/*! Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one or more contributor license agreements.
 * Licensed under the Elastic License 2.0; you may not use this file except in compliance with the Elastic License 2.0. */
(window.securitySolution_bundle_jsonpfunction=window.securitySolution_bundle_jsonpfunction||[]).push([[24,6,8,11,12,13],Array(105).concat([function(e,t,a){"use strict";a.d(t,"b",(function(){return s})),a.d(t,"a",(function(){return o}));var n=a(103),i=a(130),r=a.n(i);const s=e=>Object(n.useSelector)(e,n.shallowEqual),o=e=>Object(n.useSelector)(e,r.a)},function(e,t,a){"use strict";a.d(t,"a",(function(){return y})),a.d(t,"k",(function(){return M})),a.d(t,"d",(function(){return F})),a.d(t,"g",(function(){return D})),a.d(t,"l",(function(){return P})),a.d(t,"j",(function(){return B})),a.d(t,"e",(function(){return q})),a.d(t,"c",(function(){return $})),a.d(t,"m",(function(){return U})),a.d(t,"i",(function(){return H})),a.d(t,"h",(function(){return G})),a.d(t,"f",(function(){return Q})),a.d(t,"n",(function(){return J})),a.d(t,"o",(function(){return Z})),a.d(t,"b",(function(){return ie}));var n=a(43),i=a(112),r=a(145),s=a(113);const o=Object(r.c)(n.array(n.string)),l=(n.intersection([n.type({eventId:n.string}),n.partial({pinnedEventId:Object(r.c)(n.string),timelineId:Object(r.c)(n.string)})]),n.intersection([n.type({timelineId:n.string,eventId:n.string}),n.partial({created:Object(r.c)(n.number),createdBy:Object(r.c)(n.string),updated:Object(r.c)(n.number),updatedBy:Object(r.c)(n.string)})])),c=n.intersection([n.type({pinnedEventId:n.string,version:n.string}),l,n.partial({timelineVersion:Object(r.c)(n.string)})]);var u=a(207),d=a(373);const p=n.intersection([n.type({timelineId:Object(r.c)(n.string)}),n.partial({eventId:Object(r.c)(n.string),note:Object(r.c)(n.string),created:Object(r.c)(n.number),createdBy:Object(r.c)(n.string),updated:Object(r.c)(n.number),updatedBy:Object(r.c)(n.string)})]),m=n.intersection([p,n.type({noteId:n.string,version:n.string}),n.partial({timelineVersion:Object(r.c)(n.string)})]),b=n.partial({aggregatable:Object(r.c)(n.boolean),category:Object(r.c)(n.string),columnHeaderType:Object(r.c)(n.string),description:Object(r.c)(n.string),example:Object(r.c)(n.string),indexes:Object(r.c)(n.array(n.string)),id:Object(r.c)(n.string),name:Object(r.c)(n.string),placeholder:Object(r.c)(n.string),searchable:Object(r.c)(n.boolean),type:Object(r.c)(n.string)}),g=n.partial({field:Object(r.c)(n.string),displayField:Object(r.c)(n.string),value:n.union([n.null,n.string,n.array(n.string)]),displayValue:Object(r.c)(n.string),operator:Object(r.c)(n.string)}),f=n.partial({id:Object(r.c)(n.string),name:Object(r.c)(n.string),enabled:Object(r.c)(n.boolean),excluded:Object(r.c)(n.boolean),kqlQuery:Object(r.c)(n.string),queryMatch:Object(r.c)(g)});let y;!function(e){e.default="default",e.template="template"}(y||(y={}));const h=n.union([n.literal(y.default),n.literal(y.template)]),v=n.partial({id:Object(r.c)(n.string),name:Object(r.c)(n.string),enabled:Object(r.c)(n.boolean),excluded:Object(r.c)(n.boolean),kqlQuery:Object(r.c)(n.string),queryMatch:Object(r.c)(g),and:Object(r.c)(n.array(f)),type:Object(r.c)(h)}),E=n.partial({alias:Object(r.c)(n.string),controlledBy:Object(r.c)(n.string),disabled:Object(r.c)(n.boolean),field:Object(r.c)(n.string),formattedValue:Object(r.c)(n.string),index:Object(r.c)(n.string),key:Object(r.c)(n.string),negate:Object(r.c)(n.boolean),params:Object(r.c)(n.string),type:Object(r.c)(n.string),value:Object(r.c)(n.string)}),x=n.partial({exists:Object(r.c)(n.string),meta:Object(r.c)(E),match_all:Object(r.c)(n.string),missing:Object(r.c)(n.string),query:Object(r.c)(n.string),range:Object(r.c)(n.string),script:Object(r.c)(n.string)}),j=n.partial({eventCategoryField:Object(r.c)(n.string),query:Object(r.c)(n.string),tiebreakerField:Object(r.c)(n.string),timestampField:Object(r.c)(n.string),size:Object(r.c)(n.union([n.string,n.number]))}),S=n.partial({kind:Object(r.c)(n.string),expression:Object(r.c)(n.string)}),k=n.partial({kuery:Object(r.c)(S),serializedQuery:Object(r.c)(n.string)}),O=n.partial({filterQuery:Object(r.c)(k)}),w=n.partial({start:Object(r.c)(n.union([n.string,n.number])),end:Object(r.c)(n.union([n.string,n.number]))}),T=n.partial({keySearch:Object(r.c)(n.string),favoriteDate:Object(r.c)(n.number),fullName:Object(r.c)(n.string),userName:Object(r.c)(n.string)}),I=n.partial({columnId:Object(r.c)(n.string),columnType:Object(r.c)(n.string),sortDirection:Object(r.c)(n.string)}),C=n.union([n.array(I),I]);let M;!function(e){e.active="active",e.draft="draft",e.immutable="immutable"}(M||(M={}));const _=n.union([n.literal(M.active),n.literal(M.draft),n.literal(M.immutable)]);let F;Object(r.c)(_),function(e){e.alert="alert",e.alerts="alerts",e.auditd="auditd",e.auditd_file="auditd_file",e.library="library",e.netflow="netflow",e.plain="plain",e.registry="registry",e.suricata="suricata",e.system="system",e.system_dns="system_dns",e.system_endgame_process="system_endgame_process",e.system_file="system_file",e.system_fim="system_fim",e.system_security_event="system_security_event",e.system_socket="system_socket",e.threat_match="threat_match",e.zeek="zeek"}(F||(F={}));const A=Object(r.b)(F,"RowRendererId");let D;!function(e){e.elastic="elastic",e.custom="custom"}(D||(D={}));const N=n.union([n.literal(D.elastic),n.literal(D.custom)]);let P;Object(r.c)(N),function(e){e.default="default",e.template="template"}(P||(P={}));const R=n.union([n.literal(P.template),n.literal(P.default)]),L=(Object(r.c)(R),n.partial({columns:Object(r.c)(n.array(b)),dataProviders:Object(r.c)(n.array(v)),dataViewId:Object(r.c)(n.string),description:Object(r.c)(n.string),eqlOptions:Object(r.c)(j),eventType:Object(r.c)(n.string),excludedRowRendererIds:Object(r.c)(n.array(A)),favorite:Object(r.c)(n.array(T)),filters:Object(r.c)(n.array(x)),indexNames:Object(r.c)(n.array(n.string)),kqlMode:Object(r.c)(n.string),kqlQuery:Object(r.c)(O),title:Object(r.c)(n.string),templateTimelineId:Object(r.c)(n.string),templateTimelineVersion:Object(r.c)(n.number),timelineType:Object(r.c)(R),dateRange:Object(r.c)(w),savedQueryId:Object(r.c)(n.string),sort:Object(r.c)(C),status:Object(r.c)(_),created:Object(r.c)(n.number),createdBy:Object(r.c)(n.string),updated:Object(r.c)(n.number),updatedBy:Object(r.c)(n.string)})),B=n.intersection([L,n.type({savedObjectId:n.string,version:n.string}),n.partial({eventIdToNoteIds:n.array(m),noteIds:n.array(n.string),notes:n.array(m),pinnedEventIds:n.array(n.string),pinnedEventsSaveObject:n.array(c)})]),q=n.type({data:n.type({getOneTimeline:B})}),z=n.intersection([n.type({timeline:B,outcome:u.O}),n.partial({alias_target_id:u.N,alias_purpose:u.M})]),$=n.type({data:z}),V=n.type({timeline:n.array(B),totalCount:n.number}),U=n.intersection([V,n.type({defaultTimelineCount:n.number,templateTimelineCount:n.number,elasticTemplateTimelineCount:n.number,customTemplateTimelineCount:n.number,favoriteCount:n.number})]),H=n.type({data:n.type({persistTimeline:n.intersection([n.partial({code:Object(r.c)(n.number),message:Object(r.c)(n.string)}),n.type({timeline:B})])})}),G=n.type({status_code:n.number,message:n.string});let Q;!function(e){e.title="title",e.description="description",e.updated="updated",e.created="created"}(Q||(Q={}));const W=n.union([n.literal(Q.title),n.literal(Q.description),n.literal(Q.updated),n.literal(Q.created)]),K=n.union([n.literal(s.b.asc),n.literal(s.b.desc)]),Y=n.type({sortField:W,sortOrder:K}),J=n.exact(n.type({success:d.h,success_count:d.i,timelines_installed:i.n,timelines_updated:i.n,errors:n.array(d.g)})),X=n.partial({fullName:Object(r.c)(n.string),userName:Object(r.c)(n.string),favoriteDate:Object(r.c)(n.number)}),Z=n.partial({savedObjectId:n.string,version:n.string,code:Object(r.c)(n.number),message:Object(r.c)(n.string),templateTimelineId:Object(r.c)(n.string),templateTimelineVersion:Object(r.c)(n.number),timelineType:Object(r.c)(R),favorite:Object(r.c)(n.array(X))}),ee=n.type({pageIndex:n.number,pageSize:n.number}),te=(n.partial({onlyUserFavorite:Object(r.c)(n.boolean),pageInfo:Object(r.c)(ee),search:Object(r.c)(n.string),sort:Object(r.c)(Y),status:Object(r.c)(_),timelineType:Object(r.c)(R)}),n.type({timelineType:R}),n.type({timelineType:R}),n.intersection([n.type({timeline:L}),n.partial({status:Object(r.c)(_),timelineId:Object(r.c)(n.string),templateTimelineId:Object(r.c)(n.string),templateTimelineVersion:Object(r.c)(n.number),timelineType:Object(r.c)(R),version:Object(r.c)(n.string)})]),n.partial({noteId:Object(r.c)(n.string)}),n.type({savedObjectIds:n.array(n.string)}),n.type({file_name:n.string}),n.partial({ids:Object(r.c)(n.array(n.string))}),n.partial({template_timeline_id:n.string,id:n.string}),n.union([n.literal("true"),n.literal("false")])),ae=(n.partial({only_user_favorite:Object(r.c)(te),page_index:Object(r.c)(n.string),page_size:Object(r.c)(n.string),search:Object(r.c)(n.string),sort_field:W,sort_order:K,status:Object(r.c)(_),timeline_type:Object(r.c)(R)}),Object(r.c)(n.array(p))),ne=Object(r.c)(n.array(p)),ie=n.intersection([L,n.type({savedObjectId:Object(r.c)(n.string),version:Object(r.c)(n.string)}),n.type({globalNotes:ne,eventNotes:ae,pinnedEventIds:o})]),re=n.partial({_maxListeners:n.unknown,_readableState:n.unknown,_read:n.unknown,readable:n.boolean,_events:n.unknown,_eventsCount:n.number,_data:n.unknown,_position:n.number,_encoding:n.string}),se=n.union([n.literal("true"),n.literal("false")]);n.intersection([n.type({file:n.intersection([re,n.type({hapi:n.type({filename:n.string,headers:n.unknown})})])}),n.partial({isImmutable:se})]),n.type({timeline:L,timelineId:Object(r.c)(n.string),version:Object(r.c)(n.string)}),n.type({timelineId:Object(r.c)(n.string),templateTimelineId:Object(r.c)(n.string),templateTimelineVersion:Object(r.c)(n.number),timelineType:Object(r.c)(R)}),n.intersection([n.type({note:p}),n.partial({overrideOwner:Object(r.c)(n.boolean),noteId:Object(r.c)(n.string),version:Object(r.c)(n.string)})]),n.type({timelinesToInstall:n.array(Object(r.c)(ie)),timelinesToUpdate:n.array(Object(r.c)(ie)),prepackagedTimelines:n.array(Object(r.c)(B))})},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(2);const i=e=>Object(n.useCallback)(((t="")=>{if(e)return`${e}${t?`-${t}`:""}`}),[e])},,,function(e,t,a){"use strict";a.r(t),a.d(t,"SourcererScopeName",(function(){return i})),a.d(t,"initSourcererScope",(function(){return r})),a.d(t,"initDataView",(function(){return s})),a.d(t,"initialSourcererState",(function(){return o}));var n=a(54);let i;!function(e){e.default="default",e.detections="detections",e.timeline="timeline"}(i||(i={}));const r={loading:!1,selectedDataViewId:null,selectedPatterns:[],missingPatterns:[]},s={browserFields:n.EMPTY_BROWSER_FIELDS,id:"",indexFields:n.EMPTY_INDEX_FIELDS,fields:void 0,loading:!1,patternList:[],runtimeMappings:{},title:"",dataView:void 0},o={defaultDataView:s,kibanaDataViews:[],signalIndexName:null,sourcererScopes:{[i.default]:{...r,id:i.default},[i.detections]:{...r,id:i.detections},[i.timeline]:{...r,id:i.timeline}}}},function(e,t,a){"use strict";var n=a(12);a.d(t,"a",(function(){return n}));var i=a(376);a.d(t,"b",(function(){return i}))},,function(e,t,a){"use strict";a.d(t,"b",(function(){return n.a})),a.d(t,"h",(function(){return i.f})),a.d(t,"i",(function(){return i.g})),a.d(t,"j",(function(){return i.h})),a.d(t,"x",(function(){return i.w})),a.d(t,"y",(function(){return i.x})),a.d(t,"H",(function(){return i.F})),a.d(t,"c",(function(){return i.b})),a.d(t,"z",(function(){return i.y})),a.d(t,"F",(function(){return i.D})),a.d(t,"G",(function(){return i.E})),a.d(t,"D",(function(){return i.B})),a.d(t,"E",(function(){return i.C})),a.d(t,"C",(function(){return i.A})),a.d(t,"v",(function(){return i.u})),a.d(t,"w",(function(){return i.v})),a.d(t,"l",(function(){return i.j})),a.d(t,"n",(function(){return i.m})),a.d(t,"t",(function(){return i.s})),a.d(t,"f",(function(){return i.d})),a.d(t,"g",(function(){return i.e})),a.d(t,"o",(function(){return i.n})),a.d(t,"p",(function(){return i.o})),a.d(t,"q",(function(){return i.p})),a.d(t,"s",(function(){return i.r})),a.d(t,"u",(function(){return i.t})),a.d(t,"r",(function(){return i.q})),a.d(t,"m",(function(){return i.l})),a.d(t,"a",(function(){return i.a})),a.d(t,"B",(function(){return i.z})),a.d(t,"d",(function(){return i.c})),a.d(t,"k",(function(){return r.b})),a.d(t,"A",(function(){return r.c})),a.d(t,"e",(function(){return r.a}));var n=a(536),i=a(338),r=a(530);a(54)},function(e,t,a){"use strict";let n;a.d(t,"a",(function(){return n})),function(e){e.global="global",e.timeline="timeline",e.socTrends="socTrends"}(n||(n={}))},function(e,t,a){"use strict";a.r(t),a.d(t,"parseRoute",(function(){return g})),a.d(t,"manageOldSiemRoutes",(function(){return f})),a.d(t,"getInspectResponse",(function(){return y})),a.d(t,"isDetectionsPath",(function(){return h})),a.d(t,"isTourPath",(function(){return v})),a.d(t,"isThreatIntelligencePath",(function(){return E})),a.d(t,"getSubPluginRoutesByCapabilities",(function(){return x})),a.d(t,"isSubPluginAvailable",(function(){return j})),a.d(t,"getFieldKey",(function(){return O})),a.d(t,"getField",(function(){return w})),a.d(t,"isTimelineScope",(function(){return T})),a.d(t,"isInTableScope",(function(){return I})),a.d(t,"isAlertsPageScope",(function(){return C})),a.d(t,"getScopedActions",(function(){return M})),a.d(t,"getScopedSelectors",(function(){return _})),a.d(t,"isActiveTimeline",(function(){return F})),a.d(t,"getSourcererScopeId",(function(){return A}));var n=a(129),i=a(42),r=a(2),s=a.n(r),o=a(45),l=a(119),c=a(4),u=a(698),d=a(131),p=a(111),m=a(142),b=a(110);const g=e=>{if(!Object(i.isEmpty)(e.hash)){var t;const a=e.hash.split("?"),n=a.length>=1?`?${a[1]}`:"",i=a.length>0?a[0].split("/"):[];return{pageName:i.length>=1?i[1]:"",path:`/${null!==(t=i.slice(2).join("/"))&&void 0!==t?t:""}${n}`,search:n}}const a=e.search,n=e.pathname.split("/");return{pageName:n[3],path:`${n.length>4?`/${n.slice(4).join("/")}`:""}${a}`,search:a}},f=async e=>{const{application:t}=e,{pageName:a,path:n}=g(window.location);switch(a){case d.a.overview:t.navigateToApp(c.l,{deepLinkId:d.a.overview,replace:!0,path:n});break;case"ml-hosts":t.navigateToApp(c.l,{deepLinkId:d.a.hosts,replace:!0,path:`/ml-hosts${n}`});break;case d.a.hosts:t.navigateToApp(c.l,{deepLinkId:d.a.hosts,replace:!0,path:n});break;case"ml-network":t.navigateToApp(c.l,{deepLinkId:d.a.network,replace:!0,path:`/ml-network${n}`});break;case d.a.network:t.navigateToApp(c.l,{deepLinkId:d.a.network,replace:!0,path:n});break;case d.a.timelines:t.navigateToApp(c.l,{deepLinkId:d.a.timelines,replace:!0,path:n});break;case d.a.case:case"case":t.navigateToApp(c.l,{deepLinkId:d.a.case,replace:!0,path:n});break;case d.a.detections:case d.a.alerts:t.navigateToApp(c.l,{deepLinkId:d.a.alerts,replace:!0,path:n});break;case d.a.rules:t.navigateToApp(c.l,{deepLinkId:d.a.rules,replace:!0,path:n});break;case d.a.exceptions:t.navigateToApp(c.l,{deepLinkId:d.a.exceptions,replace:!0,path:n});break;default:t.navigateToApp(c.l,{deepLinkId:d.a.landing,replace:!0,path:n})}},y=(e,t)=>{var a,n,i;return{dsl:null!==(a=null!==(n=null==e||null===(i=e.inspect)||void 0===i?void 0:i.dsl)&&void 0!==n?n:null==t?void 0:t.dsl)&&void 0!==a?a:[],response:null!=e?[JSON.stringify(e.rawResponse,null,2)]:null==t?void 0:t.response}},h=e=>!!Object(o.matchPath)(e,{path:`(${c.d}|${c.mc}|${c.tb})`,strict:!1}),v=e=>(e=>!!Object(o.matchPath)(e,{path:`${c.d}`,strict:!1}))(e)||(e=>!!Object(o.matchPath)(e,{path:`${c.r}/:detailName`,strict:!1}))(e),E=e=>!!Object(o.matchPath)(e,{path:`(${c.xc})`,strict:!1}),x=(e,t,a)=>Object.entries(e).reduce(((e,[n,i])=>{if(j(n,t))e.push(...i.routes);else{const t=e=>e.siem.privileges;e.push(...i.routes.map((e=>({path:e.path,component:()=>{const e=a.upselling.getPageUpselling(n);return e?s.a.createElement(e,null):s.a.createElement(u.b,{pageName:n,docLinkSelector:t})}}))))}return e}),[]),j=(e,t)=>"cases"===e?!0===t[c.q].read_cases:!0===t[c.tc].show,S={[n.S]:"signal.rule.id",[n.D]:"signal.rule.name",[`${n.G}.filters`]:"signal.rule.filters",[`${n.G}.language`]:"signal.rule.language",[`${n.G}.query`]:"signal.rule.query"},k={"signal.rule.id":n.S,"signal.rule.name":n.D,"signal.rule.filters":`${n.G}.filters`,"signal.rule.language":`${n.G}.language`,"signal.rule.query":`${n.G}.query`},O=(e,t)=>{var a,n;const r=(null!==(a=k[t])&&void 0!==a?a:t).replace("signal","kibana.alert"),s=(null!==(n=S[t])&&void 0!==n?n:t).replace("kibana.alert","signal");return Object(i.has)(r,e)?r:s},w=(e,t)=>{var a,n,r;const s=(null!==(a=k[t])&&void 0!==a?a:t).replace("signal","kibana.alert"),o=(null!==(n=S[t])&&void 0!==n?n:t).replace("kibana.alert","signal"),l=s.split(".");if(l.includes("parameters")&&"parameters"!==l[l.length-1]){const t=l.slice(0,l.length-1).join("."),a=Object(i.get)(t,e);return Object(i.get)(l[l.length-1],a)}return null!==(r=Object(i.get)(s,e))&&void 0!==r?r:Object(i.get)(o,e)},T=e=>Object.values(m.f).includes(e),I=e=>Object.values(l.e).includes(e),C=e=>[l.e.alertsOnAlertsPage,l.e.alertsOnRuleDetailsPage,l.e.alertsOnCasePage].includes(e),M=e=>T(e)?p.a:I(e)?l.h:void 0,_=e=>T(e)?p.a:I(e)?l.h:void 0,F=e=>e===m.f.active,A=e=>T(e)?b.SourcererScopeName.timeline:C(e)?b.SourcererScopeName.detections:b.SourcererScopeName.default},function(e,t,a){"use strict";a.d(t,"c",(function(){return S})),a.d(t,"d",(function(){return k})),a.d(t,"a",(function(){return w})),a.d(t,"b",(function(){return I}));var n=a(2),i=a(103),r=a(5),s=a(45),o=a(158),l=a(110),c=a(181),u=a(111),d=a(4),p=a(142),m=a(105),b=a(477),g=a(108),f=a(689),y=a(377),h=a(183),v=a(160),E=a(221),x=a(340),j=a(102);const S=(e=l.SourcererScopeName.default)=>{const t=Object(i.useDispatch)(),{data:{dataViews:a}}=Object(j.j)().services,s=Object(n.useRef)(new AbortController),d=Object(n.useRef)(!0),h=Object(n.useRef)(!0),{loading:x,isSignalIndexExists:S,signalIndexName:O}=Object(c.c)(),w=Object(v.d)(E.a.sourcerer),T=Object(n.useMemo)((()=>o.d.getSourcererDataViewsSelector()),[]),{defaultDataView:I,signalIndexName:C}=Object(m.a)((e=>T(e))),{addError:M,addWarning:_}=Object(g.a)();Object(n.useEffect)((()=>{null!=I.error&&_({title:r.i18n.translate("xpack.securitySolution.sourcerer.permissions.title",{defaultMessage:"Write role required to generate data"}),text:r.i18n.translate("xpack.securitySolution.sourcerer.permissions.toastMessage",{defaultMessage:"Users with write permission need to access the Elastic Security app to initialize the app source data."})})}),[_,I.error]);const F=Object(n.useMemo)((()=>u.b.getTimelineByIdSelector()),[]),A=Object(m.a)((e=>F(e,p.f.active))),D=Object(n.useMemo)((()=>o.d.getSourcererScopeSelector()),[]),{sourcererScope:{selectedDataViewId:N,selectedPatterns:P,missingPatterns:R}}=Object(m.a)((t=>D(t,e))),{selectedDataView:L,sourcererScope:{selectedDataViewId:B,selectedPatterns:q,missingPatterns:z}}=Object(m.a)((e=>D(e,l.SourcererScopeName.timeline))),{indexFieldsSearch:$}=Object(y.b)(),V=Object(n.useCallback)((a=>{null!=a?Object.keys(a).forEach((n=>{var i,r,s,c;n===l.SourcererScopeName.default&&e===l.SourcererScopeName.detections||t(o.a.setSelectedDataView({id:n,selectedDataViewId:null!==(i=null===(r=a[n])||void 0===r?void 0:r.id)&&void 0!==i?i:null,selectedPatterns:null!==(s=null===(c=a[n])||void 0===c?void 0:c.selectedPatterns)&&void 0!==s?s:[]}))})):N&&w({[l.SourcererScopeName.default]:{id:N,selectedPatterns:P}})}),[t,N,e,P,w]);Object(v.b)(E.a.sourcerer,V);const U=Object(n.useRef)([]);Object(n.useEffect)((()=>{[...new Set([N,B])].forEach(((e,t)=>{if(null!=e&&e.length>0&&!U.current.includes(e)){U.current=[...U.current,e];const a=0===t?l.SourcererScopeName.default:l.SourcererScopeName.timeline,n=e===N?0===P.length&&0===R.length:B===e&&0===z.length&&0===(null==L?void 0:L.patternList.length);$({dataViewId:e,scopeId:a,needToBeInit:n,...n&&a===l.SourcererScopeName.timeline?{skipScopeUpdate:q.length>0}:{}})}}))}),[$,R.length,N,P.length,B,z.length,L,q.length]),Object(n.useEffect)((()=>{!x&&null!=O&&null==C&&(null==A||null==A.savedObjectId)&&d.current&&I.id.length>0?(d.current=!1,t(o.a.setSelectedDataView({id:l.SourcererScopeName.timeline,selectedDataViewId:I.id,selectedPatterns:Object(b.b)(I,l.SourcererScopeName.timeline,O,!0)}))):null!=C&&(null==A||null==A.savedObjectId)&&d.current&&I.id.length>0&&(d.current=!1,t(o.a.setSelectedDataView({id:l.SourcererScopeName.timeline,selectedDataViewId:I.id,selectedPatterns:Object(b.b)(I,l.SourcererScopeName.timeline,C,!0)})))}),[A,I,t,x,O,C]);const{dataViewId:H}=k(e),G=Object(n.useCallback)((e=>{-1===I.title.indexOf(e)&&(s.current.abort(),(async n=>{s.current=new AbortController,t(o.a.setSourcererScopeLoading({loading:!0}));try{const i=await Object(f.a)({body:{patternList:n},signal:s.current.signal,dataViewService:a,dataViewId:H});null!=i&&i.defaultDataView.patternList.includes(e)&&($({dataViewId:i.defaultDataView.id}),t(o.a.setSourcererDataViews(i))),t(o.a.setSourcererScopeLoading({loading:!1}))}catch(e){"AbortError"===e.name||M(e,{title:r.i18n.translate("xpack.securitySolution.sourcerer.error.title",{defaultMessage:"Error updating Security Data View"}),toastMessage:r.i18n.translate("xpack.securitySolution.sourcerer.error.toastMessage",{defaultMessage:"Refresh the page"})}),t(o.a.setSourcererScopeLoading({loading:!1}))}})([...I.title.split(","),e]))}),[I.title,t,a,H,$,M]),Q=Object(n.useCallback)((()=>{!x&&null!=O&&null==C&&I.id.length>0&&(G(O),t(o.a.setSignalIndexName({signalIndexName:O})))}),[I.id.length,t,x,O,C,G]);Object(n.useEffect)((()=>{Q()}),[O]),Object(n.useEffect)((()=>{e===l.SourcererScopeName.detections&&S&&null!=O&&h.current&&I.id.length>0?(h.current=!1,t(o.a.setSelectedDataView({id:l.SourcererScopeName.detections,selectedDataViewId:I.id,selectedPatterns:Object(b.b)(I,l.SourcererScopeName.detections,O,!0)}))):e===l.SourcererScopeName.detections&&null!=C&&d.current&&I.id.length>0&&(h.current=!1,o.a.setSelectedDataView({id:l.SourcererScopeName.detections,selectedDataViewId:I.id,selectedPatterns:Object(b.b)(I,l.SourcererScopeName.detections,C,!0)}))}),[I,t,S,e,O,C])},k=(e=l.SourcererScopeName.default)=>{const{getDataViewsSelector:t,getSourcererDataViewSelector:a,getScopeSelector:i}=Object(n.useMemo)((()=>({getDataViewsSelector:o.d.getSourcererDataViewsSelector(),getSourcererDataViewSelector:o.d.sourcererDataViewSelector(),getScopeSelector:o.d.scopeIdSelector()})),[]),{defaultDataView:r,signalIndexName:s,selectedDataView:c,sourcererScope:{missingPatterns:u,selectedPatterns:d,loading:p}}=Object(m.a)((n=>{const r=i(n,e);return{...t(n),selectedDataView:a(n,r.selectedDataViewId),sourcererScope:r}})),g=Object(n.useMemo)((()=>Object(x.b)(d)),[d]),[f,v]=Object(n.useState)([]),[E,j]=Object(h.b)(f),S=Object(n.useMemo)((()=>{var e,t,a,n,i,r,s;return{...j,dataView:j.dataView,runtimeMappings:null!==(e=null===(t=j.dataView)||void 0===t?void 0:t.runtimeFieldMap)&&void 0!==e?e:{},title:null!==(a=null===(n=j.dataView)||void 0===n?void 0:n.title)&&void 0!==a?a:"",id:null!==(i=null===(r=j.dataView)||void 0===r?void 0:r.id)&&void 0!==i?i:null,loading:E,patternList:j.indexes,indexFields:j.indexPatterns.fields,fields:null===(s=j.dataView)||void 0===s?void 0:s.fields}}),[j,E]);Object(n.useEffect)((()=>{null==c||u.length>0?v(g):v([])}),[u,c,g]);const k=Object(n.useMemo)((()=>null==c||u.length>0?S:c),[S,u.length,c]),O=Object(n.useMemo)((()=>!(!p&&!k.loading)||Object(b.a)({scopeId:e,signalIndexName:s,patternList:k.patternList,isDefaultDataViewSelected:k.id===r.id})),[r.id,p,e,s,k.id,k.loading,k.patternList]),w=Object(n.useCallback)((()=>{const{browserFields:e}=Object(y.a)(k.patternList.join(","),k.fields);return e}),[k.fields,k.patternList]);return Object(n.useMemo)((()=>({browserFields:w(),dataViewId:k.id,indexPattern:{fields:k.indexFields,title:g.join(","),getName:()=>g.join(",")},indicesExist:O,loading:p||k.loading,runtimeMappings:k.runtimeMappings,patternList:k.title.split(","),selectedPatterns:g,...f.length>0?{activePatterns:k.patternList}:{},sourcererDataView:k.dataView})),[w,k,g,O,p,f.length])},O=[d.d,`${d.mc}/id/:id`,`${d.r}/:detailName`],w=e=>null==Object(s.matchPath)(e,{path:O,strict:!1})?l.SourcererScopeName.default:l.SourcererScopeName.detections,T=[d.d,d.u,`${d.mc}/id/:id`,d.zb,d.Ic,d.Mb,d.Tb],I=e=>null!=Object(s.matchPath)(e,{path:T,strict:!1})},function(e,t,a){"use strict";a.d(t,"e",(function(){return u})),a.d(t,"b",(function(){return d})),a.d(t,"d",(function(){return p})),a.d(t,"c",(function(){return m})),a.d(t,"a",(function(){return b})),a.d(t,"f",(function(){return g}));var n=a(42),i=a(2),r=a.n(i),s=a(41),o=a.n(s);const l=a(5).i18n.translate("xpack.securitySolution.emptyString.emptyStringDescription",{defaultMessage:"Empty string"}),c=o.a.span.withConfig({displayName:"EmptyWrapper",componentId:"sc-1h9raim-0"})(["color:",";"],(e=>e.theme.eui.euiColorMediumShade));c.displayName="EmptyWrapper";const u=()=>"—",d=()=>`(${l})`,p=()=>r.a.createElement(c,null,u()),m=()=>r.a.createElement(c,null,d()),b=e=>null==e?p():Object(n.isString)(e)&&""===e?m():r.a.createElement(r.a.Fragment,null,e),g=e=>null==e?p():""===e?m():r.a.createElement(r.a.Fragment,null,e)},function(e,t,a){"use strict";a.d(t,"b",(function(){return n.IS_OPERATOR})),a.d(t,"a",(function(){return n.EXISTS_OPERATOR})),a.d(t,"d",(function(){return i})),a.d(t,"c",(function(){return r}));var n=a(54);let i,r;!function(e){e.query="query",e.graph="graph",e.notes="notes",e.pinned="pinned",e.eql="eql",e.session="session",e.securityAssistant="securityAssistant",e.discover="discover"}(i||(i={})),function(e){e.active="timeline-1",e.casePage="timeline-case",e.test="timeline-test",e.detectionsAlertDetailsPage="detections-alert-details-page"}(r||(r={}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return Me})),a.d(t,"h",(function(){return n})),a.d(t,"j",(function(){return i})),a.d(t,"o",(function(){return xe})),a.d(t,"i",(function(){return Ye})),a.d(t,"q",(function(){return M})),a.d(t,"k",(function(){return I})),a.d(t,"l",(function(){return C})),a.d(t,"b",(function(){return v.Direction})),a.d(t,"r",(function(){return S})),a.d(t,"c",(function(){return w})),a.d(t,"f",(function(){return O})),a.d(t,"e",(function(){return x})),a.d(t,"d",(function(){return j})),a.d(t,"m",(function(){return R})),a.d(t,"g",(function(){return z})),a.d(t,"p",(function(){return L})),a.d(t,"n",(function(){return ke}));var n={};a.r(n),a.d(n,"createDataTable",(function(){return H})),a.d(n,"upsertColumn",(function(){return G})),a.d(n,"applyDeltaToColumnWidth",(function(){return Q})),a.d(n,"updateColumnOrder",(function(){return W})),a.d(n,"updateColumnWidth",(function(){return K})),a.d(n,"toggleDetailPanel",(function(){return Y})),a.d(n,"removeColumn",(function(){return J})),a.d(n,"updateIsLoading",(function(){return X})),a.d(n,"updateColumns",(function(){return Z})),a.d(n,"updateItemsPerPage",(function(){return ee})),a.d(n,"updateItemsPerPageOptions",(function(){return te})),a.d(n,"updateSort",(function(){return ae})),a.d(n,"setSelected",(function(){return ne})),a.d(n,"clearSelected",(function(){return ie})),a.d(n,"setEventsLoading",(function(){return re})),a.d(n,"clearEventsLoading",(function(){return se})),a.d(n,"setEventsDeleted",(function(){return oe})),a.d(n,"clearEventsDeleted",(function(){return le})),a.d(n,"initializeDataTableSettings",(function(){return ce})),a.d(n,"setDataTableSelectAll",(function(){return ue})),a.d(n,"updateGraphEventId",(function(){return de})),a.d(n,"updateSessionViewConfig",(function(){return pe})),a.d(n,"setTableUpdatedAt",(function(){return me})),a.d(n,"updateTotalCount",(function(){return be})),a.d(n,"changeViewMode",(function(){return ge})),a.d(n,"updateShowBuildingBlockAlertsFilter",(function(){return fe})),a.d(n,"updateShowThreatIndicatorAlertsFilter",(function(){return ye}));var i={};a.r(i),a.d(i,"tableByIdSelector",(function(){return ve})),a.d(i,"getTableByIdSelector",(function(){return xe})),a.d(i,"getManageDataTableById",(function(){return Se}));var r=a(104),s=a.n(r),o=a(40),l=a(42),c=a(240),u=a.n(c),d=a(2),p=a.n(d),m=a(103),b=a(41),g=a.n(b),f=a(5),y=a(247);const h=180;var v=a(54),E=a(43);let x,j;!function(e){e.usersPageEvents="users-page-events",e.hostsPageEvents="hosts-page-events",e.networkPageEvents="network-page-events",e.hostsPageSessions="hosts-page-sessions-v2",e.alertsOnRuleDetailsPage="alerts-rules-details-page",e.alertsOnAlertsPage="alerts-page",e.test="table-test",e.alternateTest="alternateTest",e.rulePreview="rule-preview",e.kubernetesPageSessions="kubernetes-page-sessions",e.alertsOnCasePage="alerts-case-page",e.alertsRiskInputs="alerts-risk-inputs"}(x||(x={})),function(e){e.alert="alert",e.event="event",e.session="session"}(j||(j={}));const S={[x.alertsOnAlertsPage]:j.alert,[x.alertsOnCasePage]:j.alert,[x.alertsOnRuleDetailsPage]:j.alert,[x.hostsPageEvents]:j.event,[x.networkPageEvents]:j.event,[x.usersPageEvents]:j.event,[x.test]:j.event,[x.alternateTest]:j.event,[x.rulePreview]:j.event,[x.hostsPageSessions]:j.session,[x.kubernetesPageSessions]:j.session,[x.alertsRiskInputs]:j.alert};let k,O;E.union([E.literal(x.usersPageEvents),E.literal(x.hostsPageEvents),E.literal(x.networkPageEvents),E.literal(x.hostsPageSessions),E.literal(x.alertsOnRuleDetailsPage),E.literal(x.alertsOnAlertsPage),E.literal(x.test),E.literal(x.rulePreview),E.literal(x.kubernetesPageSessions),E.literal(x.alertsOnCasePage),E.literal(x.alertsRiskInputs)]),function(e){e.destination="destination",e.source="source"}(k||(k={})),function(e){e.query="query",e.graph="graph",e.notes="notes",e.pinned="pinned",e.eql="eql",e.session="session"}(O||(O={}));const w="open",T=f.i18n.translate("securitySolutionPackages.dataTable.loadingEventsDataLabel",{defaultMessage:"Loading Events"}),I="not-filtered",C=[{columnHeaderType:I,id:"@timestamp",initialWidth:190,esTypes:["date"],type:"date"},{columnHeaderType:I,id:"message",initialWidth:h},{columnHeaderType:I,id:"event.category",initialWidth:h},{columnHeaderType:I,id:"event.action",initialWidth:h},{columnHeaderType:I,id:"host.name",initialWidth:h},{columnHeaderType:I,id:"source.ip",initialWidth:h},{columnHeaderType:I,id:"destination.ip",initialWidth:h},{columnHeaderType:I,id:"user.name",initialWidth:h}],M={defaultColumns:C,dataViewId:null,deletedEventIds:[],expandedDetail:{},filters:[],indexNames:[],isSelectAllChecked:!1,isLoading:!1,itemsPerPage:25,itemsPerPageOptions:[10,25,50,100],loadingEventIds:[],selectedEventIds:{},showCheckboxes:!1,sort:[{columnId:"@timestamp",columnType:"date",esTypes:["date"],sortDirection:"desc"}],selectAll:!1,graphEventId:"",sessionViewConfig:null,columns:C,queryFields:[],title:"",totalCount:0,viewMode:"gridView",additionalFilters:{showBuildingBlockAlerts:!1,showOnlyThreatIndicatorAlerts:!1}},_=e=>({defaultColumns:C,loadingText:T,documentType:"",selectAll:!1,id:e,isLoading:!1,queryFields:[],title:"",unit:e=>{return t=e,f.i18n.translate("securitySolutionPackages.dataTable.unit",{values:{totalCount:t},defaultMessage:"{totalCount, plural, =1 {alert} other {alerts}}"});var t},graphEventId:""});var F=a(21);const A={showSortAsc:!0,showSortDesc:!0,showHide:!1},D=({browserField:e,fieldName:t})=>{var a;const n=null!==(a=null==e?void 0:e.aggregatable)&&void 0!==a&&a;return["kibana.alert.ancestors.depth","kibana.alert.ancestors.id","kibana.alert.ancestors.rule","kibana.alert.ancestors.type","kibana.alert.original_event.action","kibana.alert.original_event.category","kibana.alert.original_event.code","kibana.alert.original_event.created","kibana.alert.original_event.dataset","kibana.alert.original_event.duration","kibana.alert.original_event.end","kibana.alert.original_event.hash","kibana.alert.original_event.id","kibana.alert.original_event.kind","kibana.alert.original_event.module","kibana.alert.original_event.original","kibana.alert.original_event.outcome","kibana.alert.original_event.provider","kibana.alert.original_event.risk_score","kibana.alert.original_event.risk_score_norm","kibana.alert.original_event.sequence","kibana.alert.original_event.severity","kibana.alert.original_event.start","kibana.alert.original_event.timezone","kibana.alert.original_event.type","kibana.alert.original_time","kibana.alert.reason","kibana.alert.rule.created_by","kibana.alert.rule.description","kibana.alert.rule.enabled","kibana.alert.rule.false_positives","kibana.alert.rule.from","kibana.alert.rule.uuid","kibana.alert.rule.immutable","kibana.alert.rule.interval","kibana.alert.rule.max_signals","kibana.alert.rule.name","kibana.alert.rule.note","kibana.alert.rule.references","kibana.alert.risk_score","kibana.alert.rule.rule_id","kibana.alert.severity","kibana.alert.rule.size","kibana.alert.rule.tags","kibana.alert.rule.threat","kibana.alert.rule.threat.tactic.id","kibana.alert.rule.threat.tactic.name","kibana.alert.rule.threat.tactic.reference","kibana.alert.rule.threat.technique.id","kibana.alert.rule.threat.technique.name","kibana.alert.rule.threat.technique.reference","kibana.alert.rule.timeline_id","kibana.alert.rule.timeline_title","kibana.alert.rule.to","kibana.alert.rule.type","kibana.alert.rule.updated_by","kibana.alert.rule.version","kibana.alert.workflow_status"].includes(t)||n},N=e=>{switch(e){case"date":case"date_nanos":return"datetime";case"double":case"long":case"number":return"numeric";case"object":return"json";case"boolean":return"boolean";default:return}},P=[{columnHeaderType:I,id:"@timestamp",displayAsText:f.i18n.translate("securitySolutionPackages.dataTable.eventRenderedView.timestampTitle.column",{defaultMessage:"Timestamp"}),initialWidth:240,actions:!1,isExpandable:!1,isResizable:!1},{columnHeaderType:I,displayAsText:f.i18n.translate("securitySolutionPackages.dataTable.eventRenderedView.ruleTitle.column",{defaultMessage:"Rule"}),id:"kibana.alert.rule.name",initialWidth:230,linkField:"kibana.alert.rule.uuid",actions:!1,isExpandable:!1,isResizable:!1},{columnHeaderType:I,id:"eventSummary",displayAsText:f.i18n.translate("securitySolutionPackages.dataTable.eventRenderedView.eventSummary.column",{defaultMessage:"Event Summary"}),actions:!1,isExpandable:!1,isResizable:!1}],R=(e,t,a,n)=>e.reduce(((e,i)=>({...e,...n&&t.includes(i._id)?{[i._id]:i.data.filter((e=>a.includes(e.field)))}:{}})),{}),L=e=>{var t,a;return!Object(l.isEmpty)(null===(t=e.kibana)||void 0===t||null===(a=t.alert)||void 0===a?void 0:a.building_block_type)},B=e=>{switch(e){case"asc":case"desc":return e;default:return"desc"}},q=({columns:e,columnHeaders:t})=>e.map((({id:e,direction:a})=>{var n,i;const r=t.find((t=>t.id===e)),s=null!==(n=null==r?void 0:r.type)&&void 0!==n?n:"",o=null!==(i=null==r?void 0:r.esTypes)&&void 0!==i?i:[];return{columnId:e,columnType:s,esTypes:o,sortDirection:a}})),z=(e,t,a,n)=>{const i=null!=n?n:{};L(e)?a({style:{...i,backgroundColor:`${t.eui.euiColorHighlight}`}}):a({style:{...i,backgroundColor:"inherit"}})},$=f.i18n.translate("securitySolutionPackages.dataTable.columnHeaders.flyout.pane.removeColumnButtonLabel",{defaultMessage:"Remove column"});var V=a(22);const U=a.n(V)()("x-pack/security_solution/data-table"),H=U("CREATE_DATA_TABLE"),G=U("UPSERT_COLUMN"),Q=U("APPLY_DELTA_TO_COLUMN_WIDTH"),W=U("UPDATE_COLUMN_ORDER"),K=U("UPDATE_COLUMN_WIDTH"),Y=U("TOGGLE_DETAIL_PANEL"),J=U("REMOVE_COLUMN"),X=U("UPDATE_LOADING"),Z=U("UPDATE_COLUMNS"),ee=U("UPDATE_ITEMS_PER_PAGE"),te=U("UPDATE_ITEMS_PER_PAGE_OPTIONS"),ae=U("UPDATE_SORT"),ne=U("SET_DATA_TABLE_SELECTED"),ie=U("CLEAR_DATA_TABLE_SELECTED"),re=U("SET_DATA_TABLE_EVENTS_LOADING"),se=U("CLEAR_DATA_TABLE_EVENTS_LOADING"),oe=U("SET_DATA_TABLE_EVENTS_DELETED"),le=U("CLEAR_DATA_TABLE_EVENTS_DELETED"),ce=U("INITIALIZE_DATA_TABLE"),ue=U("SET_DATA_TABLE_SELECT_ALL"),de=U("UPDATE_DATA_TABLE_GRAPH_EVENT_ID"),pe=U("UPDATE_DATA_TABLE_SESSION_VIEW_CONFIG"),me=U("SET_TABLE_UPDATED_AT"),be=U("UPDATE_TOTAL_COUNT"),ge=U("CHANGE_ALERT_TABLE_VIEW_MODE"),fe=U("UPDATE_BUILDING_BLOCK_ALERTS_FILTER"),ye=U("UPDATE_SHOW_THREAT_INDICATOR_ALERTS_FILTER");var he=a(139);const ve=Object(he.createSelector)((e=>e.dataTable.tableById),(e=>e)),Ee=(e,t)=>e.dataTable.tableById[t],xe=()=>Object(he.createSelector)(Ee,(e=>e)),je=(e,t)=>{return Object(l.getOr)(Object(l.getOr)((a=t,{...M,..._(a)}),["tableById",t],e),["dataTable","tableById",t],e);var a},Se=()=>Object(he.createSelector)(je,(({dataViewId:e,defaultColumns:t,isLoading:a,loadingText:n,queryFields:i,title:r,selectAll:s,graphEventId:o})=>({dataViewId:e,defaultColumns:t,isLoading:a,loadingText:n,queryFields:i,title:r,selectAll:s,graphEventId:o}))),ke=(e,t)=>e%t,Oe=g.a.span`
  font-size: ${({theme:e})=>e.eui.euiFontSizeXS};
  font-weight: ${({theme:e})=>e.eui.euiFontWeightSemiBold};
  border-right: ${({theme:e})=>e.eui.euiBorderThin};
  margin-right: ${({theme:e})=>e.eui.euiSizeS};
  padding-right: ${({theme:e})=>e.eui.euiSizeM};
`,we=f.i18n.translate("securitySolutionPackages.dataTable.ariaLabel",{defaultMessage:"Alerts"}),Te=(e=!1)=>({border:"none",fontSize:"s",header:"underline",stripes:!0===e}),Ie=g.a.div`
  ul.euiPagination__list {
    li.euiPagination__item:last-child {
      ${({hideLastPage:e})=>e?"display:none":""};
    }
  }
  div .euiDataGridRowCell__contentByHeight {
    height: auto;
    align-self: center;
  }
  div .euiDataGridRowCell--lastColumn .euiDataGridRowCell__contentByHeight {
    flex-grow: 0;
    width: 100%;
  }
  div .siemEventsTable__trSupplement--summary {
    display: block;
  }
`,Ce=u()(((e,t,a)=>{const n=(e=>Object(l.keyBy)("name",(e=>Object.values(e).reduce(((e,t)=>[...e,...Object.values(null!=t.fields?t.fields:{})]),[]))(e)))(t),i=a?P:e;return i?i.map((e=>{var t,a,i,r;const s=n[e.id],o={...e,...s,schema:null!==(t=e.schema)&&void 0!==t?t:N(null==s?void 0:s.type)},l=Object(F.jsx)(p.a.Fragment,null,null!==(a=null!==(i=e.display)&&void 0!==i?i:e.displayAsText)&&void 0!==a?a:e.id);return{...o,actions:null!==(r=e.actions)&&void 0!==r?r:A,defaultSortDirection:"desc",display:Object(F.jsx)(p.a.Fragment,null,l),isSortable:D({browserField:s,fieldName:e.id})}})):[]})),Me=p.a.memo((({additionalControls:e,browserFields:t,bulkActions:a=!0,data:r,fieldBrowserOptions:c,hasCrudPermissions:u,id:g,leadingControlColumns:f,loadPage:v,renderCellValue:E,rowRenderers:x,pagination:j,unitCountText:S,totalItems:k,rowHeightsOptions:O,isEventRenderedView:w=!1,getFieldBrowser:T,getFieldSpec:C,cellActionsTriggerId:_,...A})=>{const D=i.getTableByIdSelector(),N=(P=e=>{var t;return null!==(t=D(e,g))&&void 0!==t?t:M},Object(m.useSelector)(P,m.shallowEqual));var P;const{columns:R,selectedEventIds:L,showCheckboxes:V,sort:U,isLoading:H,defaultColumns:G}=N,Q=Ce(R,t,w),W=Object(d.useRef)(null),K=Object(m.useDispatch)(),Y=Object(d.useMemo)((()=>Object.keys(L).length),[L]),J=Object(d.useContext)(b.ThemeContext),X=Object(d.useMemo)((()=>{var e,t;return!!u&&!(0===Y||!V)&&("boolean"==typeof a?a:null===(e=(null==a||null===(t=a.customBulkActions)||void 0===t?void 0:t.length)||(null==a?void 0:a.alertStatusActions))||void 0===e||e)}),[u,Y,V,a]),Z=Object(d.useCallback)((()=>{K(n.updateColumns({id:g,columns:G}))}),[G,K,g]),ee=Object(d.useCallback)((e=>{var t,a,i;Q.some((({id:t})=>e===t))?K(n.removeColumn({columnId:e,id:g})):K(n.upsertColumn({column:(t=e,a=G,{columnHeaderType:I,id:t,initialWidth:h,...null!==(i=a.find((e=>e.id===t)))&&void 0!==i?i:{}}),id:g,index:1}))}),[Q,K,g,G]),te=Object(d.useMemo)((()=>({additionalControls:{left:{append:Object(F.jsx)(p.a.Fragment,null,H&&Object(F.jsx)(o.EuiProgress,{size:"xs",position:"absolute",color:"accent"}),Object(F.jsx)(Oe,{"data-test-subj":"server-side-event-count"},S),null!=e?e:null,w?Object(F.jsx)(p.a.Fragment,null):T({browserFields:t,options:c,columnIds:Q.map((({id:e})=>e)),onResetColumns:Z,onToggleColumn:ee}))}},...X||w?{showColumnSelector:!1,showSortSelector:!1,showFullScreenSelector:!1}:{showColumnSelector:{allowHide:!1,allowReorder:!0},showSortSelector:!0,showFullScreenSelector:!0},showDisplaySelector:!1})),[H,S,e,w,T,t,c,Q,Z,ee,X]),ae=Object(d.useMemo)((()=>U.map((e=>({id:e.columnId,direction:B(e.sortDirection)})))),[U]),ne=Object(d.useCallback)((e=>{K(n.updateSort({id:g,sort:q({columns:e,columnHeaders:Q})})),setTimeout((()=>{null!=v&&v(0)}),0)}),[Q,K,g,v]),ie=Object(d.useMemo)((()=>Q.map((({id:e})=>e))),[Q]),re=Object(d.useCallback)((({columnId:e,width:t})=>{K(n.updateColumnWidth({columnId:e,id:g,width:t}))}),[K,g]),se=Object(d.useCallback)((e=>{K(n.updateColumnOrder({columnIds:e,id:g}))}),[K,g]),oe=Object(d.useMemo)((()=>({scopeId:g})),[g]),le=Object(d.useMemo)((()=>_?Q.map((e=>{var t;return null!==(t=C(e.id))&&void 0!==t?t:{name:e.id,type:"",aggregatable:!1,searchable:!1}})):void 0),[_,Q,C]),ce=Object(d.useCallback)(((e,t)=>{var a;const n=t%r.length;return null===(a=r[n].data.find((t=>t.field===e)))||void 0===a?void 0:a.value}),[r]),ue=Object(y.j)({triggerId:_,fields:le,getCellValue:ce,metadata:oe,dataGridRef:W}),de=Object(d.useMemo)((()=>Q.map(((e,t)=>{var a;return{...e,actions:{...e.actions,additional:[{iconType:"cross",label:$,onClick:()=>{K(n.removeColumn({id:g,columnId:e.id}))},size:"xs"}]},cellActions:null!==(a=ue[t])&&void 0!==a?a:[],visibleCellActions:3}}))),[Q,ue,K,g]),pe=Object(d.useMemo)((()=>({columnId:e,rowIndex:a,colIndex:n,setCellProps:i,isDetails:s})=>{var o;const c=ke(a,j.pageSize),u=c<r.length?r[c].data:null,p=Q.find((t=>t.id===e)),m=c<r.length?r[c]._id:null,b=c<r.length?r[c].ecs:null;return Object(d.useEffect)((()=>{const e={overflow:"hidden"};i({style:{...e}}),b&&u?z(b,J,i,e):i({style:{display:"none"}})}),[a,i,b,u]),null==u||null==p||null==m||null===b?null:E({asPlainText:!1,browserFields:t,columnId:p.id,data:u,ecsData:b,eventId:m,header:p,isDetails:s,isDraggable:!1,isExpandable:!0,isExpanded:!1,linkValues:Object(l.getOr)([],null!==(o=p.linkField)&&void 0!==o?o:"",b),rowIndex:a,colIndex:n,rowRenderers:x,setCellProps:i,scopeId:g,truncate:!s})}),[t,Q,r,g,j.pageSize,E,x,J]);return Object(F.jsx)(p.a.Fragment,null,Object(F.jsx)(Ie,{hideLastPage:k>9999},Object(F.jsx)(o.EuiDataGrid,s()({},A,{id:"body-data-grid","data-test-subj":"body-data-grid","aria-label":we,columns:w?Q:de,columnVisibility:{visibleColumns:ie,setVisibleColumns:se},gridStyle:Te(w),leadingControlColumns:f,toolbarVisibility:te,rowCount:k,renderCellValue:pe,sorting:{columns:ae,onSort:ne},onColumnResize:re,pagination:j,ref:W,rowHeightsOptions:O}))))}));var _e=a(208),Fe=a(8);const Ae=({id:e,tableById:t,...a})=>{const n=t[e];return{...t,[e]:{...n,...M,...a,isLoading:!1}}},De=({column:e,id:t,index:a,tableById:n})=>{const i=n[t];if(-1!==i.columns.findIndex((t=>t.id===e.id))){const r=i.columns.filter((t=>t.id!==e.id));return r.splice(a,0,e),{...n,[t]:{...i,columns:r}}}const r=[...i.columns];return r.splice(a,0,e),{...n,[t]:{...i,columns:r}}},Ne=({id:e,columnId:t,tableById:a})=>{const n=a[e],i=n.columns.filter((e=>e.id!==t));return{...a,[e]:{...n,columns:i}}},Pe=({id:e,tableById:t,dataTableSettingsProps:a})=>{var n;const i=t[e];return null!=i&&i.initialized?t:{...t,[e]:{...M,..._(e),...i,...a,...!i||Object(Fe.isEmpty)(i.columns)&&!Object(Fe.isEmpty)(a.defaultColumns)?{columns:a.defaultColumns}:{},sort:null!==(n=a.sort)&&void 0!==n?n:M.sort,loadingEventIds:M.loadingEventIds,initialized:!0}}},Re=({id:e,columnId:t,delta:a,tableById:n})=>{var i;const r=n[e],s=r.columns.findIndex((e=>e.id===t));if(-1===s)return{...n,[e]:{...r}};const o=(null!==(i=r.columns[s].initialWidth)&&void 0!==i?i:h)+a,l=Math.max(70,o),c={...r.columns[s],initialWidth:l},u=[...r.columns.slice(0,s),c,...r.columns.slice(s+1)];return{...n,[e]:{...r,columns:u}}},Le=({columnIds:e,id:t,tableById:a})=>{const n=a[t],i=e.reduce(((e,t)=>{const a=n.columns.findIndex((e=>e.id===t));return-1!==a?[...e,n.columns[a]]:e}),[]);return{...a,[t]:{...n,columns:i}}},Be=({columnId:e,id:t,tableById:a,width:n})=>{const i=a[t],r=i.columns.map((t=>({...t,initialWidth:t.id===e?n:t.initialWidth})));return{...a,[t]:{...i,columns:r}}},qe=({id:e,columns:t,tableById:a})=>{const n=a[e];return{...a,[e]:{...n,columns:t}}},ze=({id:e,sort:t,tableById:a})=>{const n=a[e];return{...a,[e]:{...n,sort:t}}},$e=({id:e,itemsPerPage:t,tableById:a})=>{const n=a[e];return{...a,[e]:{...n,itemsPerPage:t}}},Ve=({id:e,itemsPerPageOptions:t,tableById:a})=>{const n=a[e];return{...a,[e]:{...n,itemsPerPageOptions:t}}},Ue=({id:e,eventIds:t,isDeleted:a,tableById:n})=>{const i=n[e],r=a?Object(l.union)(i.deletedEventIds,t):i.deletedEventIds.filter((e=>!t.includes(e))),s=Object.fromEntries(Object.entries(i.selectedEventIds).filter((([e])=>!r.includes(e)))),o=Object.keys(s).length>0&&i.isSelectAllChecked;return{...n,[e]:{...i,deletedEventIds:r,selectedEventIds:s,isSelectAllChecked:o}}},He=({id:e,eventIds:t,isLoading:a,tableById:n})=>{const i=n[e],r=a?Object(l.union)(i.loadingEventIds,t):i.loadingEventIds.filter((e=>!t.includes(e)));return{...n,[e]:{...i,loadingEventIds:r}}},Ge=({id:e,eventIds:t,isSelectAllChecked:a=!1,isSelected:n,tableById:i})=>{const r=i[e],s=n?{...r.selectedEventIds,...t}:Object(l.omit)(Object.keys(t),r.selectedEventIds);return{...i,[e]:{...r,selectedEventIds:s,isSelectAllChecked:a}}},Qe=e=>{var t;const{tabType:a,id:n,...i}=e,r=new Set(["eventDetail","hostDetail","networkDetail","userDetail"]),s=null!=a?a:"query",o={params:i.params?{...i.params}:{},panelView:i.panelView};return{[s]:r.has(null!==(t=i.panelView)&&void 0!==t?t:"")?o:{}}},We=({id:e,graphEventId:t,tableById:a})=>{const n=a[e];return{...a,[e]:{...n,graphEventId:t}}},Ke=({id:e,sessionViewConfig:t,tableById:a})=>{const n=a[e];return{...a,[e]:{...n,sessionViewConfig:t}}},Ye=Object(_e.reducerWithInitialState)({tableById:{}}).case(G,((e,{column:t,id:a,index:n})=>({...e,tableById:De({column:t,id:a,index:n,tableById:e.tableById})}))).case(H,((e,t)=>({...e,tableById:Ae({...t,tableById:e.tableById})}))).case(ce,((e,{id:t,...a})=>({...e,tableById:Pe({id:t,tableById:e.tableById,dataTableSettingsProps:a})}))).case(Y,((e,t)=>({...e,tableById:{...e.tableById,[t.id]:{...e.tableById[t.id],expandedDetail:{...e.tableById[t.id].expandedDetail,...Qe(t)}}}}))).case(Q,((e,{id:t,columnId:a,delta:n})=>({...e,tableById:Re({id:t,columnId:a,delta:n,tableById:e.tableById})}))).case(W,((e,{id:t,columnIds:a})=>({...e,tableById:Le({columnIds:a,id:t,tableById:e.tableById})}))).case(K,((e,{id:t,columnId:a,width:n})=>({...e,tableById:Be({columnId:a,id:t,tableById:e.tableById,width:n})}))).case(J,((e,{id:t,columnId:a})=>({...e,tableById:Ne({id:t,columnId:a,tableById:e.tableById})}))).case(oe,((e,{id:t,eventIds:a,isDeleted:n})=>({...e,tableById:Ue({id:t,eventIds:a,tableById:e.tableById,isDeleted:n})}))).case(le,((e,{id:t})=>({...e,tableById:{...e.tableById,[t]:{...e.tableById[t],deletedEventIds:[]}}}))).case(re,((e,{id:t,eventIds:a,isLoading:n})=>({...e,tableById:He({id:t,eventIds:a,tableById:e.tableById,isLoading:n})}))).case(se,((e,{id:t})=>({...e,tableById:{...e.tableById,[t]:{...e.tableById[t],loadingEventIds:[]}}}))).case(ne,((e,{id:t,eventIds:a,isSelected:n,isSelectAllChecked:i})=>({...e,tableById:Ge({id:t,eventIds:a,tableById:e.tableById,isSelected:n,isSelectAllChecked:i})}))).case(ie,((e,{id:t})=>({...e,tableById:{...e.tableById,[t]:{...e.tableById[t],selectedEventIds:{},isSelectAllChecked:!1}}}))).case(X,((e,{id:t,isLoading:a})=>({...e,tableById:{...e.tableById,[t]:{...e.tableById[t],isLoading:a}}}))).case(Z,((e,{id:t,columns:a})=>({...e,tableById:qe({id:t,columns:a,tableById:e.tableById})}))).case(ae,((e,{id:t,sort:a})=>({...e,tableById:ze({id:t,sort:a,tableById:e.tableById})}))).case(ee,((e,{id:t,itemsPerPage:a})=>({...e,tableById:$e({id:t,itemsPerPage:a,tableById:e.tableById})}))).case(te,((e,{id:t,itemsPerPageOptions:a})=>({...e,tableById:Ve({id:t,itemsPerPageOptions:a,tableById:e.tableById})}))).case(ue,((e,{id:t,selectAll:a})=>({...e,tableById:{...e.tableById,[t]:{...e.tableById[t],selectAll:a}}}))).case(de,((e,{id:t,graphEventId:a})=>({...e,tableById:We({id:t,graphEventId:a,tableById:e.tableById})}))).case(pe,((e,{id:t,sessionViewConfig:a})=>({...e,tableById:Ke({id:t,sessionViewConfig:a,tableById:e.tableById})}))).case(me,((e,{id:t,updated:a})=>({...e,tableById:{...e.tableById,[t]:{...e.tableById[t],updated:a}}}))).case(be,((e,{id:t,totalCount:a})=>({...e,tableById:{...e.tableById,[t]:{...e.tableById[t],totalCount:a}}}))).case(ge,((e,{id:t,viewMode:a})=>({...e,tableById:{...e.tableById,[t]:{...e.tableById[t],viewMode:a}}}))).case(fe,((e,{id:t,showBuildingBlockAlerts:a})=>({...e,tableById:{...e.tableById,[t]:{...e.tableById[t],additionalFilters:{...e.tableById[t].additionalFilters,showBuildingBlockAlerts:a}}}}))).case(ye,((e,{id:t,showOnlyThreatIndicatorAlerts:a})=>({...e,tableById:{...e.tableById,[t]:{...e.tableById[t],additionalFilters:{...e.tableById[t].additionalFilters,showOnlyThreatIndicatorAlerts:a}}}}))).build()},,function(e,t,a){"use strict";a.d(t,"a",(function(){return b})),a.d(t,"b",(function(){return g})),a.d(t,"c",(function(){return h}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(321),c=a(153),u=a(117),d=a(150),p=a(379);const m=({field:e,tooltipContent:t})=>null!=t?t:e,b=r.a.memo((({children:e,field:t,tooltipContent:a,tooltipPosition:i,value:s})=>(e=>null===e)(a)?r.a.createElement(r.a.Fragment,null,e||s):r.a.createElement(n.EuiToolTip,{"data-test-subj":`${t}-tooltip`,position:i,content:m({tooltipContent:a,field:t})},r.a.createElement(r.a.Fragment,null,e||s))));b.displayName="Content";const g=r.a.memo((({hideTopN:e=!1,id:t,isDraggable:a=!0,field:n,fieldType:s="",isAggregatable:o=!1,value:u,name:m,children:g,scopeId:f,tooltipContent:y,tooltipPosition:h,queryValue:v,truncate:E})=>{const x=Object(i.useMemo)((()=>{var e;return{and:[],enabled:!0,id:Object(c.i)(t),name:m||(null!==(e=null==u?void 0:u.toString())&&void 0!==e?e:""),excluded:!1,kqlQuery:"",queryMatch:{field:n,value:v||(null!=u?u:""),operator:d.d}}}),[n,t,m,v,u]),j=Object(i.useCallback)(((e,t,a)=>a.isDragging?r.a.createElement(l.a,null,r.a.createElement(p.a,{dataProvider:e})):r.a.createElement(b,{field:n,tooltipContent:y,tooltipPosition:h,value:u},g)),[g,n,y,h,u]);return null==u?null:r.a.createElement(l.b,{dataProvider:x,fieldType:s,isAggregatable:o,hideTopN:e,isDraggable:a,render:j,scopeId:f,truncate:E})}));g.displayName="DefaultDraggable";const f=o()(n.EuiBadge).withConfig({displayName:"Badge",componentId:"sc-1g0jgxk-0"})(["vertical-align:top;"]);f.displayName="Badge";const y=({contextId:e,eventId:t,field:a,value:n,iconType:i,isDraggable:s,isAggregatable:o,fieldType:l,name:c,color:d="hollow",children:p,scopeId:m,tooltipContent:b,queryValue:y})=>null!=n?r.a.createElement(g,{id:`draggable-badge-default-draggable-${e}-${t}-${a}-${n}`,isDraggable:s,isAggregatable:o,fieldType:l,field:a,name:c,value:n,scopeId:m,tooltipContent:b,queryValue:y},r.a.createElement(f,{iconType:i,color:d,title:""},p||(""!==n?n:Object(u.c)()))):null;y.displayName="DraggableBadgeComponent";const h=r.a.memo(y);h.displayName="DraggableBadge"},function(e,t,a){"use strict";a.d(t,"a",(function(){return n.c})),a.d(t,"b",(function(){return i.c})),a.d(t,"d",(function(){return r.d})),a.d(t,"e",(function(){return s.d})),a.d(t,"c",(function(){return o.b})),a.d(t,"f",(function(){return l}));var n=a(179),i=a(227),r=a(138),s=a(158),o=(a(543),a(398));const l=(e,t)=>a=>{const n={...a,getState:()=>e(a.getState())};return t(n)}},function(e,t,a){"use strict";a.d(t,"g",(function(){return x.d})),a.d(t,"f",(function(){return x.c})),a.d(t,"o",(function(){return w})),a.d(t,"m",(function(){return C})),a.d(t,"d",(function(){return _})),a.d(t,"h",(function(){return N})),a.d(t,"a",(function(){return R})),a.d(t,"c",(function(){return L})),a.d(t,"i",(function(){return B})),a.d(t,"e",(function(){return q})),a.d(t,"b",(function(){return z})),a.d(t,"j",(function(){return G})),a.d(t,"n",(function(){return Q})),a.d(t,"l",(function(){return W})),a.d(t,"k",(function(){return K}));var n=a(40),i=a(2),r=a.n(i),s=a(42),o=a(291),l=a(199),c=a(363),u=a(4),d=a(449),p=a(169),m=a(263),b=a(102),g=a(228),f=a(5),y=a(364);const h=e=>f.i18n.translate("xpack.securitySolution.cases.caseTable.caseDetailsLinkAria",{values:{detailName:e},defaultMessage:"click to visit case with title {detailName}"});var v=a(131),E=a(669),x=a(318),j=a(104),S=a.n(j),k=a(636),O=a(609);const w=()=>{const e=Object(k.a)(),t=Object(O.a)();return Object(i.useCallback)((({deepLinkId:a,path:n,onClick:i})=>{const r=t(a);return e({id:a,path:n,urlState:r,onClick:i})}),[e,t])},T=e=>(e=>r.a.memo((function({deepLinkId:t,...a}){const n=Object(O.a)()(t);return r.a.createElement(e,S()({id:t,urlState:n},a))})))(Object(k.c)(e)),I=({children:e,Component:t,userName:a,isButton:n,onClick:s,title:o,userTab:l})=>{const c=encodeURIComponent(a),{formatUrl:d,search:m}=Object(p.m)(v.a.users),{application:{navigateToApp:g},telemetry:f}=Object(b.j)().services,y=Object(i.useCallback)((e=>{e.preventDefault(),g(u.l,{deepLinkId:v.a.users,path:l?Object(E.a)(c,l,m):Object(E.c)(c,m)})}),[c,g,m,l]),h=Object(i.useMemo)((()=>d(l?Object(E.a)(c,l):Object(E.c)(c))),[d,c,l]),j=Object(i.useCallback)((e=>{f.reportEntityDetailsClicked({entity:"user"}),(null!=s?s:y)(e)}),[y,s,f]);return n?r.a.createElement(x.b,{Component:t,dataTestSubj:"data-grid-user-details",href:h,onClick:j,title:null!=o?o:a},e||a):r.a.createElement(x.c,{"data-test-subj":"users-link-anchor",onClick:j,href:h},e||a)},C=r.a.memo(I),M=({children:e,Component:t,hostName:a,isButton:n,onClick:s,title:o,hostTab:l})=>{const{formatUrl:c,search:d}=Object(p.m)(v.a.hosts),{application:{navigateToApp:m},telemetry:g}=Object(b.j)().services,f=encodeURIComponent(a),y=Object(i.useCallback)((e=>{e.preventDefault(),m(u.l,{deepLinkId:v.a.hosts,path:l?Object(p.j)(f,l,d):Object(p.e)(f,d)})}),[f,m,d,l]),h=Object(i.useMemo)((()=>c(l?Object(p.j)(f,l):Object(p.e)(f))),[c,f,l]),E=Object(i.useCallback)((e=>{g.reportEntityDetailsClicked({entity:"host"}),(null!=s?s:y)(e)}),[y,s,g]);return n?r.a.createElement(x.b,{Component:t,dataTestSubj:"data-grid-host-details",href:h,iconType:"expand",onClick:E,title:null!=o?o:a},e):r.a.createElement(x.c,{onClick:E,href:h,"data-test-subj":"host-details-button"},e||a)},_=r.a.memo(M),F=["http://","https://"],A=r.a.memo((({url:e,children:t,idx:a,overflowIndexStart:i=5,allItemsLimit:o=5})=>{const l=i-1,c=o-1,u=Math.max(0,Math.min(l,c)),d=F.some((t=>0===e.indexOf(t)));return e&&d&&!Object(g.c)(e)&&t?r.a.createElement(n.EuiToolTip,{content:e,position:"top","data-test-subj":"externalLinkTooltip"},r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiLink,{href:e,target:"_blank",rel:"noopener","data-test-subj":"externalLink"},t),!Object(s.isNil)(a)&&a<u&&r.a.createElement(x.a,{"data-test-subj":"externalLinkComma"}))):null}));A.displayName="ExternalLink";const D=({Component:e,children:t,ip:a,flowTarget:n=m.a.source,isButton:o,onClick:l,title:c})=>{const u=w(),b=Object(i.useCallback)(((a,i)=>{const{onClick:s,href:m}=u({deepLinkId:v.a.network,path:Object(p.g)(encodeURIComponent(Object(d.c)(a)),n)}),b=null!=l?l:e=>s(e);return o?r.a.createElement(x.b,{Component:e,key:`${a}-${i}`,dataTestSubj:"data-grid-network-details",onClick:b,href:m,title:null!=c?c:a},t):r.a.createElement(x.c,{key:`${a}-${i}`,onClick:b,href:m,"data-test-subj":"network-details"},t||a)}),[t,e,n,u,l,o,c]);return Object(s.isArray)(a)?r.a.createElement(r.a.Fragment,null,a.map(b)):b(a,0)},N=r.a.memo(D),P=({index:e,children:t,detailName:a,title:n})=>{const{formatUrl:s,search:d}=Object(p.m)(v.a.case),{navigateToApp:m}=Object(b.j)().services.application,{activeStep:g,isTourShown:f}=Object(c.b)(),y=Object(i.useMemo)((()=>g===l.a.viewCase&&f(l.b.alertsCases)&&0===e),[g,e,f]),E=Object(i.useCallback)((async e=>(e&&e.preventDefault(),m(u.l,{deepLinkId:v.a.case,path:Object(p.b)({id:a,search:d})}))),[a,m,d]);return Object(i.useEffect)((()=>{var e;y&&(null===(e=document.querySelector('[tour-step="RelatedCases-accordion"]'))||void 0===e||e.scrollIntoView())}),[y]),r.a.createElement(o.a,{onClick:E,isTourAnchor:y,step:l.a.viewCase,tourId:l.b.alertsCases},r.a.createElement(x.c,{onClick:E,href:s(Object(p.b)({id:a})),"data-test-subj":"case-details-link","aria-label":h(null!=n?n:a)},t||a))},R=r.a.memo(P);R.displayName="CaseDetailsLink",r.a.memo((({children:e})=>{const{formatUrl:t,search:a}=Object(p.m)(v.a.case),{navigateToApp:n}=Object(b.j)().services.application,s=Object(i.useCallback)((async e=>(e.preventDefault(),n(u.l,{deepLinkId:v.a.case,path:Object(p.c)(a)}))),[n,a]);return r.a.createElement(x.c,{onClick:s,href:t(Object(p.c)())},e)})).displayName="CreateCaseLink";const L=r.a.memo((({children:e,link:t})=>{const a=Object(i.useMemo)((()=>`https://www.google.com/search?q=${encodeURIComponent(t)}`),[t]);return r.a.createElement(A,{url:a},e||t)}));L.displayName="GoogleLink";const B=r.a.memo((({Component:e,title:t,children:a,portOrServiceName:s})=>{var o;const l=Object(i.useMemo)((()=>`https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=${encodeURIComponent(String(s))}`),[s]);return e?r.a.createElement(e,{href:l,"data-test-subj":"data-grid-port-or-service-name-link",title:t,iconType:"link"},null!==(o=null!=t?t:a)&&void 0!==o?o:s):r.a.createElement(x.e,null,r.a.createElement(n.EuiLink,{"data-test-subj":"port-or-service-name-link",href:l,target:"_blank"},a||s))}));B.displayName="PortOrServiceNameLink";const q=r.a.memo((({children:e,ja3Fingerprint:t})=>{const a=Object(i.useMemo)((()=>`https://sslbl.abuse.ch/ja3-fingerprints/${encodeURIComponent(t)}`),[t]);return r.a.createElement(n.EuiLink,{"data-test-subj":"ja3-fingerprint-link",href:a,target:"_blank"},e||t)}));q.displayName="Ja3FingerprintLink";const z=r.a.memo((({children:e,certificateFingerprint:t})=>{const a=Object(i.useMemo)((()=>`https://sslbl.abuse.ch/ssl-certificates/sha1/${encodeURIComponent(t)}`),[t]);return r.a.createElement(n.EuiLink,{"data-test-subj":"certificate-fingerprint-link",href:a,target:"_blank"},e||t)}));var $;function V(e){return e===$["virustotal.com"]||e===$["talosIntelligence.com"]}z.displayName="CertificateFingerprintLink",function(e){e["virustotal.com"]="virustotal.com",e["talosIntelligence.com"]="talosIntelligence.com"}($||($={}));const U={[$["virustotal.com"]]:y.m,[$["talosIntelligence.com"]]:y.l},H=({overflowIndexStart:e=5,allItemsLimit:t=5,showDomain:a=!1,domain:o,direction:l="row"})=>{const[c]=Object(b.p)(u.Fb),d=Object(i.useMemo)((()=>null==c?void 0:c.slice(0,t).filter((({url_template:e,name:t})=>!Object(s.isNil)(e)&&!Object(s.isNil)(t)&&!Object(g.c)(e))).map((({name:e,url_template:t})=>({name:V(e)?U[e]:e,url_template:t.replace("{{ip}}",encodeURIComponent(o))})))),[c,o,U,t]),p=Object(i.useCallback)((a=>{var n;return(e=>void 0!==e.url_template&&void 0!==e.name)(a)&&r.a.createElement(A,{url:a.url_template,overflowIndexStart:e,allItemsLimit:t},r.a.createElement(r.a.Fragment,null,null!==(n=a.name)&&void 0!==n?n:o))}),[t,o,e]);return(null==d?void 0:d.length)>0?r.a.createElement("section",null,r.a.createElement(n.EuiFlexGroup,{gutterSize:"none",justifyContent:"center",direction:l,alignItems:"center","data-test-subj":"reputationLinkGroup"},r.a.createElement(n.EuiFlexItem,{grow:!0},null==d?void 0:d.slice(0,e).map((({name:t,url_template:n},i)=>r.a.createElement(A,{allItemsLimit:d.length,idx:i,overflowIndexStart:e,url:n,"data-test-subj":"externalLinkComponent",key:`reputationLink-${i}`},r.a.createElement(r.a.Fragment,null,a?o:null!=t?t:o))))),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(x.f,{rowItems:d,render:p,moreMaxHeight:"200px",overflowIndexStart:e})))):null};H.displayName="ReputationLinkComponent";const G=r.a.memo(H),Q=r.a.memo((({children:e,domain:t})=>{const a=Object(i.useMemo)((()=>`https://www.iana.org/whois?q=${encodeURIComponent(t)}`),[t]);return r.a.createElement(A,{url:a},e||t)}));Q.displayName="WhoIsLink";const W=T(x.d),K=T(x.c)},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(103),i=a(15);const r=Object(i.b)(),s=e=>{const t=o();if(!t||!(e in t))throw new Error(`Invalid enable value ${e}. Allowed values are: ${r.join(", ")}`);return t[e]},o=()=>Object(n.useSelector)((({app:{enableExperimental:e}})=>e))},function(e,t,a){"use strict";var n=a(52);a.d(t,"j",(function(){return n.getUseField})),a.d(t,"i",(function(){return n.getFieldValidityAndErrorMessage})),a.d(t,"a",(function(){return n.FIELD_TYPES})),a.d(t,"c",(function(){return n.Form})),a.d(t,"e",(function(){return n.UseField})),a.d(t,"f",(function(){return n.UseMultiFields})),a.d(t,"k",(function(){return n.useForm})),a.d(t,"l",(function(){return n.useFormContext})),a.d(t,"m",(function(){return n.useFormData})),a.d(t,"g",(function(){return n.VALIDATION_TYPES}));var i=a(67);a.d(t,"b",(function(){return i.Field})),a.d(t,"d",(function(){return i.SelectField}));var r=a(75);a.d(t,"h",(function(){return r.fieldValidators}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(2),i=a(1059);const r=()=>Object(n.useContext)(i.a)},function(e,t,a){"use strict";a.d(t,"a",(function(){return o})),a.d(t,"b",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"e",(function(){return u})),a.d(t,"d",(function(){return d})),a.d(t,"f",(function(){return p})),a.d(t,"g",(function(){return m}));var n=a(40),i=a(42),r=a(41),s=a.n(r);const o="details",l=s.a.div.attrs((()=>({className:o}))).withConfig({displayName:"Details",componentId:"sc-1ucey7j-0"})(["margin:5px 0 5px 10px;& .euiBadge{margin:2px 0 2px 0;}& .euiFlexGroup{justify-content:center;}"]);l.displayName="Details";const c=s()(n.EuiFlexItem).withConfig({displayName:"TokensFlexItem",componentId:"sc-1ucey7j-1"})(["margin-left:3px;"]);function u(e){return Object(i.isNumber)(e)?!isFinite(e):Object(i.isEmpty)(e)}c.displayName="TokensFlexItem";const d=({eventCategory:e,eventDataset:t})=>"file"===(null==e?void 0:e.toLowerCase())||"file"===(null==t?void 0:t.toLowerCase())||"endpoint.events.file"===(null==t?void 0:t.toLowerCase()),p=e=>["process_stopped","termination_event"].includes(`${e}`.toLowerCase()),m=e=>["created","creation","deleted","deletion","file_create_event","file_delete_event","files-encrypted","load","modification","overwrite","rename"].includes(`${e}`.toLowerCase())},function(e,t,a){"use strict";a.d(t,"z",(function(){return n.D})),a.d(t,"E",(function(){return n.I})),a.d(t,"x",(function(){return n.B})),a.d(t,"s",(function(){return n.w})),a.d(t,"H",(function(){return n.L})),a.d(t,"F",(function(){return n.J})),a.d(t,"w",(function(){return n.A})),a.d(t,"v",(function(){return n.z})),a.d(t,"q",(function(){return n.t})),a.d(t,"t",(function(){return n.x})),a.d(t,"C",(function(){return n.G})),a.d(t,"j",(function(){return n.l})),a.d(t,"I",(function(){return n.P})),a.d(t,"c",(function(){return n.e})),a.d(t,"g",(function(){return n.i})),a.d(t,"l",(function(){return n.p})),a.d(t,"L",(function(){return n.R})),a.d(t,"i",(function(){return n.k})),a.d(t,"d",(function(){return n.g})),a.d(t,"B",(function(){return n.F})),a.d(t,"u",(function(){return n.y})),a.d(t,"y",(function(){return n.C})),a.d(t,"R",(function(){return n.X})),a.d(t,"S",(function(){return n.Y})),a.d(t,"p",(function(){return n.s})),a.d(t,"O",(function(){return n.U})),a.d(t,"P",(function(){return n.V})),a.d(t,"o",(function(){return n.r})),a.d(t,"f",(function(){return n.h})),a.d(t,"Q",(function(){return n.W})),a.d(t,"N",(function(){return n.T})),a.d(t,"m",(function(){return n.q})),a.d(t,"h",(function(){return n.j})),a.d(t,"a",(function(){return n.a})),a.d(t,"M",(function(){return n.S})),a.d(t,"b",(function(){return n.d})),a.d(t,"J",(function(){return n.Q})),a.d(t,"k",(function(){return n.o})),a.d(t,"T",(function(){return n.Z})),a.d(t,"r",(function(){return n.u})),a.d(t,"G",(function(){return n.K})),a.d(t,"A",(function(){return n.E})),a.d(t,"D",(function(){return n.H})),a.d(t,"cb",(function(){return n.bb})),a.d(t,"ab",(function(){return c})),a.d(t,"n",(function(){return p})),a.d(t,"fb",(function(){return s.k})),a.d(t,"W",(function(){return s.c})),a.d(t,"ib",(function(){return s.n})),a.d(t,"X",(function(){return s.d})),a.d(t,"db",(function(){return s.i})),a.d(t,"gb",(function(){return s.l})),a.d(t,"hb",(function(){return s.m})),a.d(t,"U",(function(){return s.a})),a.d(t,"bb",(function(){return s.g})),a.d(t,"Y",(function(){return s.e})),a.d(t,"lb",(function(){return s.r})),a.d(t,"Z",(function(){return s.f})),a.d(t,"mb",(function(){return s.s})),a.d(t,"eb",(function(){return s.j})),a.d(t,"jb",(function(){return s.p})),a.d(t,"kb",(function(){return s.q})),a.d(t,"V",(function(){return s.b})),a.d(t,"K",(function(){return b})),a.d(t,"e",(function(){return f})),a.d(t,"nb",(function(){return v})),a(238);var n=a(207),i=a(112),r=a(43),s=a(433);const o=r.exact(r.partial({id:r.string,rule_id:n.I,list_id:i.k,item_id:i.k})),l=r.exact(r.type({error:r.type({status_code:s.o,message:s.h})})),c=r.intersection([o,l]),u=i.o,d=(r.union([u,r[void 0]]),i.n),p=(r.union([d,r[void 0]]),r.type({page:u,per_page:d,total:i.n}));var m=a(8);const b=r.keyof({asc:null,desc:null}),g=(r.union([b,r[void 0]]),e=>new r.Type(`DefaultSortOrder${Object(m.capitalize)(e)}`,b.is,((t,a)=>null==t?r.success(e):b.validate(t,a)),r.identity)),f=(g("asc"),g("desc")),y=r.exact(r.partial({buttonLabel:r.string})),h=r.exact(r.type({type:r.string,message:r.string,actionPath:r.string})),v=r.intersection([y,h])},function(e,t,a){"use strict";a.d(t,"o",(function(){return r})),a.d(t,"E",(function(){return s})),a.d(t,"a",(function(){return c})),a.d(t,"c",(function(){return u})),a.d(t,"e",(function(){return d})),a.d(t,"f",(function(){return p})),a.d(t,"j",(function(){return m})),a.d(t,"k",(function(){return b})),a.d(t,"n",(function(){return g})),a.d(t,"l",(function(){return f})),a.d(t,"m",(function(){return y})),a.d(t,"p",(function(){return h})),a.d(t,"s",(function(){return O})),a.d(t,"t",(function(){return w})),a.d(t,"z",(function(){return T})),a.d(t,"D",(function(){return I})),a.d(t,"G",(function(){return C})),a.d(t,"H",(function(){return M})),a.d(t,"J",(function(){return _})),a.d(t,"M",(function(){return F})),a.d(t,"P",(function(){return A})),a.d(t,"S",(function(){return N})),a.d(t,"V",(function(){return v})),a.d(t,"W",(function(){return E})),a.d(t,"fb",(function(){return x})),a.d(t,"gb",(function(){return D})),a.d(t,"hb",(function(){return j})),a.d(t,"jb",(function(){return S})),a.d(t,"kb",(function(){return k})),a.d(t,"qb",(function(){return o})),a.d(t,"sb",(function(){return n})),a.d(t,"tb",(function(){return l})),a.d(t,"q",(function(){return q})),a.d(t,"r",(function(){return z})),a.d(t,"u",(function(){return $})),a.d(t,"v",(function(){return V})),a.d(t,"w",(function(){return U})),a.d(t,"x",(function(){return H})),a.d(t,"A",(function(){return G})),a.d(t,"B",(function(){return Q})),a.d(t,"C",(function(){return W})),a.d(t,"F",(function(){return K})),a.d(t,"I",(function(){return Y})),a.d(t,"K",(function(){return J})),a.d(t,"L",(function(){return X})),a.d(t,"N",(function(){return Z})),a.d(t,"O",(function(){return ee})),a.d(t,"Q",(function(){return te})),a.d(t,"R",(function(){return ae})),a.d(t,"T",(function(){return ne})),a.d(t,"U",(function(){return ie})),a.d(t,"Y",(function(){return de})),a.d(t,"Z",(function(){return ue})),a.d(t,"ab",(function(){return oe})),a.d(t,"bb",(function(){return ce})),a.d(t,"cb",(function(){return se})),a.d(t,"db",(function(){return le})),a.d(t,"eb",(function(){return pe})),a.d(t,"ib",(function(){return me})),a.d(t,"lb",(function(){return be})),a.d(t,"nb",(function(){return P})),a.d(t,"ob",(function(){return R})),a.d(t,"pb",(function(){return L})),a.d(t,"rb",(function(){return B})),a.d(t,"b",(function(){return ge})),a.d(t,"g",(function(){return fe})),a.d(t,"h",(function(){return ye})),a.d(t,"d",(function(){return he})),a.d(t,"i",(function(){return ve})),a.d(t,"y",(function(){return Ee})),a.d(t,"mb",(function(){return xe})),a.d(t,"X",(function(){return je}));const n="@timestamp",i="kibana",r=`${i}.alert`,s=`${r}.rule`,o=`${i}.space_ids`,l=`${i}.version`,c=`${r}.action_group`,u=`${r}.case_ids`,d=`${r}.duration.us`,p=`${r}.end`,m=`${r}.flapping`,b=`${r}.flapping_history`,g=`${r}.maintenance_window_ids`,f=`${r}.instance.id`,y=`${r}.last_detected`,h=`${r}.reason`,v=`${r}.start`,E=`${r}.status`,x=`${r}.time_range`,j=`${r}.uuid`,S=`${r}.workflow_status`,k=`${r}.workflow_tags`,O=`${s}.category`,w=`${s}.consumer`,T=`${s}.execution.uuid`,I=`${s}.name`,C=`${s}.parameters`,M=`${s}.producer`,_=`${s}.revision`,F=`${s}.tags`,A=`${s}.rule_type_id`,D=`${r}.url`,N=`${s}.uuid`,P="ecs.version",R="event.action",L="event.kind",B="tags",q=`${r}.risk_score`,z=`${s}.author`,$=`${s}.created_at`,V=`${s}.created_by`,U=`${s}.description`,H=`${s}.enabled`,G=`${s}.from`,Q=`${s}.interval`,W=`${s}.license`,K=`${s}.note`,Y=`${s}.references`,J=`${s}.rule_id`,X=`${s}.rule_name_override`,Z=`${s}.to`,ee=`${s}.type`,te=`${s}.updated_at`,ae=`${s}.updated_by`,ne=`${s}.version`,ie=`${r}.severity`,re=`${r}.suppression`,se=`${re}.terms`,oe=`${se}.field`,le=`${se}.value`,ce=`${re}.start`,ue=`${re}.end`,de=`${re}.docs_count`,pe=`${r}.system_status`,me=`${r}.workflow_reason`,be=`${r}.workflow_user`,ge=`${r}.building_block_type`,fe=`${r}.evaluation.threshold`,ye=`${r}.evaluation.value`,he=`${r}.context`,ve=`${r}.evaluation.values`,Ee=`${s}.exceptions_list`,xe={APM:"apm",LOGS:"logs",INFRASTRUCTURE:"infrastructure",OBSERVABILITY:"observability",SLO:"slo",SIEM:"siem",UPTIME:"uptime"},je=(Object.values(xe).map((e=>e)),"recovered")},function(e,t,a){"use strict";e.exports=function e(t,a){if(t===a)return!0;if(t&&a&&"object"==typeof t&&"object"==typeof a){if(t.constructor!==a.constructor)return!1;var n,i,r;if(Array.isArray(t)){if((n=t.length)!=a.length)return!1;for(i=n;0!=i--;)if(!e(t[i],a[i]))return!1;return!0}if(t.constructor===RegExp)return t.source===a.source&&t.flags===a.flags;if(t.valueOf!==Object.prototype.valueOf)return t.valueOf()===a.valueOf();if(t.toString!==Object.prototype.toString)return t.toString()===a.toString();if((n=(r=Object.keys(t)).length)!==Object.keys(a).length)return!1;for(i=n;0!=i--;)if(!Object.prototype.hasOwnProperty.call(a,r[i]))return!1;for(i=n;0!=i--;){var s=r[i];if(!e(t[s],a[s]))return!1}return!0}return t!=t&&a!=a}},function(e,t,a){"use strict";var n=a(4);a.d(t,"a",(function(){return n.wc}))},function(e,t,a){"use strict";a.d(t,"c",(function(){return p})),a.d(t,"d",(function(){return m})),a.d(t,"e",(function(){return g})),a.d(t,"a",(function(){return f})),a.d(t,"b",(function(){return y}));var n=a(76),i=a.n(n),r=a(2),s=a.n(r),o=a(44),l=a(102),c=a(117),u=a(907),d=a(712);const p=s.a.memo((({value:e,dateFormat:t=Object(l.g)()})=>s.a.createElement(s.a.Fragment,null,i.a.tz(e,Object(l.m)()).format(t))));p.displayName="PreferenceFormattedDate";const m=({value:e})=>{if(null==e)return Object(c.f)(e);const t=Object(d.a)(e);if(!t.isValid())return Object(c.f)(e);const a=t.toDate();return s.a.createElement(p,{value:a})};m.displayName="PreferenceFormattedDateFromPrimitive";const b=e=>Array.isArray(e)&&"P1DT"===e[0]&&2===e.length,g=s.a.memo((({value:e})=>{const[t]=Object(l.p)("dateFormat:scaled"),a=Array.isArray(t)?t.find(b):null,n=Array.isArray(a)&&2===a.length?a[1]:"YYYY-MM-DD";return s.a.createElement(p,{dateFormat:n,value:e})}));g.displayName="PreferenceFormattedP1DTDate";const f=s.a.memo((({value:e,fieldName:t,className:a="",dateFormat:n})=>{if(null==e)return Object(c.f)(e);const i=Object(d.a)(e);return i.isValid()?s.a.createElement(u.a,{date:i.toDate(),fieldName:t,className:a},s.a.createElement(p,{value:i.toDate(),dateFormat:n})):Object(c.f)(e)}));f.displayName="FormattedDate";const y=s.a.memo((({value:e,dateFormat:t,tooltipFieldName:a,tooltipAnchorClassName:n,relativeThresholdInHrs:r=1})=>{if(null==e)return Object(c.f)(e);const l=Object(d.a)(e);if(!l.isValid())return Object(c.f)(e);const m=l.toDate(),b=i()(m).add(r,"hours").isBefore(new Date);return s.a.createElement(u.a,{date:m,fieldName:a,className:n},b?s.a.createElement(p,{"data-test-subj":"preference-time",value:m,dateFormat:t}):s.a.createElement(o.FormattedRelative,{"data-test-subj":"relative-time",value:m}))}));y.displayName="FormattedRelativePreferenceDate"},function(e,t,a){"use strict";a.d(t,"b",(function(){return c})),a.d(t,"a",(function(){return u}));var n=a(118),i=a(106),r=a(190),s=a(387);const{from:o,to:l}=Object(s.a)({from:"",to:""},!1),c={activeTab:n.d.query,prevActiveTab:n.d.query,columns:r.b,documentType:"",defaultColumns:r.b,dataProviders:[],dataViewId:null,dateRange:{start:o,end:l},description:"",eqlOptions:{eventCategoryField:"event.category",tiebreakerField:"",timestampField:"@timestamp",query:"",size:100},eventType:"all",eventIdToNoteIds:{},excludedRowRendererIds:[],expandedDetail:{},highlightedDropAndProviderId:"",historyIds:[],indexNames:[],isFavorite:!1,isLive:!1,isLoading:!1,isSaving:!1,itemsPerPage:25,itemsPerPageOptions:[10,25,50,100],kqlMode:"filter",kqlQuery:{filterQuery:null},loadingEventIds:[],resolveTimelineConfig:void 0,queryFields:[],title:"",timelineType:i.l.default,templateTimelineId:null,templateTimelineVersion:null,noteIds:[],pinnedEventIds:{},pinnedEventsSaveObject:{},savedObjectId:null,selectAll:!1,sessionViewConfig:null,show:!1,sort:[{columnId:"@timestamp",columnType:"date",esTypes:["date"],sortDirection:"desc"}],status:i.k.draft,version:null,deletedEventIds:[],selectedEventIds:{},isSelectAllChecked:!1,filters:[]},u=e=>({defaultColumns:r.b,documentType:"",selectAll:!1,id:e,isLoading:!1,queryFields:[],title:"",graphEventId:""})},function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(42),i=a(2),r=a(103),s=a(114),o=a(105),l=a(122),c=a(182);const u=()=>{const e=Object(r.useDispatch)(),{from:t,to:a}=Object(o.a)((e=>Object(n.pick)(["from","to"],l.d.globalTimeRangeSelector(e)))),[u,d]=Object(i.useState)(!0),p=Object(i.useRef)([]),m=Object(i.useCallback)((({id:t,inspect:a,loading:n,refetch:i,searchSessionId:r})=>{p.current=[...p.current,t],e(c.c.setQuery({inputId:s.a.global,id:t,inspect:a,loading:n,refetch:i,searchSessionId:r}))}),[e]),b=Object(i.useCallback)((({id:t})=>e(c.c.deleteOneQuery({inputId:s.a.global,id:t}))),[e]);return Object(i.useEffect)((()=>{d(!1)}),[]),Object(i.useEffect)((()=>()=>{p.current.length>0&&p.current.forEach((e=>b({id:e})))}),[b]),Object(i.useMemo)((()=>({isInitializing:u,from:t,to:a,setQuery:m,deleteQuery:b})),[b,t,u,m,a])}},function(e,t,a){"use strict";a.d(t,"H",(function(){return i})),a.d(t,"y",(function(){return r})),a.d(t,"a",(function(){return s})),a.d(t,"U",(function(){return o})),a.d(t,"p",(function(){return l})),a.d(t,"r",(function(){return c})),a.d(t,"q",(function(){return u})),a.d(t,"s",(function(){return d})),a.d(t,"n",(function(){return p})),a.d(t,"o",(function(){return m})),a.d(t,"u",(function(){return b})),a.d(t,"v",(function(){return g})),a.d(t,"t",(function(){return f})),a.d(t,"l",(function(){return y})),a.d(t,"m",(function(){return h})),a.d(t,"h",(function(){return v})),a.d(t,"i",(function(){return E})),a.d(t,"g",(function(){return x})),a.d(t,"e",(function(){return j})),a.d(t,"f",(function(){return S})),a.d(t,"d",(function(){return k})),a.d(t,"A",(function(){return O})),a.d(t,"G",(function(){return w})),a.d(t,"c",(function(){return T})),a.d(t,"z",(function(){return I})),a.d(t,"F",(function(){return C})),a.d(t,"b",(function(){return M})),a.d(t,"E",(function(){return _})),a.d(t,"w",(function(){return F})),a.d(t,"x",(function(){return A})),a.d(t,"J",(function(){return D})),a.d(t,"j",(function(){return N})),a.d(t,"k",(function(){return P})),a.d(t,"D",(function(){return R})),a.d(t,"I",(function(){return L})),a.d(t,"K",(function(){return B})),a.d(t,"L",(function(){return q})),a.d(t,"T",(function(){return z})),a.d(t,"M",(function(){return $})),a.d(t,"N",(function(){return V})),a.d(t,"S",(function(){return U})),a.d(t,"Q",(function(){return H})),a.d(t,"P",(function(){return G})),a.d(t,"O",(function(){return Q})),a.d(t,"R",(function(){return W})),a.d(t,"C",(function(){return K})),a.d(t,"B",(function(){return Y}));var n=a(5);n.i18n.translate("xpack.securitySolution.detectionEngine.pageTitle",{defaultMessage:"Detection engine"}),n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.documentTypeTitle",{defaultMessage:"Alerts"});const i=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.openAlertsTitle",{defaultMessage:"Open"}),r=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.closedAlertsTitle",{defaultMessage:"Closed"}),s=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.acknowledgedAlertsTitle",{defaultMessage:"Acknowledged"}),o=(n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.loadingAlertsTitle",{defaultMessage:"Loading Alerts"}),n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.totalCountOfAlertsTitle",{defaultMessage:"alerts"})),l=n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.ruleTitle",{defaultMessage:"Rule"}),c=n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.ruleNameTitle",{defaultMessage:"Rule name"}),u=n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.ruleDescriptionTitle",{defaultMessage:"Rule description"}),d=n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.severityTitle",{defaultMessage:"Severity"}),p=n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.reasonTitle",{defaultMessage:"Reason"}),m=n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.riskScoreTitle",{defaultMessage:"Risk Score"}),b=n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.thresholdCount",{defaultMessage:"Event Count"}),g=n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.thresholdTerms",{defaultMessage:"Threshold Terms"}),f=n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.thresholdCardinality",{defaultMessage:"Event Cardinality"}),y=n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.newTerms",{defaultMessage:"New Terms"}),h=n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.newTermsFields",{defaultMessage:"New Terms fields"}),v=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.investigateInTimelineTitle",{defaultMessage:"Investigate in timeline"}),E=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.investigateInTimelineAriaLabel",{defaultMessage:"Send alert to timeline"}),x=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addException",{defaultMessage:"Add rule exception"}),j=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addEventFilter",{defaultMessage:"Add Endpoint event filter"}),S=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addEventFilter.disabled.tooltip",{defaultMessage:"Endpoint event filters can be created from the Events section of the Hosts page."}),k=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addEndpointException",{defaultMessage:"Add Endpoint exception"}),O=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.closedAlertSuccessToastMessage",{values:{totalAlerts:e},defaultMessage:"Successfully closed {totalAlerts} {totalAlerts, plural, =1 {alert} other {alerts}}."}),w=(n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.alertDurationTitle",{defaultMessage:"Alert duration"}),e=>n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.openedAlertSuccessToastMessage",{values:{totalAlerts:e},defaultMessage:"Successfully opened {totalAlerts} {totalAlerts, plural, =1 {alert} other {alerts}}."})),T=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.acknowledgedAlertSuccessToastMessage",{values:{totalAlerts:e},defaultMessage:"Successfully marked {totalAlerts} {totalAlerts, plural, =1 {alert} other {alerts}} as acknowledged."}),I=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.closedAlertFailedToastMessage",{defaultMessage:"Failed to close alert(s)."}),C=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.openedAlertFailedToastMessage",{defaultMessage:"Failed to open alert(s)"}),M=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.acknowledgedAlertFailedToastMessage",{defaultMessage:"Failed to mark alert(s) as acknowledged"}),_=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.moreActionsAriaLabel",{defaultMessage:"More actions"}),F=(n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.statusTitle",{defaultMessage:"Status"}),n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.overview.changeAlertStatus",{defaultMessage:"Change alert status"})),A=n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.overview.clickToChangeAlertStatus",{defaultMessage:"Click to change alert status"}),D=n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.overviewTable.signalStatusTitle",{defaultMessage:"Status"}),N=(n.i18n.translate("xpack.securitySolution.eventsViewer.alerts.defaultHeaders.triggeredTitle",{defaultMessage:"Triggered"}),n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addToCase",{defaultMessage:"Add to existing case"})),P=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addToNewCase",{defaultMessage:"Add to new case"}),R=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.addBulkToTimeline",{defaultMessage:"Investigate in timeline"}),L=n.i18n.translate("xpack.securitySolution.sessionsView.sessionsTitle",{defaultMessage:"Sessions"}),B=(n.i18n.translate("xpack.securitySolution.detectionEngine.groups.additionalActions.takeAction",{defaultMessage:"Take actions"}),n.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.alertsCount",{defaultMessage:"Alerts:"})),q=n.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.hostsCount",{defaultMessage:"Hosts:"}),z=(n.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.ipsCount",{defaultMessage:"IP's:"}),n.i18n.translate("xpack.securitySolution.detectionEngine.selectGroup.title",{defaultMessage:"Group alerts by"}),n.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.usersCount",{defaultMessage:"Users:"})),$=n.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.rulesCount",{defaultMessage:"Rules:"}),V=n.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity",{defaultMessage:"Severity:"}),U=n.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.multi",{defaultMessage:"Multi"}),H=n.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.low",{defaultMessage:"Low"}),G=n.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.high",{defaultMessage:"High"}),Q=n.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.critical",{defaultMessage:"Critical"}),W=n.i18n.translate("xpack.securitySolution.detectionEngine.groups.stats.severity.medium",{defaultMessage:"Medium"}),K=n.i18n.translate("xpack.securitySolution.detectionsEngine.grouping.inspectTitle",{defaultMessage:"Grouping query"}),Y={timestamp:n.i18n.translate("xpack.securitySolution.EventRenderedView.timestampTitle.column",{defaultMessage:"Timestamp"}),rule:n.i18n.translate("xpack.securitySolution.EventRenderedView.ruleTitle.column",{defaultMessage:"Rule"}),eventSummary:n.i18n.translate("xpack.securitySolution.EventRenderedView.eventSummary.column",{defaultMessage:"Event Summary"})}},function(e,t,a){"use strict";a.d(t,"a",(function(){return b})),a.d(t,"b",(function(){return g}));var n=a(42),i=a(2),r=a.n(i),s=a(1073),o=a(774),l=a(355),c=a(356);const u=[{id:"default-system-prompt",content:c.b,name:c.a,promptType:"system"},{id:"CB9FA555-B59F-4F71-AFF9-8A891AC5BC28",content:c.d,name:c.c,promptType:"system"}];var d=a(372),p=a(21);const m=r.a.createContext(void 0),b=({actionTypeRegistry:e,assistantAvailability:t,assistantTelemetry:a,augmentMessageCodeBlocks:r,baseAllow:c,baseAllowReplacement:b,defaultAllow:g,defaultAllowReplacement:f,docLinks:y,basePromptContexts:h=[],baseQuickPrompts:v=[],baseSystemPrompts:E=u,children:x,getComments:j,http:S,getInitialConversations:k,nameSpace:O="elasticAssistantDefault",setConversations:w,setDefaultAllow:T,setDefaultAllowReplacement:I,title:C=l.c})=>{const[M,_]=Object(s.useLocalStorage)(`${O}.quickPrompts`,v),[F,A]=Object(s.useLocalStorage)(`${O}.systemPrompts`,E),[D,N]=Object(s.useLocalStorage)(`${O}.lastConversationId`),[P,R]=Object(i.useState)({}),L=Object(i.useCallback)((e=>{R((t=>null!=e&&null==t[e.id]?Object(o.b)({prevPromptContexts:t,promptContext:e}):t))}),[]),B=Object(i.useCallback)((e=>R((t=>null==t[e]?t:Object(n.omit)(e,t)))),[]),[q,z]=Object(i.useState)((e=>{})),[$,V]=Object(i.useState)(d.b),[U,H]=Object(i.useState)(k()),G=Object(i.useMemo)((()=>Object.keys(U).sort()),[U]);Object(i.useEffect)((()=>{H(k())}),[k]);const Q=Object(i.useCallback)((e=>{if("function"==typeof e){const t=e;H((e=>{const a=t(e);return w(a),a}))}else w(e),H(e)}),[w]),W=Object(i.useMemo)((()=>({actionTypeRegistry:e,assistantAvailability:t,assistantTelemetry:a,augmentMessageCodeBlocks:r,allQuickPrompts:null!=M?M:[],allSystemPrompts:null!=F?F:[],baseAllow:Object(n.uniq)(c),baseAllowReplacement:Object(n.uniq)(b),basePromptContexts:h,baseQuickPrompts:v,baseSystemPrompts:E,conversationIds:G,conversations:U,defaultAllow:Object(n.uniq)(g),defaultAllowReplacement:Object(n.uniq)(f),docLinks:y,getComments:j,http:S,promptContexts:P,nameSpace:O,registerPromptContext:L,selectedSettingsTab:$,setAllQuickPrompts:_,setAllSystemPrompts:A,setConversations:Q,setDefaultAllow:T,setDefaultAllowReplacement:I,setSelectedSettingsTab:V,setShowAssistantOverlay:z,showAssistantOverlay:q,title:C,unRegisterPromptContext:B,localStorageLastConversationId:D,setLastConversationId:N})),[e,t,a,r,c,b,h,v,E,G,U,g,f,y,j,S,D,M,F,O,Q,P,L,$,T,I,N,_,A,V,q,C,B]);return Object(p.jsx)(m.Provider,{value:W},x)},g=()=>{const e=r.a.useContext(m);if(null==e)throw new Error("useAssistantContext must be used within a AssistantProvider");return e}},function(e,t,a){"use strict";a.d(t,"cc",(function(){return i})),a.d(t,"Lb",(function(){return r})),a.d(t,"Nb",(function(){return s})),a.d(t,"Zc",(function(){return o})),a.d(t,"d",(function(){return l})),a.d(t,"bc",(function(){return c})),a.d(t,"e",(function(){return u})),a.d(t,"Bb",(function(){return d})),a.d(t,"dc",(function(){return p})),a.d(t,"f",(function(){return m})),a.d(t,"r",(function(){return b})),a.d(t,"p",(function(){return g})),a.d(t,"s",(function(){return f})),a.d(t,"q",(function(){return y})),a.d(t,"m",(function(){return h})),a.d(t,"t",(function(){return v})),a.d(t,"w",(function(){return E})),a.d(t,"g",(function(){return x})),a.d(t,"n",(function(){return j})),a.d(t,"i",(function(){return S})),a.d(t,"o",(function(){return k})),a.d(t,"j",(function(){return O})),a.d(t,"h",(function(){return w})),a.d(t,"v",(function(){return T})),a.d(t,"u",(function(){return I})),a.d(t,"W",(function(){return C})),a.d(t,"U",(function(){return M})),a.d(t,"V",(function(){return _})),a.d(t,"Y",(function(){return F})),a.d(t,"A",(function(){return A})),a.d(t,"l",(function(){return D})),a.d(t,"y",(function(){return N})),a.d(t,"k",(function(){return P})),a.d(t,"z",(function(){return R})),a.d(t,"X",(function(){return L})),a.d(t,"S",(function(){return B})),a.d(t,"K",(function(){return q})),a.d(t,"B",(function(){return z})),a.d(t,"M",(function(){return $})),a.d(t,"C",(function(){return V})),a.d(t,"E",(function(){return U})),a.d(t,"F",(function(){return H})),a.d(t,"D",(function(){return G})),a.d(t,"L",(function(){return Q})),a.d(t,"N",(function(){return W})),a.d(t,"O",(function(){return K})),a.d(t,"G",(function(){return Y})),a.d(t,"P",(function(){return J})),a.d(t,"H",(function(){return X})),a.d(t,"T",(function(){return Z})),a.d(t,"J",(function(){return ee})),a.d(t,"I",(function(){return te})),a.d(t,"Q",(function(){return ae})),a.d(t,"R",(function(){return ne})),a.d(t,"Gb",(function(){return ie})),a.d(t,"Pc",(function(){return re})),a.d(t,"Oc",(function(){return se})),a.d(t,"Uc",(function(){return oe})),a.d(t,"Sc",(function(){return le})),a.d(t,"ab",(function(){return ce})),a.d(t,"Rc",(function(){return ue})),a.d(t,"Cb",(function(){return de})),a.d(t,"Qb",(function(){return pe})),a.d(t,"Rb",(function(){return me})),a.d(t,"Ab",(function(){return be})),a.d(t,"Hb",(function(){return ge})),a.d(t,"xb",(function(){return fe})),a.d(t,"mb",(function(){return ye})),a.d(t,"lb",(function(){return he})),a.d(t,"nb",(function(){return ve})),a.d(t,"gb",(function(){return Ee})),a.d(t,"ib",(function(){return xe})),a.d(t,"hb",(function(){return je})),a.d(t,"pb",(function(){return Se})),a.d(t,"bb",(function(){return ke})),a.d(t,"ob",(function(){return Oe})),a.d(t,"eb",(function(){return we})),a.d(t,"fb",(function(){return Te})),a.d(t,"jb",(function(){return Ie})),a.d(t,"kb",(function(){return Ce})),a.d(t,"cb",(function(){return Me})),a.d(t,"db",(function(){return _e})),a.d(t,"Eb",(function(){return Fe})),a.d(t,"zb",(function(){return Ae})),a.d(t,"rb",(function(){return De})),a.d(t,"Db",(function(){return Ne})),a.d(t,"Xc",(function(){return Pe})),a.d(t,"Qc",(function(){return Re})),a.d(t,"Fc",(function(){return Le})),a.d(t,"Yb",(function(){return Be})),a.d(t,"Hc",(function(){return qe})),a.d(t,"Sb",(function(){return ze})),a.d(t,"Xb",(function(){return $e})),a.d(t,"Tb",(function(){return Ve})),a.d(t,"Ub",(function(){return Ue})),a.d(t,"Vb",(function(){return He})),a.d(t,"Wb",(function(){return Ge})),a.d(t,"sb",(function(){return Qe})),a.d(t,"b",(function(){return We})),a.d(t,"Nc",(function(){return Ke})),a.d(t,"Gc",(function(){return Ye})),a.d(t,"tb",(function(){return Je})),a.d(t,"a",(function(){return Xe})),a.d(t,"Mc",(function(){return Ze})),a.d(t,"c",(function(){return et})),a.d(t,"Zb",(function(){return tt})),a.d(t,"qb",(function(){return at})),a.d(t,"ub",(function(){return nt})),a.d(t,"Mb",(function(){return it})),a.d(t,"Tc",(function(){return rt})),a.d(t,"Ob",(function(){return st})),a.d(t,"ac",(function(){return ot})),a.d(t,"Wc",(function(){return lt})),a.d(t,"Jb",(function(){return ct})),a.d(t,"Kb",(function(){return ut})),a.d(t,"x",(function(){return dt})),a.d(t,"Vc",(function(){return pt})),a.d(t,"wb",(function(){return mt})),a.d(t,"vb",(function(){return bt})),a.d(t,"ec",(function(){return gt})),a.d(t,"Z",(function(){return ft})),a.d(t,"Dc",(function(){return yt})),a.d(t,"Ec",(function(){return ht})),a.d(t,"Cc",(function(){return vt})),a.d(t,"Ac",(function(){return Et})),a.d(t,"Bc",(function(){return xt})),a.d(t,"pc",(function(){return jt})),a.d(t,"qc",(function(){return St})),a.d(t,"nc",(function(){return kt})),a.d(t,"oc",(function(){return Ot})),a.d(t,"hc",(function(){return wt})),a.d(t,"ic",(function(){return Tt})),a.d(t,"fc",(function(){return It})),a.d(t,"gc",(function(){return Ct})),a.d(t,"yc",(function(){return Mt})),a.d(t,"zc",(function(){return _t})),a.d(t,"wc",(function(){return Ft})),a.d(t,"xc",(function(){return At})),a.d(t,"lc",(function(){return Dt})),a.d(t,"mc",(function(){return Nt})),a.d(t,"jc",(function(){return Pt})),a.d(t,"kc",(function(){return Rt})),a.d(t,"tc",(function(){return Lt})),a.d(t,"vc",(function(){return Bt})),a.d(t,"uc",(function(){return qt})),a.d(t,"rc",(function(){return zt})),a.d(t,"sc",(function(){return $t})),a.d(t,"Lc",(function(){return Vt})),a.d(t,"Ic",(function(){return Ut})),a.d(t,"Fb",(function(){return Ht})),a.d(t,"yb",(function(){return Gt})),a.d(t,"Jc",(function(){return Qt})),a.d(t,"Pb",(function(){return Wt})),a.d(t,"Yc",(function(){return Kt})),a.d(t,"Ib",(function(){return Yt})),a.d(t,"Kc",(function(){return Jt}));var n=a(5);const i=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.popoverTooltip.ariaLabel",{defaultMessage:"Tooltip for column: {columnName}",values:{columnName:e}}),r=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.importRuleTitle",{defaultMessage:"Import rules"}),s=n.i18n.translate("xpack.securitySolution.lists.detectionEngine.rules.importValueListsButton",{defaultMessage:"Import value lists"}),o=n.i18n.translate("xpack.securitySolution.lists.detectionEngine.rules.uploadValueListsButtonTooltip",{defaultMessage:"Use value lists to create an exception when a field value matches a value found in a list"}),l=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.addNewRuleTitle",{defaultMessage:"Create new rule"}),c=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.pageTitle",{defaultMessage:"Rules"}),u=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.addPageTitle",{defaultMessage:"Create"}),d=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.editPageTitle",{defaultMessage:"Edit"}),p=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.refreshTitle",{defaultMessage:"Refresh"}),m=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.batchActionsTitle",{defaultMessage:"Bulk actions"}),b=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.enableTitle",{defaultMessage:"Enable"}),g=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disableTitle",{defaultMessage:"Disable"}),f=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.exportTitle",{defaultMessage:"Export"}),y=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicateTitle",{defaultMessage:"Duplicate"}),h=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.deleteTitle",{defaultMessage:"Delete"}),v=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.indexPatternsTitle",{defaultMessage:"Index patterns"}),E=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.tagsTitle",{defaultMessage:"Tags"}),x=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addIndexPatternsTitle",{defaultMessage:"Add index patterns"}),j=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.deleteIndexPatternsTitle",{defaultMessage:"Delete index patterns"}),S=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addTagsTitle",{defaultMessage:"Add tags"}),k=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.deleteTagsTitle",{defaultMessage:"Delete tags"}),O=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.applyTimelineTemplateTitle",{defaultMessage:"Apply Timeline template"}),w=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.addRuleActionsTitle",{defaultMessage:"Add rule actions"}),T=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.setScheduleTitle",{defaultMessage:"Update rule schedules"}),I=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.contextMenuTitle",{defaultMessage:"Options"}),C=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastTitle",{defaultMessage:"Rules updates are in progress"}),M=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} updating."}),_=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditWarningToastNotifyButtonLabel",{defaultMessage:"Notify me when done"}),F=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkExportConfirmationDeniedTitle",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule} other {# rules}} cannot be exported"}),A=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkEditConfirmationDeniedTitle",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule} other {# rules}} cannot be edited"}),D=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.bulkActionConfirmationPartlyTitle",{values:{customRulesCount:e},defaultMessage:"This action can only be applied to {customRulesCount, plural, =1 {# custom rule} other {# custom rules}}"}),N=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditConfirmationCancelButtonLabel",{defaultMessage:"Cancel"}),P=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkActionConfirmationCloseButtonLabel",{defaultMessage:"Close"}),R=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditConfirmation.confirmButtonLabel",{values:{customRulesCount:e},defaultMessage:"Edit {customRulesCount, plural, =1 {# custom rule} other {# custom rules}}"}),L=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkExportConfirmation.confirmButtonLabel",{values:{customRulesCount:e},defaultMessage:"Export {customRulesCount, plural, =1 {# custom rule} other {# custom rules}}"}),B=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.saveButtonLabel",{defaultMessage:"Save"}),q=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.cancelButtonLabel",{defaultMessage:"Cancel"}),z=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsComboboxHelpText",{defaultMessage:"Enter the pattern of Elasticsearch indices that you would like to add. By default, the dropdown includes index patterns defined in Security Solution advanced settings."}),$=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteIndexPatternsComboboxHelpText",{defaultMessage:"Enter the pattern of Elasticsearch indices that you would like to delete. By default, the dropdown includes index patterns defined in Security Solution advanced settings."}),V=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsComboboxLabel",{defaultMessage:"Add index patterns for selected rules"}),U=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.indexPatternsRequiredErrorMessage",{defaultMessage:"A minimum of one index pattern is required."}),H=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsTitle",{defaultMessage:"Add index patterns"}),G=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addIndexPatternsOverwriteCheckboxLabel",{defaultMessage:"Overwrite all selected rules' index patterns"}),Q=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.dataViewsOverwriteCheckboxLabel",{defaultMessage:"Apply changes to rules configured with data views"}),W=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteIndexPatternsComboboxLabel",{defaultMessage:"Delete index patterns for selected rules"}),K=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteIndexPatternsTitle",{defaultMessage:"Delete index patterns"}),Y=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addTagsComboboxHelpText",{defaultMessage:"Add one or more tags for selected rules from the dropdown. You can also enter custom identifying tags and press Enter to begin a new one."}),J=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteTagsComboboxHelpText",{defaultMessage:"Delete one or more tags for selected rules from the dropdown. You can also enter custom identifying tags and press Enter to begin a new one."}),X=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addTagsComboboxLabel",{defaultMessage:"Add tags for selected rules"}),Z=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.tagsComoboxRequiredErrorMessage",{defaultMessage:"A minimum of one tag is required."}),ee=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addTagsTitle",{defaultMessage:"Add tags"}),te=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.addTagsOverwriteCheckboxLabel",{defaultMessage:"Overwrite all selected rules' tags"}),ae=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteTagsComboboxLabel",{defaultMessage:"Delete tags for selected rules"}),ne=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteTagsTitle",{defaultMessage:"Delete tags"}),ie=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.exportFilenameTitle",{defaultMessage:"rules_export"}),re=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.searchAriaLabel",{defaultMessage:"Search rules"}),se=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.searchPlaceholder",{defaultMessage:'Rule name, index pattern (e.g., "filebeat-*"), or MITRE ATT&CK™ tactic or technique (e.g., "Defense Evasion" or "TA0005")'}),oe=(e,t,a)=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.showingRulesTitle",{values:{firstInPage:e,lastOfPage:t,totalRules:a},defaultMessage:"Showing {firstInPage}-{lastOfPage} of {totalRules} {totalRules, plural, =1 {rule} other {rules}}"}),le=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.selectAllRulesTitle",{values:{totalRules:e},defaultMessage:"Select all {totalRules} {totalRules, plural, =1 {rule} other {rules}}"}),ce=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.clearSelectionTitle",{defaultMessage:"Clear selection"}),ue=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.selectedRulesTitle",{values:{selectedRules:e},defaultMessage:"Selected {selectedRules} {selectedRules, plural, =1 {rule} other {rules}}"}),de=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.editRuleSettingsDescription",{defaultMessage:"Edit rule settings"}),pe=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.lackOfKibanaActionsFeaturePrivileges",{defaultMessage:"You do not have Kibana Actions privileges"}),me=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.lackOfKibanaSecurityPrivileges",{defaultMessage:"You do not have Kibana Security privileges"}),be=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.duplicateRuleDescription",{defaultMessage:"Duplicate rule"}),ge=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.exportRuleDescription",{defaultMessage:"Export rule"}),fe=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.actions.deleteRuleDescription",{defaultMessage:"Delete rule"}),ye=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.ruleTitle",{defaultMessage:"Rule"}),he=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.riskScoreTitle",{defaultMessage:"Risk score"}),ve=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.severityTitle",{defaultMessage:"Severity"}),Ee=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.lastRunTitle",{defaultMessage:"Last run"}),xe=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.lastUpdateTitle",{defaultMessage:"Last updated"}),je=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.lastResponseTitle",{defaultMessage:"Last response"}),Se=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.tagsTitle",{defaultMessage:"Tags"}),ke=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.enabledTitle",{defaultMessage:"Enabled"}),Oe=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.snoozeTitle",{defaultMessage:"Notify"}),we=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.indexingTimes",{defaultMessage:"Indexing Time (ms)"}),Te=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.indexingTimesTooltip",{defaultMessage:"Total time spent indexing alerts during last Rule execution"}),Ie=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.queryTimes",{defaultMessage:"Query Time (ms)"}),Ce=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.queryTimesTooltip",{defaultMessage:"Total time spent querying source indices during last Rule execution"}),Me=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.gap",{defaultMessage:"Last Gap (if any)"}),_e=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.columns.gapTooltipSeeDocsDescription",{defaultMessage:"see documentation"}),Fe=(n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.tabs.rules",{defaultMessage:"Rules"}),n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.tabs.monitoring",{defaultMessage:"Rule Monitoring"}),n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.enabledRulesTitle",{defaultMessage:"Enabled rules"})),Ae=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.disabledRulesTitle",{defaultMessage:"Disabled rules"}),De=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.customRulesTitle",{defaultMessage:"Custom rules"}),Ne=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.elasticRulesTitle",{defaultMessage:"Elastic rules"}),Pe=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.tagsLabel",{defaultMessage:"Tags"}),Re=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.searchTagsPlaceholder",{defaultMessage:"Search tags"}),Le=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.rulesTagSearchText",{defaultMessage:"Rules tag search"}),Be=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.noTagsAvailableDescription",{defaultMessage:"No tags available"}),qe=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.ruleExecutionStatusFilter",{defaultMessage:"Select rule execution status to filter by"}),ze=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.noRulesTitle",{defaultMessage:"No rules found"}),$e=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.filters.noRulesBodyTitle",{defaultMessage:"We weren't able to find any rules with the above filters."}),Ve=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.addRules.noRulesTitle",{defaultMessage:"All Elastic rules have been installed"}),Ue=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.addRules.noRulesBodyTitle",{defaultMessage:"There are no prebuilt detection rules available for installation"}),He=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.upgradeRules.noRulesTitle",{defaultMessage:"All Elastic rules are up to date"}),Ge=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.upgradeRules.noRulesBodyTitle",{defaultMessage:"There are currently no available updates to your installed Elastic rules."}),Qe=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.defineRuleTitle",{defaultMessage:"Define rule"}),We=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.aboutRuleTitle",{defaultMessage:"About rule"}),Ke=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.scheduleRuleTitle",{defaultMessage:"Schedule rule"}),Ye=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.ruleActionsTitle",{defaultMessage:"Rule actions"}),Je=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.stepDefinitionTitle",{defaultMessage:"Definition"}),Xe=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.stepAboutTitle",{defaultMessage:"About"}),Ze=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.stepScheduleTitle",{defaultMessage:"Schedule"}),et=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.stepActionsTitle",{defaultMessage:"Actions"}),tt=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.optionalFieldDescription",{defaultMessage:"Optional"}),at=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.continueButtonTitle",{defaultMessage:"Continue"}),nt=(n.i18n.translate("xpack.securitySolution.detectionEngine.rules.updateButtonTitle",{defaultMessage:"Update"}),n.i18n.translate("xpack.securitySolution.detectionEngine.rules.deleteDescription",{defaultMessage:"Delete"})),it=n.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importRuleTitle",{defaultMessage:"Import"}),rt=n.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.selectRuleDescription",{defaultMessage:"Select rules to import. Associated rule actions and exceptions can be included."}),st=n.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.initialPromptTextDescription",{defaultMessage:"Select or drag and drop a valid rules_export.ndjson file"}),ot=n.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.overwriteDescription",{defaultMessage:'Overwrite existing detection rules with conflicting "rule_id"'}),lt=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.successfullyImportedRulesTitle",{values:{totalRules:e},defaultMessage:"Successfully imported {totalRules} {totalRules, plural, =1 {rule} other {rules}}"}),ct=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importFailedTitle",{values:{totalRules:e},defaultMessage:"Failed to import {totalRules} {totalRules, plural, =1 {rule} other {rules}}"}),ut=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importFailedDetailedTitle",{values:{message:e},defaultMessage:"{message}"}),dt=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.bulkDeleteConfirmationTitle",{defaultMessage:"Confirm bulk deletion"}),pt=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.singleDeleteConfirmationTitle",{defaultMessage:"Confirm deletion"}),mt=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.deleteConfirmationConfirm",{defaultMessage:"Delete"}),bt=n.i18n.translate("xpack.securitySolution.detectionEngine.components.allRules.deleteConfirmationCancel",{defaultMessage:"Cancel"}),gt=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.refreshRulePopoverDescription",{defaultMessage:"Automatically refresh table"}),ft=(n.i18n.translate("xpack.securitySolution.detectionEngine.rules.refreshRulePopoverLabel",{defaultMessage:"Refresh settings"}),n.i18n.translate("xpack.securitySolution.detectionEngine.rules.clearRulesTableFilters",{defaultMessage:"Clear filters"})),yt=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.successToastTitle",{defaultMessage:"Rules exported"}),ht=(e,t)=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.successToastDescription",{values:{totalRules:t,exportedRules:e},defaultMessage:"Successfully exported {exportedRules} of {totalRules} {totalRules, plural, =1 {rule} other {rules}}."}),vt=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.prebuiltRulesExcludedToastDescription",{defaultMessage:"Prebuilt rules were excluded from the resulting file."}),Et=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.errorToastTitle",{defaultMessage:"Error exporting rules"}),xt=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.export.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to export."}),jt=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.successToastTitle",{defaultMessage:"Rules duplicated"}),St=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.successToastDescription",{values:{totalRules:e},defaultMessage:"Successfully duplicated {totalRules, plural, =1 {{totalRules} rule} other {{totalRules} rules}}"}),kt=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.errorToastTitle",{defaultMessage:"Error duplicating rule"}),Ot=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to duplicate."}),wt=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.delete.successToastTitle",{defaultMessage:"Rules deleted"}),Tt=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.delete.successToastDescription",{values:{totalRules:e},defaultMessage:"Successfully deleted {totalRules, plural, =1 {{totalRules} rule} other {{totalRules} rules}}"}),It=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.delete.errorToastTitle",{defaultMessage:"Error deleting rules"}),Ct=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.delete.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to delete."}),Mt=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.enable.successToastTitle",{defaultMessage:"Rules enabled"}),_t=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkAction.enable.successToastDescription",{values:{totalRules:e},defaultMessage:"Successfully enabled {totalRules, plural, =1 {{totalRules} rule} other {{totalRules} rules}}"}),Ft=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.enable.errorToastTitle",{defaultMessage:"Error enabling rules"}),At=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.enable.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to enable."}),Dt=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disable.successToastTitle",{defaultMessage:"Rules disabled"}),Nt=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disable.successToastDescription",{values:{totalRules:e},defaultMessage:"Successfully disabled {totalRules, plural, =1 {{totalRules} rule} other {{totalRules} rules}}"}),Pt=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disable.errorToastTitle",{defaultMessage:"Error disabling rules"}),Rt=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.disable.errorToastDescription",{values:{rulesCount:e},defaultMessage:"{rulesCount, plural, =1 {# rule is} other {# rules are}} failed to disable."}),Lt=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.successToastTitle",{defaultMessage:"Rules updated"}),Bt=(e,t)=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.successToastDescription",{values:{succeededRulesCount:e,skippedRulesCount:t},defaultMessage:"{succeededRulesCount, plural, =0 {} =1 {You've successfully updated # rule. } other {You've successfully updated # rules. }}\n        {skippedRulesCount, plural, =0 {} =1 { # rule was skipped.} other { # rules were skipped.}}\n        "}),qt=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.successIndexEditToastDescription",{defaultMessage:"If you did not select to apply changes to rules using Kibana data views, those rules were not updated and will continue using data views."}),zt=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.errorToastTitle",{defaultMessage:"Error updating rules"}),$t=(e,t)=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.errorToastDescription",{values:{failedRulesCount:e,skippedRulesCount:t},defaultMessage:"{failedRulesCount, plural, =0 {} =1 {# rule} other {# rules}} failed to update. {skippedRulesCount, plural, =0 {} =1 { # rule was skipped.} other { # rules were skipped.}}"}),Vt=(n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.cancelButtonLabel",{defaultMessage:"Cancel"}),n.i18n.translate("xpack.securitySolution.hooks.useGetSavedQuery.errorToastMessage",{defaultMessage:"Failed to load the saved query"})),Ut=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagement.ruleManagementContextDescription",{defaultMessage:"Selected Detection Rules"}),Ht=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagement.explainThenSummarizeRuleDetails",{defaultMessage:"Please explain the selected rules above. For each rule, highlight why they are relevant, the query as published on Elastic's detection rules repository and an in-depth explanation of it, and what they typically mean for an organization if detected."}),Gt=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagement.detectionRulesConversationId",{defaultMessage:"Detection Rules"}),Qt=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagement.ruleManagementContextTooltip",{defaultMessage:"Add this alert as context"}),Wt=n.i18n.translate("xpack.securitySolution.addRules.installRuleButton",{defaultMessage:"Install rule"}),Kt=n.i18n.translate("xpack.securitySolution.addRules.upgradeRuleButton",{defaultMessage:"Update rule"}),Yt=n.i18n.translate("xpack.securitySolution.addRules.goBackToRulesTableButton",{defaultMessage:"Go back to installed Elastic rules"}),Jt=n.i18n.translate("xpack.securitySolution.ruleUpdates.documentationLink",{defaultMessage:"See what's new in Prebuilt Security Detection Rules"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return m})),a.d(t,"c",(function(){return b})),a.d(t,"b",(function(){return n})),a.d(t,"d",(function(){return i}));var n=a(151),i=(a(541),a(542)),r=a(42),s=a(208),o=a(114),l=a(286),c=a(707);const{socTrends:u,...d}=Object(l.d)(!1),p={global:{timerange:{kind:"relative",...d},queries:[],policy:Object(l.c)(!1),linkTo:[o.a.timeline],query:{query:"",language:"kuery"},filters:[],fullScreen:!1},timeline:{timerange:{kind:"relative",...d},queries:[],policy:Object(l.c)(!1),linkTo:[o.a.global],query:{query:"",language:"kuery"},filters:[],fullScreen:!1}},m=e=>{const{from:t,fromStr:a,to:n,toStr:i,socTrends:r}=Object(l.d)(),{kind:s,duration:c}=Object(l.c)();return{global:{timerange:{kind:"relative",fromStr:a,toStr:i,from:t,to:n},queries:[],policy:{kind:s,duration:c},linkTo:[o.a.timeline,...e?[o.a.socTrends]:[]],query:{query:"",language:"kuery"},filters:[],fullScreen:!1},timeline:{timerange:{kind:"relative",fromStr:a,toStr:i,from:t,to:n},queries:[],policy:{kind:s,duration:c},linkTo:[o.a.global],query:{query:"",language:"kuery"},filters:[],fullScreen:!1},...e?{socTrends:{timerange:r,linkTo:[o.a.global],policy:{kind:s,duration:c}}}:{}}},b=Object(s.reducerWithInitialState)(p).case(n.setTimelineRangeDatePicker,((e,{from:t,to:a})=>({...e,global:{...e.global,linkTo:e.global.linkTo.filter((e=>e!==o.a.timeline))},timeline:{...e.timeline,timerange:{kind:"absolute",fromStr:void 0,toStr:void 0,from:t,to:a},linkTo:[]}}))).case(n.setAbsoluteRangeDatePicker,((e,{id:t,from:a,to:n,fromStr:i,toStr:r})=>{const s={kind:"absolute",fromStr:i,toStr:r,from:a,to:n};return Object(c.i)(t,s,e)})).case(n.setRelativeRangeDatePicker,((e,{id:t,fromStr:a,from:n,to:i,toStr:r})=>{const s={kind:"relative",fromStr:a,toStr:r,from:n,to:i};return Object(c.i)(t,s,e)})).case(n.setFullScreen,((e,{id:t,fullScreen:a})=>Object(c.h)(t,a,e))).case(n.deleteAllQuery,((e,{id:t})=>({...e,[t]:{...Object(r.get)(t,e),queries:e.global.queries.slice(e.global.queries.length)}}))).case(n.setQuery,((e,{inputId:t,id:a,inspect:n,loading:i,refetch:r,searchSessionId:s})=>Object(c.j)({inputId:t,id:a,inspect:n,loading:i,refetch:r,state:e,searchSessionId:s}))).case(n.deleteOneQuery,((e,{inputId:t,id:a})=>Object(c.b)({inputId:t,id:a,state:e}))).case(n.setDuration,((e,{id:t,duration:a})=>({...e,[t]:{...Object(r.get)(t,e),policy:{...Object(r.get)(`${t}.policy`,e),duration:a}}}))).case(n.startAutoReload,((e,{id:t})=>({...e,[t]:{...Object(r.get)(t,e),policy:{...Object(r.get)(`${t}.policy`,e),kind:"interval"}}}))).case(n.stopAutoReload,((e,{id:t})=>({...e,[t]:{...Object(r.get)(t,e),policy:{...Object(r.get)(`${t}.policy`,e),kind:"manual"}}}))).case(n.toggleTimelineLinkTo,(e=>Object(c.g)(e))).case(n.toggleSocTrendsLinkTo,(e=>Object(c.f)(e))).case(n.setInspectionParameter,((e,{id:t,inputId:a,isInspected:n,selectedInspectIndex:i,searchSessionId:r})=>Object(c.e)({id:t,inputId:a,isInspected:n,selectedInspectIndex:i,state:e,searchSessionId:r}))).case(n.removeLinkTo,((e,t)=>Object(c.d)(t,e))).case(n.addLinkTo,((e,t)=>Object(c.a)(t,e))).case(n.setFilterQuery,((e,{id:t,query:a,language:n})=>({...e,[t]:{...Object(r.get)(t,e),query:{query:a,language:n}}}))).case(n.setSavedQuery,((e,{id:t,savedQuery:a})=>({...e,[t]:{...Object(r.get)(t,e),savedQuery:a}}))).case(n.setSearchBarFilter,((e,{id:t,filters:a})=>({...e,[t]:{...Object(r.get)(t,e),filters:a}}))).build()},,function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"h",(function(){return o})),a.d(t,"i",(function(){return l})),a.d(t,"k",(function(){return c})),a.d(t,"j",(function(){return u})),a.d(t,"l",(function(){return d})),a.d(t,"m",(function(){return p})),a.d(t,"n",(function(){return m})),a.d(t,"o",(function(){return b})),a.d(t,"q",(function(){return g})),a.d(t,"p",(function(){return f})),a.d(t,"y",(function(){return y})),a.d(t,"A",(function(){return h})),a.d(t,"B",(function(){return v})),a.d(t,"C",(function(){return E})),a.d(t,"D",(function(){return x})),a.d(t,"d",(function(){return j})),a.d(t,"e",(function(){return S})),a.d(t,"f",(function(){return k})),a.d(t,"g",(function(){return O})),a.d(t,"E",(function(){return w})),a.d(t,"F",(function(){return T})),a.d(t,"G",(function(){return I})),a.d(t,"H",(function(){return C})),a.d(t,"J",(function(){return M})),a.d(t,"K",(function(){return _})),a.d(t,"L",(function(){return F})),a.d(t,"M",(function(){return A})),a.d(t,"Y",(function(){return D})),a.d(t,"Z",(function(){return N})),a.d(t,"ab",(function(){return P})),a.d(t,"bb",(function(){return R})),a.d(t,"z",(function(){return L})),a.d(t,"cb",(function(){return B})),a.d(t,"db",(function(){return q})),a.d(t,"N",(function(){return z})),a.d(t,"O",(function(){return $})),a.d(t,"Q",(function(){return V})),a.d(t,"T",(function(){return U})),a.d(t,"U",(function(){return H})),a.d(t,"R",(function(){return G})),a.d(t,"S",(function(){return Q})),a.d(t,"X",(function(){return W})),a.d(t,"W",(function(){return K})),a.d(t,"s",(function(){return Y})),a.d(t,"r",(function(){return J})),a.d(t,"w",(function(){return X})),a.d(t,"P",(function(){return Z})),a.d(t,"x",(function(){return ee})),a.d(t,"I",(function(){return te})),a.d(t,"V",(function(){return ae})),a.d(t,"t",(function(){return ne})),a.d(t,"v",(function(){return ie})),a.d(t,"u",(function(){return re}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.open.timeline.batchActionsTitle",{defaultMessage:"Bulk actions"}),r=n.i18n.translate("xpack.securitySolution.open.timeline.cancelButton",{defaultMessage:"Cancel"}),s=n.i18n.translate("xpack.securitySolution.open.timeline.collapseButton",{defaultMessage:"Collapse"}),o=n.i18n.translate("xpack.securitySolution.open.timeline.deleteButton",{defaultMessage:"Delete"}),l=n.i18n.translate("xpack.securitySolution.open.timeline.deleteSelectedButton",{defaultMessage:"Delete selected"}),c=n.i18n.translate("xpack.securitySolution.open.timeline.deleteWarningLabel",{defaultMessage:"You will not be able to recover this timeline or its notes once deleted."}),u=n.i18n.translate("xpack.securitySolution.open.timeline.deleteTemplateWarningLabel",{defaultMessage:"You will not be able to recover this timeline template or its notes once deleted."}),d=n.i18n.translate("xpack.securitySolution.open.timeline.descriptionTableHeader",{defaultMessage:"Description"}),p=n.i18n.translate("xpack.securitySolution.open.timeline.expandButton",{defaultMessage:"Expand"}),m=n.i18n.translate("xpack.securitySolution.open.timeline.exportFileNameTitle",{defaultMessage:"timelines_export"}),b=n.i18n.translate("xpack.securitySolution.open.timeline.exportSelectedButton",{defaultMessage:"Export selected"}),g=n.i18n.translate("xpack.securitySolution.open.timeline.favoriteSelectedButton",{defaultMessage:"Favorite selected"}),f=n.i18n.translate("xpack.securitySolution.open.timeline.favoritesTooltip",{defaultMessage:"Favorites"}),y=n.i18n.translate("xpack.securitySolution.open.timeline.lastModifiedTableHeader",{defaultMessage:"Last modified"}),h=n.i18n.translate("xpack.securitySolution.open.timeline.missingSavedObjectIdTooltip",{defaultMessage:"Missing savedObjectId"}),v=n.i18n.translate("xpack.securitySolution.open.timeline.modifiedByTableHeader",{defaultMessage:"Modified by"}),E=n.i18n.translate("xpack.securitySolution.open.timeline.notesTooltip",{defaultMessage:"Notes"}),x=n.i18n.translate("xpack.securitySolution.open.timeline.onlyFavoritesButtonLabel",{defaultMessage:"Only favorites"}),j=n.i18n.translate("xpack.securitySolution.open.timeline.createRuleFromTimelineTooltip",{defaultMessage:"Create query rule from timeline"}),S=n.i18n.translate("xpack.securitySolution.open.timeline.createRuleFromTimelineEqlTooltip",{defaultMessage:"Create EQL rule from timeline"}),k=n.i18n.translate("xpack.securitySolution.open.timeline.createTemplateFromTimelineTooltip",{defaultMessage:"Create template from timeline"}),O=n.i18n.translate("xpack.securitySolution.open.timeline.createTimelineFromTemplateTooltip",{defaultMessage:"Create timeline from template"}),w=n.i18n.translate("xpack.securitySolution.open.timeline.openAsDuplicateTooltip",{defaultMessage:"Duplicate timeline"}),T=n.i18n.translate("xpack.securitySolution.open.timeline.openAsDuplicateTemplateTooltip",{defaultMessage:"Duplicate template"}),I=n.i18n.translate("xpack.securitySolution.open.timeline.openTimelineButton",{defaultMessage:"Open Timeline…"}),C=n.i18n.translate("xpack.securitySolution.open.timeline.openTimelineTitle",{defaultMessage:"Open"}),M=n.i18n.translate("xpack.securitySolution.open.timeline.pinnedEventsTooltip",{defaultMessage:"Pinned events"}),_=n.i18n.translate("xpack.securitySolution.open.timeline.refreshTitle",{defaultMessage:"Refresh"}),F=n.i18n.translate("xpack.securitySolution.open.timeline.searchPlaceholder",{defaultMessage:"e.g. timeline name, or description"}),A=n.i18n.translate("xpack.securitySolution.open.timeline.searchTemplatePlaceholder",{defaultMessage:"e.g. template name, or description"}),D=n.i18n.translate("xpack.securitySolution.open.timeline.timelineNameTableHeader",{defaultMessage:"Timeline name"}),N=n.i18n.translate("xpack.securitySolution.open.timeline.timelineTemplateNameTableHeader",{defaultMessage:"Template name"}),P=n.i18n.translate("xpack.securitySolution.open.timeline.untitledTimelineLabel",{defaultMessage:"Untitled timeline"}),R=n.i18n.translate("xpack.securitySolution.open.timeline.withLabel",{defaultMessage:"with"}),L=n.i18n.translate("xpack.securitySolution.open.timeline.loadingLabel",{defaultMessage:"Loading..."}),B=n.i18n.translate("xpack.securitySolution.open.timeline.zeroTimelinesMatchLabel",{defaultMessage:"0 timelines match the search criteria"}),q=n.i18n.translate("xpack.securitySolution.open.timeline.zeroTimelineTemplatesMatchLabel",{defaultMessage:"0 timeline templates match the search criteria"}),z=e=>n.i18n.translate("xpack.securitySolution.open.timeline.selectedTemplatesTitle",{values:{selectedTemplates:e},defaultMessage:"Selected {selectedTemplates} {selectedTemplates, plural, =1 {template} other {templates}}"}),$=e=>n.i18n.translate("xpack.securitySolution.open.timeline.selectedTimelinesTitle",{values:{selectedTimelines:e},defaultMessage:"Selected {selectedTimelines} {selectedTimelines, plural, =1 {timeline} other {timelines}}"}),V=n.i18n.translate("xpack.securitySolution.open.timeline.showingLabel",{defaultMessage:"Showing:"}),U=e=>n.i18n.translate("xpack.securitySolution.open.timeline.successfullyExportedTimelinesTitle",{values:{totalTimelines:e},defaultMessage:"Successfully exported {totalTimelines, plural, =0 {all timelines} =1 {{totalTimelines} timeline} other {{totalTimelines} timelines}}"}),H=e=>n.i18n.translate("xpack.securitySolution.open.timeline.successfullyExportedTimelineTemplatesTitle",{values:{totalTimelineTemplates:e},defaultMessage:"Successfully exported {totalTimelineTemplates, plural, =0 {all timelines} =1 {{totalTimelineTemplates} timeline template} other {{totalTimelineTemplates} timeline templates}}"}),G=e=>n.i18n.translate("xpack.securitySolution.open.timeline.successfullyDeletedTimelinesTitle",{values:{totalTimelines:e},defaultMessage:"Successfully deleted {totalTimelines, plural, =0 {all timelines} =1 {{totalTimelines} timeline} other {{totalTimelines} timelines}}"}),Q=e=>n.i18n.translate("xpack.securitySolution.open.timeline.successfullyDeletedTimelineTemplatesTitle",{values:{totalTimelineTemplates:e},defaultMessage:"Successfully deleted {totalTimelineTemplates, plural, =0 {all timelines} =1 {{totalTimelineTemplates} timeline template} other {{totalTimelineTemplates} timeline templates}}"}),W=n.i18n.translate("xpack.securitySolution.timelines.components.tabs.timelinesTitle",{defaultMessage:"Timelines"}),K=n.i18n.translate("xpack.securitySolution.timelines.components.tabs.templatesTitle",{defaultMessage:"Templates"}),Y=n.i18n.translate("xpack.securitySolution.timelines.components.templateFilter.elasticTitle",{defaultMessage:"Elastic templates"}),J=n.i18n.translate("xpack.securitySolution.timelines.components.templateFilter.customizedTitle",{defaultMessage:"Custom templates"}),X=n.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.importTimelineTitle",{defaultMessage:"Import"}),Z=n.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.selectTimelineDescription",{defaultMessage:"Select a timeline or timeline template file to import"}),ee=n.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.initialPromptTextDescription",{defaultMessage:"Select or drag and drop a valid timelines_export.ndjson file"}),te=n.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.overwriteDescription",{defaultMessage:"Automatically overwrite saved objects with the same timeline ID"}),ae=e=>n.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.successfullyImportedTimelinesTitle",{values:{totalCount:e},defaultMessage:"Successfully imported {totalCount} {totalCount, plural, =1 {item} other {items}}"}),ne=e=>n.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.importFailedTitle",{values:{totalTimelines:e},defaultMessage:"Failed to import {totalTimelines} {totalTimelines, plural, =1 {timeline} other {timelines}}"}),ie=n.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.importTitle",{defaultMessage:"Import…"}),re=e=>n.i18n.translate("xpack.securitySolution.timelines.components.importTimelineModal.importFailedDetailedTitle",{values:{message:e},defaultMessage:"{message}"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return r})),a.d(t,"b",(function(){return i})),a.d(t,"c",(function(){return o})),a.d(t,"d",(function(){return l}));var n=a(2);const i=()=>{const e=Object(n.useRef)(!1),t=Object(n.useCallback)((()=>e.current),[]),a=Object(n.useCallback)((()=>{e.current=!1}),[]);return Object(n.useEffect)((()=>(e.current=!0,a)),[a]),t},r=e=>{const t=i(),[a,r]=Object(n.useState)(!1),[s,o]=Object(n.useState)(),[l,c]=Object(n.useState)();return{error:s,loading:a,result:l,start:Object(n.useCallback)(((...a)=>{r(!0),c(void 0),o(void 0),e(...a).then((e=>t()&&c(e))).catch((e=>t()&&o(e))).finally((()=>t()&&r(!1)))}),[e,t])}};function s(e,t){switch(t.type){case"setResult":return{...e,result:t.result,loading:!1};case"setError":return{...e,error:t.error,loading:!1};case"load":return{loading:!0,result:void 0,error:void 0}}}const o=e=>{const t=i(),a=Object(n.useRef)(),[r,o]=Object(n.useReducer)(s,{loading:!1,error:void 0,result:void 0}),l=Object(n.useCallback)(((...n)=>{a.current&&a.current.unsubscribe(),o({type:"load"}),a.current=e(...n).subscribe((e=>{t()&&o({type:"setResult",result:e})}),(e=>{t()&&o({type:"setError",error:e})}))}),[e,t]);return Object(n.useEffect)((()=>()=>{a.current&&a.current.unsubscribe()}),[]),{result:r.result,error:r.error,loading:r.loading,start:l}},l=e=>t=>{const a=null!=t.signal?t.signal:(new AbortController).signal;return e({...t,signal:a})}},function(e,t,a){"use strict";a.d(t,"e",(function(){return n.b})),a.d(t,"a",(function(){return n.a})),a.d(t,"g",(function(){return n.d})),a.d(t,"f",(function(){return n.c})),a.d(t,"d",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"b",(function(){return s}));var n=a(118);const i="open",r="closed",s="acknowledged"},,function(e,t,a){"use strict";a.d(t,"a",(function(){return h})),a.d(t,"b",(function(){return v}));var n=a(41),i=a.n(n),r=(a(21),a(2)),s=a.n(r),o=a(40),l=a(348),c=a(186),u=a(266),d=a(175),p=a(4),m=a(110),b=a(116),g=a(1072),f=a(282);const y=Object(r.createContext)(void 0),h=({id:e,indexName:t,scopeId:a,children:n})=>{var i;const h=Object(u.a)(),v=t?null!==(i=Object(c.a)(t,h))&&void 0!==i?i:t:"",[{pageName:x}]=Object(d.a)(),j=x===p.wc.detections?m.SourcererScopeName.detections:m.SourcererScopeName.default,S=Object(b.d)(j),[k,O,w,T,I]=Object(l.a)({indexName:v,eventId:null!=e?e:"",runtimeMappings:S.runtimeMappings,skip:!e}),C=Object(g.a)(null==w?void 0:w.fields),{ruleId:M}=Object(c.b)(O),{rule:_}=Object(f.a)(M),F=Object(r.useMemo)((()=>{var n;return e&&t&&a?{eventId:e,indexName:t,scopeId:a,browserFields:S.browserFields,dataAsNestedObject:T,dataFormattedForFieldBrowser:O,searchHit:w,investigationFields:null!==(n=null==_?void 0:_.investigation_fields)&&void 0!==n?n:[],refetchFlyoutData:I,getFieldsData:C}:void 0}),[e,_,t,a,S.browserFields,T,O,w,I,C]);return k?s.a.createElement(E,null,s.a.createElement(o.EuiLoadingSpinner,{size:"xxl"})):s.a.createElement(y.Provider,{value:F},n)},v=()=>{const e=Object(r.useContext)(y);if(!e)throw new Error("RightPanelContext can only be used within RightPanelContext provider");return e};var E=i()(o.EuiFlexItem).withConfig({displayName:"_StyledEuiFlexItem",componentId:"sc-x22vh9-0"})(["align-items:center;justify-content:center;"])},function(e,t,a){"use strict";a.d(t,"c",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return s}));var n=a(43);const i=e=>n.union([e,n.null]),r=(e,t="enum")=>new n.Type(t,(t=>Object.values(e).includes(t)),((t,a)=>Object.values(e).includes(t)?n.success(t):n.failure(t,a)),(e=>e)),s=(e,t="Unknown Field in switch statement")=>{throw new Error(`${t}: ${e}`)}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.isDeepEqual=t.off=t.on=t.isClient=void 0;var n=a(34).__importDefault(a(1171));t.isClient="object"==typeof window,t.on=function(e){for(var t=[],a=1;a<arguments.length;a++)t[a-1]=arguments[a];return e.addEventListener.apply(e,t)},t.off=function(e){for(var t=[],a=1;a<arguments.length;a++)t[a-1]=arguments[a];return e.removeEventListener.apply(e,t)},t.isDeepEqual=n.default},function(e,t,a){"use strict";e.exports=function(e){return e<-2}},function(e,t,a){"use strict";a.d(t,"g",(function(){return u})),a.d(t,"f",(function(){return d})),a.d(t,"n",(function(){return p})),a.d(t,"a",(function(){return m})),a.d(t,"c",(function(){return b})),a.d(t,"d",(function(){return g})),a.d(t,"h",(function(){return f})),a.d(t,"l",(function(){return h})),a.d(t,"b",(function(){return v})),a.d(t,"e",(function(){return E})),a.d(t,"i",(function(){return x})),a.d(t,"j",(function(){return j})),a.d(t,"m",(function(){return S})),a.d(t,"k",(function(){return C}));var n=a(42),i=a(59),r=a(713),s=a(145),o=a(161),l=a(150),c=a(170);const u=(e,t)=>e.reduce(((e,a)=>{const n=[a,...a.and].filter((e=>e.enabled));if(!n.length)return e;const i=n.map((e=>((e,t)=>{const{excluded:a,type:n,queryMatch:{field:i,operator:r,value:c}}=e,u=Object(o.c)(i,t),d=a?"NOT ":"";switch(r){case l.d:return k({browserFields:t,field:i,isExcluded:d,isFieldTypeNested:u,type:n,value:c});case l.b:return`${d}${T({browserFields:t,field:i,isFieldTypeNested:u})}`;case l.c:return O({field:i,isExcluded:d,value:c});default:Object(s.a)(r)}})(e,t))),r=i.join(" and ");return[...e,r]}),[]).filter((e=>!Object(n.isEmpty)(e))).reduce(((e,t,a,n)=>n.length<=1?t:a?`${e} or (${t})`:`(${t})`),""),d="event-column-view",p=({globalFullScreen:e,graphEventId:t})=>!e||!(e=>null!=e&&""!==e)(t),m="1",b=2,g="local-events-count-button",f=({itemsCount:e,itemsPerPage:t})=>0===e||0===t?0:Math.ceil(e/t),y=e=>Object(i.elementOrChildrenHasFocus)(null==e?void 0:e.querySelector(`.${c.a}`)),h=({containerElement:e,keyboardEvent:t,onSkipFocusBeforeEventsTable:a,onSkipFocusAfterEventsTable:n})=>{const{shiftKey:r}=t,s=Object(i.getTableSkipFocus)({containerElement:e,getFocusedCell:i.getFocusedAriaColindexCell,shiftKey:r,tableHasFocus:y,tableClassName:c.a});"SKIP_FOCUS_NOOP"!==s&&(Object(i.stopPropagationAndPreventDefault)(t),Object(i.handleSkipFocus)({onSkipFocusBackwards:a,onSkipFocusForward:n,skipFocus:s}))},v="active-timeline-button",E="timeline-flyout-button-bar",x=()=>{setTimeout((()=>{var e;null===(e=document.querySelector(`div.${E} .${v}`))||void 0===e||e.focus()}),0)},j=e=>{var t;null==e||null===(t=e.querySelector("div.siemUtilityBar__action:last-of-type button"))||void 0===t||t.focus()},S=()=>{var e;null===(e=document.querySelector("header.headerGlobalNav a.chrHeaderLogo"))||void 0===e||e.focus()},k=({browserFields:e,field:t,isExcluded:a,isFieldTypeNested:n,type:i,value:r})=>C(r)?`${a}${t} : ${JSON.stringify(r)}`:`${a}${i!==l.a.template?w({browserFields:e,field:t,isFieldTypeNested:n,value:r}):T({browserFields:e,field:t,isFieldTypeNested:n})}`,O=({field:e,isExcluded:t,value:a})=>C(a)?`${t}${I({field:e,value:a})}`:`${t}${e} : ${JSON.stringify(a)}`,w=({browserFields:e,field:t,isFieldTypeNested:a,value:n})=>a?Object(o.h)(t,n,e):Object(o.b)(t,e)?Object(o.e)(t,n):`${t} : ${Object(r.a)(n)}`,T=({browserFields:e,field:t,isFieldTypeNested:a})=>a?Object(o.g)(t,e).trim():`${t} ${l.b}`.trim(),I=({field:e,value:t})=>{const a=e.trim();return t.length?`${a} : (${t.map((e=>Object(n.isNumber)(e)?e:Object(r.b)(String(e).trim()))).join(" OR ")})`:`${a} : ''`},C=e=>Array.isArray(e)&&(e.every((e=>"string"==typeof e))||e.every((e=>"number"==typeof e)))},function(e,t,a){"use strict";a.d(t,"a",(function(){return d})),a.d(t,"c",(function(){return p})),a.d(t,"b",(function(){return b}));var n=a(40),i=a(2),r=a.n(i),s=a(114),o=a(311),l=a(454),c=a(561),u=a(455);const d="inspectButtonComponent",p=({children:e,show:t=!0})=>r.a.createElement(o.a,{show:t,targetClassNames:[d]},e),m=({compact:e=!1,inputId:t=s.a.global,inspectIndex:a=0,isDisabled:i,multiple:o=!1,onCloseInspect:p,queryId:m="",showInspectButton:b=!0,title:g=""})=>{const{additionalRequests:f,additionalResponses:y,handleClick:h,handleCloseModal:v,isButtonDisabled:E,isShowingModal:x,loading:j,request:S,response:k}=Object(c.a)({inputId:t,inspectIndex:a,isDisabled:i,multiple:o,onCloseInspect:p,queryId:m});return r.a.createElement(r.a.Fragment,null,t===s.a.timeline&&!e&&b&&r.a.createElement(n.EuiButtonEmpty,{className:d,"aria-label":u.d,"data-test-subj":"inspect-empty-button",color:"text",iconSide:"left",iconType:"inspect",isDisabled:E,isLoading:j,onClick:h},u.d),(t===s.a.global||e)&&b&&r.a.createElement(n.EuiButtonIcon,{className:d,"aria-label":u.d,"data-test-subj":"inspect-icon-button",iconSize:"m",iconType:"inspect",isDisabled:E,title:u.d,onClick:h}),x&&null!==S&&null!==k&&r.a.createElement(l.a,{additionalRequests:f,additionalResponses:y,closeModal:v,"data-test-subj":"inspect-modal",inputId:t,request:S,response:k,title:g}))};m.displayName="InspectButtonComponent";const b=r.a.memo(m)},function(e,t,a){"use strict";a.d(t,"d",(function(){return n})),a.d(t,"b",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"a",(function(){return s}));const n=":",i=":*",r="includes";let s;!function(e){e.default="default",e.template="template"}(s||(s={}))},function(e,t,a){"use strict";a.r(t),a.d(t,"setAbsoluteRangeDatePicker",(function(){return r})),a.d(t,"setTimelineRangeDatePicker",(function(){return s})),a.d(t,"setRelativeRangeDatePicker",(function(){return o})),a.d(t,"setDuration",(function(){return l})),a.d(t,"startAutoReload",(function(){return c})),a.d(t,"stopAutoReload",(function(){return u})),a.d(t,"setFullScreen",(function(){return d})),a.d(t,"setQuery",(function(){return p})),a.d(t,"deleteOneQuery",(function(){return m})),a.d(t,"setInspectionParameter",(function(){return b})),a.d(t,"deleteAllQuery",(function(){return g})),a.d(t,"toggleTimelineLinkTo",(function(){return f})),a.d(t,"toggleSocTrendsLinkTo",(function(){return y})),a.d(t,"removeLinkTo",(function(){return h})),a.d(t,"addLinkTo",(function(){return v})),a.d(t,"setFilterQuery",(function(){return E})),a.d(t,"setSavedQuery",(function(){return x})),a.d(t,"setSearchBarFilter",(function(){return j}));var n=a(22);const i=a.n(n)()("x-pack/security_solution/local/inputs"),r=i("SET_ABSOLUTE_RANGE_DATE_PICKER"),s=i("SET_TIMELINE_RANGE_DATE_PICKER"),o=i("SET_RELATIVE_RANGE_DATE_PICKER"),l=i("SET_DURATION"),c=i("START_KQL_AUTO_RELOAD"),u=i("STOP_KQL_AUTO_RELOAD"),d=i("SET_FULL_SCREEN"),p=i("SET_QUERY"),m=i("DELETE_QUERY"),b=i("SET_INSPECTION_PARAMETER"),g=i("DELETE_ALL_QUERY"),f=i("TOGGLE_TIMELINE_LINK_TO"),y=i("TOGGLE_SOC_TRENDS_LINK_TO"),h=i("REMOVE_LINK_TO"),v=i("ADD_LINK_TO"),E=i("SET_FILTER_QUERY"),x=i("SET_SAVED_QUERY"),j=i("SET_SEARCH_BAR_FILTER")},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n="row-renderer-example"},function(e,t,a){"use strict";a.d(t,"d",(function(){return u})),a.d(t,"e",(function(){return d})),a.d(t,"c",(function(){return m})),a.d(t,"n",(function(){return b}));var n=a(42),i=a(109),r=a(119),s=a(176),o=a(115),l=a(182),c=a(434);a.d(t,"f",(function(){return i.g})),a.d(t,"h",(function(){return i.i})),a.d(t,"g",(function(){return i.h})),a.d(t,"l",(function(){return i.m})),a.d(t,"k",(function(){return i.l})),a.d(t,"p",(function(){return i.r})),a.d(t,"o",(function(){return i.q})),a.d(t,"m",(function(){return i.n})),a.d(t,"i",(function(){return i.j})),a.d(t,"q",(function(){return i.w})),a.d(t,"r",(function(){return i.x})),a.d(t,"j",(function(){return i.k})),a.d(t,"a",(function(){return i.b})),a.d(t,"b",(function(){return i.e}));const u=({activeTimelineDataProviders:e,dataProviders:t,dispatch:a,result:n,timelineId:r,noProviderFound:s=l.b.noProviderFound,onAddedToTimeline:o})=>{const u=Object(i.p)(n),d=t[u];d?Object(c.b)({dataProviders:e,destination:n.destination,dispatch:a,onAddedToTimeline:o,providerToAdd:d,timelineId:r}):a(s({id:u}))},d=({isAggregatable:e,fieldType:t,fieldName:a,hideTopN:n})=>{const i=["boolean","geo-point","geo-shape","ip","keyword","number","numeric","string"].includes(t),r=["kibana.alert.ancestors.depth","kibana.alert.ancestors.id","kibana.alert.ancestors.rule","kibana.alert.ancestors.type","kibana.alert.original_event.action","kibana.alert.original_event.category","kibana.alert.original_event.code","kibana.alert.original_event.created","kibana.alert.original_event.dataset","kibana.alert.original_event.duration","kibana.alert.original_event.end","kibana.alert.original_event.hash","kibana.alert.original_event.id","kibana.alert.original_event.kind","kibana.alert.original_event.module","kibana.alert.original_event.original","kibana.alert.original_event.outcome","kibana.alert.original_event.provider","kibana.alert.original_event.risk_score","kibana.alert.original_event.risk_score_norm","kibana.alert.original_event.sequence","kibana.alert.original_event.severity","kibana.alert.original_event.start","kibana.alert.original_event.timezone","kibana.alert.original_event.type","kibana.alert.original_time","kibana.alert.rule.created_by","kibana.alert.rule.description","kibana.alert.rule.enabled","kibana.alert.rule.false_positives","kibana.alert.rule.from","kibana.alert.rule.uuid","kibana.alert.rule.immutable","kibana.alert.rule.interval","kibana.alert.rule.max_signals","kibana.alert.rule.name","kibana.alert.rule.note","kibana.alert.rule.references","kibana.alert.risk_score","kibana.alert.rule.rule_id","kibana.alert.severity","kibana.alert.rule.size","kibana.alert.rule.tags","kibana.alert.rule.threat","kibana.alert.rule.threat.tactic.id","kibana.alert.rule.threat.tactic.name","kibana.alert.rule.threat.tactic.reference","kibana.alert.rule.threat.technique.id","kibana.alert.rule.threat.technique.name","kibana.alert.rule.threat.technique.reference","kibana.alert.rule.timeline_id","kibana.alert.rule.timeline_title","kibana.alert.rule.to","kibana.alert.rule.type","kibana.alert.rule.updated_by","kibana.alert.rule.version","kibana.alert.workflow_status"].includes(a);return!n&&(r||e&&i)},p={"kibana.alert.rule.name":"kibana.alert.rule.uuid","event.module":"rule.reference"},m=({browserFields:e,dispatch:t,result:a,scopeId:l,defaultsHeader:c})=>{var u;const d=Object(i.o)(a),m=(e=>Object(n.keyBy)("name",(e=>Object.values(e).reduce(((e,t)=>[...e,...Object.values(null!=t.fields?t.fields:{})]),[]))(e)))(e)[d],b=l!==r.e.alertsOnAlertsPage&&l!==r.e.alertsOnRuleDetailsPage||null===(u=c.find((e=>e.id===d)))||void 0===u?{}:u,g=Object(o.getScopedActions)(l);var f;null!=m&&g?t(g.upsertColumn({column:{category:m.category,columnHeaderType:"not-filtered",description:Object(n.isString)(m.description)?m.description:void 0,example:Object(n.isString)(m.example)?m.example:void 0,id:d,linkField:null!==(f=p[d])&&void 0!==f?f:void 0,type:m.type,aggregatable:m.aggregatable,initialWidth:s.a,...b},id:l,index:null!=a.destination?a.destination.index:0})):g&&t(g.upsertColumn({column:{columnHeaderType:"not-filtered",id:d,initialWidth:s.a},id:l,index:null!=a.destination?a.destination.index:0}))},b=e=>e.slice(e.lastIndexOf(".")+1)},function(e,t,a){"use strict";var n=a(237);e.exports=function(e,t,a,i){var r=i?i-1:1/0,s=0;return function(i){return n(i)?(e.enter(a),o(i)):t(i)};function o(i){return n(i)&&s++<r?(e.consume(i),o):(e.exit(a),t(i))}}},function(e,t,a){"use strict";a.d(t,"C",(function(){return i})),a.d(t,"q",(function(){return r})),a.d(t,"v",(function(){return s})),a.d(t,"l",(function(){return o})),a.d(t,"o",(function(){return l})),a.d(t,"p",(function(){return c})),a.d(t,"m",(function(){return u})),a.d(t,"n",(function(){return d})),a.d(t,"B",(function(){return p})),a.d(t,"r",(function(){return m})),a.d(t,"u",(function(){return b})),a.d(t,"y",(function(){return g})),a.d(t,"k",(function(){return f})),a.d(t,"E",(function(){return y})),a.d(t,"w",(function(){return h})),a.d(t,"b",(function(){return v})),a.d(t,"x",(function(){return E})),a.d(t,"z",(function(){return x})),a.d(t,"t",(function(){return j})),a.d(t,"s",(function(){return S})),a.d(t,"a",(function(){return k})),a.d(t,"c",(function(){return O})),a.d(t,"F",(function(){return w})),a.d(t,"g",(function(){return T})),a.d(t,"A",(function(){return I})),a.d(t,"D",(function(){return C})),a.d(t,"e",(function(){return M})),a.d(t,"d",(function(){return _})),a.d(t,"f",(function(){return F})),a.d(t,"i",(function(){return A})),a.d(t,"h",(function(){return D})),a.d(t,"j",(function(){return N}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.alertDetails.threatIntel",{defaultMessage:"Threat Intel"}),r=n.i18n.translate("xpack.securitySolution.alertDetails.overview.investigationGuide",{defaultMessage:"Investigation guide"}),s=n.i18n.translate("xpack.securitySolution.alertDetails.overview",{defaultMessage:"Overview"}),o=n.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields",{defaultMessage:"Highlighted fields"}),l=n.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields.field",{defaultMessage:"Field"}),c=n.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields.value",{defaultMessage:"Value"}),u=n.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields.alertPrevalence",{defaultMessage:"Alert prevalence"}),d=n.i18n.translate("xpack.securitySolution.alertDetails.overview.highlightedFields.alertPrevalenceTooltip",{defaultMessage:"The total count of alerts with the same value within the currently selected timerange. This value is not affected by additional filters."}),p=n.i18n.translate("xpack.securitySolution.eventDetails.table",{defaultMessage:"Table"}),m=n.i18n.translate("xpack.securitySolution.eventDetails.jsonView",{defaultMessage:"JSON"}),b=n.i18n.translate("xpack.securitySolution.eventDetails.osqueryView",{defaultMessage:"Osquery Results"}),g=n.i18n.translate("xpack.securitySolution.eventDetails.responseActionsView",{defaultMessage:"Response Results"}),f=n.i18n.translate("xpack.securitySolution.eventDetails.field",{defaultMessage:"Field"}),y=n.i18n.translate("xpack.securitySolution.eventDetails.value",{defaultMessage:"Value"}),h=(n.i18n.translate("xpack.securitySolution.eventDetails.description",{defaultMessage:"Description"}),n.i18n.translate("xpack.securitySolution.eventDetails.filter.placeholder",{defaultMessage:"Filter by Field, Value, or Description..."})),v=n.i18n.translate("xpack.securitySolution.detections.alerts.agentStatus",{defaultMessage:"Agent status"}),E=n.i18n.translate("xpack.securitySolution.detections.alerts.quarantinedFilePath",{defaultMessage:"Quarantined file path"}),x=n.i18n.translate("xpack.securitySolution.detections.alerts.ruleType",{defaultMessage:"Rule type"}),j=n.i18n.translate("xpack.securitySolution.eventDetails.multiFieldTooltipContent",{defaultMessage:"Multi-fields can have multiple values per field"}),S=n.i18n.translate("xpack.securitySolution.eventDetails.multiFieldBadge",{defaultMessage:"multi-field"}),k=n.i18n.translate("xpack.securitySolution.eventDetails.table.actions",{defaultMessage:"Actions"}),O=n.i18n.translate("xpack.securitySolution.eventDetails.alertReason",{defaultMessage:"Alert reason"}),w=n.i18n.translate("xpack.securitySolution.eventDetails.viewAllFields",{defaultMessage:"View all fields in table"}),T=Object.freeze({tried:e=>n.i18n.translate("xpack.securitySolution.eventDetails.responseActions.endpoint.tried",{values:{command:e},defaultMessage:"tried to execute {command} command"}),executed:e=>n.i18n.translate("xpack.securitySolution.eventDetails.responseActions.endpoint.executed",{values:{command:e},defaultMessage:"executed {command} command"}),pending:e=>n.i18n.translate("xpack.securitySolution.eventDetails.responseActions.endpoint.pending",{values:{command:e},defaultMessage:"is executing {command} command"}),failed:e=>n.i18n.translate("xpack.securitySolution.eventDetails.responseActions.endpoint.failed",{values:{command:e},defaultMessage:"failed to execute {command} command"})}),I=n.i18n.translate("xpack.securitySolution.eventDetails.summaryView",{defaultMessage:"summary"}),C=n.i18n.translate("xpack.securitySolution.eventDetails.timelineView",{defaultMessage:"Timeline"}),M=n.i18n.translate("xpack.securitySolution.alertSummaryView.alertSummaryViewConversationId",{defaultMessage:"Alert summary"}),_=e=>n.i18n.translate("xpack.securitySolution.alertSummaryView.alertSummaryViewContextDescription",{defaultMessage:"Alert (from {view})",values:{view:e}}),F=n.i18n.translate("xpack.securitySolution.alertSummaryView.alertSummaryViewContextTooltip",{defaultMessage:"Add this alert as context"}),A=n.i18n.translate("xpack.securitySolution.alertSummaryView.eventSummaryViewConversationId",{defaultMessage:"Event summary"}),D=e=>n.i18n.translate("xpack.securitySolution.alertSummaryView.eventSummaryViewContextDescription",{defaultMessage:"Event (from {view})",values:{view:e}}),N=n.i18n.translate("xpack.securitySolution.alertSummaryView.eventSummaryViewContextTooltip",{defaultMessage:"Add this event as context"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return m})),a.d(t,"u",(function(){return b})),a.d(t,"v",(function(){return g})),a.d(t,"l",(function(){return f})),a.d(t,"j",(function(){return y})),a.d(t,"m",(function(){return h})),a.d(t,"k",(function(){return v})),a.d(t,"d",(function(){return E})),a.d(t,"e",(function(){return x})),a.d(t,"h",(function(){return j})),a.d(t,"p",(function(){return S})),a.d(t,"q",(function(){return k})),a.d(t,"g",(function(){return O})),a.d(t,"n",(function(){return w})),a.d(t,"o",(function(){return T})),a.d(t,"r",(function(){return I})),a.d(t,"f",(function(){return C})),a.d(t,"i",(function(){return M})),a.d(t,"s",(function(){return _})),a.d(t,"t",(function(){return F})),a.d(t,"c",(function(){return A}));var n=a(970),i=a(324),r=a(421),s=a(120),o=a(163),l=a(538),c=a(512);const u=async e=>Object(l.pipe)(await e(),Object(c.fold)((e=>Promise.reject(e)),(e=>Promise.resolve(e)))),d=e=>e instanceof Error?e:new Error(String(e)),p=async({http:e,list:t,signal:a})=>Object(i.flow)((()=>Object(n.tryCatch)((()=>(async({http:e,list:t,signal:a})=>e.fetch(o.t,{body:JSON.stringify(t),method:"POST",signal:a}))({http:e,list:t,signal:a})),d)),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.o,e)))),Object(i.flow)(u))(),m=async({http:e,listItem:t,signal:a})=>Object(i.flow)((()=>Object(n.tryCatch)((()=>(async({http:e,listItem:t,signal:a})=>e.fetch(o.q,{body:JSON.stringify(t),method:"POST",signal:a}))({http:e,listItem:t,signal:a})),d)),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.n,e)))),Object(i.flow)(u))(),b=async({http:e,list:t,signal:a})=>Object(i.flow)((()=>Object(n.tryCatch)((()=>(async({http:e,list:t,signal:a})=>e.fetch(o.t,{body:JSON.stringify(t),method:"PUT",signal:a}))({http:e,list:t,signal:a})),d)),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.o,e)))),Object(i.flow)(u))(),g=async({http:e,listItem:t,signal:a})=>Object(i.flow)((()=>Object(n.tryCatch)((()=>(async({http:e,listItem:t,signal:a})=>e.fetch(o.q,{body:JSON.stringify(t),method:"PUT",signal:a}))({http:e,listItem:t,signal:a})),d)),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.n,e)))),Object(i.flow)(u))(),f=async({filters:e,http:t,namespaceTypes:a,pagination:l,signal:c,sort:p})=>Object(i.flow)((()=>Object(n.tryCatch)((()=>(async({http:e,filters:t,namespaceTypes:a,pagination:n,signal:i,sort:r})=>{const s={filter:t||void 0,namespace_type:a,page:n.page?`${n.page}`:"1",per_page:n.perPage?`${n.perPage}`:"20",sort_field:null!=r&&r.field?null==r?void 0:r.field:"exception-list.created_at",sort_order:null!=r&&r.order?null==r?void 0:r.order:"desc"};return e.fetch(`${o.t}/_find`,{method:"GET",query:s,signal:i})})({filters:e,http:t,namespaceTypes:a,pagination:l,signal:c,sort:p})),d)),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.t,e)))),Object(i.flow)(u))(),y=async({http:e,id:t,namespaceType:a,signal:l})=>Object(i.flow)((()=>Object(n.tryCatch)((()=>(async({http:e,id:t,namespaceType:a,signal:n})=>e.fetch(o.t,{method:"GET",query:{id:t,namespace_type:a},signal:n}))({http:e,id:t,namespaceType:a,signal:l})),d)),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.o,e)))),Object(i.flow)(u))(),h=async({filter:e,http:t,listIds:a,namespaceTypes:l,pagination:c,search:p,signal:m})=>Object(i.flow)((()=>Object(n.tryCatch)((()=>(async({http:e,listIds:t,namespaceTypes:a,filter:n,pagination:i,search:r,signal:s})=>{const l={list_id:t.join(","),namespace_type:a.join(","),page:i.page?`${i.page}`:"1",per_page:i.perPage?`${i.perPage}`:"20",search:r,sort_field:"exception-list.created_at",sort_order:"desc",filter:n};return e.fetch(`${o.q}/_find`,{method:"GET",query:l,signal:s})})({filter:e,http:t,listIds:a,namespaceTypes:l,pagination:c,search:p,signal:m})),d)),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.s,e)))),Object(i.flow)(u))(),v=async({http:e,id:t,namespaceType:a,signal:l})=>Object(i.flow)((()=>Object(n.tryCatch)((()=>(async({http:e,id:t,namespaceType:a,signal:n})=>e.fetch(o.q,{method:"GET",query:{id:t,namespace_type:a},signal:n}))({http:e,id:t,namespaceType:a,signal:l})),d)),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.n,e)))),Object(i.flow)(u))(),E=async({http:e,id:t,namespaceType:a,signal:l})=>Object(i.flow)((()=>Object(n.tryCatch)((()=>(async({http:e,id:t,namespaceType:a,signal:n})=>e.fetch(o.t,{method:"DELETE",query:{id:t,namespace_type:a},signal:n}))({http:e,id:t,namespaceType:a,signal:l})),d)),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.o,e)))),Object(i.flow)(u))(),x=async({http:e,id:t,namespaceType:a,signal:l})=>Object(i.flow)((()=>Object(n.tryCatch)((()=>(async({http:e,id:t,namespaceType:a,signal:n})=>e.fetch(o.q,{method:"DELETE",query:{id:t,namespace_type:a},signal:n}))({http:e,id:t,namespaceType:a,signal:l})),d)),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.n,e)))),Object(i.flow)(u))(),j=async({http:e,id:t,includeExpiredExceptions:a,listId:n,namespaceType:i,signal:r})=>e.fetch(`${o.t}/_export`,{method:"POST",query:{id:t,list_id:n,namespace_type:i,include_expired_exceptions:a},signal:r}),S=async({alias:e,chunkSize:t,exceptionListIds:a,excludeExceptions:n,http:i,signal:r})=>i.fetch(o.p,{method:"POST",body:JSON.stringify({exception_list_ids:a,type:"exception_list_ids",alias:e,exclude_exceptions:n,chunk_size:t}),signal:r}),k=async({exceptions:e,alias:t,excludeExceptions:a,http:n,chunkSize:i,signal:r})=>n.fetch(o.p,{method:"POST",body:JSON.stringify({exceptions:e,type:"exception_items",alias:t,exclude_exceptions:a,chunk_size:i}),signal:r}),O=async({http:e,includeExpiredExceptions:t,listId:a,namespaceType:n,signal:i})=>e.fetch(`${o.t}/_duplicate`,{method:"POST",query:{list_id:a,namespace_type:n,include_expired_exceptions:t},signal:i}),w=async({cursor:e,http:t,pageIndex:a,pageSize:c,signal:p,sortField:m,sortOrder:b})=>Object(l.pipe)({cursor:null!=e?e.toString():void 0,page:null!=a?a.toString():void 0,per_page:null!=c?c.toString():void 0,sort_field:null!=m?m.toString():void 0,sort_order:b},(e=>Object(n.fromEither)(Object(r.c)(s.r,e))),Object(n.chain)((e=>Object(n.tryCatch)((()=>(async({http:e,cursor:t,page:a,per_page:n,signal:i,sort_field:r,sort_order:s})=>e.fetch(`${o.z}/_find`,{method:"GET",query:{cursor:t,page:a,per_page:n,sort_field:r,sort_order:s},signal:i}))({http:t,signal:p,...e})),d))),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.u,e)))),Object(i.flow)(u)),T=async({cursor:e,http:t,pageIndex:a,pageSize:c,signal:p})=>Object(l.pipe)({cursor:null!=e?e.toString():void 0,page:null!=a?a.toString():void 0,per_page:null!=c?c.toString():void 0},(e=>Object(n.fromEither)(Object(r.c)(s.r,e))),Object(n.chain)((e=>Object(n.tryCatch)((()=>(async({http:e,cursor:t,page:a,per_page:n,signal:i})=>e.fetch(`${o.u}`,{method:"GET",query:{cursor:t,page:a,per_page:n},signal:i}))({http:t,signal:p,...e})),d))),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.v,e)))),Object(i.flow)(u)),I=async({file:e,http:t,listId:a,type:i,signal:c})=>Object(l.pipe)({list_id:a,type:i},(e=>Object(n.fromEither)(Object(r.c)(s.w,e))),Object(n.chain)((t=>Object(l.pipe)(Object(n.fromEither)(Object(r.c)(s.x,{file:e})),Object(n.map)((e=>({...e,...t})))))),Object(n.chain)((e=>Object(n.tryCatch)((()=>(async({file:e,http:t,list_id:a,type:n,signal:i})=>{const r=new FormData;return r.append("file",e),t.fetch(`${o.x}/_import`,{body:r,headers:{"Content-Type":void 0},method:"POST",query:{list_id:a,type:n},signal:i})})({http:t,signal:c,...e})),d))),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.A,e)))),u),C=async({deleteReferences:e,http:t,id:a,ignoreReferences:c,signal:p})=>Object(l.pipe)({deleteReferences:e,id:a,ignoreReferences:c},(e=>Object(n.fromEither)(Object(r.c)(s.j,e))),Object(n.chain)((e=>Object(n.tryCatch)((()=>(async({deleteReferences:e=!1,http:t,id:a,ignoreReferences:n=!1,signal:i})=>t.fetch(o.z,{method:"DELETE",query:{deleteReferences:e,id:a,ignoreReferences:n},signal:i}))({http:t,signal:p,...e})),d))),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.A,e)))),Object(i.flow)(u)),M=async({http:e,listId:t,signal:a})=>Object(l.pipe)({list_id:t},(e=>Object(n.fromEither)(Object(r.c)(s.q,e))),Object(n.chain)((t=>Object(n.tryCatch)((()=>(async({http:e,list_id:t,signal:a})=>e.fetch(`${o.x}/_export`,{method:"POST",query:{list_id:t},signal:a}))({http:e,signal:a,...t})),d))),Object(i.flow)(u)),_=async({http:e,signal:t})=>Object(i.flow)((()=>Object(n.tryCatch)((()=>(async({http:e,signal:t})=>e.fetch(o.w,{method:"GET",signal:t}))({http:e,signal:t})),d)),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.z,e)))),Object(i.flow)(u))(),F=async({http:e,signal:t})=>e.fetch(o.y,{method:"GET",signal:t}),A=async({http:e,signal:t})=>Object(i.flow)((()=>Object(n.tryCatch)((()=>(async({http:e,signal:t})=>e.fetch(o.w,{method:"POST",signal:t}))({http:e,signal:t})),d)),Object(n.chain)((e=>Object(n.fromEither)(Object(r.c)(s.e,e)))),Object(i.flow)(u))()},function(e,t,a){const n=a(325),{MAX_LENGTH:i,MAX_SAFE_INTEGER:r}=a(326),{safeRe:s,t:o}=a(310),l=a(451),{compareIdentifiers:c}=a(559);class SemVer{constructor(e,t){if(t=l(t),e instanceof SemVer){if(e.loose===!!t.loose&&e.includePrerelease===!!t.includePrerelease)return e;e=e.version}else if("string"!=typeof e)throw new TypeError(`Invalid version. Must be a string. Got type "${typeof e}".`);if(e.length>i)throw new TypeError(`version is longer than ${i} characters`);n("SemVer",e,t),this.options=t,this.loose=!!t.loose,this.includePrerelease=!!t.includePrerelease;const a=e.trim().match(t.loose?s[o.LOOSE]:s[o.FULL]);if(!a)throw new TypeError(`Invalid Version: ${e}`);if(this.raw=e,this.major=+a[1],this.minor=+a[2],this.patch=+a[3],this.major>r||this.major<0)throw new TypeError("Invalid major version");if(this.minor>r||this.minor<0)throw new TypeError("Invalid minor version");if(this.patch>r||this.patch<0)throw new TypeError("Invalid patch version");a[4]?this.prerelease=a[4].split(".").map((e=>{if(/^[0-9]+$/.test(e)){const t=+e;if(t>=0&&t<r)return t}return e})):this.prerelease=[],this.build=a[5]?a[5].split("."):[],this.format()}format(){return this.version=`${this.major}.${this.minor}.${this.patch}`,this.prerelease.length&&(this.version+=`-${this.prerelease.join(".")}`),this.version}toString(){return this.version}compare(e){if(n("SemVer.compare",this.version,this.options,e),!(e instanceof SemVer)){if("string"==typeof e&&e===this.version)return 0;e=new SemVer(e,this.options)}return e.version===this.version?0:this.compareMain(e)||this.comparePre(e)}compareMain(e){return e instanceof SemVer||(e=new SemVer(e,this.options)),c(this.major,e.major)||c(this.minor,e.minor)||c(this.patch,e.patch)}comparePre(e){if(e instanceof SemVer||(e=new SemVer(e,this.options)),this.prerelease.length&&!e.prerelease.length)return-1;if(!this.prerelease.length&&e.prerelease.length)return 1;if(!this.prerelease.length&&!e.prerelease.length)return 0;let t=0;do{const a=this.prerelease[t],i=e.prerelease[t];if(n("prerelease compare",t,a,i),void 0===a&&void 0===i)return 0;if(void 0===i)return 1;if(void 0===a)return-1;if(a!==i)return c(a,i)}while(++t)}compareBuild(e){e instanceof SemVer||(e=new SemVer(e,this.options));let t=0;do{const a=this.build[t],i=e.build[t];if(n("prerelease compare",t,a,i),void 0===a&&void 0===i)return 0;if(void 0===i)return 1;if(void 0===a)return-1;if(a!==i)return c(a,i)}while(++t)}inc(e,t,a){switch(e){case"premajor":this.prerelease.length=0,this.patch=0,this.minor=0,this.major++,this.inc("pre",t,a);break;case"preminor":this.prerelease.length=0,this.patch=0,this.minor++,this.inc("pre",t,a);break;case"prepatch":this.prerelease.length=0,this.inc("patch",t,a),this.inc("pre",t,a);break;case"prerelease":0===this.prerelease.length&&this.inc("patch",t,a),this.inc("pre",t,a);break;case"major":0===this.minor&&0===this.patch&&0!==this.prerelease.length||this.major++,this.minor=0,this.patch=0,this.prerelease=[];break;case"minor":0===this.patch&&0!==this.prerelease.length||this.minor++,this.patch=0,this.prerelease=[];break;case"patch":0===this.prerelease.length&&this.patch++,this.prerelease=[];break;case"pre":{const e=Number(a)?1:0;if(!t&&!1===a)throw new Error("invalid increment argument: identifier is empty");if(0===this.prerelease.length)this.prerelease=[e];else{let n=this.prerelease.length;for(;--n>=0;)"number"==typeof this.prerelease[n]&&(this.prerelease[n]++,n=-2);if(-1===n){if(t===this.prerelease.join(".")&&!1===a)throw new Error("invalid increment argument: identifier already exists");this.prerelease.push(e)}}if(t){let n=[t,e];!1===a&&(n=[t]),0===c(this.prerelease[0],t)?isNaN(this.prerelease[1])&&(this.prerelease=n):this.prerelease=n}break}default:throw new Error(`invalid increment argument: ${e}`)}return this.raw=this.format(),this.build.length&&(this.raw+=`+${this.build.join(".")}`),this}}e.exports=SemVer},function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"b",(function(){return p})),a.d(t,"d",(function(){return m})),a.d(t,"c",(function(){return f}));var n={};a.r(n),a.d(n,"setDataView",(function(){return s})),a.d(n,"setDataViewLoading",(function(){return o})),a.d(n,"setSignalIndexName",(function(){return l})),a.d(n,"setSourcererDataViews",(function(){return c})),a.d(n,"setSourcererScopeLoading",(function(){return u})),a.d(n,"setSelectedDataView",(function(){return d}));var i=a(22);const r=a.n(i)()("x-pack/security_solution/local/sourcerer"),s=r("SET_DATA_VIEW"),o=r("SET_DATA_VIEW_LOADING"),l=r("SET_SIGNAL_INDEX_NAME"),c=r("SET_SOURCERER_DATA_VIEWS"),u=r("SET_SOURCERER_SCOPE_LOADING"),d=r("SET_SELECTED_DATA_VIEW");var p=a(110),m=a(537),b=a(208),g=a(477);const f=Object(b.reducerWithInitialState)(p.initialSourcererState).case(l,((e,{signalIndexName:t})=>({...e,signalIndexName:t}))).case(o,((e,{id:t,loading:a})=>({...e,...t===e.defaultDataView.id?{defaultDataView:{...e.defaultDataView,loading:a}}:{},kibanaDataViews:e.kibanaDataViews.map((e=>e.id===t?{...e,loading:a}:e))}))).case(c,((e,{defaultDataView:t,kibanaDataViews:a})=>({...e,defaultDataView:{...e.defaultDataView,...t},kibanaDataViews:a.map((t=>{var a;return{...null!==(a=e.kibanaDataViews.find((({id:e})=>e===t.id)))&&void 0!==a?a:p.initDataView,...t}}))}))).case(u,((e,{id:t,loading:a})=>({...e,sourcererScopes:{...e.sourcererScopes,...null!=t?{[t]:{...e.sourcererScopes[t],loading:a}}:{[p.SourcererScopeName.default]:{...e.sourcererScopes[p.SourcererScopeName.default],loading:a},[p.SourcererScopeName.detections]:{...e.sourcererScopes[p.SourcererScopeName.detections],loading:a},[p.SourcererScopeName.timeline]:{...e.sourcererScopes[p.SourcererScopeName.timeline],loading:a}}}}))).case(d,((e,t)=>{const{shouldValidateSelectedPatterns:a=!0,...n}=t;return{...e,sourcererScopes:{...e.sourcererScopes,...Object(g.c)(e,n,a)}}})).case(s,((e,t)=>({...e,...t.id===e.defaultDataView.id?{defaultDataView:{...e.defaultDataView,...t}}:{},kibanaDataViews:e.kibanaDataViews.map((e=>e.id===t.id?{...e,...t}:e))}))).build()},function(e,t,a){"use strict";a.d(t,"b",(function(){return s})),a.d(t,"a",(function(){return o}));var n=a(2),i=a(102);const r={managed:!0},s=()=>{const{services:{apm:e}}=Object(i.j)();return{startTransaction:Object(n.useCallback)((({name:t,type:a="user-interaction",options:n})=>e.startTransaction(t,a,null!=n?n:r)),[e])}},o=e=>`Timeline search ${e}`},function(e,t,a){"use strict";a.d(t,"b",(function(){return b})),a.d(t,"d",(function(){return g})),a.d(t,"a",(function(){return f})),a.d(t,"c",(function(){return y}));var n=a(2),i=a(42),r=a(103),s=a(246),o=a.n(s),l=a(56),c=a(254),u=a(105),d=a(754),p=a(175),m=a(20);const b=(e,t)=>{const a=Object(r.useDispatch)(),i=Object(c.e)(e);Object(n.useEffect)((()=>{const n=i();return a(d.a.registerUrlParam({key:e,initialValue:n})),t(n),()=>{a(d.a.deregisterUrlParam({key:e}))}}),[])},g=e=>{const t=Object(r.useDispatch)();return Object(n.useCallback)((a=>{t(d.a.updateUrlParam({key:e,value:a}))}),[t,e])},f=()=>{const e=Object(u.b)(d.c.selectGlobalUrlParam);return Object(n.useMemo)((()=>{const t={};return e?(Object.keys(e).forEach((a=>{const n=e[a];if(n&&("object"!=typeof n||!Object(i.isEmpty)(n)))try{t[a]=Object(l.encode)(n)}catch{}})),Object(c.a)(Object(i.pickBy)((e=>!Object(i.isEmpty)(e)),t))):""}),[e])},y=()=>{const[{pageName:e}]=Object(p.a)(),t=Object(u.b)(d.c.selectGlobalUrlParam),a=o()(t),r=Object(c.f)();Object(n.useEffect)((()=>{var n;const s=null!==(n=Object(m.b)(e))&&void 0!==n?n:{skipUrlState:!0},o={...t};s.skipUrlState&&Object.keys(o).forEach((e=>{o[e]=null})),Object(i.difference)(Object.keys(null!=a?a:{}),Object.keys(t)).forEach((e=>{o[e]=null})),Object.keys(o).length>0&&r(o)}),[a,t,e,r])}},function(e,t,a){"use strict";a.d(t,"f",(function(){return u})),a.d(t,"e",(function(){return d})),a.d(t,"b",(function(){return b})),a.d(t,"h",(function(){return g})),a.d(t,"g",(function(){return f})),a.d(t,"c",(function(){return y})),a.d(t,"a",(function(){return h})),a.d(t,"i",(function(){return E})),a.d(t,"d",(function(){return x}));var n=a(49),i=a(42),r=a(240),s=a.n(r),o=a(713),l=a(106),c=a(118);const u=(e,t)=>{try{return e?JSON.stringify(Object(n.toElasticsearchQuery)(Object(n.fromKueryExpression)(e),t)):""}catch(e){return""}},d=(e,t)=>`${e}: ${(e=>!isNaN(Number(e)))(t)?t:new Date(t.toString()).valueOf()}`,p=s()((e=>{const t=Object(i.get)("base",e);return null!=t&&null!=t.fields?Object.keys(t.fields):[]})),m=(e,t)=>{const a=e.split(".");return p(t).includes(e)?["base","fields",e]:[a[0],"fields",e]},b=(e,t)=>{const a=m(e,t),n=Object(i.get)(a,t);return null!=n&&"date"===n.type},g=(e,t,a)=>{const n=m(e,a),r=Object(i.get)(n,a),s=r.subType.nested.path;return`${s}: { ${e.replace(`${s}.`,"")}: ${"date"===r.type?`"${t}"`:t} }`},f=(e,t)=>{const a=m(e,t),n=Object(i.get)(a,t).subType.nested.path;return`${n}: { ${e.replace(`${n}.`,"")}: * }`},y=(e,t)=>{const a=m(e,t),n=Object(i.get)(a,t);return!(null==n||!n.subType||!n.subType.nested)},h=(e,t)=>({range:{"@timestamp":{gte:e,lt:t,format:"strict_date_optional_time"}},meta:{type:"range",disabled:!1,negate:!1,alias:null,key:"@timestamp",params:{gte:e,lt:t,format:"strict_date_optional_time"}},$state:{store:n.FilterStateStore.APP_STATE}}),v=e=>Object(i.isEmpty)(e)||Object(i.isEmpty)(e.filter((e=>!0===e.enabled))),E=({config:e,indexPattern:t,queries:a,filters:i})=>{try{return[JSON.stringify(Object(n.buildEsQuery)(t,a,i.filter((e=>!1===e.meta.disabled)),{nestedIgnoreUnmapped:!0,...e,dateFormatTZ:void 0})),void 0]}catch(e){return[void 0,e]}},x=({config:e,dataProviders:t,indexPattern:a,browserFields:n,filters:r=[],kqlQuery:s,kqlMode:u})=>{const p={query:"",language:s.language};if(v(t)&&Object(i.isEmpty)(s.query)&&Object(i.isEmpty)(r))return null;if(v(t)&&Object(i.isEmpty)(s.query)&&!Object(i.isEmpty)(r)){const[t,n]=E({config:e,queries:[p],indexPattern:a,filters:r});return{filterQuery:t,kqlError:n}}const m="filter"===u?"and":"or",h=((e,t)=>e.reduce(((e,a)=>{const n=[a,...a.and].filter((e=>e.enabled));if(!n.length)return e;const i=n.map((e=>((e,t)=>`${e.excluded?"NOT ":""}${e.queryMatch.operator!==c.a&&e.type!==l.a.template?y(e.queryMatch.field,t)?g(e.queryMatch.field,e.queryMatch.value,t):b(e.queryMatch.field,t)?d(e.queryMatch.field,e.queryMatch.value):`${e.queryMatch.field} : ${Array.isArray(e.queryMatch.value)?e.queryMatch.value:Object(o.a)(e.queryMatch.value)}`:y(e.queryMatch.field,t)?f(e.queryMatch.field,t):`${e.queryMatch.field} ${c.a}`}`.trim())(e,t))),r=i.join(" and ");return[...e,r]}),[]).filter((e=>!Object(i.isEmpty)(e))).reduce(((e,t,a,n)=>n.length<=1?t:a?`${e} or (${t})`:`(${t})`),""))(t,n),x=(j=s.query,Object(i.isEmpty)(j)?"":`(${j})`);var j;const S=h?`(${h})`:"",k=S&&x?m:"";p.query=`(${S} ${k} ${x})`;const[O,w]=E({config:e,queries:[p],indexPattern:a,filters:r});return{filterQuery:O,kqlError:w}}},,,function(e,t,a){"use strict";a.d(t,"a",(function(){return k})),a.d(t,"e",(function(){return O})),a.d(t,"d",(function(){return w})),a.d(t,"f",(function(){return T})),a.d(t,"g",(function(){return C})),a.d(t,"c",(function(){return $})),a.d(t,"h",(function(){return V})),a.d(t,"b",(function(){return U}));var n=a(388),i=a(42),r=a(47),s=a(343),o=a.n(s),l=a(114),c=a(118),u=a(106),d=a(241),p=a(151),m=a(12),b=a(133),g=a(190),f=a(176),y=a(718),h=a(150),v=a(387),E=a(158),x=a(110),j=a(286),S=a(209);const k="open-timeline",O=({pinnedEventIds:e})=>null!=e?Object.keys(e).length:0,w=({eventIdToNoteIds:e,noteIds:t})=>(null!=e?Object.keys(e).reduce(((t,a)=>t+e[a].length),0):0)+(null!=t?t.length:0),T=({title:e})=>null==e||0===e.trim().length,I=(e,t)=>"__typename"===e?void 0:t,C=e=>JSON.parse(JSON.stringify(e),I),M=e=>{try{return JSON.parse(e)}catch{return e}},_=e=>Object.entries(e).reduce(((e,[t,a])=>"id"!==t&&null!=a?{...e,[t]:a}:e),{columnHeaderType:g.a,id:null!=e.id?e.id:"unknown",initialWidth:"@timestamp"===e.id?f.b:f.a}),F=e=>({$state:{store:"appState"},meta:{...e.meta,...e.meta&&null!=e.meta.field?{params:M(e.meta.field)}:{},...e.meta&&null!=e.meta.params?{params:M(e.meta.params)}:{},...e.meta&&null!=e.meta.value?{value:M(e.meta.value)}:{}},...null!=e.exists?{exists:M(e.exists)}:{},...null!=e.match_all?{exists:M(e.match_all)}:{},...null!=e.missing?{exists:M(e.missing)}:{},...null!=e.query?{query:M(e.query)}:{},...null!=e.range?{range:M(e.range)}:{},...null!=e.script?{exists:M(e.script)}:{}}),A=(e,t)=>e?{}:null!=t?t.reduce(((e,t)=>{if(null!=t.eventId){const a=Object(i.getOr)([],t.eventId,e);return{...e,[t.eventId]:[...a,t.noteId]}}return e}),{}):{},D=(e,t)=>e?{}:null!=t?t.reduce(((e,t)=>({...e,...null!=t.eventId?{[t.eventId]:t}:{}})),{}):{},N=(e,t)=>e?{}:null!=t?t.reduce(((e,t)=>({...e,[t]:!0})),{}):{},P=(e,t,a)=>a===u.l.default&&e.timelineType===u.l.template?e.templateTimelineId:t&&e.timelineType===u.l.template?Object(r.v4)():e.templateTimelineId,R=({and:e,...t})=>t.type===u.a.template?o()(t,{type:u.a.default,enabled:t.queryMatch.operator!==h.d,queryMatch:{value:t.queryMatch.operator===h.d?"":t.queryMatch.value}}):t,L=(e,t,a)=>e&&t&&a===u.l.default?t.map((e=>{var t,a;return{...R(e),and:null!==(t=null===(a=e.and)||void 0===a?void 0:a.map(R))&&void 0!==t?t:[]}})):t,B=(e,t,a)=>a&&e.timelineType!==a?"":t?`${e.title} - Duplicate`:e.title||"",q=(e,t,a)=>a&&e.timelineType!==a?u.k.draft:t?u.k.active:e.status,z=(e,t,a)=>{const i=e.timelineType===u.l.template,r={...e,columns:null!=e.columns?e.columns.map(_):g.b,defaultColumns:g.b,dateRange:e.status===u.k.immutable&&e.timelineType===u.l.template?{start:j.a.toISOString(),end:j.b.toISOString()}:e.dateRange,dataProviders:L(t,e.dataProviders,a),eventIdToNoteIds:A(t,e.eventIdToNoteIds),filters:null!=e.filters?e.filters.map(F):[],isFavorite:!t&&null!=e.favorite&&e.favorite.length>0,noteIds:t?[]:null!=e.noteIds?e.noteIds:[],pinnedEventIds:N(t,e.pinnedEventIds),pinnedEventsSaveObject:D(t,e.pinnedEventsSaveObject),id:t?"":e.savedObjectId,status:q(e,t,a),savedObjectId:t?null:e.savedObjectId,version:t?null:e.version,timelineType:null!=a?a:e.timelineType,title:B(e,t,a),templateTimelineId:P(e,t,a),templateTimelineVersion:t&&i?1:e.templateTimelineVersion};return Object.entries(r).reduce(((e,[t,a])=>null!=a?Object(n.set)(t,a,e):e),{...b.b,id:""})},$=(e,t=!1,a)=>{const{notes:n,...i}=e;return{notes:n,timeline:z(i,t,a)}},V=({activeTimelineTab:e=c.d.query,duplicate:t=!1,graphEventId:a="",timelineId:n,timelineType:r,onError:s,onOpenTimeline:o,openTimeline:l=!0,updateIsLoading:u,updateTimeline:d})=>{u({id:c.c.active,isLoading:!0}),null==n?(d({id:c.c.active,duplicate:!1,notes:[],from:j.a.toISOString(),to:j.b.toISOString(),timeline:{...b.b,id:c.c.active,activeTab:e,show:l,initialized:!0}})(),u({id:c.c.active,isLoading:!1})):Promise.resolve(Object(S.i)(n)).then((n=>{const s=Object(i.getOr)(null,"data",n);if(!s)return;const u=C(s.timeline),{timeline:p,notes:m}=$(u,t,r);if(null!=o)o(p);else if(d){const{from:n,to:r}=Object(v.a)({from:Object(i.getOr)(null,"dateRange.start",p),to:Object(i.getOr)(null,"dateRange.end",p)});d({duplicate:t,from:n,id:c.c.active,notes:m,resolveTimelineConfig:{outcome:s.outcome,alias_target_id:s.alias_target_id,alias_purpose:s.alias_purpose},timeline:{...p,activeTab:e,graphEventId:a,show:l,dateRange:{start:n,end:r}},to:r})()}})).catch((e=>{null!=s&&s(e,n)})).finally((()=>{u({id:c.c.active,isLoading:!1})}))},U=e=>({duplicate:t,id:a,forceNotes:n=!1,from:r,notes:s,resolveTimelineConfig:o,timeline:c,to:b,ruleNote:g,ruleAuthor:f})=>()=>{var h;if(Object(i.isEmpty)(c.indexNames)||e(E.a.setSelectedDataView({id:x.SourcererScopeName.timeline,selectedDataViewId:c.dataViewId,selectedPatterns:c.indexNames})),c.status===u.k.immutable&&c.timelineType===u.l.template?e(Object(p.setRelativeRangeDatePicker)({id:l.a.timeline,fromStr:"now-24h",toStr:"now",from:j.a.toISOString(),to:j.b.toISOString()})):e(Object(p.setTimelineRangeDatePicker)({from:r,to:b})),e(Object(m.addTimeline)({id:a,timeline:c,resolveTimelineConfig:o,savedTimeline:t})),null!=c.kqlQuery&&null!=c.kqlQuery.filterQuery&&null!=c.kqlQuery.filterQuery.kuery&&""!==c.kqlQuery.filterQuery.kuery.expression&&e(Object(m.applyKqlFilterQuery)({id:a,filterQuery:{kuery:{kind:null!==(h=c.kqlQuery.filterQuery.kuery.kind)&&void 0!==h?h:"kuery",expression:c.kqlQuery.filterQuery.kuery.expression||""},serializedQuery:c.kqlQuery.filterQuery.serializedQuery||""}})),t&&null!=g&&!Object(i.isEmpty)(g)){const t=Object(y.a)({newNote:g,user:f||"elastic"});e(Object(d.updateNote)({note:t})),e(Object(m.addNote)({noteId:t.id,id:a}))}t&&!n||e(Object(d.addNotes)({notes:null!=s?s.map((e=>{var t,a;return{created:null!=e.created?new Date(e.created):new Date,id:e.noteId,lastEdit:null!=e.updated?new Date(e.updated):new Date,note:e.note||"",user:e.updatedBy||"unknown",saveObjectId:e.noteId,version:e.version,eventId:null!==(t=e.eventId)&&void 0!==t?t:null,timelineId:null!==(a=e.timelineId)&&void 0!==a?a:null}})):[]}))}},function(e,t,a){"use strict";a.d(t,"e",(function(){return d})),a.d(t,"c",(function(){return p}));var n=a(104),i=a.n(n),r=a(247),s=a(2),o=a.n(s),l=a(289);a.d(t,"d",(function(){return l.b})),a.d(t,"b",(function(){return l.a}));var c=a(110),u=a(1034);a.d(t,"a",(function(){return r.b}));const d=r.j,p=({sourcererScopeId:e=c.SourcererScopeName.default,data:t,children:a,...n})=>{const l=Object(u.a)(e),d=JSON.stringify(t),p=Object(s.useMemo)((()=>(Array.isArray(t)?t:[t]).map((({field:e,value:t})=>({field:l(e),value:t}))).filter((e=>!!e.field))),[d,l]);return p.length>0?o.a.createElement(r.a,i()({data:p},n),a):o.a.createElement(o.a.Fragment,null,a)}},function(e,t,a){"use strict";a.d(t,"a",(function(){return f}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(53),c=a.n(l),u=a(149),d=a(679),p=a(910);const m=o.a.header.withConfig({displayName:"Header",componentId:"sc-1q9aiyj-0"})(["&.toggle-expand{margin-bottom:",";}.no-margin{margin-top:0 !important;margin-bottom:0 !important;}"," margin-bottom:0;user-select:text;",""],(({theme:e})=>e.eui.euiSizeL),(({height:e})=>e&&Object(s.css)(["height:","px;"],e)),(({border:e})=>e&&Object(s.css)(["border-bottom:",";padding-bottom:",";"],(({theme:e})=>e.eui.euiBorderThin),(({theme:e})=>e.eui.euiSizeL))));m.displayName="Header";const b=({alignHeader:e,stackHeader:t})=>null!=e?e:t?void 0:"center",g=({alignHeader:e,border:t,children:a,outerDirection:s="column",growLeftSplit:o=!0,headerFilters:l,height:g,hideSubtitle:f=!1,id:y,inspectMultiple:h=!1,inspectTitle:v,isInspectDisabled:E,showInspectButton:x=!0,split:j,stackHeader:S,subtitle:k,title:O,titleSize:w="m",toggleQuery:T,toggleStatus:I=!0,tooltip:C,tooltipTitle:M})=>{const _=Object(i.useCallback)((()=>{T&&T(!I)}),[T,I]),F=c()({"toggle-expand":I,siemHeaderSection:!0});return r.a.createElement(m,{"data-test-subj":"header-section",border:t,height:g,className:F,$hideSubtitle:f},r.a.createElement(n.EuiFlexGroup,{"data-test-subj":"headerSectionOuterFlexGroup",direction:s,gutterSize:"xs",responsive:!1},r.a.createElement(n.EuiFlexItem,{grow:o},r.a.createElement(n.EuiFlexGroup,{alignItems:b({alignHeader:e,stackHeader:S}),"data-test-subj":"headerSectionInnerFlexGroup",direction:S?"column":"row",gutterSize:"s"},r.a.createElement(n.EuiFlexItem,{grow:o,className:I?"":"no-margin"},r.a.createElement(n.EuiFlexGroup,{alignItems:"center",responsive:!1,gutterSize:"s"},r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiFlexGroup,{responsive:!1,gutterSize:"none",className:"header-section-titles"},T&&r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiButtonIcon,{"data-test-subj":"query-toggle-header","aria-label":p.a(I),color:"text",display:"empty",iconType:I?"arrowDown":"arrowRight",onClick:_,size:"s",title:p.a(I)})),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiTitle,{size:w},r.a.createElement("h4",{"data-test-subj":"header-section-title"},r.a.createElement("span",{className:"eui-textBreakNormal"},O),C&&r.a.createElement(r.a.Fragment,null," ",r.a.createElement(n.EuiIconTip,{color:"subdued",title:M,content:C,size:"l",type:"iInCircle"}))))))),y&&I&&r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(u.b,{isDisabled:E,queryId:y,multiple:h,showInspectButton:x,title:null!=v?v:O})),l&&I&&r.a.createElement(n.EuiFlexItem,{"data-test-subj":"header-section-filters",grow:!1},l))),a&&I&&r.a.createElement(n.EuiFlexItem,{"data-test-subj":"header-section-supplements",grow:!!j},a))),!f&&I&&r.a.createElement(n.EuiFlexItem,null,r.a.createElement(d.a,{"data-test-subj":"header-section-subtitle",items:k}))))},f=r.a.memo(g)},function(e,t,a){"use strict";a.d(t,"k",(function(){return i})),a.d(t,"l",(function(){return r})),a.d(t,"m",(function(){return s})),a.d(t,"n",(function(){return o})),a.d(t,"i",(function(){return l})),a.d(t,"g",(function(){return c})),a.d(t,"h",(function(){return u})),a.d(t,"f",(function(){return d})),a.d(t,"p",(function(){return p})),a.d(t,"e",(function(){return m})),a.d(t,"j",(function(){return b})),a.d(t,"c",(function(){return g})),a.d(t,"d",(function(){return f})),a.d(t,"a",(function(){return y})),a.d(t,"b",(function(){return h})),a.d(t,"o",(function(){return v}));var n=a(4);const i="matched.atomic",r="matched.field",s="matched.id",o="matched.type",l=[i,r,o],c=`${n.pb}.${r}`,u=`${n.pb}.${o}`,d="indicator.first_seen",p="indicator.reference",m="feed.name",b=`${n.pb}.${p}`;let g;!function(e){e.InvestigationTime="investigation_time",e.IndicatorMatchRule="indicator_match_rule"}(g||(g={}));const f={"file.hash.md5":`${n.I}.file.hash.md5`,"file.hash.sha1":`${n.I}.file.hash.sha1`,"file.hash.sha256":`${n.I}.file.hash.sha256`,"file.pe.imphash":`${n.I}.file.pe.imphash`,"file.elf.telfhash":`${n.I}.file.elf.telfhash`,"file.hash.ssdeep":`${n.I}.file.hash.ssdeep`,"source.ip":`${n.I}.ip`,"destination.ip":`${n.I}.ip`,"url.full":`${n.I}.url.full`,"registry.path":`${n.I}.registry.path`},y="now-30d",h="now",v="_others_ti_"},function(e,t,a){"use strict";a.d(t,"h",(function(){return o})),a.d(t,"e",(function(){return l})),a.d(t,"a",(function(){return c})),a.d(t,"d",(function(){return u})),a.d(t,"c",(function(){return d})),a.d(t,"i",(function(){return p})),a.d(t,"b",(function(){return m})),a.d(t,"f",(function(){return b})),a.d(t,"g",(function(){return g}));var n=a(40),i=a(41),r=a.n(i),s=a(4);const o=r.a.div.withConfig({displayName:"SecuritySolutionAppWrapper",componentId:"sc-2kezi3-0"})(["display:flex;flex-direction:column;flex:1 1 auto;width:100%;"]);o.displayName="SecuritySolutionAppWrapper";const l=()=>Object(i.css)([".euiOverlayMask[data-relative-to-header='below']{top:0 !important;}.euiFlyout{top:0 !important;height:100% !important;}"]),c=Object(i.createGlobalStyle)([".euiDataGridRowCell__popover{max-width:815px !important;max-height:none !important;overflow:hidden;.expandable-top-value-button{&.euiButtonEmpty:focus{background-color:transparent;}}&.euiPopover__panel[data-popover-open]{padding:8px 0;min-width:65px;}.euiPopoverFooter{border:0;margin-top:0;.euiFlexGroup{flex-direction:column;}}.euiText + .euiPopoverFooter{border-top:1px solid ",";margin-top:",";}}.euiPanel-loading-hide-border{border:none;}body.euiBody-hasOverlayMask{.euiDataGridRowCell__popover[data-popover-open],.withHoverActions__popover[data-popover-open]{visibility:hidden !important;}}.","{",";}.euiScreenReaderOnly{clip:rect(1px,1px,1px,1px);clip-path:inset(50%);height:1px;margin:-1px;overflow:hidden;padding:0;position:absolute;width:1px;}"],(({theme:e})=>e.eui.euiColorLightShade),(({theme:e})=>e.eui.euiSizeS),s.yb,(({theme:e})=>`background-color: ${e.eui.euiColorPrimary} !important`)),u=r()(n.EuiDescriptionList).withConfig({displayName:"DescriptionListStyled",componentId:"sc-2kezi3-1"})(["",""],(({theme:e})=>`\n    word-break: break-word;\n    dt {\n      font-size: ${e.eui.euiFontSizeXS} !important;\n    }\n    dd {\n      width: fit-content;\n    }\n    dd > div {\n      width: fit-content;\n    }\n  `));u.displayName="DescriptionListStyled";const d=r()(n.EuiBadge).withConfig({displayName:"CountBadge",componentId:"sc-2kezi3-2"})(["margin-left:5px;"]);d.displayName="CountBadge";const p=r.a.span.withConfig({displayName:"Spacer",componentId:"sc-2kezi3-3"})(["margin-left:5px;"]);p.displayName="Spacer";const m=r()(n.EuiBadge).withConfig({displayName:"Badge",componentId:"sc-2kezi3-4"})(["vertical-align:top;"]);m.displayName="Badge";const b=r()(n.EuiIcon).withConfig({displayName:"MoreRowItems",componentId:"sc-2kezi3-5"})(["margin-left:5px;"]);b.displayName="MoreRowItems";const g=r()(n.EuiFlexGroup).withConfig({displayName:"OverviewWrapper",componentId:"sc-2kezi3-6"})(["position:relative;.euiButtonIcon{position:absolute;right:",";top:6px;z-index:2;}"],(e=>e.theme.eui.euiSizeM));g.displayName="OverviewWrapper"},function(e,t,a){"use strict";a.d(t,"a",(function(){return c})),a.d(t,"d",(function(){return u.a})),a.d(t,"i",(function(){return u.d})),a.d(t,"e",(function(){return d.a})),a.d(t,"j",(function(){return d.b})),a.d(t,"f",(function(){return p})),a.d(t,"h",(function(){return m.b})),a.d(t,"g",(function(){return m.a})),a.d(t,"k",(function(){return b})),a.d(t,"l",(function(){return g})),a.d(t,"b",(function(){return f})),a.d(t,"c",(function(){return y})),a.d(t,"m",(function(){return h})),a.d(t,"n",(function(){return v}));var n=a(42),i=a(2),r=a(636),s=a(609),o=a(323),l=(a(4),a(195));const c=(e,t)=>`/${e}/summary${Object(l.a)(t)}`;var u=a(201),d=a(259);const p=(e,t)=>`/${e}${Object(l.a)(t)}`;var m=a(411);const b=(e,t)=>`/${e}${Object(l.a)(t)}`,g=(e,t)=>`?timeline=(id:'${e}',isOpen:!t${Object(n.isEmpty)(t)?")":`,graphEventId:'${t}')`}`,f=({id:e,search:t})=>`/${encodeURIComponent(e)}${Object(l.a)(null!=t?t:void 0)}`,y=e=>`/create${Object(l.a)(null!=e?e:void 0)}`,h=e=>{const{getAppUrl:t}=Object(o.a)(),a=Object(s.b)(e);return{formatUrl:Object(i.useCallback)(((i,{absolute:r=!1,skipSearch:s=!1}={})=>{const o=function(e,t,a){const[i,r]=e.split("?");return`${i}${a?Object(n.isEmpty)(r)?"":`?${r}`:Object(n.isEmpty)(r)?t:`?${r}${Object(n.isEmpty)(t)?"":`&${t}`}`}`}(i,a,s);return t({deepLinkId:e,path:o,absolute:r})}),[t,e,a]),search:a}},v=()=>{const e=Object(r.b)(),t=Object(s.a)();return Object(i.useCallback)((({deepLinkId:a,path:n="",absolute:i=!1,skipSearch:r=!1})=>{const s=r?"":t(a);return e({id:a,path:n,urlState:s,absolute:i})}),[e,t])}},function(e,t,a){"use strict";a.d(t,"B",(function(){return u})),a.d(t,"A",(function(){return p})),a.d(t,"z",(function(){return m})),a.d(t,"a",(function(){return b})),a.d(t,"i",(function(){return g})),a.d(t,"s",(function(){return f})),a.d(t,"v",(function(){return y})),a.d(t,"q",(function(){return h})),a.d(t,"r",(function(){return v})),a.d(t,"o",(function(){return E})),a.d(t,"p",(function(){return x})),a.d(t,"j",(function(){return j})),a.d(t,"u",(function(){return S})),a.d(t,"t",(function(){return k})),a.d(t,"x",(function(){return O})),a.d(t,"w",(function(){return w})),a.d(t,"m",(function(){return T})),a.d(t,"n",(function(){return I})),a.d(t,"b",(function(){return C})),a.d(t,"k",(function(){return M})),a.d(t,"l",(function(){return _})),a.d(t,"c",(function(){return F})),a.d(t,"f",(function(){return A})),a.d(t,"g",(function(){return D})),a.d(t,"d",(function(){return N})),a.d(t,"e",(function(){return P})),a.d(t,"h",(function(){return R})),a.d(t,"y",(function(){return L}));var n=a(40),i=a(287),r=a(41),s=a.n(r),o=a(109),l=a(148),c=a(268);const u=s.a.div.attrs((({className:e=""})=>({className:`securitySolutionTimeline__container ${e}`}))).withConfig({displayName:"TimelineContainer",componentId:"sc-1fubmdc-0"})(["height:100%;display:flex;flex-direction:column;position:relative;"]),d="securitySolutionTimeline__body",p=Object(r.createGlobalStyle)(["body."," .","{overflow:hidden;}"],o.e,d),m=s.a.div.attrs((({className:e=""})=>({className:`${d} ${e}`}))).withConfig({displayName:"TimelineBody",componentId:"sc-1fubmdc-1"})(["height:auto;overflow:auto;scrollbar-width:thin;flex:1;display:block;&::-webkit-scrollbar{height:",";width:",";}&::-webkit-scrollbar-thumb{background-clip:content-box;background-color:",";border:"," solid transparent;}&::-webkit-scrollbar-corner,&::-webkit-scrollbar-track{background-color:transparent;}"],(({theme:e})=>e.eui.euiScrollBar),(({theme:e})=>e.eui.euiScrollBar),(({theme:e})=>Object(i.rgba)(e.eui.euiColorDarkShade,.5)),(({theme:e})=>e.eui.euiScrollBarCorner));m.displayName="TimelineBody";const b="siemEventsTable",g=s.a.div.attrs((({className:e="",$columnCount:t,columnWidths:a,$activePage:n,$rowCount:i,$totalPages:r})=>({"aria-label":Object(c.c)({activePage:n+1,totalPages:r}),"aria-colcount":`${t}`,"aria-rowcount":`${i+1}`,className:`siemEventsTable ${e}`,role:"grid",style:{minWidth:`${a}px`},tabindex:"-1"}))).withConfig({displayName:"EventsTable",componentId:"sc-1fubmdc-2"})(["padding:3px;"]),f=s.a.div.attrs((({className:e=""})=>({className:`siemEventsTable__thead ${e}`,role:"rowgroup"}))).withConfig({displayName:"EventsThead",componentId:"sc-1fubmdc-3"})(["background-color:",";border-bottom:"," solid ",";position:sticky;top:0;z-index:",";"],(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiBorderWidthThick),(({theme:e})=>e.eui.euiColorLightShade),(({theme:e})=>e.eui.euiZLevel1)),y=s.a.div.attrs((({className:e})=>({"aria-rowindex":"1",className:`siemEventsTable__trHeader ${e}`,role:"row"}))).withConfig({displayName:"EventsTrHeader",componentId:"sc-1fubmdc-4"})(["display:flex;"]),h=s.a.div.attrs((({className:e=""})=>({"aria-colindex":`${l.a}`,className:`siemEventsTable__thGroupActions ${e}`,role:"columnheader",tabIndex:"0"}))).withConfig({displayName:"EventsThGroupActions",componentId:"sc-1fubmdc-5"})(["display:flex;flex:0 0 ",";min-width:0;padding-left:",";"],(({actionsColumnWidth:e,isEventViewer:t})=>`${t?e:e+4}px`),(({isEventViewer:e})=>e?"0;":"4px;")),v=s.a.div.attrs((({className:e=""})=>({className:`siemEventsTable__thGroupData ${e}`}))).withConfig({displayName:"EventsThGroupData",componentId:"sc-1fubmdc-6"})(["display:flex;> div:hover .siemEventsHeading__handle{display:",";opacity:1;visibility:visible;}"],(({isDragging:e})=>e?"none":"block")),E=s.a.div.attrs((({className:e="",role:t="columnheader"})=>({className:`siemEventsTable__th ${e}`,role:t}))).withConfig({displayName:"EventsTh",componentId:"sc-1fubmdc-7"})(["align-items:center;display:flex;flex-shrink:0;min-width:0;.siemEventsTable__thGroupActions &:first-child:last-child{flex:1;}.siemEventsTable__thGroupData &:hover{background-color:",";cursor:move;cursor:grab;}> div:focus{outline:0;}[data-rbd-placeholder-context-id]{display:none !important;}"],(({theme:e})=>e.eui.euiTableHoverColor)),x=s.a.div.attrs((({className:e=""})=>({className:`siemEventsTable__thContent ${e}`}))).withConfig({displayName:"EventsThContent",componentId:"sc-1fubmdc-8"})(["font-size:",";font-weight:",";line-height:",";min-width:0;padding:",";text-align:",";width:",";> button.euiButtonIcon,> .euiToolTipAnchor > button.euiButtonIcon{margin-left:",";}"],(({theme:e})=>e.eui.euiFontSizeXS),(({theme:e})=>e.eui.euiFontWeightSemiBold),(({theme:e})=>e.eui.euiLineHeight),(({theme:e})=>e.eui.euiSizeXS),(({textAlign:e})=>e),(({width:e})=>null!=e?`${e}px`:"100%"),(({theme:e})=>`-${e.eui.euiSizeXS}`)),j=s.a.div.attrs((({className:e=""})=>({className:`siemEventsTable__tbody ${e}`,role:"rowgroup"}))).withConfig({displayName:"EventsTbody",componentId:"sc-1fubmdc-9"})(["overflow-x:hidden;"]),S=s.a.div.attrs((({className:e="",$ariaRowindex:t})=>({"aria-rowindex":`${t}`,className:`siemEventsTable__trGroup ${e}`,role:"row"}))).withConfig({displayName:"EventsTrGroup",componentId:"sc-1fubmdc-10"})(["border-bottom:"," solid ",";",";",";",";&:hover{background-color:",";}",""],(({theme:e})=>e.eui.euiBorderWidthThin),(({theme:e})=>e.eui.euiColorLightShade),(({theme:e,eventType:t,isEvenEqlSequence:a,showLeftBorder:n})=>n?`border-left: 4px solid\n    ${"raw"===t?e.eui.euiColorLightShade:"eql"===t&&a?e.eui.euiColorPrimary:"eql"!==t||a?e.eui.euiColorWarning:e.eui.euiColorAccent}`:""),(({isBuildingBlockType:e})=>e?"background: repeating-linear-gradient(127deg, rgba(245, 167, 0, 0.2), rgba(245, 167, 0, 0.2) 1px, rgba(245, 167, 0, 0.05) 2px, rgba(245, 167, 0, 0.05) 10px);":""),(({eventType:e,isEvenEqlSequence:t})=>"eql"===e?t?"background: repeating-linear-gradient(127deg, rgba(0, 107, 180, 0.2), rgba(0, 107, 180, 0.2) 1px, rgba(0, 107, 180, 0.05) 2px, rgba(0, 107, 180, 0.05) 10px);":"background: repeating-linear-gradient(127deg, rgba(221, 10, 115, 0.2), rgba(221, 10, 115, 0.2) 1px, rgba(221, 10, 115, 0.05) 2px, rgba(221, 10, 115, 0.05) 10px);":""),(({theme:e})=>e.eui.euiTableHoverColor),(({isExpanded:e,theme:t})=>e&&`\n    background: ${t.eui.euiTableSelectedColor};\n\n    &:hover {\n      ${t.eui.euiTableHoverSelectedColor}\n    }\n  `)),k=s.a.div.attrs((({className:e=""})=>({className:`siemEventsTable__trData ${e}`}))).withConfig({displayName:"EventsTrData",componentId:"sc-1fubmdc-11"})(["display:flex;"]),O=s.a.div.attrs((({width:e})=>({role:"dialog",style:{width:e-40+"px"}}))).withConfig({displayName:"EventsTrSupplementContainer",componentId:"sc-1fubmdc-12"})([""]),w=s.a.div.attrs((({className:e=""})=>({className:`siemEventsTable__trSupplement ${e}`}))).withConfig({displayName:"EventsTrSupplement",componentId:"sc-1fubmdc-13"})(["display:",";font-size:",";line-height:",";padding-left:",";.euiAccordion + div{background-color:",";padding:0 ",";border:1px solid ",";border-radius:",";}"],(({$display:e})=>null!=e?e:"inline-block"),(({theme:e})=>e.eui.euiFontSizeXS),(({theme:e})=>e.eui.euiLineHeight),(({theme:e})=>e.eui.euiSizeM),(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiSizeS),(({theme:e})=>e.eui.euiColorLightShade),(({theme:e})=>e.eui.euiSizeXS)),T=s.a.div.attrs((({className:e=""})=>({"aria-colindex":`${l.a}`,className:`siemEventsTable__tdGroupActions ${e}`,role:"gridcell"}))).withConfig({displayName:"EventsTdGroupActions",componentId:"sc-1fubmdc-14"})(["align-items:center;display:flex;flex:0 0 ",";min-width:0;"],(({width:e})=>`${e}px`)),I=s.a.div.attrs((({className:e=""})=>({className:`siemEventsTable__tdGroupData ${e}`}))).withConfig({displayName:"EventsTdGroupData",componentId:"sc-1fubmdc-15"})(["display:flex;"]),C="siemEventsTable__td",M=s.a.div.attrs((({className:e="",$ariaColumnIndex:t,width:a})=>{const n={className:`siemEventsTable__td ${e}`,role:"gridcell",style:{flexBasis:a?`${a}px`:"auto"}};return null!=t?{...n,"aria-colindex":`${t}`}:n})).withConfig({displayName:"EventsTd",componentId:"sc-1fubmdc-16"})(["align-items:center;display:flex;flex-shrink:0;min-width:0;.siemEventsTable__tdGroupActions &:first-child:last-child{flex:1;}"]),_=s.a.div.attrs((({className:e})=>({className:`siemEventsTable__tdContent ${null!=e?e:""}`}))).withConfig({displayName:"EventsTdContent",componentId:"sc-1fubmdc-17"})(["font-size:",";line-height:",";min-width:0;padding:",";text-align:",";width:",";button.euiButtonIcon{margin-left:",";}"],(({theme:e})=>e.eui.euiFontSizeXS),(({theme:e})=>e.eui.euiLineHeight),(({theme:e})=>e.eui.euiSizeXS),(({textAlign:e})=>e),(({width:e})=>null!=e?`${e}px`:"100%"),(({theme:e})=>`-${e.eui.euiSizeXS}`)),F=s.a.div.attrs((({className:e=""})=>({className:`siemEventsHeading ${e}`}))).withConfig({displayName:"EventsHeading",componentId:"sc-1fubmdc-18"})(["align-items:center;display:flex;&:hover{cursor:",";}"],(({isLoading:e})=>e?"wait":"grab")),A=s.a.button.attrs((({className:e=""})=>({className:`siemEventsHeading__title siemEventsHeading__title--aggregatable ${e}`,type:"button"}))).withConfig({displayName:"EventsHeadingTitleButton",componentId:"sc-1fubmdc-19"})(["align-items:center;display:flex;font-weight:inherit;min-width:0;&:hover,&:focus{color:",";text-decoration:underline;}&:hover{cursor:pointer;}& > * + *{margin-left:",";}"],(({theme:e})=>e.eui.euiColorPrimary),(({theme:e})=>e.eui.euiSizeXS)),D=s.a.span.attrs((({className:e})=>({className:`siemEventsHeading__title siemEventsHeading__title--notAggregatable ${e}`}))).withConfig({displayName:"EventsHeadingTitleSpan",componentId:"sc-1fubmdc-20"})(["min-width:0;"]),N=s.a.div.attrs((({className:e=""})=>({className:`siemEventsHeading__extra ${e}`}))).withConfig({displayName:"EventsHeadingExtra",componentId:"sc-1fubmdc-21"})(["margin-left:auto;margin-right:2px;&.siemEventsHeading__extra--close{opacity:0;transition:all "," ease;visibility:hidden;.siemEventsTable__th:hover &{opacity:1;visibility:visible;}}"],(({theme:e})=>e.eui.euiAnimSpeedNormal)),P=s.a.div.attrs((({className:e=""})=>({className:`siemEventsHeading__handle ${e}`}))).withConfig({displayName:"EventsHeadingHandle",componentId:"sc-1fubmdc-22"})(["background-color:",";height:100%;opacity:0;transition:all "," ease;visibility:hidden;width:",";&:hover{background-color:",";cursor:col-resize;}"],(({theme:e})=>e.eui.euiBorderColor),(({theme:e})=>e.eui.euiAnimSpeedNormal),(({theme:e})=>e.eui.euiBorderWidthThick),(({theme:e})=>e.eui.euiColorPrimary)),R=s()(n.EuiLoadingSpinner).withConfig({displayName:"EventsLoading",componentId:"sc-1fubmdc-23"})(["margin:0 2px;vertical-align:middle;"]),L=s.a.div.attrs((({$isVisible:e=!1})=>({style:{display:e?"block":"none"}}))).withConfig({displayName:"HideShowContainer",componentId:"sc-1fubmdc-24"})([""])},function(e,t,a){"use strict";a.d(t,"a",(function(){return k})),a.d(t,"b",(function(){return m})),a.d(t,"c",(function(){return b}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(40);let l;!function(e){e.openFlyout="open_flyout",e.openRightPanel="open_right_panel",e.openLeftPanel="open_left_panel",e.openPreviewPanel="open_preview_panel",e.closeRightPanel="close_right_panel",e.closeLeftPanel="close_left_panel",e.closePreviewPanel="close_preview_panel",e.previousPreviewPanel="previous_preview_panel",e.closeFlyout="close_flyout"}(l||(l={}));const c={left:void 0,right:void 0,preview:[]};function u(e,t){switch(t.type){case l.openFlyout:{const{left:e,right:a,preview:n}=t.payload;return{left:e,right:a,preview:n?[n]:[]}}case l.openRightPanel:return{...e,right:t.payload};case l.openLeftPanel:return{...e,left:t.payload};case l.openPreviewPanel:return{...e,preview:[...e.preview,t.payload]};case l.closeRightPanel:return{...e,right:void 0};case l.closeLeftPanel:return{...e,left:void 0};case l.closePreviewPanel:return{...e,preview:[]};case l.previousPreviewPanel:{const t=[...e.preview];return t.pop(),{...e,preview:t}}case l.closeFlyout:return{left:void 0,right:void 0,preview:[]};default:return e}}var d=a(21);const p=Object(r.createContext)(void 0),m=s.a.forwardRef((({children:e,onChanges:t=(()=>{}),onClosePanels:a=(()=>{})},n)=>{const[i,s]=Object(r.useReducer)(u,c);Object(r.useEffect)((()=>{!i.right||t(i)}),[i,t]);const o=Object(r.useCallback)((({right:e,left:t,preview:a})=>s({type:l.openFlyout,payload:{left:t,right:e,preview:a}})),[s]),m=Object(r.useCallback)((e=>s({type:l.openRightPanel,payload:e})),[]),b=Object(r.useCallback)((e=>s({type:l.openLeftPanel,payload:e})),[]),g=Object(r.useCallback)((e=>s({type:l.openPreviewPanel,payload:e})),[]),f=Object(r.useCallback)((()=>s({type:l.closeRightPanel})),[]),y=Object(r.useCallback)((()=>s({type:l.closeLeftPanel})),[]),h=Object(r.useCallback)((()=>s({type:l.closePreviewPanel})),[]),v=Object(r.useCallback)((()=>s({type:l.previousPreviewPanel})),[]),E=Object(r.useCallback)((()=>{s({type:l.closeFlyout}),a()}),[a]);Object(r.useImperativeHandle)(n,(()=>({openFlyout:o,getState:()=>i})),[o,i]);const x=Object(r.useMemo)((()=>({panels:i,openFlyout:o,openRightPanel:m,openLeftPanel:b,openPreviewPanel:g,closeRightPanel:f,closeLeftPanel:y,closePreviewPanel:h,closeFlyout:E,previousPreviewPanel:v})),[i,o,m,b,g,f,y,h,E,v]);return Object(d.jsx)(p.Provider,{value:x},e)})),b=()=>{const e=Object(r.useContext)(p);if(!e)throw new Error("ExpandableFlyoutContext can only be used within ExpandableFlyoutContext provider");return e};var g=a(8),f=a(5);const y=f.i18n.translate("expandableFlyout.previewSection.backButton",{defaultMessage:"Back"}),h=f.i18n.translate("expandableFlyout.previewSection.closeButton",{defaultMessage:"Close"}),v=e=>Object(g.has)(e,"title")||Object(g.has)(e,"backgroundColor")||Object(g.has)(e,"textColor"),E=({component:e,showBackButton:t,width:a,banner:n})=>{const{euiTheme:i}=Object(o.useEuiTheme)(),{closePreviewPanel:r,previousPreviewPanel:s}=b(),l=100*(1-a)+"%",c=Object(d.jsx)(o.EuiFlexItem,{grow:!1},Object(d.jsx)(o.EuiButtonIcon,{iconType:"cross",onClick:()=>r(),"data-test-subj":"previewSectionCloseButton","aria-label":h})),u=t?Object(d.jsx)(o.EuiFlexGroup,{justifyContent:"spaceBetween"},Object(d.jsx)(o.EuiFlexItem,{grow:!1},Object(d.jsx)(o.EuiButtonEmpty,{size:"xs",iconType:"arrowLeft",iconSide:"left",onClick:()=>s(),"data-test-subj":"previewSectionBackButton","aria-label":y},y)),c):Object(d.jsx)(o.EuiFlexGroup,{justifyContent:"flexEnd"},c);return Object(d.jsx)("div",{css:Object(d.css)("position:absolute;top:0;bottom:0;right:0;left:",l,";z-index:1000;","")},Object(d.jsx)(o.EuiSplitPanel.Outer,{css:Object(d.css)("margin:",i.size.xs,";height:99%;box-shadow:0px 0px 5px 5px ",i.colors.darkShade,";",""),className:"eui-yScroll","data-test-subj":"previewSection"},v(n)&&Object(d.jsx)(o.EuiSplitPanel.Inner,{grow:!1,color:n.backgroundColor,paddingSize:"none"},Object(d.jsx)(o.EuiText,{textAlign:"center",color:n.textColor,size:"s"},n.title)),Object(d.jsx)(o.EuiSplitPanel.Inner,{grow:!1,paddingSize:"s","data-test-subj":"previewSectionHeader"},u),Object(d.jsx)(o.EuiSplitPanel.Inner,{paddingSize:"none"},e)))};E.displayName="PreviewSection";const x=({component:e,width:t})=>{const a=Object(r.useMemo)((()=>({height:"100%",width:100*t+"%",overflowY:"scroll"})),[t]);return Object(d.jsx)(o.EuiFlexItem,{grow:!1,style:a,"data-test-subj":"rightSection"},Object(d.jsx)(o.EuiFlexGroup,{direction:"column"},e))};x.displayName="RightSection";const j=({component:e,width:t})=>{const a=Object(r.useMemo)((()=>({height:"100%",width:100*t+"%",overflowY:"scroll"})),[t]);return Object(d.jsx)(o.EuiFlexItem,{grow:!0,"data-test-subj":"leftSection",style:a},Object(d.jsx)(o.EuiFlexGroup,{direction:"column"},e))};j.displayName="LeftSection";const S={height:"100%"},k=({registeredPanels:e,handleOnFlyoutClosed:t,...a})=>{var n,s;const{panels:l,closeFlyout:c}=b(),{left:u,right:p,preview:m}=l,g=Object(r.useCallback)((()=>{t&&t(),c()}),[c,t]),f=Object(r.useMemo)((()=>e.find((e=>e.key===(null==u?void 0:u.id)))),[u,e]),y=Object(r.useMemo)((()=>e.find((e=>e.key===(null==p?void 0:p.id)))),[p,e]),h=m?m[m.length-1]:void 0,k=v(null==h||null===(n=h.params)||void 0===n?void 0:n.banner)?null==h||null===(s=h.params)||void 0===s?void 0:s.banner:void 0,O=m&&m.length>1,w=Object(r.useMemo)((()=>e.find((e=>e.key===(null==h?void 0:h.id)))),[h,e]);if(!u&&!p&&!m.length)return null;const T=f&&y?"l":"s",I=f?.4:1,C=f?.4:1;return Object(d.jsx)(o.EuiFlyout,i()({},a,{size:T,ownFocus:!1,onClose:g}),Object(d.jsx)(o.EuiFlexGroup,{direction:f?"row":"column",wrap:!1,gutterSize:"none",style:S},f&&u?Object(d.jsx)(j,{component:f.component({...u}),width:.6}):null,y&&p?Object(d.jsx)(x,{component:y.component({...p}),width:I}):null),w&&m?Object(d.jsx)(E,{component:w.component({...h}),showBackButton:O,width:C,banner:k}):null)};k.displayName="ExpandableFlyout"},function(e,t,a){"use strict";a.d(t,"b",(function(){return o})),a.d(t,"a",(function(){return l}));var n=a(43),i=a(112),r=a(193),s=a(128);let o,l;!function(e){e.enable="enable",e.disable="disable",e.export="export",e.delete="delete",e.duplicate="duplicate",e.edit="edit"}(o||(o={})),function(e){e.add_tags="add_tags",e.delete_tags="delete_tags",e.set_tags="set_tags",e.add_index_patterns="add_index_patterns",e.delete_index_patterns="delete_index_patterns",e.set_index_patterns="set_index_patterns",e.set_timeline="set_timeline",e.add_rule_actions="add_rule_actions",e.set_rule_actions="set_rule_actions",e.set_schedule="set_schedule"}(l||(l={}));const c=n.union([n.literal("rule"),n.literal("1h"),n.literal("1d"),n.literal("7d")]),u=n.type({type:n.union([n.literal(l.add_tags),n.literal(l.delete_tags),n.literal(l.set_tags)]),value:s.F}),d=n.intersection([n.type({type:n.union([n.literal(l.add_index_patterns),n.literal(l.delete_index_patterns),n.literal(l.set_index_patterns)]),value:s.i}),n.exact(n.partial({overwrite_data_views:n.boolean}))]),p=n.type({type:n.literal(l.set_timeline),value:n.type({timeline_id:s.O,timeline_title:s.P})}),m=n.exact(n.intersection([n.type({group:r.i,id:r.j,params:r.k}),n.partial({frequency:r.h}),n.partial({alerts_filter:r.f})])),b=n.type({type:n.union([n.literal(l.add_rule_actions),n.literal(l.set_rule_actions)]),value:n.intersection([n.partial({throttle:c}),n.type({actions:n.array(m)})])}),g=n.type({type:n.literal(l.set_schedule),value:n.type({interval:Object(i.q)({allowedUnits:["s","m","h"]}),lookback:Object(i.q)({allowedUnits:["s","m","h"]})})}),f=n.union([u,d,p,b,g]),y=n.exact(n.type({include_exceptions:n.boolean,include_expired_exceptions:n.boolean}));n.intersection([n.exact(n.type({query:n.union([s.B,n[void 0]])})),n.exact(n.partial({ids:Object(i.j)(n.string)})),n.union([n.exact(n.type({action:n.union([n.literal(o.delete),n.literal(o.disable),n.literal(o.enable),n.literal(o.export)])})),n.intersection([n.exact(n.type({action:n.literal(o.duplicate)})),n.exact(n.partial({[o.duplicate]:y}))]),n.exact(n.type({action:n.literal(o.edit),[o.edit]:Object(i.j)(f)}))])]),n.exact(n.partial({dry_run:n.union([n.literal("true"),n.literal("false")])}))},,function(e,t,a){"use strict";a.d(t,"d",(function(){return i})),a.d(t,"g",(function(){return r})),a.d(t,"a",(function(){return o})),a.d(t,"b",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"e",(function(){return u})),a.d(t,"f",(function(){return d}));var n=a(47);const i=e=>null!=e.id?e:{...e,id:Object(n.v4)()},r=e=>{const t=e;if(null!=t.id){const{id:e,...a}=t;return a}return e};var s=a(5);let o,l,c;s.i18n.translate("utils.filename.wildcardWarning",{defaultMessage:"Using wildcards in file paths can impact Endpoint performance"}),s.i18n.translate("utils.filename.pathWarning",{defaultMessage:"Path may be formed incorrectly; verify value"}),function(e){e.HASH="process.hash.*",e.PATH="process.executable.caseless",e.SIGNER="process.Ext.code_signature"}(o||(o={})),function(e){e.HASH=".hash.",e.EXECUTABLE=".executable.caseless",e.PATH=".path",e.SIGNER=".Ext.code_signature"}(l||(l={})),function(e){e.LINUX="linux",e.MAC="macos",e.WINDOWS="windows"}(c||(c={}));const u=({os:e,type:t,value:a})=>{const n=e===c.WINDOWS?"\\":"/",i=a.split(n).pop();if(i)return"wildcard"!==t||1===(i.split("*").length||i.split("?").length)},d=({os:e,field:t,type:a,value:n})=>!["process.executable.caseless","file.path","file.path.text"].includes(t)||("wildcard"===a?e===c.WINDOWS?m(n):b(n):p({value:n,os:e})),p=({os:e,value:t})=>e===c.WINDOWS?/^[a-z]:(?:|\\\\[^<>:"'/\\|?*]+\\[^<>:"'/\\|?*]+|%\w+%|)[\\](?:[^<>:"'/\\|?*]+[\\/])*([^<>:"'/\\|?*])+$/i.test(t):/^(\/|(\/[\w\-]+)+|\/[\w\-]+\.[\w]+|(\/[\w-]+)+\/[\w\-]+\.[\w]+)$/i.test(t),m=e=>{const t=e[0],a=e.slice(-1),n=e.trim(),i=/\//.test(n);return 0!==e.length&&!(i||n.length!==e.length||"^"===t||"\\"===a||!g({path:e,isWindowsPath:!0}))},b=e=>{const t=e[0],a=e.slice(-1),n=e.trim();return 0!==e.length&&!(n.length!==e.length||"/"!==t||"/"===a||e.length>1024==1||!0===e.includes("//")||!g({path:e,isWindowsPath:!1}))},g=({path:e,isWindowsPath:t})=>{for(const a of e.split(t?"\\":"/"))if(!0===/[\*|\?]+/.test(a))return!0;return!1}},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(2),i=a(901);const r=()=>Object(n.useContext)(i.a)},function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"c",(function(){return i})),a.d(t,"b",(function(){return r}));const n=180,i=70,r=190},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(2),i=a(102),r=a(175);const s=e=>{var t;const[{pageName:a}]=Object(r.a)(),{services:{storage:s}}=Object(i.j)(),o=((e,t)=>t&&e.length>0?`kibana.siem:${t}.query.toggle:${e}`:null)(a,e),[l,c]=Object(n.useState)(null==o||null===(t=s.get(o))||void 0===t||t);Object(n.useEffect)((()=>{var e;null!=o&&c(null===(e=s.get(o))||void 0===e||e)}),[s,o]);const u=Object(n.useCallback)((e=>{null!=o&&(s.set(o,e),c(e))}),[s,o]);return e?{toggleStatus:l,setToggleStatus:u}:{toggleStatus:!0,setToggleStatus:()=>{}}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return u})),a.d(t,"c",(function(){return d})),a.d(t,"b",(function(){return p}));var n=a(2),i=a(103),r=a(114),s=a(4),o=a(105),l=a(122),c=a(182);const u=()=>{var e;const t=Object(i.useDispatch)(),a=null!==(e=Object(o.b)(l.d.globalFullScreenSelector))&&void 0!==e&&e,u=Object(n.useCallback)((e=>{const a=null!==document.querySelector(".euiDataGrid--fullScreen");e?document.body.classList.add(s.pc,"euiDataGrid__restrictBody"):!1!==a&&!1!==e||document.body.classList.remove(s.pc,"euiDataGrid__restrictBody"),t(c.c.setFullScreen({id:r.a.global,fullScreen:e}))}),[t]);return Object(n.useMemo)((()=>({globalFullScreen:a,setGlobalFullScreen:u})),[a,u])},d=()=>{var e;const t=Object(i.useDispatch)(),a=null!==(e=Object(o.b)(l.d.timelineFullScreenSelector))&&void 0!==e&&e,s=Object(n.useCallback)((e=>{const a=null!==document.querySelector(".euiDataGrid--fullScreen");e?document.body.classList.add("euiDataGrid__restrictBody"):!1!==a&&!1!==e||document.body.classList.remove("euiDataGrid__restrictBody"),t(c.c.setFullScreen({id:r.a.timeline,fullScreen:e}))}),[t]);return Object(n.useMemo)((()=>({timelineFullScreen:a,setTimelineFullScreen:s})),[a,s])},p=()=>{const{globalFullScreen:e}=u(),{timelineFullScreen:t}=d(),a=(()=>{const[e,t]=Object(n.useState)(!1);return Object(n.useEffect)((()=>{const e=document.body,a=new MutationObserver((a=>{for(const n of a)"class"===n.attributeName&&t(e.classList.contains("euiDataGrid__restrictBody"))}));return a.observe(e,{attributes:!0}),()=>a.disconnect()}),[]),e})();return e||t||a}},function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"c",(function(){return i})),a.d(t,"d",(function(){return s})),a.d(t,"b",(function(){return l}));var n=a(241),i=a(515),r=a(208);const s={notesById:{},errors:[],enableExperimental:{...a(15).a}},o=({note:e,notesById:t})=>({...t,[e.id]:e}),l=Object(r.reducerWithInitialState)(s).case(n.addNotes,((e,{notes:t})=>({...e,notesById:t.reduce(((e,t)=>({...e,[t.id]:t})),{})}))).case(n.deleteNote,((e,{id:t})=>({...e,notesById:Object.fromEntries(Object.entries(e.notesById).filter((([e,a])=>a.id!==t&&a.saveObjectId!==t)))}))).case(n.updateNote,((e,{note:t})=>({...e,notesById:o({note:t,notesById:e.notesById})}))).case(n.addError,((e,{id:t,title:a,message:n})=>({...e,errors:e.errors.concat({id:t,title:a,message:n})}))).case(n.removeError,((e,{id:t})=>({...e,errors:e.errors.filter((e=>e.id!==t))}))).case(n.addErrorHash,((e,{id:t,hash:a,title:n,message:i})=>{const r=e.errors.findIndex((e=>e.id===t)),s=e.errors.find((e=>e.id===t))||{id:t,title:n,message:i};return-1===r?{...e,errors:e.errors.concat({...s,hash:a,displayError:!e.errors.some((e=>e.hash===a))})}:{...e,errors:[...e.errors.slice(0,r),{...s,hash:a,displayError:!e.errors.some((e=>e.hash===a))},...e.errors.slice(r+1)]}})).build()},function(e,t,a){"use strict";e.exports=a(961)},function(e,t,a){"use strict";a.d(t,"b",(function(){return d})),a.d(t,"a",(function(){return p})),a.d(t,"c",(function(){return m}));var n=a(42),i=a(2),r=a.n(i),s=a(285),o=a(299);const l={canUserCRUD:null,canUserREAD:null,hasIndexManage:null,hasIndexMaintenance:null,hasIndexWrite:null,hasIndexRead:null,hasIndexUpdateDelete:null,isSignalIndexExists:null,isAuthenticated:null,hasEncryptionKey:null,loading:!0,signalIndexName:null,signalIndexMappingOutdated:null},c=(e,t)=>{switch(t.type){case"updateLoading":return{...e,loading:t.loading};case"updateHasIndexManage":return{...e,hasIndexManage:t.hasIndexManage};case"updateHasIndexMaintenance":return{...e,hasIndexMaintenance:t.hasIndexMaintenance};case"updateHasIndexWrite":return{...e,hasIndexWrite:t.hasIndexWrite};case"updateHasIndexRead":return{...e,hasIndexRead:t.hasIndexRead};case"updateHasIndexUpdateDelete":return{...e,hasIndexUpdateDelete:t.hasIndexUpdateDelete};case"updateIsSignalIndexExists":return{...e,isSignalIndexExists:t.isSignalIndexExists};case"updateIsAuthenticated":return{...e,isAuthenticated:t.isAuthenticated};case"updateHasEncryptionKey":return{...e,hasEncryptionKey:t.hasEncryptionKey};case"updateSignalIndexName":return{...e,signalIndexName:t.signalIndexName};case"updateSignalIndexMappingOutdated":return{...e,signalIndexMappingOutdated:t.signalIndexMappingOutdated};case"updateCanUserCRUD":return{...e,canUserCRUD:t.canUserCRUD};case"updateCanUserREAD":return{...e,canUserREAD:t.canUserREAD};default:return e}},u=Object(i.createContext)([l,()=>n.noop]),d=()=>Object(i.useContext)(u),p=({children:e})=>r.a.createElement(u.Provider,{value:Object(i.useReducer)(c,l)},e),m=()=>{const[{canUserCRUD:e,canUserREAD:t,hasIndexManage:a,hasIndexMaintenance:n,hasIndexWrite:r,hasIndexRead:l,hasIndexUpdateDelete:c,isSignalIndexExists:u,isAuthenticated:p,hasEncryptionKey:m,loading:b,signalIndexName:g,signalIndexMappingOutdated:f},y]=d(),{loading:h,isAuthenticated:v,hasEncryptionKey:E,hasIndexManage:x,hasIndexMaintenance:j,hasIndexUpdateDelete:S,hasIndexWrite:k,hasIndexRead:O,hasKibanaCRUD:w,hasKibanaREAD:T}=Object(s.a)(),{loading:I,signalIndexExists:C,signalIndexName:M,signalIndexMappingOutdated:_,createDeSignalIndex:F}=Object(o.a)();return Object(i.useEffect)((()=>{b||e===w||y({type:"updateCanUserCRUD",canUserCRUD:w})}),[y,b,e,w]),Object(i.useEffect)((()=>{b||t===T||y({type:"updateCanUserREAD",canUserREAD:T})}),[y,b,t,T]),Object(i.useEffect)((()=>{b!==(h||I)&&y({type:"updateLoading",loading:h||I})}),[y,b,h,I]),Object(i.useEffect)((()=>{b||a===x||null==x||y({type:"updateHasIndexManage",hasIndexManage:x})}),[y,b,a,x]),Object(i.useEffect)((()=>{b||r===k||null==k||y({type:"updateHasIndexWrite",hasIndexWrite:k})}),[y,b,r,k]),Object(i.useEffect)((()=>{b||l===O||null==O||y({type:"updateHasIndexRead",hasIndexRead:O})}),[y,b,l,O]),Object(i.useEffect)((()=>{b||c===S||null==S||y({type:"updateHasIndexUpdateDelete",hasIndexUpdateDelete:S})}),[y,b,c,S]),Object(i.useEffect)((()=>{b||n===j||null==j||y({type:"updateHasIndexMaintenance",hasIndexMaintenance:j})}),[y,b,n,j]),Object(i.useEffect)((()=>{b||u===C||null==C||y({type:"updateIsSignalIndexExists",isSignalIndexExists:C})}),[y,b,u,C]),Object(i.useEffect)((()=>{b||p===v||null==v||y({type:"updateIsAuthenticated",isAuthenticated:v})}),[y,b,p,v]),Object(i.useEffect)((()=>{b||m===E||null==E||y({type:"updateHasEncryptionKey",hasEncryptionKey:E})}),[y,b,m,E]),Object(i.useEffect)((()=>{b||g===M||null==M||y({type:"updateSignalIndexName",signalIndexName:M})}),[y,b,g,M]),Object(i.useEffect)((()=>{b||f===_||null==_||y({type:"updateSignalIndexMappingOutdated",signalIndexMappingOutdated:_})}),[y,b,f,_]),Object(i.useEffect)((()=>{p&&m&&a&&(null!=u&&!u||null!=f&&f)&&null!=F&&F()}),[F,p,m,u,a,f]),{loading:b,isSignalIndexExists:u,isAuthenticated:p,hasEncryptionKey:m,canUserCRUD:e,canUserREAD:t,hasIndexManage:a,hasIndexMaintenance:n,hasIndexWrite:r,hasIndexRead:l,hasIndexUpdateDelete:c,signalIndexName:g,signalIndexMappingOutdated:f}}},function(e,t,a){"use strict";var n=a(179);a.d(t,"a",(function(){return n.a}));var i=a(227);a.d(t,"b",(function(){return i.a}));var r=a(138);a.d(t,"c",(function(){return r.b}));var s=a(158);a.d(t,"d",(function(){return s.a}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return d})),a.d(t,"b",(function(){return g}));var n=a(42),i=a(240),r=a.n(i),s=a(2),o=a(102),l=a(513),c=a(377),u=a(108);const d=e=>Object(n.keyBy)("name",function(e){const t=[];for(const a of Object.values(e))a.fields&&t.push(...Object.values(a.fields));return t}(e)),p=r()(((e,t)=>t&&t.length>0?{fields:t.map((e=>Object(n.pick)(["name","searchable","type","aggregatable","esTypes","subType","conflictDescriptions"],e))),title:e}:{fields:[],title:e}),((e,t)=>e[0]===t[0]&&e[1].length===t[1].length)),m={},b={fields:[],title:""},g=(e,t=!1,a="indexFields")=>{const{data:i}=Object(o.j)().services,r=Object(s.useRef)(new AbortController),d=Object(s.useRef)([]),[g,f]=Object(s.useState)({browserFields:m,indexes:e,indexExists:!0,indexPatterns:b,dataView:void 0,loading:!1}),{addError:y}=Object(u.a)(),h=Object(s.useCallback)((t=>{(async()=>{try{f({...g,loading:!0}),r.current=new AbortController;const e=await i.dataViews.create({title:t.join(","),allowNoIndex:!0}),a=e.toSpec(),{browserFields:n}=Object(c.a)(t,a.fields);d.current=e.getIndexPattern().split(","),f({loading:!1,dataView:a,browserFields:n,indexes:e.getIndexPattern().split(","),indexExists:e.getIndexPattern().split(",").length>0,indexPatterns:p(e.getIndexPattern(),e.fields)})}catch(t){f({browserFields:m,indexes:e,indexExists:!0,indexPatterns:b,dataView:void 0,loading:!1}),y(null==t?void 0:t.message,{title:l.a})}})()}),[y,i.dataViews,e,g]);return Object(s.useEffect)((()=>(Object(n.isEmpty)(e)||Object(n.isEqual)(d.current,e)||h(e),()=>{r.current.abort()})),[e,d]),[g.loading,g]}},function(e,t,a){"use strict";let n,i,r;a.r(t),a.d(t,"UsersType",(function(){return n})),a.d(t,"UsersTableType",(function(){return i})),a.d(t,"UsersDetailsTableType",(function(){return r})),function(e){e.page="page",e.details="details"}(n||(n={})),function(e){e.allUsers="allUsers",e.authentications="authentications",e.anomalies="anomalies",e.risk="userRisk",e.events="events"}(i||(i={})),function(e){e.authentications="authentications",e.anomalies="anomalies",e.risk="userRisk",e.events="events"}(r||(r={}))},function(e,t,a){"use strict";let n,i,r,s,o,l,c;a.d(t,"e",(function(){return n})),a.d(t,"d",(function(){return i})),a.d(t,"c",(function(){return s})),a.d(t,"f",(function(){return o})),a.d(t,"b",(function(){return l})),a.d(t,"a",(function(){return c})),function(e){e.windows="windows",e.mac="mac",e.linux="linux"}(n||(n={})),function(e){e.is="is",e.matches="matches"}(i||(i={})),function(e){e.enrolled="enrolled",e.unenrolled="unenrolled"}(r||(r={})),function(e){e.UNHEALTHY="unhealthy",e.HEALTHY="healthy",e.OFFLINE="offline",e.UPDATING="updating",e.INACTIVE="inactive",e.UNENROLLED="unenrolled"}(s||(s={})),function(e){e.detect="detect",e.prevent="prevent",e.off="off"}(o||(o={})),function(e){e.success="success",e.failure="failure",e.warning="warning",e.unsupported="unsupported"}(l||(l={})),function(e){e.ENROLLED_AT="enrolled_at",e.HOSTNAME="metadata.host.hostname",e.HOST_STATUS="host_status",e.POLICY_NAME="metadata.Endpoint.policy.applied.name",e.POLICY_STATUS="metadata.Endpoint.policy.applied.status",e.HOST_OS_NAME="metadata.host.os.name",e.HOST_IP="metadata.host.ip",e.AGENT_VERSION="metadata.agent.version",e.LAST_SEEN="last_checkin"}(c||(c={}))},function(e,t,a){"use strict";a.d(t,"b",(function(){return o})),a.d(t,"a",(function(){return l}));var n=a(42),i=a(2),r=a(350),s=a(4);const o=e=>{const t=Object(n.some)({category:"kibana",field:"kibana.alert.rule.uuid"},e),a=Object(i.useMemo)((()=>t?Object(r.a)({category:"kibana",field:"kibana.alert.rule.uuid"},e):Object(r.a)({category:"signal",field:"signal.rule.id"},e)),[t,e]),s=Object(i.useMemo)((()=>Object(r.a)({category:"kibana",field:"kibana.alert.rule.name"},e)),[e]),o=Object(i.useMemo)((()=>Object(r.a)({category:"kibana",field:"kibana.alert.rule.description"},e)),[e]),l=Object(i.useMemo)((()=>Object(r.a)({category:"_id",field:"_id"},e)),[e]),c=Object(i.useMemo)((()=>Object(r.a)({category:"_index",field:"_index"},e)),[e]),u=Object(i.useMemo)((()=>Object(r.a)({category:"kibana",field:"kibana.alert.url"},e)),[e]),d=Object(i.useMemo)((()=>Object(r.a)({category:"agent",field:"agent.id"},e)),[e]),p=Object(i.useMemo)((()=>Object(r.a)({category:"host",field:"host.name"},e)),[e]),m=Object(i.useMemo)((()=>Object(r.a)({category:"user",field:"user.name"},e)),[e]),b=Object(i.useMemo)((()=>Object(r.a)({category:"base",field:"@timestamp"},e)),[e]);return Object(i.useMemo)((()=>({agentId:d,alertId:l,alertUrl:u,data:e,hostName:p,indexName:c,isAlert:t,ruleDescription:o,ruleId:a,ruleName:s,timestamp:b,userName:m})),[d,l,u,e,p,c,t,o,a,s,b,m])},l=(e,t="default")=>e.startsWith(`.internal${s.v}`)?`${s.v}-${t}`:e.startsWith(`.internal${s.P}`)?`${s.P}-${t}`:void 0},function(e,t,a){"use strict";a.d(t,"g",(function(){return u})),a.d(t,"a",(function(){return d})),a.d(t,"e",(function(){return p})),a.d(t,"i",(function(){return m})),a.d(t,"b",(function(){return b})),a.d(t,"c",(function(){return g})),a.d(t,"j",(function(){return f})),a.d(t,"d",(function(){return y})),a.d(t,"h",(function(){return h})),a.d(t,"f",(function(){return v}));var n=a(8),i=a(139),r=a(114);const s=e=>e.policy,o=e=>e.timerange,l=e=>e.queries,c=(e,t)=>{const a=e.inputs[t];return Object(n.isEmpty)(a.linkTo)?a.queries:a.linkTo.reduce(((t,a)=>{if(a===r.a.socTrends)return t;const n=e.inputs[a];return[...t,...n.queries]}),a.queries)},u=()=>Object(i.createSelector)(s,(e=>e.kind)),d=()=>Object(i.createSelector)(s,(e=>e.duration)),p=()=>Object(i.createSelector)(o,(e=>e.kind)),m=()=>Object(i.createSelector)(o,(e=>e.from)),b=()=>Object(i.createSelector)(o,(e=>e.to)),g=()=>Object(i.createSelector)(o,(e=>e.fromStr)),f=()=>Object(i.createSelector)(o,(e=>e.toStr)),y=()=>Object(i.createSelector)(l,(e=>e.some((e=>!0===e.loading)))),h=()=>Object(i.createSelector)(c,(e=>e.filter((e=>"kql"!==e.id)))),v=()=>Object(i.createSelector)(l,(e=>e.find((e=>"kql"===e.id))))},,function(e,t,a){"use strict";a.d(t,"d",(function(){return u})),a.d(t,"c",(function(){return d})),a.d(t,"e",(function(){return p})),a.d(t,"a",(function(){return m})),a.d(t,"b",(function(){return b}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(40),l=a(16),c=a(21);const u=()=>{const{getAppUrl:e}=Object(l.a)();return Object(r.useCallback)((({id:t,path:a="",absolute:n=!1,urlState:i})=>{const{appId:r,deepLinkId:s,path:o=""}=g(t),l=f(o,a),c=i?y(l,i):l;return e({deepLinkId:s,appId:r,path:c,absolute:n})}),[e])},d=()=>{const e=u(),{navigateTo:t}=Object(l.b)();return Object(r.useCallback)((({id:a,path:n,urlState:i,onClick:r,overrideNavigation:s=!0})=>{const o=e({id:a,path:n,urlState:i});return{href:o,onClick:e=>{h(e)||(r&&r(e),s&&(e.preventDefault(),t({url:o})))}}}),[e,t])},p=e=>s.a.memo((function({id:t,path:a,urlState:n,onClick:r,...s}){const o=d(),{onClick:l,href:u}=o({id:t,path:a,urlState:n,onClick:r,..."_blank"===s.target&&{overrideNavigation:!1}});return Object(c.jsx)(e,i()({onClick:l,href:u},s))})),m=(p(o.EuiButton),p(o.EuiLink)),b=e=>!e.includes(":"),g=e=>{const[t,a]=e.split(/\/(.*)/),n=a?`/${a}`:"";if(!b(t)){const[e,a]=t.split(":");return{appId:e,deepLinkId:a,path:n}}return{deepLinkId:t,path:n}},f=(e,t)=>e&&t?`${e.replace(/\/$/,"")}/${t.replace(/^\//,"")}`:e||t||"",y=(e,t)=>{const a=t.replace("?",""),[n,i]=e.split("?");let r="";return a&&i?r=`?${i}&${a}`:i?r=`?${i}`:a&&(r=`?${a}`),`${n}${r}`},h=e=>e.metaKey||e.altKey||e.ctrlKey||e.shiftKey},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r}));var n=a(176);const i="not-filtered",r=[{columnHeaderType:i,id:"@timestamp",initialWidth:n.b,esTypes:["date"],type:"date"},{columnHeaderType:i,id:"message",initialWidth:n.a},{columnHeaderType:i,id:"event.category",initialWidth:n.a},{columnHeaderType:i,id:"event.action",initialWidth:n.a},{columnHeaderType:i,id:"host.name",initialWidth:n.a},{columnHeaderType:i,id:"source.ip",initialWidth:n.a},{columnHeaderType:i,id:"destination.ip",initialWidth:n.a},{columnHeaderType:i,id:"user.name",initialWidth:n.a}]},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"E",(function(){return s})),a.d(t,"D",(function(){return o})),a.d(t,"p",(function(){return l})),a.d(t,"x",(function(){return c})),a.d(t,"q",(function(){return u})),a.d(t,"u",(function(){return d})),a.d(t,"z",(function(){return p})),a.d(t,"r",(function(){return m})),a.d(t,"s",(function(){return b})),a.d(t,"v",(function(){return g})),a.d(t,"y",(function(){return f})),a.d(t,"t",(function(){return y})),a.d(t,"w",(function(){return h})),a.d(t,"k",(function(){return v})),a.d(t,"j",(function(){return E})),a.d(t,"I",(function(){return x})),a.d(t,"H",(function(){return j})),a.d(t,"m",(function(){return S})),a.d(t,"l",(function(){return k})),a.d(t,"i",(function(){return O})),a.d(t,"G",(function(){return w})),a.d(t,"c",(function(){return T})),a.d(t,"e",(function(){return I})),a.d(t,"d",(function(){return C})),a.d(t,"g",(function(){return M})),a.d(t,"f",(function(){return _})),a.d(t,"h",(function(){return F})),a.d(t,"F",(function(){return A})),a.d(t,"A",(function(){return D})),a.d(t,"B",(function(){return N})),a.d(t,"C",(function(){return P})),a.d(t,"n",(function(){return R})),a.d(t,"o",(function(){return L}));const n="securitySolutionDocumentDetailsFlyout",i=`${n}AnalyzerGraph`,r=`${n}AnalyzerGraphError`,s=`${n}SessionView`,o=`${n}SessionViewError`,l=`${n}PrevalenceDetailsDatePicker`,c=`${n}PrevalenceDetailsTable`,u=`${n}PrevalenceDetailsLoading`,d=`${n}PrevalenceDetailsTableFieldCell`,p=`${n}PrevalenceDetailsTableValueCell`,m=`${n}PrevalenceDetailsTableAlertCountCell`,b=`${n}PrevalenceDetailsTableDocCountCell`,g=`${n}PrevalenceDetailsTableHostPrevalenceCell`,f=`${n}PrevalenceDetailsTableUserPrevalenceCell`,y=`${n}PrevalenceDetailsTableError`,h=`${n}PrevalenceDetailsTableNoData`,v=`${n}EntitiesDetails`,E=`${v}NoData`,x=`${n}UsersDetails`,j=`${n}UsersDetailsRelatedHostsTable`,S=`${n}HostsDetails`,k=`${n}HostsDetailsRelatedUsersTable`,O=`${n}CorrelationsDetails`,w=`${n}ThreatIntelligenceDetailsLoadingSpinner`,T=`${O}AlertsByAncestrySection`,I=`${O}AlertsBySourceSection`,C=`${O}AlertsBySessionSection`,M=`${O}CasesSection`,_=`${M}Table`,F=`${O}SuppressedAlertsSection`,A=`${O}SuppressedAlertsSectionTechnicalPreview`,D=`${n}Responses`,N=`${D}Details`,P=`${D}Empty`,R=`${n}InvestigationGuideLoading`,L=`${n}NoData`},function(e,t,a){const n=a(157);e.exports=(e,t,a)=>new n(e,a).compare(new n(t,a))},function(e,t,a){"use strict";a.d(t,"i",(function(){return p})),a.d(t,"j",(function(){return m})),a.d(t,"k",(function(){return f})),a.d(t,"f",(function(){return y})),a.d(t,"g",(function(){return v})),a.d(t,"a",(function(){return x})),a.d(t,"b",(function(){return w})),a.d(t,"c",(function(){return T})),a.d(t,"h",(function(){return d})),a.d(t,"t",(function(){return Z})),a.d(t,"u",(function(){return O})),a.d(t,"d",(function(){return I})),a.d(t,"e",(function(){return M})),a.d(t,"m",(function(){return ee})),a.d(t,"n",(function(){return te})),a.d(t,"o",(function(){return ae})),a.d(t,"p",(function(){return _})),a.d(t,"q",(function(){return A})),a.d(t,"v",(function(){return K})),a.d(t,"C",(function(){return ne})),a.d(t,"z",(function(){return ie})),a.d(t,"x",(function(){return re})),a.d(t,"w",(function(){return le})),a.d(t,"B",(function(){return ce})),a.d(t,"y",(function(){return ue})),a.d(t,"A",(function(){return de})),a.d(t,"r",(function(){return pe})),a.d(t,"s",(function(){return me})),a.d(t,"l",(function(){return l})),a.d(t,"D",(function(){return be}));var n=a(112),i=a(43);const r=i.recursion("saved_object_attribute_single",(()=>i.union([i.string,i.number,i.boolean,i.null,i[void 0],o]))),s=i.recursion("saved_object_attribute",(()=>i.union([r,i.array(r)]))),o=i.recursion("saved_object_attributes",(()=>i.record(i.string,s))),l=i.union([i.literal("no_actions"),i.literal("rule"),Object(n.q)({allowedUnits:["s","m","h","d"]})]),c=i.boolean,u=i.union([i.literal("onActionGroupChange"),i.literal("onActiveAlert"),i.literal("onThrottleInterval")]),d=i.type({summary:c,notifyWhen:u,throttle:i.union([l,i.null])}),p=i.string,m=i.string,b=i.string,g=n.k,f=o,y=i.partial({query:i.union([i[void 0],i.intersection([i.strict({kql:i.string,filters:i.array(i.intersection([i.type({meta:i.partial({alias:i.union([i.string,i.null]),disabled:i.boolean,negate:i.boolean,controlledBy:i.string,group:i.string,index:i.string,isMultiIndex:i.boolean,type:i.string,key:i.string,params:i.any,value:i.string})}),i.partial({$state:i.type({store:i.any}),query:i.record(i.string,i.any)})]))}),i.partial({dsl:i.string})])]),timeframe:i.union([i[void 0],i.strict({timezone:i.string,days:i.array(i.union([i.literal(1),i.literal(2),i.literal(3),i.literal(4),i.literal(5),i.literal(6),i.literal(7)])),hours:i.strict({start:i.string,end:i.string})})])}),h=i.exact(i.intersection([i.type({group:p,id:m,action_type_id:b,params:f}),i.partial({uuid:g,alerts_filter:y,frequency:d})])),v=i.array(h),E=i.exact(i.intersection([i.type({group:p,id:m,actionTypeId:b,params:f}),i.partial({uuid:g,alertsFilter:y,frequency:d})])),x=(i.array(E),new i.Type("DefaultActionsArray",v.is,((e,t)=>null==e?i.success([]):v.validate(e,t)),i.identity),new i.Type("DefaultExportFileName",i.string.is,((e,t)=>null==e?i.success("export.ndjson"):i.string.validate(e,t)),i.identity));var j=a(421);const S=new i.Type("From",i.string.is,((e,t)=>(e=>"string"==typeof e)(e)&&null==Object(j.a)(e)?i.failure(e,t,'Failed to parse "from" on rule param'):i.string.validate(e,t)),i.identity),k=(new i.Type("DefaultFromString",i.string.is,((e,t)=>null==e?i.success("now-6m"):S.validate(e,t)),i.identity),new i.Type("DefaultIntervalString",i.string.is,((e,t)=>null==e?i.success("5m"):i.string.validate(e,t)),i.identity),i.keyof({eql:null,kuery:null,lucene:null})),O=(i.union([k,i[void 0]]),new i.Type("DefaultLanguageString",i.string.is,((e,t)=>null==e?i.success("kuery"):k.validate(e,t)),i.identity),n.o),w=(i.union([O,i[void 0]]),new i.Type("DefaultMaxSignals",i.number.is,((e,t)=>null==e?i.success(100):O.validate(e,t)),i.identity),new i.Type("DefaultPerPage",i.number.is,((e,t)=>null==e?i.success(1):"string"==typeof e?n.o.validate(parseInt(e,10),t):n.o.validate(e,t)),i.identity)),T=new i.Type("DefaultPerPage",i.number.is,((e,t)=>null==e?i.success(20):"string"==typeof e?n.o.validate(parseInt(e,10),t):n.o.validate(e,t)),i.identity),I=new i.Type("RiskScore",i.number.is,((e,t)=>"number"==typeof e&&Number.isSafeInteger(e)&&e>=0&&e<=100?i.success(e):i.failure(e,t)),i.identity),C=i.exact(i.type({field:i.string,value:i.string,operator:n.w,risk_score:i.union([I,i[void 0]])})),M=i.array(C),_=(new i.Type("DefaultRiskScoreMappingArray",M.is,((e,t)=>null==e?i.success([]):M.validate(e,t)),i.identity),i.keyof({low:null,medium:null,high:null,critical:null})),F=i.exact(i.type({field:i.string,operator:n.w,value:i.string,severity:_})),A=i.array(F),D=(new i.Type("DefaultSeverityMappingArray",A.is,((e,t)=>null==e?i.success([]):A.validate(e,t)),i.identity),i.string),N=i.string,P=i.string,R=i.type({id:D,name:N,reference:P}),L=i.string,B=i.string,q=i.string,z=i.type({id:L,name:B,reference:q}),$=i.array(z),V=i.string,U=i.string,H=i.string,G=i.intersection([i.exact(i.type({id:V,name:U,reference:H})),i.exact(i.partial({subtechnique:$}))]),Q=i.array(G),W=i.string,K=i.intersection([i.exact(i.type({framework:W,tactic:R})),i.exact(i.partial({technique:Q}))]),Y=i.array(K);i.union([Y,i[void 0]]),new i.Type("DefaultThreatArray",Y.is,((e,t)=>null==e?i.success([]):Y.validate(e,t)),i.identity),new i.Type("DefaultToString",i.string.is,((e,t)=>null==e?i.success("now"):i.string.validate(e,t)),i.identity);var J=a(47);new i.Type("DefaultUuid",i.string.is,((e,t)=>null==e?i.success(Object(J.v4)()):n.k.validate(e,t)),i.identity);const X=Object(n.j)(i.string),Z=(i.union([X,i[void 0]]),i.union([i.string,X])),ee=(i.union([Z,i[void 0]]),new i.Type("referencesWithDefaultArray",i.array(i.string).is,((e,t)=>null==e?i.success([]):i.array(i.string).validate(e,t)),i.identity),i.string),te=S,ae=i.string,ne=i.string,ie=(i.union([ne,i[void 0]]),i.string),re=(i.union([ie,i[void 0]]),i.array(i.unknown)),se=(i.union([re,i[void 0]]),i.exact(i.type({field:n.k,type:i.keyof({mapping:null}),value:n.k}))),oe=i.array(se),le=i.exact(i.type({entries:oe})),ce=Object(n.j)(le,"NonEmptyArray<ThreatMap>"),ue=(i.union([ce,i[void 0]]),i.array(i.string)),de=(i.union([ue,i[void 0]]),i.union([k,i[void 0]])),pe=(i.union([de,i[void 0]]),n.o),me=(i.union([pe,i[void 0]]),n.o),be=(i.union([me,i[void 0]]),i.keyof({eql:null,machine_learning:null,query:null,saved_query:null,threshold:null,threat_match:null,new_terms:null}));i.union([be,i[void 0]])},function(e,t,a){"use strict";a.d(t,"a",(function(){return y}));var n=a(60),i=a(42),r=a(2),s=a(141),o=a(13),l=a(85),c=a(5);const u=e=>c.i18n.translate("xpack.securitySolution.searchStrategy.error",{values:{factoryQueryType:e},defaultMessage:"Failed to run search: {factoryQueryType}"});var d=a(115),p=a(102),m=a(108),b=a(303),g=a(4);const f={dsl:[],response:[]},y=({factoryQueryType:e,initialResult:t,errorMessage:a,abort:y=!1,showErrorToast:h=!0})=>{const v=Object(r.useRef)(new AbortController),E=Object(r.useRef)(i.noop),{addError:x}=Object(m.a)(),j=(e=>{const{data:t}=Object(p.j)().services,{addWarning:a}=Object(m.a)(),{startTracking:i}=Object(b.a)();return Object(r.useCallback)((({abortSignal:r,request:s})=>{const{endTracking:l}=i({name:`${g.l} searchStrategy ${e}`,spanName:"batched search"}),u=t.search.search({...s,factoryQueryType:e},{strategy:"securitySolutionSearchStrategy",abortSignal:r}).pipe(Object(n.filter)((e=>Object(o.isErrorResponse)(e)||Object(o.isCompleteResponse)(e))));return u.subscribe({next:t=>{Object(o.isErrorResponse)(t)?(a((e=>c.i18n.translate("xpack.securitySolution.searchStrategy.warning",{values:{factoryQueryType:e},defaultMessage:"An error has occurred running search: {factoryQueryType}"}))(e)),l("invalid")):l("success")},error:()=>{l(r.aborted?"aborted":"error")}}),u}),[a,t.search,e,i])})(e),{start:S,error:k,result:O,loading:w}=Object(s.c)(j);Object(r.useEffect)((()=>{!h||null==k||k instanceof l.AbortError||x(k,{title:null!=a?a:u(e)})}),[x,k,a,e,h]);const T=Object(r.useCallback)((e=>{const t=()=>{v.current=new AbortController,S({request:e,abortSignal:v.current.signal})};v.current.abort(),t(),E.current=t}),[S]);Object(r.useEffect)((()=>()=>{v.current.abort()}),[]),Object(r.useEffect)((()=>{y&&v.current.abort()}),[y]);const[I,C]=Object(r.useMemo)((()=>Object(o.isErrorResponse)(O)?[t,f]:[Object(i.omit)("rawResponse",O),Object(d.getInspectResponse)(O,f)]),[O,t]);return{loading:w,result:I,error:k,search:T,refetch:E.current,inspect:C}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(42);const i=e=>Object(n.isEmpty)(e)?"":`${null!=e&&e.startsWith("?")?e:`?${e}`}`},function(e,t,a){"use strict";a.d(t,"e",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"d",(function(){return s})),a.d(t,"f",(function(){return o})),a.d(t,"a",(function(){return l})),a.d(t,"c",(function(){return c}));var n=a(4);const i={ENABLE:`${n.l} singleRuleActions enable`,DISABLE:`${n.l} singleRuleActions disable`,DUPLICATE:`${n.l} singleRuleActions duplicate`,EXPORT:`${n.l} singleRuleActions export`,DELETE:`${n.l} singleRuleActions delete`,PREVIEW:`${n.l} singleRuleActions preview`,SAVE:`${n.l} singleRuleActions save`},r={ENABLE:`${n.l} bulkRuleActions enable`,DISABLE:`${n.l} bulkRuleActions disable`,DUPLICATE:`${n.l} bulkRuleActions duplicate`,EXPORT:`${n.l} bulkRuleActions export`,DELETE:`${n.l} bulkRuleActions delete`,EDIT:`${n.l} bulkRuleActions edit`},s={REFRESH:`${n.l} rulesTable refresh`,FILTER:`${n.l} rulesTable filter`,LOAD_PREBUILT:`${n.l} rulesTable loadPrebuilt`},o={SAVE:`${n.l} timeline save`,DUPLICATE:`${n.l} timeline duplicate`,DELETE:`${n.l} timeline delete`,BULK_DELETE:`${n.l} timeline bulkDelete`},l={OPEN_ANALYZER:`${n.l} alerts openAnalyzer`,OPEN_SESSION_VIEW:`${n.l} alerts openSessionView`,INVESTIGATE_IN_TIMELINE:`${n.l} alerts investigateInTimeline`},c={FIELD_SAVED:`${n.l} fieldBrowser fieldSaved`,FIELD_DELETED:`${n.l} fieldBrowser fieldDeleted`}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"g",(function(){return s})),a.d(t,"e",(function(){return o})),a.d(t,"f",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"d",(function(){return u})),a.d(t,"h",(function(){return d}));var n=a(8);a(210);const i=e=>{if(null!=e){const t=e.trim().split(/[ \t\r\n]+/);return"sequence"===t[0]&&"where"!==t[1]}return!1},r=e=>"eql"===e,s=e=>"threshold"===e,o=e=>"query"===e||"saved_query"===e,l=e=>"threat_match"===e,c=e=>"machine_learning"===e,u=e=>"new_terms"===e,d=e=>Array.isArray(e)?e:Object(n.isEmpty)(e)?[]:[e]},function(e,t,a){"use strict";a.d(t,"B",(function(){return i})),a.d(t,"y",(function(){return r})),a.d(t,"A",(function(){return s})),a.d(t,"z",(function(){return o})),a.d(t,"x",(function(){return l})),a.d(t,"w",(function(){return c})),a.d(t,"q",(function(){return u})),a.d(t,"p",(function(){return d})),a.d(t,"u",(function(){return p})),a.d(t,"t",(function(){return m})),a.d(t,"X",(function(){return b})),a.d(t,"Z",(function(){return g})),a.d(t,"V",(function(){return f})),a.d(t,"W",(function(){return y})),a.d(t,"Y",(function(){return h})),a.d(t,"j",(function(){return v})),a.d(t,"O",(function(){return E})),a.d(t,"E",(function(){return x})),a.d(t,"F",(function(){return j})),a.d(t,"s",(function(){return S})),a.d(t,"k",(function(){return k})),a.d(t,"o",(function(){return O})),a.d(t,"gb",(function(){return w.T})),a.d(t,"m",(function(){return w.p})),a.d(t,"C",(function(){return w.u})),a.d(t,"r",(function(){return w.s})),a.d(t,"v",(function(){return w.t})),a.d(t,"n",(function(){return w.r})),a.d(t,"nb",(function(){return w.cb})),a.d(t,"db",(function(){return w.Q})),a.d(t,"mb",(function(){return w.bb})),a.d(t,"bb",(function(){return w.O})),a.d(t,"cb",(function(){return w.P})),a.d(t,"pb",(function(){return w.eb})),a.d(t,"D",(function(){return w.v})),a.d(t,"eb",(function(){return w.R})),a.d(t,"jb",(function(){return w.X})),a.d(t,"lb",(function(){return w.Z})),a.d(t,"kb",(function(){return w.Y})),a.d(t,"R",(function(){return w.H})),a.d(t,"Q",(function(){return w.F})),a.d(t,"T",(function(){return w.J})),a.d(t,"S",(function(){return w.I})),a.d(t,"P",(function(){return w.E})),a.d(t,"ab",(function(){return w.N})),a.d(t,"a",(function(){return w.c})),a.d(t,"U",(function(){return w.K})),a.d(t,"fb",(function(){return w.S})),a.d(t,"b",(function(){return w.d})),a.d(t,"i",(function(){return w.m})),a.d(t,"l",(function(){return w.o})),a.d(t,"h",(function(){return w.l})),a.d(t,"f",(function(){return w.j})),a.d(t,"g",(function(){return w.k})),a.d(t,"d",(function(){return w.h})),a.d(t,"e",(function(){return w.i})),a.d(t,"c",(function(){return w.e})),a.d(t,"ob",(function(){return w.db})),a.d(t,"ib",(function(){return w.W})),a.d(t,"hb",(function(){return w.U})),a.d(t,"G",(function(){return w.w})),a.d(t,"M",(function(){return w.C})),a.d(t,"K",(function(){return w.A})),a.d(t,"J",(function(){return w.z})),a.d(t,"L",(function(){return w.B})),a.d(t,"N",(function(){return w.D})),a.d(t,"H",(function(){return w.x})),a.d(t,"I",(function(){return w.y}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.exception.list.empty.viewer_title",{defaultMessage:"Create exceptions to this list"}),r=e=>n.i18n.translate("xpack.securitySolution.exception.list.empty.viewer_body",{values:{listName:e},defaultMessage:"There is no exception in your [{listName}]. Create rule exceptions to this list."}),s=n.i18n.translate("xpack.securitySolution.exception.list.empty.viewer_button_endpoint",{defaultMessage:"Create endpoint exception"}),o=n.i18n.translate("xpack.securitySolution.exception.list.empty.viewer_button",{defaultMessage:"Create rule exception"}),l=n.i18n.translate("xpack.securitySolution.exception.list.search_bar_button_enpoint",{defaultMessage:"Add endpoint exception to list"}),c=n.i18n.translate("xpack.securitySolution.exception.list.search_bar_button",{defaultMessage:"Add rule exception to list"}),u=(n.i18n.translate("xpack.securitySolution.exceptions.list.exceptionItemSearchErrorTitle",{defaultMessage:"Error searching"}),n.i18n.translate("xpack.securitySolution.exceptions.list.exceptionItemSearchErrorBody",{defaultMessage:"An error occurred searching for exception items. Please try again."}),n.i18n.translate("xpack.securitySolution.exceptions.list.exceptionItemsFetchError",{defaultMessage:"Unable to load exception items"})),d=n.i18n.translate("xpack.securitySolution.exceptions.list.exceptionItemsFetchErrorDescription",{defaultMessage:"There was an error loading the exception items. Contact your administrator for help."}),p=n.i18n.translate("xpack.securitySolution.exceptions.list.exception.item.card.exceptionItemDeleteSuccessTitle",{defaultMessage:"Exception deleted"}),m=e=>n.i18n.translate("xpack.securitySolution.exceptions.list.exception.item.card.exceptionItemDeleteSuccessText",{values:{itemName:e},defaultMessage:'"{itemName}" deleted successfully.'}),b=n.i18n.translate("xpack.securitySolution.exceptions.list.manage_rules_cancel",{defaultMessage:"Cancel"}),g=n.i18n.translate("xpack.securitySolution.exceptions.list.manage_rules_save",{defaultMessage:"Save"}),f=n.i18n.translate("xpack.securitySolution.exceptions.list.link_rules_header",{defaultMessage:"Link rules"}),y=n.i18n.translate("xpack.securitySolution.exceptions.list.link_rules_overflow_button_title",{defaultMessage:"Link rules"}),h=n.i18n.translate("xpack.securitySolution.exceptions.list.manage_rules_description",{defaultMessage:"Link or unlink rules to this exception list."}),v=n.i18n.translate("xpack.securitySolution.exceptionsTable.deleteExceptionList",{defaultMessage:"Delete exception list"}),E=n.i18n.translate("xpack.securitySolution.exceptionsTable.exportExceptionList",{defaultMessage:"Export exception list"}),x=n.i18n.translate("xpack.securitySolution.exceptionsTable.manageRulesError",{defaultMessage:"Manage rules error"}),j=n.i18n.translate("xpack.securitySolution.exceptionsTable.manageRulesErrorDescription",{defaultMessage:"An error occurred linking or unlinking rules"}),S=n.i18n.translate("xpack.securitySolution.exceptionsTable.exportListDescription",{defaultMessage:"An error occurred exporting a list"}),k=n.i18n.translate("xpack.securitySolution.exceptionsTable.duplicateExceptionList",{defaultMessage:"Duplicate exception list"}),O=n.i18n.translate("xpack.securitySolution.exceptionsTable.duplicateListDescription",{defaultMessage:"An error occurred duplicating a list"});a(567);var w=a(729)},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"c",(function(){return o})),a.d(t,"d",(function(){return c})),a.d(t,"e",(function(){return u}));var n=a(5);let i,r;!function(e){e.rules="rules",e.alertsCases="alertsCases"}(i||(i={})),function(e){e[e.none=0]="none",e[e.pointToAlertName=1]="pointToAlertName",e[e.expandEvent=2]="expandEvent",e[e.reviewAlertDetailsFlyout=3]="reviewAlertDetailsFlyout",e[e.addAlertToCase=4]="addAlertToCase",e[e.createCase=5]="createCase",e[e.submitCase=6]="submitCase",e[e.viewCase=7]="viewCase"}(r||(r={}));const s={minWidth:360,maxWidth:360,offset:10,repositionOnScroll:!0,ownFocus:!0,initialFocus:'[tour-step="nextButton"]'},o=(e,t)=>`tourStepAnchor-${t}-${e}`,l=[{...s,step:r.pointToAlertName,title:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.ruleNameStep.tourTitle",{defaultMessage:"Examine the Alerts Table"}),content:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.ruleNameStep.tourContent",{defaultMessage:"To help you practice triaging alerts, here is the alert from the rule that we enabled in the previous step."}),anchorPosition:"downCenter",dataTestSubj:o(r.pointToAlertName,i.alertsCases),initialFocus:'button[tour-step="nextButton"]'},{...s,step:r.expandEvent,title:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.openFlyout.tourTitle",{defaultMessage:"Review the alert details"}),content:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.openFlyout.tourContent",{defaultMessage:"Some information is provided at-a-glance in the table, but for full details, you'll want to open the alert."}),anchorPosition:"rightUp",dataTestSubj:o(r.expandEvent,i.alertsCases)},{...s,step:r.reviewAlertDetailsFlyout,title:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.flyoutOverview.tourTitle",{defaultMessage:"Explore alert details"}),content:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.flyoutOverview.tourContent",{defaultMessage:"Learn more about alerts by checking out all the information available."}),anchor:`[tour-step="${o(r.reviewAlertDetailsFlyout,i.alertsCases)}"] span.euiTab__content`,offset:20,anchorPosition:"leftUp",dataTestSubj:o(r.reviewAlertDetailsFlyout,i.alertsCases)},{...s,step:r.addAlertToCase,title:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.addToCase.tourTitle",{defaultMessage:"Create a case"}),content:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.addToCase.tourContent",{defaultMessage:'From the Take action menu, select "Add to new case".'}),anchorPosition:"upRight",dataTestSubj:o(r.addAlertToCase,i.alertsCases)},{...s,step:r.createCase,title:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.createCase.tourTitle",{defaultMessage:"Add Case details"}),content:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.createCase.tourContent",{defaultMessage:"Provide the relevant information to create the case. We have included sample text for you."}),anchor:'[tour-step="create-case-flyout"] label',anchorPosition:"leftUp",dataTestSubj:o(r.createCase,i.alertsCases),offset:20,repositionOnScroll:!1},{...s,step:r.submitCase,title:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.submitCase.tourTitle",{defaultMessage:"Create a case"}),content:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.submitCase.tourContent",{defaultMessage:'Press "Create case" to continue.'}),anchor:'[tour-step="create-case-flyout"] [tour-step="create-case-submit"]',anchorPosition:"leftUp",hideNextButton:!0,dataTestSubj:o(r.submitCase,i.alertsCases),offset:20,ownFocus:!1,initialFocus:'[tour-step="create-case-flyout"] [tour-step="create-case-submit"]'},{...s,step:r.viewCase,title:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.viewCase.tourTitle",{defaultMessage:"View the case"}),content:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.viewCase.tourContent",{defaultMessage:"Cases are shown under Insights, in the alert details."}),anchorPosition:"rightUp",dataTestSubj:o(r.viewCase,i.alertsCases)}],c={title:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.createCase.title",{defaultMessage:"This is a test case"}),description:n.i18n.translate("xpack.securitySolution.guided_onboarding.tour.createCase.description",{defaultMessage:"Add a description and other relevant information. The alert will be added to the case."})},u={[i.rules]:[],[i.alertsCases]:l}},function(e,t,a){"use strict";let n,i;a.r(t),a.d(t,"HostsType",(function(){return n})),a.d(t,"HostsTableType",(function(){return i})),function(e){e.page="page",e.details="details"}(n||(n={})),function(e){e.authentications="authentications",e.hosts="allHosts",e.events="events",e.uncommonProcesses="uncommonProcesses",e.anomalies="anomalies",e.risk="hostRisk",e.sessions="sessions"}(i||(i={}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"e",(function(){return r})),a.d(t,"d",(function(){return s})),a.d(t,"c",(function(){return o})),a.d(t,"b",(function(){return l}));var n=a(195);const i=e=>`${Object(n.a)(e)}`,r=e=>`${Object(n.a)(e)}`,s=(e,t)=>`/id/${e}${Object(n.a)(t)}`,o=(e,t,a)=>`/id/${e}/${t}${Object(n.a)(a)}`,l=(e,t)=>`/id/${e}/edit${Object(n.a)(t)}`},function(e,t,a){"use strict";a.d(t,"g",(function(){return i})),a.d(t,"f",(function(){return r})),a.d(t,"e",(function(){return s})),a.d(t,"a",(function(){return o})),a.d(t,"c",(function(){return l})),a.d(t,"d",(function(){return c})),a.d(t,"b",(function(){return u}));var n=a(5);const i=e=>n.i18n.translate("xpack.securitySolution.flyout.errorTitle",{values:{title:e},defaultMessage:"Unable to display {title}"}),r=e=>n.i18n.translate("xpack.securitySolution.flyout.errorMessage",{values:{message:e},defaultMessage:"There was an error displaying {message}"}),s=e=>n.i18n.translate("xpack.securitySolution.flyout.documentDetails.correlations.suppressedAlerts",{defaultMessage:"suppressed {count, plural, =1 {alert} other {alerts}}",values:{count:e}}),o=e=>n.i18n.translate("xpack.securitySolution.flyout.documentDetails.correlations.ancestryAlerts",{defaultMessage:"{count, plural, one {alert} other {alerts}} related by ancestry",values:{count:e}}),l=e=>n.i18n.translate("xpack.securitySolution.flyout.documentDetails.correlations.sourceAlerts",{defaultMessage:"{count, plural, one {alert} other {alerts}} related by source event",values:{count:e}}),c=e=>n.i18n.translate("xpack.securitySolution.flyout.documentDetails.correlations.sessionAlerts",{defaultMessage:"{count, plural, one {alert} other {alerts}} related by session",values:{count:e}}),u=e=>n.i18n.translate("xpack.securitySolution.flyout.documentDetails.correlations.relatedCases",{defaultMessage:"related {count, plural, one {case} other {cases}}",values:{count:e}})},function(e,t,a){"use strict";a.d(t,"W",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"g",(function(){return o})),a.d(t,"r",(function(){return l})),a.d(t,"A",(function(){return c})),a.d(t,"B",(function(){return u})),a.d(t,"H",(function(){return d})),a.d(t,"e",(function(){return p})),a.d(t,"f",(function(){return m})),a.d(t,"i",(function(){return b})),a.d(t,"n",(function(){return g})),a.d(t,"q",(function(){return f})),a.d(t,"s",(function(){return y})),a.d(t,"t",(function(){return h})),a.d(t,"u",(function(){return v})),a.d(t,"v",(function(){return E})),a.d(t,"E",(function(){return x})),a.d(t,"k",(function(){return j})),a.d(t,"G",(function(){return S})),a.d(t,"F",(function(){return k})),a.d(t,"m",(function(){return O})),a.d(t,"l",(function(){return w})),a.d(t,"j",(function(){return T})),a.d(t,"p",(function(){return I})),a.d(t,"J",(function(){return C})),a.d(t,"o",(function(){return M})),a.d(t,"I",(function(){return _})),a.d(t,"z",(function(){return F})),a.d(t,"h",(function(){return A})),a.d(t,"w",(function(){return D})),a.d(t,"d",(function(){return N})),a.d(t,"a",(function(){return P})),a.d(t,"y",(function(){return R})),a.d(t,"x",(function(){return L})),a.d(t,"K",(function(){return B})),a.d(t,"L",(function(){return q})),a.d(t,"M",(function(){return z})),a.d(t,"D",(function(){return $})),a.d(t,"C",(function(){return V})),a.d(t,"N",(function(){return U})),a.d(t,"R",(function(){return H})),a.d(t,"P",(function(){return G})),a.d(t,"T",(function(){return Q})),a.d(t,"Q",(function(){return W})),a.d(t,"U",(function(){return K})),a.d(t,"O",(function(){return Y})),a.d(t,"S",(function(){return J})),a.d(t,"V",(function(){return X}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.system.withResultDescription",{defaultMessage:"with result"}),r=n.i18n.translate("xpack.securitySolution.system.acceptedAConnectionViaDescription",{defaultMessage:"accepted a connection via"}),s=n.i18n.translate("xpack.securitySolution.system.attemptedLoginDescription",{defaultMessage:"attempted a login via"}),o=n.i18n.translate("xpack.securitySolution.system.disconnectedViaDescription",{defaultMessage:"disconnected via"}),l=n.i18n.translate("xpack.securitySolution.system.loggedOutDescription",{defaultMessage:"logged out via"}),c=(n.i18n.translate("xpack.securitySolution.system.usingDescription",{defaultMessage:"using"}),n.i18n.translate("xpack.securitySolution.system.processStartedDescription",{defaultMessage:"started process"})),u=n.i18n.translate("xpack.securitySolution.system.processStoppedDescription",{defaultMessage:"stopped process"}),d=n.i18n.translate("xpack.securitySolution.system.terminatedProcessDescription",{defaultMessage:"terminated process"}),p=n.i18n.translate("xpack.securitySolution.system.createdFileDescription",{defaultMessage:"created a file"}),m=n.i18n.translate("xpack.securitySolution.system.deletedFileDescription",{defaultMessage:"deleted a file"}),b=n.i18n.translate("xpack.securitySolution.rowRenderer.executedProcessDescription",{defaultMessage:"executed process"}),g=n.i18n.translate("xpack.securitySolution.rowRenderer.forkedProcessDescription",{defaultMessage:"forked process"}),f=n.i18n.translate("xpack.securitySolution.rowRenderer.loadedLibraryDescription",{defaultMessage:"loaded library"}),y=n.i18n.translate("xpack.securitySolution.rowRenderer.madeAHttpRequestViaDescription",{defaultMessage:"made a http request via"}),h=n.i18n.translate("xpack.securitySolution.rowRenderer.modifiedFileDescription",{defaultMessage:"modified a file"}),v=n.i18n.translate("xpack.securitySolution.rowRenderer.modifiedRegistryKeyDescription",{defaultMessage:"modified registry key"}),E=n.i18n.translate("xpack.securitySolution.rowRenderer.overwroteFileDescription",{defaultMessage:"overwrote a file"}),x=n.i18n.translate("xpack.securitySolution.rowRenderer.renamedFileDescription",{defaultMessage:"renamed a file"}),j=n.i18n.translate("xpack.securitySolution.system.existingProcessDescription",{defaultMessage:"is running process"}),S=n.i18n.translate("xpack.securitySolution.system.socketOpenedDescription",{defaultMessage:"opened a socket with"}),k=n.i18n.translate("xpack.securitySolution.system.socketClosedDescription",{defaultMessage:"closed a socket with"}),O=n.i18n.translate("xpack.securitySolution.system.existingUserDescription",{defaultMessage:"is an existing user"}),w=n.i18n.translate("xpack.securitySolution.system.existingSocketDescription",{defaultMessage:"is using an existing socket from"}),T=n.i18n.translate("xpack.securitySolution.system.existingPackageDescription",{defaultMessage:"is using an existing package"}),I=n.i18n.translate("xpack.securitySolution.system.invalidDescription",{defaultMessage:"attempted invalid usage of"}),C=n.i18n.translate("xpack.securitySolution.system.userChangedDescription",{defaultMessage:"user has changed"}),M=n.i18n.translate("xpack.securitySolution.system.hostDescription",{defaultMessage:"host information"}),_=n.i18n.translate("xpack.securitySolution.system.userAddedDescription",{defaultMessage:"user was added"}),F=n.i18n.translate("xpack.securitySolution.system.processErrorDescription",{defaultMessage:"encountered a process error with"}),A=n.i18n.translate("xpack.securitySolution.system.errorDescription",{defaultMessage:"encountered an error with"}),D=n.i18n.translate("xpack.securitySolution.system.packageInstalledDescription",{defaultMessage:"installed package"}),N=n.i18n.translate("xpack.securitySolution.system.packageSystemStartedDescription",{defaultMessage:"system started"}),P=n.i18n.translate("xpack.securitySolution.system.acceptedDescription",{defaultMessage:"accepted the user via"}),R=n.i18n.translate("xpack.securitySolution.system.packageUpdatedDescription",{defaultMessage:"updated package"}),L=n.i18n.translate("xpack.securitySolution.system.packageRemovedDescription",{defaultMessage:"removed package"}),B=n.i18n.translate("xpack.securitySolution.system.userRemovedDescription",{defaultMessage:"was removed"}),q=n.i18n.translate("xpack.securitySolution.system.viaDescription",{defaultMessage:"via"}),z=n.i18n.translate("xpack.securitySolution.system.viaParentProcessDescription",{defaultMessage:"via parent process"}),$=n.i18n.translate("xpack.securitySolution.rowRenderer.ransomwareWasPreventedFromeEcryptingFilesDescription",{defaultMessage:"ransomware was prevented from encrypting files"}),V=n.i18n.translate("xpack.securitySolution.rowRenderer.ransomwareWasDetectedEcryptingFilesDescription",{defaultMessage:"ransomware was detected encrypting files"}),U=n.i18n.translate("xpack.securitySolution.rowRenderer.wasDetectedCreatingAMaliciousFileDescription",{defaultMessage:"was detected creating a malicious file"}),H=n.i18n.translate("xpack.securitySolution.rowRenderer.wasPreventedFromCreatingAMaliciousFileDescription",{defaultMessage:"was prevented from creating a malicious file"}),G=n.i18n.translate("xpack.securitySolution.rowRenderer.wasDetectedModifyingAMaliciousFileDescription",{defaultMessage:"was detected modifying a malicious file"}),Q=n.i18n.translate("xpack.securitySolution.rowRenderer.wasPreventedFromModifyingAMaliciousFileDescription",{defaultMessage:"was prevented from modifying a malicious file"}),W=n.i18n.translate("xpack.securitySolution.rowRenderer.wasDetectedRenamingAMaliciousFileDescription",{defaultMessage:"was detected renaming a malicious file"}),K=n.i18n.translate("xpack.securitySolution.rowRenderer.wasPreventedFromRenamingAMaliciousFileDescription",{defaultMessage:"was prevented from renaming a malicious file"}),Y=n.i18n.translate("xpack.securitySolution.rowRenderer.wasDetectedExecutingAMaliciousProcessDescription",{defaultMessage:"was detected executing a malicious process"}),J=n.i18n.translate("xpack.securitySolution.rowRenderer.wasPreventedFromExecutingAMaliciousProcessDescription",{defaultMessage:"was prevented from executing a malicious process"}),X=n.i18n.translate("xpack.securitySolution.system.withExitCodeDescription",{defaultMessage:"with exit code"})},,function(e,t,a){class Range{constructor(e,t){if(t=i(t),e instanceof Range)return e.loose===!!t.loose&&e.includePrerelease===!!t.includePrerelease?e:new Range(e.raw,t);if(e instanceof r)return this.raw=e.value,this.set=[[e]],this.format(),this;if(this.options=t,this.loose=!!t.loose,this.includePrerelease=!!t.includePrerelease,this.raw=e.trim().split(/\s+/).join(" "),this.set=this.raw.split("||").map((e=>this.parseRange(e.trim()))).filter((e=>e.length)),!this.set.length)throw new TypeError(`Invalid SemVer Range: ${this.raw}`);if(this.set.length>1){const e=this.set[0];if(this.set=this.set.filter((e=>!g(e[0]))),0===this.set.length)this.set=[e];else if(this.set.length>1)for(const e of this.set)if(1===e.length&&f(e[0])){this.set=[e];break}}this.format()}format(){return this.range=this.set.map((e=>e.join(" ").trim())).join("||").trim(),this.range}toString(){return this.range}parseRange(e){const t=((this.options.includePrerelease&&m)|(this.options.loose&&b))+":"+e,a=n.get(t);if(a)return a;const i=this.options.loose,o=i?l[c.HYPHENRANGELOOSE]:l[c.HYPHENRANGE];e=e.replace(o,I(this.options.includePrerelease)),s("hyphen replace",e),e=e.replace(l[c.COMPARATORTRIM],u),s("comparator trim",e),e=e.replace(l[c.TILDETRIM],d),s("tilde trim",e),e=e.replace(l[c.CARETTRIM],p),s("caret trim",e);let f=e.split(" ").map((e=>h(e,this.options))).join(" ").split(/\s+/).map((e=>T(e,this.options)));i&&(f=f.filter((e=>(s("loose invalid filter",e,this.options),!!e.match(l[c.COMPARATORLOOSE]))))),s("range list",f);const y=new Map,v=f.map((e=>new r(e,this.options)));for(const e of v){if(g(e))return[e];y.set(e.value,e)}y.size>1&&y.has("")&&y.delete("");const E=[...y.values()];return n.set(t,E),E}intersects(e,t){if(!(e instanceof Range))throw new TypeError("a Range is required");return this.set.some((a=>y(a,t)&&e.set.some((e=>y(e,t)&&a.every((a=>e.every((e=>a.intersects(e,t)))))))))}test(e){if(!e)return!1;if("string"==typeof e)try{e=new o(e,this.options)}catch(e){return!1}for(let t=0;t<this.set.length;t++)if(C(this.set[t],e,this.options))return!0;return!1}}e.exports=Range;const n=new(a(1296))({max:1e3}),i=a(451),r=a(463),s=a(325),o=a(157),{safeRe:l,t:c,comparatorTrimReplace:u,tildeTrimReplace:d,caretTrimReplace:p}=a(310),{FLAG_INCLUDE_PRERELEASE:m,FLAG_LOOSE:b}=a(326),g=e=>"<0.0.0-0"===e.value,f=e=>""===e.value,y=(e,t)=>{let a=!0;const n=e.slice();let i=n.pop();for(;a&&n.length;)a=n.every((e=>i.intersects(e,t))),i=n.pop();return a},h=(e,t)=>(s("comp",e,t),e=j(e,t),s("caret",e),e=E(e,t),s("tildes",e),e=k(e,t),s("xrange",e),e=w(e,t),s("stars",e),e),v=e=>!e||"x"===e.toLowerCase()||"*"===e,E=(e,t)=>e.trim().split(/\s+/).map((e=>x(e,t))).join(" "),x=(e,t)=>{const a=t.loose?l[c.TILDELOOSE]:l[c.TILDE];return e.replace(a,((t,a,n,i,r)=>{let o;return s("tilde",e,t,a,n,i,r),v(a)?o="":v(n)?o=`>=${a}.0.0 <${+a+1}.0.0-0`:v(i)?o=`>=${a}.${n}.0 <${a}.${+n+1}.0-0`:r?(s("replaceTilde pr",r),o=`>=${a}.${n}.${i}-${r} <${a}.${+n+1}.0-0`):o=`>=${a}.${n}.${i} <${a}.${+n+1}.0-0`,s("tilde return",o),o}))},j=(e,t)=>e.trim().split(/\s+/).map((e=>S(e,t))).join(" "),S=(e,t)=>{s("caret",e,t);const a=t.loose?l[c.CARETLOOSE]:l[c.CARET],n=t.includePrerelease?"-0":"";return e.replace(a,((t,a,i,r,o)=>{let l;return s("caret",e,t,a,i,r,o),v(a)?l="":v(i)?l=`>=${a}.0.0${n} <${+a+1}.0.0-0`:v(r)?l="0"===a?`>=${a}.${i}.0${n} <${a}.${+i+1}.0-0`:`>=${a}.${i}.0${n} <${+a+1}.0.0-0`:o?(s("replaceCaret pr",o),l="0"===a?"0"===i?`>=${a}.${i}.${r}-${o} <${a}.${i}.${+r+1}-0`:`>=${a}.${i}.${r}-${o} <${a}.${+i+1}.0-0`:`>=${a}.${i}.${r}-${o} <${+a+1}.0.0-0`):(s("no pr"),l="0"===a?"0"===i?`>=${a}.${i}.${r}${n} <${a}.${i}.${+r+1}-0`:`>=${a}.${i}.${r}${n} <${a}.${+i+1}.0-0`:`>=${a}.${i}.${r} <${+a+1}.0.0-0`),s("caret return",l),l}))},k=(e,t)=>(s("replaceXRanges",e,t),e.split(/\s+/).map((e=>O(e,t))).join(" ")),O=(e,t)=>{e=e.trim();const a=t.loose?l[c.XRANGELOOSE]:l[c.XRANGE];return e.replace(a,((a,n,i,r,o,l)=>{s("xRange",e,a,n,i,r,o,l);const c=v(i),u=c||v(r),d=u||v(o),p=d;return"="===n&&p&&(n=""),l=t.includePrerelease?"-0":"",c?a=">"===n||"<"===n?"<0.0.0-0":"*":n&&p?(u&&(r=0),o=0,">"===n?(n=">=",u?(i=+i+1,r=0,o=0):(r=+r+1,o=0)):"<="===n&&(n="<",u?i=+i+1:r=+r+1),"<"===n&&(l="-0"),a=`${n+i}.${r}.${o}${l}`):u?a=`>=${i}.0.0${l} <${+i+1}.0.0-0`:d&&(a=`>=${i}.${r}.0${l} <${i}.${+r+1}.0-0`),s("xRange return",a),a}))},w=(e,t)=>(s("replaceStars",e,t),e.trim().replace(l[c.STAR],"")),T=(e,t)=>(s("replaceGTE0",e,t),e.trim().replace(l[t.includePrerelease?c.GTE0PRE:c.GTE0],"")),I=e=>(t,a,n,i,r,s,o,l,c,u,d,p,m)=>`${a=v(n)?"":v(i)?`>=${n}.0.0${e?"-0":""}`:v(r)?`>=${n}.${i}.0${e?"-0":""}`:s?`>=${a}`:`>=${a}${e?"-0":""}`} ${l=v(c)?"":v(u)?`<${+c+1}.0.0-0`:v(d)?`<${c}.${+u+1}.0-0`:p?`<=${c}.${u}.${d}-${p}`:e?`<${c}.${u}.${+d+1}-0`:`<=${l}`}`.trim(),C=(e,t,a)=>{for(let a=0;a<e.length;a++)if(!e[a].test(t))return!1;if(t.prerelease.length&&!a.includePrerelease){for(let a=0;a<e.length;a++)if(s(e[a].semver),e[a].semver!==r.ANY&&e[a].semver.prerelease.length>0){const n=e[a].semver;if(n.major===t.major&&n.minor===t.minor&&n.patch===t.patch)return!0}return!1}return!0}},function(e,t,a){"use strict";a.d(t,"h",(function(){return Ee})),a.d(t,"b",(function(){return xe})),a.d(t,"f",(function(){return je})),a.d(t,"c",(function(){return Se})),a.d(t,"d",(function(){return ke})),a.d(t,"g",(function(){return Oe})),a.d(t,"j",(function(){return we})),a.d(t,"i",(function(){return Te})),a.d(t,"a",(function(){return Ie})),a.d(t,"e",(function(){return Ce})),a.d(t,"k",(function(){return Tt}));var n=a(42),i=a(2),r=a.n(i),s=a(106),o=a(40),l=a(127),c=a(250),u=a(121),d=a(277),p=a(819);const m=r.a.memo((({contextId:e,eventId:t,hostName:a,hostNameSeparator:n="@",isDraggable:i,userDomain:s,userDomainField:o="user.domain",userName:c,userNameField:d="user.name",workingDirectory:m})=>null!=c||null!=s||null!=a||null!=m?r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:t,field:d,isDraggable:i,value:c,iconType:"user",fieldType:"keyword",isAggregatable:!0})),null!=s&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{"data-test-subj":"user-host-working-dir-domain-separator-text",grow:!1,component:"span"},"\\"),r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:t,field:o,isDraggable:i,value:s,fieldType:"keyword",isAggregatable:!0}))),null!=a&&null!=c&&r.a.createElement(l.c,{grow:!1,component:"span"},n),r.a.createElement(p.a,{contextId:e,eventId:t,hostName:a,isDraggable:i,workingDirectory:m})):null));m.displayName="UserHostWorkingDir";var b=a(5);const g=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.dns.askedForDescription",{defaultMessage:"asked for"}),f=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.dns.responseCodeDescription",{defaultMessage:"response code:"}),y=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.dns.viaDescription",{defaultMessage:"via"}),h=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.dns.whichResolvedToDescription",{defaultMessage:", which resolved to"}),v=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.dns.withQuestionTypeDescription",{defaultMessage:"with question type"}),E=r.a.memo((({contextId:e,dnsQuestionName:t,dnsQuestionType:a,dnsResolvedIp:n,dnsResponseCode:i,eventCode:s,hostName:c,id:p,isDraggable:b,processExecutable:E,processName:x,processPid:j,userDomain:S,userName:k,winlogEventId:O})=>r.a.createElement(r.a.Fragment,null,r.a.createElement(o.EuiFlexGroup,{alignItems:"center",justifyContent:"center",gutterSize:"none",wrap:!0},r.a.createElement(m,{contextId:e,eventId:p,hostName:c,isDraggable:b,userDomain:S,userName:k,workingDirectory:void 0}),!Object(l.e)(t)&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{component:"span","data-test-subj":"asked-for",grow:!1},g),r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:p,field:"dns.question.name",isDraggable:b,value:t,isAggregatable:!0,fieldType:"keyword"}))),!Object(l.e)(a)&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{component:"span","data-test-subj":"with-question-type",grow:!1},v),r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:p,field:"dns.question.type",isDraggable:b,value:a,isAggregatable:!0,fieldType:"keyword"}))),!Object(l.e)(n)&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{component:"span","data-test-subj":"which-resolved-to",grow:!1},h),r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:p,field:"dns.resolved_ip",isDraggable:b,value:n,isAggregatable:!0,fieldType:"ip"}))),!Object(l.e)(i)&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{component:"span",grow:!1},"("),r.a.createElement(l.c,{component:"span","data-test-subj":"response-code",grow:!1},f),r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:p,field:"dns.response_code",isDraggable:b,value:i,isAggregatable:!0,fieldType:"keyword"})),r.a.createElement(l.c,{component:"span",grow:!1},")")),r.a.createElement(l.c,{component:"span",grow:!1},y),r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(d.b,{contextId:e,endgamePid:void 0,endgameProcessName:void 0,eventId:p,isDraggable:b,processPid:j,processName:x,processExecutable:E})),(!Object(l.e)(s)||!Object(l.e)(O))&&r.a.createElement(r.a.Fragment,null,Object(l.e)(s)?r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:p,iconType:"logoWindows",field:"winlog.event_id",isDraggable:b,value:O,isAggregatable:!0,fieldType:"keyword"})):r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:p,field:"event.code",isDraggable:b,value:s,isAggregatable:!0,fieldType:"number"})))))));E.displayName="DnsRequestEventDetailsLine";const x=r.a.memo((({data:e,contextId:t,isDraggable:a,timelineId:i})=>{const s=Object(n.get)("dns.question.name[0]",e),u=Object(n.get)("dns.question.type[0]",e),d=Object(n.get)("dns.resolved_ip[0]",e),p=Object(n.get)("dns.response_code[0]",e),m=Object(n.get)("event.code[0]",e),b=Object(n.get)("host.name[0]",e),g=e._id,f=Object(n.get)("process.executable[0]",e),y=Object(n.get)("process.name[0]",e),h=Object(n.get)("process.pid[0]",e),v=Object(n.get)("user.domain[0]",e),x=Object(n.get)("user.name[0]",e),j=Object(n.get)("winlog.event_id[0]",e);return r.a.createElement(l.b,null,r.a.createElement(E,{contextId:t,dnsQuestionName:s,dnsQuestionType:u,dnsResolvedIp:d,dnsResponseCode:p,eventCode:m,hostName:b,id:g,isDraggable:a,processExecutable:f,processName:y,processPid:h,userDomain:v,userName:x,winlogEventId:j}),r.a.createElement(o.EuiSpacer,{size:"s"}),r.a.createElement(c.a,{data:e,isDraggable:a,timelineId:i}))}));x.displayName="DnsRequestEventDetails";const j=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.aLoginWasAttemptedUsingExplicitCredentialsDescription",{defaultMessage:"A login was attempted using explicit credentials"}),S=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.asRequestedBySubjectDescription",{defaultMessage:"as requested by subject"}),k=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endpoint.failedToLogInDescription",{defaultMessage:"failed to log in"}),O=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endpoint.failedToLogOffDescription",{defaultMessage:"failed to log off"}),w=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.loggedOffDescription",{defaultMessage:"logged off"}),T=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.logonTypeBatchDescription",{defaultMessage:"Batch"}),I=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.logonTypeCachedInteractiveDescription",{defaultMessage:"Cached Interactive"}),C=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.logonTypeInteractiveDescription",{defaultMessage:"Interactive"}),M=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.logonTypeNetworkDescription",{defaultMessage:"Network"}),_=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.logonTypeNetworkCleartextDescription",{defaultMessage:"Network Cleartext"}),F=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.logonTypeNewCredentialsDescription",{defaultMessage:"New Credentials"}),A=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.logonTypeRemoteInteractiveDescription",{defaultMessage:"Remote Interactive"}),D=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.logonTypeServiceDescription",{defaultMessage:"Service"}),N=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.logonTypeUnlockDescription",{defaultMessage:"Unlock"}),P=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.subjectLogonIdDescription",{defaultMessage:"subject logon ID"}),R=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.successfullyLoggedInDescription",{defaultMessage:"successfully logged in"}),L=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.targetLogonIdDescription",{defaultMessage:"target logon ID"}),B=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.toDescription",{defaultMessage:"to"}),q=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.usingLogonTypeDescription",{defaultMessage:"using logon type"}),z=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.viaDescription",{defaultMessage:"via"}),$=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.endgame.withSpecialPrivilegesDescription",{defaultMessage:"With special privileges,"}),V=e=>{if(Object(l.e)(e))return"";switch(e){case 2:return C;case 3:return M;case 4:return T;case 5:return D;case 7:return N;case 8:return _;case 9:return F;case 10:return A;case 11:return I;default:return`${e}`}},U=e=>"explicit_user_logon"===e||"user_logoff"===e,H=r.a.memo((({contextId:e,endgameLogonType:t,endgameSubjectDomainName:a,endgameSubjectLogonId:n,endgameSubjectUserName:i,endgameTargetDomainName:s,endgameTargetLogonId:c,endgameTargetUserName:p,eventAction:b,eventCode:g,eventOutcome:f,hostName:y,id:h,isDraggable:v,processExecutable:E,processName:x,processPid:T,userDomain:I,userName:C,winlogEventId:M})=>{const _=U(b)?s:I,F=(({eventAction:e,eventOutcome:t})=>{switch(e){case"explicit_user_logon":return"";case"log_off":case"user_logoff":return"failure"===(null==t?void 0:t.toLowerCase())?O:w;default:return"failure"===(null==t?void 0:t.toLowerCase())?k:R}})({eventAction:b,eventOutcome:f}),A=(e=>"explicit_user_logon"===e?B:"@")(b),D=U(b)?p:C,N=(e=>U(e)?"endgame.target_domain_name":"user.domain")(b),H=(e=>U(e)?"endgame.target_user_name":"user.name")(b);return r.a.createElement(r.a.Fragment,null,r.a.createElement(o.EuiFlexGroup,{alignItems:"center",justifyContent:"center",gutterSize:"none",wrap:!0},"admin_logon"===b&&r.a.createElement(l.c,{component:"span","data-test-subj":"with-special-privileges",grow:!1},$),"explicit_user_logon"===b&&r.a.createElement(l.c,{component:"span","data-test-subj":"a-login-was-attempted",grow:!1},j),r.a.createElement(m,{contextId:e,eventId:h,hostName:y,hostNameSeparator:A,isDraggable:v,userDomain:_,userDomainField:N,userName:D,userNameField:H,workingDirectory:void 0}),r.a.createElement(l.c,{component:"span","data-test-subj":"event-details",grow:!1},F),!Object(l.e)(t)&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{component:"span","data-test-subj":"using-logon-type",grow:!1},q),r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:h,field:"endgame.logon_type",isDraggable:v,queryValue:String(t),value:`${t} - ${V(t)}`,isAggregatable:!0,fieldType:"keyword"}))),!Object(l.e)(c)&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{component:"span",grow:!1},"("),r.a.createElement(l.c,{component:"span","data-test-subj":"using-logon-type",grow:!1},L),r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:h,field:"endgame.target_logon_id",isDraggable:v,value:c,isAggregatable:!0,fieldType:"keyword"})),r.a.createElement(l.c,{component:"span",grow:!1},")")),r.a.createElement(l.c,{component:"span",grow:!1},z),r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(d.b,{contextId:e,endgamePid:void 0,endgameProcessName:void 0,eventId:h,isDraggable:v,processPid:T,processName:x,processExecutable:E})),!Object(l.e)(i)&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{component:"span","data-test-subj":"as-requested-by-subject",grow:!1},S),r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:h,field:"endgame.subject_user_name",isDraggable:v,iconType:"user",value:i,isAggregatable:!0,fieldType:"keyword"}))),null!=a&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{component:"span","data-test-subj":"subject-domain-name-domain-separator-text",grow:!1},"\\"),r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:h,field:"endgame.subject_domain_name",isDraggable:v,value:a,isAggregatable:!0,fieldType:"keyword"}))),!Object(l.e)(n)&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{component:"span",grow:!1},"("),r.a.createElement(l.c,{component:"span","data-test-subj":"subject-login-id",grow:!1},P),r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:h,field:"endgame.subject_logon_id",isDraggable:v,value:n,isAggregatable:!0,fieldType:"keyword"})),r.a.createElement(l.c,{component:"span",grow:!1},")")),(!Object(l.e)(g)||!Object(l.e)(M))&&r.a.createElement(r.a.Fragment,null,Object(l.e)(g)?r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:h,iconType:"logoWindows",field:"winlog.event_id",value:M,isAggregatable:!0,fieldType:"keyword"})):r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:h,field:"event.code",value:g,isAggregatable:!0,fieldType:"keyword"})))))}));H.displayName="EndgameSecurityEventDetailsLine";const G=r.a.memo((({data:e,contextId:t,isDraggable:a,timelineId:i})=>{const s=Object(n.get)("endgame.logon_type[0]",e),u=Object(n.get)("endgame.subject_domain_name[0]",e),d=Object(n.get)("endgame.subject_logon_id[0]",e),p=Object(n.get)("endgame.subject_user_name[0]",e),m=Object(n.get)("endgame.target_logon_id[0]",e),b=Object(n.get)("endgame.target_domain_name[0]",e),g=Object(n.get)("endgame.target_user_name[0]",e),f=Object(n.get)("event.action[0]",e),y=Object(n.get)("event.code[0]",e),h=Object(n.get)("event.outcome[0]",e),v=Object(n.get)("host.name[0]",e),E=e._id,x=Object(n.get)("process.executable[0]",e),j=Object(n.get)("process.name[0]",e),S=Object(n.get)("process.pid[0]",e),k=Object(n.get)("user.domain[0]",e),O=Object(n.get)("user.name[0]",e),w=Object(n.get)("winlog.event_id[0]",e);return r.a.createElement(l.b,null,r.a.createElement(H,{contextId:t,endgameLogonType:s,endgameSubjectDomainName:u,endgameSubjectLogonId:d,endgameSubjectUserName:p,endgameTargetDomainName:b,endgameTargetLogonId:m,endgameTargetUserName:g,eventAction:f,eventCode:y,eventOutcome:h,hostName:v,id:E,isDraggable:a,processExecutable:x,processName:j,processPid:S,userDomain:k,userName:O,winlogEventId:w}),r.a.createElement(o.EuiSpacer,{size:"s"}),r.a.createElement(c.a,{data:e,timelineId:i}))}));G.displayName="EndgameSecurityEventDetails";const Q=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.registry.viaDescription",{defaultMessage:"via"}),W=b.i18n.translate("xpack.securitySolution.timeline.body.renderers.registry.withNewValueDescription",{defaultMessage:"with new value"}),K=({contextId:e,hostName:t,id:a,isDraggable:n,processName:s,processPid:c,registryKey:p,registryPath:b,text:g,userDomain:f,userName:y})=>{const h=Object(i.useMemo)((()=>r.a.createElement(r.a.Fragment,null,r.a.createElement("div",null,"registry.key"),r.a.createElement("div",null,p))),[p]),v=Object(i.useMemo)((()=>r.a.createElement(r.a.Fragment,null,r.a.createElement("div",null,"registry.path"),r.a.createElement("div",null,b))),[b]);return Object(l.e)(p)?null:r.a.createElement(r.a.Fragment,null,r.a.createElement(o.EuiFlexGroup,{alignItems:"center",justifyContent:"center",gutterSize:"none",wrap:!0},r.a.createElement(m,{contextId:e,eventId:a,hostName:t,isDraggable:n,userDomain:f,userName:y,workingDirectory:void 0}),!Object(l.e)(p)&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{component:"span","data-test-subj":"text",grow:!1},g),r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:a,field:"registry.key",isDraggable:n,tooltipContent:h,value:p,isAggregatable:!0,fieldType:"keyword"}))),!Object(l.e)(b)&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{component:"span","data-test-subj":"with-new-value",grow:!1},W),r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(u.c,{contextId:e,eventId:a,field:"registry.path",isDraggable:n,tooltipContent:v,value:b,isAggregatable:!0,fieldType:"keyword"}))),r.a.createElement(l.c,{component:"span",grow:!1},Q),r.a.createElement(l.c,{component:"span",grow:!1},r.a.createElement(d.b,{contextId:e,endgamePid:void 0,endgameProcessName:void 0,eventId:a,isDraggable:n,processPid:c,processName:s,processExecutable:void 0}))))},Y=r.a.memo(K),J=({contextId:e,data:t,isDraggable:a,text:i})=>{const s=Object(n.get)("host.name[0]",t),o=t._id,c=Object(n.get)("process.name[0]",t),u=Object(n.get)("process.pid[0]",t),d=Object(n.get)("registry.key[0]",t),p=Object(n.get)("registry.path[0]",t),m=Object(n.get)("user.domain[0]",t),b=Object(n.get)("user.name[0]",t);return Object(l.e)(d)?null:r.a.createElement(l.b,null,r.a.createElement(Y,{contextId:e,hostName:s,id:o,isDraggable:a,processName:c,processPid:u,registryKey:d,registryPath:p,text:i,userDomain:m,userName:b}))};J.displayName="RegistryEventDetailsComponent";const X=r.a.memo(J);var Z=a(275),ee=a(331),te=a(203);const ae=r.a.memo((({contextId:e,eventId:t,isDraggable:a,packageName:n,packageSummary:i,packageVersion:s})=>null!=n||null!=i||null!=s?r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:t,field:"system.audit.package.name",isDraggable:a,value:n,iconType:"document",isAggregatable:!0,fieldType:"keyword"})),r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:t,field:"system.audit.package.version",isDraggable:a,value:s,iconType:"document",isAggregatable:!0,fieldType:"keyword"})),r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:t,field:"system.audit.package.summary",isDraggable:a,value:i,isAggregatable:!0,fieldType:"keyword"}))):null));ae.displayName="Package";const ne=r.a.memo((({contextId:e,eventId:t,isDraggable:a,sshSignature:n,sshMethod:i})=>r.a.createElement(r.a.Fragment,null,null!=n&&r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:t,field:"system.audit.package.name",isDraggable:a,value:n,iconType:"document",isAggregatable:!0,fieldType:"keyword"})),null!=i&&r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:t,field:"system.audit.package.version",isDraggable:a,value:i,iconType:"document",isAggregatable:!0,fieldType:"keyword"})))));ne.displayName="AuthSsh";var ie=a(168);const re=r.a.memo((({contextId:e,hostName:t,id:a,isDraggable:n,message:i,outcome:s,packageName:c,packageSummary:p,packageVersion:b,processPid:g,processName:f,processExecutable:y,sshSignature:h,sshMethod:v,text:E,userDomain:x,userName:j,workingDirectory:S})=>r.a.createElement(r.a.Fragment,null,r.a.createElement(o.EuiFlexGroup,{alignItems:"center",justifyContent:"center",gutterSize:"none",wrap:!0},r.a.createElement(m,{contextId:e,eventId:a,hostName:t,isDraggable:n,userDomain:x,userName:j,workingDirectory:S}),r.a.createElement(l.c,{grow:!1,component:"span"},E),r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(d.a,{contextId:e,endgamePid:void 0,endgameProcessName:void 0,eventId:a,isDraggable:n,processPid:g,processName:f,processExecutable:y})),null!=s&&r.a.createElement(l.c,{grow:!1,component:"span"},te.W),r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:a,field:"event.outcome",isDraggable:n,queryValue:s,value:s,isAggregatable:!0,fieldType:"keyword"})),r.a.createElement(ne,{contextId:e,eventId:a,isDraggable:n,sshSignature:h,sshMethod:v}),r.a.createElement(ae,{contextId:e,eventId:a,isDraggable:n,packageName:c,packageSummary:p,packageVersion:b})),null!=i&&r.a.createElement(r.a.Fragment,null,r.a.createElement(o.EuiSpacer,{size:"xs"}),r.a.createElement(o.EuiFlexGroup,{justifyContent:"center",gutterSize:"none",wrap:!0},r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(ie.b,{iconType:"editorComment",color:"hollow",title:""},r.a.createElement(ee.a,{value:i}))))))));re.displayName="SystemGenericLine";const se=r.a.memo((({contextId:e,data:t,isDraggable:a,text:i,timelineId:s})=>{const u=t._id,d=null!=t.message?t.message[0]:null,p=Object(n.get)("host.name[0]",t),m=Object(n.get)("user.domain[0]",t),b=Object(n.get)("user.name[0]",t),g=Object(n.get)("event.outcome[0]",t),f=Object(n.get)("system.audit.package.name[0]",t),y=Object(n.get)("system.audit.package.summary[0]",t),h=Object(n.get)("system.audit.package.version[0]",t),v=Object(n.get)("process.pid[0]",t),E=Object(n.get)("process.name[0]",t),x=Object(n.get)("process.executable[0]",t),j=Object(n.get)("system.auth.ssh.signature[0]",t),S=Object(n.get)("system.auth.ssh.method[0]",t),k=Object(n.get)("process.working_directory[0]",t);return r.a.createElement(l.b,null,r.a.createElement(re,{contextId:e,hostName:p,id:u,isDraggable:a,message:d,outcome:g,packageName:f,packageSummary:y,packageVersion:h,processExecutable:x,processPid:v,processName:E,sshMethod:S,sshSignature:j,text:i,userDomain:m,userName:b,workingDirectory:k}),r.a.createElement(o.EuiSpacer,{size:"s"}),r.a.createElement(c.a,{data:t,isDraggable:a,timelineId:s}))}));se.displayName="SystemGenericDetails";var oe=a(572);const le=r.a.memo((({contextId:e,endgameExitCode:t,eventId:a,isDraggable:n,processExitCode:i,text:s})=>Object(l.e)(i)&&Object(l.e)(t)?null:r.a.createElement(r.a.Fragment,null,!Object(l.e)(s)&&r.a.createElement(l.c,{"data-test-subj":"exit-code-draggable-text",grow:!1,component:"span"},s),!Object(l.e)(i)&&r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:a,field:"process.exit_code",isDraggable:n,value:`${i}`,fieldType:"number",isAggregatable:!0})),!Object(l.e)(t)&&r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:a,field:"endgame.exit_code",isDraggable:n,value:t,fieldType:"number",isAggregatable:!0})))));le.displayName="ExitCodeDraggable";var ce=a(392);const ue=r.a.memo((({contextId:e,endgameFileName:t,endgameFilePath:a,eventId:n,fileExtOriginalPath:i,fileName:s,filePath:o,isDraggable:c})=>{if(Object(l.e)(s)&&Object(l.e)(t)&&Object(l.e)(o)&&Object(l.e)(a))return null;const d=!Object(l.e)(o)||!Object(l.e)(a);return r.a.createElement(r.a.Fragment,null,Object(l.e)(s)?Object(l.e)(t)?null:r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:n,field:"endgame.file_name",isDraggable:c,value:t,iconType:"document",isAggregatable:!0,fieldType:"keyword"})):r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:n,field:"file.name",isDraggable:c,value:s,iconType:"document",isAggregatable:!0,fieldType:"keyword"})),d&&r.a.createElement(l.c,{"data-test-subj":"in",grow:!1,component:"span"},ce.e),Object(l.e)(o)?Object(l.e)(a)?null:r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:n,field:"endgame.file_path",isDraggable:c,value:a,iconType:"document",isAggregatable:!0,fieldType:"keyword"})):r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:n,field:"file.path",isDraggable:c,value:o,iconType:"document",isAggregatable:!0,fieldType:"keyword"})),!Object(l.e)(i)&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.c,{grow:!1,component:"span"},ce.d),r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:n,field:"file.Ext.original.path",isDraggable:c,value:i,iconType:"document",isAggregatable:!0,fieldType:"keyword"}))))}));ue.displayName="FileDraggable";var de=a(41),pe=a.n(de);const me=pe()(o.EuiFlexGroup).withConfig({displayName:"HashFlexGroup",componentId:"sc-ezi1kd-0"})(["margin:",";"],(({theme:e})=>e.eui.euiSizeXS)),be=r.a.memo((({contextId:e,eventId:t,fileHashSha256:a,isDraggable:n})=>Object(l.e)(a)?null:r.a.createElement(me,{alignItems:"center",direction:"column",gutterSize:"none"},r.a.createElement(l.c,{grow:!1,component:"div"},r.a.createElement(u.c,{contextId:e,eventId:t,field:"file.hash.sha256",isDraggable:n,iconType:"number",value:a,isAggregatable:!0,fieldType:"keyword"})))));be.displayName="FileHash";const ge=r.a.memo((({contextId:e,endgameParentProcessName:t,eventId:a,isDraggable:n,processParentName:i,processParentPid:s,processPpid:o,text:c})=>Object(l.e)(i)&&Object(l.e)(t)?null:r.a.createElement(r.a.Fragment,null,!Object(l.e)(c)&&r.a.createElement(l.c,{"data-test-subj":"parent-process-draggable-text",grow:!1,component:"span"},c),!Object(l.e)(i)&&r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:a,field:"process.parent.name",isDraggable:n,value:i,fieldType:"keyword",isAggregatable:!0})),!Object(l.e)(t)&&r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:a,field:"endgame.parent_process_name",isDraggable:n,value:t,fieldType:"keyword",isAggregatable:!0})),!Object(l.e)(s)&&r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:a,field:"process.parent.pid",isDraggable:n,queryValue:String(s),value:`(${String(s)})`,fieldType:"keyword",isAggregatable:!0})),!Object(l.e)(o)&&r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:e,eventId:a,field:"process.ppid",isDraggable:n,queryValue:String(o),value:`(${String(o)})`,fieldType:"keyword",isAggregatable:!0})))));ge.displayName="ParentProcessDraggable";const fe=pe()(o.EuiFlexGroup).withConfig({displayName:"HashFlexGroup",componentId:"sc-joyfnh-0"})(["margin:",";"],(({theme:e})=>e.eui.euiSizeXS)),ye=r.a.memo((({contextId:e,eventId:t,isDraggable:a,processHashSha256:n})=>Object(l.e)(n)?null:r.a.createElement(fe,{alignItems:"center",direction:"column",gutterSize:"none"},r.a.createElement(l.c,{grow:!1,component:"div"},r.a.createElement(u.c,{contextId:e,eventId:t,field:"process.hash.sha256",iconType:"number",isDraggable:a,value:n,fieldType:"keyword",isAggregatable:!0})))));ye.displayName="ProcessHash";const he=r.a.memo((({args:e,contextId:t,endgameExitCode:a,endgameFileName:n,endgameFilePath:i,endgameParentProcessName:s,endgamePid:c,endgameProcessName:p,eventAction:b,fileExtOriginalPath:g,fileHashSha256:f,fileName:y,filePath:h,hostName:v,id:E,isDraggable:x,message:j,outcome:S,packageName:k,processParentName:O,processParentPid:w,processExitCode:T,packageSummary:I,packageVersion:C,processExecutable:M,processHashSha256:_,processName:F,processPid:A,processPpid:D,processTitle:N,showMessage:P,skipRedundantFileDetails:R=!1,skipRedundantProcessDetails:L=!1,sshSignature:B,sshMethod:q,text:z,userDomain:$,userName:V,workingDirectory:U})=>r.a.createElement(r.a.Fragment,null,r.a.createElement(o.EuiFlexGroup,{alignItems:"center",justifyContent:"center",gutterSize:"none",wrap:!0},r.a.createElement(m,{eventId:E,contextId:t,isDraggable:x,userDomain:$,userName:V,workingDirectory:U,hostName:v}),r.a.createElement(l.c,{grow:!1,component:"span"},z),!R&&r.a.createElement(ue,{contextId:t,endgameFileName:n,endgameFilePath:i,eventId:E,fileExtOriginalPath:g,fileName:y,filePath:h,isDraggable:x}),Object(l.g)(b)&&r.a.createElement(l.c,{"data-test-subj":"via",grow:!1,component:"span"},te.L),r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(d.b,{contextId:t,endgamePid:c,endgameProcessName:p,eventId:E,isDraggable:x,processPid:A,processName:F,processExecutable:M})),r.a.createElement(oe.a,{args:e,contextId:t,eventId:E,processTitle:N,isDraggable:x}),r.a.createElement(le,{contextId:t,endgameExitCode:a,eventId:E,isDraggable:x,processExitCode:T,text:te.V}),!Object(l.f)(b)&&r.a.createElement(ge,{contextId:t,endgameParentProcessName:s,eventId:E,isDraggable:x,processParentName:O,processParentPid:w,processPpid:D,text:te.M}),null!=S&&r.a.createElement(l.c,{grow:!1,component:"span"},te.W),r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(u.c,{contextId:t,eventId:E,field:"event.outcome",isDraggable:x,queryValue:S,value:S,isAggregatable:!0,fieldType:"keyword"})),r.a.createElement(ne,{contextId:t,eventId:E,isDraggable:x,sshSignature:B,sshMethod:q}),r.a.createElement(ae,{contextId:t,eventId:E,isDraggable:x,packageName:k,packageSummary:I,packageVersion:C})),!R&&r.a.createElement(be,{contextId:t,eventId:E,fileHashSha256:f,isDraggable:x}),!L&&r.a.createElement(ye,{contextId:t,eventId:E,isDraggable:x,processHashSha256:_}),null!=j&&P&&r.a.createElement(r.a.Fragment,null,r.a.createElement(o.EuiSpacer,{size:"xs"}),r.a.createElement(o.EuiFlexGroup,{justifyContent:"center",gutterSize:"none",wrap:!0},r.a.createElement(l.c,{grow:!1,component:"span"},r.a.createElement(ie.b,{iconType:"editorComment",color:"hollow",title:""},r.a.createElement(ee.a,{value:j}))))))));he.displayName="SystemGenericFileLine";const ve=r.a.memo((({contextId:e,data:t,isDraggable:a,showMessage:i=!0,skipRedundantFileDetails:s=!1,skipRedundantProcessDetails:u=!1,text:d,timelineId:p})=>{const m=t._id,b=null!=t.message?t.message[0]:null,g=Object(n.get)("host.name[0]",t),f=Object(n.get)("endgame.exit_code[0]",t),y=Object(n.get)("endgame.file_name[0]",t),h=Object(n.get)("endgame.file_path[0]",t),v=Object(n.get)("endgame.parent_process_name[0]",t),E=Object(n.get)("endgame.pid[0]",t),x=Object(n.get)("endgame.process_name[0]",t),j=Object(n.get)("event.action[0]",t),S=Object(n.get)("file.Ext.original.path[0]",t),k=Object(n.get)("file.hash.sha256[0]",t),O=Object(n.get)("file.name[0]",t),w=Object(n.get)("file.path[0]",t),T=Object(n.get)("user.domain[0]",t),I=Object(n.get)("user.name[0]",t),C=Object(n.get)("event.outcome[0]",t),M=Object(n.get)("system.audit.package.name[0]",t),_=Object(n.get)("system.audit.package.summary[0]",t),F=Object(n.get)("system.audit.package.version[0]",t),A=Object(n.get)("process.exit_code[0]",t),D=Object(n.get)("process.parent.name[0]",t),N=Object(n.get)("process.parent.pid[0]",t),P=Object(n.get)("process.hash.sha256[0]",t),R=Object(n.get)("process.pid[0]",t),L=Object(n.get)("process.ppid[0]",t),B=Object(n.get)("process.name[0]",t),q=Object(n.get)("system.auth.ssh.signature[0]",t),z=Object(n.get)("system.auth.ssh.method[0]",t),$=Object(n.get)("process.executable[0]",t),V=Object(n.get)("process.title[0]",t),U=Object(n.get)("process.working_directory[0]",t),H=Object(n.get)("process.args",t);return r.a.createElement(l.b,null,r.a.createElement(he,{id:m,contextId:e,text:d,hostName:g,endgameExitCode:f,endgameFileName:y,endgameFilePath:h,endgameParentProcessName:v,endgamePid:E,endgameProcessName:x,eventAction:j,fileExtOriginalPath:S,fileHashSha256:k,fileName:O,filePath:w,userDomain:T,userName:I,message:b,processExitCode:A,processParentName:D,processParentPid:N,processTitle:V,workingDirectory:U,args:H,packageName:M,packageSummary:_,packageVersion:F,processHashSha256:P,processName:B,processPid:R,processPpid:L,processExecutable:$,showMessage:i,skipRedundantFileDetails:s,skipRedundantProcessDetails:u,sshSignature:q,sshMethod:z,outcome:C,isDraggable:a}),r.a.createElement(o.EuiSpacer,{size:"s"}),r.a.createElement(c.a,{data:t,isDraggable:a,timelineId:p}))}));ve.displayName="SystemGenericFileDetails";const Ee=({actionName:e,text:t})=>({id:s.d.system,isInstance:t=>{const a=Object(n.get)("event.module[0]",t),i=Object(n.get)("event.action[0]",t);return null!=a&&"system"===a.toLowerCase()&&null!=i&&i.toLowerCase()===e},renderRow:({data:a,isDraggable:n,scopeId:i})=>r.a.createElement(Z.a,null,r.a.createElement(se,{contextId:`${e}-${i}`,data:a,isDraggable:n,text:t,timelineId:i}))}),xe=({actionName:e,text:t})=>({id:s.d.system_file,isInstance:t=>{const a=Object(n.get)("event.action[0]",t),i=Object(n.get)("event.category[0]",t),r=Object(n.get)("event.dataset[0]",t);return("process"===(null==i?void 0:i.toLowerCase())||"endpoint.events.process"===(null==r?void 0:r.toLowerCase()))&&(null==a?void 0:a.toLowerCase())===e},renderRow:({data:a,isDraggable:n,scopeId:i})=>r.a.createElement(Z.a,null,r.a.createElement(ve,{data:a,contextId:`endgame-process-${e}-${i}`,isDraggable:n,showMessage:!1,text:t,timelineId:i}))}),je=({actionName:e,text:t})=>({id:s.d.system_fim,isInstance:t=>{const a=Object(n.get)("event.action[0]",t),i=Object(n.get)("event.category[0]",t),r=Object(n.get)("event.dataset[0]",t);return Object(l.d)({eventCategory:i,eventDataset:r})&&(null==a?void 0:a.toLowerCase())===e},renderRow:({data:a,isDraggable:n,scopeId:i})=>r.a.createElement(Z.a,null,r.a.createElement(ve,{data:a,contextId:`fim-${e}-${i}`,isDraggable:n,showMessage:!1,text:t,timelineId:i}))}),Se=({eventAction:e,eventCategory:t,eventType:a,skipRedundantFileDetails:i=!1,skipRedundantProcessDetails:o=!1,text:l})=>({id:s.d.alerts,isInstance:i=>{var r,s,o;const l=Object(n.get)("event.action",i),c=Object(n.get)("event.category",i),u=Object(n.get)("event.dataset[0]",i),d=Object(n.get)("event.type",i),p=null!==(r=null==l?void 0:l.includes(e))&&void 0!==r&&r,m=null!==(s=null==c?void 0:c.includes(t))&&void 0!==s&&s,b=null!==(o=null==d?void 0:d.includes(a))&&void 0!==o&&o;return"endpoint.alerts"===(null==u?void 0:u.toLowerCase())&&b&&m&&p},renderRow:({data:n,isDraggable:s,scopeId:c})=>r.a.createElement(Z.a,null,r.a.createElement(ve,{contextId:`endpoint-alerts-row-renderer-${e}-${t}-${a}-${c}`,data:n,isDraggable:s,showMessage:!1,skipRedundantFileDetails:i,skipRedundantProcessDetails:o,text:l,timelineId:c}))}),ke=({actionName:e,text:t})=>({id:s.d.library,isInstance:t=>{const a=Object(n.get)("event.action[0]",t),i=Object(n.get)("event.dataset[0]",t);return"endpoint.events.library"===(null==i?void 0:i.toLowerCase())&&(null==a?void 0:a.toLowerCase())===e},renderRow:({data:a,isDraggable:n,scopeId:i})=>r.a.createElement(Z.a,null,r.a.createElement(ve,{contextId:`library-row-renderer-${e}-${i}`,data:a,isDraggable:n,showMessage:!1,text:t,timelineId:i}))}),Oe=({actionName:e,text:t})=>({id:s.d.system_file,isInstance:t=>{const a=Object(n.get)("event.module[0]",t),i=Object(n.get)("event.action[0]",t);return null!=a&&"system"===a.toLowerCase()&&null!=i&&i.toLowerCase()===e},renderRow:({data:a,isDraggable:n,scopeId:i})=>r.a.createElement(Z.a,null,r.a.createElement(ve,{contextId:`${e}-${i}`,data:a,isDraggable:n,text:t,timelineId:i}))}),we=({actionName:e,text:t})=>({id:s.d.system_socket,isInstance:t=>{const a=Object(n.get)("event.action[0]",t);return null!=a&&a.toLowerCase()===e},renderRow:({data:a,isDraggable:n,scopeId:i})=>r.a.createElement(Z.a,null,r.a.createElement(ve,{contextId:`socket-${e}-${i}`,data:a,isDraggable:n,text:t,timelineId:i}))}),Te=({actionName:e})=>({id:s.d.system_security_event,isInstance:t=>{const a=Object(n.get)("event.category[0]",t),i=Object(n.get)("event.action[0]",t),r=Object(n.get)("event.dataset[0]",t);return("authentication"===(null==a?void 0:a.toLowerCase())||"endpoint.events.security"===(null==r?void 0:r.toLowerCase()))&&(null==i?void 0:i.toLowerCase())===e},renderRow:({data:t,isDraggable:a,scopeId:n})=>r.a.createElement(Z.a,null,r.a.createElement(G,{contextId:`authentication-${e}-${n}`,data:t,isDraggable:a,timelineId:n}))}),Ie=()=>({id:s.d.system_dns,isInstance:e=>{const t=Object(n.get)("dns.question.type[0]",e),a=Object(n.get)("dns.question.name[0]",e);return!Object(l.e)(t)&&!Object(l.e)(a)},renderRow:({data:e,isDraggable:t,scopeId:a})=>r.a.createElement(Z.a,null,r.a.createElement(x,{contextId:`dns-request-${a}`,data:e,isDraggable:t,timelineId:a}))}),Ce=({actionName:e,text:t})=>({id:s.d.registry,isInstance:t=>{const a=Object(n.get)("event.action[0]",t),i=Object(n.get)("event.dataset[0]",t);return"endpoint.events.registry"===(null==i?void 0:i.toLowerCase())&&(null==a?void 0:a.toLowerCase())===e},renderRow:({data:e,isDraggable:a,scopeId:n})=>r.a.createElement(Z.a,null,r.a.createElement(X,{contextId:`registry-event-${n}`,data:e,isDraggable:a,text:t}))}),Me=Ee({actionName:"user_login",text:te.c}),_e=Oe({actionName:"process_started",text:te.A}),Fe=xe({actionName:"creation_event",text:te.A}),Ae=xe({actionName:"start",text:te.A}),De=Ce({actionName:"modification",text:te.u}),Ne=Oe({actionName:"process_stopped",text:te.B}),Pe=xe({actionName:"termination_event",text:te.H}),Re=xe({actionName:"end",text:te.H}),Le=je({actionName:"file_create_event",text:te.e}),Be=je({actionName:"creation",text:te.e}),qe=je({actionName:"created",text:te.e}),ze=je({actionName:"file_delete_event",text:te.f}),$e=je({actionName:"deletion",text:te.f}),Ve=je({actionName:"modification",text:te.t}),Ue=je({actionName:"overwrite",text:te.v}),He=je({actionName:"rename",text:te.E}),Ge=je({actionName:"deleted",text:te.f}),Qe=Oe({actionName:"existing_process",text:te.k}),We=[{eventAction:"creation",eventCategory:"file",eventType:"denied",skipRedundantProcessDetails:!0,text:te.R},{eventAction:"creation",eventCategory:"file",eventType:"allowed",skipRedundantProcessDetails:!0,text:te.N},{eventAction:"files-encrypted",eventCategory:"file",eventType:"denied",skipRedundantFileDetails:!0,text:te.D},{eventAction:"files-encrypted",eventCategory:"file",eventType:"allowed",skipRedundantFileDetails:!0,text:te.C},{eventAction:"modification",eventCategory:"file",eventType:"denied",skipRedundantProcessDetails:!0,text:te.T},{eventAction:"modification",eventCategory:"file",eventType:"allowed",skipRedundantProcessDetails:!0,text:te.P},{eventAction:"rename",eventCategory:"file",eventType:"denied",skipRedundantProcessDetails:!0,text:te.U},{eventAction:"rename",eventCategory:"file",eventType:"allowed",skipRedundantProcessDetails:!0,text:te.Q},{eventAction:"execution",eventCategory:"process",eventType:"denied",skipRedundantFileDetails:!0,text:te.S},{eventAction:"execution",eventCategory:"process",eventType:"allowed",skipRedundantFileDetails:!0,text:te.O}].map((e=>Se(e))),Ke=ke({actionName:"load",text:te.q}),Ye=we({actionName:"socket_opened",text:te.G}),Je=we({actionName:"socket_closed",text:te.F}),Xe=we({actionName:"ipv4_connection_accept_event",text:te.b}),Ze=we({actionName:"connection_accepted",text:te.b}),et=we({actionName:"http_request",text:te.s}),tt=xe({actionName:"exec",text:te.i}),at=xe({actionName:"fork",text:te.n}),nt=we({actionName:"ipv6_connection_accept_event",text:te.b}),it=we({actionName:"ipv4_disconnect_received_event",text:te.g}),rt=we({actionName:"disconnect_received",text:te.g}),st=we({actionName:"ipv6_disconnect_received_event",text:te.g}),ot=Te({actionName:"admin_logon"}),lt=Te({actionName:"explicit_user_logon"}),ct=Te({actionName:"user_logoff"}),ut=Te({actionName:"user_logon"}),dt=Te({actionName:"log_on"}),pt=Ie(),mt=Ee({actionName:"existing_user",text:te.m}),bt=Oe({actionName:"existing_socket",text:te.l}),gt=Ee({actionName:"existing_package",text:te.j}),ft=Oe({actionName:"invalid",text:te.p}),yt=Ee({actionName:"user_changed",text:te.J}),ht=Ee({actionName:"host",text:te.o}),vt=Ee({actionName:"user_added",text:te.I}),Et=Ee({actionName:"user_logout",text:te.r}),xt=Te({actionName:"log_off"}),jt=Oe({actionName:"process_error",text:te.z}),St=Ee({actionName:"error:",text:te.h}),kt=Ee({actionName:"error",text:te.h}),Ot=Ee({actionName:"package_installed",text:te.w}),wt=Ee({actionName:"boot",text:te.d}),Tt=[pt,ot,lt,Le,Be,ze,$e,Ue,He,...We,Ke,Ve,De,Xe,Ze,et,tt,at,nt,it,rt,st,Fe,Ae,Pe,Re,ct,ut,dt,qe,Ge,Ee({actionName:"accepted",text:te.a}),wt,kt,St,gt,Qe,bt,mt,ht,ft,Me,Et,xt,Ot,Ee({actionName:"package_updated",text:te.y}),Ee({actionName:"package_removed",text:te.x}),jt,_e,Ne,Je,Ye,vt,yt,Ee({actionName:"user_removed",text:te.K})]},function(e,t,a){"use strict";a.d(t,"D",(function(){return o})),a.d(t,"I",(function(){return l})),a.d(t,"B",(function(){return c})),a.d(t,"w",(function(){return u})),a.d(t,"L",(function(){return d})),a.d(t,"n",(function(){return p})),a.d(t,"m",(function(){return m})),a.d(t,"J",(function(){return b})),a.d(t,"A",(function(){return g})),a.d(t,"z",(function(){return f})),a.d(t,"t",(function(){return y})),a.d(t,"x",(function(){return h})),a.d(t,"v",(function(){return v})),a.d(t,"G",(function(){return E})),a.d(t,"l",(function(){return x})),a.d(t,"P",(function(){return j})),a.d(t,"e",(function(){return S})),a.d(t,"c",(function(){return k})),a.d(t,"i",(function(){return w})),a.d(t,"p",(function(){return T})),a.d(t,"R",(function(){return I})),a.d(t,"k",(function(){return C})),a.d(t,"g",(function(){return M})),a.d(t,"F",(function(){return _})),a.d(t,"y",(function(){return F})),a.d(t,"C",(function(){return A})),a.d(t,"X",(function(){return D})),a.d(t,"Y",(function(){return N})),a.d(t,"s",(function(){return R})),a.d(t,"U",(function(){return L})),a.d(t,"V",(function(){return B})),a.d(t,"O",(function(){return q})),a.d(t,"N",(function(){return z})),a.d(t,"M",(function(){return $})),a.d(t,"r",(function(){return U})),a.d(t,"h",(function(){return H})),a.d(t,"W",(function(){return G})),a.d(t,"T",(function(){return Q})),a.d(t,"q",(function(){return K})),a.d(t,"j",(function(){return Y})),a.d(t,"b",(function(){return J})),a.d(t,"f",(function(){return Z})),a.d(t,"a",(function(){return ae})),a.d(t,"ab",(function(){return ne})),a.d(t,"S",(function(){return oe})),a.d(t,"d",(function(){return ve})),a.d(t,"Q",(function(){return Ee})),a.d(t,"o",(function(){return Oe})),a.d(t,"Z",(function(){return De})),a.d(t,"u",(function(){return Re})),a.d(t,"K",(function(){return Le})),a.d(t,"E",(function(){return Be})),a.d(t,"H",(function(){return qe})),a.d(t,"bb",(function(){return be}));var n=a(43),i=a(120),r=a(112),s=a(193);const o=r.r,l=n.string,c=r.k,u=r.k,d=r.y,p=n.boolean,m=n.boolean,b=n.array(n.string),g=n.object,f=n.string,y=n.array(n.string),h=n.array(n.string),v=n.array(r.k),E=n.array(n.string),x=n.string,j=n.string,S=n.string,k=n.string,O=n.string,w=i.y,T=s.u,I=n.array(s.v),C=n.array(n.string),M=n.string,_=n.string,F=n.array(n.unknown),A=n.string,D=n.string,N=n.boolean,P=n.exact(n.type({name:r.k,type:r.k,ecs:n.boolean})),R=n.array(P),L=n.string,B=n.string,q=n.union([n.literal("exactMatch"),n.literal("aliasMatch"),n.literal("conflict")]),z=n.string,$=n.union([n.literal("savedObjectConversion"),n.literal("savedObjectImport")]),V=n.exact(n.intersection([n.type({package:r.k,version:r.k}),n.partial({integration:r.k})])),U=n.array(V),H=n.string,G=n.string,Q=n.string;var W=a(4);const K=Object(r.i)({codec:n.string,minSize:1,maxSize:W.Kb}),Y=r.k;let J;!function(e){e.DoNotSuppress="doNotSuppress",e.Suppress="suppress"}(J||(J={}));const X=Object(r.u)("AlertSuppressionMissingFields",J),Z=J.Suppress,ee=Object(r.i)({codec:n.string,minSize:1,maxSize:3}),te=n.type({value:r.o,unit:n.keyof({s:null,m:null,h:null})}),ae=n.intersection([n.exact(n.type({group_by:ee})),n.exact(n.partial({duration:te,missing_fields_strategy:X}))]),ne=(n.intersection([n.exact(n.type({groupBy:ee})),n.exact(n.partial({duration:te,missingFieldsStrategy:X}))]),"platinum"),ie=n.exact(n.type({field:n.union([n.string,n.array(n.string)]),value:r.o})),re=n.exact(n.type({field:n.array(n.string),value:r.o})),se=n.exact(n.type({field:n.string,value:r.n})),oe=n.intersection([ie,n.exact(n.partial({cardinality:n.array(se)}))]);n.intersection([re,n.exact(n.partial({cardinality:n.array(se)}))]),n.intersection([re,n.exact(n.type({cardinality:n.array(se)}))]);var le=a(546),ce=a(238),ue=a(433);const de=e=>({...e,create:pe(e.required,e.optional,e.defaultable),patch:me(e.required,e.optional,e.defaultable),response:ge(e.required,e.optional,e.defaultable)}),pe=(e,t,a)=>n.intersection([n.exact(n.type(e)),n.exact(n.partial(t)),n.exact(n.partial(a))]),me=(e,t,a)=>n.intersection([n.partial(e),n.partial(t),n.partial(a)]),be=e=>Object.keys(e).reduce(((t,a)=>(t[a]=n.union([e[a],n[void 0]]),t)),{}),ge=(e,t,a)=>{const i=be(t);return n.intersection([n.exact(n.type(e)),n.exact(n.type(i)),n.exact(n.type(a))])},fe=de({required:{name:c,description:u,risk_score:s.d,severity:s.p},optional:{rule_name_override:A,timestamp_override:D,timestamp_override_fallback_disabled:N,timeline_id:L,timeline_title:B,outcome:q,alias_target_id:z,alias_purpose:$,license:f,note:x,building_block_type:S,output_index:k,namespace:O,meta:g,investigation_fields:v,throttle:s.l},defaultable:{version:d,tags:b,enabled:m,risk_score_mapping:s.e,severity_mapping:s.q,interval:s.m,from:s.n,to:s.o,actions:s.g,exceptions_list:w,author:y,false_positives:h,references:E,max_signals:T,threat:I}}),ye={id:o,rule_id:l,immutable:p,updated_at:ue.r,updated_by:ue.s,created_at:ue.e,created_by:ue.f,revision:ue.j,related_integrations:U,required_fields:R,setup:j},he={execution_summary:le.c},ve=fe.create,Ee=n.intersection([fe.create,n.exact(n.partial({rule_id:l}))]),xe=n.intersection([fe.create,n.exact(n.partial({rule_id:l})),n.exact(n.partial({id:o}))]),je=n.intersection([fe.patch,n.exact(n.partial({rule_id:l,id:o}))]),Se=n.intersection([fe.response,n.exact(n.type(ye)),n.exact(n.partial(he))]);let ke;!function(e){e.kuery="kuery",e.lucene="lucene",e.eql="eql"}(ke||(ke={}));const Oe=n.keyof({kuery:null,lucene:null}),we=n.literal("eql"),Te=de({required:{type:n.literal("eql"),language:we,query:_},optional:{index:C,data_view_id:M,filters:F,timestamp_field:G,event_category_override:H,tiebreaker_field:Q},defaultable:{}}),Ie=(n.intersection([Se,Te.response]),n.intersection([Ee,Te.create]),n.intersection([xe,Te.create]),n.intersection([je,Te.patch]),Te.patch,de({required:{type:n.literal("threat_match"),query:_,threat_query:s.C,threat_mapping:s.B,threat_index:s.y},optional:{index:C,data_view_id:M,filters:F,saved_id:ue.k,threat_filters:s.x,threat_indicator_path:s.z,threat_language:Oe,concurrent_searches:s.r,items_per_search:s.s},defaultable:{language:Oe}})),Ce=(n.intersection([Se,Ie.response]),n.intersection([Ee,Ie.create]),n.intersection([xe,Ie.create]),n.intersection([je,Ie.patch]),Ie.patch,de({required:{type:n.literal("query")},optional:{index:C,data_view_id:M,filters:F,saved_id:ue.k,response_actions:ce.b,alert_suppression:ae},defaultable:{query:_,language:Oe}})),Me=(n.intersection([Se,Ce.response]),n.intersection([Ee,Ce.create]),n.intersection([xe,Ce.create]),n.intersection([je,Ce.patch]),Ce.patch,de({required:{type:n.literal("saved_query"),saved_id:ue.k},optional:{index:C,data_view_id:M,query:_,filters:F,response_actions:ce.b,alert_suppression:ae},defaultable:{language:Oe}})),_e=(n.intersection([Se,Me.response]),n.intersection([Ee,Me.create]),n.intersection([xe,Me.create]),n.intersection([je,Me.patch]),Me.patch,de({required:{type:n.literal("threshold"),query:_,threshold:oe},optional:{index:C,data_view_id:M,filters:F,saved_id:ue.k},defaultable:{language:Oe}})),Fe=(n.intersection([Se,_e.response]),n.intersection([Ee,_e.create]),n.intersection([xe,_e.create]),n.intersection([je,_e.patch]),_e.patch,de({required:{type:n.literal("machine_learning"),anomaly_threshold:ue.c,machine_learning_job_id:s.t},optional:{},defaultable:{}})),Ae=(n.intersection([Se,Fe.response]),n.intersection([Ee,Fe.create]),n.intersection([xe,Fe.create]),n.intersection([je,Fe.patch]),Fe.patch,de({required:{type:n.literal("new_terms"),query:_,new_terms_fields:K,history_window_start:Y},optional:{index:C,data_view_id:M,filters:F},defaultable:{language:Oe}})),De=(n.intersection([Se,Ae.response]),n.intersection([Ee,Ae.create]),n.intersection([xe,Ae.create]),n.intersection([je,Ae.patch]),Ae.patch,n.union([Te.create,Ie.create,Ce.create,Me.create,_e.create,Fe.create,Ae.create])),Ne=n.union([Te.patch,Ie.patch,Ce.patch,Me.patch,_e.patch,Fe.patch,Ae.patch]),Pe=n.union([Te.response,Ie.response,Ce.response,Me.response,_e.response,Fe.response,Ae.response]),Re=n.intersection([De,Ee]),Le=n.intersection([De,xe]),Be=n.intersection([Ne,je]),qe=n.intersection([Se,Pe])},,function(e,t,a){"use strict";a.d(t,"h",(function(){return g})),a.d(t,"e",(function(){return f})),a.d(t,"b",(function(){return y})),a.d(t,"f",(function(){return v})),a.d(t,"i",(function(){return E})),a.d(t,"d",(function(){return x})),a.d(t,"c",(function(){return j})),a.d(t,"g",(function(){return S})),a.d(t,"a",(function(){return k}));var n=a(512),i=a(324),r=a(538),s=a(8),o=a(63),l=a(106),c=a(4),u=a(102),d=a(531);const p=e=>new d.c([e]),m=e=>Object(r.pipe)(l.i.decode(e),Object(n.fold)(Object(o.throwErrors)(p),i.identity)),b=async({timelineId:e,timeline:t,version:a})=>{let s=null,d=null;try{d=JSON.stringify({timeline:t,timelineId:e,version:a})}catch(e){return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(e)}`))}try{s=await u.b.get().http.patch(c.Gc,{method:"PATCH",body:d})}catch(e){return Promise.resolve((b=e.body,Object(r.pipe)(l.h.decode(b),Object(n.fold)(Object(o.throwErrors)(p),i.identity))))}var b;return m(s)},g=async({timelineId:e,timeline:t,version:a})=>{try{if(Object(s.isEmpty)(e)&&t.status===l.k.draft&&t){var n,i,r,o,d;const e=await h({timelineType:t.timelineType,templateTimelineId:null!==(n=t.templateTimelineId)&&void 0!==n?n:void 0,templateTimelineVersion:null!==(i=t.templateTimelineVersion)&&void 0!==i?i:void 0}),a=m(e),s=t.timelineType===l.l.template?{templateTimelineId:null!==(r=a.data.persistTimeline.timeline.templateTimelineId)&&void 0!==r?r:t.templateTimelineId,templateTimelineVersion:null!==(o=a.data.persistTimeline.timeline.templateTimelineVersion)&&void 0!==o?o:t.templateTimelineVersion}:{};return b({timelineId:a.data.persistTimeline.timeline.savedObjectId,timeline:{...t,...s},version:null!==(d=a.data.persistTimeline.timeline.version)&&void 0!==d?d:""})}return Object(s.isEmpty)(e)?(async({timeline:e})=>{let t;try{t=JSON.stringify({timeline:e})}catch(e){return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(e)}`))}const a=await u.b.get().http.post(c.Gc,{method:"POST",body:t});return m(a)})({timeline:t}):b({timelineId:null!=e?e:"-1",timeline:t,version:null!=a?a:""})}catch(e){return 403===e.status_code||403===e.body.status_code?Promise.resolve({data:{persistTimeline:{code:403,message:e.message||e.body.message,timeline:{...t,savedObjectId:"",version:""}}}}):Promise.resolve(e)}},f=async({fileToImport:e,signal:t})=>{const a=new FormData;return a.append("file",e),u.b.get().http.fetch(`${c.Dc}`,{method:"POST",headers:{"Content-Type":void 0},body:a,signal:t})},y=({filename:e="timelines_export.ndjson",ids:t=[],signal:a})=>{let n;try{n=t.length>0?JSON.stringify({ids:t}):void 0}catch(e){return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(e)}`))}return u.b.get().http.fetch(`${c.Bc}`,{method:"POST",body:n,query:{file_name:e},signal:a})},h=async({timelineType:e,templateTimelineId:t,templateTimelineVersion:a})=>{let n;const i=e===l.l.template?{templateTimelineId:t,templateTimelineVersion:a}:{};try{n=JSON.stringify({timelineType:e,...i})}catch(e){return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(e)}`))}const r=await u.b.get().http.post(c.Ac,{body:n});return m(r)},v=async()=>{return e=await u.b.get().http.post(c.Ec,{}),Object(r.pipe)(l.n.decode(e),Object(n.fold)(Object(o.throwErrors)(p),i.identity));var e},E=async e=>{return t=await u.b.get().http.get(c.Fc,{query:{id:e}}),Object(r.pipe)(l.c.decode(t),Object(n.fold)(Object(o.throwErrors)(p),i.identity));var t},x=async e=>{const t=await u.b.get().http.get(c.Gc,{query:{template_timeline_id:e}});return a=t,Object(r.pipe)(l.e.decode(a),Object(n.fold)(Object(o.throwErrors)(p),i.identity));var a},j=async(e,t)=>{var a,s,d,m,b,g;return f=await u.b.get().http.fetch(c.zc,{method:"GET",query:{...e.onlyUserFavorite?{only_user_favorite:e.onlyUserFavorite}:{},...null!=e&&null!==(a=e.pageInfo)&&void 0!==a&&a.pageSize?{page_size:e.pageInfo.pageSize}:{},...null!=e&&null!==(s=e.pageInfo)&&void 0!==s&&s.pageIndex?{page_index:e.pageInfo.pageIndex}:{},...e.search?{search:e.search}:{},...null!=e&&null!==(d=e.sort)&&void 0!==d&&d.sortField?{sort_field:null==e||null===(m=e.sort)||void 0===m?void 0:m.sortField}:{},...null!=e&&null!==(b=e.sort)&&void 0!==b&&b.sortOrder?{sort_order:null==e||null===(g=e.sort)||void 0===g?void 0:g.sortOrder}:{},...e.status?{status:e.status}:{},...e.timelineType?{timeline_type:e.timelineType}:{}},signal:t}),Object(r.pipe)(l.m.decode(f),Object(n.fold)(Object(o.throwErrors)(p),i.identity));var f},S=async({timelineId:e,templateTimelineId:t,templateTimelineVersion:a,timelineType:s})=>{let d;try{d=JSON.stringify({timelineId:e,templateTimelineId:t,templateTimelineVersion:a,timelineType:s})}catch(e){return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(e)}`))}return m=await u.b.get().http.patch(c.Cc,{method:"PATCH",body:d}),Object(r.pipe)(l.o.decode(m),Object(n.fold)(Object(o.throwErrors)(p),i.identity));var m},k=async e=>{let t;try{t=JSON.stringify({savedObjectIds:e})}catch(e){return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(e)}`))}return await u.b.get().http.delete(c.Gc,{method:"DELETE",body:t})}},function(e,t,a){"use strict";a.d(t,"q",(function(){return r})),a.d(t,"o",(function(){return s})),a.d(t,"p",(function(){return o})),a.d(t,"g",(function(){return c})),a.d(t,"f",(function(){return u})),a.d(t,"b",(function(){return g})),a.d(t,"a",(function(){return f})),a.d(t,"h",(function(){return S})),a.d(t,"i",(function(){return k})),a.d(t,"m",(function(){return j})),a.d(t,"n",(function(){return O})),a.d(t,"c",(function(){return I})),a.d(t,"k",(function(){return C})),a.d(t,"l",(function(){return M})),a.d(t,"d",(function(){return _})),a.d(t,"e",(function(){return F})),a.d(t,"j",(function(){return D}));var n=a(5),i=a(120);const r={message:n.i18n.translate("lists.exceptions.isOperatorLabel",{defaultMessage:"is"}),operator:i.c.INCLUDED,type:i.d.MATCH,value:"is"},s={message:n.i18n.translate("lists.exceptions.isNotOperatorLabel",{defaultMessage:"is not"}),operator:i.c.EXCLUDED,type:i.d.MATCH,value:"is_not"},o={message:n.i18n.translate("lists.exceptions.isOneOfOperatorLabel",{defaultMessage:"is one of"}),operator:i.c.INCLUDED,type:i.d.MATCH_ANY,value:"is_one_of"},l={message:n.i18n.translate("lists.exceptions.isNotOneOfOperatorLabel",{defaultMessage:"is not one of"}),operator:i.c.EXCLUDED,type:i.d.MATCH_ANY,value:"is_not_one_of"},c={message:n.i18n.translate("lists.exceptions.existsOperatorLabel",{defaultMessage:"exists"}),operator:i.c.INCLUDED,type:i.d.EXISTS,value:"exists"},u={message:n.i18n.translate("lists.exceptions.doesNotExistOperatorLabel",{defaultMessage:"does not exist"}),operator:i.c.EXCLUDED,type:i.d.EXISTS,value:"does_not_exist"},d={message:n.i18n.translate("lists.exceptions.isInListOperatorLabel",{defaultMessage:"is in list"}),operator:i.c.INCLUDED,type:i.d.LIST,value:"is_in_list"},p={message:n.i18n.translate("lists.exceptions.isNotInListOperatorLabel",{defaultMessage:"is not in list"}),operator:i.c.EXCLUDED,type:i.d.LIST,value:"is_not_in_list"},m={message:n.i18n.translate("lists.exceptions.matchesOperatorLabel",{defaultMessage:"matches"}),operator:i.c.INCLUDED,type:i.d.WILDCARD,value:"matches"},b={message:n.i18n.translate("lists.exceptions.doesNotMatchOperatorLabel",{defaultMessage:"does not match"}),operator:i.c.EXCLUDED,type:i.d.WILDCARD,value:"does_not_match"},g=[r,s,o,l,m],f=[r,s,o,l,c,u,d,p,m,b];var y=a(163);const h=y.r,v=y.s;var E=a(8),x=a(42);const j=({namespaceType:e})=>e.map((e=>(({namespaceType:e})=>"agnostic"===e?v:h)({namespaceType:e}))),S=({filters:e,namespaceTypes:t,hideLists:a})=>{const n=j({namespaceType:t}),i=((e,t)=>Object.keys(e).map((a=>{const n=Object(x.get)(a,e);return Object(E.isArray)(n)||null!=n&&""!==n.trim()?`(${t.map((e=>{const t="name"===a?"name.text":"types"===a?"type":a;return Object(E.isArray)(n)?n.map((a=>`${e}.attributes.${t}:${a}`)).join(" OR "):`${e}.attributes.${t}:${n}`})).join(" OR ")})`:null})).filter((e=>null!=e)).join(" AND "))(e,n);return[i,...a.map((e=>`(${n.map((t=>`not ${t}.attributes.list_id: ${e}*`)).join(" AND ")})`))].filter((e=>""!==e.trim())).join(" AND ")},k=({lists:e,showDetection:t,showEndpoint:a})=>e.filter((e=>t?"detection"===e.type:!a||"endpoint"===e.type)).reduce(((e,{listId:t,namespaceType:a})=>({ids:[...e.ids,t],namespaces:[...e.namespaces,a]})),{ids:[],namespaces:[]}),O=e=>e.filter((({type:e})=>"list"===e)).length>0;var w=a(47),T=a(174);a(421),a(49),a(374);const I=e=>e.map((e=>"nested"===e.type?Object(T.d)({...e,entries:e.entries.map((e=>Object(T.d)(e)))}):Object(T.d)(e))),C=({listId:e,namespaceType:t,name:a})=>({comments:[],description:"Exception list item",entries:I([{field:"",operator:"included",type:"match",value:""}]),item_id:void 0,list_id:e,meta:{temporaryUuid:Object(w.v4)()},name:a,namespace_type:t,tags:[],type:"simple"}),M=e=>{switch(e.type){case"match":return i.d.MATCH;case"match_any":return i.d.MATCH_ANY;case"wildcard":return i.d.WILDCARD;case"list":return i.d.LIST;default:return i.d.EXISTS}},_=e=>{const t=(new Date).toISOString();return e.map((e=>`${e}.attributes.expire_time > "${t}" OR NOT ${e}.attributes.expire_time: *`)).join(",")},F=e=>{const t=(new Date).toISOString();return e.map((e=>`${e}.attributes.expire_time <= "${t}"`)).join(",")},A=e=>{let t=e.match(/.ds-(.*?)-[0-9]{4}\.[0-9]{2}\.[0-9]{2}-[0-9]{6}/);return t&&2===t.length?t[1]:(t=e.match(/.siem-(.*?)-[0-9]{6}/),t&&2===t.length?`.siem-${t[1]}`:e)},D=e=>{if(!e.conflictDescriptions)return null;const t=[];for(const[a,n]of Object.entries(e.conflictDescriptions)){const e=[],i={};n.forEach((e=>{const t=A(e);i[t]||(i[t]=0),i[t]++}));for(const[t,a]of Object.entries(i))e.push({name:t,count:a});e.sort(((e,t)=>t.count-e.count)),t.push({type:a,totalIndexCount:n.length,groupedIndices:e})}return t}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"c",(function(){return s})),a.d(t,"b",(function(){return o})),a.d(t,"e",(function(){return l})),a.d(t,"h",(function(){return c})),a.d(t,"d",(function(){return u})),a.d(t,"f",(function(){return d})),a.d(t,"g",(function(){return p}));var n=a(4);const i="histogram-actions-trigger",r={[n.wc.hosts]:"host",[n.wc.users]:"user"},s=(e,t)=>{const a=r[e];return a&&t?[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:`${a}.name`,params:{query:t}},query:{match_phrase:{[`${a}.name`]:t}}}]:[]},o=e=>{const t=r[e];return t&&e?[{query:{bool:{should:[{exists:{field:`${t}.name`}}],minimum_should_match:1}},meta:{alias:"",disabled:!1,key:"bool",negate:!1,type:"custom",value:`{"query": {"bool": {"filter": [{"bool": {"should": [{"exists": {"field": "${t}.name"}}],"minimum_should_match": 1}}]}}}`}}]:[]},l=e=>e?[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:"source.ip",params:{query:e}},query:{bool:{should:[{match_phrase:{"source.ip":e}},{match_phrase:{"destination.ip":e}}],minimum_should_match:1}}}]:[],c=[{query:{bool:{should:[{exists:{field:"source.ip"}},{exists:{field:"destination.ip"}}],minimum_should_match:1}},meta:{alias:"",disabled:!1,key:"bool",negate:!1,type:"custom",value:'{"bool":{"filter":[{"bool":{"should":[{"bool":{"should":[{"exists":{"field": "source.ip"}}],"minimum_should_match":1}},{"bool":{"should":[{"exists":{"field": "destination.ip"}}],"minimum_should_match":1}}],"minimum_should_match":1}}]}}'}}],u=e=>e.length>=1?[{meta:{type:"phrases",key:"_index",params:e,alias:null,negate:!1,disabled:!1},query:{bool:{should:e.map((e=>({match_phrase:{_index:e}}))),minimum_should_match:1}}}]:[],d=e=>(null!=e?e:[]).reduce(((e,t)=>{var a,n,i,r,s,o;return{requests:[...e.requests,JSON.stringify({body:null==t?void 0:t.json,index:(null!==(a=null==t||null===(n=t.stats)||void 0===n||null===(i=n.indexFilter)||void 0===i?void 0:i.value)&&void 0!==a?a:"").split(",")},null,2)],responses:[...e.responses,JSON.stringify(null!==(r=null==t||null===(s=t.response)||void 0===s||null===(o=s.json)||void 0===o?void 0:o.rawResponse)&&void 0!==r?r:{},null,2)]}}),{requests:[],responses:[]}),p=e=>e.reduce(((e,t)=>{try{return[...e,JSON.parse(t)]}catch(t){return e}}),[])},function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return g}));var n=a(2),i=a.n(n),r=a(40),s=a(41),o=a.n(s),l=a(48),c=a(637),u=a(113),d=a(499);const p={[u.y.unknown]:l.euiLightVars.euiColorMediumShade,[u.y.low]:d.b.low,[u.y.moderate]:d.b.medium,[u.y.high]:d.b.high,[u.y.critical]:d.b.critical},m=o.a.div.withConfig({displayName:"RiskBadge",componentId:"sc-1t9tm5r-0"})(["",""],(({theme:e,$severity:t,$hideBackgroundColor:a})=>Object(s.css)(["width:fit-content;padding-right:",";padding-left:",";",";"],e.eui.euiSizeS,e.eui.euiSizeXS,("Critical"===t||"High"===t)&&!a&&Object(s.css)(["background-color:",";border-radius:999px;"],Object(r.transparentize)(e.eui.euiColorDanger,.2))))),b=o.a.div.withConfig({displayName:"TooltipContainer",componentId:"sc-1t9tm5r-1"})(["padding:",";"],(({theme:e})=>e.eui.euiSizeS)),g=({severity:e,hideBackgroundColor:t=!1,toolTipContent:a})=>{const n=i.a.createElement(m,{color:l.euiLightVars.euiColorDanger,$severity:e,$hideBackgroundColor:t,"data-test-subj":"risk-score"},i.a.createElement(r.EuiHealth,{className:"eui-alignMiddle",color:p[e]},e));return null!=a?i.a.createElement(c.a,{hoverContent:i.a.createElement(b,null,a),render:()=>n}):n}},function(e,t,a){"use strict";let n,i,r;a.d(t,"c",(function(){return n})),a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r})),function(e){e.defineRule="define-rule",e.aboutRule="about-rule",e.scheduleRule="schedule-rule",e.ruleActions="rule-actions"}(n||(n={})),function(e){e.IndexPatterns="indexPatterns",e.DataView="dataView"}(i||(i={})),function(e){e.PerRuleExecution="per-rule-execution",e.PerTimePeriod="per-time-period"}(r||(r={}))},function(e,t,a){"use strict";a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return o})),a.d(t,"c",(function(){return p})),a.d(t,"d",(function(){return g})),a.d(t,"e",(function(){return y})),a.d(t,"f",(function(){return v})),a.d(t,"g",(function(){return j})),a.d(t,"h",(function(){return k})),a.d(t,"i",(function(){return w})),a.d(t,"j",(function(){return I})),a.d(t,"k",(function(){return M})),a.d(t,"l",(function(){return F}));var n=a(324),i=a(174);const r=e=>Object(n.flow)(s)(e),s=e=>{const t=e.entries.map((e=>"nested"===e.type?Object(i.d)({...e,entries:e.entries.map((e=>Object(i.d)(e)))}):Object(i.d)(e)));return{...e,entries:t}},o=e=>{const{entries:t}=e,a=t.map((e=>"nested"===e.type?Object(i.g)({...e,entries:e.entries.map((e=>Object(i.g)(e)))}):Object(i.g)(e)));return{...e,entries:a}},l=e=>{const{comments:t}=e;if(!t||!t.length)return e;const a=t.map((({comment:e,id:t})=>({comment:e,id:t})));return{...e,comments:a}};var c=a(2),u=a(156),d=a(210);const p=e=>Object(c.useMemo)((()=>({async addExceptionListItem({listItem:t}){const a=new AbortController,i=(r=t,Object(n.flow)(o)(r));var r;return u.b({http:e,listItem:i,signal:a.signal})},async deleteExceptionItem({id:t,namespaceType:a,onSuccess:n,onError:i}){const r=new AbortController;try{await u.e({http:e,id:t,namespaceType:a,signal:r.signal}),n()}catch(e){i(e)}},async deleteExceptionList({id:t,namespaceType:a,onSuccess:n,onError:i}){const r=new AbortController;try{await u.d({http:e,id:t,namespaceType:a,signal:r.signal}),n()}catch(e){i(e)}},async duplicateExceptionList({includeExpiredExceptions:t,listId:a,namespaceType:n,onError:i,onSuccess:r}){const s=new AbortController;try{r(await u.g({http:e,includeExpiredExceptions:t,listId:a,namespaceType:n,signal:s.signal}))}catch(e){i(e)}},async exportExceptionList({id:t,includeExpiredExceptions:a,listId:n,namespaceType:i,onError:r,onSuccess:s}){const o=new AbortController;try{s(await u.h({http:e,id:t,includeExpiredExceptions:a,listId:n,namespaceType:i,signal:o.signal}))}catch(e){r(e)}},async getExceptionItem({id:t,namespaceType:a,onSuccess:n,onError:i}){const s=new AbortController;try{n(r(await u.k({http:e,id:t,namespaceType:a,signal:s.signal})))}catch(e){i(e)}},async getExceptionList({id:t,namespaceType:a,onSuccess:n,onError:i}){const r=new AbortController;try{n(await u.j({http:e,id:t,namespaceType:a,signal:r.signal}))}catch(e){i(e)}},async getExceptionListsItems({lists:t,filter:a,pagination:n,showDetectionsListsOnly:i,showEndpointListsOnly:s,onSuccess:o,onError:l}){const c=new AbortController,{ids:p,namespaces:m}=Object(d.i)({lists:t,showDetection:i,showEndpoint:s});try{if(p.length>0&&m.length>0){const{data:t,page:i,per_page:s,total:l}=await u.m({filter:a,http:e,listIds:p,namespaceTypes:m,pagination:n,signal:c.signal});o({exceptions:t.map((e=>r(e))),pagination:{page:i,perPage:s,total:l}})}else o({exceptions:[],pagination:{page:0,perPage:null!=n.perPage?n.perPage:0,total:0}})}catch(e){l(e)}},async getExceptionFilterFromIds({exceptionListIds:t,chunkSize:a,alias:n,excludeExceptions:i,onSuccess:r,onError:s}){const o=new AbortController;try{const{filter:s}=await u.p({http:e,exceptionListIds:t,signal:o.signal,chunkSize:a,alias:n,excludeExceptions:i});r(s)}catch(e){s(e)}},async getExceptionFilterFromExceptions({exceptions:t,chunkSize:a,alias:n,excludeExceptions:i,onSuccess:r,onError:s}){const o=new AbortController;try{const{filter:s}=await u.q({http:e,exceptions:t,signal:o.signal,chunkSize:a,alias:n,excludeExceptions:i});r(s)}catch(e){s(e)}},async updateExceptionListItem({listItem:t}){const a=new AbortController,i=(r=t,Object(n.flow)(l,o)(r));var r;return u.v({http:e,listItem:i,signal:a.signal})}})),[e]);var m=a(141);const b=Object(m.d)(u.c),g=()=>Object(m.a)(b),f=e=>JSON.stringify(e),y=({pageIndex:e,pageSize:t})=>{const[a,n]=Object(c.useState)({}),i=Object(c.useCallback)((i=>{n({...a,[f({pageIndex:e+1,pageSize:t})]:i})}),[e,t]);let r;for(let n=e;n>=0&&(r=a[f({pageIndex:n,pageSize:t})],!r);n--);return[r,i]},h=Object(m.d)(u.f),v=()=>Object(m.a)(h),E={page:1,perPage:20,total:0},x={field:"created_at",order:"desc"},j=({errorMessage:e,http:t,initialPagination:a=E,filterOptions:n={},namespaceTypes:i,notifications:r,hideLists:s=[],initialSort:o=x})=>{const[l,p]=Object(c.useState)([]),[m,b]=Object(c.useState)(a),[g,f]=Object(c.useState)(o),[y,h]=Object(c.useState)(!0),v=Object(c.useRef)(),j=Object(c.useMemo)((()=>i.join(",")),[i]),S=Object(c.useMemo)((()=>Object(d.h)({filters:n,namespaceTypes:i,hideLists:s})),[i,n,s]),k=Object(c.useCallback)((async()=>{try{h(!0),v.current=new AbortController;const{page:e,per_page:a,total:n,data:i}=await Object(u.l)({filters:S,http:t,namespaceTypes:j,pagination:{page:m.page,perPage:m.perPage},sort:g,signal:v.current.signal});b({page:e,perPage:a,total:n}),p(i),h(!1)}catch(t){"AbortError"!==t.name&&(r.toasts.addError(t,{title:e}),p([]),b(E),h(!1))}}),[e,S,t,j,r.toasts,m.page,m.perPage,g]);return Object(c.useEffect)((()=>(k(),()=>{var e;null===(e=v.current)||void 0===e||e.abort()})),[k]),[y,l,m,b,k,g,f]},S=(Object(m.d)(u.i),Object(m.d)(u.n)),k=()=>Object(m.a)(S),O=Object(m.d)(u.o),w=()=>Object(m.a)(O),T=Object(m.d)(u.r),I=()=>Object(m.a)(T),C=Object(m.d)(u.s),M=()=>Object(m.a)(C),_=Object(m.d)(u.t),F=()=>Object(m.a)(_)},function(e,t,a){"use strict";a.d(t,"z",(function(){return r})),a.d(t,"A",(function(){return s})),a.d(t,"B",(function(){return o})),a.d(t,"u",(function(){return l})),a.d(t,"q",(function(){return u})),a.d(t,"p",(function(){return d})),a.d(t,"t",(function(){return p})),a.d(t,"g",(function(){return m})),a.d(t,"v",(function(){return b})),a.d(t,"f",(function(){return g})),a.d(t,"r",(function(){return f})),a.d(t,"x",(function(){return y})),a.d(t,"o",(function(){return h})),a.d(t,"s",(function(){return v})),a.d(t,"w",(function(){return E})),a.d(t,"n",(function(){return x})),a.d(t,"m",(function(){return j})),a.d(t,"y",(function(){return S})),a.d(t,"e",(function(){return k})),a.d(t,"c",(function(){return O})),a.d(t,"b",(function(){return w})),a.d(t,"a",(function(){return T})),a.d(t,"d",(function(){return I})),a.d(t,"i",(function(){return C})),a.d(t,"h",(function(){return M})),a.d(t,"j",(function(){return _})),a.d(t,"k",(function(){return F})),a.d(t,"l",(function(){return A}));var n=a(65),i=a(185);const r="logs-endpoint.events.*",s="metrics-endpoint.metadata_current_*",o="endpoint.metadata_current-default",l=".metrics-endpoint.metadata_united_default",c=(Object(n.getFileMetadataIndexName)("endpoint"),Object(n.getFileDataIndexName)("endpoint"),"/api/endpoint"),u=`${c}/metadata`,d=`${u}/{id}`,p=`${c}/metadata/transforms`,m=`${c}/policy_response`,b=`${c}/suggestions/{suggestion_type}`,g=`${c}/action`,f=`${g}/isolate`,y=`${g}/unisolate`,h=`${g}/running_procs`,v=`${g}/kill_process`,E=`${g}/suspend_process`,x=`${g}/get_file`,j=`${g}/execute`,S=`${g}/upload`,k=`${c}/action_status`,O=`${g}/{action_id}`,w=`${g}/{action_id}/file/{file_id}`,T=`${g}/{action_id}/file/{file_id}/download`,I=`${g}/state`,C=i.a.ENROLLED_AT,M="desc",_={ES_CONNECTION_ERROR:-272,OUTPUT_SERVER_ERROR:-273},F="endpointFields",A="endpointSearchStrategy"},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(42);const i=e=>Object(n.isString)(e)?e:JSON.stringify(e)},function(e,t,a){"use strict";a.d(t,"g",(function(){return o})),a.d(t,"c",(function(){return l})),a.d(t,"d",(function(){return c})),a.d(t,"a",(function(){return u})),a.d(t,"f",(function(){return p})),a.d(t,"b",(function(){return m})),a.d(t,"e",(function(){return g}));var n=a(42),i=a(59),r=a(155),s=a(188);const o={box:{incremental:!0,placeholder:r.w,schema:!0,"data-test-subj":"search-input"}},l=e=>Object(n.isEmpty)(e)?"":`Example: ${e}`,c=e=>{switch(e){case"string":case"keyword":return"string";case"number":case"long":case"float":return"number";case"date":return"clock";case"ip":case"geo_point":return"globe";default:return"questionInCircle"}},u="event-fields-table",d=e=>Object(i.elementOrChildrenHasFocus)(null==e?void 0:e.querySelector(`.${u}`)),p=({containerElement:e,keyboardEvent:t,onSkipFocusBeforeEventsTable:a,onSkipFocusAfterEventsTable:n})=>{const{shiftKey:r}=t,s=Object(i.getTableSkipFocus)({containerElement:e,getFocusedCell:i.getFocusedDataColindexCell,shiftKey:r,tableHasFocus:d,tableClassName:u});"SKIP_FOCUS_NOOP"!==s&&(Object(i.stopPropagationAndPreventDefault)(t),Object(i.handleSkipFocus)({onSkipFocusBackwards:a,onSkipFocusForward:n,skipFocus:s}))};function m({browserFields:e,contextId:t,eventId:a,field:i,item:r,linkValueField:s,scopeId:o}){var l,c,u,d;const p={contextId:t,eventId:a,fieldType:"string",linkValue:void 0,scopeId:o},m=Object(n.getOr)(null,"originalValue.0",s),b=null!==(l=r.category)&&void 0!==l?l:"",g=null!==(c=r.field)&&void 0!==c?c:"",f=Object(n.get)([b,"fields",g],e),y=null==i?void 0:i.overrideField;return{...p,data:{field:null!=y?y:g,format:null!==(u=null==f?void 0:f.format)&&void 0!==u?u:"",type:null!==(d=null==f?void 0:f.type)&&void 0!==d?d:"",isObjectArray:r.isObjectArray},values:r.values,linkValue:null!=m?m:void 0,fieldFromBrowserField:f}}const b={[s.a]:!0,[s.j]:!0};function g(e){return!b[e]}},function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return o}));var n=a(42),i=a(2),r=a.n(i);function s(e){var t;const a=t=>{const{deleteQuery:a,id:i,inspect:s=null,loading:l,refetch:c,setQuery:u,session:d}=t;o({deleteQuery:a,inspect:s,loading:l,queryId:i,refetch:c,session:d,setQuery:u});const p=Object(n.omit)(["refetch","setQuery"],t);return r.a.createElement(e,p)};return a.displayName=`ManageQuery (${null!==(t=null==e?void 0:e.displayName)&&void 0!==t?t:"Unknown"})`,a}const o=({setQuery:e,deleteQuery:t,refetch:a,inspect:n,loading:r,queryId:s,session:o})=>{Object(i.useEffect)((()=>{e({id:s,inspect:null!=n?n:null,loading:r,refetch:a,searchSessionId:null==o?void 0:o.current.start()})}),[t,e,s,a,n,r,o]),Object(i.useEffect)((()=>()=>{t&&t({id:s})}),[t,s])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(2),i=a(45),r=a(130),s=a.n(r),o=a(8),l=a(175);const c=Object(n.memo)((({location:{pathname:e,search:t},history:a,match:{params:{detailName:i,tabName:r,flowTarget:c}},pageName:u,state:d})=>{const[p,m]=Object(n.useState)(!0),[b,g]=Object(l.a)();return Object(n.useEffect)((()=>{p&&""!==t?(g({type:"updateSearch",search:t}),m(!1)):""!==t&&t!==b.search&&g({type:"updateSearch",search:t})}),[t]),Object(n.useEffect)((()=>{if(!u||b.pathName===e&&s()(d,b.state))return;const n={detailName:i,flowTarget:c,history:a,pageName:u,pathName:e,search:t,state:d,tabName:r};if(p&&null==i)return g({type:"updateRouteWithOutSearch",route:Object(o.omit)(n,"search")}),void m(!1);g({type:"updateRoute",route:n})}),[e,t,u,i,r,c,d]),null}));c.displayName="SpyRouteComponent";const u=Object(i.withRouter)(c)},function(e,t,a){"use strict";a.d(t,"d",(function(){return n.a})),a.d(t,"c",(function(){return Mt})),a.d(t,"a",(function(){return Tt})),a.d(t,"f",(function(){return Nt})),a.d(t,"g",(function(){return Lt})),a.d(t,"j",(function(){return Ft})),a.d(t,"i",(function(){return F.a})),a.d(t,"b",(function(){return le})),a.d(t,"e",(function(){return I.c})),a.d(t,"h",(function(){return I.d}));var n=a(136),i=a(2),r=a.n(i),s=a(40),o=a(447),l=a.n(o),c=a(41),u=a.n(c),d=a(64),p=a(21),m=a(66),b=a(355),g=a(777);var f=a(306),y=a(356),h=a(305);const v=({allowSet:e,allowReplacementSet:t,currentReplacements:a,field:n,getAnonymizedValue:i,rawData:r})=>{var s;return(null!==(s=r[n])&&void 0!==s?s:[]).reduce(((r,s)=>{if(Object(h.b)({allowSet:e,field:n})&&Object(h.c)({allowReplacementSet:t,field:n})){const e=i({currentReplacements:a,rawValue:s});return{anonymizedValues:[...r.anonymizedValues,e],replacements:{...r.replacements,[e]:s}}}return Object(h.b)({allowSet:e,field:n})?{anonymizedValues:[...r.anonymizedValues,s],replacements:{...r.replacements}}:r}),{anonymizedValues:[],replacements:{}})};var E=a(42),x=a(47);const j=({currentReplacements:e,rawValue:t})=>{if(null!=e){const a=Object(E.invert)(e)[t];return null!=a?a:Object(x.v4)()}return Object(x.v4)()};var S=a(5);const k=S.i18n.translate("xpack.elasticAssistant.securityAssistant.content.prompts.welcome.welcomeGeneralPrompt",{defaultMessage:"Welcome to your Elastic AI Assistant! I am your 100% open-code portal into your Elastic life. In time, I will be able to answer questions and provide assistance across all your information in Elastic, and oh-so much more. Till then, I hope this early preview will open your mind to the possibilities of what we can create when we work together, in the open. Cheers!"}),O=S.i18n.translate("xpack.elasticAssistant.securityAssistant.content.prompts.welcome.welcomeGeneral2Prompt",{defaultMessage:"First things first, we'll need to set up a Generative AI Connector to get this chat experience going! With the Generative AI Connector, you'll be able to configure access to either an Azure OpenAI Service or OpenAI API account, but you better believe you'll be able to deploy your own models within your Elastic Cloud instance and use those here in the future... 😉"}),w=S.i18n.translate("xpack.elasticAssistant.securityAssistant.content.prompts.welcome.welcomeGeneral3Prompt",{defaultMessage:"Go ahead and click the add connector button below to continue the conversation!"}),T=S.i18n.translate("xpack.elasticAssistant.securityAssistant.content.prompts.welcome.enterprisePrompt",{defaultMessage:"Elastic AI Assistant is available to Enterprise users only. Please upgrade your license to use this feature."});var I=a(234);const C={id:I.d,theme:{title:I.c,titleIcon:"logoSecurity",assistant:{name:I.b,icon:"logoSecurity"},system:{icon:"logoElastic"},user:{}},messages:[{role:"assistant",content:k,timestamp:"",presentation:{delay:2e3,stream:!0}},{role:"assistant",content:O,timestamp:"",presentation:{delay:1e3,stream:!0}},{role:"assistant",content:w,timestamp:"",presentation:{delay:1e3,stream:!0}}],apiConfig:{}},M=[{role:"assistant",content:T,timestamp:"",presentation:{delay:2e3,stream:!0}}],_=e=>1===(null==e?void 0:e.length)?e[0]:void 0;var F=a(307);const A=({allSystemPrompts:e,currentConversation:t,editingSystemPromptId:a,http:n,selectedPromptContexts:r,setEditingSystemPromptId:s,setPromptTextPreview:o,setSelectedPromptContexts:l,setUserPrompt:c})=>{const{isLoading:u,sendMessages:d}=(()=>{const[e,t]=Object(i.useState)(!1);return{isLoading:e,sendMessages:Object(i.useCallback)((async({apiConfig:e,http:a,messages:n})=>{t(!0);try{return await(async({http:e,messages:t,apiConfig:a,signal:n})=>{var i;const r=t.map((e=>({role:e.role,content:e.content}))),s=(null==a?void 0:a.provider)===m.OpenAiProviderType.OpenAi?{model:null!==(i=a.model)&&void 0!==i?i:g.a,messages:r,n:1,stop:null,temperature:.2}:{messages:r},o={params:{subActionParams:{body:JSON.stringify(s)},subAction:"test"}};try{const t=await e.fetch(`/api/actions/connector/${null==a?void 0:a.connectorId}/_execute`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(o),signal:n}),i=t.data;return"ok"!==t.status?b.a:i.choices&&i.choices.length>0&&i.choices[0].message.content?i.choices[0].message.content.trim():b.a}catch(e){return b.a}})({http:a,messages:n,apiConfig:e})}finally{t(!1)}}),[])}})(),{appendMessage:p,appendReplacements:E,clearConversation:x}=Object(f.a)(),S=Object(i.useCallback)((async i=>{const s=e.find((e=>e.id===a)),c=await async function({currentReplacements:e,getAnonymizedValue:t=j,isNewChat:a,onNewReplacements:n,promptText:i,selectedPromptContexts:r,selectedSystemPrompt:s}){var o;const l=Object.keys(r).sort().map((a=>{const i=(({currentReplacements:e,getAnonymizedValue:t,onNewReplacements:a,selectedPromptContext:n})=>{if("string"==typeof n.rawData)return n.rawData;const i=(({allow:e,allowReplacement:t,currentReplacements:a,getAnonymizedValue:n,getAnonymizedValues:i,rawData:r})=>Object.keys(r).reduce(((s,o)=>{const l=new Set(t),c=new Set(e);if(Object(h.b)({allowSet:c,field:o})){const{anonymizedValues:e,replacements:t}=i({allowReplacementSet:l,allowSet:c,currentReplacements:a,field:o,getAnonymizedValue:n,rawData:r});return{anonymizedData:{...s.anonymizedData,[o]:e},replacements:{...s.replacements,...t}}}return s}),{anonymizedData:{},replacements:{}}))({allow:n.allow,allowReplacement:n.allowReplacement,currentReplacements:e,rawData:n.rawData,getAnonymizedValue:t,getAnonymizedValues:v});return null!=a&&a(i.replacements),r=i.anonymizedData,Object.keys(r).sort().map((e=>`${e},${r[e].join(",")}`)).join("\n");var r})({currentReplacements:e,getAnonymizedValue:t,onNewReplacements:n,selectedPromptContext:r[a]});return`${Object(y.e)(i)}`}));return{content:`${a?`${null!==(o=null==s?void 0:s.content)&&void 0!==o?o:""}\n\n`:""}${l}\n\n${i}`,role:"user",timestamp:(new Date).toLocaleString()}}({isNewChat:0===t.messages.length,currentReplacements:t.replacements,onNewReplacements:e=>E({conversationId:t.id,replacements:e}),promptText:i,selectedPromptContexts:r,selectedSystemPrompt:s}),u=p({conversationId:t.id,message:c});l({}),o("");const m=(e=>{const t=(new Date).toLocaleString();return e?{role:"assistant",content:e,timestamp:t}:{role:"assistant",content:"Error: Response from LLM API is empty or undefined.",timestamp:t}})(await d({http:n,apiConfig:t.apiConfig,messages:u}));p({conversationId:t.id,message:m})}),[e,t,r,p,l,o,d,n,E,a]);return{handleButtonSendMessage:Object(i.useCallback)((e=>{S(e),c("")}),[S,c]),handleOnChatCleared:Object(i.useCallback)((()=>{var a;const n=null===(a=Object(F.b)({allSystemPrompts:e,conversation:t}))||void 0===a?void 0:a.id;o(""),c(""),l({}),x(t.id),s(n)}),[e,x,t,s,o,l,c]),handlePromptChange:e=>{o(e),c(e)},handleSendMessage:S,isLoading:u}};var D={name:"a4hmbt",styles:"position:absolute"};const N=({isDisabled:e,isLoading:t,onChatCleared:a,onSendMessage:n})=>Object(p.jsx)(s.EuiFlexGroup,{css:D,direction:"column",gutterSize:"xs"},Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiToolTip,{position:"right",content:b.b},Object(p.jsx)(s.EuiButtonIcon,{"aria-label":b.b,color:"danger","data-test-subj":"clear-chat",display:"base",iconType:"cross",isDisabled:e,onClick:a}))),Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiToolTip,{position:"right",content:b.g},Object(p.jsx)(s.EuiButtonIcon,{"aria-label":b.g,"data-test-subj":"submit-chat",color:"primary",display:"base",iconType:"returnKey",isDisabled:e,isLoading:t,onClick:n})))),P=S.i18n.translate("xpack.elasticAssistant.assistant.promptPlaceholder",{defaultMessage:"Ask me anything from 'summarize this alert' to 'help me build a query...'"}),R=u()(s.EuiTextArea)`
  min-height: 125px;
  padding-right: 42px;
`,L=Object(i.forwardRef)((({isDisabled:e=!1,value:t,onPromptSubmit:a,handlePromptChange:n,...r},s)=>{const o=Object(i.useCallback)((e=>{n(e.target.value)}),[n]),l=Object(i.useCallback)((e=>{var i;"Enter"===e.key&&!e.shiftKey&&t.trim().length>0?(e.preventDefault(),a(null===(i=e.target.value)||void 0===i?void 0:i.trim()),n("")):"Enter"!==e.key||e.shiftKey||0!==t.trim().length||(e.preventDefault(),e.stopPropagation())}),[t,a,n]);return Object(i.useEffect)((()=>{n(t)}),[n,t]),Object(p.jsx)(R,{className:"eui-scrollBar",inputRef:s,id:"prompt-textarea","data-test-subj":"prompt-textarea",fullWidth:!0,autoFocus:!0,disabled:e,placeholder:P,value:t,onChange:o,onKeyDown:l})}));L.displayName="PromptTextArea";var B={name:"zyunh5",styles:"left:-34px;position:relative;top:11px"},q={name:"1d3w5wq",styles:"width:100%"};const z=({isDisabled:e,userPrompt:t,shouldRefocusPrompt:a,...n})=>{const{handleButtonSendMessage:r,handleOnChatCleared:o,handlePromptChange:l,handleSendMessage:c,isLoading:u}=A(n),d=Object(i.useRef)(null);Object(i.useEffect)((()=>{a&&d.current&&(null==d||d.current.focus())}),[a]);const m=Object(i.useMemo)((()=>e?"":null!=t?t:""),[e,t]),b=Object(i.useCallback)((()=>{var e,t,a;r(null!==(e=null===(t=d.current)||void 0===t||null===(a=t.value)||void 0===a?void 0:a.trim())&&void 0!==e?e:"")}),[r,d]);return Object(p.jsx)(s.EuiFlexGroup,{gutterSize:"none",css:q},Object(p.jsx)(s.EuiFlexItem,null,Object(p.jsx)(L,{onPromptSubmit:c,ref:d,handlePromptChange:l,value:m,isDisabled:e})),Object(p.jsx)(s.EuiFlexItem,{css:B,grow:!1},Object(p.jsx)(N,{onChatCleared:o,isDisabled:e,isLoading:u,onSendMessage:b})))},$=S.i18n.translate("xpack.elasticAssistant.components.upgrade.upgradeTitle",{defaultMessage:"Manage license"}),V=S.i18n.translate("xpack.elasticAssistant.components.upgrade.upgradeButtonLabel",{defaultMessage:"Subscription plans"}),U=({basePath:e})=>Object(p.jsx)(s.EuiFlexGroup,{gutterSize:"s",wrap:!0,"data-test-subj":"upgrade-buttons"},Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiButton,{href:"https://www.elastic.co/subscriptions",iconType:"popout",iconSide:"right",target:"_blank"},V)),Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiButton,{href:`${e}/app/management/stack/license_management`,iconType:"gear",target:"_blank"},$))),H=r.a.memo(U);H.displayName="UpgradeButtons";var G={name:"1d3w5wq",styles:"width:100%"},Q={name:"1d3w5wq",styles:"width:100%"};const W=({connectorPrompt:e,http:t,isAssistantEnabled:a,isWelcomeSetup:n})=>{const i=t.basePath.get();return a?n?Object(p.jsx)(s.EuiFlexGroup,{css:G},Object(p.jsx)(s.EuiFlexItem,{"data-test-subj":"connector-prompt"},e)):null:Object(p.jsx)(s.EuiFlexGroup,{justifyContent:"spaceAround",css:Q},Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(H,{basePath:i})))};var K=a(44),Y=a(68),J=a(180),X=a(358),Z=a(269),ee=a(554),te=a(444);const ae="ADD_NEW_CONNECTOR",ne=J.css`
  height: 32px;

  .euiSuperSelect {
    width: 400px;
  }

  .euiSuperSelectControl {
    border: none;
    box-shadow: none;
    background: none;
    padding-left: 0;
  }

  .euiFormControlLayoutIcons {
    right: 14px;
    top: 2px;
  }
`,ie=J.css`
  overflow: hidden;
  text-overflow: ellipsis;
  max-width: 400px;
`,re=J.css`
  overflow: hidden;
  text-overflow: ellipsis;
  max-width: 400px;
  font-weight: normal;
  padding-bottom: 5px;
  padding-left: 0;
  padding-top: 2px;
`,se=r.a.memo((({isDisabled:e=!1,onConnectorModalVisibilityChange:t,selectedConnectorId:a,selectedConversation:o})=>{var l,c,u;const[d,b]=Object(i.useState)(!1),{actionTypeRegistry:g,assistantAvailability:y,http:h}=Object(n.b)(),{setApiConfig:v}=Object(f.a)(),[E,x]=Object(i.useState)(!1),{data:j}=Object(ee.a)({http:h}),S=null!==(l=null==j?void 0:j.find((e=>e.id===m.GEN_AI_CONNECTOR_ID)))&&void 0!==l?l:{enabledInConfig:!0,enabledInLicense:!0,minimumLicenseRequired:"platinum",supportedFeatureIds:["general"],isSystemActionType:!1,id:".gen-ai",name:"Generative AI",enabled:!0},{data:k,isLoading:O,isFetching:w,refetch:T}=Object(X.a)({http:h}),I=O||w,C=null!==(c=null==k||null===(u=k.find((e=>e.id===a)))||void 0===u?void 0:u.name)&&void 0!==c?c:Z.l,M=e||!y.hasConnectorsReadPrivilege,_=Object(i.useMemo)((()=>({value:ae,inputDisplay:Z.e,dropdownDisplay:Object(p.jsx)(s.EuiFlexGroup,{gutterSize:"none",key:ae},Object(p.jsx)(s.EuiFlexItem,{grow:!0},Object(p.jsx)(s.EuiButtonEmpty,{"data-test-subj":"addNewConnectorButton",iconType:"plus",size:"xs"},Z.e)),Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)("div",{style:{width:"24px"}})))})),[]),F=Object(i.useMemo)((()=>{var e;return null!==(e=null==k?void 0:k.map((e=>{var t;const a=null===(t=Object(te.a)(e))||void 0===t?void 0:t.apiProvider,n=e.isPreconfigured?Z.q:a;return{value:e.id,inputDisplay:Object(p.jsx)(s.EuiText,{className:ie,size:"xs"},e.name),dropdownDisplay:Object(p.jsx)(r.a.Fragment,{key:e.id},Object(p.jsx)("strong",null,e.name),n&&Object(p.jsx)(s.EuiText,{size:"xs",color:"subdued"},Object(p.jsx)("p",null,n)))}})))&&void 0!==e?e:[]}),[k]),A=Object(i.useMemo)((()=>y.hasConnectorsAllPrivilege?[...F,_]:[...F]),[_,y.hasConnectorsAllPrivilege,F]),D=Object(i.useCallback)((()=>{null==t||t(!1),x(!1)}),[t]),N=Object(i.useCallback)((()=>{b(!d)}),[d]),P=Object(i.useCallback)((()=>b(!1)),[]),R=Object(i.useCallback)(((e,a,n)=>{if(b(!1),e===ae)return null==t||t(!0),void x(!0);const i=null==k?void 0:k.find((t=>t.id===e)),r=Object(te.a)(i);null!=o&&v({conversationId:o.id,apiConfig:{...o.apiConfig,connectorId:e,provider:null!=a?a:null==r?void 0:r.apiProvider,model:null!=n?n:null==r?void 0:r.defaultModel}})}),[k,o,t,v]),L=Object(i.useMemo)((()=>Object(p.jsx)(s.EuiText,{color:"default",size:"xs"},Z.l)),[]);return Object(p.jsx)(s.EuiFlexGroup,{alignItems:"center",className:ne,direction:"row",gutterSize:"xs",justifyContent:"flexStart",responsive:!1},Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiText,{size:"xs",color:"subdued"},Z.k)),Object(p.jsx)(s.EuiFlexItem,null,d?Object(p.jsx)(s.EuiSuperSelect,{"aria-label":Z.f,compressed:!0,disabled:M,hasDividers:!0,isLoading:I,isOpen:d,onBlur:P,onChange:R,options:A,placeholder:L,valueOfSelected:a}):Object(p.jsx)("span",null,Object(p.jsx)(s.EuiButtonEmpty,{className:re,color:"text","data-test-subj":"connectorSelectorPlaceholderButton",iconSide:"right",iconType:"arrowDown",isDisabled:M,onClick:N,size:"xs"},C)),E&&Object(p.jsx)(Y.ConnectorAddModal,{actionType:S,onClose:D,postSaveEventHandler:e=>{const t=Object(te.a)(e);R(e.id,null==t?void 0:t.apiProvider,null==t?void 0:t.defaultModel),null==T||T(),D()},actionTypeRegistry:g})))}));se.displayName="ConnectorSelectorInline";const oe={xl:64,l:48,m:32,s:24,xs:16},le=({size:e="s"})=>Object(p.jsx)("svg",{xmlns:"http://www.w3.org/2000/svg",width:oe[e],height:oe[e],viewBox:"0 0 64 64",fill:"none"},Object(p.jsx)("path",{fill:"#F04E98",d:"M36 28h24v36H36V28Z"}),Object(p.jsx)("path",{fill:"#00BFB3",d:"M4 46c0-9.941 8.059-18 18-18h6v36h-6c-9.941 0-18-8.059-18-18Z"}),Object(p.jsx)("path",{fill:"#343741",d:"M60 12c0 6.627-5.373 12-12 12s-12-5.373-12-12S41.373 0 48 0s12 5.373 12 12Z"}),Object(p.jsx)("path",{fill:"#FA744E",d:"M6 23C6 10.85 15.85 1 28 1v22H6Z"}));var ce={name:"1y0ex1",styles:"max-width:400px"};const ue=({isDisabled:e=!1,title:t,docLinks:a,selectedConversation:n})=>{var r;const o=null==n||null===(r=n.apiConfig)||void 0===r?void 0:r.connectorId,{ELASTIC_WEBSITE_URL:l,DOC_LINK_VERSION:c}=a,u=`${l}guide/en/security/${c}/security-assistant.html`,d=Object(i.useMemo)((()=>Object(p.jsx)(s.EuiLink,{"aria-label":b.h,"data-test-subj":"externalDocumentationLink",external:!0,href:u,target:"_blank"},b.d)),[u]),m=Object(i.useMemo)((()=>Object(p.jsx)(K.FormattedMessage,{defaultMessage:"Responses from AI systems may not always be entirely accurate. For more information on the assistant feature and its usage, please reference the {documentationLink}.",id:"xpack.elasticAssistant.assistant.technicalPreview.tooltipContent",values:{documentationLink:d}})),[d]),[g,f]=Object(i.useState)(!1),y=Object(i.useCallback)((()=>f((e=>!e))),[]),h=Object(i.useCallback)((()=>f(!1)),[]);return Object(p.jsx)(s.EuiModalHeaderTitle,null,Object(p.jsx)(s.EuiFlexGroup,{gutterSize:"m"},Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(le,{"data-test-subj":"titleIcon",size:"m"})),Object(p.jsx)(s.EuiFlexGroup,{direction:"column",gutterSize:"none",justifyContent:"center"},Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiFlexGroup,{gutterSize:"xs",alignItems:"center"},Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiTitle,{size:"s"},Object(p.jsx)("h3",null,t))),Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiPopover,{button:Object(p.jsx)(s.EuiButtonIcon,{"aria-label":b.h,"data-test-subj":"tooltipIcon",iconType:"iInCircle",onClick:y}),isOpen:g,closePopover:h,anchorPosition:"rightUp"},Object(p.jsx)(s.EuiText,{"data-test-subj":"tooltipContent",grow:!1,css:ce},Object(p.jsx)(s.EuiText,{size:"s"},Object(p.jsx)("p",null,m))))))),Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(se,{isDisabled:e||void 0===n,onConnectorModalVisibilityChange:()=>{},selectedConnectorId:o,selectedConversation:n})))))},de=S.i18n.translate("xpack.elasticAssistant.assistant.conversationSelector.defaultConversationTitle",{defaultMessage:"Conversations"}),pe=S.i18n.translate("xpack.elasticAssistant.assistant.conversationSelector.ariaLabel",{defaultMessage:"Conversation selector"}),me=S.i18n.translate("xpack.elasticAssistant.assistant.conversationSelector.placeholderTitle",{defaultMessage:"Select or type to create new..."}),be=S.i18n.translate("xpack.elasticAssistant.assistant.conversationSelector.CustomOptionTextTitle",{defaultMessage:"Create new conversation:"}),ge=S.i18n.translate("xpack.elasticAssistant.assistant.conversationSelector.previousConversationTitle",{defaultMessage:"Previous conversation"}),fe=S.i18n.translate("xpack.elasticAssistant.assistant.conversationSelector.nextConversationTitle",{defaultMessage:"Next conversation"}),ye=S.i18n.translate("xpack.elasticAssistant.assistant.conversationSelector.deleteConversationTitle",{defaultMessage:"Delete conversation"}),he=navigator.platform.toLowerCase().indexOf("mac")>=0,ve=(e,t)=>0===e.indexOf(t)?e[e.length-1]:e[e.indexOf(t)-1];var Ee={name:"1v0pok0",styles:"min-width:300px"},xe={name:"4109g5",styles:"visibility:hidden;.parentFlexGroup:hover &{visibility:visible;}"},je={name:"1gz2b5f",styles:"overflow:hidden;text-overflow:ellipsis"},Se={name:"1e5733u",styles:"width:calc(100% - 60px)"};const ke=r.a.memo((({selectedConversationId:e=I.a,defaultConnectorId:t,defaultProvider:a,onConversationSelected:r,shouldDisableKeyboardShortcut:o=(()=>!1),isDisabled:c=!1})=>{const{allSystemPrompts:u}=Object(n.b)(),{deleteConversation:d,setConversation:m}=Object(f.a)(),{conversations:b}=Object(n.b)(),g=Object(i.useMemo)((()=>Object.keys(b)),[b]),y=Object(i.useMemo)((()=>Object.values(b).map((e=>{var t;return{value:{isDefault:null!==(t=e.isDefault)&&void 0!==t&&t},label:e.id}}))),[b]),[h,v]=Object(i.useState)((()=>{var t;return null!==(t=y.filter((t=>t.label===e)))&&void 0!==t?t:[]})),E=Object(i.useCallback)(((e,n=[])=>{if(!e||!e.trim().toLowerCase())return;const i=e.trim().toLowerCase(),s=u.find((e=>e.isNewConversationDefault));if(-1===n.findIndex((e=>e.label.trim().toLowerCase()===i))){const n={id:e,messages:[],apiConfig:{connectorId:t,provider:a,defaultSystemPromptId:null==s?void 0:s.id}};m({conversation:n})}r(e)}),[u,t,a,m,r]),x=Object(i.useCallback)((t=>{e===t&&r(ve(g,t)),setTimeout((()=>{d(t)}),0)}),[g,d,e,r]),j=Object(i.useCallback)((e=>{0===e.length?v([]):-1!==y.findIndex((t=>t.label===(null==e?void 0:e[0].label)))&&r(null==e?void 0:e[0].label)}),[y,r]),S=Object(i.useCallback)((()=>{const t=ve(g,e);r(t)}),[g,e,r]),k=Object(i.useCallback)((()=>{const t=((e,t)=>e.indexOf(t)+1>=e.length?e[0]:e[e.indexOf(t)+1])(g,e);r(t)}),[g,e,r]),O=Object(i.useCallback)((e=>{c||g.length<=1||("ArrowLeft"===e.key&&(he?e.metaKey:e.ctrlKey)&&!o()&&(e.preventDefault(),S()),"ArrowRight"===e.key&&(he?e.metaKey:e.ctrlKey)&&!o()&&(e.preventDefault(),k()))}),[g.length,c,S,k,o]);return l()("keydown",O),Object(i.useEffect)((()=>{v(y.filter((t=>t.label===e)))}),[y,e]),Object(p.jsx)(s.EuiFormRow,{label:de,display:"rowCompressed",css:Ee},Object(p.jsx)(s.EuiComboBox,{"aria-label":pe,customOptionText:`${be} {searchValue}`,placeholder:me,singleSelection:{asPlainText:!0},options:y,selectedOptions:h,onChange:j,onCreateOption:E,renderOption:(e,t,a)=>{const{label:n,value:i}=e;return Object(p.jsx)(s.EuiFlexGroup,{alignItems:"center",className:"parentFlexGroup",component:"span",justifyContent:"spaceBetween"},Object(p.jsx)(s.EuiFlexItem,{component:"span",grow:!1,css:Se},Object(p.jsx)(s.EuiHighlight,{search:t,css:je},n)),!(null!=i&&i.isDefault)&&Object(p.jsx)(s.EuiFlexItem,{grow:!1,component:"span"},Object(p.jsx)(s.EuiToolTip,{position:"right",content:ye},Object(p.jsx)(s.EuiButtonIcon,{iconType:"cross","aria-label":ye,color:"danger",onClick:e=>{e.stopPropagation(),x(n)},css:xe}))))},compressed:!0,isDisabled:c,prepend:Object(p.jsx)(s.EuiToolTip,{content:`${ge} (⌘ + ←)`,display:"block"},Object(p.jsx)(s.EuiButtonIcon,{iconType:"arrowLeft","aria-label":ge,onClick:S,disabled:c||g.length<=1})),append:Object(p.jsx)(s.EuiToolTip,{content:`${fe} (⌘ + →)`,display:"block"},Object(p.jsx)(s.EuiButtonIcon,{iconType:"arrowRight","aria-label":fe,onClick:k,disabled:c||g.length<=1}))}))}));ke.displayName="ConversationSelector";var Oe=a(372),we=a(775);const Te=r.a.memo((({defaultConnectorId:e,defaultProvider:t,isDisabled:a=!1,isSettingsModalVisible:o,setIsSettingsModalVisible:l,selectedConversation:c,setSelectedConversationId:u})=>{const{setSelectedSettingsTab:d}=Object(n.b)(),m=Object(i.useCallback)((()=>{l(!1)}),[l]),b=Object(i.useCallback)((()=>{m()}),[m]),g=Object(i.useCallback)((()=>{m()}),[m]),f=Object(i.useCallback)((()=>{d(Oe.b),l(!0)}),[l,d]);return Object(p.jsx)(r.a.Fragment,null,Object(p.jsx)(s.EuiToolTip,{position:"right",content:we.g},Object(p.jsx)(s.EuiButtonIcon,{"aria-label":we.f,"data-test-subj":"settings",onClick:f,isDisabled:a,iconType:"gear",size:"xs"})),o&&Object(p.jsx)(Oe.a,{defaultConnectorId:e,defaultProvider:t,selectedConversation:c,setSelectedConversationId:u,onClose:b,onSave:g}))}));Te.displayName="AssistantSettingsButton";var Ie={name:"1h6p4mk",styles:"width:335px"},Ce={name:"1d3w5wq",styles:"width:100%"};const Me=({currentConversation:e,defaultConnectorId:t,defaultProvider:a,docLinks:n,isDisabled:o,isSettingsModalVisible:l,onConversationSelected:c,onToggleShowAnonymizedValues:u,selectedConversationId:d,setIsSettingsModalVisible:m,setSelectedConversationId:g,shouldDisableKeyboardShortcut:f,showAnonymizedValues:y,title:h})=>{const v=Object(i.useMemo)((()=>null!=e.replacements&&Object.keys(e.replacements).length>0&&y),[e.replacements,y]);return Object(p.jsx)(r.a.Fragment,null,Object(p.jsx)(s.EuiFlexGroup,{css:Ce,alignItems:"center",justifyContent:"spaceBetween"},Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(ue,{isDisabled:o,docLinks:n,selectedConversation:e,title:h})),Object(p.jsx)(s.EuiFlexItem,{grow:!1,css:Ie},Object(p.jsx)(ke,{defaultConnectorId:t,defaultProvider:a,selectedConversationId:d,onConversationSelected:c,shouldDisableKeyboardShortcut:f,isDisabled:o}),Object(p.jsx)(r.a.Fragment,null,Object(p.jsx)(s.EuiSpacer,{size:"s"}),Object(p.jsx)(s.EuiFlexGroup,{alignItems:"center",gutterSize:"none",justifyContent:"spaceBetween"},Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiToolTip,{content:b.f,position:"left",repositionOnScroll:!0},Object(p.jsx)(s.EuiSwitch,{"data-test-subj":"showAnonymizedValues",checked:v,compressed:!0,disabled:null==e.replacements,label:b.e,onChange:u}))),Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(Te,{defaultConnectorId:t,defaultProvider:a,isDisabled:o,isSettingsModalVisible:l,selectedConversation:e,setIsSettingsModalVisible:m,setSelectedConversationId:g})))))),Object(p.jsx)(s.EuiHorizontalRule,{margin:"m"}))};async function _e({defaultAllow:e,defaultAllowReplacement:t,promptContext:a}){const n=await a.getPromptContext();return"string"==typeof n?{allow:[],allowReplacement:[],promptContextId:a.id,rawData:n}:{allow:[...e],allowReplacement:[...t],promptContextId:a.id,rawData:n}}const Fe=u()(s.EuiButton)`
  margin-right: ${({theme:e})=>e.eui.euiSizeXS};
`,Ae=({defaultAllow:e,defaultAllowReplacement:t,promptContexts:a,selectedPromptContexts:n,setSelectedPromptContexts:r})=>{const o=Object(i.useMemo)((()=>Object(E.sortBy)("description",Object.values(a))),[a]),l=Object(i.useCallback)((async i=>{if(null==n[i]&&null!=a[i]){const n=await _e({defaultAllow:e,defaultAllowReplacement:t,promptContext:a[i]});r((e=>({...e,[i]:n})))}}),[e,t,a,n,r]);return Object(p.jsx)(s.EuiFlexGroup,{gutterSize:"none",wrap:!0},o.map((({description:e,id:t,getPromptContext:a,tooltip:i})=>Object(p.jsx)(s.EuiFlexItem,{grow:!1,key:t},Object(p.jsx)(s.EuiToolTip,{content:i},Object(p.jsx)(Fe,{"data-test-subj":`pillButton-${t}`,disabled:null!=n[t],iconSide:"left",iconType:"plus",onClick:()=>l(t)},e))))))},De=r.a.memo(Ae);var Ne=a(555),Pe=a(898),Re={name:"1m5oqbf",styles:"white-space:pre-line;&:hover{cursor:pointer;text-decoration:underline;}"};const Le=({conversation:e,editingSystemPromptId:t,isSettingsModalVisible:a,onSystemPromptSelectionChange:o,setIsSettingsModalVisible:l})=>{const{allSystemPrompts:c}=Object(n.b)(),u=Object(i.useMemo)((()=>{var a;return void 0!==t?null!==(a=null==c?void 0:c.find((e=>e.id===t)))&&void 0!==a?a:null==c?void 0:c.find((t=>t.id===(null==e?void 0:e.apiConfig.defaultSystemPromptId))):void 0}),[c,null==e?void 0:e.apiConfig.defaultSystemPromptId,t]),[d,m]=r.a.useState(!1),b=Object(i.useCallback)((()=>{e&&o(void 0)}),[e,o]),g=Object(i.useCallback)((()=>m(!0)),[]);return Object(p.jsx)("div",null,null==u||d?Object(p.jsx)(Pe.a,{allSystemPrompts:c,clearSelectedSystemPrompt:b,conversation:e,"data-test-subj":"systemPrompt",isClearable:!0,isEditing:d,isOpen:d,isSettingsModalVisible:a,onSystemPromptSelectionChange:o,selectedPrompt:u,setIsEditing:m,setIsSettingsModalVisible:l}):Object(p.jsx)(s.EuiFlexGroup,{alignItems:"flexStart",gutterSize:"none"},Object(p.jsx)(s.EuiFlexItem,{grow:!0},Object(p.jsx)(s.EuiText,{color:"subdued","data-test-subj":"systemPromptText",onClick:g,css:Re},Object(E.isEmpty)(null==u?void 0:u.content)?Ne.d:null==u?void 0:u.content)),Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiFlexGroup,{gutterSize:"none"},Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiToolTip,{content:Ne.e},Object(p.jsx)(s.EuiButtonIcon,{"aria-label":Ne.e,"data-test-subj":"edit",iconType:"documentEdit",onClick:g}))),Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiToolTip,{content:Ne.c},Object(p.jsx)(s.EuiButtonIcon,{"aria-label":Ne.c,"data-test-subj":"clear",iconType:"cross",onClick:b})))))))};Le.displayName="SystemPromptComponent";const Be=r.a.memo(Le),qe=S.i18n.translate("xpack.elasticAssistant.assistant.firstPromptEditor.commentsListAriaLabel",{defaultMessage:"List of comments"}),ze=S.i18n.translate("xpack.elasticAssistant.assistant.firstPromptEditor.editingPromptLabel",{defaultMessage:"editing prompt"}),$e=S.i18n.translate("xpack.elasticAssistant.assistant.firstPromptEditor.youLabel",{defaultMessage:"You"});var Ve=a(869);const Ue=({rawData:e})=>Object(p.jsx)(s.EuiCodeBlock,{"data-test-subj":"readOnlyContextViewer",isCopyable:!0},Object(y.e)(e));Ue.displayName="ReadOnlyContextViewerComponent";const He=r.a.memo(Ue);var Ge=a(897),Qe=a(885),We=a(553);const Ke=S.i18n.translate("xpack.elasticAssistant.dataAnonymizationEditor.stats.availableStat.availableDescription",{defaultMessage:"Available"}),Ye=({total:e})=>{const t=Object(i.useMemo)((()=>(e=>S.i18n.translate("xpack.elasticAssistant.dataAnonymizationEditor.stats.availableStat.availableTooltip",{values:{total:e},defaultMessage:"{total} fields in this context are available to be included in the conversation"}))(e)),[e]);return Object(p.jsx)(s.EuiToolTip,{content:t},Object(p.jsx)(s.EuiStat,{"data-test-subj":"availableStat",description:Ke,reverse:!0,title:e,titleSize:We.a}))};Ye.displayName="AvailableStatComponent";const Je=r.a.memo(Ye),Xe=u()(s.EuiFlexItem)`
  margin-right: ${({theme:e})=>e.eui.euiSizeL};
`,Ze=({isDataAnonymizable:e,selectedPromptContext:t})=>{const{allowed:a,anonymized:n,total:r}=Object(i.useMemo)((()=>(({allow:e,allowReplacement:t,rawData:a})=>{const n={allowed:0,anonymized:0,denied:0,total:0};if("string"==typeof a)return n;{const i=Object.keys(a),r=new Set(t),s=new Set(e);return i.reduce(((e,t)=>({allowed:e.allowed+(Object(h.b)({allowSet:s,field:t})?1:0),anonymized:e.anonymized+(Object(h.b)({allowSet:s,field:t})&&Object(h.c)({allowReplacementSet:r,field:t})?1:0),denied:e.denied+(Object(h.d)({allowSet:s,field:t})?1:0),total:e.total+1})),n)}})(t)),[t]);return Object(p.jsx)(s.EuiFlexGroup,{alignItems:"center","data-test-subj":"stats",gutterSize:"none"},e&&Object(p.jsx)(Xe,{grow:!1},Object(p.jsx)(Ge.a,{allowed:a,total:r})),Object(p.jsx)(Xe,{grow:!1},Object(p.jsx)(Qe.a,{anonymized:n,isDataAnonymizable:e})),e&&Object(p.jsx)(Xe,{grow:!1},Object(p.jsx)(Je,{total:r})))};Ze.displayName="StatsComponent";const et=r.a.memo(Ze),tt=u.a.div`
  overflow-x: auto;
`,at=({selectedPromptContext:e,setSelectedPromptContexts:t})=>{const{defaultAllow:a,defaultAllowReplacement:r,setDefaultAllow:o,setDefaultAllowReplacement:l}=Object(n.b)(),c=Object(i.useMemo)((()=>Object(h.a)(e.rawData)),[e]),u=Object(i.useCallback)((n=>{const i=n.reduce(((e,{field:t,operation:a,update:n})=>Object(h.f)({field:t,operation:a,selectedPromptContext:e,update:n})),e);t((t=>({...t,[e.promptContextId]:i}))),Object(h.e)({defaultAllow:a,defaultAllowReplacement:r,setDefaultAllow:o,setDefaultAllowReplacement:l,updates:n})}),[a,r,e,o,l,t]);return Object(p.jsx)(tt,{"data-test-subj":"dataAnonymizationEditor"},Object(p.jsx)(et,{isDataAnonymizable:c,selectedPromptContext:e}),Object(p.jsx)(s.EuiSpacer,{size:"s"}),"string"==typeof e.rawData?Object(p.jsx)(He,{rawData:e.rawData}):Object(p.jsx)(Ve.a,{allow:e.allow,allowReplacement:e.allowReplacement,onListUpdated:u,rawData:e.rawData}))},nt=r.a.memo(at),it=S.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.selectedPromotContexts.removeContextTooltip",{defaultMessage:"Remove context"}),rt=u.a.div`
  ${({$accordionState:e})=>"closed"===e?"height: 0px;":""}
  ${({$accordionState:e})=>"closed"===e?"overflow: hidden;":""}
  ${({$accordionState:e})=>"closed"===e?"position: absolute;":""}
`,st=({isNewConversation:e,promptContexts:t,selectedPromptContexts:a,setSelectedPromptContexts:n})=>{const[o,l]=r.a.useState("closed"),c=Object(i.useCallback)((()=>l((e=>"open"===e?"closed":"open"))),[]),u=Object(i.useCallback)((e=>{n((t=>Object(E.omit)(e,t)))}),[n]);return Object(E.isEmpty)(t)?null:Object(p.jsx)(s.EuiFlexGroup,{"data-test-subj":"selectedPromptContexts",direction:"column",gutterSize:"none"},Object.keys(a).sort().map((i=>{var r;return Object(p.jsx)(s.EuiFlexItem,{"data-test-subj":`selectedPromptContext-${i}`,grow:!1,key:i},e||Object.keys(a).length>1?Object(p.jsx)(s.EuiSpacer,{"data-test-subj":"spacer"}):null,Object(p.jsx)(s.EuiAccordion,{buttonContent:null===(r=t[i])||void 0===r?void 0:r.description,forceState:o,extraAction:Object(p.jsx)(s.EuiToolTip,{content:it},Object(p.jsx)(s.EuiButtonIcon,{"aria-label":it,"data-test-subj":`removePromptContext-${i}`,iconType:"cross",onClick:()=>u(i)})),id:i,onToggle:c,paddingSize:"s"},Object(p.jsx)(rt,{$accordionState:o},Object(p.jsx)(nt,{selectedPromptContext:a[i],setSelectedPromptContexts:n}))))})))},ot=r.a.memo(st),lt=u()(s.EuiText)`
  white-space: pre-line;
`,ct=({conversation:e,editingSystemPromptId:t,isNewConversation:a,isSettingsModalVisible:n,promptContexts:o,promptTextPreview:l,onSystemPromptSelectionChange:c,selectedPromptContexts:u,setIsSettingsModalVisible:d,setSelectedPromptContexts:m})=>{const b=Object(i.useMemo)((()=>Object(p.jsx)(r.a.Fragment,null,a&&Object(p.jsx)(Be,{conversation:e,editingSystemPromptId:t,onSystemPromptSelectionChange:c,isSettingsModalVisible:n,setIsSettingsModalVisible:d}),Object(p.jsx)(ot,{isNewConversation:a,promptContexts:o,selectedPromptContexts:u,setSelectedPromptContexts:m}),Object(p.jsx)(lt,{color:"subdued","data-test-subj":"previewText"},l))),[e,t,a,n,c,o,l,u,d,m]),g=Object(i.useMemo)((()=>[{children:b,event:Object(p.jsx)(s.EuiText,{"data-test-subj":"eventText",size:"xs"},Object(p.jsx)("i",null,ze)),timelineAvatar:Object(p.jsx)(s.EuiAvatar,{"data-test-subj":"userAvatar",name:"user",size:"l",color:"subdued",iconType:"userAvatar"}),timelineAvatarAriaLabel:$e,username:$e}]),[b]);return Object(p.jsx)(s.EuiCommentList,{"aria-label":qe,comments:g})};ct.displayName="PromptEditorComponent";const ut=r.a.memo(ct),dt=S.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.addQuickPromptTitle",{defaultMessage:"Add quick prompt..."}),pt=S.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.overflowAriaTitle",{defaultMessage:"Show overflow Quick Prompts"}),mt=(S.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.modalCancelButtonTitle",{defaultMessage:"Cancel"}),S.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.modalSaveButtonTitle",{defaultMessage:"Save"}),u()(s.EuiFlexGroup)`
  margin: 16px;
`),bt=r.a.memo((({setInput:e,setIsSettingsModalVisible:t,trackPrompt:a})=>{const{allQuickPrompts:r,promptContexts:o,setSelectedSettingsTab:l}=Object(n.b)(),c=Object(i.useMemo)((()=>{const e=Object.values(o).map((e=>e.category));return r.filter((t=>null==t.categories||0===t.categories.length||t.categories.some((t=>e.includes(t)))))}),[r,o]),[u,d]=Object(i.useState)(!1),m=Object(i.useCallback)((()=>d(!u)),[u]),b=Object(i.useCallback)((()=>d(!1)),[]),g=Object(i.useCallback)((t=>{e(t.prompt),t.isDefault?a(t.title):a("Custom")}),[e,a]),f=Object(i.useCallback)((e=>{g(e),b()}),[b,g]),y=Object(i.useCallback)((()=>{t(!0),l(Oe.c)}),[t,l]);return Object(p.jsx)(mt,{gutterSize:"s",alignItems:"center"},c.slice(0,5).map(((e,t)=>Object(p.jsx)(s.EuiFlexItem,{key:t,grow:!1},Object(p.jsx)(s.EuiBadge,{color:e.color,onClick:()=>g(e),onClickAriaLabel:e.title},e.title)))),c.length>5&&Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiPopover,{button:Object(p.jsx)(s.EuiBadge,{color:"hollow",iconType:"boxesHorizontal",onClick:m,onClickAriaLabel:pt}),isOpen:u,closePopover:b,anchorPosition:"rightUp"},Object(p.jsx)(s.EuiFlexGroup,{direction:"column",gutterSize:"s"},c.slice(5).map(((e,t)=>Object(p.jsx)(s.EuiFlexItem,{key:t,grow:!1},Object(p.jsx)(s.EuiBadge,{color:e.color,onClick:()=>f(e),onClickAriaLabel:e.title},e.title))))))),Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiButtonEmpty,{"data-test-subj":"addQuickPrompt",onClick:y,iconType:"plus",size:"xs"},dt)))}));bt.displayName="QuickPrompts";const gt=r.a.memo((({text:e,children:t,chunkSize:a=5,delay:n=100,onStreamingComplete:r})=>{const[s,o]=Object(i.useState)(n>0?"":e),[l,c]=Object(i.useState)(null==n||0===n);return Object(i.useEffect)((()=>{0===n&&(null==r||r())}),[]),Object(i.useEffect)((()=>{if(l||0===n)return void o(e);let t=0;c(!1);const i=setInterval((()=>{if(t>=e.length)return null==r||r(),c(!0),void clearInterval(i);const n=e.substring(t,t+a);o((e=>e+n)),t+=a}),n);return()=>{clearInterval(i)}}),[e,a,n,r,l]),t?Object(p.jsx)("div",null,t(s,l)):Object(p.jsx)("div",null,s)}));gt.displayName="StreamingText";const ft=r.a.memo((({setIsConnectorModalVisible:e})=>{const{assistantAvailability:t}=Object(n.b)(),a=t.hasConnectorsAllPrivilege?Z.d:Z.c,r=t.hasConnectorsAllPrivilege?Z.a:Z.b,o=Object(i.useCallback)((()=>{null==e||e(!0)}),[e]);return Object(p.jsx)(s.EuiFlexGroup,{gutterSize:"l",justifyContent:"spaceAround"},Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(s.EuiCard,{"data-test-subj":"connectorButton",layout:"horizontal",icon:Object(p.jsx)(s.EuiIcon,{size:"xl",type:m.GenAiLogo}),title:a,description:r,onClick:t.hasConnectorsAllPrivilege?o:void 0})))}));ft.displayName="ConnectorButton";const yt=e=>{const{messages:t,...a}=e;return{...a,messages:t.map((e=>{const{presentation:t,...a}=e;return{...a,presentation:void 0}}))}},ht=e=>!e.messages.some((e=>void 0!==e.presentation)),vt=u.a.div`
  margin-bottom: 10px;
`,Et=u()(s.EuiText)`
  margin-top: 20px;
`,xt=r.a.memo((({isConnectorConfigured:e,isSettingsModalVisible:t,setIsSettingsModalVisible:a})=>{const{assistantAvailability:o,setSelectedSettingsTab:l}=Object(n.b)(),c=Object(i.useCallback)((()=>{t||(a(!0),l(Oe.b))}),[t,a,l]),u=o.hasConnectorsAllPrivilege||o.hasConnectorsReadPrivilege&&e;return Object(p.jsx)(r.a.Fragment,null,u?Object(p.jsx)(s.EuiCallOut,{"data-test-subj":"connectorMissingCallout",color:"danger",iconType:"controlsVertical",size:"m",title:Z.o},Object(p.jsx)("p",null," ",Object(p.jsx)(K.FormattedMessage,{defaultMessage:"Select a connector above or from the {link} to continue",id:"xpack.elasticAssistant.assistant.connectors.connectorMissingCallout.calloutDescription",values:{link:Object(p.jsx)(s.EuiLink,{onClick:c},Z.p)}}))):Object(p.jsx)(ft,null))}));xt.displayName="ConnectorMissingCallout";var jt={name:"hbng6e",styles:"align-items:flex-start;flex-direction:column"},St={name:"hbng6e",styles:"align-items:flex-start;flex-direction:column"},kt={name:"r5hahk",styles:"margin-right:20px"},Ot={name:"r5hahk",styles:"margin-right:20px"};const wt=({conversationId:e,isAssistantEnabled:t,promptContextId:a="",shouldRefocusPrompt:o=!1,showTitle:l=!0,setConversationId:c})=>{var u,b,g;const{assistantTelemetry:y,augmentMessageCodeBlocks:h,conversations:v,defaultAllow:E,defaultAllowReplacement:x,docLinks:j,getComments:S,http:k,promptContexts:O,setLastConversationId:w,localStorageLastConversationId:T,title:A,allSystemPrompts:D}=Object(n.b)(),[N,P]=Object(i.useState)({}),R=Object(i.useMemo)((()=>Object.keys(N).length),[N]),{createConversation:L}=Object(f.a)(),{data:B,isSuccess:q}=Object(X.a)({http:k}),$=Object(i.useMemo)((()=>{var e;return null===(e=_(B))||void 0===e?void 0:e.id}),[B]),V=Object(i.useMemo)((()=>{var e,t;return null===(e=_(B))||void 0===e||null===(t=e.config)||void 0===t?void 0:t.apiProvider}),[B]),[U,H]=Object(i.useState)(t&&null!==(u=null!=e?e:T)&&void 0!==u?u:I.d);Object(i.useEffect)((()=>{c&&c(U)}),[U,c]);const G=Object(i.useMemo)((()=>{var e;return null!==(e=v[U])&&void 0!==e?e:L({conversationId:U})}),[v,L,U]),Q=Object(i.useMemo)((()=>{var e;return!Object.keys(v).some((e=>null!=v[e].apiConfig.connectorId))&&0===(null!==(e=null==B?void 0:B.length)&&void 0!==e?e:0)}),[null==B?void 0:B.length,v]),K=Q||!t,J=Object(i.useMemo)((()=>((e,t)=>t?{...e,messages:[...e.messages,...C.messages]}:0===e.messages.length||e.messages[e.messages.length-1].content!==M[0].content?{...e,messages:[...e.messages,...M]}:e)(G,t)),[G,t]),[ae,ne]=Object(i.useState)(!1);Object(i.useEffect)((()=>{if(q&&(null==B||!B.length))return w(I.d);G.excludeFromLastConversationStorage||w(G.id)}),[q,null==B?void 0:B.length,G,w]);const{comments:ie,prompt:re}=(({conversation:e=C,onSetupComplete:t})=>{var a,r,o,l;const{appendMessage:c,setApiConfig:u,setConversation:d}=Object(f.a)(),b=Object(i.useRef)(null),{actionTypeRegistry:g,conversations:y,http:h}=Object(n.b)(),{data:v,isSuccess:E,refetch:x}=Object(X.a)({http:h}),j=E&&!(null==v||!v.length),[S,k]=Object(i.useState)(!1),[O,w]=Object(i.useState)((()=>ht(e))),{data:T}=Object(ee.a)({http:h}),I=Object(i.useMemo)((()=>{var e;return null!==(e=null==T?void 0:T.find((e=>e.id===m.GEN_AI_CONNECTOR_ID)))&&void 0!==e?e:{enabledInConfig:!0,enabledInLicense:!0,isSystemActionType:!1,minimumLicenseRequired:"platinum",supportedFeatureIds:["general"],id:".gen-ai",name:"Generative AI",enabled:!0}}),[T]),M=Object(i.useMemo)((()=>{var t,a,n;return null!==(t=null===(a=e.theme)||void 0===a||null===(n=a.user)||void 0===n?void 0:n.name)&&void 0!==t?t:Z.j}),[null===(a=e.theme)||void 0===a||null===(r=a.user)||void 0===r?void 0:r.name]),_=Object(i.useMemo)((()=>{var t,a,n;return null!==(t=null===(a=e.theme)||void 0===a||null===(n=a.assistant)||void 0===n?void 0:n.name)&&void 0!==t?t:Z.i}),[null===(o=e.theme)||void 0===o||null===(l=o.assistant)||void 0===l?void 0:l.name]),F=Object(i.useMemo)((()=>e.messages.length-1),[e.messages.length]),[A,D]=Object(i.useState)(j||ht(e)?F:0),N=Object(i.useRef)(void 0),P=Object(i.useCallback)((()=>{var t,a,n;if(A!==F)return N.current=window.setTimeout((()=>{var e;return null===(e=b.current)||void 0===e||e.scrollIntoView({block:"end"}),D(A+1)}),null!==(t=null===(a=e.messages[A])||void 0===a||null===(n=a.presentation)||void 0===n?void 0:n.delay)&&void 0!==t?t:0),()=>clearTimeout(N.current);clearTimeout(N.current)}),[e.messages,A,F]),R=Object(i.useCallback)((()=>{var a;w(!0),null===(a=b.current)||void 0===a||a.scrollIntoView({block:"end"}),null==t||t(),d({conversation:yt(e)})}),[e,t,d]),L=Object(i.useCallback)((()=>{D(F)}),[F]),B=Object(i.useCallback)(((t,a,n)=>{var i,r;null!=e.messages[a].timestamp&&0!==e.messages[a].timestamp.length||(e.messages[a].timestamp=(new Date).toLocaleString());const o=a===n-1,l=null!==(i=null==t||null===(r=t.presentation)||void 0===r?void 0:r.stream)&&void 0!==i&&i&&A!==n-1;return Object(p.jsx)(gt,{text:t.content,delay:l?50:0,onStreamingComplete:o?R:P},((e,t)=>Object(p.jsx)(s.EuiText,null,Object(p.jsx)(s.EuiMarkdownFormat,{className:`message-${a}`},e),Object(p.jsx)("span",{ref:b}))))}),[e.messages,A,R,P]);return{comments:Object(i.useMemo)((()=>e.messages.slice(0,A+1).map(((t,a)=>({username:"user"===t.role?M:_,children:B(t,a,e.messages.length),timelineAvatar:Object(p.jsx)(s.EuiAvatar,{name:Z.i,size:"l",color:"subdued",iconType:le}),timestamp:`${Z.h}: ${t.timestamp}`})))),[_,B,e.messages,A,M]),prompt:Object(p.jsx)("div",{"data-test-subj":"prompt"},O&&Object(p.jsx)(vt,null,Object(p.jsx)(ft,{setIsConnectorModalVisible:k})),!O&&Object(p.jsx)(Et,{color:"subdued",size:"xs"},Object(p.jsx)(s.EuiTextAlign,{textAlign:"center"},Object(p.jsx)(s.EuiBadge,{color:"hollow",onClick:L,onClickAriaLabel:Z.g},Z.g))),S&&Object(p.jsx)(Y.ConnectorAddModal,{actionType:I,onClose:()=>k(!1),postSaveEventHandler:t=>{const a=Object(te.a)(t);Object.values(y).forEach((e=>{u({conversationId:e.id,apiConfig:{...e.apiConfig,connectorId:t.id,provider:null==a?void 0:a.apiProvider,model:null==a?void 0:a.defaultModel}})})),null==x||x(),k(!1),c({conversationId:e.id,message:{role:"assistant",content:"Connector setup complete!",timestamp:(new Date).toLocaleString()}})},actionTypeRegistry:g}))}})({conversation:J,onSetupComplete:()=>{var e;null===(e=oe.current)||void 0===e||e.scrollIntoView({behavior:"auto"})}}),se=Q&&null!==(b=J.theme)&&void 0!==b&&b.title?null===(g=J.theme)||void 0===g?void 0:g.title:A,oe=Object(i.useRef)(null),ce=Object(i.useRef)(null),[ue,de]=Object(i.useState)(""),[pe,me]=Object(i.useState)(!1),[be,ge]=Object(i.useState)(null),[fe,ye]=Object(i.useState)(!1),[he,ve]=Object(i.useState)(!1),[Ee,xe]=Object(i.useState)(),[je,Se]=Object(i.useState)(!1);Object(i.useLayoutEffect)((()=>{xe(h(G))}),[h,G]);const ke=Object(i.useMemo)((()=>K||fe),[fe,K]);Object(i.useEffect)((()=>{const e=()=>{const e=document.querySelectorAll(".euiCodeBlock__controls");Se(e.length>0)};e();const t=new MutationObserver(e);return t.observe(document.body,{subtree:!0,childList:!0}),()=>{t.disconnect()}}),[]),Object(i.useEffect)((()=>{var e;null===(e=oe.current)||void 0===e||e.scrollIntoView({behavior:"auto"})}),[]),Object(i.useEffect)((()=>{setTimeout((()=>{var e;null===(e=oe.current)||void 0===e||e.scrollIntoView({behavior:"auto"})}),0)}),[G.messages.length,R]);const Oe=Object(i.useMemo)((()=>Object(F.b)({allSystemPrompts:D,conversation:G})),[D,G]),[we,Te]=Object(i.useState)(null==Oe?void 0:Oe.id),Ie=Object(i.useCallback)((e=>{var t;H(e),Te(null===(t=Object(F.b)({allSystemPrompts:D,conversation:v[e]}))||void 0===t?void 0:t.id)}),[D,v]),Ce=Object(i.useCallback)((e=>{Te(e)}),[]);[...document.getElementsByClassName("euiCodeBlock")].forEach((e=>e.style.minHeight="75px"));const Fe=Object(i.useCallback)((e=>{null!=ve&&ve(e.target.checked)}),[ve]);Object(i.useEffect)((()=>{if(G.messages.length||e!==U)return;if(pe)return;const t=O[a];null!=t&&(me(!0),Object.keys(N).includes(t.id)||(async()=>{const e=await _e({defaultAllow:E,defaultAllowReplacement:x,promptContext:t});P((a=>({...a,[t.id]:e})))})(),null!=t.suggestedUserPrompt&&ge(t.suggestedUserPrompt))}),[G.messages,O,a,e,U,N,pe,E,x]),Object(i.useEffect)((()=>{var e;const t=null!==(e=null==B?void 0:B.some((e=>{var t;return e.id===(null===(t=G.apiConfig)||void 0===t?void 0:t.connectorId)})))&&void 0!==e&&e;ye(!t)}),[B,G]);const Ae=Object(i.useCallback)((()=>null==Ee?void 0:Ee.map((e=>e.map((e=>{const t=e.getControlContainer,a=null==t?void 0:t();return a?Object(d.createPortal)(e.button,a):Object(p.jsx)(r.a.Fragment,null)}))))),[Ee]),Ne=Object(i.useMemo)((()=>Object(p.jsx)(r.a.Fragment,null,Object(p.jsx)(s.EuiCommentList,{comments:S({currentConversation:G,lastCommentRef:ce,showAnonymizedValues:he}),css:Ot}),0!==G.messages.length&&R>0&&Object(p.jsx)(s.EuiSpacer,{size:"m"}),(0===G.messages.length||R>0)&&Object(p.jsx)(ut,{conversation:G,editingSystemPromptId:we,isNewConversation:0===G.messages.length,isSettingsModalVisible:ae,promptContexts:O,promptTextPreview:ue,onSystemPromptSelectionChange:Ce,selectedPromptContexts:N,setIsSettingsModalVisible:ne,setSelectedPromptContexts:P}),Object(p.jsx)("div",{ref:oe}))),[G,we,S,Ce,ae,O,ue,N,R,he]),Pe=Object(i.useMemo)((()=>K?Object(p.jsx)(r.a.Fragment,null,Object(p.jsx)(s.EuiCommentList,{comments:ie,css:kt}),Object(p.jsx)("span",{ref:oe})):Ne),[ie,K,Ne]),Re=Object(i.useCallback)((e=>{null==y||y.reportAssistantQuickPrompt({conversationId:U,promptTitle:e})}),[y,U]);return Object(p.jsx)(r.a.Fragment,null,Object(p.jsx)(s.EuiModalHeader,{css:St},l&&Object(p.jsx)(Me,{currentConversation:G,defaultConnectorId:$,defaultProvider:V,docLinks:j,isDisabled:K,isSettingsModalVisible:ae,onConversationSelected:Ie,onToggleShowAnonymizedValues:Fe,selectedConversationId:U,setIsSettingsModalVisible:ne,setSelectedConversationId:H,showAnonymizedValues:he,title:se}),Ae(),!K&&Object(p.jsx)(r.a.Fragment,null,Object(p.jsx)(De,{defaultAllow:E,defaultAllowReplacement:x,promptContexts:O,selectedPromptContexts:N,setSelectedPromptContexts:P}),Object.keys(O).length>0&&Object(p.jsx)(s.EuiSpacer,{size:"s"}))),Object(p.jsx)(s.EuiModalBody,null,Pe,!K&&fe&&q&&Object(p.jsx)(r.a.Fragment,null,Object(p.jsx)(s.EuiSpacer,null),Object(p.jsx)(s.EuiFlexGroup,{justifyContent:"spaceAround"},Object(p.jsx)(s.EuiFlexItem,{grow:!1},Object(p.jsx)(xt,{isConnectorConfigured:(null==B?void 0:B.length)>0,isSettingsModalVisible:ae,setIsSettingsModalVisible:ne}))))),Object(p.jsx)(s.EuiModalFooter,{css:jt},Object(p.jsx)(W,{connectorPrompt:re,http:k,isAssistantEnabled:t,isWelcomeSetup:Q}),Object(p.jsx)(z,{allSystemPrompts:D,currentConversation:G,isDisabled:ke,shouldRefocusPrompt:o,setPromptTextPreview:de,userPrompt:be,setUserPrompt:ge,editingSystemPromptId:we,http:k,setEditingSystemPromptId:Te,selectedPromptContexts:N,setSelectedPromptContexts:P}),!K&&Object(p.jsx)(bt,{setInput:ge,setIsSettingsModalVisible:ne,trackPrompt:Re})))};wt.displayName="AssistantComponent";const Tt=r.a.memo(wt),It=navigator.platform.toLowerCase().indexOf("mac")>=0,Ct=u()(s.EuiModal)`
  ${({theme:e})=>`margin-top: ${e.eui.euiSizeXXL};`}
  min-width: 95vw;
  min-height: 25vh;
`,Mt=r.a.memo((({isAssistantEnabled:e})=>{const[t,a]=Object(i.useState)(!1),[s,o]=Object(i.useState)(I.d),[c,u]=Object(i.useState)(),{assistantTelemetry:d,setShowAssistantOverlay:m,localStorageLastConversationId:b}=Object(n.b)(),g=Object(i.useCallback)((()=>({showOverlay:e,promptContextId:t,conversationId:n})=>{e&&(null==d||d.reportAssistantInvoked({conversationId:null!=n?n:"unknown",invokedBy:"click"})),a(e),u(t),o(n)}),[d]);Object(i.useEffect)((()=>{m(g)}),[m,g]);const f=Object(i.useCallback)((()=>{t||(o(null!=b?b:I.d),null==d||d.reportAssistantInvoked({invokedBy:"shortcut",conversationId:null!=b?b:I.d})),a(!t)}),[d,t,b]),y=Object(i.useCallback)((e=>{";"===e.key&&(It?e.metaKey:e.ctrlKey)&&(e.preventDefault(),f())}),[f]);l()("keydown",y);const h=Object(i.useCallback)((()=>{a(!1),u(void 0),o(s)}),[s]),v=Object(i.useCallback)((()=>{h()}),[h]);return Object(p.jsx)(r.a.Fragment,null,t&&Object(p.jsx)(Ct,{onClose:v,"data-test-subj":"ai-assistant-modal"},Object(p.jsx)(Tt,{isAssistantEnabled:e,conversationId:s,promptContextId:c})))}));Mt.displayName="AssistantOverlay";var _t=a(774);const Ft=(e,t,a,r,s,o,l)=>{const c=Object(i.useMemo)((()=>e),[e]),u=Object(i.useMemo)((()=>a),[a]),d=Object(i.useMemo)((()=>r),[r]),p=Object(i.useMemo)((()=>null!=s?s:Object(_t.a)()),[s]),m=Object(i.useMemo)((()=>null!=o?o:void 0),[o]),b=Object(i.useMemo)((()=>l),[l]),{registerPromptContext:g,showAssistantOverlay:f,unRegisterPromptContext:y}=Object(n.b)(),h=Object(i.useCallback)((e=>{null!=p&&f({showOverlay:e,promptContextId:p,conversationId:null!=t?t:void 0})}),[f,t,p]);return Object(i.useEffect)((()=>(y(p),g({category:c,description:u,getPromptContext:d,id:p,suggestedUserPrompt:m,tooltip:b}),()=>y(p))),[c,u,d,m,b,p,g,y]),{promptContextId:p,showAssistantOverlay:h}},At=S.i18n.translate("xpack.elasticAssistant.assistant.newChat.newChatButton",{defaultMessage:"Chat"}),Dt=({category:e,children:t=At,conversationId:a,description:n,getPromptContext:r,iconType:o,promptContextId:l,suggestedUserPrompt:c,tooltip:u})=>{const{showAssistantOverlay:d}=Ft(e,null!=a?a:null,n,r,null!=l?l:null,c,u),m=Object(i.useCallback)((()=>{d(!0)}),[d]),b=Object(i.useMemo)((()=>{if(null!==o)return null!=o?o:"discuss"}),[o]);return Object(i.useMemo)((()=>Object(p.jsx)(s.EuiButtonEmpty,{"data-test-subj":"newChat",onClick:m,iconType:b},t)),[t,b,m])};Dt.displayName="NewChatComponent";const Nt=r.a.memo(Dt),Pt=S.i18n.translate("xpack.elasticAssistant.assistant.newChatById.newChatByIdButton",{defaultMessage:"Chat"}),Rt=({children:e=Pt,conversationId:t,iconType:a,promptContextId:r})=>{const{showAssistantOverlay:o}=Object(n.b)(),l=Object(i.useCallback)((()=>o({conversationId:t,promptContextId:r,showOverlay:!0})),[t,r,o]),c=Object(i.useMemo)((()=>{if(null!==a)return null!=a?a:"discuss"}),[a]);return Object(i.useMemo)((()=>Object(p.jsx)(s.EuiButtonEmpty,{"data-test-subj":"newChatById",iconType:c,onClick:l},e)),[e,c,l])};Rt.displayName="NewChatByIdComponent";const Lt=r.a.memo(Rt);S.i18n.translate("xpack.elasticAssistant.assistant.content.prompts.user.thenSummarizeSuggestedKqlAndEqlQueries",{defaultMessage:"Evaluate the event from the context above and format your output neatly in markdown syntax for my Elastic Security case."}),S.i18n.translate("xpack.elasticAssistant.assistant.content.prompts.user.finallySuggestInvestigationGuideAndFormatAsMarkdown",{defaultMessage:"Add your description, recommended actions and bulleted triage steps. Use the MITRE ATT&CK data provided to add more context and recommendations from MITRE, and hyperlink to the relevant pages on MITRE's website. Be sure to include the user and host risk score data from the context. Your response should include steps that point to Elastic Security specific features, including endpoint response actions, the Elastic Agent OSQuery manager integration (with example osquery queries), timelines and entity analytics and link to all the relevant Elastic Security documentation."})},function(e,t,a){"use strict";a.d(t,"b",(function(){return T})),a.d(t,"a",(function(){return I}));var n=a(160),i=a(103),r=a(2),s=a(114),o=a(102),l=a(122),c=a(138),u=a(42),d=a(124),p=a(387),m=a(378);var b=a(246),g=a.n(b),f=a(254),y=a(175);var h=a(164),v=a(111),E=a(142),x=a(105),j=a(45),S=a(56);const k=({search:e,urlKey:t})=>Object(f.b)(Object(f.c)(e),t);var O=a(119),w=a(4);const T=()=>{Object(n.c)(),(()=>{const e=Object(i.useDispatch)(),{filterManager:t,savedQueries:a}=Object(o.j)().services.data.query,u=Object(r.useMemo)((()=>l.d.globalFiltersQuerySelector()),[]),d=Object(i.useSelector)(u),p=Object(r.useCallback)((t=>{null!=t&&e(c.b.setFilterQuery({id:s.a.global,query:t.query,language:t.language}))}),[e]),m=Object(r.useCallback)((a=>{null!=a?(t.setFilters(a),e(c.b.setSearchBarFilter({id:s.a.global,filters:a}))):(t.setAppFilters(d),e(c.b.setSearchBarFilter({id:s.a.global,filters:t.getFilters()})))}),[t,e,d]),b=Object(r.useCallback)((n=>{null!=n&&""!==n&&a.getSavedQuery(n).then((a=>{const n=a.attributes.filters||[],i=a.attributes.query;t.setFilters(n),e(c.b.setSearchBarFilter({id:s.a.global,filters:n})),e(c.b.setFilterQuery({id:s.a.global,...i})),e(c.b.setSavedQuery({id:s.a.global,savedQuery:a}))}))}),[e,t,a]);Object(n.b)(I.appQuery,p),Object(n.b)(I.filters,m),Object(n.b)(I.savedQuery,b)})(),(()=>{const e=Object(i.useDispatch)(),t=Object(d.a)("socTrendsEnabled"),a=Object(r.useCallback)((a=>((e,t,a)=>{if(null!=e){const n={linkTo:Object(u.get)("global.linkTo",e)},i=Object(u.get)("global.timerange.kind",e),r={linkTo:Object(u.get)("timeline.linkTo",e)},o=Object(u.get)("timeline.timerange.kind",e),l={linkTo:Object(u.get)("socTrends.linkTo",e)},d=Object(u.get)("socTrends.timerange.kind",e);if(a&&(Object(u.isEmpty)(l.linkTo)?t(c.b.removeLinkTo([s.a.global,s.a.socTrends])):t(c.b.addLinkTo([s.a.global,s.a.socTrends]))),Object(u.isEmpty)(n.linkTo)?(t(c.b.removeLinkTo([s.a.global,s.a.timeline])),a&&t(c.b.removeLinkTo([s.a.global,s.a.socTrends]))):(t(c.b.addLinkTo([s.a.global,s.a.timeline])),a&&t(c.b.addLinkTo([s.a.global,s.a.socTrends]))),Object(u.isEmpty)(r.linkTo)?t(c.b.removeLinkTo([s.a.global,s.a.timeline])):t(c.b.addLinkTo([s.a.global,s.a.timeline])),o){if("absolute"===o){const a=Object(p.a)(Object(u.get)("timeline.timerange",e));t(c.b.setAbsoluteRangeDatePicker({...a,id:s.a.timeline}))}if("relative"===o){const a=Object(p.a)(Object(u.get)("timeline.timerange",e));a.from=Object(m.c)(a.fromStr),a.to=Object(m.c)(a.toStr,{roundUp:!0}),t(c.b.setRelativeRangeDatePicker({...a,id:s.a.timeline}))}}if(i){if("absolute"===i){const a=Object(p.a)(Object(u.get)("global.timerange",e));t(c.b.setAbsoluteRangeDatePicker({...a,id:s.a.global}))}if("relative"===i){const a=Object(p.a)(Object(u.get)("global.timerange",e));a.from=Object(m.c)(a.fromStr),a.to=Object(m.c)(a.toStr,{roundUp:!0}),t(c.b.setRelativeRangeDatePicker({...a,id:s.a.global}))}}if(a&&d){if("absolute"===d){const a=Object(p.a)(Object(u.get)("socTrends.timerange",e));t(c.b.setAbsoluteRangeDatePicker({...a,id:s.a.socTrends}))}if("relative"===d){const a=Object(p.a)(Object(u.get)("socTrends.timerange",e));a.from=Object(m.c)(a.fromStr),a.to=Object(m.c)(a.toStr,{roundUp:!0}),t(c.b.setRelativeRangeDatePicker({...a,id:s.a.socTrends}))}}}})(a,e,t)),[e,t]);Object(n.b)(I.timerange,a)})(),(()=>{const[{pageName:e}]=Object(y.a)(),t=Object(i.useDispatch)(),a=g()(e),n=Object(r.useMemo)((()=>l.d.inputsSelector()),[]),o=Object(i.useSelector)(n),{timerange:u}=o.global,{timerange:d}=o.timeline;Object(r.useEffect)((()=>{((e,t)=>e&&t&&t!==e&&Object(f.d)(e))(e,a)&&("relative"===d.kind&&t(c.b.setRelativeRangeDatePicker({...d,from:Object(m.c)(d.fromStr),to:Object(m.c)(d.toStr,{roundUp:!0}),id:s.a.timeline})),"relative"===u.kind&&t(c.b.setRelativeRangeDatePicker({...u,from:Object(m.c)(u.fromStr),to:Object(m.c)(u.toStr,{roundUp:!0}),id:s.a.global})))}),[e,a,t,d,u])})(),(()=>{const e=Object(i.useDispatch)(),t=Object(r.useCallback)((t=>{null!=t&&Object(h.h)({activeTimelineTab:t.activeTab,duplicate:!1,graphEventId:t.graphEventId,timelineId:t.id,openTimeline:t.isOpen,updateIsLoading:t=>e(v.a.updateIsLoading(t)),updateTimeline:Object(h.b)(e)})}),[e]);Object(n.b)(I.timeline,t)})(),(()=>{const e=Object(n.d)(I.timeline),t=Object(r.useMemo)((()=>v.b.getTimelineByIdSelector()),[]),{activeTab:a,graphEventId:i,show:s,savedObjectId:o}=Object(x.b)((e=>{var a;return null!==(a=t(e,E.f.active))&&void 0!==a?a:{}}));Object(r.useEffect)((()=>{const t={...o?{id:o}:{},isOpen:s,activeTab:a,graphEventId:null!=i?i:""};e(t)}),[a,i,o,s,e])})(),(()=>{var e;const t=Object(r.useMemo)((()=>v.b.getTimelineByIdSelector()),[]),a=Object(x.b)((e=>t(e,E.f.active))),{search:n}=Object(j.useLocation)(),s=g()(n),o=null!==(e=null==a?void 0:a.savedObjectId)&&void 0!==e?e:"",l=Object(i.useDispatch)(),[c,u]=Object(r.useMemo)((()=>{const e=k({urlKey:I.timeline,search:null!=s?s:""}),t=k({urlKey:I.timeline,search:n});return null!=e&&null!=t?[Object(S.safeDecode)(e),Object(S.safeDecode)(t)]:[null,null]}),[s,n]),d=null==c?void 0:c.id,{id:p,activeTab:m,graphEventId:b}=u||{};Object(r.useEffect)((()=>{p&&p!==d&&p!==o&&Object(h.h)({activeTimelineTab:null!=m?m:E.g.query,duplicate:!1,graphEventId:b,timelineId:p,openTimeline:!0,updateIsLoading:e=>l(v.a.updateIsLoading(e)),updateTimeline:Object(h.b)(l)})}),[o,l,d,p,m,b])})(),(()=>{const[e]=Object(o.p)(w.lb),[t,a]=Object(r.useState)(null),[s,l]=Object(r.useState)(!1),c=Object(i.useDispatch)(),u=O.j.getTableByIdSelector(),d=Object(x.b)((e=>{var t;return null!==(t=u(e,O.e.alertsOnAlertsPage))&&void 0!==t?t:O.q})),p=Object(r.useCallback)((t=>{!e&&null!=t&&t.panelView&&a(t)}),[e]),m=Object(r.useCallback)((()=>{const{initialized:a,isLoading:n,totalCount:i,additionalFilters:r}=d,s=a&&!n&&i>0;!e&&t&&(r&&r.showBuildingBlockAlerts||c(O.h.updateShowBuildingBlockAlertsFilter({id:O.e.alertsOnAlertsPage,showBuildingBlockAlerts:!0})),s&&(l(!0),c(O.h.toggleDetailPanel({id:O.e.alertsOnAlertsPage,...t}))))}),[d,c,e,t]);Object(r.useEffect)((()=>{s||m()}),[s,m]);const b=e?"":I.eventFlyout;Object(n.b)(b,p)})(),(()=>{const e=Object(n.d)(I.eventFlyout),{pathname:t}=Object(j.useLocation)(),a=Object(i.useDispatch)(),s=O.j.getTableByIdSelector(),{expandedDetail:o}=Object(x.b)((e=>{var t;return null!==(t=s(e,O.e.alertsOnAlertsPage))&&void 0!==t?t:O.q}));Object(r.useEffect)((()=>{var n;const i=t===w.d;i&&null!=o&&null!=o&&o.query?e(o.query.panelView?o.query:null):!i&&null!=o&&null!==(n=o.query)&&void 0!==n&&n.panelView&&(a(O.h.toggleDetailPanel({id:O.e.alertsOnAlertsPage})),e(null))}),[a,o,t,e])})()};let I;!function(e){e.appQuery="query",e.eventFlyout="eventFlyout",e.filters="filters",e.savedQuery="savedQuery",e.sourcerer="sourcerer",e.timeline="timeline",e.timerange="timerange",e.pageFilter="pageFilters",e.rulesTable="rulesTable"}(I||(I={}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return y}));var n=a(104),i=a.n(n),r=a(220),s=a(53),o=a.n(s),l=a(2),c=a.n(l),u=a(41),d=a.n(u),p=a(309),m=a(178),b=a(168);const g=d.a.div.withConfig({displayName:"Wrapper",componentId:"sc-1kulm59-0"})(["&.securitySolutionWrapper--fullHeight{height:100%;display:flex;flex-direction:column;flex:1 1 auto;}&.securitySolutionWrapper--noPadding{padding:0;display:flex;flex-direction:column;flex:1 1 auto;}"]);g.displayName="Wrapper";const f=({children:e,className:t,style:a,noPadding:n,noTimeline:s,...u})=>{const{isAssistantEnabled:d,hasAssistantPrivilege:f}=Object(p.a)(),{globalFullScreen:y,setGlobalFullScreen:h}=Object(m.a)();Object(l.useEffect)((()=>{h(!1)}),[h]);const v=o()(t,{securitySolutionWrapper:!0,"securitySolutionWrapper--noPadding":n,"securitySolutionWrapper--withTimeline":!s,"securitySolutionWrapper--fullHeight":y});return c.a.createElement(g,i()({className:v,style:a},u),e,c.a.createElement(b.a,null),f&&c.a.createElement(r.c,{isAssistantEnabled:d}))},y=c.a.memo(f)},function(e,t,a){"use strict";a.d(t,"j",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"K",(function(){return s})),a.d(t,"e",(function(){return o})),a.d(t,"N",(function(){return l})),a.d(t,"M",(function(){return c})),a.d(t,"L",(function(){return u})),a.d(t,"E",(function(){return d})),a.d(t,"D",(function(){return p})),a.d(t,"F",(function(){return m})),a.d(t,"C",(function(){return b})),a.d(t,"B",(function(){return g})),a.d(t,"m",(function(){return f})),a.d(t,"l",(function(){return y})),a.d(t,"k",(function(){return h})),a.d(t,"H",(function(){return v})),a.d(t,"G",(function(){return E})),a.d(t,"I",(function(){return x})),a.d(t,"n",(function(){return j})),a.d(t,"o",(function(){return S})),a.d(t,"u",(function(){return k})),a.d(t,"w",(function(){return O})),a.d(t,"p",(function(){return w})),a.d(t,"q",(function(){return T})),a.d(t,"s",(function(){return I})),a.d(t,"t",(function(){return C})),a.d(t,"r",(function(){return M})),a.d(t,"v",(function(){return _})),a.d(t,"J",(function(){return F})),a.d(t,"i",(function(){return A})),a.d(t,"g",(function(){return D})),a.d(t,"f",(function(){return N})),a.d(t,"h",(function(){return P})),a.d(t,"c",(function(){return R})),a.d(t,"b",(function(){return L})),a.d(t,"d",(function(){return B})),a.d(t,"x",(function(){return q})),a.d(t,"z",(function(){return z})),a.d(t,"y",(function(){return $})),a.d(t,"A",(function(){return V}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.flyout.entitiesNoDataMessage",{defaultMessage:"Host and user information are unavailable for this alert."}),r=n.i18n.translate("xpack.securitySolution.flyout.analyzerErrorMessage",{defaultMessage:"analyzer"}),s=n.i18n.translate("xpack.securitySolution.flyout.sessionViewErrorMessage",{defaultMessage:"session view"}),o=n.i18n.translate("xpack.securitySolution.flyout.correlationsErrorMessage",{defaultMessage:"No correlations data available"}),l=n.i18n.translate("xpack.securitySolution.flyout.entities.userTitle",{defaultMessage:"User"}),c=n.i18n.translate("xpack.securitySolution.flyout.entities.userPrevalenceColumTitleTooltip",{defaultMessage:"Percentage of unique users with identical field value pairs"}),u=n.i18n.translate("xpack.securitySolution.flyout.entities.usersInfoTitle",{defaultMessage:"User information"}),d=n.i18n.translate("xpack.securitySolution.flyout.entities.relatedHostsTitle",{defaultMessage:"Related hosts"}),p=n.i18n.translate("xpack.securitySolution.flyout.entities.relatedHostsTableNoData",{defaultMessage:"No hosts identified"}),m=e=>n.i18n.translate("xpack.securitySolution.flyout.entities.relatedHostsToolTip",{defaultMessage:"After this alert was generated, {userName} logged into these hosts. Check if this activity is normal.",values:{userName:e}}),b=n.i18n.translate("xpack.securitySolution.flyout.entities.relatedEntitiesNameColumn",{defaultMessage:"Name"}),g=n.i18n.translate("xpack.securitySolution.flyout.entities.relatedEntitiesIpColumn",{defaultMessage:"Ip addresses"}),f=n.i18n.translate("xpack.securitySolution.flyout.entities.hostTitle",{defaultMessage:"Host"}),y=n.i18n.translate("xpack.securitySolution.flyout.entities.hostPrevalenceColumTitleTooltip",{defaultMessage:"Percentage of unique hosts with identical field value pairs"}),h=n.i18n.translate("xpack.securitySolution.flyout.entities.hostsInfoTitle",{defaultMessage:"Host information"}),v=n.i18n.translate("xpack.securitySolution.flyout.entities.relatedUsersTitle",{defaultMessage:"Related users"}),E=n.i18n.translate("xpack.securitySolution.flyout.entities.relatedUsersTableNoData",{defaultMessage:"No users identified"}),x=e=>n.i18n.translate("xpack.securitySolution.flyout.entities.relatedUsersToolTip",{defaultMessage:"After this alert was generated, these users logged into {hostName}. Check if this activity is normal.",values:{hostName:e}}),j=n.i18n.translate("xpack.securitySolution.flyout.prevalenceErrorMessage",{defaultMessage:"prevalence"}),S=n.i18n.translate("xpack.securitySolution.flyout.prevalenceNoDataMessage",{defaultMessage:"No prevalence data available"}),k=n.i18n.translate("xpack.securitySolution.flyout.prevalenceTableFieldColumnTitle",{defaultMessage:"Field"}),O=n.i18n.translate("xpack.securitySolution.flyout.prevalenceTableValueColumnTitle",{defaultMessage:"Value"}),w=n.i18n.translate("xpack.securitySolution.flyout.prevalenceTableAlertCountColumnTitle",{defaultMessage:"Alert"}),T=n.i18n.translate("xpack.securitySolution.flyout.prevalenceTableAlertCountColumnTitleTooltip",{defaultMessage:"Total number of alerts with identical field value pairs"}),I=n.i18n.translate("xpack.securitySolution.flyout.prevalenceTableDocCountColumnTitle",{defaultMessage:"Document"}),C=n.i18n.translate("xpack.securitySolution.flyout.prevalenceTableDocCountColumnTitleTooltip",{defaultMessage:"Total number of event documents with identical field value pairs"}),M=n.i18n.translate("xpack.securitySolution.flyout.prevalenceTableCountColumnTitle",{defaultMessage:"count"}),_=n.i18n.translate("xpack.securitySolution.flyout.prevalenceTablePrevalenceColumnTitle",{defaultMessage:"prevalence"}),F=n.i18n.translate("xpack.securitySolution.flyout.response.title",{defaultMessage:"Responses"}),A=n.i18n.translate("xpack.securitySolution.flyout.correlations.timestampColumnTitle",{defaultMessage:"Timestamp"}),D=n.i18n.translate("xpack.securitySolution.flyout.correlations.ruleColumnTitle",{defaultMessage:"Rule"}),N=n.i18n.translate("xpack.securitySolution.flyout.correlations.reasonColumnTitle",{defaultMessage:"Reason"}),P=n.i18n.translate("xpack.securitySolution.flyout.correlations.severityColumnTitle",{defaultMessage:"Severity"}),R=n.i18n.translate("xpack.securitySolution.flyout.correlations.statusColumnTitle",{defaultMessage:"Status"}),L=n.i18n.translate("xpack.securitySolution.flyout.correlations.caseNameColumnTitle",{defaultMessage:"Name"}),B=n.i18n.translate("xpack.securitySolution.flyout.correlations.correlationsDetailsTableFilter",{defaultMessage:"Correlations Details Table Alert IDs"}),q=n.i18n.translate("xpack.securitySolution.flyout.correlations.relatedAlertsByAncestryNoData",{defaultMessage:"No alerts related by ancestry"}),z=n.i18n.translate("xpack.securitySolution.flyout.correlations.relatedAlertsBySourceEventNoData",{defaultMessage:"No related source events"}),$=n.i18n.translate("xpack.securitySolution.flyout.correlations.relatedAlertsBySessionNoData",{defaultMessage:"No alerts related by session"}),V=n.i18n.translate("xpack.securitySolution.flyout.correlations.relatedCasesNoData",{defaultMessage:"No related cases"})},function(e,t,a){"use strict";a.d(t,"b",(function(){return E})),a.d(t,"g",(function(){return x})),a.d(t,"d",(function(){return j})),a.d(t,"e",(function(){return S})),a.d(t,"f",(function(){return k})),a.d(t,"i",(function(){return O})),a.d(t,"h",(function(){return w})),a.d(t,"a",(function(){return I})),a.d(t,"c",(function(){return C}));var n=a(40),i=a(44),r=a(42),s=a(2),o=a.n(s),l=a(41),c=a.n(l),u=a(165),d=a(153),p=a(121),m=a(117),b=(a(132),a(123)),g=a(168),f=a(364),y=a(110),h=a(658);const v=c()(n.EuiFlexGroup).withConfig({displayName:"DraggableContainerFlexGroup",componentId:"sc-17s23cb-0"})(["flex-grow:unset;"]),E="ip-overview",x=(e,t,a,i)=>e.length>0&&e.every((e=>Object(r.getOr)(null,e,t)))?o.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},e.map(((e,l)=>{const c=Object(r.getOr)("",e,t);return o.a.createElement(s.Fragment,{key:`${E}-${e}`},l?", ":"",o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(p.b,{id:`location-renderer-default-draggable-${E}-${a?`${a}-`:""}${e}`,isDraggable:null!=i&&i,field:e,value:c,isAggregatable:!0,fieldType:"keyword"})))}))):Object(m.d)(),j=(e,t,a,i)=>e&&e.organization&&e.organization.name&&e.number?o.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(p.b,{id:`autonomous-system-renderer-default-draggable-${E}-${a?`${a}-`:""}${t}.as.organization.name`,isDraggable:null!=i&&i,field:`${t}.as.organization.name`,value:e.organization.name})),o.a.createElement(n.EuiFlexItem,{grow:!1},"/"),o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(p.b,{id:`autonomous-system-renderer-default-draggable-${E}-${a?`${a}-`:""}${t}.as.number`,isDraggable:!1,field:`${t}.as.number`,value:`${e.number}`,isAggregatable:!0,fieldType:"number"}))):Object(m.d)(),S=({contextID:e,host:t,isDraggable:a=!1,ipFilter:n,noLink:i})=>t.id&&t.ip&&(null==n||t.ip.includes(n))?o.a.createElement(o.a.Fragment,null,t.name&&null!=t.name[0]?o.a.createElement(p.b,{id:`host-id-renderer-default-draggable-${E}-${e?`${e}-`:""}host-id`,isDraggable:a,field:"host.id",value:t.id[0],isAggregatable:!0,fieldType:"keyword"},i?o.a.createElement(o.a.Fragment,null,t.id):o.a.createElement(b.d,{hostName:t.name[0]},t.id)):o.a.createElement(o.a.Fragment,null,t.id)):Object(m.d)(),k=(e,t,a,n)=>e&&e.name&&e.name[0]&&e.ip&&(null==t||e.ip.includes(t))?o.a.createElement(p.b,{id:`host-name-renderer-default-draggable-${E}-${a?`${a}-`:""}host-name`,isDraggable:null!=n&&n,field:"host.name",value:e.name[0],isAggregatable:!0,fieldType:"keyword"},o.a.createElement(b.d,{hostName:e.name[0]},e.name?e.name:Object(m.d)())):Object(m.d)(),O=e=>o.a.createElement(b.n,{domain:e},f.n),w=e=>o.a.createElement(b.j,{domain:e,direction:"column"}),T=({attrName:e,displayCount:t=1,idPrefix:a,isDraggable:i=!1,moreMaxHeight:r="200px",render:s,rowItems:l,sourcererScopeId:c})=>{if(null!=l&&l.length>0){const u=l.slice(0,t).map(((t,r)=>{const l=Object(d.i)(`default-field-renderer-default-draggable-${a}-${e}-${t}`);return o.a.createElement(n.EuiFlexItem,{key:l,grow:!1},0!==r&&o.a.createElement(o.a.Fragment,null,",",o.a.createElement(g.i,null)),"string"==typeof t&&o.a.createElement(p.b,{id:l,isDraggable:i,field:e,value:t,isAggregatable:!0,fieldType:"keyword"},s?s(t):t))}));return u.length>0?o.a.createElement(v,{alignItems:"center",gutterSize:"none",component:"span","data-test-subj":"DefaultFieldRendererComponent"},o.a.createElement(n.EuiFlexItem,{grow:!1},u," "),o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(M,{attrName:e,idPrefix:a,moreMaxHeight:r,overflowIndexStart:t,render:s,rowItems:l,sourcererScopeId:c}))):Object(m.d)()}return Object(m.d)()},I=o.a.memo(T);I.displayName="DefaultFieldRenderer";const C=o.a.memo((({fieldName:e,idPrefix:t,moreMaxHeight:a,overflowIndexStart:i,render:r,values:l,sourcererScopeId:c})=>{const{timelineId:p}=Object(s.useContext)(h.b),b=Object(s.useMemo)((()=>l.slice(i).reduce(((a,i,s)=>{const l=Object(d.i)(`${t}-${e}-${i}-${s}`);return"string"==typeof i&&null!=e&&a.push(o.a.createElement(n.EuiFlexItem,{key:l},o.a.createElement(u.c,{key:l,mode:u.a.HOVER_DOWN,visibleCellActions:5,showActionTooltips:!0,triggerId:u.d.DEFAULT,data:{value:i,field:e},sourcererScopeId:null!=c?c:y.SourcererScopeName.default,metadata:{scopeId:null!=p?p:void 0}},o.a.createElement(o.a.Fragment,null,r?r(i):Object(m.a)(i))))),a}),[])),[l,i,t,e,p,r,c]);return o.a.createElement("div",{"data-test-subj":"more-container",className:"eui-yScroll",style:{maxHeight:a,paddingRight:"2px"}},o.a.createElement(n.EuiFlexGroup,{gutterSize:"s",direction:"column","data-test-subj":"overflow-items"},b))}));C.displayName="MoreContainer";const M=o.a.memo((({attrName:e,idPrefix:t,moreMaxHeight:a,overflowIndexStart:r=5,render:l,rowItems:c,sourcererScopeId:u})=>{const[d,p]=Object(s.useState)(!1),m=Object(s.useCallback)((()=>p((e=>!e))),[]),b=Object(s.useMemo)((()=>o.a.createElement(o.a.Fragment,null," ,",o.a.createElement(n.EuiButtonEmpty,{size:"xs",onClick:m,"data-test-subj":"DefaultFieldRendererOverflow-button"},`+${c.length-r} `,o.a.createElement(i.FormattedMessage,{id:"xpack.securitySolution.fieldRenderers.moreLabel",defaultMessage:"More"})))),[m,r,c.length]);return o.a.createElement(n.EuiFlexItem,{grow:!1},c.length>r&&o.a.createElement(n.EuiPopover,{id:"popover",button:b,isOpen:d,closePopover:m,repositionOnScroll:!0,panelClassName:"withHoverActions__popover"},o.a.createElement(C,{fieldName:e,idPrefix:t,render:l,values:c,moreMaxHeight:a,overflowIndexStart:r,sourcererScopeId:u})))}));M.displayName="DefaultFieldRendererOverflow"},function(e,t,a){"use strict";a.d(t,"c",(function(){return c})),a.d(t,"b",(function(){return u})),a.d(t,"d",(function(){return d})),a.d(t,"a",(function(){return p}));var n=a(5),i=a(113);const r=n.i18n.translate("xpack.securitySolution.riskScore.overview.hostTitle",{defaultMessage:"Host"}),s=n.i18n.translate("xpack.securitySolution.riskScore.overview.hosts",{defaultMessage:"Hosts"}),o=n.i18n.translate("xpack.securitySolution.riskScore.overview.userTitle",{defaultMessage:"User"}),l=n.i18n.translate("xpack.securitySolution.riskScore.overview.users",{defaultMessage:"Users"}),c=e=>n.i18n.translate("xpack.securitySolution.riskScore.overview.riskScoreTitle",{defaultMessage:"{riskEntity} Risk Score",values:{riskEntity:d(e)}}),u=e=>n.i18n.translate("xpack.securitySolution.entityAnalytics.riskDashboard.riskClassificationTitle",{defaultMessage:"{riskEntity} risk classification",values:{riskEntity:d(e)}}),d=(e,t=!1,a=!1)=>t?a?(e===i.w.host?s:l).toLowerCase():(e===i.w.host?r:o).toLowerCase():a?e===i.w.host?s:l:e===i.w.host?r:o,p=n.i18n.translate("xpack.securitySolution.riskScore.overview.alerts",{defaultMessage:"Alerts"})},,function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"c",(function(){return i})),a.d(t,"d",(function(){return g})),a.d(t,"b",(function(){return h}));var n={};a.r(n),a.d(n,"registerProvider",(function(){return o})),a.d(n,"unRegisterProvider",(function(){return l})),a.d(n,"noProviderFound",(function(){return c}));var i={};a.r(i),a.d(i,"getDataProvidersSelector",(function(){return p}));var r=a(22);const s=a.n(r)()("x-pack/security_solution/local/drag_and_drop"),o=s("REGISTER_PROVIDER"),l=s("UNREGISTER_PROVIDER"),c=s("NO_PROVIDER_FOUND");var u=a(139);const d=e=>e.dragAndDrop.dataProviders,p=()=>Object(u.createSelector)(d,(e=>e));var m=a(42),b=a(208);const g={dataProviders:{}},f=({provider:e,dataProviders:t})=>({...t,[e.id]:e}),y=({id:e,dataProviders:t})=>Object(m.omit)(e,t),h=Object(b.reducerWithInitialState)(g).case(o,((e,{provider:t})=>({...e,dataProviders:f({provider:t,dataProviders:e.dataProviders})}))).case(l,((e,{id:t})=>({...e,dataProviders:y({id:t,dataProviders:e.dataProviders})}))).build()},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"c",(function(){return s})),a.d(t,"a",(function(){return o}));var n=a(42);const i=e=>{var t;return Boolean(null===(t=e.Endpoint.state)||void 0===t?void 0:t.isolation)},r=["http:","https:"],s=e=>{try{if(null!=e){if(""===e)return!1;{const t=new URL(e);if(r.includes(t.protocol)&&e.startsWith(`${t.protocol}//`))return!1}}}catch(e){}return!0};function o(e){return Object(n.isNumber)(e)||!Object(n.isEmpty)(e)}},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(2),i=a.n(n),r=a(40),s=a(41);const o=a.n(s)()(r.EuiText).withConfig({displayName:"CodeBlock",componentId:"sc-s548fn-0"})(["font-family:",";"],(e=>e.theme.eui.euiCodeFontFamily)),l=Object(n.memo)((({children:e,inline:t=!1,textColor:a="default",bold:n=!1})=>i.a.createElement(o,{size:"relative",color:a,className:t?"eui-displayInline":""},n?i.a.createElement("strong",null,e):e)));l.displayName="ConsoleCodeBlock"},function(e,t,a){"use strict";a.d(t,"k",(function(){return i})),a.d(t,"j",(function(){return r})),a.d(t,"l",(function(){return s})),a.d(t,"c",(function(){return o})),a.d(t,"b",(function(){return l})),a.d(t,"a",(function(){return c})),a.d(t,"m",(function(){return u})),a.d(t,"h",(function(){return d})),a.d(t,"n",(function(){return p})),a.d(t,"e",(function(){return m})),a.d(t,"i",(function(){return b})),a.d(t,"d",(function(){return g})),a.d(t,"p",(function(){return f})),a.d(t,"o",(function(){return y})),a.d(t,"f",(function(){return h})),a.d(t,"g",(function(){return v}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.visualizationActions.moreActions",{defaultMessage:"More actions"}),r=n.i18n.translate("xpack.securitySolution.visualizationActions.inspect",{defaultMessage:"Inspect"}),s=n.i18n.translate("xpack.securitySolution.visualizationActions.openInLens",{defaultMessage:"Open in Lens"}),o=n.i18n.translate("xpack.securitySolution.visualizationActions.addToNewCase",{defaultMessage:"Add to new case"}),l=n.i18n.translate("xpack.securitySolution.visualizationActions.addToExistingCase",{defaultMessage:"Add to existing case"}),c=n.i18n.translate("xpack.securitySolution.visualizationActions.addToCaseSuccessContent",{defaultMessage:"Successfully added visualization to the case"}),u=n.i18n.translate("xpack.securitySolution.visualizationActions.uniqueIps.sourceChartLabel",{defaultMessage:"Src."}),d=n.i18n.translate("xpack.securitySolution.visualizationActions.uniqueIps.destinationChartLabel",{defaultMessage:"Dest."}),p=n.i18n.translate("xpack.securitySolution.visualizationActions.userAuthentications.successChartLabel",{defaultMessage:"Succ."}),m=n.i18n.translate("xpack.securitySolution.visualizationActions.userAuthentications.authentication.successChartLabel",{defaultMessage:"Success"}),b=n.i18n.translate("xpack.securitySolution.visualizationActions.userAuthentications.failChartLabel",{defaultMessage:"Fail"}),g=n.i18n.translate("xpack.securitySolution.visualizationActions.userAuthentications.authentication.failureChartLabel",{defaultMessage:"Failure"}),f=e=>n.i18n.translate("xpack.securitySolution.visualizationActions.uniqueCountLabel",{values:{field:e},defaultMessage:"Unique count of {field}"}),y=e=>n.i18n.translate("xpack.securitySolution.visualizationActions.topValueLabel",{values:{field:e},defaultMessage:"Top values of {field}"}),h=n.i18n.translate("xpack.securitySolution.visualizationActions.countLabel",{defaultMessage:"Count of records"}),v=e=>n.i18n.translate("xpack.securitySolution.visualizationActions.countOfFieldLabel",{values:{field:e},defaultMessage:"Count of {field}"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=e=>e.capabilities.canGetJobs&&e.capabilities.canGetDatafeeds&&e.capabilities.canGetCalendars},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(4);const i={ADD_EXCEPTION_FLYOUT:`${n.l} fetchAlerts addExceptionFlyout`,ALERTS_COUNT_BY_STATUS:`${n.l} fetchAlerts byRulebyCount`,ALERTS_GROUPING:`${n.l} fetchAlerts grouping`,BY_ID:`${n.l} fetchAlerts byId`,BY_RULE_BY_STATUS:`${n.l} fetchAlerts byRulebyStatus`,BY_RULE_ID:`${n.l} fetchAlerts byRuleId`,BY_SEVERITY:`${n.l} fetchAlerts bySeverity`,BY_STATUS:`${n.l} fetchAlerts byStatus`,CASES:`${n.l} fetchAlerts cases`,COUNT:`${n.l} fetchAlerts count`,HISTOGRAM:`${n.l} fetchAlerts histogram`,PREVALENCE:`${n.l} fetchAlerts prevalence`,SOC_TRENDS:`${n.l} fetchAlerts socTrends`,TREE_MAP:`${n.l} fetchAlerts treeMap`,VULNERABLE_HOSTS:`${n.l} fetchAlerts vulnerableHosts`,VULNERABLE_USERS:`${n.l} fetchAlerts vulnerableUsers`}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(8),i=a(2),r=a(239),s=a(303);const o=({fetchMethod:e=r.e,query:t,indexName:a,skip:o,queryName:l})=>{const[c,u]=Object(i.useState)(t),[d,p]=Object(i.useState)({data:null,response:"",request:"",setQuery:u,refetch:null}),[m,b]=Object(i.useState)(!1),g=((e,t)=>{const{startTracking:a}=Object(s.a)();return Object(i.useMemo)((()=>async n=>{const{endTracking:i}=a({name:t});let r;try{r=await e(n),i("success")}catch(e){throw i(n.signal.aborted?"aborted":"error"),e}return r}),[e,t,a])})(e,l);return Object(i.useEffect)((()=>{let e=!0;const t=new AbortController,i=async()=>{try{b(!0);const r=await g({query:c,signal:t.signal});var n;e&&p({data:r,response:JSON.stringify(r,null,2),request:JSON.stringify({index:null!==(n=[a])&&void 0!==n?n:[""],body:c},null,2),setQuery:u,refetch:i})}catch(t){e&&p({data:null,response:"",request:"",setQuery:u,refetch:i})}e&&b(!1)};return Object(n.isEmpty)(c)||o||i(),o&&(b(!1),e=!1,t.abort()),()=>{e=!1,t.abort()}}),[c,a,o,g]),{loading:m,...d}}},function(e,t,a){"use strict";a.d(t,"d",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"b",(function(){return o}));var n=a(5);const i=n.i18n.translate("xpack.elasticAssistant.assistant.useConversation.welcomeConversationTitle",{defaultMessage:"Welcome"}),r=n.i18n.translate("xpack.elasticAssistant.assistant.useConversation.defaultConversationTitle",{defaultMessage:"Default"}),s=n.i18n.translate("xpack.elasticAssistant.assistant.useConversation.elasticAiAssistantTitle",{defaultMessage:"Elastic AI Assistant"}),o=n.i18n.translate("xpack.elasticAssistant.assistant.useConversation.elasticAiAssistantName",{defaultMessage:"Assistant"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return h})),a.d(t,"b",(function(){return v}));var n=a(41),i=a.n(n),r=(a(21),a(2)),s=a.n(r),o=a(40),l=a(1072),c=a(348),u=a(186),d=a(266),p=a(175),m=a(4),b=a(110),g=a(116),f=a(282);const y=Object(r.createContext)(void 0),h=({id:e,indexName:t,scopeId:a,children:n})=>{var i;const h=Object(d.a)(),v=t?null!==(i=Object(u.a)(t,h))&&void 0!==i?i:t:"",[{pageName:x}]=Object(p.a)(),j=x===m.wc.detections?b.SourcererScopeName.detections:b.SourcererScopeName.default,S=Object(g.d)(j),[k,O,w,T]=Object(c.a)({indexName:v,eventId:null!=e?e:"",runtimeMappings:S.runtimeMappings,skip:!e}),I=Object(l.a)(null==w?void 0:w.fields),{ruleId:C}=Object(u.b)(O),{rule:M}=Object(f.a)(C),_=Object(r.useMemo)((()=>{var n;return e&&t&&a?{eventId:e,indexName:t,scopeId:a,browserFields:S.browserFields,dataAsNestedObject:T,dataFormattedForFieldBrowser:O,searchHit:w,investigationFields:null!==(n=null==M?void 0:M.investigation_fields)&&void 0!==n?n:[],getFieldsData:I}:void 0}),[e,t,a,S.browserFields,T,O,w,null==M?void 0:M.investigation_fields,I]);return k?s.a.createElement(E,null,s.a.createElement(o.EuiLoadingSpinner,{size:"xxl"})):s.a.createElement(y.Provider,{value:_},n)},v=()=>{const e=Object(r.useContext)(y);if(!e)throw new Error("LeftPanelContext can only be used within LeftPanelContext provider");return e};var E=i()(o.EuiFlexItem).withConfig({displayName:"_StyledEuiFlexItem",componentId:"sc-1xv2erz-0"})(["align-items:center;justify-content:center;"])},function(e,t,a){"use strict";a.d(t,"e",(function(){return r})),a.d(t,"f",(function(){return s})),a.d(t,"i",(function(){return o})),a.d(t,"g",(function(){return l})),a.d(t,"h",(function(){return c})),a.d(t,"k",(function(){return u})),a.d(t,"l",(function(){return d})),a.d(t,"j",(function(){return p})),a.d(t,"d",(function(){return m})),a.d(t,"c",(function(){return b})),a.d(t,"n",(function(){return g})),a.d(t,"b",(function(){return f})),a.d(t,"a",(function(){return y})),a.d(t,"m",(function(){return h})),a.d(t,"o",(function(){return v}));var n=a(5),i=a(225);a.d(t,"p",(function(){return i.c}));const r=n.i18n.translate("xpack.securitySolution.eventDetails.ctiSummary.feedNamePreposition",{defaultMessage:"from"}),s=n.i18n.translate("xpack.securitySolution.eventDetails.ctiSummary.indicatorEnrichmentTitle",{defaultMessage:"Threat match detected"}),o=n.i18n.translate("xpack.securitySolution.eventDetails.ctiSummary.investigationEnrichmentTitle",{defaultMessage:"Enriched with threat intelligence"}),l=n.i18n.translate("xpack.securitySolution.eventDetails.ctiSummary.indicatorEnrichmentTooltipContent",{defaultMessage:"Shows available threat indicator matches."}),c=n.i18n.translate("xpack.securitySolution.eventDetails.ctiSummary.informationAriaLabel",{defaultMessage:"Information"}),u=n.i18n.translate("xpack.securitySolution.eventDetails.ctiSummary.investigationEnrichmentTooltipContent",{defaultMessage:"Shows additional threat intelligence for the alert. The past 30 days were queried by default."}),d=(n.i18n.translate("xpack.securitySolution.alertDetails.noInvestigationEnrichmentsDescription",{defaultMessage:"This alert does not have supplemental threat intelligence data."}),n.i18n.translate("xpack.securitySolution.alertDetails.noEnrichmentsFoundDescription",{defaultMessage:"This alert does not have threat intelligence."})),p=n.i18n.translate("xpack.securitySolution.alertDetails.investigationTimeQueryTitle",{defaultMessage:"Enrichment with Threat Intelligence"}),m=n.i18n.translate("xpack.securitySolution.alertDetails.enrichmentQueryStartDate",{defaultMessage:"Start date"}),b=n.i18n.translate("xpack.securitySolution.alertDetails.enrichmentQueryEndDate",{defaultMessage:"End date"}),g=n.i18n.translate("xpack.securitySolution.alertDetails.refresh",{defaultMessage:"Refresh"}),f=n.i18n.translate("xpack.securitySolution.alertDetails.overview.enrichedDataTitle",{defaultMessage:"Enriched data"}),y=e=>n.i18n.translate("xpack.securitySolution.alertDetails.overview.hostRiskClassification",{defaultMessage:"Current {riskEntity} risk classification",values:{riskEntity:Object(i.d)(e,!0)}}),h=e=>n.i18n.translate("xpack.securitySolution.alertDetails.overview.originalHostRiskClassification",{defaultMessage:"Original {riskEntity} risk classification",values:{riskEntity:Object(i.d)(e,!0)}}),v=e=>n.i18n.translate("xpack.securitySolution.alertDetails.overview.hostRiskDataTitle",{defaultMessage:"{riskEntity} Risk Data",values:{riskEntity:Object(i.d)(e)}})},function(e,t,a){"use strict";e.exports=function(e){return-2===e||-1===e||32===e}},function(e,t,a){"use strict";a.d(t,"a",(function(){return M})),a.d(t,"c",(function(){return _})),a.d(t,"b",(function(){return L}));var n=a(43),i=a(493);const r=n.type({command:n.keyof((s=i.a,Object.fromEntries(s.map((e=>[e,null]))))),comment:n.union([n.string,n[void 0]])});var s;const o=n.string,l=(n.union([o,n[void 0]]),n.type({agents:n.array(n.string),allAgentsSelected:n.boolean,platformsSelected:n.array(n.string),policiesSelected:n.array(n.string)})),c=(n.union([l,n[void 0]]),n.string),u=(n.union([c,n[void 0]]),n.string),d=n.union([u,n[void 0]]),p=n.string,m=(n.union([p,n[void 0]]),n.string),b=n.union([m,n[void 0]]),g=n.string,f=(n.union([g,n[void 0]]),n.boolean),y=n.union([f,n[void 0]]),h=n.boolean,v=n.union([h,n[void 0]]),E=n.string,x=n.union([E,n[void 0]]),j=n.string,S=(n.union([j,n[void 0]]),n.type({name:n.union([n.string,n[void 0]]),url:n.union([n.string,n[void 0]])})),k=(n.union([S,n[void 0]]),n.record(n.string,n.partial({field:n.string,value:n.union([n.string,n.array(n.string)])}))),O=n.union([k,n[void 0]]),w=(n.union([n.array(n.string),n[void 0]]),n.array(n.type({id:o,query:p,ecs_mapping:O,version:b,platform:d,removed:v,snapshot:y}))),T=n.record(n.string,n.type({query:p,id:o,ecs_mapping:O,version:b,platform:d,saved_query_id:x,removed:v,snapshot:y})),I=(n.union([w,T]),n.union([w,n[void 0]]),n.type({query:n.union([n.string,n[void 0]]),ecs_mapping:n.union([k,n[void 0]]),queries:n.union([w,n[void 0]]),pack_id:n.union([n.string,n[void 0]]),saved_query_id:n.union([n.string,n[void 0]])})),C=n.type({query:n.union([n.string,n[void 0]]),ecsMapping:n.union([k,n[void 0]]),queries:n.union([w,n[void 0]]),packId:n.union([n.string,n[void 0]]),savedQueryId:n.union([n.string,n[void 0]])});let M;!function(e){e.OSQUERY=".osquery",e.ENDPOINT=".endpoint"}(M||(M={}));const _=Object.values(M),F=n.strict({actionTypeId:n.literal(M.OSQUERY),params:C}),A=n.strict({actionTypeId:n.literal(M.ENDPOINT),params:r}),D=n.union([F,A]),N=(n.union([n.array(D),n[void 0]]),n.strict({action_type_id:n.literal(M.OSQUERY),params:I})),P=n.strict({action_type_id:n.literal(M.ENDPOINT),params:r}),R=n.union([N,P]),L=n.array(R)},function(e,t,a){"use strict";a.d(t,"e",(function(){return c})),a.d(t,"k",(function(){return u})),a.d(t,"j",(function(){return d})),a.d(t,"h",(function(){return p})),a.d(t,"a",(function(){return m})),a.d(t,"i",(function(){return b})),a.d(t,"d",(function(){return g})),a.d(t,"b",(function(){return f})),a.d(t,"c",(function(){return y})),a.d(t,"f",(function(){return h})),a.d(t,"g",(function(){return v}));var n=a(63),i=a(4),r=a(215),s=a(102),o=a(759),l=a(706);const c=async({query:e,signal:t})=>s.b.get().http.fetch(i.db,{method:"POST",body:JSON.stringify(e),signal:t}),u=async({query:e,status:t,signal:a})=>s.b.get().http.fetch(i.ib,{method:"POST",body:JSON.stringify({conflicts:"proceed",status:t,query:e}),signal:a}),d=async({signalIds:e,status:t,signal:a})=>s.b.get().http.fetch(i.ib,{method:"POST",body:JSON.stringify({status:t,signal_ids:e}),signal:a}),p=async({signal:e})=>s.b.get().http.fetch(i.bb,{method:"GET",signal:e}),m=async({signal:e})=>s.b.get().http.fetch(i.Z,{method:"GET",signal:e}),b=async({signal:e})=>s.b.get().http.fetch(i.cb,{method:"GET",signal:e}),g=async({signal:e})=>s.b.get().http.fetch(i.bb,{method:"POST",signal:e}),f=async({endpointId:e,comment:t="",caseIds:a})=>Object(o.a)({endpoint_ids:[e],comment:t,case_ids:a}),y=async({endpointId:e,comment:t="",caseIds:a})=>Object(o.b)({endpoint_ids:[e],comment:t,case_ids:a}),h=async({alertId:e,owner:t})=>s.b.get().http.fetch(Object(n.getCasesFromAlertsUrl)(e),{method:"get",query:{...t.length>0?{owner:t}:{}}}),v=async({agentId:e,signal:t})=>s.b.get().http.fetch(Object(l.a)(r.p,{id:e}),{method:"GET",signal:t,version:"2023-10-31"})},function(e,t,a){"use strict";var n=Number.isNaN||function(e){return"number"==typeof e&&e!=e};function i(e,t){if(e.length!==t.length)return!1;for(var a=0;a<e.length;a++)if(!((i=e[a])===(r=t[a])||n(i)&&n(r)))return!1;var i,r;return!0}e.exports=function(e,t){void 0===t&&(t=i);var a=null;function n(){for(var n=[],i=0;i<arguments.length;i++)n[i]=arguments[i];if(a&&a.lastThis===this&&t(n,a.lastArgs))return a.lastResult;var r=e.apply(this,n);return a={lastResult:r,lastArgs:n,lastThis:this},r}return n.clear=function(){a=null},n}},function(e,t,a){"use strict";a.r(t),a.d(t,"updateNote",(function(){return r})),a.d(t,"addNotes",(function(){return s})),a.d(t,"deleteNote",(function(){return o})),a.d(t,"addError",(function(){return l})),a.d(t,"removeError",(function(){return c})),a.d(t,"addErrorHash",(function(){return u}));var n=a(22);const i=a.n(n)()("x-pack/security_solution/local/app"),r=i("UPDATE_NOTE"),s=i("ADD_NOTE"),o=i("DELETE_NOTE"),l=i("ADD_ERRORS"),c=i("REMOVE_ERRORS"),u=i("ADD_ERROR_HASH")},function(e,t,a){"use strict";a.d(t,"a",(function(){return E})),a.d(t,"b",(function(){return x}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(103),l=a(40),c=a(114),u=a(190),d=a(111),p=a(178),m=a(118),b=a(106),g=a(105),f=a(138),y=a(158),h=a(110),v=a(179);const E=({timelineId:e,timelineType:t,closeGearMenu:a})=>{const n=Object(o.useDispatch)(),i=Object(r.useMemo)((()=>y.d.defaultDataViewSelector()),[]),{id:s,patternList:l}=Object(g.a)(i),{timelineFullScreen:b,setTimelineFullScreen:E}=Object(p.c)(),x=Object(g.a)(f.d.globalTimeRangeSelector),j=Object(r.useCallback)((({id:e,show:a,timeRange:i})=>{const r=null!=i?i:x;e===m.c.active&&b&&E(!1),n(y.a.setSelectedDataView({id:h.SourcererScopeName.timeline,selectedDataViewId:s,selectedPatterns:l})),n(d.a.createTimeline({columns:u.b,dataViewId:s,id:e,indexNames:l,show:a,timelineType:t})),n(d.a.setTimelineUpdatedAt({id:m.c.active,updated:void 0})),n(f.b.addLinkTo([c.a.global,c.a.timeline])),n(v.a.addNotes({notes:[]})),i&&n(f.b.removeLinkTo([c.a.timeline,c.a.global])),"absolute"===r.kind?n(f.b.setAbsoluteRangeDatePicker({...r,id:c.a.timeline})):"relative"===r.kind&&n(f.b.setRelativeRangeDatePicker({...r,id:c.a.timeline}))}),[n,x,s,l,E,b,t]);return Object(r.useCallback)((n=>{j({id:e,show:!0,timelineType:t,timeRange:null==n?void 0:n.timeRange}),"function"==typeof a&&a()}),[j,e,t,a])},x=({timelineId:e,timelineType:t,closeGearMenu:a})=>{const n=E({timelineId:e,timelineType:t,closeGearMenu:a});return{getButton:Object(r.useCallback)((({outline:e,title:a,iconType:r="plusInCircle",fill:o=!0,isDisabled:c=!1})=>{const u={iconType:r,onClick:()=>n(),fill:o},d=t===b.l.template?"template-timeline-new":"timeline-new",{fill:p,...m}=u;return e?s.a.createElement(l.EuiButton,i()({"data-test-subj":`${d}-with-border`},u),a):s.a.createElement(l.EuiButtonEmpty,i()({"data-test-subj":d,color:"text"},m),a)}),[n,t])}}},function(e,t,a){"use strict";a.d(t,"e",(function(){return i})),a.d(t,"g",(function(){return r})),a.d(t,"h",(function(){return s})),a.d(t,"j",(function(){return o})),a.d(t,"k",(function(){return l})),a.d(t,"i",(function(){return c})),a.d(t,"o",(function(){return u})),a.d(t,"n",(function(){return d})),a.d(t,"m",(function(){return p})),a.d(t,"l",(function(){return m})),a.d(t,"u",(function(){return b})),a.d(t,"t",(function(){return g})),a.d(t,"s",(function(){return f})),a.d(t,"r",(function(){return y})),a.d(t,"d",(function(){return h})),a.d(t,"b",(function(){return v})),a.d(t,"a",(function(){return E})),a.d(t,"c",(function(){return x})),a.d(t,"p",(function(){return j})),a.d(t,"q",(function(){return S})),a.d(t,"f",(function(){return k})),a.d(t,"v",(function(){return O})),a.d(t,"w",(function(){return w}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights",{defaultMessage:"Insights"}),r=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.related_alerts_by_process_ancestry",{defaultMessage:"Related alerts by process ancestry"}),s=e=>n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.related_alerts_by_process_ancestry_count",{defaultMessage:"{count} {count, plural, =1 {alert} other {alerts}} by process ancestry",values:{count:e}}),o=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.related_alerts_by_process_ancestry_error",{defaultMessage:"Failed to fetch alerts."}),l=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.processAncestryFilter",{defaultMessage:"Process Ancestry Alert IDs"}),c=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.related_alerts_by_process_ancestry_empty",{defaultMessage:"There are no related alerts by process ancestry."}),u=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.related_alerts_by_source_event_loading",{defaultMessage:"Loading related alerts by source event"}),d=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.related_alerts_by_session_error",{defaultMessage:"Failed to load related alerts by session"}),p=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.related_alerts_by_session_empty",{defaultMessage:"There are no related alerts by session"}),m=e=>n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.related_alerts_by_session_count",{defaultMessage:"{count} {count, plural, =1 {alert} other {alerts}} related by session",values:{count:e}}),b=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.related_alerts_by_source_event_loading",{defaultMessage:"Loading related alerts by source event"}),g=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.related_alerts_by_source_event_error",{defaultMessage:"Failed to load related alerts by source event"}),f=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.related_alerts_by_source_event_empty",{defaultMessage:"There are no related alerts by source event"}),y=e=>n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights_related_alerts_by_source_event_count",{defaultMessage:"{count} {count, plural, =1 {alert} other {alerts}} related by source event",values:{count:e}}),h=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.related_cases_loading",{defaultMessage:"Loading related cases"}),v=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.related_cases_error",{defaultMessage:"Failed to load related cases"}),E=e=>n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.related_cases_count",{defaultMessage:"{count} {count, plural, =1 {case} other {cases}} related to this alert",values:{count:e}}),x=e=>n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.relatedCasesFailure",{defaultMessage:'Unable to load related cases: "{error}"',values:{error:e}}),j=n.i18n.translate("xpack.securitySolution.alertDetails.overview.simpleAlertTable.error",{defaultMessage:"Failed to load the alerts."}),S=n.i18n.translate("xpack.securitySolution.alertDetails.overview.limitedAlerts",{defaultMessage:"Showing only the latest 10 alerts. View the rest of alerts in timeline."}),k=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.alertUpsellTitle",{defaultMessage:"Get more insights with a platinum subscription"}),O=e=>n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.suppressedAlertsCount",{defaultMessage:"{count} suppressed {count, plural, =1 {alert} other {alerts}}",values:{count:e}}),w=n.i18n.translate("xpack.securitySolution.alertDetails.overview.insights.suppressedAlertsCountTechnicalPreview",{defaultMessage:"Technical Preview"})},function(e,t,a){"use strict";a.d(t,"g",(function(){return c})),a.d(t,"a",(function(){return L})),a.d(t,"f",(function(){return q})),a.d(t,"c",(function(){return V})),a.d(t,"b",(function(){return Ve})),a.d(t,"h",(function(){return Ge})),a.d(t,"i",(function(){return d})),a.d(t,"d",(function(){return ot})),a.d(t,"e",(function(){return _e})),a.d(t,"j",(function(){return Re}));var n=a(2),i=a.n(n),r=a(40),s=a(21);const o={strict:!0,fields:{created_by:{type:"string"},description:{type:"string"},id:{type:"string"},item_id:{type:"string"},list_id:{type:"string"},name:{type:"string"},os_types:{type:"string"},tags:{type:"string"}}},l=({addExceptionButtonText:e,placeholdertext:t,canAddException:a,listType:i,isSearching:l,dataTestSubj:c,filters:u=[],isButtonFilled:d=!0,buttonIconType:p,onSearch:m,onAddExceptionClick:b})=>{const g=Object(n.useCallback)((({queryText:e})=>{m({search:e})}),[m]),f=Object(n.useCallback)((()=>{b(i)}),[b,i]);return Object(s.jsx)(r.EuiFlexGroup,{alignItems:"center"},Object(s.jsx)(r.EuiFlexItem,{grow:!0},Object(s.jsx)(r.EuiSearchBar,{box:{placeholder:t,incremental:!1,schema:o,"data-test-subj":`${c||""}searchBar`},filters:u,onChange:g})),!a&&Object(s.jsx)(r.EuiFlexItem,{grow:!1},Object(s.jsx)(r.EuiButton,{"data-test-subj":`${c||""}Button`,onClick:f,isDisabled:l,fill:d,iconType:p},e)))};l.displayName="SearchBarComponent";const c=i.a.memo(l);c.displayName="SearchBar";var u=a(48);let d,p;!function(e){e.ERROR="error",e.EMPTY="empty",e.EMPTY_SEARCH="empty_search",e.LOADING="loading",e.SEARCHING="searching",e.DELETING="deleting"}(d||(d={})),function(e){e.ENDPOINT="endpoint",e.DETECTION="empty",e.RULE_DEFAULT="empty_search"}(p||(p={}));var m=a(5);const b=m.i18n.translate("exceptionList-components.empty.viewer.state.empty.title",{defaultMessage:"Add exceptions to this list"}),g=m.i18n.translate("exceptionList-components.empty.viewer.state.empty.body",{defaultMessage:"There is no exception in your list. Create your first exception."}),f=m.i18n.translate("exceptionList-components.empty.viewer.state.empty_search.search.title",{defaultMessage:"No results match your search criteria"}),y=m.i18n.translate("exceptionList-components.empty.viewer.state.empty_search.body",{defaultMessage:"Try modifying your search"}),h=m.i18n.translate("exceptionList-components.empty.viewer.state.error_title",{defaultMessage:"Unable to load exception items"}),v=m.i18n.translate("exceptionList-components.empty.viewer.state.error_body",{defaultMessage:"There was an error loading the exception items. Contact your administrator for help."}),E=m.i18n.translate("exceptionList-components.exception_list_header_export_action",{defaultMessage:"Export exception list"}),x=m.i18n.translate("exceptionList-components.exception_list_header_delete_action",{defaultMessage:"Delete exception list"}),j=m.i18n.translate("exceptionList-components.exception_list_header_duplicate_action",{defaultMessage:"Duplicate exception list"}),S=m.i18n.translate("exceptionList-components.exception_list_header_link_rules_button",{defaultMessage:"Link rules"}),k=e=>m.i18n.translate("exceptionList-components.exception_list_header_linked_rules",{values:{noOfRules:e},defaultMessage:"Linked to {noOfRules} rules"}),O=m.i18n.translate("exceptionList-components.exception_list_header_breadcrumb",{defaultMessage:"Shared Exception Lists"}),w=m.i18n.translate("exceptionList-components.exception_list_header_list_id",{defaultMessage:"List ID"}),T=m.i18n.translate("exceptionList-components.exception_list_header_name",{defaultMessage:"Add a name"}),I=m.i18n.translate("exceptionList-components.exception_list_header_description",{defaultMessage:"Add a description"}),C=m.i18n.translate("exceptionList-components.exception_list_header_edit_modal_save_button",{defaultMessage:"Save"}),M=m.i18n.translate("exceptionList-components.exception_list_header_edit_modal_cancel_button",{defaultMessage:"Cancel"}),_=m.i18n.translate("exceptionList-components.exception_list_header_Name_textbox",{defaultMessage:"Name"}),F=m.i18n.translate("exceptionList-components.exception_list_header_description_textbox",{defaultMessage:"Description (optional)"}),A=m.i18n.translate("exceptionList-components.exception_list_header_description_textboxexceptionList-components.exception_list_header_name_required_eror",{defaultMessage:"List name cannot be empty"});var D=a(1267),N=a.n(D);const P=Object(s.css)("margin:",u.euiThemeVars.euiSizeL," 0;padding:",u.euiThemeVars.euiSizeL," 0;",""),R=({title:e,body:t,buttonText:a,listType:i,isReadOnly:o,viewerStatus:l,onEmptyButtonStateClick:c})=>{const{euiTheme:u}=Object(r.useEuiTheme)(),p=Object(n.useMemo)((()=>{switch(l){case d.ERROR:return{color:"danger",iconType:"error",title:Object(s.jsx)("h2",{"data-test-subj":"errorTitle"},e||h),body:Object(s.jsx)("p",{"data-test-subj":"errorBody"},t||v),"data-test-subj":"errorViewerState"};case d.EMPTY:return{color:"subdued",iconType:"plusInCircle",iconColor:u.colors.darkestShade,title:Object(s.jsx)("h2",{"data-test-subj":"emptyTitle"},e||b),body:Object(s.jsx)("p",{"data-test-subj":"emptyBody"},t||g),"data-test-subj":"emptyViewerState",actions:[Object(s.jsx)(r.EuiButton,{"data-test-subj":"emptyStateButton",onClick:c,iconType:"plusInCircle",color:"primary",isDisabled:o,fill:!0},a||(n=i||"rule",m.i18n.translate("exceptionList-components.empty.viewer.state.empty.viewer_button",{values:{exceptionType:n},defaultMessage:"Create {exceptionType} exception"})))]};case d.EMPTY_SEARCH:return{color:"plain",layout:"horizontal",hasBorder:!0,hasShadow:!1,icon:Object(s.jsx)(r.EuiImage,{size:"fullWidth",alt:"",src:N.a}),title:Object(s.jsx)("h3",{"data-test-subj":"emptySearchTitle"},e||f),body:Object(s.jsx)("p",{"data-test-subj":"emptySearchBody"},t||y),"data-test-subj":"emptySearchViewerState"}}var n}),[l,u.colors.darkestShade,e,t,c,o,a,i]);return Object(s.jsx)(r.EuiSkeletonText,{lines:4,"data-test-subj":"loadingViewerState",isLoading:l===d.LOADING||l===d.SEARCHING},Object(s.jsx)(r.EuiPanel,{css:P,color:"empty_search"===l?"subdued":"transparent"},Object(s.jsx)(r.EuiEmptyPrompt,p)))},L=i.a.memo(R);L.displayName="EmptyViewerState";const B=({dataTestSubj:e,ariaLabel:t,pagination:a,onPaginationChange:i})=>{const{pageIndex:o,pageCount:l,pageSize:c,pageSizeOptions:u,handleItemsPerPageChange:d,handlePageIndexChange:p}=(({pagination:e,onPaginationChange:t})=>{const{pageIndex:a,totalItemCount:i,pageSize:r,pageSizeOptions:s}=e,o=Object(n.useMemo)((()=>isFinite(i/r)?Math.ceil(i/r):0),[r,i]),l=Object(n.useCallback)((e=>{t({pagination:{pageIndex:a,pageSize:e,totalItemCount:i}})}),[a,i,t]),c=Object(n.useCallback)((e=>{t({pagination:{pageIndex:e,pageSize:r,totalItemCount:i}})}),[r,i,t]);return{pageCount:o,pageIndex:a,pageSize:r,pageSizeOptions:s,handleItemsPerPageChange:l,handlePageIndexChange:c}})({pagination:a,onPaginationChange:i});return Object(s.jsx)(r.EuiTablePagination,{"data-test-subj":e,"aria-label":t,pageCount:l,activePage:o,itemsPerPage:c,onChangePage:p,onChangeItemsPerPage:d,itemsPerPageOptions:u})};B.displayName="PaginationComponent";const q=i.a.memo(B);q.displayName="Pagination";const z=Object(s.css)("margin:",u.euiThemeVars.euiSize," 0;&div:first-child{margin:",u.euiThemeVars.euiSizeXS," 0 ",u.euiThemeVars.euiSize,";}",""),$=({lastUpdated:e,viewerStatus:t,isReadOnly:a,exceptions:n,listType:o,ruleReferences:l,emptyViewerTitle:c,emptyViewerBody:u,emptyViewerButtonText:d,pagination:p,dataTestSubj:m,editActionLabel:b,deleteActionLabel:g,securityLinkAnchorComponent:f,exceptionsUtilityComponent:y,formattedDateComponent:h,getFormattedComments:v,onPaginationChange:E,onDeleteException:x,onEditExceptionItem:j,onCreateExceptionListItem:S})=>{const k=y;return!n.length||t?Object(s.jsx)(L,{isReadOnly:a,title:c,viewerStatus:t,buttonText:d,body:u,onEmptyButtonStateClick:S}):Object(s.jsx)(i.a.Fragment,null,Object(s.jsx)(k,{pagination:p,lastUpdated:e}),Object(s.jsx)(r.EuiFlexGroup,{direction:"column",gutterSize:"none",className:"eui-yScrollWithShadows"},Object(s.jsx)(r.EuiFlexItem,{grow:!1},Object(s.jsx)(r.EuiFlexGroup,{css:z,"data-test-subj":`${m||""}exceptionsContainer`,direction:"column",gutterSize:"s"},n.map((e=>Object(s.jsx)(r.EuiFlexItem,{"data-test-subj":`${m||""}exceptionItemContainer`,grow:!1,key:e.id},Object(s.jsx)(Ve,{key:`${e.id}exceptionItemCardKey`,dataTestSubj:`${m||""}exceptionItemCard`,disableActions:a,exceptionItem:e,listType:o,ruleReferences:Object.keys(l).length&&l[e.list_id]?l[e.list_id].referenced_rules:[],editActionLabel:b,deleteActionLabel:g,onDeleteException:x,onEditException:j,securityLinkAnchorComponent:f,formattedDateComponent:h,getFormattedComments:v}))))))),Object(s.jsx)(q,{dataTestSubj:`${m||""}pagination`,pagination:p,onPaginationChange:E}))};$.displayName="ExceptionItemsComponent";const V=i.a.memo($);V.displayName="ExceptionsItems";var U=a(180);const H=Object(s.css)("margin-left:",u.euiThemeVars.euiSizeXL,";margin-bottom:",u.euiThemeVars.euiSizeXS,";padding-top:",u.euiThemeVars.euiSizeXS,";",""),G=Object(U.cx)("eui-xScroll","\n  border: 1px;\n  border-color: #d3dae6;\n  border-style: solid;\n"),Q=Object(s.css)("display:flex;align-items:center;margin-left:",u.euiThemeVars.euiSizeS,";",""),W={name:"s5xdrg",styles:"display:flex;align-items:center"},K=e=>m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.editItemButton",{values:{listType:e},defaultMessage:"Edit {listType} exception"}),Y=e=>m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.deleteItemButton",{values:{listType:e},defaultMessage:"Delete {listType} exception"}),J=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.createdLabel",{defaultMessage:"Created"}),X=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.updatedLabel",{defaultMessage:"Updated"}),Z=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.expiresLabel",{defaultMessage:"Expires at"}),ee=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.expiredLabel",{defaultMessage:"Expired at"}),te=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.metaDetailsBy",{defaultMessage:"by"}),ae=e=>m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.showCommentsLabel",{values:{comments:e},defaultMessage:"Show {comments, plural, =1 {comment} other {comments}} ({comments})"}),ne=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.matchOperator",{defaultMessage:"IS"}),ie=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.matchOperator.not",{defaultMessage:"IS NOT"}),re=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.wildcardMatchesOperator",{defaultMessage:"MATCHES"}),se=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.wildcardDoesNotMatchOperator",{defaultMessage:"DOES NOT MATCH"}),oe=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.nestedOperator",{defaultMessage:"has"}),le=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.matchAnyOperator",{defaultMessage:"is one of"}),ce=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.matchAnyOperator.not",{defaultMessage:"is not one of"}),ue=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.existsOperator",{defaultMessage:"exists"}),de=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.existsOperator.not",{defaultMessage:"does not exist"}),pe=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.listOperator",{defaultMessage:"included in"}),me=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.listOperator.not",{defaultMessage:"is not included in"}),be=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.and",{defaultMessage:"AND"}),ge=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.os",{defaultMessage:"OS"}),fe=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.windows",{defaultMessage:"Windows"}),ye=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.linux",{defaultMessage:"Linux"}),he=m.i18n.translate("exceptionList-components.exceptions.exceptionItem.card.conditions.macos",{defaultMessage:"Mac"});var ve=a(120);const Ee=Object.freeze({linux:ye,mac:he,macos:he,windows:fe}),xe=Object.freeze({[ve.d.NESTED]:oe,[ve.d.MATCH_ANY]:le,[ve.d.MATCH]:ne,[ve.d.WILDCARD]:re,[ve.d.EXISTS]:ue,[ve.d.LIST]:pe}),je=Object.freeze({[ve.d.MATCH_ANY]:ce,[ve.d.MATCH]:ie,[ve.d.WILDCARD]:se,[ve.d.EXISTS]:de,[ve.d.LIST]:me}),Se=(e,t)=>"match_any"===e&&Array.isArray(t)?t.map(((e,t)=>Object(s.jsx)(r.EuiBadge,{key:t,"data-test-subj":`matchAnyBadge${t}`,color:"hollow"},e))):null!=t?t:"",ke=(e,t)=>{var a,n;return"nested"===e?"":"included"===t?null!==(a=xe[e])&&void 0!==a?a:e:null!==(n=je[e])&&void 0!==n?n:e},Oe=(e,t,a)=>Object(s.jsx)(i.a.Fragment,null,Object(s.jsx)(r.EuiExpression,{description:ke(e,t),value:Se(e,a),"data-test-subj":"entryValueExpression"}),Object(s.jsx)(Ge,{value:a})),we=Object(n.memo)((({entry:e,index:t,isNestedEntry:a=!1,dataTestSubj:n})=>{const{field:o,type:l}=e,c=(e=>"list"===e.type?e.list.id:"value"in e?e.value:"")(e),u="operator"in e?e.operator:"",d=`${o}${l}${c}${t}`;return Object(s.jsx)("div",{"data-test-subj":`${n||""}${d}EntryContent`,key:d},Object(s.jsx)("div",{css:W},a?Object(s.jsx)(r.EuiFlexGroup,{responsive:!0,css:H,direction:"row",alignItems:"center",gutterSize:"m","data-test-subj":`${n||""}NestedEntry`},Object(s.jsx)(r.EuiToken,{"data-test-subj":"nstedEntryIcon",iconType:"tokenNested",size:"s"}),Object(s.jsx)("div",{css:Q},Object(s.jsx)(r.EuiExpression,{description:"",value:o,color:"subdued"}),Oe(l,u,c))):Object(s.jsx)(i.a.Fragment,null,Object(s.jsx)(r.EuiExpression,{description:0===t?"":be,value:o,color:0===t?"primary":"subdued","data-test-subj":`${n||""}SingleEntry`}),Oe(l,u,c))))}));we.displayName="EntryContent";const Te=Object(n.memo)((({os:e,dataTestSubj:t})=>{const a=Object(n.useMemo)((()=>e.map((e=>{var t;return null!==(t=Ee[e])&&void 0!==t?t:e})).join(", ")),[e]);return a?Object(s.jsx)("div",{"data-test-subj":`${t||""}Os`},Object(s.jsx)("strong",null,Object(s.jsx)(r.EuiExpression,{"data-test-subj":"osLabel",description:"",value:ge}),Object(s.jsx)(r.EuiExpression,{"data-test-subj":"osValue",description:ne,value:a}))):null}));Te.displayName="OsCondition";const Ie=Object(n.memo)((({os:e,entries:t,dataTestSubj:a})=>Object(s.jsx)(r.EuiPanel,{color:"subdued",hasBorder:!0,hasShadow:!1,"data-test-subj":a,className:G},null!=e&&e.length?Object(s.jsx)(Te,{os:e,dataTestSubj:a}):null,t.map(((e,t)=>{const n="entries"in e?e.entries:[];return Object(s.jsx)("div",{key:`ExceptionItemCardConditionsContainer${t}`},Object(s.jsx)(we,{key:`entry${t}`,entry:e,index:t,dataTestSubj:a}),null!=n&&n.length?n.map(((e,n)=>Object(s.jsx)(we,{key:`nestedEntry${t}${n}`,entry:e,index:n,isNestedEntry:!0,dataTestSubj:a}))):null)})))));Ie.displayName="ExceptionItemCardConditions";const Ce={name:"qeawqx",styles:"max-height:300px;height:100%;overflow-x:hidden;overflow-y:auto"},Me=({text:e,dataTestSubj:t,actions:a,disableActions:i,emptyButton:o,useCustomActions:l,iconType:c,iconSide:u="left",anchorPosition:d="downCenter",panelPaddingSize:p="s"})=>{const[m,b]=Object(n.useState)(!1),g=()=>b((e=>!e)),f=()=>b(!1),y=Object(n.useMemo)((()=>l||null===a?a:a.map((e=>Object(s.jsx)(r.EuiContextMenuItem,{"data-test-subj":`${t||""}ActionItem${e.key}`,key:e.key,icon:e.icon,disabled:e.disabled,layoutAlign:"center",onClick:t=>{f(),"function"==typeof e.onClick&&e.onClick(t)}},e.label)))),[a,t,l]);return Object(s.jsx)(r.EuiFlexGroup,{responsive:!0},Object(s.jsx)(r.EuiPopover,{button:o?Object(s.jsx)(r.EuiButtonEmpty,{isDisabled:i,onClick:g,iconType:c||void 0,iconSide:u,"data-test-subj":`${t||""}EmptyButton`,"aria-label":"Header menu Button Empty"},e):Object(s.jsx)(r.EuiButtonIcon,{isDisabled:i,onClick:g,iconType:c||"boxesHorizontal","data-test-subj":`${t||""}ButtonIcon`,"aria-label":"Header menu Button Icon"},e),onClick:e=>e.stopPropagation(),panelPaddingSize:p,isOpen:m,closePopover:f,anchorPosition:d,"data-test-subj":`${t||""}Items`},y?Object(s.jsx)(r.EuiContextMenuPanel,{css:Ce,className:"eui-scrollBar","data-test-subj":`${t||""}MenuPanel`,size:"s",items:y}):null))};Me.displayName="HeaderMenuComponent";const _e=i.a.memo(Me);_e.displayName="HeaderMenu";const Fe=Object(n.memo)((({item:e,actions:t,disableActions:a=!1,dataTestSubj:n})=>Object(s.jsx)(r.EuiFlexGroup,{responsive:!0,"data-test-subj":n,justifyContent:"spaceBetween"},Object(s.jsx)(r.EuiFlexItem,{grow:9},Object(s.jsx)(r.EuiTitle,{size:"xs",textTransform:"uppercase","data-test-subj":`${n}Title`},Object(s.jsx)("h3",null,e.name))),Object(s.jsx)(r.EuiFlexItem,{grow:!1},Object(s.jsx)(_e,{iconType:"boxesHorizontal",disableActions:a,actions:t,"aria-label":"Exception item actions menu",dataTestSubj:n,anchorPosition:"downCenter"})))));Fe.displayName="ExceptionItemCardHeader";const Ae=Object(s.css)("font-family:",u.euiThemeVars.euiFontFamily,";",""),De=Object(n.memo)((({label:e,lastUpdate:t,lastUpdateValue:a,dataTestSubj:n})=>Object(s.jsx)(r.EuiFlexGroup,{"data-test-subj":`${n||""}metaInfoDetails`,alignItems:"center",gutterSize:"s",wrap:!0,responsive:!0},Object(s.jsx)(r.EuiFlexItem,{grow:!1},Object(s.jsx)(r.EuiText,{size:"xs",css:Ae},e)),Object(s.jsx)(r.EuiFlexItem,{grow:!1,"data-test-subj":`${n||""}lastUpdate`},Object(s.jsx)(r.EuiBadge,{color:"default",css:Ae},t)),null!=a&&Object(s.jsx)(i.a.Fragment,null,Object(s.jsx)(r.EuiFlexItem,{grow:!1},Object(s.jsx)(r.EuiText,{size:"xs",css:Ae},te)),Object(s.jsx)(r.EuiFlexItem,{grow:!1,"data-test-subj":`${n||""}lastUpdateValue`},Object(s.jsx)(r.EuiFlexGroup,{responsive:!0,gutterSize:"xs",alignItems:"center"},Object(s.jsx)(r.EuiFlexItem,{grow:!1},Object(s.jsx)(r.EuiBadge,{color:"hollow",css:Ae},a))))))));De.displayName="MetaInfoDetails";const Ne=Object(s.css)("border-bottom:1px solid ",u.euiThemeVars.euiColorLightShade,";",""),Pe=Object(s.css)("color:",u.euiThemeVars.euiColorPrimary,";flex-basis:content;",""),Re=({dataTestSubj:e,linkedRules:t,securityLinkAnchorComponent:a,leftIcon:n=""})=>{if(!t.length||null===a)return null;const i=a;return t.map((a=>Object(s.jsx)(r.EuiContextMenuItem,{css:t.length>1?Ne:"","data-test-subj":`${e||""}ActionItem${a.id}`,key:a.id},Object(s.jsx)(r.EuiFlexGroup,{gutterSize:"s",css:Pe},n?Object(s.jsx)(r.EuiFlexItem,{"data-test-subj":`${e||""}LeftIcon`,grow:!1},Object(s.jsx)(r.EuiIcon,{type:n})):null,Object(s.jsx)(r.EuiFlexItem,{css:Pe},Object(s.jsx)(i,{external:!0,referenceName:a.name,referenceId:a.id}))))))},Le=Object(s.css)("border-right:1px solid #d3dae6;padding:",u.euiThemeVars.euiSizeS," ",u.euiThemeVars.euiSizeM," ",u.euiThemeVars.euiSizeS," 0;",""),Be=Object(n.memo)((({item:e,rules:t,dataTestSubj:a,securityLinkAnchorComponent:o,formattedDateComponent:l})=>{const c=l,u=Object(n.useMemo)((()=>Re({dataTestSubj:a,linkedRules:t,securityLinkAnchorComponent:o})),[a,t,o]),d=Object(n.useMemo)((()=>!!e.expire_time&&new Date(e.expire_time)<=new Date),[e]);return Object(s.jsx)(r.EuiFlexGroup,{alignItems:"center",responsive:!0,gutterSize:"s","data-test-subj":a},null!==c&&Object(s.jsx)(i.a.Fragment,null,Object(s.jsx)(r.EuiFlexItem,{css:Le,grow:!1},Object(s.jsx)(De,{label:J,lastUpdate:Object(s.jsx)(c,{"data-test-subj":"{dataTestSubj||''}formattedDateComponentCreatedBy",fieldName:"created_at",value:e.created_at}),lastUpdateValue:e.created_by,dataTestSubj:`${a||""}CreatedBy`})),Object(s.jsx)(r.EuiFlexItem,{css:Le,grow:!1},Object(s.jsx)(De,{label:X,lastUpdate:Object(s.jsx)(c,{"data-test-subj":"{dataTestSubj||''}formattedDateComponentUpdatedBy",fieldName:"updated_at",value:e.updated_at}),lastUpdateValue:e.updated_by,dataTestSubj:`${a||""}UpdatedBy`})),null!=e.expire_time&&Object(s.jsx)(i.a.Fragment,null,Object(s.jsx)(r.EuiFlexItem,{css:Le,grow:!1},Object(s.jsx)(De,{label:d?ee:Z,lastUpdate:Object(s.jsx)(c,{"data-test-subj":"{dataTestSubj||''}formattedDateComponentExpireTime",fieldName:"expire_time",value:e.expire_time}),dataTestSubj:`${a||""}ExpireTime`})))),Object(s.jsx)(r.EuiFlexItem,null,Object(s.jsx)(_e,{emptyButton:!0,useCustomActions:!0,iconType:"list",actions:u,disableActions:!1,text:(p=t.length,m.i18n.translate("exceptionList-components.exceptions.card.exceptionItem.affectedRules",{values:{numRules:p},defaultMessage:"Affects {numRules} {numRules, plural, =1 {rule} other {rules}}"})),dataTestSubj:a})));var p}));Be.displayName="ExceptionItemCardMetaInfo";const qe=Object(s.css)("color:",u.euiThemeVars.euiColorPrimary,";",""),ze=Object(n.memo)((({comments:e,dataTestSubj:t})=>e.length?Object(s.jsx)(r.EuiFlexItem,{"data-test-subj":t},Object(s.jsx)(r.EuiAccordion,{id:"exceptionItemCardComments",buttonContent:Object(s.jsx)(r.EuiText,{size:"s",css:qe,"data-test-subj":`${t||""}TextButton`},ae(e.length)),arrowDisplay:"none","data-test-subj":"exceptionItemCardComments"},Object(s.jsx)(r.EuiPanel,{"data-test-subj":"accordionContentPanel",hasBorder:!0,hasShadow:!0,paddingSize:"m"},Object(s.jsx)(r.EuiCommentList,{"data-test-subj":"accordionCommentList",comments:e})))):null));ze.displayName="ExceptionItemCardComments";const $e=({disableActions:e=!1,exceptionItem:t,listType:a,ruleReferences:i,dataTestSubj:o,editActionLabel:l,deleteActionLabel:c,securityLinkAnchorComponent:u,formattedDateComponent:d,getFormattedComments:p,onDeleteException:m,onEditException:b})=>{const{actions:g,formattedComments:f}=(({listType:e,editActionLabel:t,deleteActionLabel:a,exceptionItem:i,getFormattedComments:r,onEditException:s,onDeleteException:o})=>{const l=Object(n.useCallback)((()=>{o({id:i.id,name:i.name,namespaceType:i.namespace_type})}),[o,i.id,i.name,i.namespace_type]),c=Object(n.useCallback)((()=>{s(i)}),[s,i]),u=Object(n.useMemo)((()=>r(i.comments)),[i.comments,r]);return{actions:Object(n.useMemo)((()=>[{key:"edit",icon:"controlsHorizontal",label:t||K(e),onClick:c},{key:"delete",icon:"trash",label:a||Y(e),onClick:l}]),[t,e,a,l,c]),formattedComments:u}})({listType:a,editActionLabel:l,deleteActionLabel:c,exceptionItem:t,getFormattedComments:p,onEditException:b,onDeleteException:m});return Object(s.jsx)(r.EuiPanel,{key:`${t.id}exceptionItemPanel`,paddingSize:"l","data-test-subj":o||"",hasBorder:!0,hasShadow:!1},Object(s.jsx)(r.EuiFlexGroup,{responsive:!0,gutterSize:"m",direction:"column"},Object(s.jsx)(r.EuiFlexItem,{"data-test-subj":"exceptionItemCardHeaderContainer"},Object(s.jsx)(Fe,{item:t,actions:g,disableActions:e,dataTestSubj:"exceptionItemCardHeader"})),Object(s.jsx)(r.EuiFlexItem,{"data-test-subj":"exceptionItemCardMeta"},Object(s.jsx)(Be,{item:t,rules:i,dataTestSubj:"exceptionItemCardMetaInfo",securityLinkAnchorComponent:u,formattedDateComponent:d})),Object(s.jsx)(r.EuiFlexItem,{"data-test-subj":"exceptionItemCardCondition"},Object(s.jsx)(Ie,{os:t.os_types,entries:t.entries,dataTestSubj:"exceptionItemCardConditions"})),f.length>0&&Object(s.jsx)(ze,{dataTestSubj:"exceptionsItemCommentAccordion",comments:f})))};$e.displayName="ExceptionItemCardComponent";const Ve=i.a.memo($e);Ve.displayName="ExceptionItemCard";var Ue=a(316);const He=Object(U.css)("display:inline;margin-left:",u.euiThemeVars.euiSizeXS,";",""),Ge=({value:e,tooltipIconType:t="iInCircle",tooltipIconText:a})=>{const{showSpaceWarningIcon:n,warningText:i}=(({value:e,tooltipIconText:t})=>({showSpaceWarningIcon:!!(Array.isArray(e)?e.find(Ue.d):Object(Ue.d)(e)),warningText:t||Ue.c.FIELD_SPACE_WARNING}))({value:e,tooltipIconText:a});return n&&e?Object(s.jsx)("div",{className:He},Object(s.jsx)(r.EuiToolTip,{position:"top",content:i},Object(s.jsx)(r.EuiIcon,{"data-test-subj":"valueWithSpaceWarningTooltip",type:t,color:"warning"}))):null},Qe=Object(s.css)("border-right:1px solid #d3dae6;padding:",u.euiThemeVars.euiSizeXS," ",u.euiThemeVars.euiSizeL," ",u.euiThemeVars.euiSizeXS," 0;",""),We={name:"95qvyx",styles:"width:max-content"},Ke=Object(s.css)("font-size:",u.euiThemeVars.euiFontSize,";color:",u.euiThemeVars.euiTextSubduedColor,";margin-left:",u.euiThemeVars.euiSizeXS,";",""),Ye=Object(s.css)("margin-top:-",u.euiThemeVars.euiSizeL,";margin-bottom:-",u.euiThemeVars.euiSizeL,";",""),Je=Object(s.css)("font-size:",u.euiThemeVars.euiFontSizeXS,";",""),Xe=({dataTestSubj:e,linkedRules:t,securityLinkAnchorComponent:a,isReadonly:i,canUserEditList:o=!0,onDeleteList:l,onManageRules:c,onExportList:u,onDuplicateList:d})=>{const p=Object(n.useMemo)((()=>Re({leftIcon:"check",dataTestSubj:e,linkedRules:t,securityLinkAnchorComponent:a})),[e,t,a]);return Object(s.jsx)(r.EuiFlexGroup,{direction:"row",alignItems:"baseline",justifyContent:"center",responsive:!0,"data-test-subj":`${e||""}Container`,gutterSize:"l"},Object(s.jsx)(r.EuiFlexItem,{css:Qe},t.length?Object(s.jsx)(_e,{dataTestSubj:`${e||""}LinkedRulesMenu`,emptyButton:!0,useCustomActions:!0,text:k(t.length),actions:p,disableActions:!1,iconType:"arrowDown",iconSide:"right",panelPaddingSize:"none"}):Object(s.jsx)(r.EuiTextColor,{"data-test-subj":"noLinkedRules",css:We,color:"subdued"},k(t.length))),o&&Object(s.jsx)(r.EuiFlexItem,null,Object(s.jsx)(r.EuiButton,{"data-test-subj":`${e||""}LinkRulesButton`,fill:!0,onClick:()=>{"function"==typeof c&&c()}},S)),Object(s.jsx)(r.EuiFlexItem,null,Object(s.jsx)(_e,{iconType:"boxesHorizontal",dataTestSubj:`${e||""}MenuActions`,actions:[{key:"1",icon:"exportAction",label:E,onClick:()=>{"function"==typeof u&&u()}},{key:"2",icon:"copy",label:j,onClick:()=>{"function"==typeof d&&d()},disabled:!o},{key:"3",icon:"trash",label:x,onClick:()=>{"function"==typeof l&&l()},disabled:!o}],disableActions:i,anchorPosition:"downCenter"})))};Xe.displayName="MenuItemsComponent";const Ze=i.a.memo(Xe);Ze.displayName="MenuItems";const et=Object(s.css)("display:flex;width:fit-content;align-items:baseline;padding-bottom:",u.euiThemeVars.euiSizeS,";h1{margin-bottom:0;}",""),tt=Object(s.css)("button{margin-left:-",u.euiThemeVars.euiSizeM,";}",""),at=({isReadonly:e,dataTestSubj:t,text:a,onEdit:n,textCss:i})=>Object(s.jsx)(r.EuiFlexGroup,{css:et},Object(s.jsx)(r.EuiFlexItem,{grow:10},Object(s.jsx)("span",{css:i,"data-test-subj":`${t||""}Text`},a)),Object(s.jsx)(r.EuiFlexItem,{grow:!1,css:tt},e?null:Object(s.jsx)(r.EuiButtonIcon,{"data-test-subj":`${t||""}EditIcon`,"aria-label":"Edit Text List Header",iconType:"pencil",onClick:()=>"function"==typeof n?n():null})));at.displayName="TextWithEditComponent";const nt=i.a.memo(at);nt.displayName="TextWithEdit";const it=({listDetails:e,onSave:t,onCancel:a})=>{const{error:i,modalFormId:o,newListDetails:l,showProgress:c,onBlur:u,onSubmit:d,onChange:p}=(({listDetails:e,onSave:t})=>{const a=Object(r.useGeneratedHtmlId)({prefix:"modalForm"}),[i,s]=Object(n.useState)(e),[o,l]=Object(n.useState)(!1),[c,u]=Object(n.useState)(void 0),d=Object(n.useCallback)((({target:e})=>{const{name:t,value:a}=e,n=a.trim();s({...i,[t]:n}),"name"===t&&u(n?void 0:A)}),[i]);return{error:c,modalFormId:a,newListDetails:i,showProgress:o,onBlur:d,onChange:({target:e})=>{const{name:t,value:a}=e;s({...i,[t]:a})},onSubmit:e=>{c||(l(!0),t(i),null==e||e.preventDefault())}}})({listDetails:e,onSave:t});return Object(s.jsx)(r.EuiModal,{"data-test-subj":"EditModal",onClose:a,initialFocus:"[name=popswitch]"},c&&Object(s.jsx)(r.EuiProgress,{"data-test-subj":"editModalProgess",size:"xs",position:"absolute"}),Object(s.jsx)(r.EuiModalHeader,null,Object(s.jsx)(r.EuiModalHeaderTitle,{"data-test-subj":"editModalTitle"},(b=e.name,m.i18n.translate("exceptionList-components.exception_list_header_edit_modal_name",{defaultMessage:"Edit {listName}",values:{listName:b}})))),Object(s.jsx)(r.EuiModalBody,null,Object(s.jsx)(r.EuiForm,{id:o,"data-test-subj":"editModalForm",component:"form",onSubmit:d},Object(s.jsx)(r.EuiFormRow,{error:i,isInvalid:!!i,fullWidth:!0,label:_},Object(s.jsx)(r.EuiFieldText,{fullWidth:!0,isInvalid:!!i,onBlur:u,"data-test-subj":"editModalNameTextField",name:"name",value:l.name,onChange:p})),Object(s.jsx)(r.EuiFormRow,{fullWidth:!0,label:F},Object(s.jsx)(r.EuiTextArea,{fullWidth:!0,"data-test-subj":"editModalDescriptionTextField",name:"description",value:l.description,onChange:p,onBlur:u})))),Object(s.jsx)(r.EuiModalFooter,null,Object(s.jsx)(r.EuiButtonEmpty,{"data-test-subj":"editModalCancelBtn",onClick:a},M),Object(s.jsx)(r.EuiButton,{"data-test-subj":"editModalSaveBtn",type:"submit",form:o,onClick:d,fill:!0},C)));var b};it.displayName="EditModalComponent";const rt=i.a.memo(it);rt.displayName="EditModal";const st=({name:e,description:t,listId:a,linkedRules:i,isReadonly:o,dataTestSubj:l,securityLinkAnchorComponent:c,backOptions:u,canUserEditList:d=!0,onEditListDetails:p,onDeleteList:m,onManageRules:b,onExportList:g,onDuplicateList:f})=>{const{isModalVisible:y,listDetails:h,onEdit:v,onSave:E,onCancel:x}=(({name:e,description:t,onEditListDetails:a})=>{const[i,r]=Object(n.useState)(!1),[s,o]=Object(n.useState)({name:e,description:t});return{isModalVisible:i,listDetails:s,onEdit:()=>{r(!0)},onSave:e=>{o(e),"function"==typeof a&&a(e),setTimeout((()=>{r(!1)}),200)},onCancel:()=>{r(!1)}}})({name:e,description:t,onEditListDetails:p});return Object(s.jsx)("div",null,Object(s.jsx)(r.EuiPageHeader,{bottomBorder:!0,paddingSize:"none",pageTitle:Object(s.jsx)(nt,{dataTestSubj:`${l||""}Title`,text:h.name||T,isReadonly:o||!d,onEdit:v}),responsive:!0,"data-test-subj":`${l||""}PageHeader`,description:Object(s.jsx)("div",{css:Ye},Object(s.jsx)(nt,{dataTestSubj:`${l||""}Description`,textCss:Ke,isReadonly:o||!d,text:h.description||I,onEdit:v}),Object(s.jsx)("div",{css:et,"data-test-subj":`${l||""}ListID`},Object(s.jsx)(r.EuiText,{css:Ke},w,":"),Object(s.jsx)(r.EuiText,{css:Ke},a))),rightSideItems:[Object(s.jsx)(Ze,{dataTestSubj:`${l||""}RightSideMenuItems`,linkedRules:i,isReadonly:o,canUserEditList:d,securityLinkAnchorComponent:c,onDeleteList:m,onManageRules:b,onExportList:g,onDuplicateList:f})],breadcrumbs:[{text:Object(s.jsx)("div",{"data-test-subj":`${l||""}Breadcrumb`,css:Je},Object(s.jsx)(r.EuiIcon,{size:"s",type:"arrowLeft"}),O),color:"primary","aria-current":!1,href:u.path,onClick:e=>{e.preventDefault(),u.onNavigate(u.path)}}]}),y&&Object(s.jsx)(rt,{listDetails:h,onSave:E,onCancel:x}))};st.displayName="ExceptionListHeaderComponent";const ot=i.a.memo(st);ot.displayName="ExceptionListHeader"},,function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e){var t=n.useRef();return n.useEffect((function(){t.current=e})),t.current}},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"c",(function(){return u})),a.d(t,"a",(function(){return q})),a.d(t,"j",(function(){return V})),a.d(t,"g",(function(){return ie})),a.d(t,"h",(function(){return ue})),a.d(t,"i",(function(){return me})),a.d(t,"d",(function(){return de})),a.d(t,"e",(function(){return be})),a.d(t,"f",(function(){return K}));const n="cellAction-filter";let i;!function(e){e.HOVER_DOWN="hover-down",e.HOVER_RIGHT="hover-right",e.INLINE="inline"}(i||(i={}));var r=a(42),s=a(2),o=a.n(s),l=a(21);const c=Object(s.createContext)(null),u=({children:e,getTriggerCompatibleActions:t})=>{const a=Object(s.useMemo)((()=>({getActions:e=>t(e.trigger.id,e).then((e=>Object(r.orderBy)(["order","id"],["asc","asc"],e)))})),[t]);return Object(l.jsx)(c.Provider,{value:a},e)},d=()=>{const e=Object(s.useContext)(c);if(!e)throw new Error("No CellActionsContext found. Please wrap the application with CellActionsProvider");return e};var p=a(40),m=a(104),b=a.n(m);const g=({action:e,actionContext:t,showTooltip:a,onClick:n})=>{const i=Object(s.useMemo)((()=>({iconType:e.getIconType(t),onClick:()=>{e.execute(t),n&&n()},"data-test-subj":`actionItem-${e.id}`,"aria-label":e.getDisplayName(t)})),[e,t,n]);return i.iconType?a?Object(l.jsx)(p.EuiToolTip,{content:e.getDisplayNameTooltip?e.getDisplayNameTooltip(t):""},Object(l.jsx)(p.EuiButtonIcon,b()({},i,{iconSize:"s"}))):Object(l.jsx)(p.EuiButtonIcon,b()({},i,{iconSize:"s"})):null},f=(e,t)=>t<=1?{extraActions:e,visibleActions:[]}:e.length<=t?{extraActions:[],visibleActions:e}:{visibleActions:e.slice(0,t-1),extraActions:e.slice(t-1,e.length)};var y=a(48),h=a(5);const v=e=>h.i18n.translate("cellActions.youAreInADialogContainingOptionsScreenReaderOnly",{values:{fieldName:e},defaultMessage:"You are in a dialog, containing options for field {fieldName}. Press tab to navigate options. Press escape to exit."}),E=h.i18n.translate("cellActions.extraActionsAriaLabel",{defaultMessage:"Extra actions"}),x=h.i18n.translate("cellActions.showMoreActionsLabel",{defaultMessage:"More actions"}),j=h.i18n.translate("cellActions.actionsAriaLabel",{defaultMessage:"Actions"}),S=Object(l.css)("color:",y.euiThemeVars.euiColorPrimaryText,";",""),k=({anchorPosition:e,actions:t,actionContext:a,isOpen:n,closePopOver:i,button:r})=>Object(l.jsx)(p.EuiPopover,{button:r,isOpen:n,closePopover:i,panelPaddingSize:"xs",anchorPosition:e,hasArrow:!0,repositionOnScroll:!0,ownFocus:!0,"data-test-subj":"extraActionsPopOver","aria-label":E},Object(l.jsx)(w,{actions:t,actionContext:a,closePopOver:i})),O=({anchorPosition:e,anchorRef:t,actionContext:a,isOpen:n,closePopOver:i,actions:r})=>t.current?Object(l.jsx)(p.EuiWrappingPopover,{"aria-label":E,button:t.current,isOpen:n,closePopover:i,panelPaddingSize:"xs",anchorPosition:e,hasArrow:!1,repositionOnScroll:!0,ownFocus:!0,attachToAnchor:!1,"data-test-subj":"extraActionsPopOverWithAnchor"},Object(l.jsx)(w,{actions:r,actionContext:a,closePopOver:i})):null,w=({actionContext:e,actions:t,closePopOver:a})=>{const n=Object(s.useMemo)((()=>t.map((t=>Object(l.jsx)(p.EuiContextMenuItem,{css:S,key:t.id,icon:t.getIconType(e),"aria-label":t.getDisplayName(e),"data-test-subj":`actionItem-${t.id}`,onClick:()=>{a(),t.execute(e)}},t.getDisplayName(e))))),[e,t,a]);return Object(l.jsx)(o.a.Fragment,null,Object(l.jsx)(p.EuiScreenReaderOnly,null,Object(l.jsx)("p",null,v(e.data.map((({field:e})=>e.name)).join(", ")))),Object(l.jsx)(p.EuiContextMenuPanel,{size:"s",items:n}))},T=({onClick:e,showTooltip:t})=>t?Object(l.jsx)(p.EuiToolTip,{content:x},Object(l.jsx)(p.EuiButtonIcon,{"data-test-subj":"showExtraActionsButton","aria-label":x,iconType:"boxesHorizontal",onClick:e})):Object(l.jsx)(p.EuiButtonIcon,{"data-test-subj":"showExtraActionsButton","aria-label":x,iconType:"boxesHorizontal",onClick:e});var I=a(544),C=a.n(I),M=a(545),_=a.n(M);const F=e=>{if(e)throw e},A=(e,t)=>Object(s.useMemo)((()=>D(e,t)),[e,t]),D=(e,t=[])=>e?e.filter((({type:e})=>!(null!=t&&t.includes(e)))):void 0,N=({actionContext:e,anchorPosition:t,showActionTooltips:a,visibleCellActions:n,disabledActionTypes:i})=>{const{value:r}=((e,t={})=>{const{getActions:a}=d(),{error:n,value:i,loading:r}=C()((()=>a(e)),[]),s=A(i,t.disabledActionTypes);return F(n),{value:s,loading:r}})(e,{disabledActionTypes:i}),{extraActions:o,visibleActions:c}=((e,t)=>Object(s.useMemo)((()=>f(null!=e?e:[],t)),[e,t]))(null!=r?r:[],n),[u,m]=Object(s.useState)(!1),b=Object(s.useCallback)((()=>m((e=>!e))),[]),y=Object(s.useCallback)((()=>m(!1)),[]),h=Object(s.useMemo)((()=>Object(l.jsx)(T,{onClick:b,showTooltip:a})),[b,a]);return Object(l.jsx)(p.EuiFlexGroup,{responsive:!1,alignItems:"flexStart",gutterSize:"none","data-test-subj":"inlineActions",className:"inlineActions "+(u?"inlineActions-popoverOpen":"")},c.map((t=>Object(l.jsx)(p.EuiFlexItem,{grow:!1,key:`action-item-${t.id}`},Object(l.jsx)(g,{action:t,actionContext:e,showTooltip:a})))),o.length>0?Object(l.jsx)(p.EuiFlexItem,{grow:!1},Object(l.jsx)(k,{actions:o,actionContext:e,anchorPosition:t,button:h,closePopOver:y,isOpen:u})):null)};var P=a(8);const R={minWidth:"24px"},L=Object(l.css)("padding:0 ",y.euiThemeVars.euiSizeS,";",""),B=({anchorPosition:e,children:t,visibleCellActions:a,actionContext:n,showActionTooltips:i,disabledActionTypes:r})=>{const c=Object(s.useRef)(null),[u,m]=Object(s.useState)(!1),[b,h]=Object(s.useState)(!1),[{value:E},x]=((e={})=>{const{getActions:t}=d(),[{error:a,value:n,loading:i},r]=_()(t,[]),s=A(n,e.disabledActionTypes);return F(a),[{value:s,loading:i},r]})({disabledActionTypes:r}),{visibleActions:S,extraActions:k}=Object(s.useMemo)((()=>f(null!=E?E:[],a)),[E,a]),w=Object(s.useMemo)((()=>Object(P.debounce)((()=>{document.body.classList.contains("is-dragging")||h(!0)}),100)),[]);Object(s.useEffect)((()=>()=>{w.cancel()}),[w]);const I=Object(s.useCallback)((()=>{w.cancel(),h(!1)}),[w]),C=Object(s.useCallback)((()=>m(!1)),[m]),M=Object(s.useCallback)((()=>{m(!0),I()}),[I,m]),D=Object(s.useCallback)((async()=>{u||(void 0===E&&x(n),w())}),[u,E,w,x,n]),N=Object(s.useMemo)((()=>Object(l.jsx)("div",{ref:c,onMouseEnter:D,onClick:C},t)),[D,C,t]),B=Object(s.useMemo)((()=>"rightCenter"===e?{marginTop:y.euiThemeVars.euiSizeS}:{}),[e]);return Object(l.jsx)(o.a.Fragment,null,Object(l.jsx)("div",{onMouseLeave:I},Object(l.jsx)(p.EuiPopover,{panelStyle:{...R,...B},anchorPosition:e,button:N,closePopover:I,hasArrow:!1,isOpen:b,panelPaddingSize:"none",repositionOnScroll:!0,ownFocus:!1,"data-test-subj":"hoverActionsPopover","aria-label":j},b&&Object(l.jsx)("div",{css:L},Object(l.jsx)(p.EuiScreenReaderOnly,null,Object(l.jsx)("p",null,v(n.data.map((({field:e})=>e.name)).join(", ")))),S.map((e=>Object(l.jsx)(g,{key:e.id,action:e,actionContext:n,showTooltip:i,onClick:I}))),k.length>0&&Object(l.jsx)(T,{onClick:M,showTooltip:i})))),Object(l.jsx)(O,{anchorPosition:e,actions:k,anchorRef:c,actionContext:n,closePopOver:C,isOpen:u}))},q=({data:e,triggerId:t,children:a,mode:n,showActionTooltips:o=!0,visibleCellActions:c=3,disabledActionTypes:u=[],metadata:d,className:m})=>{const b=Object(s.useRef)(null),g=Object(s.useMemo)((()=>Object(r.isArray)(e)?e:[e]),[e]),f=Object(s.useMemo)((()=>({data:g,trigger:{id:t},nodeRef:b,metadata:d})),[g,t,d]),y=Object(s.useMemo)((()=>n===i.HOVER_DOWN?"downCenter":"rightCenter"),[n]),h=`cellActions-renderContent-${g.map((({field:e})=>e.name)).join("-")}`;return n===i.HOVER_DOWN||n===i.HOVER_RIGHT?Object(l.jsx)("div",{className:m,ref:b,"data-test-subj":h},Object(l.jsx)(B,{anchorPosition:y,actionContext:f,showActionTooltips:o,visibleCellActions:c,disabledActionTypes:u},a)):Object(l.jsx)(p.EuiFlexGroup,{responsive:!1,alignItems:"center",ref:b,gutterSize:"none",justifyContent:"flexStart",className:m,"data-test-subj":h},Object(l.jsx)(p.EuiFlexItem,{grow:!1},a),Object(l.jsx)(p.EuiFlexItem,{grow:!1},Object(l.jsx)(N,{anchorPosition:y,actionContext:f,showActionTooltips:o,visibleCellActions:c,disabledActionTypes:u})))},z=[()=>Object(l.jsx)(p.EuiLoadingSpinner,{size:"s","data-test-subj":"dataGridColumnCellAction-loading"})],$=[],V=({fields:e,getCellValue:t,triggerId:a,metadata:n,dataGridRef:i,disabledActionTypes:r=[]})=>{const o=Object(s.useMemo)((()=>{if(a&&null!=e&&e.length)return e.map((e=>({data:[{field:e}],trigger:{id:a},metadata:n})))}),[e,a,n]),{loading:l,value:c}=((e,t={})=>{const{getActions:a}=d(),{error:n,...i}=C()((()=>{var n;return Promise.all(null!==(n=null==e?void 0:e.map((e=>a(e).then((e=>{var a;return null!==(a=D(e,t.disabledActionTypes))&&void 0!==a?a:[]})))))&&void 0!==n?n:[])}),[e]);return F(n),i})(o,{disabledActionTypes:r});return Object(s.useMemo)((()=>l?null!=e&&e.length?e.map((()=>z)):$:a&&null!=c&&c.length&&null!=e&&e.length?c.length!==e.length?$:c.map(((r,s)=>r.map((r=>U({action:r,field:e[s],getCellValue:t,metadata:n,triggerId:a,dataGridRef:i}))))):$),[c,e,t,l,n,a,i])},U=({action:e,field:t,getCellValue:a,metadata:n,triggerId:i,dataGridRef:r})=>function({Component:o,rowIndex:c,isExpanded:u}){const d=Object(s.useRef)(null),p=Object(s.useRef)(null),m=Object(s.useMemo)((()=>{const{name:e}=t,r=a(e,c);return{data:[{field:t,value:r}],trigger:{id:i},nodeRef:d,metadata:n}}),[c]),b=Object(s.useCallback)((async()=>{m.nodeRef.current=await H({dataGrid:r.current,isExpanded:u,buttonRef:p}),e.execute(m)}),[m,u]);return Object(l.jsx)(o,{buttonRef:p,"aria-label":e.getDisplayName(m),title:e.getDisplayName(m),"data-test-subj":`dataGridColumnCellAction-${e.id}`,iconType:e.getIconType(m),onClick:b},e.getDisplayName(m))},H=({dataGrid:e,isExpanded:t,buttonRef:a})=>new Promise((n=>{const i=t?document.querySelector('div[role="gridcell"].euiDataGridRowCell--open'):G(a.current);null==e||e.closeCellPopover(),setTimeout((()=>{var e;n(null!==(e=null==i?void 0:i.firstElementChild)&&void 0!==e?e:null)}))})),G=e=>null==e?null:"DIV"===e.nodeName&&"gridcell"===e.getAttribute("role")?e:G(e.parentElement);var Q=a(516),W=a.n(Q);const K=e=>t=>{const a=e(t);return Y(a)},Y=e=>{const t=t=>X(e,t);return t.combine=t=>{const a=J(e,t);return Y(a)},t},J=(e,t)=>Z(e,t),X=(e,t)=>Z(e,t),Z=(e,t)=>{const{isCompatible:a,execute:n,...i}=t;let r=e.isCompatible;a&&(r=n?a:async t=>await e.isCompatible(t)&&await a(t));const s=null!=n?n:e.execute;return{...e,isCompatible:r,execute:s,...i}};var ee=a(427),te=a(428);const ae=h.i18n.translate("cellActions.actions.copyToClipboard.displayName",{defaultMessage:"Copy to Clipboard"}),ne=h.i18n.translate("cellActions.actions.copyToClipboard.successMessage",{defaultMessage:"Copied to the clipboard"}),ie=K((({notifications:e})=>({type:"cellAction-copy",getIconType:()=>"copyClipboard",getDisplayName:()=>ae,getDisplayNameTooltip:()=>ae,isCompatible:async({data:e})=>{var t;const a=null===(t=e[0])||void 0===t?void 0:t.field;return 1===e.length&&null!=a.name&&Object(ee.b)(a.type)},execute:async({data:t})=>{var a,n;const i=null===(a=t[0])||void 0===a?void 0:a.field,s=null===(n=t[0])||void 0===n?void 0:n.value,o=Object(ee.a)(Object(ee.d)(s));if(!Object(ee.c)(o))return void e.toasts.addWarning({title:te.a});const l=o.map((e=>Object(r.isString)(e)?`"${(e=>e.replace(/"/g,'\\"'))(e)}"`:e)).join(" AND "),c=""!==l?`${i.name}: ${l}`:i.name;W()(c,{debug:!0})&&e.toasts.addSuccess({title:ne},{toastLifeTimeMs:800})}})));var re=a(49);const se=e=>0===e.length||e.every((e=>""===e)),oe=({key:e,negate:t,value:a})=>({meta:{key:e,negate:t,type:re.FILTERS.PHRASE,params:{query:a.toString()}},query:{match_phrase:{[e]:{query:a.toString()}}}}),le=({key:e,value:t,negate:a})=>0===t.length?(({key:e,negate:t})=>({meta:{key:e,negate:t,type:re.FILTERS.EXISTS,value:"exists"},query:{exists:{field:e}}}))({key:e,negate:a}):t.length>1?(({values:e,key:t,negate:a})=>({meta:{key:t,negate:a,type:re.FILTERS.COMBINED,relation:re.BooleanRelation.AND,params:e.map((e=>oe({key:t,value:e})))}}))({key:e,negate:a,values:t}):oe({key:e,negate:a,value:t[0]}),ce=h.i18n.translate("cellActions.actions.filterIn",{defaultMessage:"Filter In"}),ue=K((({filterManager:e,notifications:{toasts:t}})=>({type:n,getIconType:()=>"plusInCircle",getDisplayName:()=>ce,getDisplayNameTooltip:()=>ce,isCompatible:async({data:e})=>{var t;const a=null===(t=e[0])||void 0===t?void 0:t.field;return 1===e.length&&!!a.name&&Object(ee.b)(a.type)},execute:async({data:a})=>{var n,i;const r=null===(n=a[0])||void 0===n?void 0:n.field,s=null===(i=a[0])||void 0===i?void 0:i.value,o=Object(ee.a)(Object(ee.d)(s));Object(ee.c)(o)?de({filterManager:e,fieldName:r.name,value:o}):t.addWarning({title:te.a})}}))),de=({filterManager:e,fieldName:t,value:a})=>{if(null!=e){const n=le({key:t,value:a,negate:se(a)});e.addFilters(n)}},pe=h.i18n.translate("cellActions.actions.filterOut",{defaultMessage:"Filter Out"}),me=K((({filterManager:e,notifications:{toasts:t}})=>({type:n,getIconType:()=>"minusInCircle",getDisplayName:()=>pe,getDisplayNameTooltip:()=>pe,isCompatible:async({data:e})=>{var t;const a=null===(t=e[0])||void 0===t?void 0:t.field;return 1===e.length&&!!a.name&&Object(ee.b)(a.type)},execute:async({data:a})=>{var n,i;const r=null===(n=a[0])||void 0===n?void 0:n.field,s=null===(i=a[0])||void 0===i?void 0:i.value,o=Object(ee.a)(Object(ee.d)(s));Object(ee.c)(o)?be({filterManager:e,fieldName:r.name,value:o}):t.addWarning({title:te.a})}}))),be=({filterManager:e,fieldName:t,value:a})=>{if(null!=e){const n=le({key:t,value:a,negate:!se(a)});e.addFilters(n)}}},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"j",(function(){return r})),a.d(t,"l",(function(){return s})),a.d(t,"k",(function(){return o})),a.d(t,"f",(function(){return l})),a.d(t,"i",(function(){return c})),a.d(t,"h",(function(){return u})),a.d(t,"g",(function(){return d})),a.d(t,"a",(function(){return p})),a.d(t,"c",(function(){return m})),a.d(t,"e",(function(){return b})),a.d(t,"d",(function(){return g}));var n=a(5);n.i18n.translate("xpack.securitySolution.timeline.properties.timelineDescription",{defaultMessage:"Timeline Description"});const i=n.i18n.translate("xpack.securitySolution.timeline.properties.addToFavoriteButtonLabel",{defaultMessage:"Add to favorites"}),r=n.i18n.translate("xpack.securitySolution.timeline.properties.removeFromFavoritesButtonLabel",{defaultMessage:"Remove from favorites"}),s=n.i18n.translate("xpack.securitySolution.timeline.properties.untitledTimelinePlaceholder",{defaultMessage:"Untitled timeline"}),o=n.i18n.translate("xpack.securitySolution.timeline.properties.untitledTemplatePlaceholder",{defaultMessage:"Untitled template"}),l=n.i18n.translate("xpack.securitySolution.timeline.properties.descriptionPlaceholder",{defaultMessage:"Add a description"}),c=n.i18n.translate("xpack.securitySolution.timeline.properties.notesButtonLabel",{defaultMessage:"Notes"}),u=n.i18n.translate("xpack.securitySolution.timeline.properties.newTimelineButtonLabel",{defaultMessage:"Create new timeline"}),d=n.i18n.translate("xpack.securitySolution.timeline.properties.newTemplateTimelineButtonLabel",{defaultMessage:"Create new timeline template"}),p=n.i18n.translate("xpack.securitySolution.timeline.properties.addTimelineButtonLabel",{defaultMessage:"Add new timeline or template"}),m=n.i18n.translate("xpack.securitySolution.timeline.properties.attachToCaseButtonLabel",{defaultMessage:"Attach to case"}),b=n.i18n.translate("xpack.securitySolution.timeline.properties.attachToNewCaseButtonLabel",{defaultMessage:"Attach to new case"}),g=n.i18n.translate("xpack.securitySolution.timeline.properties.attachToExistingCaseButtonLabel",{defaultMessage:"Attach to existing case"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(41),i=a.n(n),r=a(2),s=a.n(r),o=a(40);a(21);const l=({header:{title:e,callback:t,iconType:a,headerContent:n},content:{loading:i,error:l}={loading:!1,error:!1},expand:{expandable:p,expandedOnFirstRender:m}={expandable:!1,expandedOnFirstRender:!1},"data-test-subj":b,children:g})=>{const[f,y]=Object(r.useState)(m),h=Object(r.useCallback)((()=>{y(!f)}),[y,f]),v=Object(r.useMemo)((()=>s.a.createElement(o.EuiButtonIcon,{"data-test-subj":`${b}ToggleIcon`,"aria-label":"entity-toggle",color:"text",display:"empty",iconType:f?"arrowDown":"arrowRight",onClick:h,size:"xs"})),[b,f,h]),{euiTheme:E}=Object(o.useEuiTheme)(),x=Object(r.useMemo)((()=>s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiFlexGroup,{alignItems:"center",gutterSize:"s","data-test-subj":`${b}LeftSection`},s.a.createElement(o.EuiFlexItem,{grow:!1},p&&g&&v),s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(c,{color:t?"primary":"text",type:a,"data-test-subj":`${b}TitleIcon`,$_css:E.size.s})),s.a.createElement(o.EuiFlexItem,{grow:!1},t?s.a.createElement(u,{"data-test-subj":`${b}TitleLink`,onClick:t},e):s.a.createElement(o.EuiTitle,{size:"xxxs"},s.a.createElement(o.EuiText,{"data-test-subj":`${b}TitleText`},e)))))),[b,p,g,v,t,a,E.size.s,e]),j=Object(r.useMemo)((()=>n&&s.a.createElement(d,{grow:!1,"data-test-subj":`${b}RightSection`,$_css2:E.size.m},n)),[b,E.size.m,n]),S=Object(r.useMemo)((()=>!!g&&(!p||p&&f)),[g,p,f]),k=i?s.a.createElement(o.EuiFlexGroup,{justifyContent:"center"},s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiLoadingSpinner,{"data-test-subj":`${b}Loading`}))):l?null:g;return s.a.createElement(o.EuiSplitPanel.Outer,{grow:!0,hasBorder:!0},s.a.createElement(o.EuiSplitPanel.Inner,{grow:!1,color:"subdued",paddingSize:"xs"},s.a.createElement(o.EuiFlexGroup,{justifyContent:"spaceBetween",alignItems:"center"},x,j)),S&&s.a.createElement(o.EuiSplitPanel.Inner,{paddingSize:"none"},s.a.createElement(o.EuiPanel,{"data-test-subj":`${b}Content`},k)))};l.displayName="ExpandablePanel";var c=i()(o.EuiIcon).withConfig({displayName:"_StyledEuiIcon",componentId:"sc-6xxggh-0"})(["margin:"," 0;"],(e=>e.$_css)),u=i()(o.EuiLink).withConfig({displayName:"_StyledEuiLink",componentId:"sc-6xxggh-1"})(["font-size:12px;font-weight:700;"]),d=i()(o.EuiFlexItem).withConfig({displayName:"_StyledEuiFlexItem",componentId:"sc-6xxggh-2"})(["margin-right:",";"],(e=>e.$_css2))},function(e,t,a){"use strict";a.d(t,"a",(function(){return h}));var n=a(42),i=a(2),r=a.n(i),s=a(449),o=a(607),l=a(485),c=a(569),u=a(395),d=a(608),p=a(868),m=a(571),b=a(380),g=a(570),f=a(532),y=a(460);const h=r.a.memo((({data:e,timelineId:t,isDraggable:a})=>r.a.createElement(p.a,{contextId:`netflow-renderer-${t}-${e._id}`,destinationBytes:Object(s.a)(Object(n.get)(f.a,e)),destinationGeoContinentName:Object(s.a)(Object(n.get)(g.b,e)),destinationGeoCountryName:Object(s.a)(Object(n.get)(g.d,e)),destinationGeoCountryIsoCode:Object(s.a)(Object(n.get)(g.c,e)),destinationGeoRegionName:Object(s.a)(Object(n.get)(g.e,e)),destinationGeoCityName:Object(s.a)(Object(n.get)(g.a,e)),destinationIp:Object(s.a)(Object(n.get)(u.a,e)),destinationPackets:Object(s.a)(Object(n.get)(f.b,e)),destinationPort:Object(s.a)(Object(n.get)(b.a,e)),eventDuration:Object(s.a)(Object(n.get)(l.b,e)),eventId:Object(n.get)(c.a,e),eventEnd:Object(s.a)(Object(n.get)(m.b,e)),eventStart:Object(s.a)(Object(n.get)(m.c,e)),isDraggable:a,networkBytes:Object(s.a)(Object(n.get)(y.a,e)),networkCommunityId:Object(s.a)(Object(n.get)(y.b,e)),networkDirection:Object(s.a)(Object(n.get)(y.c,e)),networkPackets:Object(s.a)(Object(n.get)(y.d,e)),networkProtocol:Object(s.a)(Object(n.get)(y.e,e)),sourceBytes:Object(s.a)(Object(n.get)(f.c,e)),sourceGeoContinentName:Object(s.a)(Object(n.get)(g.h,e)),sourceGeoCountryName:Object(s.a)(Object(n.get)(g.j,e)),sourceGeoCountryIsoCode:Object(s.a)(Object(n.get)(g.i,e)),sourceGeoRegionName:Object(s.a)(Object(n.get)(g.k,e)),sourceGeoCityName:Object(s.a)(Object(n.get)(g.g,e)),sourceIp:Object(s.a)(Object(n.get)(u.d,e)),sourcePackets:Object(s.a)(Object(n.get)(f.d,e)),sourcePort:Object(s.a)(Object(n.get)(b.c,e)),tlsClientCertificateFingerprintSha1:Object(s.a)(Object(n.get)(o.b,e)),tlsFingerprintsJa3Hash:Object(s.a)(Object(n.get)(d.a,e)),tlsServerCertificateFingerprintSha1:Object(s.a)(Object(n.get)(o.c,e)),transport:Object(s.a)(Object(n.get)(y.f,e)),userName:void 0})));h.displayName="NetflowRenderer"},function(e,t,a){"use strict";var n=a(1321);e.exports=function(e,t,a,i){var r,s=e.length,o=0;if(t=t<0?-t>s?0:s+t:t>s?s:t,a=a>0?a:0,i.length<1e4)(r=Array.from(i)).unshift(t,a),n.apply(e,r);else for(a&&n.apply(e,[t,a]);o<i.length;)(r=i.slice(o,o+1e4)).unshift(t,0),n.apply(e,r),o+=1e4,t+=1e4}},function(e,t,a){"use strict";e.exports=function(e){return e<0||32===e}},function(e,t,a){"use strict";var n=a(465);e.exports=function(e){return function(t){return e.test(n(t))}}},function(e,t,a){"use strict";a.d(t,"d",(function(){return c})),a.d(t,"c",(function(){return u})),a.d(t,"b",(function(){return d})),a.d(t,"e",(function(){return p})),a.d(t,"a",(function(){return m})),a.d(t,"f",(function(){return b}));var n=a(56),i=a(478),r=a(14),s=a(45),o=a(2),l=a(131);const c=e=>e===l.a.alerts||e===l.a.rules||e===l.a.rulesAdd||e===l.a.rulesCreate||e===l.a.exceptions,u=e=>e.substring(1),d=(e,t)=>{const a=Object(i.parse)(e,{sort:!1})[t];return Array.isArray(a)?a[0]:a},p=e=>Object(o.useCallback)((()=>{const t=d(u(window.location.search),e);return Object(n.safeDecode)(null!=t?t:"")}),[e]),m=e=>Object(i.stringify)(r.url.encodeQuery(e),{sort:!1,encode:!1}),b=()=>{const e=Object(s.useHistory)();return Object(o.useCallback)((t=>{const a=window.location.search,r=Object(i.parse)(a,{sort:!1});Object.keys(t).forEach((e=>{const a=t[e];if(null!=a&&""!==a)try{r[e]=Object(n.encode)(a)}catch{console.error("Unable to encode url param value")}else delete r[e]}));const s=m(r);u(a)!==s&&e.replace({search:s})}),[e])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(8);const i=(e,t=!1)=>{if(Array.isArray(e))return e;const a={};return Object.entries(e).forEach((([e,i])=>{const r=t&&Array.isArray(i)&&1===i.length;Object(n.merge)(a,Object(n.setWith)({},e,r?i[0]:i,Object))})),a}},function(e,t,a){"use strict";var n,i=function(){var e={};return function(t){if(void 0===e[t]){var a=document.querySelector(t);if(window.HTMLIFrameElement&&a instanceof window.HTMLIFrameElement)try{a=a.contentDocument.head}catch(e){a=null}e[t]=a}return e[t]}}(),r=[];function s(e){for(var t=-1,a=0;a<r.length;a++)if(r[a].identifier===e){t=a;break}return t}function o(e,t){for(var a={},n=[],i=0;i<e.length;i++){var o=e[i],l=t.base?o[0]+t.base:o[0],c=a[l]||0,u="".concat(l," ").concat(c);a[l]=c+1;var d=s(u),p={css:o[1],media:o[2],sourceMap:o[3]};-1!==d?(r[d].references++,r[d].updater(p)):r.push({identifier:u,updater:g(p,t),references:1}),n.push(u)}return n}function l(e){var t=document.createElement("style"),n=e.attributes||{};if(void 0===n.nonce){var r=a.nc;r&&(n.nonce=r)}if(Object.keys(n).forEach((function(e){t.setAttribute(e,n[e])})),"function"==typeof e.insert)e.insert(t);else{var s=i(e.insert||"head");if(!s)throw new Error("Couldn't find a style target. This probably means that the value for the 'insert' parameter is invalid.");s.appendChild(t)}return t}var c,u=(c=[],function(e,t){return c[e]=t,c.filter(Boolean).join("\n")});function d(e,t,a,n){var i=a?"":n.media?"@media ".concat(n.media," {").concat(n.css,"}"):n.css;if(e.styleSheet)e.styleSheet.cssText=u(t,i);else{var r=document.createTextNode(i),s=e.childNodes;s[t]&&e.removeChild(s[t]),s.length?e.insertBefore(r,s[t]):e.appendChild(r)}}function p(e,t,a){var n=a.css,i=a.media,r=a.sourceMap;if(i?e.setAttribute("media",i):e.removeAttribute("media"),r&&"undefined"!=typeof btoa&&(n+="\n/*# sourceMappingURL=data:application/json;base64,".concat(btoa(unescape(encodeURIComponent(JSON.stringify(r))))," */")),e.styleSheet)e.styleSheet.cssText=n;else{for(;e.firstChild;)e.removeChild(e.firstChild);e.appendChild(document.createTextNode(n))}}var m=null,b=0;function g(e,t){var a,n,i;if(t.singleton){var r=b++;a=m||(m=l(t)),n=d.bind(null,a,r,!1),i=d.bind(null,a,r,!0)}else a=l(t),n=p.bind(null,a,t),i=function(){!function(e){if(null===e.parentNode)return!1;e.parentNode.removeChild(e)}(a)};return n(e),function(t){if(t){if(t.css===e.css&&t.media===e.media&&t.sourceMap===e.sourceMap)return;n(e=t)}else i()}}e.exports=function(e,t){(t=t||{}).singleton||"boolean"==typeof t.singleton||(t.singleton=(void 0===n&&(n=Boolean(window&&document&&document.all&&!window.atob)),n));var a=o(e=e||[],t);return function(e){if(e=e||[],"[object Array]"===Object.prototype.toString.call(e)){for(var n=0;n<a.length;n++){var i=s(a[n]);r[i].references--}for(var l=o(e,t),c=0;c<a.length;c++){var u=s(a[c]);0===r[u].references&&(r[u].updater(),r.splice(u,1))}a=l}}}},function(e,t,a){"use strict";e.exports=function(e){var t=[];return t.toString=function(){return this.map((function(t){var a=function(e,t){var a,n,i,r=e[1]||"",s=e[3];if(!s)return r;if(t&&"function"==typeof btoa){var o=(a=s,n=btoa(unescape(encodeURIComponent(JSON.stringify(a)))),i="sourceMappingURL=data:application/json;charset=utf-8;base64,".concat(n),"/*# ".concat(i," */")),l=s.sources.map((function(e){return"/*# sourceURL=".concat(s.sourceRoot||"").concat(e," */")}));return[r].concat(l).concat([o]).join("\n")}return[r].join("\n")}(t,e);return t[2]?"@media ".concat(t[2]," {").concat(a,"}"):a})).join("")},t.i=function(e,a,n){"string"==typeof e&&(e=[[null,e,""]]);var i={};if(n)for(var r=0;r<this.length;r++){var s=this[r][0];null!=s&&(i[s]=!0)}for(var o=0;o<e.length;o++){var l=[].concat(e[o]);n&&i[l[0]]||(a&&(l[2]?l[2]="".concat(a," and ").concat(l[2]):l[2]=a),t.push(l))}},t}},function(e,t,a){e.exports=a(33)(284)},function(e,t,a){"use strict";a.d(t,"c",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"b",(function(){return s})),a(4);var n=a(195);const i=(e,t)=>`/${e}${Object(n.a)(t)}`,r=(e,t)=>`/name/${e}${Object(n.a)(t)}`,s=(e,t,a)=>`/name/${e}/${t}${Object(n.a)(a)}`},function(e,t,a){"use strict";a.d(t,"d",(function(){return ce})),a.d(t,"f",(function(){return ue})),a.d(t,"b",(function(){return de})),a.d(t,"c",(function(){return pe})),a.d(t,"e",(function(){return me})),a.d(t,"a",(function(){return be}));var n=a(41),i=a.n(n),r=a(2),s=a.n(r),o=a(40),l=(a(21),a(171)),c=a(235),u=a(223),d=a(191),p=a(924),m=a(498),b=a(202),g=a(115);const f="analyze_graph",y=()=>{const{eventId:e}=Object(c.b)(),t="flyout",{from:a,to:n,shouldUpdate:i,selectedPatterns:l}=Object(m.a)(Object(g.isActiveTimeline)(t)),f=Object(r.useMemo)((()=>({from:a,to:n})),[a,n]);return e?s.a.createElement("div",{"data-test-subj":d.a},s.a.createElement(p.a,{databaseDocumentID:e,resolverComponentInstanceID:t,indices:l,shouldUpdate:i,filters:f})):s.a.createElement(o.EuiEmptyPrompt,{iconType:"error",color:"danger",title:s.a.createElement("h2",null,Object(b.g)(u.a)),body:s.a.createElement("p",null,Object(b.f)(u.a)),"data-test-subj":d.b})};y.displayName="AnalyzeGraph";var h=a(5);const v=h.i18n.translate("xpack.securitySolution.flyout.documentDetails.visualizeOptions",{defaultMessage:"Visualize options"}),E=h.i18n.translate("xpack.securitySolution.flyout.documentDetails.sessionViewButton",{defaultMessage:"Session View"}),x=h.i18n.translate("xpack.securitySolution.flyout.documentDetails.analyzerGraphButton",{defaultMessage:"Analyzer Graph"}),j=h.i18n.translate("xpack.securitySolution.flyout.documentDetails.insightsOptions",{defaultMessage:"Insights options"}),S=h.i18n.translate("xpack.securitySolution.flyout.documentDetails.entitiesButton",{defaultMessage:"Entities"}),k=h.i18n.translate("xpack.securitySolution.flyout.documentDetails.threatIntelligenceButton",{defaultMessage:"Threat intelligence"}),O=h.i18n.translate("xpack.securitySolution.flyout.documentDetails.prevalenceButton",{defaultMessage:"Prevalence"}),w=h.i18n.translate("xpack.securitySolution.flyout.documentDetails.correlationsButton",{defaultMessage:"Correlations"});var T=a(366),I=a(261),C=a(102);const M="session-view",_=()=>{const{sessionView:e}=Object(C.j)().services,{getFieldsData:t,indexName:a}=Object(c.b)(),n=Object(I.a)(t(T.b)),i=Object(I.a)(t(T.c)),r=Object(I.a)(t(T.d)),l=n||a;return l&&i&&r?s.a.createElement("div",{"data-test-subj":d.E},e.getSessionView({index:l,sessionEntityId:i,sessionStartTime:r,isFullScreen:!0})):s.a.createElement(o.EuiEmptyPrompt,{iconType:"error",color:"danger",title:s.a.createElement("h2",null,Object(b.g)(u.K)),body:s.a.createElement("p",null,Object(b.f)(u.K)),"data-test-subj":d.D})};_.displayName="SessionView";var F=a(196),A=a(159);const D=[{id:M,label:E,"data-test-subj":"securitySolutionDocumentDetailsFlyoutVisualizeTabSessionViewButton"},{id:f,label:x,"data-test-subj":"securitySolutionDocumentDetailsFlyoutVisualizeTabGraphAnalyzerButton"}],N=Object(r.memo)((()=>{var e,t,a,n,i;const{eventId:u,indexName:d,scopeId:p}=Object(c.b)(),{panels:m,openLeftPanel:b}=Object(l.c)(),[g,h]=Object(r.useState)(null!==(e=null===(t=m.left)||void 0===t||null===(a=t.path)||void 0===a?void 0:a.subTab)&&void 0!==e?e:M),{startTransaction:E}=Object(A.b)(),x=Object(r.useCallback)((e=>{h(e),e===f&&E({name:F.a.OPEN_ANALYZER}),b({id:ce,path:{tab:ue,subTab:e},params:{id:u,indexName:d,scopeId:p}})}),[E,u,d,p,b]);return Object(r.useEffect)((()=>{var e,t,a,n;null!==(e=m.left)&&void 0!==e&&null!==(t=e.path)&&void 0!==t&&t.subTab&&h(null===(a=m.left)||void 0===a||null===(n=a.path)||void 0===n?void 0:n.subTab)}),[null===(n=m.left)||void 0===n||null===(i=n.path)||void 0===i?void 0:i.subTab]),s.a.createElement(s.a.Fragment,null,s.a.createElement(o.EuiButtonGroup,{color:"primary",name:"coarsness",legend:v,options:D,idSelected:g,onChange:e=>x(e),buttonSize:"compressed",isFullWidth:!0,"data-test-subj":"securitySolutionDocumentDetailsFlyoutVisualizeTabButtonGroup"}),s.a.createElement(o.EuiSpacer,{size:"m"}),g===M&&s.a.createElement(_,null),g===f&&s.a.createElement(y,null))}));N.displayName="VisualizeTab";var P=a(44),R=a(1077),L=a(402);const B=()=>{const{dataFormattedForFieldBrowser:e}=Object(c.b)(),{loading:t,error:a,basicAlertData:n,ruleNote:i}=Object(R.a)({dataFormattedForFieldBrowser:e});return!e||a?null:t?s.a.createElement(o.EuiFlexGroup,{justifyContent:"spaceAround","data-test-subj":d.n},s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiLoadingSpinner,{size:"m"}))):s.a.createElement(s.a.Fragment,null,n.ruleId&&i?s.a.createElement(L.b,{basicData:n,ruleNote:i,showTitle:!1,showFullView:!0}):s.a.createElement("div",{"data-test-subj":d.o},s.a.createElement(P.FormattedMessage,{id:"xpack.securitySolution.flyout.investigationGuideNoData",defaultMessage:"There’s no investigation guide for this rule. {documentation} to add one.",values:{documentation:s.a.createElement(o.EuiLink,{href:"https://www.elastic.co/guide/en/security/current/rules-ui-management.html#edit-rules-settings",target:"_blank"},s.a.createElement(P.FormattedMessage,{id:"xpack.securitySolution.flyout.documentDetails.investigationGuideDocumentationLink",defaultMessage:"Edit the rule's settings"}))}})))};B.displayName="InvestigationGuide";const q=Object(r.memo)((()=>{const{dataFormattedForFieldBrowser:e}=Object(c.b)();return null==e?null:s.a.createElement(o.EuiPanel,{"data-test-subj":"securitySolutionDocumentDetailsFlyoutInvestigationsTabContent",hasShadow:!1},s.a.createElement(B,null))}));q.displayName="InvestigationTab";const z=h.i18n.translate("xpack.securitySolution.flyout.documentDetails.visualizeTab",{defaultMessage:"Visualize"}),$=h.i18n.translate("xpack.securitySolution.flyout.documentDetails.insightsTab",{defaultMessage:"Insights"}),V=h.i18n.translate("xpack.securitySolution.flyout.documentDetails.investigationsTab",{defaultMessage:"Investigation"}),U=h.i18n.translate("xpack.securitySolution.flyout.documentDetails.responseTab",{defaultMessage:"Response"});var H=a(507),G=a(1129),Q=a(1082),W=a(1122);const K=[{id:H.a,label:S,"data-test-subj":"securitySolutionDocumentDetailsFlyoutInsightsTabEntitiesButton"},{id:G.a,label:k,"data-test-subj":"securitySolutionDocumentDetailsFlyoutInsightsTabThreatIntelligenceButton"},{id:Q.a,label:O,"data-test-subj":"securitySolutionDocumentDetailsFlyoutInsightsTabPrevalenceButton"},{id:W.a,label:w,"data-test-subj":"securitySolutionDocumentDetailsFlyoutInsightsTabCorrelationsButton"}],Y=Object(r.memo)((()=>{var e,t,a,n,i;const{eventId:u,indexName:d,scopeId:p}=Object(c.b)(),{panels:m,openLeftPanel:b}=Object(l.c)(),[g,f]=Object(r.useState)(null!==(e=null===(t=m.left)||void 0===t||null===(a=t.path)||void 0===a?void 0:a.subTab)&&void 0!==e?e:H.a),y=Object(r.useCallback)((e=>{f(e),b({id:ce,path:{tab:de,subTab:e},params:{id:u,indexName:d,scopeId:p}})}),[u,d,p,b]);return Object(r.useEffect)((()=>{var e,t,a,n;null!==(e=m.left)&&void 0!==e&&null!==(t=e.path)&&void 0!==t&&t.subTab&&f(null===(a=m.left)||void 0===a||null===(n=a.path)||void 0===n?void 0:n.subTab)}),[null===(n=m.left)||void 0===n||null===(i=n.path)||void 0===i?void 0:i.subTab]),s.a.createElement(s.a.Fragment,null,s.a.createElement(o.EuiButtonGroup,{color:"primary",name:"coarsness",legend:j,options:K,idSelected:g,onChange:y,buttonSize:"compressed",isFullWidth:!0,"data-test-subj":"securitySolutionDocumentDetailsFlyoutInsightsTabButtonGroup"}),s.a.createElement(o.EuiSpacer,{size:"m"}),g===H.a&&s.a.createElement(H.b,null),g===G.a&&s.a.createElement(G.b,null),g===Q.a&&s.a.createElement(Q.b,null),g===W.a&&s.a.createElement(W.b,null))}));Y.displayName="InsightsTab";var J=a(255),X=a(124),Z=a(931),ee=a(944);const te=i.a.div.withConfig({displayName:"ExtendedFlyoutWrapper",componentId:"sc-1anotmt-0"})(["figure{background-color:white"]),ae=i.a.div.withConfig({displayName:"InlineBlock",componentId:"sc-1anotmt-1"})(["display:inline-block;line-height:1.7em;"]),ne=()=>{var e,t,a,n;const{searchHit:i,dataAsNestedObject:r}=Object(c.b)(),l=Object(X.a)("endpointResponseActionsEnabled"),p=i?Object(J.a)(i.fields):void 0,m=null==p||null===(e=p.kibana)||void 0===e||null===(t=e.alert)||void 0===t||null===(a=t.rule)||void 0===a||null===(n=a.parameters)||void 0===n?void 0:n[0].response_actions,b=Object(ee.a)({rawEventData:i,ecsData:r}),g=Object(Z.a)({rawEventData:i,ecsData:r});return s.a.createElement("div",{"data-test-subj":d.B},s.a.createElement(o.EuiTitle,{size:"xxxs"},s.a.createElement("h5",null,u.J)),s.a.createElement(o.EuiSpacer,{size:"s"}),m?s.a.createElement(te,null,l?null==b?void 0:b.content:null==g?void 0:g.content):s.a.createElement(ae,{"data-test-subj":d.C},s.a.createElement(P.FormattedMessage,{id:"xpack.securitySolution.flyout.documentDetails.response.emptyMessage",defaultMessage:"There are no response actions defined for this event. To add some, edit the rule’s settings and set up {link}.",values:{link:s.a.createElement(o.EuiLink,{href:"https://www.elastic.co/guide/en/security/current/rules-ui-create.html#rule-response-action",target:"_blank"},s.a.createElement(P.FormattedMessage,{id:"xpack.securitySolution.flyout.documentDetails.response.responseActionLink",defaultMessage:"response actions"}))}})))};ne.displayName="ResponseDetails";const ie=Object(r.memo)((()=>s.a.createElement(o.EuiPanel,{"data-test-subj":"securitySolutionDocumentDetailsFlyoutResponseTabContent",hasShadow:!1},s.a.createElement(ne,null))));ie.displayName="ResponseTab";const re=[{id:"visualize","data-test-subj":"securitySolutionDocumentDetailsFlyoutVisualizeTab",name:z,content:s.a.createElement(N,null),visible:!1},{id:"insights","data-test-subj":"securitySolutionDocumentDetailsFlyoutInsightsTab",name:$,content:s.a.createElement(Y,null),visible:!0},{id:"investigation","data-test-subj":"securitySolutionDocumentDetailsFlyoutInvestigationTab",name:V,content:s.a.createElement(q,null),visible:!0},{id:"response","data-test-subj":"securitySolutionDocumentDetailsFlyoutResponseTab",name:U,content:s.a.createElement(ie,null),visible:!0}],se=Object(r.memo)((({selectedTabId:e,setSelectedTabId:t})=>{const a=re.filter((e=>e.visible)).map(((a,n)=>s.a.createElement(o.EuiTab,{onClick:()=>{return e=a.id,t(e);var e},isSelected:a.id===e,key:n,"data-test-subj":a["data-test-subj"]},a.name)));return s.a.createElement(o.EuiFlyoutHeader,{hasBorder:!0},s.a.createElement(oe,{size:"l",expand:!0},a))}));se.displayName="PanelHeader";var oe=i()(o.EuiTabs).withConfig({displayName:"_StyledEuiTabs",componentId:"sc-5ez8i1-0"})(["margin-bottom:-25px;"]);const le=({selectedTabId:e})=>{const t=Object(r.useMemo)((()=>{var t;return null===(t=re.filter((e=>e.visible)).find((t=>t.id===e)))||void 0===t?void 0:t.content}),[e]);return s.a.createElement(o.EuiFlyoutBody,null,t)};le.displayName="PanelContent";const ce="document-details-left",ue="visualize",de="insights",pe="investigation",me="response",be=Object(r.memo)((({path:e})=>{const{openLeftPanel:t}=Object(l.c)(),{eventId:a,indexName:n,scopeId:i}=Object(c.b)(),u=Object(r.useMemo)((()=>{var t;const a=re.filter((e=>e.visible)),n=a[0].id;return e&&null!==(t=a.map((e=>e.id)).find((t=>t===e.tab)))&&void 0!==t?t:n}),[e]);return s.a.createElement(ge,{$_css:Object(o.useEuiBackgroundColor)("subdued")},s.a.createElement(se,{selectedTabId:u,setSelectedTabId:e=>{t({id:ce,path:{tab:e},params:{id:a,indexName:n,scopeId:i}})}}),s.a.createElement(le,{selectedTabId:u}))}));be.displayName="LeftPanel";var ge=i()("div").withConfig({displayName:"_StyledDiv",componentId:"sc-49975n-0"})(["height:100%;background:",";"],(e=>e.$_css))},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=(e,t)=>"string"==typeof e?e:Array.isArray(e)&&e.length>0&&"string"==typeof e[0]?e[0]:null!=t?t:null},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"b",(function(){return s}));var n=a(112);let i;a(145),function(e){e["going to run"]="going to run",e.running="running",e["partial failure"]="partial failure",e.failed="failed",e.succeeded="succeeded"}(i||(i={}));const r=Object(n.u)("RuleExecutionStatus",i),s=(Object.values(i),n.n)},function(e,t,a){"use strict";let n,i,r,s,o,l,c,u,d,p;a.d(t,"c",(function(){return n})),a.d(t,"i",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"b",(function(){return s})),a.d(t,"d",(function(){return o})),a.d(t,"e",(function(){return l})),a.d(t,"f",(function(){return c})),a.d(t,"h",(function(){return u})),a.d(t,"j",(function(){return d})),a.d(t,"g",(function(){return p})),function(e){e.inbound="inbound",e.outbound="outbound",e.internal="internal",e.external="external",e.incoming="incoming",e.outgoing="outgoing",e.listening="listening",e.unknown="unknown"}(n||(n={})),function(e){e.bytes_in="bytes_in",e.bytes_out="bytes_out",e.flows="flows",e.destination_ips="destination_ips",e.source_ips="source_ips"}(i||(i={})),function(e){e.client="client",e.destination="destination",e.server="server",e.source="source"}(r||(r={})),function(e){e.destination="destination",e.source="source"}(s||(s={})),function(e){e.dnsName="dnsName",e.queryCount="queryCount",e.uniqueDomains="uniqueDomains",e.dnsBytesIn="dnsBytesIn",e.dnsBytesOut="dnsBytesOut"}(o||(o={})),function(e){e.domains="domains",e.lastHost="lastHost",e.lastSourceIp="lastSourceIp",e.methods="methods",e.path="path",e.requestCount="requestCount",e.statuses="statuses"}(l||(l={})),function(e){e.dns="networkKpiDns",e.networkEvents="networkKpiNetworkEvents",e.tlsHandshakes="networkKpiTlsHandshakes",e.uniqueFlows="networkKpiUniqueFlows",e.uniquePrivateIps="networkKpiUniquePrivateIps"}(c||(c={})),function(e){e._id="_id"}(u||(u={})),function(e){e.name="name",e.count="count"}(d||(d={})),function(e){e.details="networkDetails",e.dns="dns",e.http="http",e.overview="overviewNetwork",e.tls="tls",e.topCountries="topCountries",e.topNFlow="topNFlow",e.users="users"}(p||(p={}))},,function(e,t,a){"use strict";a.d(t,"a",(function(){return h})),a.d(t,"b",(function(){return v})),a.d(t,"c",(function(){return E}));var n=a(8),i=a(2),r=a.n(i),s=a(470),o=a(4),l=a(587),c=a(221),u=a(102),d=a(254),p=a(853),m=a(588),b=a(1106),g=a(738),f=a(421);const y=Object(i.createContext)(null),h=({children:e})=>{var t,a,n,l,h,v,E,j,S;const[k]=Object(u.p)(o.R),{sessionStorage:O}=Object(u.j)().services,{filter:w,sorting:T,pagination:I}=function(){const e=Object(d.e)(c.a.rulesTable),{services:{sessionStorage:t}}=Object(u.j)(),a=e(),n=function(e){try{return e.get(m.c)}catch{return null}}(t);if(!a&&!n)return{};const[i,r,s]=function(e,t){var a,n,i,r,s,l,c,u;const[d]=Object(f.d)(e,g.b),[p]=Object(f.d)(t,g.b),m={searchTerm:null!==(a=null==d?void 0:d.searchTerm)&&void 0!==a?a:null==p?void 0:p.searchTerm,source:null!==(n=null==d?void 0:d.source)&&void 0!==n?n:null==p?void 0:p.source,tags:null!==(i=null==d?void 0:d.tags)&&void 0!==i?i:null==p?void 0:p.tags,enabled:null!==(r=null==d?void 0:d.enabled)&&void 0!==r?r:null==p?void 0:p.enabled,ruleExecutionStatus:null!==(s=null==d?void 0:d.ruleExecutionStatus)&&void 0!==s?s:null==p?void 0:p.ruleExecutionStatus},[b]=Object(f.d)(e,g.c),[y]=Object(f.d)(t,g.c),h={field:null!==(l=null==b?void 0:b.field)&&void 0!==l?l:null==y?void 0:y.field,order:null!==(c=null==b?void 0:b.order)&&void 0!==c?c:null==y?void 0:y.order},[v]=Object(f.d)(e,g.e),[E]=Object(f.d)(t,g.d),x={page:null==v?void 0:v.page,perPage:null!==(u=null==v?void 0:v.perPage)&&void 0!==u?u:null==E?void 0:E.perPage};return x.perPage&&(x.perPage<0||x.perPage>o.nc)&&delete x.perPage,[m,h,x]}(a,n);return{filter:i,sorting:r,pagination:s}}(),[C,M]=Object(i.useState)({filter:null!==(t=null==w?void 0:w.searchTerm)&&void 0!==t?t:b.a.filter,tags:null!==(a=null==w?void 0:w.tags)&&void 0!==a?a:b.a.tags,showCustomRules:null!==(n=(null==w?void 0:w.source)===g.a.Custom)&&void 0!==n?n:b.a.showCustomRules,showElasticRules:null!==(l=(null==w?void 0:w.source)===g.a.Prebuilt)&&void 0!==l?l:b.a.showElasticRules,enabled:null==w?void 0:w.enabled,ruleExecutionStatus:null!==(h=null==w?void 0:w.ruleExecutionStatus)&&void 0!==h?h:b.a.ruleExecutionStatus}),[_,F]=Object(i.useState)({field:null!==(v=null==T?void 0:T.field)&&void 0!==v?v:b.d.field,order:null!==(E=null==T?void 0:T.order)&&void 0!==E?E:b.d.order}),[A,D]=Object(i.useState)(!1),[N,P]=Object(i.useState)(k.on),[R,L]=Object(i.useState)({ids:[],action:null}),[B,q]=Object(i.useState)(!1),[z,$]=Object(i.useState)(null!==(j=null==I?void 0:I.page)&&void 0!==j?j:b.b),[V,U]=Object(i.useState)(null!==(S=null==I?void 0:I.perPage)&&void 0!==S?S:b.c),[H,G]=Object(i.useState)([]),Q=Object(i.useRef)(null),W=R.ids.length>0,K=Object(i.useMemo)((()=>({page:z,perPage:V})),[z,V]),Y=Object(i.useCallback)((e=>{M((t=>({...t,...e}))),$(1),G([]),D(!1)}),[]),J=Object(i.useCallback)((()=>{G([]),D(!1)}),[]),X=Object(d.f)(),Z=Object(i.useCallback)((()=>{M({filter:b.a.filter,showElasticRules:b.a.showElasticRules,showCustomRules:b.a.showCustomRules,tags:b.a.tags,enabled:void 0,ruleExecutionStatus:b.a.ruleExecutionStatus}),F({field:b.d.field,order:b.d.order}),$(b.b),U(b.c),X({[c.a.rulesTable]:null}),O.remove(m.c)}),[M,F,$,U,X,O]);Object(i.useEffect)((()=>{var e;H.length>0?(P(!1),null==Q.current&&(Q.current=N)):(P(null!==(e=Q.current)&&void 0!==e?e:N),Q.current=null)}),[H,N]);const{data:{rules:ee,total:te}={rules:[],total:0},refetch:ae,dataUpdatedAt:ne,isFetched:ie,isFetching:re,isLoading:se,isRefetching:oe}=Object(p.a)({filterOptions:C,sortingOptions:_,pagination:K},{refetchInterval:N&&!W&&k.value,keepPreviousData:!0}),{data:le,isLoading:ce,isFetching:ue,isError:de,refetch:pe}=Object(s.a)(ee.map((e=>e.id)),{enabled:ee.length>0}),me=Object(i.useCallback)((async()=>{const e=await ae();return await pe(),e}),[ae,pe]),be=Object(i.useMemo)((()=>({reFetchRules:me,setFilterOptions:Y,setIsAllSelected:D,setIsRefreshOn:P,setLoadingRules:L,setPage:$,setPerPage:U,setSelectedRuleIds:G,setSortingOptions:F,clearRulesSelection:J,setIsPreflightInProgress:q,clearFilters:Z})),[me,Y,D,P,L,$,U,G,F,J,q,Z]),ge=Object(i.useMemo)((()=>({state:{rules:ee,rulesSnoozeSettings:{data:null!=le?le:{},isLoading:ce,isFetching:ue,isError:de},pagination:{page:z,perPage:V,total:te},filterOptions:C,isPreflightInProgress:B,isActionInProgress:W,isAllSelected:A,isFetched:ie,isFetching:re,isLoading:se,isRefetching:oe,isRefreshOn:N,lastUpdated:ne,loadingRuleIds:R.ids,loadingRulesAction:R.action,selectedRuleIds:H,sortingOptions:_,isDefault:x(C,_,{page:z,perPage:V,total:te})},actions:be})),[ee,le,ce,ue,de,z,V,te,C,B,W,A,ie,re,se,oe,N,ne,R.ids,R.action,H,_,be]);return r.a.createElement(y.Provider,{value:ge},e)},v=()=>{const e=Object(i.useContext)(y);return Object(l.a)(e,"useRulesTableContext should be used inside RulesTableContextProvider"),e},E=()=>Object(i.useContext)(y);function x(e,t,a){return Object(n.isEqual)(e,b.a)&&Object(n.isEqual)(t,b.d)&&a.page===b.b&&a.perPage===b.c}},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(2),i=a(102);const r=()=>{const{spaces:e}=Object(i.j)().services,[t,a]=Object(n.useState)();return Object(n.useEffect)((()=>{e&&e.getActiveSpace().then((e=>a(e.id)))}),[e]),t}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(){var e=n.useRef(!1),t=n.useCallback((function(){return e.current}),[]);return n.useEffect((function(){return e.current=!0,function(){e.current=!1}})),t}},function(e,t,a){"use strict";a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return s})),a.d(t,"c",(function(){return o})),a.d(t,"e",(function(){return l})),a.d(t,"f",(function(){return c})),a.d(t,"d",(function(){return u}));var n=a(5),i=a(106);const r=n.i18n.translate("xpack.securitySolution.timeline.defaultTimelineTitle",{defaultMessage:"None"}),s=n.i18n.translate("xpack.securitySolution.timeline.defaultTimelineDescription",{defaultMessage:"Timeline offered by default when creating new timeline."}),o=({activePage:e,totalPages:t})=>n.i18n.translate("xpack.securitySolution.timeline.eventsTableAriaLabel",{values:{activePage:e,totalPages:t},defaultMessage:"events; Page {activePage} of {totalPages}"}),l=e=>n.i18n.translate("xpack.securitySolution.timeline.searchBoxPlaceholder",{values:{timeline:e===i.l.template?"Timeline template":"Timeline"},defaultMessage:"e.g. {timeline} name or description"}),c=n.i18n.translate("xpack.securitySolution.timeline.flyoutTimelineTemplateLabel",{defaultMessage:"Timeline template"}),u=n.i18n.translate("xpack.securitySolution.timeline.participantsTitle",{defaultMessage:"Participants"})},function(e,t,a){"use strict";a.d(t,"m",(function(){return i})),a.d(t,"n",(function(){return r})),a.d(t,"q",(function(){return s})),a.d(t,"f",(function(){return o})),a.d(t,"e",(function(){return l})),a.d(t,"k",(function(){return c})),a.d(t,"l",(function(){return u})),a.d(t,"d",(function(){return d})),a.d(t,"a",(function(){return p})),a.d(t,"c",(function(){return m})),a.d(t,"b",(function(){return b})),a.d(t,"j",(function(){return g})),a.d(t,"i",(function(){return f})),a.d(t,"h",(function(){return y})),a.d(t,"g",(function(){return h})),a.d(t,"o",(function(){return v})),a.d(t,"p",(function(){return E}));var n=a(5);const i=n.i18n.translate("xpack.elasticAssistant.connectors.useLoadActionTypes.errorMessage",{defaultMessage:"Welcome to your Elastic AI Assistant! I am your 100% open-source portal into your Elastic Life. "}),r=n.i18n.translate("xpack.elasticAssistant.connectors.useLoadConnectors.errorMessage",{defaultMessage:"Welcome to your Elastic AI Assistant! I am your 100% open-source portal into your Elastic Life. "}),s=(n.i18n.translate("xpack.elasticAssistant.content.prompts.welcome.welcomeSecurityPrompt",{defaultMessage:"Welcome to your Elastic AI Assistant! I am your 100% open-source portal into Elastic Security. "}),n.i18n.translate("xpack.elasticAssistant.assistant.connectors.preconfiguredTitle",{defaultMessage:"Preconfigured"})),o=n.i18n.translate("xpack.elasticAssistant.assistant.connectors.connectorSelector.ariaLabel",{defaultMessage:"Conversation Selector"}),l=n.i18n.translate("xpack.elasticAssistant.assistant.connectors.connectorSelector.newConnectorOptions",{defaultMessage:"Add new Connector..."}),c=n.i18n.translate("xpack.elasticAssistant.assistant.connectors.connectorSelectorInline.connectorLabel",{defaultMessage:"Connector:"}),u=n.i18n.translate("xpack.elasticAssistant.assistant.connectors.connectorSelectorInline.connectorPlaceholder",{defaultMessage:"Select a Connector"}),d=n.i18n.translate("xpack.elasticAssistant.assistant.connectors.addConnectorButton.title",{defaultMessage:"Add Generative AI Connector"}),p=n.i18n.translate("xpack.elasticAssistant.assistant.connectors.addConnectorButton.description",{defaultMessage:"Configure a connector to continue the conversation"}),m=n.i18n.translate("xpack.elasticAssistant.assistant.connectors.addConnectorButton.missingPrivilegesTitle",{defaultMessage:"Generative AI Connector Required"}),b=n.i18n.translate("xpack.elasticAssistant.assistant.connectors.addConnectorButton.missingPrivilegesDescription",{defaultMessage:"Please contact your administrator to enable a Generative AI Connector."}),g=n.i18n.translate("xpack.elasticAssistant.assistant.connectors.setup.userYouTitle",{defaultMessage:"You"}),f=n.i18n.translate("xpack.elasticAssistant.assistant.connectors.setup.userAssistantTitle",{defaultMessage:"Assistant"}),y=n.i18n.translate("xpack.elasticAssistant.assistant.connectors.setup.timestampAtTitle",{defaultMessage:"at"}),h=n.i18n.translate("xpack.elasticAssistant.assistant.connectors.setup.skipTitle",{defaultMessage:"Click to skip..."}),v=n.i18n.translate("xpack.elasticAssistant.assistant.connectors.connectorMissingCallout.calloutTitle",{defaultMessage:"The current conversation is missing a connector configuration"}),E=n.i18n.translate("xpack.elasticAssistant.assistant.connectors.connectorMissingCallout.conversationSettingsLink",{defaultMessage:"Conversation Settings"})},function(e,t,a){"use strict";let n,i,r;a.r(t),a.d(t,"NetworkType",(function(){return n})),a.d(t,"NetworkTableType",(function(){return i})),a.d(t,"NetworkDetailsTableType",(function(){return r})),function(e){e.page="page",e.details="details"}(n||(n={})),function(e){e.alerts="alerts",e.dns="dns",e.http="http",e.topCountriesDestination="topCountriesDestination",e.topCountriesSource="topCountriesSource",e.topNFlowDestination="topNFlowDestination",e.topNFlowSource="topNFlowSource",e.tls="tls",e.anomalies="anomalies"}(i||(i={})),function(e){e.http="http",e.tls="tls",e.topCountriesDestination="topCountriesDestination",e.topCountriesSource="topCountriesSource",e.topNFlowDestination="topNFlowDestination",e.topNFlowSource="topNFlowSource",e.users="users",e.anomalies="anomalies"}(r||(r={}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return E}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(40),l=a(103),c=a(122),u=a(114),d=a(138),p=a(12),m=a(182),b=a(110),g=a(118),f=a(106),y=a(242),h=a(135),v=a(105);const E=({asEmptyButton:e,children:t,dataProviders:a,filters:n,timeRange:E,keepDataView:x,iconType:j,...S})=>{const k=Object(l.useDispatch)(),O=Object(r.useMemo)((()=>c.e.getSourcererDataViewsSelector()),[]),{defaultDataView:w,signalIndexName:T}=Object(v.a)((e=>O(e))),I=a&&a.find((e=>"template"===e.type)),C=Object(y.a)({timelineId:g.c.active,timelineType:I?f.l.template:f.l.default}),M=Object(r.useCallback)((()=>{(a||n)&&(E?C({timeRange:E}):C(),a&&k(Object(p.updateProviders)({id:g.c.active,providers:a})),n&&k(Object(p.setFilters)({id:g.c.active,filters:n})),x||k(m.d.setSelectedDataView({id:b.SourcererScopeName.timeline,selectedDataViewId:w.id,selectedPatterns:[T||""]})),k(d.b.removeLinkTo([u.a.timeline,u.a.global])))}),[a,C,k,w.id,T,n,E,x]);return e?s.a.createElement(o.EuiButtonEmpty,{"aria-label":h.h,onClick:M,flush:"right",size:"xs",iconType:j},t):s.a.createElement(o.EuiButton,i()({"aria-label":h.h,onClick:M},S),t)};E.displayName="InvestigateInTimelineButton"},function(e,t,a){"use strict";a.d(t,"a",(function(){return m})),a.d(t,"c",(function(){return b})),a.d(t,"d",(function(){return y})),a.d(t,"b",(function(){return h}));var n=a(129),i=a(119),r=a(118),s=a(110),o=a(641);const l=[i.e.alertsOnAlertsPage,i.e.alertsOnRuleDetailsPage,i.e.alertsOnCasePage,r.c.casePage],c=[{value:"all",inputDisplay:o.b,"data-test-subj":"option-all"}],u=[{value:"raw",inputDisplay:o.d,"data-test-subj":"option-raw"}],d=[{value:"alert",inputDisplay:o.a,"data-test-subj":"option-alert"}],p=[...u,...d],m=e=>{switch(e){case"all":return c;case"raw":return u;case"alert":return d;default:return p}},b=e=>!!e&&l.includes(e),g=[n.a,n.b,n.e,n.f,n.g,n.h,n.l,n.o,n.E,n.t,n.H,n.p,n.q,n.W,n.ib,n.jb,n.lb,n.r,n.u,n.v,n.w,n.x,n.A,n.B,n.C,n.D,n.F,n.G,n.I,n.K,n.L,n.M,n.N,n.O,n.P,n.Q,n.R,n.S,n.s,n.T,n.U,n.V,n.eb,n.hb,"signal.rule.building_block_type","signal.rule.id","signal.rule.name","signal.rule.threat_mapping","signal.status"],f=({tableId:e,view:t})=>"raw"===t&&b(e),y=({filters:e,tableId:t,view:a})=>f({tableId:t,view:a})?e.filter((e=>!g.includes(`${e.meta.key}`))):e,h=({scopeId:e,view:t})=>f({tableId:e,view:t})?s.SourcererScopeName.default:b(e)?s.SourcererScopeName.detections:e===r.c.active?s.SourcererScopeName.timeline:s.SourcererScopeName.default},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a(103),r=a(122),s=a(179),o=a(108),l=a(105);const c=({id:e,filterQuery:t,kqlError:a,query:c,startDate:u,endDate:d})=>{const{addError:p}=Object(o.a)(),m=Object(i.useDispatch)(),b=Object(n.useMemo)((()=>r.a.errorsSelector()),[]),g=Object(l.a)(b),f=null==a?void 0:a.name,y=null==a?void 0:a.message;Object(n.useEffect)((()=>{if(!t&&y&&f){const t=y.split("").reduce(((e,t)=>(e<<5)-e+t.charCodeAt(0)|0),0).toString();m(s.a.addErrorHash({id:e,hash:t,title:f,message:[y]}))}}),[e,t,p,c,u,d,m,y,f]),Object(n.useEffect)((()=>{const t=g.find((t=>t.id===e));null!=t&&t.displayError&&null!=a&&(delete a.stack,p(a,{title:a.name}))}),[p,g,e,a])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(40),i=a(287),r=a(2),s=a.n(r),o=a(41),l=a.n(o);const c=l.a.aside.withConfig({displayName:"Aside",componentId:"sc-tazcmx-0"})(["padding:",";",""],(({theme:e})=>e.eui.euiSizeM),(({overlay:e,overlayBackground:t,theme:a})=>e&&Object(o.css)(["background:",";bottom:0;left:0;position:absolute;right:0;top:0;z-index:",";"],t?Object(i.rgba)(t,.9):Object(i.rgba)(a.eui.euiColorEmptyShade,.9),a.eui.euiZLevel1)));c.displayName="Aside";const u=l()(n.EuiFlexGroup).attrs((()=>({alignItems:"center",direction:"column",gutterSize:"s",justifyContent:"center"}))).withConfig({displayName:"FlexGroup",componentId:"sc-tazcmx-1"})(["",""],(({overlay:e})=>e&&Object(o.css)(["height:100%;"])));u.displayName="FlexGroup";const d=s.a.memo((({children:e,overlay:t,overlayBackground:a,size:i})=>s.a.createElement(c,{overlay:t,overlayBackground:a},s.a.createElement(u,{overlay:{overlay:t}},s.a.createElement(n.EuiFlexItem,{grow:!1},s.a.createElement(n.EuiLoadingSpinner,{"data-test-subj":"loading-spinner",size:i})),e&&s.a.createElement(n.EuiFlexItem,{grow:!1},s.a.createElement(n.EuiText,{color:"subdued",size:"s"},s.a.createElement("p",null,e)))))));d.displayName="Loader"},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(2),i=a.n(n),r=a(170);const s=i.a.memo((({children:e})=>i.a.createElement(r.w,{className:"siemEventsTable__trSupplement--summary"},e)));s.displayName="RowRendererContainer"},function(e,t,a){"use strict";a.d(t,"Vb",(function(){return i})),a.d(t,"oc",(function(){return r})),a.d(t,"e",(function(){return s})),a.d(t,"eb",(function(){return o})),a.d(t,"Yb",(function(){return l})),a.d(t,"db",(function(){return c})),a.d(t,"m",(function(){return u})),a.d(t,"pc",(function(){return d})),a.d(t,"gb",(function(){return p})),a.d(t,"i",(function(){return m})),a.d(t,"T",(function(){return b})),a.d(t,"kc",(function(){return g})),a.d(t,"Db",(function(){return f})),a.d(t,"y",(function(){return y})),a.d(t,"A",(function(){return h})),a.d(t,"z",(function(){return v})),a.d(t,"ob",(function(){return E})),a.d(t,"gc",(function(){return x})),a.d(t,"V",(function(){return j})),a.d(t,"Bb",(function(){return S})),a.d(t,"Ob",(function(){return k})),a.d(t,"S",(function(){return O})),a.d(t,"Q",(function(){return w})),a.d(t,"dc",(function(){return T})),a.d(t,"ic",(function(){return I})),a.d(t,"Z",(function(){return C})),a.d(t,"N",(function(){return M})),a.d(t,"mb",(function(){return _})),a.d(t,"t",(function(){return F})),a.d(t,"Hb",(function(){return A})),a.d(t,"Ub",(function(){return D})),a.d(t,"lb",(function(){return N})),a.d(t,"D",(function(){return P})),a.d(t,"M",(function(){return R})),a.d(t,"ub",(function(){return L})),a.d(t,"L",(function(){return B})),a.d(t,"h",(function(){return q})),a.d(t,"Rb",(function(){return z})),a.d(t,"g",(function(){return $})),a.d(t,"u",(function(){return V})),a.d(t,"nb",(function(){return U})),a.d(t,"H",(function(){return H})),a.d(t,"rb",(function(){return G})),a.d(t,"hc",(function(){return Q})),a.d(t,"f",(function(){return W})),a.d(t,"U",(function(){return K})),a.d(t,"hb",(function(){return Y})),a.d(t,"jc",(function(){return J})),a.d(t,"ib",(function(){return X})),a.d(t,"o",(function(){return Z})),a.d(t,"Eb",(function(){return ee})),a.d(t,"n",(function(){return te})),a.d(t,"ec",(function(){return ae})),a.d(t,"nc",(function(){return ne})),a.d(t,"lc",(function(){return ie})),a.d(t,"B",(function(){return re})),a.d(t,"P",(function(){return se})),a.d(t,"v",(function(){return oe})),a.d(t,"Jb",(function(){return le})),a.d(t,"Cb",(function(){return ce})),a.d(t,"X",(function(){return ue})),a.d(t,"Y",(function(){return de})),a.d(t,"ac",(function(){return pe})),a.d(t,"d",(function(){return me})),a.d(t,"a",(function(){return be})),a.d(t,"Lb",(function(){return ge})),a.d(t,"Mb",(function(){return fe})),a.d(t,"Wb",(function(){return ye})),a.d(t,"p",(function(){return he})),a.d(t,"Ib",(function(){return ve})),a.d(t,"Pb",(function(){return Ee})),a.d(t,"Qb",(function(){return xe})),a.d(t,"Zb",(function(){return je})),a.d(t,"ab",(function(){return Se})),a.d(t,"bb",(function(){return ke})),a.d(t,"w",(function(){return Oe})),a.d(t,"Kb",(function(){return we})),a.d(t,"q",(function(){return Te})),a.d(t,"C",(function(){return Ie})),a.d(t,"xb",(function(){return Ce})),a.d(t,"jb",(function(){return Me})),a.d(t,"yb",(function(){return _e})),a.d(t,"Fb",(function(){return Fe})),a.d(t,"E",(function(){return Ae})),a.d(t,"tb",(function(){return De})),a.d(t,"J",(function(){return Ne})),a.d(t,"qb",(function(){return Pe})),a.d(t,"K",(function(){return Re})),a.d(t,"j",(function(){return Le})),a.d(t,"zb",(function(){return Be})),a.d(t,"Nb",(function(){return qe})),a.d(t,"mc",(function(){return ze})),a.d(t,"bc",(function(){return $e})),a.d(t,"cc",(function(){return Ve})),a.d(t,"s",(function(){return Ue})),a.d(t,"O",(function(){return He})),a.d(t,"Xb",(function(){return Ge})),a.d(t,"Tb",(function(){return Qe})),a.d(t,"fc",(function(){return We})),a.d(t,"Sb",(function(){return Ke})),a.d(t,"c",(function(){return Ye})),a.d(t,"r",(function(){return Je})),a.d(t,"G",(function(){return Xe})),a.d(t,"Gb",(function(){return Ze})),a.d(t,"fb",(function(){return et})),a.d(t,"sb",(function(){return tt})),a.d(t,"F",(function(){return at})),a.d(t,"pb",(function(){return nt})),a.d(t,"Ab",(function(){return it})),a.d(t,"I",(function(){return rt})),a.d(t,"b",(function(){return st})),a.d(t,"x",(function(){return ot})),a.d(t,"kb",(function(){return lt})),a.d(t,"W",(function(){return ct})),a.d(t,"cb",(function(){return ut})),a.d(t,"R",(function(){return dt})),a.d(t,"k",(function(){return pt})),a.d(t,"vb",(function(){return mt})),a.d(t,"wb",(function(){return bt})),a.d(t,"l",(function(){return gt}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.auditd.sessionDescription",{defaultMessage:"Session"}),r=n.i18n.translate("xpack.securitySolution.auditd.wasAuthorizedToUseDescription",{defaultMessage:"was authorized to use"}),s=n.i18n.translate("xpack.securitySolution.auditd.acquiredCredentialsDescription",{defaultMessage:"acquired credentials to"}),o=n.i18n.translate("xpack.securitySolution.auditd.endedFromDescription",{defaultMessage:"ended from"}),l=n.i18n.translate("xpack.securitySolution.auditd.startedAtDescription",{defaultMessage:"started"}),c=n.i18n.translate("xpack.securitySolution.auditd.disposedCredentialsDescription",{defaultMessage:"disposed credentials to"}),u=n.i18n.translate("xpack.securitySolution.auditd.attemptedLoginDescription",{defaultMessage:"attempted a login via"}),d=n.i18n.translate("xpack.securitySolution.auditd.withResultDescription",{defaultMessage:"with result"}),p=n.i18n.translate("xpack.securitySolution.auditd.executedDescription",{defaultMessage:"executed"}),m=n.i18n.translate("xpack.securitySolution.auditd.asDescription",{defaultMessage:"as"}),b=n.i18n.translate("xpack.securitySolution.auditd.connectedUsingDescription",{defaultMessage:"connected using"}),g=n.i18n.translate("xpack.securitySolution.auditd.usingDescription",{defaultMessage:"using"}),f=n.i18n.translate("xpack.securitySolution.auditd.OpenedFileDescription",{defaultMessage:"opened file"}),y=n.i18n.translate("xpack.securitySolution.auditd.ChangedFileAttributesOfDescription",{defaultMessage:"changed file attributes of"}),h=n.i18n.translate("xpack.securitySolution.auditd.changedFilePermissionOfDescription",{defaultMessage:"changed file permissions of"}),v=n.i18n.translate("xpack.securitySolution.auditd.changeidleOwernshipOfDescription",{defaultMessage:"changed file ownership of"}),E=n.i18n.translate("xpack.securitySolution.auditd.loaedKernelModuleOfDescription",{defaultMessage:"loaded kernel module of"}),x=n.i18n.translate("xpack.securitySolution.auditd.unloadedKernelModuleOfDescription",{defaultMessage:"unloaded kernel module of"}),j=n.i18n.translate("xpack.securitySolution.auditd.createdDirectoryDescription",{defaultMessage:"created directory"}),S=n.i18n.translate("xpack.securitySolution.auditd.mountedDescription",{defaultMessage:"mounted"}),k=n.i18n.translate("xpack.securitySolution.auditd.renamedDescription",{defaultMessage:"renamed"}),O=n.i18n.translate("xpack.securitySolution.auditd.chedckedMetaDataOfDescription",{defaultMessage:"checked metadata of"}),w=n.i18n.translate("xpack.securitySolution.auditd.checkedFileSystemMetadataOfDescription",{defaultMessage:"checked filesystem metadata of"}),T=n.i18n.translate("xpack.securitySolution.auditd.symLinkedDescription",{defaultMessage:"symbolically linked"}),I=n.i18n.translate("xpack.securitySolution.auditd.unmountedDescription",{defaultMessage:"unmounted"}),C=n.i18n.translate("xpack.securitySolution.auditd.deletedDescription",{defaultMessage:"deleted"}),M=n.i18n.translate("xpack.securitySolution.auditd.changedTimeStampOfDescription",{defaultMessage:"changed time stamp of"}),_=n.i18n.translate("xpack.securitySolution.auditd.ListeningForConnectionsUsingDescription",{defaultMessage:"listening for connections using"}),F=n.i18n.translate("xpack.securitySolution.auditd.boundSocketFromDescription",{defaultMessage:"bound socket from"}),A=n.i18n.translate("xpack.securitySolution.auditd.receivedFromDescription",{defaultMessage:"received from"}),D=n.i18n.translate("xpack.securitySolution.auditd.sentToDescription",{defaultMessage:"sent to"}),N=n.i18n.translate("xpack.securitySolution.auditd.killedProcessIdDescription",{defaultMessage:"killed process id of"}),P=n.i18n.translate("xpack.securitySolution.auditd.changedIdentityUsingDescription",{defaultMessage:"changed identity using"}),R=n.i18n.translate("xpack.securitySolution.auditd.changedSystemTimeWithDescription",{defaultMessage:"changed system time with"}),L=n.i18n.translate("xpack.securitySolution.auditd.madeDeviceWithDescription",{defaultMessage:"made device with"}),B=n.i18n.translate("xpack.securitySolution.auditd.changedSystemNameDescription",{defaultMessage:"changed system name"}),q=n.i18n.translate("xpack.securitySolution.auditd.allocatedMemoryForDescription",{defaultMessage:"allocated memory for"}),z=n.i18n.translate("xpack.securitySolution.auditd.scheduledPolicyOFDescription",{defaultMessage:"scheduled policy of"}),$=n.i18n.translate("xpack.securitySolution.auditd.addedUserAccountDescription",{defaultMessage:"added user account"}),V=n.i18n.translate("xpack.securitySolution.auditd.causedMacPolicyErrorDescription",{defaultMessage:"caused mac policy error"}),U=n.i18n.translate("xpack.securitySolution.auditd.loadedFirewallRuleDescription",{defaultMessage:"loaded firewall rule"}),H=n.i18n.translate("xpack.securitySolution.auditd.promiscuousModeDescription",{defaultMessage:"changed promiscuous mode on the device using"}),G=n.i18n.translate("xpack.securitySolution.auditd.lockedAccountDescription",{defaultMessage:"locked account"}),Q=n.i18n.translate("xpack.securitySolution.auditd.unlockedAccountDescription",{defaultMessage:"unlocked account"}),W=n.i18n.translate("xpack.securitySolution.auditd.adddedGroupAccountUsingDescription",{defaultMessage:"added group account using"}),K=n.i18n.translate("xpack.securitySolution.auditd.crashedProgramDescription",{defaultMessage:"crashed program"}),Y=n.i18n.translate("xpack.securitySolution.auditd.executionOfForbiddenProgramDescription",{defaultMessage:"execution of forbidden program"}),J=n.i18n.translate("xpack.securitySolution.auditd.suspiciousProgramDescription",{defaultMessage:"used suspicious program"}),X=n.i18n.translate("xpack.securitySolution.auditd.failedLoginTooManyTimesDescription",{defaultMessage:"failed login due to logging in too many times"}),Z=n.i18n.translate("xpack.securitySolution.auditd.attemptedLoginFromUnusalPlaceDescription",{defaultMessage:"attempted login from unusual place"}),ee=n.i18n.translate("xpack.securitySolution.auditd.openedTooManySessionsDescription",{defaultMessage:"opened too many sessions"}),te=n.i18n.translate("xpack.securitySolution.auditd.attemptedLoginFromUnusualHourDescription",{defaultMessage:"attempted login from unusual hour"}),ae=n.i18n.translate("xpack.securitySolution.auditd.testedFileSystemIntegrityDescription",{defaultMessage:"tested file system integrity"}),ne=n.i18n.translate("xpack.securitySolution.auditd.violatedSeLinuxPolicyDescription",{defaultMessage:"violated selinux policy"}),ie=n.i18n.translate("xpack.securitySolution.auditd.violatedAppArmorPolicyFromDescription",{defaultMessage:"violated app armor policy from"}),re=n.i18n.translate("xpack.securitySolution.auditd.changedGroupDescription",{defaultMessage:"changed group"}),se=n.i18n.translate("xpack.securitySolution.auditd.changedUserIdDescription",{defaultMessage:"changed user id"}),oe=n.i18n.translate("xpack.securitySolution.auditd.changedAuditConfigurationDescription",{defaultMessage:"changed audit configuration"}),le=n.i18n.translate("xpack.securitySolution.auditd.refreshedCredentialsForDescription",{defaultMessage:"refreshed credentials for"}),ce=n.i18n.translate("xpack.securitySolution.auditd.negotiatedCryptoKeyDescription",{defaultMessage:"negotiated crypto key"}),ue=n.i18n.translate("xpack.securitySolution.auditd.cryptoOfficerLoggedInDescription",{defaultMessage:"crypto officer logged in"}),de=n.i18n.translate("xpack.securitySolution.auditd.cryptoOfficerLoggedOutDescription",{defaultMessage:"crypto officer logged out"}),pe=n.i18n.translate("xpack.securitySolution.auditd.startedCryptoSessionDescription",{defaultMessage:"started crypto session"}),me=n.i18n.translate("xpack.securitySolution.auditd.accessResultDescription",{defaultMessage:"access result"}),be=n.i18n.translate("xpack.securitySolution.auditd.abortedAuditStartupDescription",{defaultMessage:"aborted audit startup"}),ge=n.i18n.translate("xpack.securitySolution.auditd.remoteAuditConnectedDescription",{defaultMessage:"remote audit connected"}),fe=n.i18n.translate("xpack.securitySolution.auditd.remoteAuditDisconnectedDescription",{defaultMessage:"remote audit disconnected"}),ye=n.i18n.translate("xpack.securitySolution.auditd.shutDownAuditDescription",{defaultMessage:"shutdown audit"}),he=n.i18n.translate("xpack.securitySolution.auditd.auditErrorDescription",{defaultMessage:"audit error"}),ve=n.i18n.translate("xpack.securitySolution.auditd.reconfiguredAuditDescription",{defaultMessage:"reconfigured audit"}),Ee=n.i18n.translate("xpack.securitySolution.auditd.resumedAuditLoggingDescription",{defaultMessage:"resumed audit logging"}),xe=n.i18n.translate("xpack.securitySolution.auditd.rotatedAuditLogsDescription",{defaultMessage:"rotated-audit-logs"}),je=n.i18n.translate("xpack.securitySolution.auditd.startedAuditDescription",{defaultMessage:"started audit"}),Se=n.i18n.translate("xpack.securitySolution.auditd.deletedGroupAccountUsingDescription",{defaultMessage:"deleted group account using"}),ke=n.i18n.translate("xpack.securitySolution.auditd.deletedUserAccountUsingDescription",{defaultMessage:"deleted user account using"}),Oe=n.i18n.translate("xpack.securitySolution.auditd.changedAuditFeatureDescription",{defaultMessage:"changed audit feature"}),we=n.i18n.translate("xpack.securitySolution.auditd.relabeledFileSystemDescription",{defaultMessage:"relabeled filesystem"}),Te=n.i18n.translate("xpack.securitySolution.auditd.authenticatedToGroupDescription",{defaultMessage:"authenticated to group"}),Ie=n.i18n.translate("xpack.securitySolution.auditd.changedGroupPasswordDescription",{defaultMessage:"changed group password"}),Ce=n.i18n.translate("xpack.securitySolution.auditd.modifiedGroupAccountDescription",{defaultMessage:"modified group account"}),Me=n.i18n.translate("xpack.securitySolution.auditd.initializedAuditSubsystemDescription",{defaultMessage:"initialized audit subsystem"}),_e=n.i18n.translate("xpack.securitySolution.auditd.modifiedLevelOfDescription",{defaultMessage:"modified level of"}),Fe=n.i18n.translate("xpack.securitySolution.auditd.overrodeLabelOfDescription",{defaultMessage:"overrode label of"}),Ae=n.i18n.translate("xpack.securitySolution.auditd.changedLoginIdToDescription",{defaultMessage:"changed login id to"}),De=n.i18n.translate("xpack.securitySolution.auditd.macPermissionDescription",{defaultMessage:"mac permission"}),Ne=n.i18n.translate("xpack.securitySolution.auditd.changedSeLinuxBooleanDescription",{defaultMessage:"changed selinux boolean"}),Pe=n.i18n.translate("xpack.securitySolution.auditd.loadedSeLinuxPolicyDescription",{defaultMessage:"loaded selinux policy"}),Re=n.i18n.translate("xpack.securitySolution.auditd.changedSelinuxEnforcementDescription",{defaultMessage:"changed selinux enforcement"}),Le=n.i18n.translate("xpack.securitySolution.auditd.assignedUserRoleToDescription",{defaultMessage:"assigned user role to"}),Be=n.i18n.translate("xpack.securitySolution.auditd.modifiedRoleDescription",{defaultMessage:"modified role"}),qe=n.i18n.translate("xpack.securitySolution.auditd.removedUserRoleFromDescription",{defaultMessage:"removed user role from"}),ze=n.i18n.translate("xpack.securitySolution.auditd.violatedSeccompPolicyWithDescription",{defaultMessage:"violated seccomp policy with"}),$e=n.i18n.translate("xpack.securitySolution.auditd.startedServiceDescription",{defaultMessage:"started service"}),Ve=n.i18n.translate("xpack.securitySolution.auditd.stoppedServiceDescription",{defaultMessage:"stopped service"}),Ue=n.i18n.translate("xpack.securitySolution.auditd.bootedSystemDescription",{defaultMessage:"booted system"}),He=n.i18n.translate("xpack.securitySolution.auditd.changedToRunLevelWithDescription",{defaultMessage:"changed to run level with"}),Ge=n.i18n.translate("xpack.securitySolution.auditd.shutdownSystemDescription",{defaultMessage:"shutdown system"}),Qe=n.i18n.translate("xpack.securitySolution.auditd.sentTestDescription",{defaultMessage:"sent test"}),We=n.i18n.translate("xpack.securitySolution.auditd.unknownDescription",{defaultMessage:"unknown"}),Ke=n.i18n.translate("xpack.securitySolution.auditd.sentMessageDescription",{defaultMessage:"sent message"}),Ye=n.i18n.translate("xpack.securitySolution.auditd.accessPermissionDescription",{defaultMessage:"access permission"}),Je=n.i18n.translate("xpack.securitySolution.auditd.authenticatedUsingDescription",{defaultMessage:"authenticated using"}),Xe=n.i18n.translate("xpack.securitySolution.auditd.changedPasswordWithDescription",{defaultMessage:"changed password with"}),Ze=n.i18n.translate("xpack.securitySolution.auditd.ranCommandDescription",{defaultMessage:"ran command"}),et=n.i18n.translate("xpack.securitySolution.auditd.errorFromDescription",{defaultMessage:"error from"}),tt=n.i18n.translate("xpack.securitySolution.auditd.loggedOutDescription",{defaultMessage:"logged out"}),at=n.i18n.translate("xpack.securitySolution.auditd.changedMacConfigurationDescription",{defaultMessage:"changed mac configuration"}),nt=n.i18n.translate("xpack.securitySolution.auditd.loadedMacPolicyDescription",{defaultMessage:"loaded mac policy"}),it=n.i18n.translate("xpack.securitySolution.auditd.modifiedUserAccountDescription",{defaultMessage:"modified user account"}),rt=n.i18n.translate("xpack.securitySolution.auditd.changedRoleUsingDescription",{defaultMessage:"changed role using"}),st=n.i18n.translate("xpack.securitySolution.auditd.accessErrorDescription",{defaultMessage:"access error"}),ot=n.i18n.translate("xpack.securitySolution.auditd.changedConfigurationWIthDescription",{defaultMessage:"changed configuration with"}),lt=n.i18n.translate("xpack.securitySolution.auditd.issuedVmControlDescription",{defaultMessage:"issued vm control"}),ct=n.i18n.translate("xpack.securitySolution.auditd.createdVmImageDescription",{defaultMessage:"created vm image"}),ut=n.i18n.translate("xpack.securitySolution.auditd.deletedVmImageDescription",{defaultMessage:"deleted vm image"}),dt=n.i18n.translate("xpack.securitySolution.auditd.checkedIntegrityOfDescription",{defaultMessage:"checked integrity of"}),pt=n.i18n.translate("xpack.securitySolution.auditd.assignedVmIdDescription",{defaultMessage:"assigned vm id"}),mt=n.i18n.translate("xpack.securitySolution.auditd.migratedVmFromDescription",{defaultMessage:"migrated vm from"}),bt=n.i18n.translate("xpack.securitySolution.auditd.migratedVmToDescription",{defaultMessage:"migrated vm to"}),gt=n.i18n.translate("xpack.securitySolution.auditd.assignedVMResourceDescription",{defaultMessage:"assigned vm resource"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return c})),a.d(t,"b",(function(){return u}));var n=a(40),i=a(2),r=a.n(i),s=a(121),o=a(127),l=a(392);const c=r.a.memo((({contextId:e,endgamePid:t,endgameProcessName:a,eventId:i,processExecutable:l,processName:c,processPid:u,isDraggable:d})=>Object(o.e)(c)&&Object(o.e)(l)&&Object(o.e)(a)&&Object(o.e)(u)&&Object(o.e)(t)?null:r.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},Object(o.e)(c)?Object(o.e)(l)?Object(o.e)(a)?null:r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(s.c,{contextId:e,eventId:i,field:"endgame.process_name",value:a,iconType:"console",isDraggable:d,fieldType:"keyword",isAggregatable:!0})):r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(s.c,{contextId:e,eventId:i,field:"process.executable",value:l,iconType:"console",isDraggable:d,fieldType:"keyword",isAggregatable:!0})):r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(s.c,{contextId:e,eventId:i,field:"process.name",value:c,iconType:"console",isDraggable:d,fieldType:"keyword",isAggregatable:!0})),Object(o.e)(u)?Object(o.e)(t)?null:r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(s.c,{contextId:e,eventId:i,field:"endgame.pid",queryValue:String(t),value:`(${String(t)})`,isDraggable:d,fieldType:"keyword",isAggregatable:!0})):r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(s.c,{contextId:e,eventId:i,field:"process.pid",queryValue:String(u),value:`(${String(u)})`,isDraggable:d,fieldType:"keyword",isAggregatable:!0})))));c.displayName="ProcessDraggable";const u=r.a.memo((({contextId:e,endgamePid:t,endgameProcessName:a,eventId:n,processExecutable:i,processName:s,processPid:o,isDraggable:u})=>null==t&&null==a&&null==i&&null==s&&null==o?r.a.createElement(r.a.Fragment,null,l.g):r.a.createElement(c,{contextId:e,endgamePid:t,endgameProcessName:a,eventId:n,processExecutable:i,processName:s,processPid:o,isDraggable:u})));u.displayName="ProcessDraggableWithNonExistentProcess"},function(e,t,a){"use strict";let n;a.d(t,"a",(function(){return n})),a.d(t,"b",(function(){return i})),a.d(t,"c",(function(){return r})),function(e){e.updateActiveGroups="UPDATE_ACTIVE_GROUPS",e.updateGroupOptions="UPDATE_GROUP_OPTIONS"}(n||(n={}));const i={},r={activeGroups:["none"],options:[]}},function(e,t,a){"use strict";a.d(t,"a",(function(){return O})),a.d(t,"e",(function(){return K})),a.d(t,"d",(function(){return Y})),a.d(t,"f",(function(){return J})),a.d(t,"c",(function(){return M})),a.d(t,"b",(function(){return _})),a.d(t,"g",(function(){return ne}));var n=a(40),i=a(2),r=a.n(i),s=a(0),o=a.n(s),l=a(5),c=a(21);const u={selectedOptions:[]};class custom_field_panel_CustomFieldPanel extends r.a.PureComponent{constructor(...e){super(...e),o()(this,"state",u),o()(this,"handleSubmit",(()=>{this.props.onSubmit(this.state.selectedOptions[0].label)})),o()(this,"handleFieldSelection",(e=>{this.setState({selectedOptions:e})}))}render(){const{fields:e,currentOptions:t}=this.props,a=e.filter((e=>e.aggregatable&&"string"===e.type&&!(t&&t.some((t=>t.field===e.name))))).map((e=>({label:e.name}))),i=!this.state.selectedOptions.length;return Object(c.jsx)("div",{"data-test-subj":"custom-field-panel",style:{padding:16}},Object(c.jsx)(n.EuiForm,null,Object(c.jsx)(n.EuiFormRow,{label:l.i18n.translate("grouping.groupSelector.customGroupByFieldLabel",{defaultMessage:"Field"}),helpText:l.i18n.translate("grouping.groupSelector.customGroupByHelpText",{defaultMessage:"This is the field used for the terms aggregation"}),display:"rowCompressed",fullWidth:!0},Object(c.jsx)(n.EuiComboBox,{"data-test-subj":"groupByCustomField",placeholder:l.i18n.translate("grouping.groupSelector.customGroupByDropdownPlacehoder",{defaultMessage:"Select one"}),singleSelection:{asPlainText:!0},selectedOptions:this.state.selectedOptions,options:a,onChange:this.handleFieldSelection,fullWidth:!0,isClearable:!1})),Object(c.jsx)(n.EuiButton,{"data-test-subj":"groupByCustomFieldAddButton",disabled:i,type:"submit",size:"s",fill:!0,onClick:this.handleSubmit},l.i18n.translate("grouping.selector.grouping.label.add",{defaultMessage:"Add"}))))}}o()(custom_field_panel_CustomFieldPanel,"displayName","CustomFieldPanel");const d=l.i18n.translate("grouping.additionalActions.takeAction",{defaultMessage:"Take actions"}),p=l.i18n.translate("grouping.alerts.label",{defaultMessage:"Group alerts by"}),m=l.i18n.translate("grouping.customGroupByPanelTitle",{defaultMessage:"Group By Custom Field"}),b=l.i18n.translate("grouping.noneGroupByOptionName",{defaultMessage:"None"}),g=l.i18n.translate("grouping.customGroupByOptionName",{defaultMessage:"Custom field"});var f=a(61),y=a(48);const h=Object(c.css)("font-size:",y.euiThemeVars.euiFontSizeXS,";font-weight:",y.euiThemeVars.euiFontWeightSemiBold,";border-right:",y.euiThemeVars.euiBorderThin,";margin-right:16px;padding-right:16px;",""),v=Object(c.css)("font-size:",y.euiThemeVars.euiFontSizeXS,";font-weight:",y.euiThemeVars.euiFontWeightSemiBold,";border-right:",y.euiThemeVars.euiBorderThin,";margin-right:16px;padding-right:16px;.smallDot{width:3px!important;display:inline-block;}.euiBadge__text{text-align:center;width:100%;}",""),E=Object(c.css)(".groupingAccordionForm .euiAccordion__childWrapper .euiAccordion__children{margin-left:8px;margin-right:8px;border-left:",y.euiThemeVars.euiBorderThin,";border-right:",y.euiThemeVars.euiBorderThin,";border-bottom:",y.euiThemeVars.euiBorderThin,";border-radius:0 0 6px 6px;}.groupingAccordionForm .euiAccordion__triggerWrapper{border-bottom:",y.euiThemeVars.euiBorderThin,";border-left:",y.euiThemeVars.euiBorderThin,";border-right:",y.euiThemeVars.euiBorderThin,";border-radius:6px;min-height:78px;padding-left:16px;padding-right:16px;}.groupingAccordionForm{border-top:",y.euiThemeVars.euiBorderThin,";border-bottom:none;border-radius:6px;min-width:1090px;}.groupingPanelRenderer{display:table;table-layout:fixed;width:100%;padding-right:32px;}",""),x=Object(c.css)(".groupingAccordionFormLevel .euiAccordion__childWrapper .euiAccordion__children{margin-left:8px;margin-right:8px;border-left:none;border-right:none;border-bottom:",y.euiThemeVars.euiBorderThin,";border-radius:0;}.groupingAccordionFormLevel .euiAccordion__triggerWrapper{border-bottom:",y.euiThemeVars.euiBorderThin,";border-left:none;border-right:none;min-height:78px;padding-left:16px;padding-right:16px;border-radius:0;}.groupingAccordionFormLevel{border-top:none;border-bottom:none;border-radius:0;min-width:1090px;}.groupingPanelRenderer{display:table;table-layout:fixed;width:100%;padding-right:32px;}",""),j=Object(f.euiStyled)(n.EuiContextMenu)`
  width: 250px;
  & .euiContextMenuItem__text {
    overflow: hidden;
    text-overflow: ellipsis;
  }
  .euiContextMenuItem {
    border-bottom: ${y.euiThemeVars.euiBorderThin};
  }
  .euiContextMenuItem:last-child {
    border: none;
  }
`,S=Object(f.euiStyled)(n.EuiButtonEmpty)`
  font-weight: 'normal';

  .euiButtonEmpty__text {
    max-width: 300px;
    white-space: nowrap;
    overflow: hidden;
    text-overflow: ellipsis;
  }
`,k=({"data-test-subj":e,fields:t,groupsSelected:a=["none"],onGroupChange:r,options:s,title:o=p,maxGroupingLevels:u=1})=>{const[d,f]=Object(i.useState)(!1),y=Object(i.useCallback)((e=>!!a.find((t=>t===e))),[a]),h=Object(i.useMemo)((()=>{return[{id:"firstPanel",title:(e=u,l.i18n.translate("grouping.groupByPanelTitle",{values:{groupingLevelsCount:e},defaultMessage:"Select up to {groupingLevelsCount} groupings"})),items:[{"data-test-subj":"panel-none",name:b,icon:y("none")?"check":"empty",onClick:()=>r("none")},...s.map((e=>({"data-test-subj":`panel-${e.key}`,disabled:a.length===u&&!y(e.key),name:e.label,onClick:()=>r(e.key),icon:y(e.key)?"check":"empty"}))),{"data-test-subj":"panel-custom",name:g,icon:"empty",disabled:a.length===u,panel:"customPanel",hasPanel:!0}]},{id:"customPanel",title:m,width:685,content:Object(c.jsx)(custom_field_panel_CustomFieldPanel,{currentOptions:s.map((e=>({text:e.label,field:e.key}))),onSubmit:e=>{r(e),f(!1)},fields:t})}];var e}),[t,a.length,y,u,r,s]),v=Object(i.useMemo)((()=>s.filter((e=>y(e.key)))),[y,s]),E=Object(i.useCallback)((()=>f((e=>!e))),[]),x=Object(i.useCallback)((()=>f(!1)),[]),k=Object(i.useMemo)((()=>{const e=y("none")?b:a.reduce(((e,t)=>{const a=v.find((e=>e.key===t));return null==a?e:e?[e,a.label].join(", "):a.label}),"");return Object(c.jsx)(S,{"data-test-subj":"group-selector-dropdown",flush:"both",iconSide:"right",iconSize:"s",iconType:"arrowDown",onClick:E,title:e,size:"xs"},`${o}: ${e}`)}),[a,y,E,v,o]);return Object(c.jsx)(n.EuiPopover,{"data-test-subj":null!=e?e:"groupByPopover",button:k,closePopover:x,isOpen:d,panelPaddingSize:"none"},Object(c.jsx)(j,{"data-test-subj":"groupByContextMenu",initialPanelId:"firstPanel",panels:h}))},O=r.a.memo(k);var w=a(23),T=a(278);const I=e=>{return t=e,l.i18n.translate("grouping.eventsTab.unit",{values:{totalCount:t},defaultMessage:"{totalCount, plural, =1 {event} other {events}}"});var t},C="groups",M=e=>{const t=e.getItem(C);return t?JSON.parse(t):T.b},_=(e,t,a)=>{const n=M(e);e.setItem(C,JSON.stringify({...n,[t]:a}))};var F=a(49);const A=(e,t)=>null!=t&&t.length>0?t.reduce(((t,a)=>[...t,{meta:{alias:null,disabled:!1,key:e,negate:!1,params:{query:a},type:"phrase"},query:{match_phrase:{[e]:{query:a}}}}]),[{meta:{alias:null,disabled:!1,type:F.FILTERS.CUSTOM,negate:!1,key:e},query:{script:{script:{source:"doc[params['field']].size()==params['size']",params:{field:e,size:t.length}}}}}]):[],D=e=>[{meta:{disabled:!1,negate:!0,alias:null,key:e,value:"exists",type:"exists"},query:{exists:{field:e}}}],N=({isNullGroup:e,title:t,nullGroupMessage:a})=>Object(c.jsx)("div",null,Object(c.jsx)(n.EuiFlexGroup,{gutterSize:"s",alignItems:"center",responsive:!1},Object(c.jsx)(n.EuiFlexItem,{grow:!1,className:"eui-textTruncate"},Object(c.jsx)(n.EuiTitle,{size:"xs",className:"euiAccordionForm__title"},Object(c.jsx)("h4",{className:"eui-textTruncate",title:t},t))),e&&a&&Object(c.jsx)(n.EuiFlexItem,{grow:!1,"data-test-subj":"null-group-icon"},Object(c.jsx)(n.EuiIconTip,{content:a,position:"right"})))),P=({customAccordionButtonClassName:e,customAccordionClassName:t="groupingAccordionForm",extraAction:a,forceState:r,groupBucket:s,groupPanelRenderer:o,groupingLevel:l=0,isLoading:u,isNullGroup:d=!1,onGroupClose:p,onToggleGroup:m,renderChildComponent:b,selectedGroup:g,nullGroupMessage:f})=>{const y=Object(i.useRef)(r);Object(i.useEffect)((()=>{"open"===y.current&&"closed"===r?(p(),y.current="closed"):"closed"===y.current&&"open"===r&&(y.current="open")}),[p,r,g]);const h=Object(i.useMemo)((()=>s.selectedGroup===g?{asString:s.key_as_string,asArray:s.key}:{asString:null,asArray:null}),[s.key,s.key_as_string,s.selectedGroup,g]),v=Object(i.useMemo)((()=>d?D(g):A(g,h.asArray)),[h.asArray,d,g]),E=Object(i.useCallback)((e=>{m&&m(e,s)}),[s,m]);return h.asString?Object(c.jsx)(n.EuiAccordion,{buttonClassName:e,buttonContent:Object(c.jsx)("div",{"data-test-subj":"group-panel-toggle",className:"groupingPanelRenderer"},null!=o?o:Object(c.jsx)(N,{title:h.asString,isNullGroup:d,nullGroupMessage:f})),buttonElement:"div",className:l>0?"groupingAccordionFormLevel":t,"data-test-subj":"grouping-accordion",extraAction:a,forceState:r,isLoading:u,id:`group${l}-${h.asString}`,onToggle:E,paddingSize:"m"},Object(c.jsx)("span",{"data-test-subj":"grouping-accordion-content"},b(v))):null},R=r.a.memo(P),L=({bucketKey:e,groupFilter:t,groupNumber:a,onTakeActionsOpen:r,statRenderers:s,takeActionItems:o})=>{const[l,u]=Object(i.useState)(!1),[p,m]=Object(i.useState)([]),b=Object(i.useCallback)((()=>(l||0!==p.length||m(o(t,a)),!l&&r?r():u(!l))),[o,t,a,l,r,p.length]),g=Object(i.useMemo)((()=>null==s?void 0:s.map((e=>{var t,a;const{dataTestSubj:i,component:r}=null!=e.badge?{dataTestSubj:`metric-${e.title}`,component:Object(c.jsx)(n.EuiToolTip,{position:"top",content:e.badge.value},Object(c.jsx)(n.EuiBadge,{style:{marginLeft:10,width:null!==(t=e.badge.width)&&void 0!==t?t:35},color:null!==(a=e.badge.color)&&void 0!==a?a:"hollow"},e.badge.value>99?"99+":e.badge.value.toString()))}:{dataTestSubj:`customMetric-${e.title}`,component:e.renderer};return Object(c.jsx)(n.EuiFlexItem,{grow:!1,key:e.title},Object(c.jsx)("span",{css:v,"data-test-subj":i},e.title,r))}))),[s]),f=Object(i.useMemo)((()=>Object(c.jsx)(n.EuiFlexItem,{grow:!1},Object(c.jsx)(n.EuiPopover,{anchorPosition:"downLeft",button:Object(c.jsx)(n.EuiButtonEmpty,{"data-test-subj":"take-action-button",onClick:b,iconType:"arrowDown",iconSide:"right"},d),closePopover:()=>u(!1),isOpen:l,panelPaddingSize:"none"},Object(c.jsx)(n.EuiContextMenuPanel,{items:p})))),[l,b,p]);return Object(c.jsx)(n.EuiFlexGroup,{"data-test-subj":"group-stats",key:`stats-${e}`,gutterSize:"none",alignItems:"center"},g,f)},B=r.a.memo(L);var q=a(44),z=(a(833),a(834)),$=a.n(z);const V={maxWidth:500},U={tall:490,short:250},H=({height:e="tall"})=>Object(c.jsx)(n.EuiPanel,{color:"subdued","data-test-subj":"empty-results-panel"},Object(c.jsx)(n.EuiFlexGroup,{style:{height:U[e]},alignItems:"center",justifyContent:"center"},Object(c.jsx)(n.EuiFlexItem,{grow:!1},Object(c.jsx)(n.EuiPanel,{hasBorder:!0,style:V},Object(c.jsx)(n.EuiFlexGroup,null,Object(c.jsx)(n.EuiFlexItem,null,Object(c.jsx)(n.EuiText,{size:"s"},Object(c.jsx)(n.EuiTitle,null,Object(c.jsx)("h3",null,Object(c.jsx)(q.FormattedMessage,{id:"grouping.empty.title",defaultMessage:"No grouping results match your selected Group alerts field"}))),Object(c.jsx)("p",null,Object(c.jsx)(q.FormattedMessage,{id:"grouping.empty.description",defaultMessage:"Try searching over a longer period of time or modifying your Group alerts field"})))),Object(c.jsx)(n.EuiFlexItem,{grow:!1},Object(c.jsx)(n.EuiImage,{size:"200px",alt:"",src:$.a})))))));var G=a(735);const Q=({activePage:e,data:t,groupPanelRenderer:a,groupSelector:s,groupStatsRenderer:o,groupingId:u,groupingLevel:d=0,inspectButton:p,isLoading:m,itemsPerPage:b,onChangeGroupsItemsPerPage:g,onChangeGroupsPage:f,onGroupClose:y,onGroupToggle:v,renderChildComponent:j,selectedGroup:S,takeActionItems:k,tracker:O,unit:T=I})=>{var C,M,_;const[F,N]=Object(i.useState)({}),P=Object(i.useMemo)((()=>{var e,a;return null!==(e=null==t||null===(a=t.unitsCount)||void 0===a?void 0:a.value)&&void 0!==e?e:0}),[null==t||null===(C=t.unitsCount)||void 0===C?void 0:C.value]),L=Object(i.useMemo)((()=>`${P.toLocaleString()} ${T&&T(P)}`),[P,T]),q=Object(i.useMemo)((()=>{var e,a;return null!==(e=null==t||null===(a=t.groupsCount)||void 0===a?void 0:a.value)&&void 0!==e?e:0}),[null==t||null===(M=t.groupsCount)||void 0===M?void 0:M.value]),z=Object(i.useMemo)((()=>{return`${q.toLocaleString()} ${e=q,l.i18n.translate("grouping.total.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {group} other {groups}}"})}`;var e}),[q]),$=Object(i.useMemo)((()=>{var e,i;return null==t||null===(e=t.groupByFields)||void 0===e||null===(i=e.buckets)||void 0===i?void 0:i.map(((e,t)=>{var i,r;const s=function(e){if(null!==e){if(!Array.isArray(e))return e;for(const t of e)if(null!==t)return t}}(e.key),p=`group-${t}-${s}`,b=null!==(i=e.isNullGroup)&&void 0!==i&&i,g=b?((e,t)=>l.i18n.translate("grouping.nullGroup.title",{values:{selectedGroup:e,unit:t},defaultMessage:"The selected group by field, {selectedGroup}, is missing a value for this group of {unit}."}))(S,T(e.doc_count)):void 0;return Object(c.jsx)("span",{key:p,"data-test-subj":`level-${d}-group-${t}`},Object(c.jsx)(R,{isNullGroup:b,nullGroupMessage:g,onGroupClose:y,extraAction:Object(c.jsx)(B,{bucketKey:p,groupFilter:b?D(S):A(S,Array.isArray(e.key)?e.key:[e.key]),groupNumber:t,statRenderers:o&&o(S,e),takeActionItems:k}),forceState:null!==(r=F[p]&&F[p].state)&&void 0!==r?r:"closed",groupBucket:e,groupPanelRenderer:a&&a(S,e,g),isLoading:m,onToggleGroup:e=>{null==O||O(w.METRIC_TYPE.CLICK,G.a.groupToggled({isOpen:e,groupingId:u,groupNumber:t})),N({[p]:{state:e?"open":"closed"}}),null==v||v({isOpen:e,groupName:s,groupNumber:t,groupingId:u})},renderChildComponent:F[p]&&"open"===F[p].state?j:()=>Object(c.jsx)("span",null),selectedGroup:S,groupingLevel:d}),d>0?null:Object(c.jsx)(n.EuiSpacer,{size:"s"}))}))}),[null==t||null===(_=t.groupByFields)||void 0===_?void 0:_.buckets,a,o,u,d,m,y,v,j,S,k,O,F,T]),V=Object(i.useMemo)((()=>q?Math.ceil(q/b):1),[q,b]);return Object(c.jsx)(r.a.Fragment,null,d>0?null:Object(c.jsx)(n.EuiFlexGroup,{"data-test-subj":"grouping-table",justifyContent:"spaceBetween",alignItems:"center",style:{paddingBottom:20,paddingTop:20}},Object(c.jsx)(n.EuiFlexItem,{grow:!1},q>0&&P>0?Object(c.jsx)(n.EuiFlexGroup,{gutterSize:"none"},Object(c.jsx)(n.EuiFlexItem,{grow:!1},Object(c.jsx)("span",{css:h,"data-test-subj":"unit-count"},L)),Object(c.jsx)(n.EuiFlexItem,null,Object(c.jsx)("span",{css:h,"data-test-subj":"group-count",style:{borderRight:"none"}},z))):null),Object(c.jsx)(n.EuiFlexItem,{grow:!1},Object(c.jsx)(n.EuiFlexGroup,{gutterSize:"xs"},p&&Object(c.jsx)(n.EuiFlexItem,null,p),Object(c.jsx)(n.EuiFlexItem,null,s)))),Object(c.jsx)("div",{css:d>0?x:E,className:"eui-xScroll"},m&&Object(c.jsx)(n.EuiProgress,{"data-test-subj":"is-loading-grouping-table",size:"xs",color:"accent"}),q>0?Object(c.jsx)("span",{"data-test-subj":`grouping-level-${d}`},$,q>0&&Object(c.jsx)(r.a.Fragment,null,Object(c.jsx)(n.EuiSpacer,{size:"m"}),Object(c.jsx)(n.EuiTablePagination,{activePage:e,"data-test-subj":`grouping-level-${d}-pagination`,itemsPerPage:b,itemsPerPageOptions:[10,25,50,100],onChangeItemsPerPage:e=>{g&&g(e)},onChangePage:e=>{f&&f(e)},pageCount:V,showPerPageOptions:!0}))):Object(c.jsx)(H,null)))},W=r.a.memo(Q),K=e=>!!e.find((e=>"none"===e)),Y=({additionalFilters:e=[],from:t,groupByField:a,pageNumber:n,rootAggregations:i,runtimeMappings:r,size:s=10,sort:o,statsAggregations:l,to:c,uniqueValue:u})=>({size:0,runtime_mappings:{...r,groupByField:{type:"keyword",script:{source:"if (doc[params['selectedGroup']].size()==0) { emit(params['uniqueValue']) } else { emit(doc[params['selectedGroup']].join(params['uniqueValue']))}",params:{selectedGroup:a,uniqueValue:u}}}},aggs:{groupByFields:{terms:{field:"groupByField",size:1e4},aggs:{bucket_truncate:{bucket_sort:{sort:o,from:n,size:s}},...l?l.reduce(((e,t)=>Object.assign(e,t)),{}):{}}},unitsCount:{value_count:{field:"groupByField"}},groupsCount:{cardinality:{field:"groupByField"}},...i?i.reduce(((e,t)=>Object.assign(e,t)),{}):{}},query:{bool:{filter:[...e,{range:{"@timestamp":{gte:t,lte:c}}}]}},_source:!1}),J=(e,t,a)=>{var n,i,r,s;if(!a)return{};const o=null==a||null===(n=a.groupByFields)||void 0===n||null===(i=n.buckets)||void 0===i?void 0:i.map((a=>{if(a.key===t)return{...a,key:["—"],selectedGroup:e,key_as_string:"—",isNullGroup:!0};const n=(Array.isArray(a.key)?a.key[0]:a.key).split(t);return{...a,key:n,selectedGroup:e,key_as_string:n.join(", ")}}));return{...a,groupByFields:{buckets:o},groupsCount:{value:null!==(r=null===(s=a.groupsCount)||void 0===s?void 0:s.value)&&void 0!==r?r:0}}};var X=a(104),Z=a.n(X),ee=a(576),te=a(878),ae=a(1100);const ne=({componentProps:e,defaultGroupingOptions:t,fields:a,groupingId:n,maxGroupingLevels:r,onGroupChange:s,onOptionsChange:o,tracker:l})=>{const[u,d]=Object(i.useReducer)(ee.a,ee.b),{activeGroups:p}=Object(i.useMemo)((()=>{var e;return null!==(e=Object(te.b)({groups:u},n))&&void 0!==e?e:T.c}),[n,u]),m=Object(i.useCallback)((e=>{d(te.a.updateActiveGroups({id:n,activeGroups:e}))}),[n]),b=Object(ae.a)({defaultGroupingOptions:t,dispatch:d,fields:a,groupingId:n,groupingState:u,maxGroupingLevels:r,onGroupChange:s,onOptionsChange:o,tracker:l}),g=Object(i.useCallback)((t=>K([t.selectedGroup])?t.renderChildComponent([]):Object(c.jsx)(W,Z()({},e,t,{groupSelector:b,groupingId:n,tracker:l}))),[e,b,n,l]);return Object(i.useMemo)((()=>({getGrouping:g,groupSelector:b,selectedGroups:p,setSelectedGroups:m})),[g,b,p,m])}},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"e",(function(){return n})),a.d(t,"a",(function(){return g})),a.d(t,"d",(function(){return f}));var n={};a.r(n),a.d(n,"dnsSelector",(function(){return E})),a.d(n,"topNFlowSelector",(function(){return j})),a.d(n,"tlsSelector",(function(){return k})),a.d(n,"topCountriesSelector",(function(){return w})),a.d(n,"httpSelector",(function(){return I})),a.d(n,"usersSelector",(function(){return C})),a.d(n,"networkAnomaliesJobIdFilterSelector",(function(){return M})),a.d(n,"networkAnomaliesIntervalSelector",(function(){return _}));var i=a(523),r=a(270),s=a(139),o=a(42),l=a(263),c=a(208),u=a(388),d=a(113),p=a(314);const m=e=>({...e.page.queries,[r.NetworkTableType.topCountriesSource]:{...e.page.queries[r.NetworkTableType.topCountriesSource],activePage:p.a},[r.NetworkTableType.topCountriesDestination]:{...e.page.queries[r.NetworkTableType.topCountriesDestination],activePage:p.a},[r.NetworkTableType.topNFlowSource]:{...e.page.queries[r.NetworkTableType.topNFlowSource],activePage:p.a},[r.NetworkTableType.topNFlowDestination]:{...e.page.queries[r.NetworkTableType.topNFlowDestination],activePage:p.a},[r.NetworkTableType.dns]:{...e.page.queries[r.NetworkTableType.dns],activePage:p.a},[r.NetworkTableType.tls]:{...e.page.queries[r.NetworkTableType.tls],activePage:p.a},[r.NetworkTableType.http]:{...e.page.queries[r.NetworkTableType.http],activePage:p.a}}),b=e=>({...e.details.queries,[r.NetworkDetailsTableType.topCountriesSource]:{...e.details.queries[r.NetworkDetailsTableType.topCountriesSource],activePage:p.a},[r.NetworkDetailsTableType.topCountriesDestination]:{...e.details.queries[r.NetworkDetailsTableType.topCountriesDestination],activePage:p.a},[r.NetworkDetailsTableType.topNFlowSource]:{...e.details.queries[r.NetworkDetailsTableType.topNFlowSource],activePage:p.a},[r.NetworkDetailsTableType.topNFlowDestination]:{...e.details.queries[r.NetworkDetailsTableType.topNFlowDestination],activePage:p.a},[r.NetworkDetailsTableType.tls]:{...e.details.queries[r.NetworkDetailsTableType.tls],activePage:p.a},[r.NetworkDetailsTableType.users]:{...e.details.queries[r.NetworkDetailsTableType.users],activePage:p.a},[r.NetworkDetailsTableType.http]:{...e.details.queries[r.NetworkDetailsTableType.http],activePage:p.a}}),g={page:{queries:{[r.NetworkTableType.topNFlowSource]:{activePage:p.a,limit:p.b,sort:{field:d.t.bytes_out,direction:d.b.desc}},[r.NetworkTableType.topNFlowDestination]:{activePage:p.a,limit:p.b,sort:{field:d.t.bytes_in,direction:d.b.desc}},[r.NetworkTableType.dns]:{activePage:p.a,limit:p.b,sort:{field:d.o.uniqueDomains,direction:d.b.desc},isPtrIncluded:!1},[r.NetworkTableType.http]:{activePage:p.a,limit:p.b,sort:{direction:d.b.desc}},[r.NetworkTableType.tls]:{activePage:p.a,limit:p.b,sort:{field:d.s._id,direction:d.b.desc}},[r.NetworkTableType.topCountriesSource]:{activePage:p.a,limit:p.b,sort:{field:d.t.bytes_out,direction:d.b.desc}},[r.NetworkTableType.topCountriesDestination]:{activePage:p.a,limit:p.b,sort:{field:d.t.bytes_in,direction:d.b.desc}},[r.NetworkTableType.alerts]:{activePage:p.a,limit:p.b},[r.NetworkTableType.anomalies]:{jobIdSelection:[],intervalSelection:"auto"}}},details:{queries:{[r.NetworkDetailsTableType.http]:{activePage:p.a,limit:p.b,sort:{direction:d.b.desc}},[r.NetworkDetailsTableType.topCountriesSource]:{activePage:p.a,limit:p.b,sort:{field:d.t.bytes_out,direction:d.b.desc}},[r.NetworkDetailsTableType.topCountriesDestination]:{activePage:p.a,limit:p.b,sort:{field:d.t.bytes_in,direction:d.b.desc}},[r.NetworkDetailsTableType.topNFlowSource]:{activePage:p.a,limit:p.b,sort:{field:d.t.bytes_out,direction:d.b.desc}},[r.NetworkDetailsTableType.topNFlowDestination]:{activePage:p.a,limit:p.b,sort:{field:d.t.bytes_in,direction:d.b.desc}},[r.NetworkDetailsTableType.tls]:{activePage:p.a,limit:p.b,sort:{field:d.s._id,direction:d.b.desc}},[r.NetworkDetailsTableType.users]:{activePage:p.a,limit:p.b,sort:{field:d.u.name,direction:d.b.asc}},[r.NetworkDetailsTableType.anomalies]:{jobIdSelection:[],intervalSelection:"auto"}},flowTarget:d.f.source}},f=Object(c.reducerWithInitialState)(g).case(i.updateNetworkTable,((e,{networkType:t,tableType:a,updates:n})=>({...e,[t]:{...e[t],queries:{...e[t].queries,[a]:{...Object(o.get)([t,"queries",a],e),...n}}}}))).case(i.setNetworkTablesActivePageToZero,(e=>({...e,page:{...e.page,queries:m(e)},details:{...e.details,queries:b(e)}}))).case(i.setNetworkDetailsTablesActivePageToZero,(e=>({...e,details:{...e.details,queries:b(e)}}))).case(i.updateNetworkAnomaliesJobIdFilter,((e,{jobIds:t,networkType:a})=>a===r.NetworkType.page?Object(u.set)("page.queries.anomalies.jobIdSelection",t,e):Object(u.set)("details.queries.anomalies.jobIdSelection",t,e))).case(i.updateNetworkAnomaliesInterval,((e,{interval:t,networkType:a})=>a===r.NetworkType.page?Object(u.set)("page.queries.anomalies.intervalSelection",t,e):Object(u.set)("details.queries.anomalies.intervalSelection",t,e))).build(),y=(e,t)=>Object(o.get)(t,e.network),h=e=>e.network.page,v=e=>e.network.details,E=()=>Object(s.createSelector)(h,(e=>e.queries.dns)),x=(e,t,a)=>{const n=a===l.b.source?"topNFlowSource":"topNFlowDestination",i=t===r.NetworkType.page?r.NetworkTableType[n]:r.NetworkDetailsTableType[n];return Object(o.get)([t,"queries",i],e.network)||Object(o.get)([t,"queries",i],g)},j=()=>Object(s.createSelector)(x,(e=>e)),S=(e,t)=>{const a=t===r.NetworkType.page?r.NetworkTableType.tls:r.NetworkDetailsTableType.tls;return Object(o.get)([t,"queries",a],e.network)||Object(o.get)([t,"queries",a],g)},k=()=>Object(s.createSelector)(S,(e=>e)),O=(e,t,a)=>{const n=a===l.b.source?"topCountriesSource":"topCountriesDestination",i=t===r.NetworkType.page?r.NetworkTableType[n]:r.NetworkDetailsTableType[n];return Object(o.get)([t,"queries",i],e.network)||Object(o.get)([t,"queries",i],g)},w=()=>Object(s.createSelector)(O,(e=>e)),T=(e,t)=>{const a=t===r.NetworkType.page?r.NetworkTableType.http:r.NetworkDetailsTableType.http;return Object(o.get)([t,"queries",a],e.network)||Object(o.get)([t,"queries",a],g)},I=()=>Object(s.createSelector)(T,(e=>e)),C=()=>Object(s.createSelector)(v,(e=>e.queries.users)),M=()=>Object(s.createSelector)(y,(e=>e.queries[r.NetworkTableType.anomalies].jobIdSelection)),_=()=>Object(s.createSelector)(y,(e=>e.queries[r.NetworkTableType.anomalies].intervalSelection))},function(e,t,a){"use strict";a.d(t,"j",(function(){return y})),a.d(t,"i",(function(){return h})),a.d(t,"m",(function(){return v})),a.d(t,"d",(function(){return E})),a.d(t,"e",(function(){return x})),a.d(t,"a",(function(){return j})),a.d(t,"c",(function(){return S})),a.d(t,"n",(function(){return k})),a.d(t,"l",(function(){return O})),a.d(t,"b",(function(){return _})),a.d(t,"f",(function(){return F})),a.d(t,"g",(function(){return A})),a.d(t,"h",(function(){return D})),a.d(t,"k",(function(){return N}));var n=a(2),i=a.n(n),r=a(40),s=a(8),o=a(50),l=a.n(o),c=a(120),u=a(210),d=a(214),p=a(655),m=a(458),b=a(880),g=a(563);const f=["kibana.alert.rule","signal.rule","rule"],y=e=>e.map((e=>({username:e.created_by,timestamp:l()(e.created_at).format("on MMM Do YYYY @ HH:mm:ss"),event:m.b,timelineAvatar:i.a.createElement(r.EuiAvatar,{size:"l",name:e.created_by.toUpperCase()}),children:i.a.createElement(r.EuiText,{size:"s"},e.comment),actions:i.a.createElement(b.a,{"data-test-subj":"copy-to-clipboard",text:e.comment,titleSummary:m.a})}))),h=e=>{const{created_at:t,created_by:a,list_id:n,tie_breaker_id:i,updated_at:r,updated_by:s,...o}=e;return{...o}},v=e=>e.map((e=>{if(void 0!==e.entries){const t=e.entries.map((e=>{const t=Object(s.omit)(e,"id");return{...t,field:t.field.startsWith("event.")?t.field.replace(/^event./,`${g.d}.`):t.field}}));return{...e,entries:t,comments:[]}}return{...e,comments:[]}})),E=(e,t)=>e.map((e=>({...e,comments:t}))),x=(e,t)=>{const a=void 0!==t?t.toISOString():void 0;return e.map((e=>({...e,expire_time:a})))},j=e=>({query:{match:{_id:{query:e||""}}}}),S=(e,t)=>e.map((e=>({...e,os_types:t}))),k=e=>{const t=["windows","macos"];if(null!=e){var a,n,i,r,s,o;const l="endpoint"===(null==e||null===(a=e.agent)||void 0===a?void 0:a.type)?null===(n=e.host)||void 0===n||null===(i=n.os)||void 0===i||null===(r=i.name)||void 0===r?void 0:r.toLowerCase():null===(s=e.host)||void 0===s||null===(o=s.os)||void 0===o?void 0:o.family;if(null!=l)return c.D.is(l)?[l]:t}return t},O=e=>e.map((e=>{const t=e.entries.map((e=>{if(e.field.includes(".hash")){if("match"===e.type)return{...e,value:e.value.toLowerCase()};if("match_any"===e.type)return{...e,value:e.value.map((e=>e.toLowerCase()))}}return e}));return{...e,entries:t}})),w=e=>{if(Array.isArray(e)&&e.length>0)return e.map((e=>{var t,a,n;return{subjectName:null!==(t=null==e?void 0:e.subject_name)&&void 0!==t?t:"",trusted:null!==(a=null==e||null===(n=e.trusted)||void 0===n?void 0:n.toString())&&void 0!==a?a:""}}));{var t,a;const n=Array.isArray(e)?void 0:e;return[{subjectName:null!==(t=null==n?void 0:n.subject_name)&&void 0!==t?t:"",trusted:null!==(a=null==n?void 0:n.trusted)&&void 0!==a?a:""}]}};function T(e){const t=[];for(const a of e)void 0!==a.entries?(a.entries=a.entries.filter((e=>void 0!==e.value&&e.value.length>0)),t.push(a)):void 0!==a.value&&a.value.length>0&&t.push(a);return t}const I=({listId:e,name:t,eventCode:a,listNamespace:n="agnostic",alertEcsData:i})=>{var r,s,o,l,c,d;const{process:p}=i,m=T([{field:"Memory_protection.feature",operator:"included",type:"match",value:null!==(r=null===(s=i.Memory_protection)||void 0===s?void 0:s.feature)&&void 0!==r?r:""},{field:"process.executable.caseless",operator:"included",type:"match",value:null!==(o=null==p?void 0:p.executable)&&void 0!==o?o:""},{field:"process.name.caseless",operator:"included",type:"match",value:null!==(l=null==p?void 0:p.name)&&void 0!==l?l:""},{field:"process.hash.sha256",operator:"included",type:"match",value:null!==(c=null==p||null===(d=p.hash)||void 0===d?void 0:d.sha256)&&void 0!==c?c:""}]);return{...Object(u.k)({listId:e,namespaceType:n,name:t}),entries:Object(u.c)(m)}},C=({listId:e,name:t,eventCode:a,listNamespace:n="agnostic",alertEcsData:i})=>{var r,s,o,l,c,d,p,m,b;const{process:g}=i,f=T([{field:"Memory_protection.feature",operator:"included",type:"match",value:null!==(r=null===(s=i.Memory_protection)||void 0===s?void 0:s.feature)&&void 0!==r?r:""},{field:"Memory_protection.self_injection",operator:"included",type:"match",value:null!==(o=String(null===(l=i.Memory_protection)||void 0===l?void 0:l.self_injection))&&void 0!==o?o:""},{field:"process.executable.caseless",operator:"included",type:"match",value:null!==(c=null==g?void 0:g.executable)&&void 0!==c?c:""},{field:"process.name.caseless",operator:"included",type:"match",value:null!==(d=null==g?void 0:g.name)&&void 0!==d?d:""},{field:"process.Ext.token.integrity_level_name",operator:"included",type:"match",value:null!==(p=null==g||null===(m=g.Ext)||void 0===m||null===(b=m.token)||void 0===b?void 0:b.integrity_level_name)&&void 0!==p?p:""}]);return{...Object(u.k)({listId:e,namespaceType:n,name:t}),entries:Object(u.c)(f)}},M=({listId:e,name:t,eventCode:a,listNamespace:n="agnostic",alertEcsData:i})=>{var r,s,o,l,c,d,p,m,b,g,f,y,h,v,E,x,j,S,k,O,w,I,C,M,_,F,A,D,N,P,R,L,B,q,z,$,V,U,H;const{process:G}=i,Q=T([{field:"rule.id",operator:"included",type:"match",value:null!==(r=null===(s=i.rule)||void 0===s?void 0:s.id)&&void 0!==r?r:""},{field:"process.executable.caseless",operator:"included",type:"match",value:null!==(o=null==G?void 0:G.executable)&&void 0!==o?o:""},{field:"process.command_line",operator:"included",type:"match",value:null!==(l=null==G?void 0:G.command_line)&&void 0!==l?l:""},{field:"process.parent.executable",operator:"included",type:"match",value:null!==(c=null==G||null===(d=G.parent)||void 0===d?void 0:d.executable)&&void 0!==c?c:""},{field:"process.code_signature.subject_name",operator:"included",type:"match",value:null!==(p=null==G||null===(m=G.code_signature)||void 0===m?void 0:m.subject_name)&&void 0!==p?p:""},{field:"file.path",operator:"included",type:"match",value:null!==(b=null===(g=i.file)||void 0===g?void 0:g.path)&&void 0!==b?b:""},{field:"file.name",operator:"included",type:"match",value:null!==(f=null===(y=i.file)||void 0===y?void 0:y.name)&&void 0!==f?f:""},{field:"source.ip",operator:"included",type:"match",value:null!==(h=null===(v=i.source)||void 0===v?void 0:v.ip)&&void 0!==h?h:""},{field:"destination.ip",operator:"included",type:"match",value:null!==(E=null===(x=i.destination)||void 0===x?void 0:x.ip)&&void 0!==E?E:""},{field:"registry.path",operator:"included",type:"match",value:null!==(j=null===(S=i.registry)||void 0===S?void 0:S.path)&&void 0!==j?j:""},{field:"registry.value",operator:"included",type:"match",value:null!==(k=null===(O=i.registry)||void 0===O?void 0:O.value)&&void 0!==k?k:""},{field:"registry.data.strings",operator:"included",type:"match",value:null!==(w=null===(I=i.registry)||void 0===I||null===(C=I.data)||void 0===C?void 0:C.strings)&&void 0!==w?w:""},{field:"dll.path",operator:"included",type:"match",value:null!==(M=null===(_=i.dll)||void 0===_?void 0:_.path)&&void 0!==M?M:""},{field:"dll.code_signature.subject_name",operator:"included",type:"match",value:null!==(F=null===(A=i.dll)||void 0===A||null===(D=A.code_signature)||void 0===D?void 0:D.subject_name)&&void 0!==F?F:""},{field:"dll.pe.original_file_name",operator:"included",type:"match",value:null!==(N=null===(P=i.dll)||void 0===P||null===(R=P.pe)||void 0===R?void 0:R.original_file_name)&&void 0!==N?N:""},{field:"dns.question.name",operator:"included",type:"match",value:null!==(L=null===(B=i.dns)||void 0===B||null===(q=B.question)||void 0===q?void 0:q.name)&&void 0!==L?L:""},{field:"dns.question.type",operator:"included",type:"match",value:null!==(z=null===($=i.dns)||void 0===$||null===(V=$.question)||void 0===V?void 0:V.type)&&void 0!==z?z:""},{field:"user.id",operator:"included",type:"match",value:null!==(U=null===(H=i.user)||void 0===H?void 0:H.id)&&void 0!==U?U:""}]);return{...Object(u.k)({listId:e,namespaceType:n,name:t}),entries:Object(u.c)(Q)}},_=(e,t,a)=>{var n,i;const r=null!==(n=a["event.code"])&&void 0!==n?n:null===(i=a.event)||void 0===i?void 0:i.code;switch(r){case"behavior":return[M({listId:e,name:t,eventCode:r,alertEcsData:a})];case"memory_signature":return[I({listId:e,name:t,eventCode:r,alertEcsData:a})];case"shellcode_thread":return[C({listId:e,name:t,eventCode:r,alertEcsData:a})];case"ransomware":return(e=>{const{process:t}=e,a=t&&t.Ext&&t.Ext.code_signature;return w(a)})(a).map((n=>(({listId:e,name:t,codeSignature:a,eventCode:n,listNamespace:i="agnostic",alertEcsData:r})=>{var s,o,l,c;const{process:d,Ransomware:p}=r,m=null!==(s=null==d||null===(o=d.hash)||void 0===o?void 0:o.sha256)&&void 0!==s?s:"",b=null!==(l=null==d?void 0:d.executable)&&void 0!==l?l:"",g=null!==(c=null==p?void 0:p.feature)&&void 0!==c?c:"";return{...Object(u.k)({listId:e,namespaceType:i,name:t}),entries:Object(u.c)([{field:"process.Ext.code_signature",type:"nested",entries:[{field:"subject_name",operator:"included",type:"match",value:null!=a?a.subjectName:""},{field:"trusted",operator:"included",type:"match",value:null!=a?a.trusted:""}]},{field:"process.executable",operator:"included",type:"match",value:null!=b?b:""},{field:"process.hash.sha256",operator:"included",type:"match",value:null!=m?m:""},{field:"Ransomware.feature",operator:"included",type:"match",value:null!=g?g:""},{field:"event.code",operator:"included",type:"match",value:null!=n?n:""}])}})({listId:e,name:t,eventCode:r,codeSignature:n,alertEcsData:a})));default:return(e=>{const{file:t}=e,a=t&&t.Ext&&t.Ext.code_signature;return w(a)})(a).map((n=>(({listId:e,name:t,codeSignature:a,eventCode:n,listNamespace:i="agnostic",alertEcsData:r})=>{var s,o,l,c;const{file:d,host:p}=r,m=null!==(s=null==d?void 0:d.path)&&void 0!==s?s:"",b=null!==(o=null==d||null===(l=d.hash)||void 0===l?void 0:l.sha256)&&void 0!==o?o:"",g="Linux"===(null==p||null===(c=p.os)||void 0===c?void 0:c.name),f=[{field:g?"file.path":"file.path.caseless",operator:"included",type:"match",value:null!=m?m:""},{field:"file.hash.sha256",operator:"included",type:"match",value:null!=b?b:""},{field:"event.code",operator:"included",type:"match",value:null!=n?n:""}];return{...Object(u.k)({listId:e,namespaceType:i,name:t}),entries:g?Object(u.c)(f):Object(u.c)([{field:"file.Ext.code_signature",type:"nested",entries:[{field:"subject_name",operator:"included",type:"match",value:null!=a?a.subjectName:""},{field:"trusted",operator:"included",type:"match",value:null!=a?a.trusted:""}]},...f])}})({listId:e,name:t,eventCode:null!=r?r:"",codeSignature:n,alertEcsData:a})))}},F=(e,t)=>e.map((e=>({...e,name:t}))),A=e=>e.map((e=>({...Object(d.a)(e),list_id:void 0,namespace_type:"single"}))),D=(e,t)=>t.flatMap((t=>e.map((e=>({...Object(d.a)(e),list_id:t.list_id,namespace_type:t.namespace_type}))))),N=({alertData:e,exceptionItemName:t,ruleCustomHighlightedFields:a})=>{const n=P(e,a);if(!n.length)return null;const i=(({highlightedFields:e,alertData:t})=>Object.values(e).reduce(((e,a)=>{var n;const i=a.id,r=null!==(n=Object(s.get)(t,i))&&void 0!==n?n:Object(s.get)(t,`kibana.alert.${i}`);if(null!=r){const t=Array.isArray(r)?c.d.MATCH_ANY:c.d.MATCH,a=Array.isArray(r)?r.map(String):r.toString();e.push({field:i,operator:c.c.INCLUDED,type:t,value:a})}return e}),[]))({highlightedFields:n,alertData:e});return i.length?(({name:e,exceptionEntries:t})=>({...Object(u.k)({listId:void 0,namespaceType:"single",name:e}),entries:Object(u.c)(t)}))({name:t,exceptionEntries:i}):null},P=(e,t)=>{const a=Object(s.get)(e,"event.category"),n=Object(s.get)(e,"event.code"),i=Object(s.get)(e,"kibana.alert.rule.type"),r={primaryEventCategory:Array.isArray(a)?a[0]:a,allEventCategories:[a]};return((e,t,a)=>e.filter((({id:e})=>"agent.id"===e?R(a):!t.some((t=>e.startsWith(t))))))(Object(p.b)({eventCategories:r,eventCode:n,eventRuleType:i,highlightedFieldsOverride:t}),f,e)},R=e=>{if(!Object(s.get)(e,"kibana.alert.rule.uuid"))return!1;const t=Object(s.get)(e,"agent.type");return"endpoint"===(Array.isArray(t)?t[0]:t)}},function(e,t,a){"use strict";a.d(t,"a",(function(){return b}));var n=a(129),i=a(109),r=a(2),s=a(255),o=a(108),l=a(232),c=a(233),u=a(409),d=a(304),p=a(552);const m=e=>({query:{bool:{filter:[{bool:{should:[{match:{"signal.rule.id":e}},{match:{[n.S]:e}}],minimum_should_match:1}}]}},size:1}),b=e=>{const{isFetching:t,data:a,error:n,refetch:s}=Object(p.a)(e,!1),{addError:b}=Object(o.a)(),f=!Object(i.u)(n),{loading:y,data:h}=Object(c.a)({query:m(e),skip:f,queryName:l.a.BY_RULE_ID});Object(r.useEffect)((()=>{null==n||Object(i.u)(n)||b(n,{title:d.b})}),[b,n]);const v=Object(r.useMemo)((()=>{const e=f?a:null==h?void 0:g(h);if(e)return Object(u.a)(e)}),[f,h,a]);return{error:n,loading:t||y,refresh:s,rule:null!=v?v:null,isExistingRule:f}},g=e=>{var t,a,n,i;if(0===e.hits.hits.length)return;const r=e.hits.hits[0],o=null!==(t=null===(a=r._source.signal)||void 0===a?void 0:a.rule)&&void 0!==t?t:null===(n=r._source.kibana)||void 0===n||null===(i=n.alert)||void 0===i?void 0:i.rule;if(null==o){var l,c,u,d,p,m;const e=Object(s.a)(null!==(l=r._source)&&void 0!==l?l:{}),t={...null==e||null===(c=e.kibana)||void 0===c||null===(u=c.alert)||void 0===u?void 0:u.rule,...null==e||null===(d=e.kibana)||void 0===d||null===(p=d.alert)||void 0===p||null===(m=p.rule)||void 0===m?void 0:m.parameters};return delete t.parameters,t}return o}},function(e,t,a){"use strict";a.d(t,"h",(function(){return b})),a.d(t,"i",(function(){return g})),a.d(t,"j",(function(){return f})),a.d(t,"e",(function(){return y.c})),a.d(t,"d",(function(){return y.a})),a.d(t,"c",(function(){return h.a})),a.d(t,"f",(function(){return v.a})),a.d(t,"g",(function(){return E.a})),a.d(t,"b",(function(){return x.b})),a.d(t,"a",(function(){return x.a}));var n=a(43),i=a(112);let r,s;!function(e){e.last_hour="last_hour",e.last_day="last_day",e.last_week="last_week",e.last_month="last_month",e.last_year="last_year",e.custom_range="custom_range"}(r||(r={})),function(e){e.minute="minute",e.hour="hour",e.day="day",e.week="week",e.month="month"}(s||(s={}));const o=n.union([n.exact(n.type({type:n.literal(r.last_hour),granularity:n.literal(s.minute)})),n.exact(n.type({type:n.literal(r.last_day),granularity:n.union([n.literal(s.minute),n.literal(s.hour)])})),n.exact(n.type({type:n.literal(r.last_week),granularity:n.union([n.literal(s.hour),n.literal(s.day)])})),n.exact(n.type({type:n.literal(r.last_month),granularity:n.union([n.literal(s.day),n.literal(s.week)])})),n.exact(n.type({type:n.literal(r.last_year),granularity:n.union([n.literal(s.week),n.literal(s.month)])})),n.exact(n.type({type:n.literal(r.custom_range),granularity:n.union([n.literal(s.minute),n.literal(s.hour),n.literal(s.day),n.literal(s.week),n.literal(s.month)]),from:i.h,to:i.h}))]);n.exact(n.partial({interval:o,debug:n.boolean})),n.exact(n.intersection([n.type({rule_id:i.k}),n.partial({interval:o,debug:n.boolean})])),n.exact(n.partial({interval:o,debug:n.boolean})),n.exact(n.type({}));var l=a(193),c=a(128),u=a(546);n.exact(n.type({ruleId:i.k})),n.exact(n.type({event_types:Object(i.s)(u.f),log_levels:Object(i.s)(u.e),sort_order:c.e,page:l.b,per_page:l.c})),n.exact(n.type({events:n.array(u.a),pagination:c.n}));const d=Object(i.s)(u.g),p=Object(i.t)(u.d,"timestamp","DefaultSortField");n.exact(n.type({ruleId:i.k})),n.exact(n.type({start:i.h,end:i.h,query_text:i.b,status_filters:d,sort_field:p,sort_order:c.e,page:l.b,per_page:l.c})),n.exact(n.type({events:n.array(u.b),total:n.number}));var m=a(4);m.Cb,m.Cb,m.Cb;const b=`${m.Cb}/health/_setup`,g=(m.Cb,e=>`${m.Cb}/rules/${e}/execution/events`),f=(m.Cb,e=>`${m.Cb}/rules/${e}/execution/results`);var y=a(429),h=(a(352),a(430),a(431)),v=a(262),E=a(432),x=a(351)},function(e,t,a){"use strict";a.d(t,"c",(function(){return E})),a.d(t,"d",(function(){return j})),a.d(t,"b",(function(){return S})),a.d(t,"a",(function(){return k}));var n=a(2),i=a(162),r=a(533),s=a(102),o=a(4);const l=async e=>{const{indexName:t,entity:a}=e.query;return s.b.get().http.fetch(o.hc,{method:"GET",query:{indexName:t,entity:a},asSystemRequest:!0,signal:e.signal})};var c=a(414),u=a(216),d=a(113),p=a(5);p.i18n.translate("xpack.securitySolution.riskScore.errorSearchDescription",{defaultMessage:"An error has occurred on risk score search"});const m=p.i18n.translate("xpack.securitySolution.riskScore.failSearchDescription",{defaultMessage:"Failed to run search on risk score"});var b=a(108);const g=e=>{var t,a;return"index_not_found_exception"===(null===(t=e.attributes)||void 0===t||null===(a=t.caused_by)||void 0===a?void 0:a.type)};var f=a(266),y=a(194),h=a(124);const v={totalCount:0,data:void 0},E=({timerange:e,onlyLatest:t=!0,filterQuery:a,sort:s,skip:o=!1,pagination:p,riskEntity:E,includeAlertsCount:x=!1})=>{const j=Object(f.a)(),S=Object(h.a)("riskScoringRoutesEnabled"),k=j?E===d.w.host?Object(d.F)(j,t,S):Object(d.G)(j,t,S):void 0,O=E===d.w.host?d.v.hostsRiskScore:d.v.usersRiskScore,{querySize:w,cursorStart:T}=p||{},{addError:I}=Object(b.a)(),{isDeprecated:C,isEnabled:M,isAuthorized:_,isLoading:F,refetch:A}=((e,t)=>{const{isPlatinumOrTrialLicense:a,capabilitiesFetched:s}=Object(i.a)(),o=Object(c.a)("entity-analytics"),u=a&&o,{fetch:d,data:p,isLoading:m,error:b}=Object(r.b)(r.a.GET_RISK_SCORE_DEPRECATED,l),g=Object(n.useMemo)((()=>p||{isDeprecated:u,isEnabled:u}),[p]),f=Object(n.useCallback)((t=>{u&&d({query:{indexName:t,entity:e}})}),[u,d,e]);return Object(n.useEffect)((()=>{null!=t&&f(t)}),[t,f]),{error:b,isLoading:m||!s||null==t,refetch:f,isAuthorized:u,...g}})(E,k),{loading:D,result:N,search:P,refetch:R,inspect:L,error:B}=Object(y.a)({factoryQueryType:O,initialResult:v,abort:o,showErrorToast:!1}),q=Object(n.useCallback)((()=>{k&&(A(k),R())}),[k,R,A]);Object(n.useEffect)((()=>{q()}),[null==e?void 0:e.to,null==e?void 0:e.from]);const z=Object(n.useMemo)((()=>({data:N.data,inspect:L,refetch:q,totalCount:N.totalCount,isAuthorized:_,isDeprecated:C,isModuleEnabled:M,isInspected:!1})),[L,C,M,_,q,N.data,N.totalCount]),$=Object(n.useMemo)((()=>e?{to:e.to,from:e.from,interval:""}:void 0),[e]),V=Object(n.useMemo)((()=>k?{defaultIndex:[k],factoryQueryType:O,riskScoreEntity:E,includeAlertsCount:x,filterQuery:Object(u.a)(a),pagination:void 0!==T&&void 0!==w?{cursorStart:T,querySize:w}:void 0,sort:s,timerange:t?void 0:$,alertsTimerange:x?$:void 0}:null),[T,k,O,a,w,s,$,t,E,x]);return Object(n.useEffect)((()=>{B&&(g(B)||I(B,{title:m}))}),[I,B]),Object(n.useEffect)((()=>{o||F||null==V||!_||!M||C||P(V)}),[M,C,_,F,V,P,o]),{...z,loading:D||F}},x=p.i18n.translate("xpack.securitySolution.riskScore.kpi.failSearchDescription",{defaultMessage:"Failed to run search on risk score"}),j=({filterQuery:e,skip:t,riskEntity:a,timerange:r})=>{const{addError:s}=Object(b.a)(),o=Object(f.a)(),l=Object(i.a)().isPlatinumOrTrialLicense,c=Object(h.a)("riskScoringRoutesEnabled"),u=o?a===d.w.host?Object(d.F)(o,!0,c):Object(d.G)(o,!0,c):void 0,{loading:p,result:m,search:v,refetch:E,inspect:j,error:S}=Object(y.a)({factoryQueryType:d.v.kpiRiskScore,initialResult:{kpiRiskScore:d.c},abort:t,showErrorToast:!1}),k=!!S&&g(S);Object(n.useEffect)((()=>{!t&&u&&l&&v({filterQuery:e,defaultIndex:[u],entity:a})}),[u,v,e,t,a,l]),Object(n.useEffect)((()=>{E()}),[null==r?void 0:r.to,null==r?void 0:r.from]),Object(n.useEffect)((()=>{S&&(g(S)||s(S,{title:x}))}),[s,S]);const O=Object(n.useMemo)((()=>{var e,t,a,n,i;if(!p&&!S)return{[d.y.unknown]:null!==(e=m.kpiRiskScore[d.y.unknown])&&void 0!==e?e:0,[d.y.low]:null!==(t=m.kpiRiskScore[d.y.low])&&void 0!==t?t:0,[d.y.moderate]:null!==(a=m.kpiRiskScore[d.y.moderate])&&void 0!==a?a:0,[d.y.high]:null!==(n=m.kpiRiskScore[d.y.high])&&void 0!==n?n:0,[d.y.critical]:null!==(i=m.kpiRiskScore[d.y.critical])&&void 0!==i?i:0}}),[m,p,S]);return{error:S,severityCount:O,loading:p,isModuleDisabled:k,refetch:E,inspect:j}};let S,k;!function(e){e.USERS_BY_RISK="UsersByRisk",e.USER_DETAILS_RISK_SCORE="UserDetailsRiskScore"}(S||(S={})),function(e){e.DEFAULT="HostRiskScore",e.HOST_DETAILS_RISK_SCORE="HostDetailsRiskScore",e.OVERVIEW_RISKY_HOSTS="OverviewRiskyHosts",e.HOSTS_BY_RISK="HostsByRisk"}(k||(k={}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(2),i=a(126);const r=()=>{const[e,t]=Object(n.useState)({isAuthenticated:null,hasEncryptionKey:null,hasIndexManage:null,hasIndexRead:null,hasIndexWrite:null,hasIndexUpdateDelete:null,hasIndexMaintenance:null,hasKibanaCRUD:!1,hasKibanaREAD:!1}),{detectionEnginePrivileges:a,kibanaSecuritySolutionsPrivileges:{crud:r,read:s}}=Object(i.a)();return Object(n.useEffect)((()=>{null!=a.error&&t({isAuthenticated:!1,hasEncryptionKey:!1,hasIndexManage:!1,hasIndexRead:!1,hasIndexWrite:!1,hasIndexUpdateDelete:!1,hasIndexMaintenance:!1,hasKibanaCRUD:r,hasKibanaREAD:s})}),[a.error,r,s]),Object(n.useEffect)((()=>{if(null!=a.result){const e=a.result;if(null!=e.index&&Object.keys(e.index).length>0){const a=Object.keys(e.index)[0];t({isAuthenticated:e.is_authenticated,hasEncryptionKey:e.has_encryption_key,hasIndexManage:e.index[a].manage&&e.cluster.manage,hasIndexMaintenance:e.index[a].maintenance,hasIndexRead:e.index[a].read,hasIndexWrite:e.index[a].create||e.index[a].create_doc||e.index[a].index||e.index[a].write,hasIndexUpdateDelete:e.index[a].write,hasKibanaCRUD:r,hasKibanaREAD:s})}}}),[a.result,r,s]),{loading:a.loading,...e}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return d})),a.d(t,"b",(function(){return p})),a.d(t,"d",(function(){return m})),a.d(t,"c",(function(){return b})),a.d(t,"e",(function(){return g}));var n=a(62),i=a.n(n),r=a(50),s=a.n(r),o=a(42),l=a(769),c=a(4),u=a(102);const d=s()().subtract(24,"hours"),p=s()(),m=(e=!0)=>{const t=e?u.b.get().uiSettings.get(c.z):null,a=Object(o.isString)(null==t?void 0:t.from)&&(null==t?void 0:t.from)||c.G,n=Object(o.isString)(null==t?void 0:t.to)&&(null==t?void 0:t.to)||c.X,i=g(a,d).toISOString(),r=g(n,p,!0).toISOString();return{from:i,fromStr:a,to:r,toStr:n,socTrends:Object(l.b)({to:r,from:i})}},b=(e=!0)=>{const t=e?u.b.get().uiSettings.get(c.y):null,a=Object(o.isNumber)(null==t?void 0:t.value)&&(null==t?void 0:t.value)||c.K;return{kind:!Object(o.isBoolean)(null==t?void 0:t.pause)||null!=t&&t.pause?c.J:"interval",duration:a}},g=(e,t,a=!1,n,r)=>{const s=i.a.parse(e,{roundUp:a,momentInstance:n,forceNow:r});return null!=s&&s.isValid()?s:t}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(104),i=a(1156),r=a(1157),s=a(1158),o=a(1159);function l(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var c=l(n),u=l(i),d=l(r),p=l(s),m=l(o);function b(){var e;return(e=arguments.length-1)<0||arguments.length<=e?void 0:arguments[e]}var g={symbols:{"!":{postfix:{symbol:"!",f:function e(t){return t%1||!(+t>=0)?NaN:t>170?1/0:0===t?1:t*e(t-1)},notation:"postfix",precedence:6,rightToLeft:0,argCount:1},symbol:"!",regSymbol:"!"},"^":{infix:{symbol:"^",f:function(e,t){return Math.pow(e,t)},notation:"infix",precedence:5,rightToLeft:1,argCount:2},symbol:"^",regSymbol:"\\^"},"*":{infix:{symbol:"*",f:function(e,t){return e*t},notation:"infix",precedence:4,rightToLeft:0,argCount:2},symbol:"*",regSymbol:"\\*"},"/":{infix:{symbol:"/",f:function(e,t){return e/t},notation:"infix",precedence:4,rightToLeft:0,argCount:2},symbol:"/",regSymbol:"/"},"+":{infix:{symbol:"+",f:function(e,t){return e+t},notation:"infix",precedence:2,rightToLeft:0,argCount:2},prefix:{symbol:"+",f:b,notation:"prefix",precedence:3,rightToLeft:0,argCount:1},symbol:"+",regSymbol:"\\+"},"-":{infix:{symbol:"-",f:function(e,t){return e-t},notation:"infix",precedence:2,rightToLeft:0,argCount:2},prefix:{symbol:"-",f:function(e){return-e},notation:"prefix",precedence:3,rightToLeft:0,argCount:1},symbol:"-",regSymbol:"-"},",":{infix:{symbol:",",f:function(){return Array.of.apply(Array,arguments)},notation:"infix",precedence:1,rightToLeft:0,argCount:2},symbol:",",regSymbol:","},"(":{prefix:{symbol:"(",f:b,notation:"prefix",precedence:0,rightToLeft:0,argCount:1},symbol:"(",regSymbol:"\\("},")":{postfix:{symbol:")",f:void 0,notation:"postfix",precedence:0,rightToLeft:0,argCount:1},symbol:")",regSymbol:"\\)"},min:{func:{symbol:"min",f:function(){return Math.min.apply(Math,arguments)},notation:"func",precedence:0,rightToLeft:0,argCount:1},symbol:"min",regSymbol:"min\\b"},max:{func:{symbol:"max",f:function(){return Math.max.apply(Math,arguments)},notation:"func",precedence:0,rightToLeft:0,argCount:1},symbol:"max",regSymbol:"max\\b"},sqrt:{func:{symbol:"sqrt",f:function(e){return Math.sqrt(e)},notation:"func",precedence:0,rightToLeft:0,argCount:1},symbol:"sqrt",regSymbol:"sqrt\\b"}}},f=function(e){function t(t){var a;return a=e.call(this,"An error occurred. See https://github.com/styled-components/polished/blob/main/src/internalHelpers/errors.md#"+t+" for more information.")||this,u.default(a)}return d.default(t,e),t}(p.default(Error)),y=/((?!\w)a|na|hc|mc|dg|me[r]?|xe|ni(?![a-zA-Z])|mm|cp|tp|xp|q(?!s)|hv|xamv|nimv|wv|sm|s(?!\D|$)|ged|darg?|nrut)/g;function h(e,t){var a,n=e.pop();return t.push(n.f.apply(n,(a=[]).concat.apply(a,t.splice(-n.argCount)))),n.precedence}function v(e){return e.split("").reverse().join("")}var E=/--[\S]*/g;function x(e){return e.charAt(0).toUpperCase()+e.slice(1)}var j=["Top","Right","Bottom","Left"];function S(e,t){if(!e)return t.toLowerCase();var a=e.split("-");if(a.length>1)return a.splice(1,0,t),a.reduce((function(e,t){return""+e+x(t)}));var n=e.replace(/([a-z])([A-Z])/g,"$1"+t+"$2");return e===n?""+e+t:n}function k(e){for(var t=arguments.length,a=new Array(t>1?t-1:0),n=1;n<t;n++)a[n-1]=arguments[n];var i=a[0],r=a[1],s=void 0===r?i:r,o=a[2],l=void 0===o?i:o,c=a[3];return function(e,t){for(var a={},n=0;n<t.length;n+=1)(t[n]||0===t[n])&&(a[S(e,j[n])]=t[n]);return a}(e,[i,s,l,void 0===c?s:c])}function O(e,t){return e.substr(-t.length)===t}var w=/^([+-]?(?:\d+|\d*\.\d+))([a-z]*|%)$/;function T(e,t){if("string"!=typeof e)return t?[e,void 0]:e;var a=e.match(w);return t?(console.warn("stripUnit's unitReturn functionality has been marked for deprecation in polished 4.0. It's functionality has been been moved to getValueAndUnit."),a?[parseFloat(e),a[2]]:[e,void 0]):a?parseFloat(e):e}var I=function(e){return function(t,a){void 0===a&&(a="16px");var n=t,i=a;if("string"==typeof t){if(!O(t,"px"))throw new f(69,e,t);n=T(t)}if("string"==typeof a){if(!O(a,"px"))throw new f(70,e,a);i=T(a)}if("string"==typeof n)throw new f(71,t,e);if("string"==typeof i)throw new f(72,a,e);return""+n/i+e}},C=I("em"),M=/^([+-]?(?:\d+|\d*\.\d+))([a-z]*|%)$/;function _(e){if("string"!=typeof e)return[e,""];var t=e.match(M);return t?[parseFloat(e),t[2]]:[e,void 0]}var F={minorSecond:1.067,majorSecond:1.125,minorThird:1.2,majorThird:1.25,perfectFourth:1.333,augFourth:1.414,perfectFifth:1.5,minorSixth:1.6,goldenSection:1.618,majorSixth:1.667,minorSeventh:1.778,majorSeventh:1.875,octave:2,majorTenth:2.5,majorEleventh:2.667,majorTwelfth:3,doubleOctave:4},A=I("rem");function D(e,t,a,n){void 0===a&&(a="320px"),void 0===n&&(n="1200px");var i=_(e),r=i[0],s=i[1],o=_(t),l=o[0],c=o[1],u=_(a),d=u[0],p=u[1],m=_(n),b=m[0],g=m[1];if("number"!=typeof d||"number"!=typeof b||!p||!g||p!==g)throw new f(47);if("number"!=typeof r||"number"!=typeof l||s!==c)throw new f(48);if(s!==p||c!==g)throw new f(75);var y=(r-l)/(d-b);return"calc("+(l-y*b).toFixed(2)+(s||"")+" + "+(100*y).toFixed(2)+"vw)"}function N(e,t){(null==t||t>e.length)&&(t=e.length);for(var a=0,n=new Array(t);a<t;a++)n[a]=e[a];return n}var P,R,L=/^\s*data:([a-z]+\/[a-z-]+(;[a-z-]+=[a-z-]+)?)?(;charset=[a-z0-9-]+)?(;base64)?,[a-z0-9!$&',()*+,;=\-._~:@/?%\s]*\s*$/i,B={woff:"woff",woff2:"woff2",ttf:"truetype",otf:"opentype",eot:"embedded-opentype",svg:"svg",svgz:"svg"};function q(e,t){return t?' format("'+B[e]+'")':""}function z(e,t,a,n){var i=[];return t&&i.push(function(e){return e.map((function(e){return'local("'+e+'")'})).join(", ")}(t)),e&&i.push(function(e,t,a){return function(e){return!!e.replace(/\s+/g," ").match(L)}(e)?'url("'+e+'")'+q(t[0],a):t.map((function(t){return'url("'+e+"."+t+'")'+q(t,a)})).join(", ")}(e,a,n)),i.join(", ")}function $(e){return void 0===e&&(e=1.3),"\n    @media only screen and (-webkit-min-device-pixel-ratio: "+e+"),\n    only screen and (min--moz-device-pixel-ratio: "+e+"),\n    only screen and (-o-min-device-pixel-ratio: "+e+"/1),\n    only screen and (min-resolution: "+Math.round(96*e)+"dpi),\n    only screen and (min-resolution: "+e+"dppx)\n  "}function V(e){for(var t="",a=arguments.length,n=new Array(a>1?a-1:0),i=1;i<a;i++)n[i-1]=arguments[i];for(var r=0;r<e.length;r+=1)if(t+=e[r],r===n.length-1&&n[r]){var s=n.filter((function(e){return!!e}));s.length>1?(t=t.slice(0,-1),t+=", "+n[r]):1===s.length&&(t+=""+n[r])}else n[r]&&(t+=n[r]+" ");return t.trim()}var U={easeInBack:"cubic-bezier(0.600, -0.280, 0.735, 0.045)",easeInCirc:"cubic-bezier(0.600,  0.040, 0.980, 0.335)",easeInCubic:"cubic-bezier(0.550,  0.055, 0.675, 0.190)",easeInExpo:"cubic-bezier(0.950,  0.050, 0.795, 0.035)",easeInQuad:"cubic-bezier(0.550,  0.085, 0.680, 0.530)",easeInQuart:"cubic-bezier(0.895,  0.030, 0.685, 0.220)",easeInQuint:"cubic-bezier(0.755,  0.050, 0.855, 0.060)",easeInSine:"cubic-bezier(0.470,  0.000, 0.745, 0.715)",easeOutBack:"cubic-bezier(0.175,  0.885, 0.320, 1.275)",easeOutCubic:"cubic-bezier(0.215,  0.610, 0.355, 1.000)",easeOutCirc:"cubic-bezier(0.075,  0.820, 0.165, 1.000)",easeOutExpo:"cubic-bezier(0.190,  1.000, 0.220, 1.000)",easeOutQuad:"cubic-bezier(0.250,  0.460, 0.450, 0.940)",easeOutQuart:"cubic-bezier(0.165,  0.840, 0.440, 1.000)",easeOutQuint:"cubic-bezier(0.230,  1.000, 0.320, 1.000)",easeOutSine:"cubic-bezier(0.390,  0.575, 0.565, 1.000)",easeInOutBack:"cubic-bezier(0.680, -0.550, 0.265, 1.550)",easeInOutCirc:"cubic-bezier(0.785,  0.135, 0.150, 0.860)",easeInOutCubic:"cubic-bezier(0.645,  0.045, 0.355, 1.000)",easeInOutExpo:"cubic-bezier(1.000,  0.000, 0.000, 1.000)",easeInOutQuad:"cubic-bezier(0.455,  0.030, 0.515, 0.955)",easeInOutQuart:"cubic-bezier(0.770,  0.000, 0.175, 1.000)",easeInOutQuint:"cubic-bezier(0.860,  0.000, 0.070, 1.000)",easeInOutSine:"cubic-bezier(0.445,  0.050, 0.550, 0.950)"},H=function(e,t,a){var n=""+a[0]+(a[1]||""),i=""+a[0]/2+(a[1]||""),r=""+t[0]+(t[1]||""),s=""+t[0]/2+(t[1]||"");switch(e){case"top":return"0 "+i+" "+r+" "+i;case"topLeft":return n+" "+r+" 0 0";case"left":return s+" "+n+" "+s+" 0";case"bottomLeft":return n+" 0 0 "+r;case"bottom":return r+" "+i+" 0 "+i;case"bottomRight":return"0 0 "+n+" "+r;case"right":return s+" 0 "+s+" "+n;default:return"0 "+n+" "+r+" 0"}};function G(e){return Math.round(255*e)}function Q(e,t,a){return G(e)+","+G(t)+","+G(a)}function W(e,t,a,n){if(void 0===n&&(n=Q),0===t)return n(a,a,a);var i=(e%360+360)%360/60,r=(1-Math.abs(2*a-1))*t,s=r*(1-Math.abs(i%2-1)),o=0,l=0,c=0;i>=0&&i<1?(o=r,l=s):i>=1&&i<2?(o=s,l=r):i>=2&&i<3?(l=r,c=s):i>=3&&i<4?(l=s,c=r):i>=4&&i<5?(o=s,c=r):i>=5&&i<6&&(o=r,c=s);var u=a-r/2;return n(o+u,l+u,c+u)}var K={aliceblue:"f0f8ff",antiquewhite:"faebd7",aqua:"00ffff",aquamarine:"7fffd4",azure:"f0ffff",beige:"f5f5dc",bisque:"ffe4c4",black:"000",blanchedalmond:"ffebcd",blue:"0000ff",blueviolet:"8a2be2",brown:"a52a2a",burlywood:"deb887",cadetblue:"5f9ea0",chartreuse:"7fff00",chocolate:"d2691e",coral:"ff7f50",cornflowerblue:"6495ed",cornsilk:"fff8dc",crimson:"dc143c",cyan:"00ffff",darkblue:"00008b",darkcyan:"008b8b",darkgoldenrod:"b8860b",darkgray:"a9a9a9",darkgreen:"006400",darkgrey:"a9a9a9",darkkhaki:"bdb76b",darkmagenta:"8b008b",darkolivegreen:"556b2f",darkorange:"ff8c00",darkorchid:"9932cc",darkred:"8b0000",darksalmon:"e9967a",darkseagreen:"8fbc8f",darkslateblue:"483d8b",darkslategray:"2f4f4f",darkslategrey:"2f4f4f",darkturquoise:"00ced1",darkviolet:"9400d3",deeppink:"ff1493",deepskyblue:"00bfff",dimgray:"696969",dimgrey:"696969",dodgerblue:"1e90ff",firebrick:"b22222",floralwhite:"fffaf0",forestgreen:"228b22",fuchsia:"ff00ff",gainsboro:"dcdcdc",ghostwhite:"f8f8ff",gold:"ffd700",goldenrod:"daa520",gray:"808080",green:"008000",greenyellow:"adff2f",grey:"808080",honeydew:"f0fff0",hotpink:"ff69b4",indianred:"cd5c5c",indigo:"4b0082",ivory:"fffff0",khaki:"f0e68c",lavender:"e6e6fa",lavenderblush:"fff0f5",lawngreen:"7cfc00",lemonchiffon:"fffacd",lightblue:"add8e6",lightcoral:"f08080",lightcyan:"e0ffff",lightgoldenrodyellow:"fafad2",lightgray:"d3d3d3",lightgreen:"90ee90",lightgrey:"d3d3d3",lightpink:"ffb6c1",lightsalmon:"ffa07a",lightseagreen:"20b2aa",lightskyblue:"87cefa",lightslategray:"789",lightslategrey:"789",lightsteelblue:"b0c4de",lightyellow:"ffffe0",lime:"0f0",limegreen:"32cd32",linen:"faf0e6",magenta:"f0f",maroon:"800000",mediumaquamarine:"66cdaa",mediumblue:"0000cd",mediumorchid:"ba55d3",mediumpurple:"9370db",mediumseagreen:"3cb371",mediumslateblue:"7b68ee",mediumspringgreen:"00fa9a",mediumturquoise:"48d1cc",mediumvioletred:"c71585",midnightblue:"191970",mintcream:"f5fffa",mistyrose:"ffe4e1",moccasin:"ffe4b5",navajowhite:"ffdead",navy:"000080",oldlace:"fdf5e6",olive:"808000",olivedrab:"6b8e23",orange:"ffa500",orangered:"ff4500",orchid:"da70d6",palegoldenrod:"eee8aa",palegreen:"98fb98",paleturquoise:"afeeee",palevioletred:"db7093",papayawhip:"ffefd5",peachpuff:"ffdab9",peru:"cd853f",pink:"ffc0cb",plum:"dda0dd",powderblue:"b0e0e6",purple:"800080",rebeccapurple:"639",red:"f00",rosybrown:"bc8f8f",royalblue:"4169e1",saddlebrown:"8b4513",salmon:"fa8072",sandybrown:"f4a460",seagreen:"2e8b57",seashell:"fff5ee",sienna:"a0522d",silver:"c0c0c0",skyblue:"87ceeb",slateblue:"6a5acd",slategray:"708090",slategrey:"708090",snow:"fffafa",springgreen:"00ff7f",steelblue:"4682b4",tan:"d2b48c",teal:"008080",thistle:"d8bfd8",tomato:"ff6347",turquoise:"40e0d0",violet:"ee82ee",wheat:"f5deb3",white:"fff",whitesmoke:"f5f5f5",yellow:"ff0",yellowgreen:"9acd32"},Y=/^#[a-fA-F0-9]{6}$/,J=/^#[a-fA-F0-9]{8}$/,X=/^#[a-fA-F0-9]{3}$/,Z=/^#[a-fA-F0-9]{4}$/,ee=/^rgb\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})\s*\)$/i,te=/^rgba\(\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*(\d{1,3})\s*,\s*([-+]?[0-9]*[.]?[0-9]+)\s*\)$/i,ae=/^hsl\(\s*(\d{0,3}[.]?[0-9]+)\s*,\s*(\d{1,3}[.]?[0-9]?)%\s*,\s*(\d{1,3}[.]?[0-9]?)%\s*\)$/i,ne=/^hsla\(\s*(\d{0,3}[.]?[0-9]+)\s*,\s*(\d{1,3}[.]?[0-9]?)%\s*,\s*(\d{1,3}[.]?[0-9]?)%\s*,\s*([-+]?[0-9]*[.]?[0-9]+)\s*\)$/i;function ie(e){if("string"!=typeof e)throw new f(3);var t=function(e){if("string"!=typeof e)return e;var t=e.toLowerCase();return K[t]?"#"+K[t]:e}(e);if(t.match(Y))return{red:parseInt(""+t[1]+t[2],16),green:parseInt(""+t[3]+t[4],16),blue:parseInt(""+t[5]+t[6],16)};if(t.match(J)){var a=parseFloat((parseInt(""+t[7]+t[8],16)/255).toFixed(2));return{red:parseInt(""+t[1]+t[2],16),green:parseInt(""+t[3]+t[4],16),blue:parseInt(""+t[5]+t[6],16),alpha:a}}if(t.match(X))return{red:parseInt(""+t[1]+t[1],16),green:parseInt(""+t[2]+t[2],16),blue:parseInt(""+t[3]+t[3],16)};if(t.match(Z)){var n=parseFloat((parseInt(""+t[4]+t[4],16)/255).toFixed(2));return{red:parseInt(""+t[1]+t[1],16),green:parseInt(""+t[2]+t[2],16),blue:parseInt(""+t[3]+t[3],16),alpha:n}}var i=ee.exec(t);if(i)return{red:parseInt(""+i[1],10),green:parseInt(""+i[2],10),blue:parseInt(""+i[3],10)};var r=te.exec(t.substring(0,50));if(r)return{red:parseInt(""+r[1],10),green:parseInt(""+r[2],10),blue:parseInt(""+r[3],10),alpha:parseFloat(""+r[4])};var s=ae.exec(t);if(s){var o="rgb("+W(parseInt(""+s[1],10),parseInt(""+s[2],10)/100,parseInt(""+s[3],10)/100)+")",l=ee.exec(o);if(!l)throw new f(4,t,o);return{red:parseInt(""+l[1],10),green:parseInt(""+l[2],10),blue:parseInt(""+l[3],10)}}var c=ne.exec(t.substring(0,50));if(c){var u="rgb("+W(parseInt(""+c[1],10),parseInt(""+c[2],10)/100,parseInt(""+c[3],10)/100)+")",d=ee.exec(u);if(!d)throw new f(4,t,u);return{red:parseInt(""+d[1],10),green:parseInt(""+d[2],10),blue:parseInt(""+d[3],10),alpha:parseFloat(""+c[4])}}throw new f(5)}function re(e){return function(e){var t,a=e.red/255,n=e.green/255,i=e.blue/255,r=Math.max(a,n,i),s=Math.min(a,n,i),o=(r+s)/2;if(r===s)return void 0!==e.alpha?{hue:0,saturation:0,lightness:o,alpha:e.alpha}:{hue:0,saturation:0,lightness:o};var l=r-s,c=o>.5?l/(2-r-s):l/(r+s);switch(r){case a:t=(n-i)/l+(n<i?6:0);break;case n:t=(i-a)/l+2;break;default:t=(a-n)/l+4}return t*=60,void 0!==e.alpha?{hue:t,saturation:c,lightness:o,alpha:e.alpha}:{hue:t,saturation:c,lightness:o}}(ie(e))}var se=function(e){return 7===e.length&&e[1]===e[2]&&e[3]===e[4]&&e[5]===e[6]?"#"+e[1]+e[3]+e[5]:e};function oe(e){var t=e.toString(16);return 1===t.length?"0"+t:t}function le(e){return oe(Math.round(255*e))}function ce(e,t,a){return se("#"+le(e)+le(t)+le(a))}function ue(e,t,a){return W(e,t,a,ce)}function de(e,t,a){if("number"==typeof e&&"number"==typeof t&&"number"==typeof a)return ue(e,t,a);if("object"==typeof e&&void 0===t&&void 0===a)return ue(e.hue,e.saturation,e.lightness);throw new f(1)}function pe(e,t,a,n){if("number"==typeof e&&"number"==typeof t&&"number"==typeof a&&"number"==typeof n)return n>=1?ue(e,t,a):"rgba("+W(e,t,a)+","+n+")";if("object"==typeof e&&void 0===t&&void 0===a&&void 0===n)return e.alpha>=1?ue(e.hue,e.saturation,e.lightness):"rgba("+W(e.hue,e.saturation,e.lightness)+","+e.alpha+")";throw new f(2)}function me(e,t,a){if("number"==typeof e&&"number"==typeof t&&"number"==typeof a)return se("#"+oe(e)+oe(t)+oe(a));if("object"==typeof e&&void 0===t&&void 0===a)return se("#"+oe(e.red)+oe(e.green)+oe(e.blue));throw new f(6)}function be(e,t,a,n){if("string"==typeof e&&"number"==typeof t){var i=ie(e);return"rgba("+i.red+","+i.green+","+i.blue+","+t+")"}if("number"==typeof e&&"number"==typeof t&&"number"==typeof a&&"number"==typeof n)return n>=1?me(e,t,a):"rgba("+e+","+t+","+a+","+n+")";if("object"==typeof e&&void 0===t&&void 0===a&&void 0===n)return e.alpha>=1?me(e.red,e.green,e.blue):"rgba("+e.red+","+e.green+","+e.blue+","+e.alpha+")";throw new f(7)}var ge=function(e){return"number"==typeof e.red&&"number"==typeof e.green&&"number"==typeof e.blue&&("number"!=typeof e.alpha||void 0===e.alpha)},fe=function(e){return"number"==typeof e.red&&"number"==typeof e.green&&"number"==typeof e.blue&&"number"==typeof e.alpha},ye=function(e){return"number"==typeof e.hue&&"number"==typeof e.saturation&&"number"==typeof e.lightness&&("number"!=typeof e.alpha||void 0===e.alpha)},he=function(e){return"number"==typeof e.hue&&"number"==typeof e.saturation&&"number"==typeof e.lightness&&"number"==typeof e.alpha};function ve(e){if("object"!=typeof e)throw new f(8);if(fe(e))return be(e);if(ge(e))return me(e);if(he(e))return pe(e);if(ye(e))return de(e);throw new f(8)}function Ee(e,t,a){return function(){var n=a.concat(Array.prototype.slice.call(arguments));return n.length>=t?e.apply(this,n):Ee(e,t,n)}}function xe(e){return Ee(e,e.length,[])}function je(e,t){if("transparent"===t)return t;var a=re(t);return ve(c.default({},a,{hue:a.hue+parseFloat(e)}))}var Se=xe(je);function ke(e,t,a){return Math.max(e,Math.min(t,a))}function Oe(e,t){if("transparent"===t)return t;var a=re(t);return ve(c.default({},a,{lightness:ke(0,1,a.lightness-parseFloat(e))}))}var we=xe(Oe);function Te(e,t){if("transparent"===t)return t;var a=re(t);return ve(c.default({},a,{saturation:ke(0,1,a.saturation-parseFloat(e))}))}var Ie=xe(Te);function Ce(e){if("transparent"===e)return 0;var t=ie(e),a=Object.keys(t).map((function(e){var a=t[e]/255;return a<=.03928?a/12.92:Math.pow((a+.055)/1.055,2.4)})),n=a[0],i=a[1],r=a[2];return parseFloat((.2126*n+.7152*i+.0722*r).toFixed(3))}function Me(e,t){var a=Ce(e),n=Ce(t);return parseFloat((a>n?(a+.05)/(n+.05):(n+.05)/(a+.05)).toFixed(2))}function _e(e,t){if("transparent"===t)return t;var a=re(t);return ve(c.default({},a,{lightness:ke(0,1,a.lightness+parseFloat(e))}))}var Fe=xe(_e);function Ae(e,t,a){if("transparent"===t)return a;if("transparent"===a)return t;if(0===e)return a;var n=ie(t),i=c.default({},n,{alpha:"number"==typeof n.alpha?n.alpha:1}),r=ie(a),s=c.default({},r,{alpha:"number"==typeof r.alpha?r.alpha:1}),o=i.alpha-s.alpha,l=2*parseFloat(e)-1,u=((l*o==-1?l:l+o)/(1+l*o)+1)/2,d=1-u;return be({red:Math.floor(i.red*u+s.red*d),green:Math.floor(i.green*u+s.green*d),blue:Math.floor(i.blue*u+s.blue*d),alpha:i.alpha*(parseFloat(e)/1)+s.alpha*(1-parseFloat(e)/1)})}var De=xe(Ae);function Ne(e,t){if("transparent"===t)return t;var a=ie(t),n="number"==typeof a.alpha?a.alpha:1;return be(c.default({},a,{alpha:ke(0,1,(100*n+100*parseFloat(e))/100)}))}var Pe=xe(Ne),Re="#000",Le="#fff";function Be(e,t){if("transparent"===t)return t;var a=re(t);return ve(c.default({},a,{saturation:ke(0,1,a.saturation+parseFloat(e))}))}var qe=xe(Be);function ze(e,t){return"transparent"===t?t:ve(c.default({},re(t),{hue:parseFloat(e)}))}var $e=xe(ze);function Ve(e,t){return"transparent"===t?t:ve(c.default({},re(t),{lightness:parseFloat(e)}))}var Ue=xe(Ve);function He(e,t){return"transparent"===t?t:ve(c.default({},re(t),{saturation:parseFloat(e)}))}var Ge=xe(He);function Qe(e,t){return"transparent"===t?t:De(parseFloat(e),"rgb(0, 0, 0)",t)}var We=xe(Qe);function Ke(e,t){return"transparent"===t?t:De(parseFloat(e),"rgb(255, 255, 255)",t)}var Ye=xe(Ke);function Je(e,t){if("transparent"===t)return t;var a=ie(t),n="number"==typeof a.alpha?a.alpha:1;return be(c.default({},a,{alpha:ke(0,1,+(100*n-100*parseFloat(e)).toFixed(2)/100)}))}var Xe=xe(Je),Ze=["top","right","bottom","left"];function et(e,t){return e(t?":"+t:"")}function tt(e,t,a){if(!t)throw new f(67);if(0===e.length)return et(t,null);for(var n=[],i=0;i<e.length;i+=1){if(a&&a.indexOf(e[i])<0)throw new f(68);n.push(et(t,e[i]))}return n.join(",")}var at=[void 0,null,"active","focus","hover"];function nt(e){return"button"+e+',\n  input[type="button"]'+e+',\n  input[type="reset"]'+e+',\n  input[type="submit"]'+e}var it=["absolute","fixed","relative","static","sticky"],rt=[void 0,null,"active","focus","hover"];function st(e){return'input[type="color"]'+e+',\n    input[type="date"]'+e+',\n    input[type="datetime"]'+e+',\n    input[type="datetime-local"]'+e+',\n    input[type="email"]'+e+',\n    input[type="month"]'+e+',\n    input[type="number"]'+e+',\n    input[type="password"]'+e+',\n    input[type="search"]'+e+',\n    input[type="tel"]'+e+',\n    input[type="text"]'+e+',\n    input[type="time"]'+e+',\n    input[type="url"]'+e+',\n    input[type="week"]'+e+",\n    input:not([type])"+e+",\n    textarea"+e}t.adjustHue=Se,t.animation=function(){for(var e=arguments.length,t=new Array(e),a=0;a<e;a++)t[a]=arguments[a];var n=Array.isArray(t[0]);if(!n&&t.length>8)throw new f(64);return{animation:t.map((function(e){if(n&&!Array.isArray(e)||!n&&Array.isArray(e))throw new f(65);if(Array.isArray(e)&&e.length>8)throw new f(66);return Array.isArray(e)?e.join(" "):e})).join(", ")}},t.backgroundImages=function(){for(var e=arguments.length,t=new Array(e),a=0;a<e;a++)t[a]=arguments[a];return{backgroundImage:t.join(", ")}},t.backgrounds=function(){for(var e=arguments.length,t=new Array(e),a=0;a<e;a++)t[a]=arguments[a];return{background:t.join(", ")}},t.between=D,t.border=function(e){for(var t=arguments.length,a=new Array(t>1?t-1:0),n=1;n<t;n++)a[n-1]=arguments[n];var i;return"string"==typeof e&&Ze.indexOf(e)>=0?((i={})["border"+x(e)+"Width"]=a[0],i["border"+x(e)+"Style"]=a[1],i["border"+x(e)+"Color"]=a[2],i):(a.unshift(e),{borderWidth:a[0],borderStyle:a[1],borderColor:a[2]})},t.borderColor=function(){for(var e=arguments.length,t=new Array(e),a=0;a<e;a++)t[a]=arguments[a];return k.apply(void 0,["borderColor"].concat(t))},t.borderRadius=function(e,t){var a,n,i=x(e);if(!t&&0!==t)throw new f(62);if("Top"===i||"Bottom"===i)return(a={})["border"+i+"RightRadius"]=t,a["border"+i+"LeftRadius"]=t,a;if("Left"===i||"Right"===i)return(n={})["borderTop"+i+"Radius"]=t,n["borderBottom"+i+"Radius"]=t,n;throw new f(63)},t.borderStyle=function(){for(var e=arguments.length,t=new Array(e),a=0;a<e;a++)t[a]=arguments[a];return k.apply(void 0,["borderStyle"].concat(t))},t.borderWidth=function(){for(var e=arguments.length,t=new Array(e),a=0;a<e;a++)t[a]=arguments[a];return k.apply(void 0,["borderWidth"].concat(t))},t.buttons=function(){for(var e=arguments.length,t=new Array(e),a=0;a<e;a++)t[a]=arguments[a];return tt(t,nt,at)},t.clearFix=function(e){var t;return void 0===e&&(e="&"),(t={})[e+"::after"]={clear:"both",content:'""',display:"table"},t},t.complement=function(e){if("transparent"===e)return e;var t=re(e);return ve(c.default({},t,{hue:(t.hue+180)%360}))},t.cover=function(e){return void 0===e&&(e=0),{position:"absolute",top:e,right:e,bottom:e,left:e}},t.cssVar=function(e,t){if(!e||!e.match(E)){if(t)return e;throw new f(73)}var a;if("undefined"!=typeof document&&null!==document.documentElement&&(a=getComputedStyle(document.documentElement).getPropertyValue(e)),a)return a.trim();throw new f(74)},t.darken=we,t.desaturate=Ie,t.directionalProperty=k,t.ellipsis=function(e){return void 0===e&&(e="100%"),{display:"inline-block",maxWidth:e,overflow:"hidden",textOverflow:"ellipsis",whiteSpace:"nowrap",wordWrap:"normal"}},t.em=C,t.fluidRange=function(e,t,a){if(void 0===t&&(t="320px"),void 0===a&&(a="1200px"),!Array.isArray(e)&&"object"!=typeof e||null===e)throw new f(49);if(Array.isArray(e)){for(var n,i={},r={},s=function(e,t){var a="undefined"!=typeof Symbol&&e[Symbol.iterator]||e["@@iterator"];if(a)return(a=a.call(e)).next.bind(a);if(Array.isArray(e)||(a=function(e,t){if(e){if("string"==typeof e)return N(e,t);var a=Object.prototype.toString.call(e).slice(8,-1);return"Object"===a&&e.constructor&&(a=e.constructor.name),"Map"===a||"Set"===a?Array.from(e):"Arguments"===a||/^(?:Ui|I)nt(?:8|16|32)(?:Clamped)?Array$/.test(a)?N(e,t):void 0}}(e))||t&&e&&"number"==typeof e.length){a&&(e=a);var n=0;return function(){return n>=e.length?{done:!0}:{done:!1,value:e[n++]}}}throw new TypeError("Invalid attempt to iterate non-iterable instance.\nIn order to be iterable, non-array objects must have a [Symbol.iterator]() method.")}(e);!(n=s()).done;){var o,l,u=n.value;if(!u.prop||!u.fromSize||!u.toSize)throw new f(50);r[u.prop]=u.fromSize,i["@media (min-width: "+t+")"]=c.default({},i["@media (min-width: "+t+")"],((o={})[u.prop]=D(u.fromSize,u.toSize,t,a),o)),i["@media (min-width: "+a+")"]=c.default({},i["@media (min-width: "+a+")"],((l={})[u.prop]=u.toSize,l))}return c.default({},r,i)}var d,p,m;if(!e.prop||!e.fromSize||!e.toSize)throw new f(51);return(m={})[e.prop]=e.fromSize,m["@media (min-width: "+t+")"]=((d={})[e.prop]=D(e.fromSize,e.toSize,t,a),d),m["@media (min-width: "+a+")"]=((p={})[e.prop]=e.toSize,p),m},t.fontFace=function(e){var t=e.fontFamily,a=e.fontFilePath,n=e.fontStretch,i=e.fontStyle,r=e.fontVariant,s=e.fontWeight,o=e.fileFormats,l=void 0===o?["eot","woff2","woff","ttf","svg"]:o,c=e.formatHint,u=void 0!==c&&c,d=e.localFonts,p=e.unicodeRange,m=e.fontDisplay,b=e.fontVariationSettings,g=e.fontFeatureSettings;if(!t)throw new f(55);if(!a&&!d)throw new f(52);if(d&&!Array.isArray(d))throw new f(53);if(!Array.isArray(l))throw new f(54);var y={"@font-face":{fontFamily:t,src:z(a,d,l,u),unicodeRange:p,fontStretch:n,fontStyle:i,fontVariant:r,fontWeight:s,fontDisplay:m,fontVariationSettings:b,fontFeatureSettings:g}};return JSON.parse(JSON.stringify(y))},t.getContrast=Me,t.getLuminance=Ce,t.getValueAndUnit=_,t.grayscale=function(e){return"transparent"===e?e:ve(c.default({},re(e),{saturation:0}))},t.hiDPI=$,t.hideText=function(){return{textIndent:"101%",overflow:"hidden",whiteSpace:"nowrap"}},t.hideVisually=function(){return{border:"0",clip:"rect(0 0 0 0)",height:"1px",margin:"-1px",overflow:"hidden",padding:"0",position:"absolute",whiteSpace:"nowrap",width:"1px"}},t.hsl=de,t.hslToColorString=function(e){if("object"==typeof e&&"number"==typeof e.hue&&"number"==typeof e.saturation&&"number"==typeof e.lightness)return e.alpha&&"number"==typeof e.alpha?pe({hue:e.hue,saturation:e.saturation,lightness:e.lightness,alpha:e.alpha}):de({hue:e.hue,saturation:e.saturation,lightness:e.lightness});throw new f(45)},t.hsla=pe,t.invert=function(e){if("transparent"===e)return e;var t=ie(e);return ve(c.default({},t,{red:255-t.red,green:255-t.green,blue:255-t.blue}))},t.lighten=Fe,t.linearGradient=function(e){var t=e.colorStops,a=e.fallback,n=e.toDirection,i=void 0===n?"":n;if(!t||t.length<2)throw new f(56);return{backgroundColor:a||t[0].replace(/,\s+/g,",").split(" ")[0].replace(/,(?=\S)/g,", "),backgroundImage:V(P||(P=m.default(["linear-gradient(","",")"])),i,t.join(", ").replace(/,(?=\S)/g,", "))}},t.margin=function(){for(var e=arguments.length,t=new Array(e),a=0;a<e;a++)t[a]=arguments[a];return k.apply(void 0,["margin"].concat(t))},t.math=function(e,t){var a=v(e),n=a.match(y);if(n&&!n.every((function(e){return e===n[0]})))throw new f(41);return""+function(e,t){var a,n=function(e){var t={};return t.symbols=e?c.default({},g.symbols,e.symbols):c.default({},g.symbols),t}(t),i=[n.symbols["("].prefix],r=[],s=new RegExp("\\d+(?:\\.\\d+)?|"+Object.keys(n.symbols).map((function(e){return n.symbols[e]})).sort((function(e,t){return t.symbol.length-e.symbol.length})).map((function(e){return e.regSymbol})).join("|")+"|(\\S)","g");s.lastIndex=0;var o=!1;do{var l=(a=s.exec(e))||[")",void 0],u=l[0],d=l[1],p=n.symbols[u],m=p&&!p.prefix&&!p.func,b=!p||!p.postfix&&!p.infix;if(d||(o?b:m))throw new f(37,a?a.index:e.length,e);if(o){var y=p.postfix||p.infix;do{var v=i[i.length-1];if((y.precedence-v.precedence||v.rightToLeft)>0)break}while(h(i,r));o="postfix"===y.notation,")"!==y.symbol&&(i.push(y),o&&h(i,r))}else if(p){if(i.push(p.prefix||p.func),p.func&&(!(a=s.exec(e))||"("!==a[0]))throw new f(38,a?a.index:e.length,e)}else r.push(+u),o=!0}while(a&&i.length);if(i.length)throw new f(39,a?a.index:e.length,e);if(a)throw new f(40,a?a.index:e.length,e);return r.pop()}(v(a.replace(y,"")),t)+(n?v(n[0]):"")},t.meetsContrastGuidelines=function(e,t){var a=Me(e,t);return{AA:a>=4.5,AALarge:a>=3,AAA:a>=7,AAALarge:a>=4.5}},t.mix=De,t.modularScale=function(e,t,a){if(void 0===t&&(t="1em"),void 0===a&&(a=1.333),"number"!=typeof e)throw new f(42);if("string"==typeof a&&!F[a])throw new f(43);var n="string"==typeof t?_(t):[t,""],i=n[0],r=n[1],s="string"==typeof a?F[a]:a;if("string"==typeof i)throw new f(44,t);return""+i*Math.pow(s,e)+(r||"")},t.normalize=function(){var e;return[(e={html:{lineHeight:"1.15",textSizeAdjust:"100%"},body:{margin:"0"},main:{display:"block"},h1:{fontSize:"2em",margin:"0.67em 0"},hr:{boxSizing:"content-box",height:"0",overflow:"visible"},pre:{fontFamily:"monospace, monospace",fontSize:"1em"},a:{backgroundColor:"transparent"},"abbr[title]":{borderBottom:"none",textDecoration:"underline"}},e["b,\n    strong"]={fontWeight:"bolder"},e["code,\n    kbd,\n    samp"]={fontFamily:"monospace, monospace",fontSize:"1em"},e.small={fontSize:"80%"},e["sub,\n    sup"]={fontSize:"75%",lineHeight:"0",position:"relative",verticalAlign:"baseline"},e.sub={bottom:"-0.25em"},e.sup={top:"-0.5em"},e.img={borderStyle:"none"},e["button,\n    input,\n    optgroup,\n    select,\n    textarea"]={fontFamily:"inherit",fontSize:"100%",lineHeight:"1.15",margin:"0"},e["button,\n    input"]={overflow:"visible"},e["button,\n    select"]={textTransform:"none"},e['button,\n    html [type="button"],\n    [type="reset"],\n    [type="submit"]']={WebkitAppearance:"button"},e['button::-moz-focus-inner,\n    [type="button"]::-moz-focus-inner,\n    [type="reset"]::-moz-focus-inner,\n    [type="submit"]::-moz-focus-inner']={borderStyle:"none",padding:"0"},e['button:-moz-focusring,\n    [type="button"]:-moz-focusring,\n    [type="reset"]:-moz-focusring,\n    [type="submit"]:-moz-focusring']={outline:"1px dotted ButtonText"},e.fieldset={padding:"0.35em 0.625em 0.75em"},e.legend={boxSizing:"border-box",color:"inherit",display:"table",maxWidth:"100%",padding:"0",whiteSpace:"normal"},e.progress={verticalAlign:"baseline"},e.textarea={overflow:"auto"},e['[type="checkbox"],\n    [type="radio"]']={boxSizing:"border-box",padding:"0"},e['[type="number"]::-webkit-inner-spin-button,\n    [type="number"]::-webkit-outer-spin-button']={height:"auto"},e['[type="search"]']={WebkitAppearance:"textfield",outlineOffset:"-2px"},e['[type="search"]::-webkit-search-decoration']={WebkitAppearance:"none"},e["::-webkit-file-upload-button"]={WebkitAppearance:"button",font:"inherit"},e.details={display:"block"},e.summary={display:"list-item"},e.template={display:"none"},e["[hidden]"]={display:"none"},e),{"abbr[title]":{textDecoration:"underline dotted"}}]},t.opacify=Pe,t.padding=function(){for(var e=arguments.length,t=new Array(e),a=0;a<e;a++)t[a]=arguments[a];return k.apply(void 0,["padding"].concat(t))},t.parseToHsl=re,t.parseToRgb=ie,t.position=function(e){for(var t=arguments.length,a=new Array(t>1?t-1:0),n=1;n<t;n++)a[n-1]=arguments[n];return it.indexOf(e)>=0&&e?c.default({},k.apply(void 0,[""].concat(a)),{position:e}):k.apply(void 0,["",e].concat(a))},t.radialGradient=function(e){var t=e.colorStops,a=e.extent,n=void 0===a?"":a,i=e.fallback,r=e.position,s=void 0===r?"":r,o=e.shape,l=void 0===o?"":o;if(!t||t.length<2)throw new f(57);return{backgroundColor:i||t[0].split(" ")[0],backgroundImage:V(R||(R=m.default(["radial-gradient(","","","",")"])),s,l,n,t.join(", "))}},t.readableColor=function(e,t,a,n){void 0===t&&(t=Re),void 0===a&&(a=Le),void 0===n&&(n=!0);var i=Ce(e)>.179,r=i?t:a;return!n||Me(e,r)>=4.5?r:i?Re:Le},t.rem=A,t.retinaImage=function(e,t,a,n,i){var r;if(void 0===a&&(a="png"),void 0===i&&(i="_2x"),!e)throw new f(58);var s=a.replace(/^\./,""),o=n?n+"."+s:""+e+i+"."+s;return(r={backgroundImage:"url("+e+"."+s+")"})[$()]=c.default({backgroundImage:"url("+o+")"},t?{backgroundSize:t}:{}),r},t.rgb=me,t.rgbToColorString=function(e){if("object"==typeof e&&"number"==typeof e.red&&"number"==typeof e.green&&"number"==typeof e.blue)return"number"==typeof e.alpha?be({red:e.red,green:e.green,blue:e.blue,alpha:e.alpha}):me({red:e.red,green:e.green,blue:e.blue});throw new f(46)},t.rgba=be,t.saturate=qe,t.setHue=$e,t.setLightness=Ue,t.setSaturation=Ge,t.shade=We,t.size=function(e,t){return void 0===t&&(t=e),{height:e,width:t}},t.stripUnit=T,t.textInputs=function(){for(var e=arguments.length,t=new Array(e),a=0;a<e;a++)t[a]=arguments[a];return tt(t,st,rt)},t.timingFunctions=function(e){return U[e]},t.tint=Ye,t.toColorString=ve,t.transitions=function(){for(var e=arguments.length,t=new Array(e),a=0;a<e;a++)t[a]=arguments[a];if(Array.isArray(t[0])&&2===t.length){var n=t[1];if("string"!=typeof n)throw new f(61);return{transition:t[0].map((function(e){return e+" "+n})).join(", ")}}return{transition:t.join(", ")}},t.transparentize=Xe,t.triangle=function(e){var t=e.pointingDirection,a=e.height,n=e.width,i=e.foregroundColor,r=e.backgroundColor,s=void 0===r?"transparent":r,o=_(n),l=_(a);if(isNaN(l[0])||isNaN(o[0]))throw new f(60);return c.default({width:"0",height:"0",borderColor:s},function(e,t){switch(e){case"top":case"bottomRight":return{borderBottomColor:t};case"right":case"bottomLeft":return{borderLeftColor:t};case"bottom":case"topLeft":return{borderTopColor:t};case"left":case"topRight":return{borderRightColor:t};default:throw new f(59)}}(t,i),{borderStyle:"solid",borderWidth:H(t,l,o)})},t.wordWrap=function(e){return void 0===e&&(e="break-word"),{overflowWrap:e,wordWrap:e,wordBreak:"break-word"===e?"break-all":e}}},function(e,t,a){e.exports=a(33)(1654)},,,function(e,t,a){"use strict";a.d(t,"a",(function(){return E}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(40),l=a(44),c=a(41),u=a.n(c),d=a(105),p=a(142),m=a(133),b=a(111),g=a(345),f=a(199);const y=(e,t)=>(t===f.a.createCase||t===f.a.submitCase)&&e===f.b.alertsCases,h=u()(o.EuiTourStep).withConfig({displayName:"StyledTourStep",componentId:"sc-1l8wop5-0"})(["&.euiPopover__panel[data-popover-open]{z-index:",";}"],(({step:e,tourId:t})=>y(t,e)?"9000 !important":"1000 !important")),v=({children:e,onClick:t,step:a,tourId:n})=>{const{activeStep:c,incrementStep:u,isTourShown:v}=Object(g.b)(),E=Object(r.useMemo)((()=>f.e[n].find((e=>e.step===a))),[a,n]),x=Object(r.useMemo)((()=>b.b.getTimelineByIdSelector()),[]),j=Object(d.b)((e=>{var t;return(null!==(t=x(e,p.f.active))&&void 0!==t?t:m.b).show})),S=Object(r.useCallback)((()=>t?t():u(n)),[u,t,n]),k=Object(r.useCallback)((e=>{"Enter"===e.key&&e.stopPropagation()}),[]),O=y(n,a);if(null==E||(a!==c||!v(n))&&!O||j)return e||null;const{anchor:w,content:T,imageConfig:I,dataTestSubj:C,hideNextButton:M=!1,..._}=E,F=M?s.a.createElement(s.a.Fragment,null):s.a.createElement(o.EuiButtonEmpty,{onClick:S,onKeyDown:k,size:"xs",color:"text",flush:"right","data-test-subj":"onboarding--securityTourNextStepButton","tour-step":"nextButton"},s.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.guided_onboarding.nextStep.buttonLabel",defaultMessage:"Next"})),A={..._,content:s.a.createElement(s.a.Fragment,null,s.a.createElement(o.EuiText,{size:"s"},s.a.createElement("p",null,T)),I&&s.a.createElement(s.a.Fragment,null,s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(o.EuiImage,{alt:I.altText,src:I.src,size:"fullWidth"}))),footerAction:F,isStepOpen:!0,onFinish:()=>null,stepsTotal:f.e[n].length,panelProps:{"data-test-subj":C}};return null!=w?s.a.createElement(s.a.Fragment,null,s.a.createElement(h,i()({tourId:n},A,{anchor:w})),s.a.createElement(s.a.Fragment,null,e)):null!=e?s.a.createElement(h,i()({tourId:n},A),e):null},E=({children:e,isTourAnchor:t=!0,...a})=>t?s.a.createElement(v,a,e):s.a.createElement(s.a.Fragment,null,e)},function(e,t,a){const n=a(157);e.exports=(e,t,a=!1)=>{if(e instanceof n)return e;try{return new n(e,t)}catch(e){if(!a)return null;throw e}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return u})),a.d(t,"b",(function(){return d})),a.d(t,"c",(function(){return p}));var n=a(42),i=a(2),r=a(1038),s=a.n(r),o=a(57),l=a(76),c=a.n(l);const u=(e,t)=>{const a=null!=t?t:((e,t)=>{const a=t.diff(e,"days");return a<=1&&!e.isSame(t)?2:a})(c()(e[0]),c()(e[1])),n=Object(o.niceTimeFormatByDay)(a);return Object(o.timeFormatter)(n)},d=(e=100)=>{const[t,a]=Object(i.useState)({width:0,height:0}),r=Object(i.useMemo)((()=>Object(n.throttle)(e,a)),[e]),{ref:o}=s()({onResize:r});return{ref:o,...t}},p=(e,t,a,n)=>{Object(i.useEffect)((()=>{!async function(){const i=await(null==e?void 0:e.getVariation(t,a));i&&n(i)}()}),[e,t,a,n])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(40),i=a(5),r=a(44),s=a(2),o=a.n(s);const l=({count:e})=>{const[t,a,l]=Object(s.useMemo)((()=>function(e){var t;if(!Number.isFinite(e))return[e,"",""];const a=Math.pow(10,3*Math.min(Math.floor(Math.floor(Math.log10(e))/3),4)),n={compactThousands:i.i18n.translate("xpack.securitySolution.formattedNumber.compactThousands",{defaultMessage:"k"}),compactMillions:i.i18n.translate("xpack.securitySolution.formattedNumber.compactMillions",{defaultMessage:"M"}),compactBillions:i.i18n.translate("xpack.securitySolution.formattedNumber.compactBillions",{defaultMessage:"B"}),compactTrillions:i.i18n.translate("xpack.securitySolution.formattedNumber.compactTrillions",{defaultMessage:"T"})},r=new Map([[1,""],[1e3,n.compactThousands],[1e6,n.compactMillions],[1e9,n.compactBillions],[1e12,n.compactTrillions]]),s=i.i18n.translate("xpack.securitySolution.formattedNumber.compactOverflow",{defaultMessage:"+"}),o=null!==(t=r.get(a))&&void 0!==t?t:"";return[Math.floor(e/a),o,e/a%1>Number.EPSILON?s:""]}(e||0)),[e]);return null==e?null:0===e?o.a.createElement(o.a.Fragment,null,0):o.a.createElement(r.FormattedMessage,{id:"xpack.securitySolution.formattedNumber.countsLabel",description:"",defaultMessage:"{mantissa}{scale}{hasRemainder}",values:{mantissa:o.a.createElement(n.EuiI18nNumber,{value:t}),scale:a,hasRemainder:l}})},c=o.a.memo(l)},function(e,t,a){"use strict";a.d(t,"a",(function(){return R})),a.d(t,"b",(function(){return L})),a.d(t,"c",(function(){return B})),a.d(t,"d",(function(){return q}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(5),l=a(40),c=a(44),u=a(41),d=a.n(u),p=a(53),m=a.n(p),b=a(107);const g=d()(l.EuiPanel).withConfig({displayName:"EuiPanelStyled",componentId:"sc-n74boe-0"})(["&.full-height,.full-height{height:100%;}.is-not-scrollable{overflow:hidden;}.is-scrollable{overflow:auto;}"]),f=Object(r.memo)((({pageTitle:e,pageDescription:t,pageBody:a,actions:n,headerHasBottomBorder:i,restrictWidth:o,paddingSize:c="l",scrollableBody:u=!1,headerBackComponent:d,children:p,"data-test-subj":f})=>{const y=!(e||t||n||d),h=Object(b.a)(f),v=Object(r.useMemo)((()=>Array.isArray(n)?n:n?[n]:void 0),[n]),E=Object(r.useMemo)((()=>({gutterSize:"s"})),[]),x=Object(r.useMemo)((()=>m()({"is-scrollable":u,"is-not-scrollable":!u,"full-height":!0})),[u]),j=Object(r.useMemo)((()=>y?null:s.a.createElement(l.EuiFlexGroup,{direction:"column",gutterSize:"none",alignItems:"flexStart",wrap:!1,responsive:!1},d&&s.a.createElement(l.EuiFlexItem,{grow:!1},d),s.a.createElement(l.EuiSpacer,{size:"m"}),s.a.createElement(l.EuiFlexItem,{grow:!1},s.a.createElement(l.EuiTitle,{size:"l"},s.a.createElement("span",{"data-test-subj":h("titleHolder")},e))))),[h,d,y,e]);return s.a.createElement(g,{hasShadow:!1,paddingSize:c,"data-test-subj":f,className:"full-height",color:"transparent"},s.a.createElement(l.EuiFlexGroup,{direction:"column",responsive:!1,gutterSize:"none",className:"full-height","data-test-subj":h("root")},!y&&s.a.createElement(l.EuiFlexItem,{grow:!1,"data-test-subj":h("headerContainer")},s.a.createElement(l.EuiPageHeader,{pageTitle:j,description:t,bottomBorder:i,rightSideItems:v,rightSideGroupProps:E,restrictWidth:o,alignItems:"bottom","data-test-subj":h("header")}),s.a.createElement(l.EuiSpacer,{size:"l"})),s.a.createElement(l.EuiFlexItem,{grow:!1},a),s.a.createElement(l.EuiFlexItem,{grow:!0,className:x,"data-test-subj":h("consoleBody")},s.a.createElement("div",{role:"main",className:"full-height"},p))))}));f.displayName="PageLayout";var y=a(45),h=a(141),v=a(178),E=a(168);const x=d.a.div.withConfig({displayName:"OverlayRootContainer",componentId:"sc-vostrz-0"})(["border:none;display:block;position:fixed;overflow:hidden;top:calc(("," * 2));bottom:0;right:0;height:calc(100% - "," * 2);width:100%;z-index:",";background-color:",";&.scrolling{overflow:auto;}&.hidden{display:none;}&.padding-xs{padding:",";}&.padding-s{padding:",";}&.padding-m{padding:",";}&.padding-l{padding:",";}&.padding-xl{padding:",";}&.fullScreen{top:0;height:100%;}.fullHeight{height:100%;}"],(({theme:{eui:e}})=>e.euiHeaderHeightCompensation),(({theme:{eui:e}})=>e.euiHeaderHeightCompensation),(({theme:{eui:e}})=>e.euiZFlyout),(({theme:{eui:e}})=>e.euiColorEmptyShade),(({theme:{eui:e}})=>e.euiSizeXS),(({theme:{eui:e}})=>e.euiSizeS),(({theme:{eui:e}})=>e.euiSizeM),(({theme:{eui:e}})=>e.euiSizeL),(({theme:{eui:e}})=>e.euiSizeXL)),j="securitySolution-pageOverlay",S=`${j}-isVisible`,k=`${j}-lock`,O=`${j}-fullScreen`,w=`${j}-overSecuritySolutionPageWrapper`,T=Object(u.createGlobalStyle)(["body.","{overflow:hidden;}body.","{","}body.kbnBody.kbnBody--projectLayout:not(.",") .","{top:",";height:calc(100% - (","));}"],k,O,E.e,O,j,(({theme:{eui:e}})=>e.euiHeaderHeightCompensation),(({theme:{eui:e}})=>e.euiHeaderHeightCompensation)),I=()=>{document.body.classList.remove(S)},C=()=>{document.body.classList.remove(k)},M=()=>{document.body.classList.remove(O)},_=()=>{document.body.classList.remove(w)},F=Object(r.memo)((({children:e,onHide:t,isHidden:a=!1,enableScrolling:n=!0,hideOnUrlPathnameChange:i=!0,lockDocumentBody:o=!0,appendAsBodyLastNode:c=!0,paddingSize:u,zIndex:d,"data-test-subj":p})=>{const{pathname:b}=Object(y.useLocation)(),g=Object(h.b)(),f=Object(v.b)(),[E,F]=Object(r.useState)(null),A=Object(r.useRef)(),D=Object(r.useCallback)((e=>{A.current=e}),[]),N=Object(r.useMemo)((()=>{const e={};return d&&(e.zIndex=d),e}),[d]),P=Object(r.useMemo)((()=>m()({[j]:!0,scrolling:n,hidden:a,fullScreen:f,"eui-scrollBar":n,"padding-xs":"xs"===u,"padding-s":"s"===u,"padding-m":"m"===u,"padding-l":"l"===u,"padding-xl":"xl"===u})),[n,a,u,f]);return Object(r.useEffect)((()=>{g()&&F((e=>a?null:e||(c&&A.current&&document.body.appendChild(A.current),b)))}),[c,a,g,b]),Object(r.useEffect)((()=>{g()&&t&&i&&!a&&E&&E!==b&&t()}),[i,a,g,t,E,b]),Object(r.useEffect)((()=>{if(g()){const e=Boolean(document.querySelector(".securitySolutionWrapper"));a?(I(),C(),M(),_()):(document.body.classList.add(S),o&&document.body.classList.add(k),f&&document.body.classList.add(O),e&&document.body.classList.add(w))}return()=>{C(),I(),M(),_()}}),[a,g,o,f]),s.a.createElement(l.EuiPortal,{portalRef:D},s.a.createElement(x,{"data-test-subj":p,className:P,style:N},s.a.createElement(l.EuiFocusTrap,{"data-test-subj":"trap-focus",className:"fullHeight"},e)),s.a.createElement(T,null))}));F.displayName="PageOverlay";const A=o.i18n.translate("xpack.securitySolution.consolePageOverlay.backButtonLabel",{defaultMessage:"Back"}),D=Object(r.memo)((({console:e,onHide:t,isHidden:a,body:n,actions:i,pageTitle:o="",showCloseButton:u=!1})=>{const d=Object(b.a)("consolePageOverlay"),p=Object(r.useCallback)((e=>{e.preventDefault(),t()}),[t]),m=Object(r.useMemo)((()=>a?{}:{pageTitle:o,pageBody:n,headerHasBottomBorder:!1,"data-test-subj":d("layout"),headerBackComponent:s.a.createElement(l.EuiButtonEmpty,{flush:"left",size:"s",iconType:"arrowLeft",onClick:p,"data-test-subj":d("header-back-link")},A),actions:u?[s.a.createElement(l.EuiButton,{fill:!0,onClick:p,minWidth:"auto","data-test-subj":d("doneButton")},s.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.consolePageOverlay.doneButtonLabel",defaultMessage:"Done"})),...null!=i?i:[]]:[...null!=i?i:[]]}),[i,n,d,p,a,o,u]);return s.a.createElement(F,{isHidden:a,"data-test-subj":"consolePageOverlay",onHide:t,paddingSize:"l",enableScrolling:!1},s.a.createElement(f,m,e))}));D.displayName="ConsolePageOverlay";var N=a(865);const P=s.a.createContext(void 0),R=Object(r.memo)((({storage:e={},children:t})=>{const[a,n]=Object(r.useState)(e),[o]=Object(r.useState)(new Map),l=Object(r.useRef)();l.current=a;const c=Object(r.useCallback)((e=>{var t;if(null===(t=l.current)||void 0===t||!t[e])throw new Error(`Console with id ${e} not found`)}),[]),u=Object(r.useCallback)((e=>{c(e),n((t=>{const a={...t};return Object.entries(a).forEach((([e,t])=>{t.isOpen&&(a[e]={...t,isOpen:!1})})),a[e]={...a[e],isOpen:!0},a}))}),[c]),d=Object(r.useCallback)((e=>{c(e),n((t=>({...t,[e]:{...t[e],isOpen:!1}})))}),[c]),p=Object(r.useCallback)((e=>{c(e),n((t=>{const a={...t};return delete a[e],a}))}),[c]),m=Object(r.useCallback)((e=>{var t;if(null!==(t=l.current)&&void 0!==t&&t[e])return l.current[e].client}),[]),b=Object(r.useCallback)((()=>Object.values(a).map((e=>e.client))),[a]),g=Object(r.useCallback)((e=>{var t;return!(null===(t=l.current)||void 0===t||!t[e])&&l.current[e].isOpen}),[]),f=Object(r.useCallback)((({id:e,meta:t,consoleProps:r,...o})=>{if(a[e])throw new Error(`Console with id ${e} already registered`);const l=Symbol(e),c=u.bind(null,e),m=d.bind(null,e),b=p.bind(null,e),f=g.bind(null,e),y={PageBodyComponent:void 0,PageTitleComponent:void 0,ActionComponents:void 0,...o,client:{id:e,meta:t,show:()=>{setTimeout(c,0)},hide:()=>{setTimeout(m,0)},terminate:()=>{setTimeout(b,0)},isVisible:()=>f()},consoleProps:r,console:s.a.createElement(N.a,i()({},r,{managedKey:l,key:e})),isOpen:!1,key:l};return n((t=>({...t,[e]:y}))),y.client}),[a,d,g,u,p]),y=Object(r.useMemo)((()=>({register:f,show:u,hide:d,terminate:p,getOne:m,getList:b})),[b,m,d,f,u,p]),h=Object(r.useMemo)((()=>({client:y,internal:{getManagedConsole:e=>Object.values(a).find((t=>t.key===e)),getManagedConsoleState:e=>o.get(e),storeManagedConsoleState(e,t){o.set(e,t)}}})),[y,o,a]),v=Object(r.useMemo)((()=>Object.values(a).find((e=>e.isOpen))),[a]),E=Object(r.useMemo)((()=>{var e;return null!==(e=null==v?void 0:v.client.meta)&&void 0!==e?e:{}}),[null==v?void 0:v.client.meta]),x=Object(r.useCallback)((()=>{v&&y.hide(v.client.id)}),[y,v]);return s.a.createElement(P.Provider,{value:h},t,v&&s.a.createElement(D,{onHide:x,console:s.a.createElement(N.a,i()({},v.consoleProps,{managedKey:v.key,key:v.client.id})),isHidden:!v,pageTitle:v.PageTitleComponent&&s.a.createElement(v.PageTitleComponent,{meta:E}),body:v.PageBodyComponent&&s.a.createElement(v.PageBodyComponent,{meta:E}),actions:v.ActionComponents&&v.ActionComponents.map((e=>s.a.createElement(e,{meta:E}))),showCloseButton:v.showCloseButton}))}));R.displayName="ConsoleManager";const L=()=>{const e=Object(r.useContext)(P);if(!e)throw new Error("ConsoleManagerContext not found");return e.client},B=e=>{const t=Object(r.useContext)(P);if(e&&t)return t.internal.getManagedConsole(e)},q=e=>{const t=Object(r.useContext)(P);return Object(r.useMemo)((()=>e&&t?[()=>t.internal.getManagedConsoleState(e),a=>{t.internal.getManagedConsole(e)&&t.internal.storeManagedConsoleState(e,a)}]:[void 0,void 0]),[t,e])}},,function(e,t,a){"use strict";a.d(t,"c",(function(){return m})),a.d(t,"i",(function(){return f})),a.d(t,"e",(function(){return y})),a.d(t,"g",(function(){return h})),a.d(t,"h",(function(){return v})),a.d(t,"f",(function(){return E})),a.d(t,"d",(function(){return x})),a.d(t,"b",(function(){return j})),a.d(t,"a",(function(){return S}));var n=a(57),i=a(40),r=a(2),s=a.n(r),o=a(41),l=a.n(o),c=a(4),u=a(102);const d="100%",p=l.a.div.withConfig({displayName:"WrappedByAutoSizerComponent",componentId:"sc-1gxuxf9-0"})([""," position:relative;&:hover{z-index:100;}"],(e=>`\n    height: ${null!=e.height?e.height:d};\n  `));p.displayName="WrappedByAutoSizer";const m=s.a.memo(p);let b;!function(e){e.BAR="bar",e.AREA="area",e.LINE="line"}(b||(b={}));const g={chartMargins:{left:0,right:0,top:4,bottom:0},chartPaddings:{left:0,right:0,top:0,bottom:0},scales:{barsPadding:.05}},f=()=>({baseTheme:Object(u.o)(c.B)?n.DARK_THEME:n.LIGHT_THEME,theme:g}),y={rotation:0,rendering:"canvas",showLegend:!1,showLegendExtra:!1,debug:!1,legendPosition:n.Position.Bottom},h=(e,t)=>{const a=e||t;return a?`${a}px`:d},v=(e,t)=>{const a=e||t;return a?`${a}px`:"100%"},E=e=>Array.isArray(e)&&e.every((e=>Array.isArray(e.value)&&e.value.every((({y:e})=>0===e)))),x=l.a.div.withConfig({displayName:"Wrapper",componentId:"sc-1gxuxf9-1"})(["position:relative;"]),j=l()(i.EuiFlexGroup).withConfig({displayName:"ChartWrapper",componentId:"sc-1gxuxf9-2"})(["z-index:0;"]),S=l()(i.EuiFlexGroup).withConfig({displayName:"BarChartWrapper",componentId:"sc-1gxuxf9-3"})(["z-index:0;padding-right:20px;"])},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(50),i=a.n(n);const r=(e,t)=>"second"===t||"minute"===t||"hour"===t?{from:i()(e.time).subtract(1,"hour").toISOString(),to:i()(e.time).add(1,"hour").toISOString()}:{from:i()(e.time).subtract(1,"day").toISOString(),to:i()(e.time).add(1,"day").toISOString()}},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a(109),r=a(108),s=a(239),o=a(375),l=a(285);const c=()=>{const[e,t]=Object(n.useState)(!0),[a,c]=Object(n.useState)({signalIndexExists:null,signalIndexName:null,signalIndexMappingOutdated:null,createDeSignalIndex:null}),{addError:u}=Object(r.a)(),{hasIndexRead:d}=Object(l.a)();return Object(n.useEffect)((()=>{let e=!0;const a=new AbortController,n=async()=>{try{t(!0);const n=await Object(s.h)({signal:a.signal});e&&null!=n&&c({signalIndexExists:!0,signalIndexName:n.name,signalIndexMappingOutdated:n.index_mapping_outdated,createDeSignalIndex:r})}catch(t){e&&(c({signalIndexExists:!1,signalIndexName:null,signalIndexMappingOutdated:null,createDeSignalIndex:r}),Object(i.v)(t)&&404!==t.body.status_code&&u(t,{title:o.c}))}e&&t(!1)},r=async()=>{let l=!1;try{t(!0),await Object(s.d)({signal:a.signal}),e&&(l=!0,n())}catch(t){e&&(Object(i.v)(t)&&409===t.body.status_code?n():(c({signalIndexExists:!1,signalIndexName:null,signalIndexMappingOutdated:null,createDeSignalIndex:r}),u(t,{title:o.d})))}e&&!l&&t(!1)};return d?n():t(!1),()=>{e=!1,a.abort()}}),[u,d]),{loading:e,...a}}},function(e,t,a){e.exports=a(33)(2943)},function(e,t,a){"use strict";const n=a(762);e.exports=function(e,...t){if(!e){if(1===t.length&&t[0]instanceof Error)throw t[0];throw new n(t)}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(0),i=a.n(n),r=a(118);const s=new class ActiveTimelineEvents{constructor(){i()(this,"_activePage",0),i()(this,"_expandedDetail",{}),i()(this,"_pageName",""),i()(this,"_request",null),i()(this,"_response",null),i()(this,"_eqlRequest",null),i()(this,"_eqlResponse",null)}getActivePage(){return this._activePage}setActivePage(e){this._activePage=e}getExpandedDetail(){return this._expandedDetail}toggleExpandedDetail(e){const t=r.d.query,a=this._expandedDetail[t];let n;var i,s;if("eventDetail"===(null==a?void 0:a.panelView))n="eventDetail"===(null==e?void 0:e.panelView)&&(null==e||null===(i=e.params)||void 0===i?void 0:i.eventId)===(null==a||null===(s=a.params)||void 0===s?void 0:s.eventId);else if("hostDetail"===(null==a?void 0:a.panelView)){var o,l;n="hostDetail"===(null==e?void 0:e.panelView)&&(null==e||null===(o=e.params)||void 0===o?void 0:o.hostName)===(null==a||null===(l=a.params)||void 0===l?void 0:l.hostName)}else if("networkDetail"===(null==a?void 0:a.panelView)){var c,u;n="networkDetail"===(null==e?void 0:e.panelView)&&(null==e||null===(c=e.params)||void 0===c?void 0:c.ip)===(null==a||null===(u=a.params)||void 0===u?void 0:u.ip)}this._expandedDetail=n?{}:{[t]:{...e}}}setExpandedDetail(e){this._expandedDetail=e}getPageName(){return this._pageName}setPageName(e){this._pageName=e}getRequest(){return this._request}setRequest(e){this._request=e}getResponse(){return this._response}setResponse(e){this._response=e}getEqlRequest(){return this._eqlRequest}setEqlRequest(e){this._eqlRequest=e}getEqlResponse(){return this._eqlResponse}setEqlResponse(e){this._eqlResponse=e}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(2),i=a(159);const r=()=>{const{startTransaction:e}=Object(i.b)();return{startTracking:Object(n.useCallback)((({name:t,spanName:a="fetch"})=>{const n=e({name:t,type:"http-request",options:{managed:!1}}),i=null==n?void 0:n.startSpan(a,"http-request",{blocking:!0});return{endTracking:e=>{null==n||n.addLabels({result:e}),null==i||i.end()}}}),[e])}}},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"a",(function(){return s}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.containers.detectionEngine.rulesAndTimelines",{defaultMessage:"Failed to fetch Rules and Timelines"}),r=n.i18n.translate("xpack.securitySolution.containers.detectionEngine.ruleManagementFiltersFetchFailure",{defaultMessage:"Failed to fetch rule filters"}),s=n.i18n.translate("xpack.securitySolution.containers.detectionEngine.addRuleFailDescription",{defaultMessage:"Failed to add Rule"});n.i18n.translate("xpack.securitySolution.containers.detectionEngine.createPrePackagedRuleAndTimelineFailDescription",{defaultMessage:"Failed to installed pre-packaged rules and timelines from elastic"}),n.i18n.translate("xpack.securitySolution.containers.detectionEngine.createPrePackagedRuleAndTimelineSuccesDescription",{defaultMessage:"Installed pre-packaged rules and timeline templates from elastic"}),n.i18n.translate("xpack.securitySolution.containers.detectionEngine.createPrePackagedRuleSuccesDescription",{defaultMessage:"Installed pre-packaged rules from elastic"}),n.i18n.translate("xpack.securitySolution.containers.detectionEngine.createPrePackagedTimelineSuccesDescription",{defaultMessage:"Installed pre-packaged timeline templates from elastic"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"b",(function(){return i})),a.d(t,"d",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"f",(function(){return l})),a.d(t,"e",(function(){return u}));const n=e=>"string"!=typeof e,i=({allowSet:e,field:t})=>e.has(t),r=({allowSet:e,field:t})=>!e.has(t),s=({allowReplacementSet:e,field:t})=>e.has(t),o=({field:e,list:t,operation:a})=>"add"===a?t.includes(e)?t:[...t,e]:t.filter((t=>t!==e)),l=({field:e,operation:t,selectedPromptContext:a,update:n})=>{const{allow:i,allowReplacement:r}=a;switch(n){case"allow":return{...a,allow:o({field:e,list:i,operation:t})};case"allowReplacement":return{...a,allowReplacement:o({field:e,list:r,operation:t})};default:return a}},c=({currentList:e,setDefaultList:t,update:a,updates:n})=>{const i=n.filter((e=>e.update===a));i.length>0&&t(i.reduce(((e,{field:t,operation:a})=>o({field:t,list:e,operation:a})),e))},u=({defaultAllow:e,defaultAllowReplacement:t,setDefaultAllow:a,setDefaultAllowReplacement:n,updates:i})=>{c({currentList:e,setDefaultList:a,update:"defaultAllow",updates:i}),c({currentList:t,setDefaultList:n,update:"defaultAllowReplacement",updates:i})}},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(2),i=a(136),r=a(234),s=a(307);const o={id:r.a,messages:[],apiConfig:{},theme:{title:r.c,titleIcon:"logoSecurity",assistant:{name:r.b,icon:"logoSecurity"},system:{icon:"logoElastic"},user:{}}},l=()=>{const{allSystemPrompts:e,assistantTelemetry:t,setConversations:a}=Object(i.b)();return{appendMessage:Object(n.useCallback)((({conversationId:e,message:n})=>{null==t||t.reportAssistantMessageSent({conversationId:e,role:n.role});let i=[];return a((t=>{const a=t[e];if(null!=a){i=[...a.messages,n];const r={...a,messages:i};return{...t,[e]:r}}return t})),i}),[t,a]),appendReplacements:Object(n.useCallback)((({conversationId:e,replacements:t})=>{let n=t;return a((a=>{const i=a[e];if(null!=i){n={...i.replacements,...t};const r={...i,replacements:n};return{...a,[e]:r}}return a})),n}),[a]),clearConversation:Object(n.useCallback)((t=>{a((a=>{var n;const i=a[t],r=null===(n=Object(s.b)({allSystemPrompts:e,conversation:i}))||void 0===n?void 0:n.id;if(null!=i){const e={...i,apiConfig:{...i.apiConfig,defaultSystemPromptId:r},messages:[],replacements:void 0};return{...a,[t]:e}}return a}))}),[e,a]),createConversation:Object(n.useCallback)((({conversationId:t,messages:n})=>{var i;const r=null===(i=Object(s.b)({allSystemPrompts:e,conversation:void 0}))||void 0===i?void 0:i.id,l={...o,apiConfig:{...o.apiConfig,defaultSystemPromptId:r},id:t,messages:null!=n?n:[]};return a((e=>{if(null!=e[t])throw new Error("Conversation already exists!");return{...e,[t]:{...l}}})),l}),[e,a]),deleteConversation:Object(n.useCallback)((e=>{let t;return a((a=>{const{[e]:n,...i}=a;return t=n,null!=n?i:a})),t}),[a]),setApiConfig:Object(n.useCallback)((({conversationId:e,apiConfig:t})=>{a((a=>{const n=a[e];if(null!=n){const i={...n,apiConfig:t};return{...a,[e]:i}}return a}))}),[a]),setConversation:Object(n.useCallback)((({conversation:e})=>{a((t=>({...t,[e.id]:e})))}),[a])}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"b",(function(){return i}));const n=e=>{const t=[...e.matchAll(/```(\w+)?\s([\s\S]*?)```/g)],a={eql:["Event Query Language","EQL sequence query","EQL"],kql:["Kibana Query Language","KQL Query","KQL"],dsl:["Elasticsearch QueryDSL","Elasticsearch Query DSL","Elasticsearch DSL","Query DSL","DSL"]};return t.map((t=>{let n=t[1]||"no-type";if("no-type"===n||"json"===n){const i=t.index||0,r=e.slice(0,i);for(const[e,t]of Object.entries(a))if(t.some((e=>r.toLowerCase().includes(e.toLowerCase())))){n=e;break}}const i=t[2].trim(),r=t.index||0;return{type:n,content:i,start:r,end:r+t[0].length}}))},i=({allSystemPrompts:e,conversation:t})=>{var a;const n=e.find((e=>{var a;return e.id===(null==t||null===(a=t.apiConfig)||void 0===a?void 0:a.defaultSystemPromptId)})),i=e.find((e=>e.isNewConversationDefault));return null!==(a=null!=n?n:i)&&void 0!==a?a:null==e?void 0:e[0]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=function(e){return(e+1)%1e6};t.default=function(){return n.useReducer(i,0)[1]}},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(17),i=a(102),r=a(4);const s=()=>{var e,t,a,s,o;const l=Object(n.b)().isEnterprise(),c=Object(i.j)().services.application.capabilities,u=!0===(null===(e=c[r.m])||void 0===e?void 0:e["ai-assistant"]),d=!0===(null===(t=c.actions)||void 0===t?void 0:t.show)&&!0===(null===(a=c.actions)||void 0===a?void 0:a.execute);return{hasAssistantPrivilege:u,hasConnectorsAllPrivilege:d&&!0===(null===(s=c.actions)||void 0===s?void 0:s.delete)&&!0===(null===(o=c.actions)||void 0===o?void 0:o.save),hasConnectorsReadPrivilege:d,isAssistantEnabled:l}}},function(e,t,a){const{MAX_SAFE_COMPONENT_LENGTH:n,MAX_SAFE_BUILD_LENGTH:i,MAX_LENGTH:r}=a(326),s=a(325),o=(t=e.exports={}).re=[],l=t.safeRe=[],c=t.src=[],u=t.t={};let d=0;const p="[a-zA-Z0-9-]",m=[["\\s",1],["\\d",r],[p,i]],b=(e,t,a)=>{const n=(e=>{for(const[t,a]of m)e=e.split(`${t}*`).join(`${t}{0,${a}}`).split(`${t}+`).join(`${t}{1,${a}}`);return e})(t),i=d++;s(e,i,t),u[e]=i,c[i]=t,o[i]=new RegExp(t,a?"g":void 0),l[i]=new RegExp(n,a?"g":void 0)};b("NUMERICIDENTIFIER","0|[1-9]\\d*"),b("NUMERICIDENTIFIERLOOSE","\\d+"),b("NONNUMERICIDENTIFIER",`\\d*[a-zA-Z-]${p}*`),b("MAINVERSION",`(${c[u.NUMERICIDENTIFIER]})\\.(${c[u.NUMERICIDENTIFIER]})\\.(${c[u.NUMERICIDENTIFIER]})`),b("MAINVERSIONLOOSE",`(${c[u.NUMERICIDENTIFIERLOOSE]})\\.(${c[u.NUMERICIDENTIFIERLOOSE]})\\.(${c[u.NUMERICIDENTIFIERLOOSE]})`),b("PRERELEASEIDENTIFIER",`(?:${c[u.NUMERICIDENTIFIER]}|${c[u.NONNUMERICIDENTIFIER]})`),b("PRERELEASEIDENTIFIERLOOSE",`(?:${c[u.NUMERICIDENTIFIERLOOSE]}|${c[u.NONNUMERICIDENTIFIER]})`),b("PRERELEASE",`(?:-(${c[u.PRERELEASEIDENTIFIER]}(?:\\.${c[u.PRERELEASEIDENTIFIER]})*))`),b("PRERELEASELOOSE",`(?:-?(${c[u.PRERELEASEIDENTIFIERLOOSE]}(?:\\.${c[u.PRERELEASEIDENTIFIERLOOSE]})*))`),b("BUILDIDENTIFIER",`${p}+`),b("BUILD",`(?:\\+(${c[u.BUILDIDENTIFIER]}(?:\\.${c[u.BUILDIDENTIFIER]})*))`),b("FULLPLAIN",`v?${c[u.MAINVERSION]}${c[u.PRERELEASE]}?${c[u.BUILD]}?`),b("FULL",`^${c[u.FULLPLAIN]}$`),b("LOOSEPLAIN",`[v=\\s]*${c[u.MAINVERSIONLOOSE]}${c[u.PRERELEASELOOSE]}?${c[u.BUILD]}?`),b("LOOSE",`^${c[u.LOOSEPLAIN]}$`),b("GTLT","((?:<|>)?=?)"),b("XRANGEIDENTIFIERLOOSE",`${c[u.NUMERICIDENTIFIERLOOSE]}|x|X|\\*`),b("XRANGEIDENTIFIER",`${c[u.NUMERICIDENTIFIER]}|x|X|\\*`),b("XRANGEPLAIN",`[v=\\s]*(${c[u.XRANGEIDENTIFIER]})(?:\\.(${c[u.XRANGEIDENTIFIER]})(?:\\.(${c[u.XRANGEIDENTIFIER]})(?:${c[u.PRERELEASE]})?${c[u.BUILD]}?)?)?`),b("XRANGEPLAINLOOSE",`[v=\\s]*(${c[u.XRANGEIDENTIFIERLOOSE]})(?:\\.(${c[u.XRANGEIDENTIFIERLOOSE]})(?:\\.(${c[u.XRANGEIDENTIFIERLOOSE]})(?:${c[u.PRERELEASELOOSE]})?${c[u.BUILD]}?)?)?`),b("XRANGE",`^${c[u.GTLT]}\\s*${c[u.XRANGEPLAIN]}$`),b("XRANGELOOSE",`^${c[u.GTLT]}\\s*${c[u.XRANGEPLAINLOOSE]}$`),b("COERCE",`(^|[^\\d])(\\d{1,${n}})(?:\\.(\\d{1,${n}}))?(?:\\.(\\d{1,${n}}))?(?:$|[^\\d])`),b("COERCERTL",c[u.COERCE],!0),b("LONETILDE","(?:~>?)"),b("TILDETRIM",`(\\s*)${c[u.LONETILDE]}\\s+`,!0),t.tildeTrimReplace="$1~",b("TILDE",`^${c[u.LONETILDE]}${c[u.XRANGEPLAIN]}$`),b("TILDELOOSE",`^${c[u.LONETILDE]}${c[u.XRANGEPLAINLOOSE]}$`),b("LONECARET","(?:\\^)"),b("CARETTRIM",`(\\s*)${c[u.LONECARET]}\\s+`,!0),t.caretTrimReplace="$1^",b("CARET",`^${c[u.LONECARET]}${c[u.XRANGEPLAIN]}$`),b("CARETLOOSE",`^${c[u.LONECARET]}${c[u.XRANGEPLAINLOOSE]}$`),b("COMPARATORLOOSE",`^${c[u.GTLT]}\\s*(${c[u.LOOSEPLAIN]})$|^$`),b("COMPARATOR",`^${c[u.GTLT]}\\s*(${c[u.FULLPLAIN]})$|^$`),b("COMPARATORTRIM",`(\\s*)${c[u.GTLT]}\\s*(${c[u.LOOSEPLAIN]}|${c[u.XRANGEPLAIN]})`,!0),t.comparatorTrimReplace="$1$2$3",b("HYPHENRANGE",`^\\s*(${c[u.XRANGEPLAIN]})\\s+-\\s+(${c[u.XRANGEPLAIN]})\\s*$`),b("HYPHENRANGELOOSE",`^\\s*(${c[u.XRANGEPLAINLOOSE]})\\s+-\\s+(${c[u.XRANGEPLAINLOOSE]})\\s*$`),b("STAR","(<|>)?=?\\s*\\*"),b("GTE0","^\\s*>=\\s*0\\.0\\.0\\s*$"),b("GTE0PRE","^\\s*>=\\s*0\\.0\\.0-0\\s*$")},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(42);const l=s.a.div.withConfig({displayName:"StyledDiv",componentId:"sc-we8ln-0"})(["width:100%;display:flex;flex-grow:1;> *{max-width:100%;}",""],(({targetClassNames:e})=>Object(r.css)(["","{pointer-events:none;opacity:0;transition:opacity "," ease;}","{pointer-events:auto;opacity:1;}"],e.map((e=>`.${e}`)).join(", "),(e=>Object(o.getOr)(250,"theme.eui.euiAnimSpeedNormal",e)),e.map((e=>`&:hover .${e}`)).join(", ")))),c=i.a.memo((({show:e=!0,targetClassNames:t,children:a})=>e?i.a.createElement(l,{"data-test-subj":"hoverVisibilityContainer",targetClassNames:t},a):i.a.createElement(i.a.Fragment,null,a)));c.displayName="HoverVisibilityContainer"},function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return o})),a.d(t,"c",(function(){return l})),a.d(t,"d",(function(){return c})),a.d(t,"e",(function(){return u})),a.d(t,"f",(function(){return d})),a.d(t,"g",(function(){return p})),a.d(t,"h",(function(){return m}));var n=a(129),i=a(119),r=a(328);const s=e=>{const t="acknowledged"===e?{bool:{should:[{term:{[n.jb]:e}},{term:{[n.jb]:"in-progress"}}]}}:{term:{[n.jb]:e}};return[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:n.jb,params:{query:e}},query:t}]},o=e=>[{meta:{alias:null,negate:!1,disabled:!1},query:{bool:{should:e.map((e=>({term:{[n.jb]:e}})))}}}],l=e=>e?[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:n.K,params:{query:e}},query:{match_phrase:{[n.K]:e}}}]:[],c=e=>e?[]:[{meta:{alias:null,negate:!0,disabled:!1,type:"exists",key:n.b,value:"exists"},query:{exists:{field:n.b}}}],u=e=>e?[{meta:{alias:null,disabled:!1,negate:!1,key:"kibana.alert.rule.type",type:"term"},query:{term:{"kibana.alert.rule.type":"threat_match"}}}]:[],d=e=>({...i.q,columns:Object(r.b)(e),showCheckboxes:!0}),p=e=>({...d(e),columns:Object(r.b)(e),defaultColumns:Object(r.c)(e),sort:[{columnId:"kibana.alert.original_time",columnType:"date",esTypes:["date"],sortDirection:"desc"}],showCheckboxes:!1}),m=["@timestamp","kibana.alert.workflow_status","kibana.alert.workflow_tags","kibana.alert.group.id","kibana.alert.original_time","kibana.alert.building_block_type","kibana.alert.rule.from","kibana.alert.rule.name","kibana.alert.rule.to","kibana.alert.rule.uuid","kibana.alert.rule.rule_id","kibana.alert.rule.type","kibana.alert.suppression.docs_count","kibana.alert.original_event.kind","kibana.alert.original_event.module","file.path","file.Ext.code_signature.subject_name","file.Ext.code_signature.trusted","file.hash.sha256","host.os.family","event.code","process.entry_leader.entity_id"]},function(e,t,a){"use strict";a.d(t,"b",(function(){return y})),a.d(t,"a",(function(){return h})),a.d(t,"d",(function(){return v})),a.d(t,"c",(function(){return E}));var n=a(2),i=a.n(n),r=a(42),s=a(120),o=a(40),l=a(244),c=a(728),u=a(281),d=a(692),p=a(565);const m=e=>t=>""!==e.trim()?Object(u.d)(t,[{comment:e}]):t,b=e=>t=>""!==e.trim()?Object(u.f)(t,e):t,g=e=>t=>Object(u.e)(t,e),f=(e,t)=>a=>e===s.b.ENDPOINT?Object(u.l)(Object(u.c)(a,t)):a,y=({itemName:e,commentToAdd:t,addToRules:a,addToSharedLists:n,sharedLists:i,selectedOs:o,listType:l,expireTime:c,items:d})=>{const p=Object(r.pipe)(m(t),g(c),b(e),f(l,o),((e,t)=>a=>t&&e!==s.b.ENDPOINT?Object(u.g)(a):a)(l,a),((e,t,a)=>n=>t&&e!==s.b.ENDPOINT?Object(u.h)(n,a):n)(l,n,i))(d);return p},h=({itemName:e,commentToAdd:t,selectedOs:a,listType:n,expireTime:i,items:s})=>Object(r.pipe)(m(t),g(i),b(e),f(n,a))(s),v=()=>[{field:"name",name:p.c,sortable:!0,"data-test-subj":"exceptionListNameCell"},{field:"referenced_rules",name:"Number of rules linked to",sortable:!1,"data-test-subj":"exceptionListRulesLinkedToIdCell",render:e=>i.a.createElement(l.e,{emptyButton:!0,useCustomActions:!0,actions:Object(l.j)({dataTestSubj:"addToSharedListsLinkedRulesMenu",linkedRules:e,securityLinkAnchorComponent:d.f}),panelPaddingSize:"none",disableActions:!1,text:e.length.toString(),dataTestSubj:"addToSharedListsLinkedRulesMenuAction"})},{name:p.a,"data-test-subj":"exceptionListRulesActionCell",render:e=>i.a.createElement(d.e,{dataTestSubj:"exceptionListActionCell-link",linkTitle:p.e,listId:e.list_id,external:!0})}],E=()=>[{field:"name",align:"left",name:p.c,sortable:!0,"data-test-subj":"ruleNameCell",truncateText:!1},{field:"tags",align:"left",name:p.d,"data-test-subj":"ruleNameCell",render:e=>0===e.length?null:i.a.createElement(c.a,{items:e,popoverTitle:p.d,popoverButtonTitle:e.length.toString(),popoverButtonIcon:"tag",dataTestPrefix:"tags",renderItem:(e,t)=>i.a.createElement(o.EuiBadge,{color:"hollow",key:`${e}-${t}`,"data-test-subj":"tag"},e)})},{name:p.a,"data-test-subj":"ruleAction-view",render:e=>i.a.createElement(d.f,{external:!0,referenceId:e.id,referenceName:p.f})}]},function(e,t,a){"use strict";a.d(t,"b",(function(){return n})),a.d(t,"a",(function(){return i}));const n=10,i=0},function(e,t,a){"use strict";var n=a(369);e.exports=function(e){return n({},e)}},function(e,t,a){"use strict";a.d(t,"b",(function(){return S})),a.d(t,"a",(function(){return D})),a.d(t,"d",(function(){return _})),a.d(t,"c",(function(){return b}));var n=a(5);const i=n.i18n.translate("autocomplete.loadingDescription",{defaultMessage:"Loading..."}),r=n.i18n.translate("autocomplete.selectField",{defaultMessage:"Please select a field first..."}),s=n.i18n.translate("autocomplete.fieldRequiredError",{defaultMessage:"Value cannot be empty"}),o=n.i18n.translate("autocomplete.invalidNumberError",{defaultMessage:"Not a valid number"}),l=n.i18n.translate("autocomplete.invalidDateError",{defaultMessage:"Not a valid date"}),c=n.i18n.translate("autocomplete.invalidBinaryType",{defaultMessage:"Binary fields are currently unsupported"}),u=n.i18n.translate("autocomplete.fieldSpaceWarning",{defaultMessage:"Warning: Spaces at the start or end of this value aren't being displayed."}),d=(n.i18n.translate("autocomplete.listsTooltipWarning",{defaultMessage:"Lists that aren't able to be processed by this rule type will be disabled."}),n.i18n.translate("autocomplete.seeDocumentation",{defaultMessage:"See Documentation"}),n.i18n.translate("autocomplete.conflictIndicesWarning.title",{defaultMessage:"Mapping Conflict"})),p=n.i18n.translate("autocomplete.conflictIndicesWarning.description",{defaultMessage:"This field is defined as different types across the following indices or is unmapped. This can cause unexpected query results."}),m=(e,t)=>n.i18n.translate("autocomplete.conflictIndicesWarning.index.description",{defaultMessage:"{name} ({count} indices)",values:{count:t,name:e}});var b={LOADING:i,SELECT_FIELD_FIRST:r,FIELD_REQUIRED_ERR:s,NUMBER_ERR:o,DATE_ERR:l,FIELD_SPACE_WARNING:u,BINARY_TYPE_NOT_SUPPORTED:c},g=a(2),f=a.n(g),y=a(40),h=a(21),v=a(210);const E=({getLabel:e,options:t,selectedOptions:a,disabledOptions:n})=>{const i=t.map(e),r=null==n?void 0:n.map(e),s=i.map((e=>({label:e,disabled:r&&0!==r.length&&r.includes(e)}))),o=a.map(e).filter((e=>-1!==i.indexOf(e))).map((e=>s[i.indexOf(e)]));return{comboOptions:s,labels:i,selectedComboOptions:o}},x={binary:c},j={asPlainText:!0},S=({fieldInputWidth:e,fieldTypeFilter:t=[],indexPattern:a,isClearable:i=!1,isDisabled:r=!1,isLoading:s=!1,isRequired:o=!1,onChange:l,placeholder:c,selectedField:u,acceptsCustomOptions:b=!1,showMappingConflicts:S=!1})=>{const{isInvalid:k,comboOptions:O,selectedComboOptions:w,fieldWidth:T,renderFields:I,handleTouch:C,handleValuesChange:M,handleCreateCustomOption:_}=(({indexPattern:e,fieldTypeFilter:t,isRequired:a,selectedField:n,fieldInputWidth:i,showMappingConflicts:r,onChange:s})=>{const[o,l]=Object(g.useState)(!1),[c,u]=Object(g.useState)(null),b=Object(y.useEuiPaddingSize)("s"),{availableFields:j,selectedFields:S}=Object(g.useMemo)((()=>((e,t,a)=>{const n=(e=>null!=e?e.fields:[])(e),i=(e=>e&&""!==e.name.trim()?[e]:[])(t),r=((e,t,a)=>{const n=new Map;e.forEach((e=>n.set(e.name,e))),t.forEach((e=>n.set(e.name,e)));const i=Array.from(n.values());return a&&(null==a?void 0:a.length)>0?i.filter((({type:e})=>a.includes(e))):i})(n,i,a);return{availableFields:r,selectedFields:i}})(null!=c&&null!=e?{...e,fields:[c,...null==e?void 0:e.fields]}:e,n,t)),[e,t,n,c]),{comboOptions:k,labels:O,selectedComboOptions:w,disabledLabelTooltipTexts:T,mappingConflictsTooltipInfo:I}=Object(g.useMemo)((()=>(e=>{const{availableFields:t,selectedFields:a}=e,n=E({getLabel:e=>e.name,options:t,selectedOptions:a}),i=(e=>e.availableFields.reduce(((e,t)=>{var a;const n=null===(a=t.esTypes)||void 0===a?void 0:a.find((e=>x[e])),i=n&&x[n]||x[t.type];return i&&(e[t.name]=i),e}),{}))(e),r=(e=>e.availableFields.reduce(((e,t)=>{const a=Object(v.j)(t);return a?(e[t.name]=a,e):e}),{}))(e);return{...n,disabledLabelTooltipTexts:i,mappingConflictsTooltipInfo:r}})({availableFields:j,selectedFields:S})),[j,S]),C=Object(g.useCallback)((e=>{const t=e.map((({label:e})=>j[O.indexOf(e)]));s(t)}),[j,O,s]),M=Object(g.useCallback)((e=>{e.trim().toLowerCase()&&(u({name:e,type:"text"}),s([{name:e,type:"text"}]))}),[s]),_=Object(g.useCallback)((()=>{l(!0)}),[l]),F=Object(g.useMemo)((()=>i?{width:`${i}px`}:{}),[i]);return{isInvalid:Object(g.useMemo)((()=>!!a&&o&&null==n),[a,n,o]),comboOptions:k,selectedComboOptions:w,fieldWidth:F,renderFields:e=>{const{label:t}=e,a=T[t];if(a)return e.disabled=!0,Object(h.jsx)(y.EuiToolTip,{"data-test-subj":"disabledLabelWithTooltip",content:a,position:"bottom"},Object(h.jsx)(f.a.Fragment,null,t));const n=I[t];if(r&&n){const e=Object(h.jsx)(f.a.Fragment,null,p,n.map((e=>{const t=e.groupedIndices.map((({name:e,count:t})=>`${t>1?m(e,t):e}`));return Object(h.jsx)(f.a.Fragment,null,Object(h.jsx)(y.EuiSpacer,{size:"s"}),`${e.totalIndexCount>1?m(e.type,e.totalIndexCount):e.type}: ${t.join(", ")}`)})));return Object(h.jsx)(y.EuiToolTip,{"data-test-subj":"mappingConflictsTooltip",position:"bottom",content:e},Object(h.jsx)(f.a.Fragment,null,t,Object(h.jsx)(y.EuiIcon,{"data-test-subj":"mappingConflictsWarningIcon",tabIndex:0,type:"warning",title:d,size:"s",css:Object(h.css)({marginLeft:`${b}`},"","")})))}return t},handleTouch:_,handleValuesChange:C,handleCreateCustomOption:M}})({indexPattern:a,fieldTypeFilter:t,isRequired:o,selectedField:u,fieldInputWidth:e,showMappingConflicts:S,onChange:l});return b?Object(h.jsx)(y.EuiComboBox,{placeholder:c,options:O,selectedOptions:w,onChange:M,isLoading:s,isDisabled:r,isClearable:i,isInvalid:k,onFocus:C,singleSelection:j,"data-test-subj":"fieldAutocompleteComboBox",style:T,onCreateOption:_,customOptionText:n.i18n.translate("autocomplete.customOptionText",{defaultMessage:"Add {searchValuePlaceholder} as a custom field",values:{searchValuePlaceholder:"{searchValue}"}}),fullWidth:!0,renderOption:I}):Object(h.jsx)(y.EuiComboBox,{placeholder:c,options:O,selectedOptions:w,onChange:M,isLoading:s,isDisabled:r,isClearable:i,isInvalid:k,onFocus:C,singleSelection:j,"data-test-subj":"fieldAutocompleteComboBox",style:T,fullWidth:!0,renderOption:I})};S.displayName="Field";a(214),a(74);var k=a(8),O=a(120),w=a(49);const T=({selectedField:e,operatorType:t,fieldValue:a,query:n,indexPattern:i,autocompleteService:r})=>{const[s,o]=Object(g.useState)(!1),[l,c]=Object(g.useState)(!0),[u,d]=Object(g.useState)([]),p=Object(g.useRef)(null);return Object(g.useEffect)((()=>{let s=!0;const l=new AbortController,u=Object(k.debounce)((async({fieldSelected:e,patterns:t,searchQuery:a})=>{try{if(s){if(null==e||null==t)return;if("boolean"===e.type)return void c(!1);o(!0);const n=Object(w.getDataViewFieldSubtypeNested)(e),i=n?{...e,name:`${n.nested.path}.${e.name}`}:e,s=await r.getValueSuggestions({field:i,indexPattern:t,query:a,signal:l.signal,useTimeRange:!1});0===s.length&&c(!1),o(!1),d([...s])}}catch(e){s&&(d([]),o(!1))}}),500);return t!==O.d.EXISTS&&u({fieldSelected:e,patterns:i,searchQuery:n,value:a}),p.current=u,()=>{s=!1,l.abort()}}),[e,t,a,i,n,r]),[s,l,u,p.current]};var I=a(62),C=a.n(I);const M=(e,t,a,n)=>{if(null==t)return;const i=((e,t,a,n)=>a&&n&&(null==e||""===e.trim())?s:null==t||a&&!n||!(a||null!=e&&""!==e)?void 0:null)(e,t,a,n);if(null!==i)return i;switch(t.type){case"date":const t=C.a.parse(null!=e?e:"");return Boolean(t&&t.isValid())?void 0:l;case"number":return null==e||""===e.trim()||isNaN(+e)?o:void 0;default:return}},_=e=>e&&e.trim().length!==e.length,F=[{inputDisplay:"true",value:"true"},{inputDisplay:"false",value:"false"}],A={asPlainText:!0},D=({placeholder:e,rowLabel:t,selectedField:a,selectedValue:n,indexPattern:s,isLoading:o,isDisabled:l=!1,isClearable:c=!1,isRequired:d=!1,fieldInputWidth:p,autocompleteService:m,onChange:b,onError:f})=>{const[v,x]=Object(g.useState)(""),[j,S]=Object(g.useState)(!1),[w,I]=Object(g.useState)(void 0),[C,D]=Object(g.useState)(!1),[N,P,R]=T({autocompleteService:m,fieldValue:n,indexPattern:s,operatorType:O.d.MATCH,query:v,selectedField:a}),L=Object(g.useCallback)((e=>e),[]),B=Object(g.useMemo)((()=>{const e=String(n);return null!=n&&""!==n.trim()?Object(k.uniq)([e,...R]):R}),[R,n]),q=Object(g.useMemo)((()=>{const e=String(n);return n?[e]:[]}),[n]),z=Object(g.useCallback)((e=>{if(!e)return D(!1);D(!!_(e))}),[D]),$=Object(g.useCallback)((e=>{I((t=>{const a=null!=e;return null!=t!==a&&null!=f&&f(a),e}))}),[I,f]),{comboOptions:V,labels:U,selectedComboOptions:H}=Object(g.useMemo)((()=>E({getLabel:L,options:B,selectedOptions:q})),[B,q,L]),G=Object(g.useCallback)((e=>{const[t]=e.map((({label:e})=>B[U.indexOf(e)]));z(t),$(void 0),b(null!=t?t:"")}),[$,z,U,b,B]),Q=Object(g.useCallback)((e=>{if(""!==e&&null!=a){const t=M(e,a,d,j);$(t),t||z(e),x(e)}}),[$,z,d,a,j]),W=Object(g.useCallback)((e=>{const t=M(e,a,d,j);if($(t),null!=t)return D(!1),!1;z(e),b(e)}),[d,b,a,j,$,z]),K=Object(g.useCallback)((e=>{const t=e.target.value;b(t)}),[b]),Y=Object(g.useCallback)((e=>{b(e)}),[b]),J=Object(g.useCallback)((()=>{S(!0);const e=M(n,a,d,!0);$(e)}),[S,$,n,a,d]),X=Object(g.useMemo)((()=>o||N?i:null==a?r:e),[o,a,N,e]),Z=Object(g.useMemo)((()=>o||N),[o,N]);Object(g.useEffect)((()=>{I(void 0),null!=f&&f(!1),z(n)}),[null==a?void 0:a.name,null==a?void 0:a.type,n,z,f]);const ee=Object(g.useMemo)((()=>Object(h.jsx)(y.EuiFormRow,{label:t,error:w,isInvalid:null!=a&&null!=w,"data-test-subj":"valuesAutocompleteMatchLabel",fullWidth:!0,helpText:C&&u},Object(h.jsx)(y.EuiComboBox,{placeholder:X,isDisabled:l||!a,isLoading:Z,isClearable:c,options:V,selectedOptions:H,onChange:G,singleSelection:A,onSearchChange:Q,onCreateOption:W,isInvalid:null!=a&&null!=w,onBlur:J,sortMatchesBy:"startsWith","data-test-subj":"valuesAutocompleteMatch",style:p?{width:`${p}px`}:{},fullWidth:!0,async:!0}))),[V,w,p,X,c,l,Z,t,H,a,C,W,Q,G,J]);if(P||null==a)return ee;switch(a.type){case"number":return Object(h.jsx)(y.EuiFormRow,{label:t,error:w,isInvalid:null!=a&&null!=w,"data-test-subj":"valuesAutocompleteMatchLabel",fullWidth:!0},Object(h.jsx)(y.EuiFieldNumber,{placeholder:X,onBlur:J,value:"string"==typeof n&&n.trim().length>0?parseFloat(n):null!=n?n:"",onChange:K,"data-test-subj":"valueAutocompleteFieldMatchNumber",style:p?{width:`${p}px`}:{},fullWidth:!0}));case"boolean":return Object(h.jsx)(y.EuiFormRow,{label:t,error:w,isInvalid:null!=a&&null!=w,"data-test-subj":"valuesAutocompleteMatchLabel",fullWidth:!0},Object(h.jsx)(y.EuiSuperSelect,{isLoading:Z,options:F,valueOfSelected:null!=n?n:"true",onChange:Y,"data-test-subj":"valuesAutocompleteMatchBoolean",style:p?{width:`${p}px`}:{},fullWidth:!0}));default:return ee}};D.displayName="AutocompleteFieldMatch";const N={asPlainText:!0};Object(g.memo)((({autocompleteService:e,placeholder:t,rowLabel:a,selectedField:n,selectedValue:s,indexPattern:o,isLoading:l,isDisabled:c=!1,isClearable:d=!1,isRequired:p=!1,fieldInputWidth:m,onChange:b,onError:f,onWarning:v,warning:x})=>{const[j,S]=Object(g.useState)(""),[w,I]=Object(g.useState)(!1),[C,F]=Object(g.useState)(void 0),[A,D]=Object(g.useState)(!1),[P,,R]=T({autocompleteService:e,fieldValue:s,indexPattern:o,operatorType:O.d.WILDCARD,query:j,selectedField:n}),L=Object(g.useCallback)((e=>e),[]),B=Object(g.useMemo)((()=>{const e=String(s);return null!=s&&""!==s.trim()?Object(k.uniq)([e,...R]):R}),[R,s]),q=Object(g.useMemo)((()=>{const e=String(s);return s?[e]:[]}),[s]),z=Object(g.useCallback)((e=>{if(!e)return D(!1);D(!!_(e))}),[D]),$=Object(g.useCallback)((e=>{F((t=>{const a=null!=e;return null!=t!==a&&null!=f&&f(a),e}))}),[F,f]),V=Object(g.useCallback)((e=>{v(void 0!==e)}),[v]),{comboOptions:U,labels:H,selectedComboOptions:G}=Object(g.useMemo)((()=>E({getLabel:L,options:B,selectedOptions:q})),[B,q,L]),Q=Object(g.useCallback)((e=>{const[t]=e.map((({label:e})=>B[H.indexOf(e)]));$(void 0),z(t),D(!1),b(null!=t?t:"")}),[$,z,H,b,B]),W=Object(g.useCallback)((e=>{if(""!==e.trim()&&null!=n){const t=M(e,n,p,w);$(t),V(x),t||z(e),S(e)}}),[$,z,p,n,w,x,V]),K=Object(g.useCallback)((e=>{const t=M(e,n,p,w);if($(t),V(x),null!=t)return D(!1),!1;z(e),b(e)}),[p,z,b,n,w,$,V,x]),Y=Object(g.useCallback)((()=>{I(!0);const e=M(s,n,p,!0);$(e),V(x)}),[I,$,s,n,p,V,x]),J=Object(g.useMemo)((()=>l||P?i:null==n?r:t),[l,n,P,t]),X=Object(g.useMemo)((()=>l||P),[l,P]);return Object(g.useEffect)((()=>{F(void 0),null!=f&&f(!1),z(s),v(!1)}),[n,s,f,v,z]),Object(g.useMemo)((()=>Object(h.jsx)(y.EuiFormRow,{label:a,error:C,helpText:x||A&&u,isInvalid:null!=n&&null!=C,"data-test-subj":"valuesAutocompleteWildcardLabel",fullWidth:!0},Object(h.jsx)(y.EuiComboBox,{placeholder:J,isDisabled:c||!n,isLoading:X,isClearable:d,options:U,selectedOptions:G,onChange:Q,singleSelection:N,onSearchChange:W,onCreateOption:K,isInvalid:null!=n&&null!=C,onBlur:Y,sortMatchesBy:"startsWith","data-test-subj":"valuesAutocompleteWildcard",style:m?{width:`${m}px`}:{},fullWidth:!0,async:!0}))),[U,C,m,K,W,Q,J,d,c,X,a,G,n,Y,x,A])})).displayName="AutocompleteFieldWildcard"},function(e,t,a){"use strict";a.d(t,"a",(function(){return m})),a.d(t,"b",(function(){return h})),a.d(t,"c",(function(){return v})),a.d(t,"d",(function(){return E})),a.d(t,"e",(function(){return x}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r);const o=s.a.aside.attrs({className:"siemUtilityBar"}).withConfig({displayName:"Bar",componentId:"sc-yj1vvr-0"})(["",""],(({border:e,theme:t})=>Object(r.css)([""," @media only screen and (min-width:","){display:flex;justify-content:space-between;}"],e&&Object(r.css)(["border-bottom:",";padding-bottom:",";align-items:center;"],t.eui.euiBorderThin,t.eui.euiSizeXS),t.eui.euiBreakpoints.l)));o.displayName="Bar";const l=s.a.div.attrs({className:"siemUtilityBar__section"}).withConfig({displayName:"BarSection",componentId:"sc-yj1vvr-1"})(["",""],(({grow:e,theme:t})=>Object(r.css)(["& + &{margin-top:",";align-items:center;}@media only screen and (min-width:","){display:flex;flex-wrap:wrap;}@media only screen and (min-width:","){& + &{margin-top:0;margin-left:",";}}",""],t.eui.euiSizeS,t.eui.euiBreakpoints.m,t.eui.euiBreakpoints.l,t.eui.euiSize,e&&Object(r.css)(["flex:1;"]))));l.displayName="BarSection";const c=s.a.div.attrs({className:"siemUtilityBar__group"}).withConfig({displayName:"BarGroup",componentId:"sc-yj1vvr-2"})(["",""],(({grow:e,theme:t})=>Object(r.css)(["align-items:flex-start;display:flex;flex-wrap:wrap;& + &{margin-top:",";}@media only screen and (min-width:","){border-right:",";flex-wrap:nowrap;margin-right:",";padding-right:",";& + &{margin-top:0;}&:last-child{border-right:none;margin-right:0;padding-right:0;}}& > *{margin-right:",";&:last-child{margin-right:0;}}",""],t.eui.euiSizeS,t.eui.euiBreakpoints.m,t.eui.euiBorderThin,t.eui.euiSizeM,t.eui.euiSizeM,t.eui.euiSize,e&&Object(r.css)(["flex:1;"]))));c.displayName="BarGroup";const u=s.a.p.attrs((({className:e})=>({className:e||"siemUtilityBar__text"}))).withConfig({displayName:"BarText",componentId:"sc-yj1vvr-3"})(["",""],(({shouldWrap:e,theme:t})=>Object(r.css)(["color:",";font-size:",";line-height:",";white-space:",";"],t.eui.euiTextSubduedColor,t.eui.euiFontSizeXS,t.eui.euiLineHeight,e?"normal":"nowrap")));u.displayName="BarText";const d=s.a.div.attrs({className:"siemUtilityBar__action"}).withConfig({displayName:"BarAction",componentId:"sc-yj1vvr-4"})(["",""],(({theme:e})=>Object(r.css)(["font-size:",";"],e.eui.euiFontSizeXS)));d.displayName="BarAction";const p=s.a.div.attrs({className:"siemUtilityBar__spacer"}).withConfig({displayName:"BarSpacer",componentId:"sc-yj1vvr-5"})(["",""],(()=>Object(r.css)(["flex:1;"])));p.displayName="BarSpacer";const m=i.a.memo((({border:e,children:t})=>i.a.createElement(o,{border:e},t)));m.displayName="UtilityBar";var b=a(40),g=a(674);const f=s()(b.EuiButtonEmpty).withConfig({displayName:"LoadingButtonEmpty",componentId:"sc-ou55gk-0"})(["",""],(({theme:e})=>Object(r.css)(["&.euiButtonEmpty{height:",";}"],e.eui.euiSize))),y=i.a.memo((({children:e,color:t,iconSide:a,iconSize:r,iconType:s,popoverContent:o,disabled:l,ownFocus:c,dataTestSubj:u,popoverPanelPaddingSize:d,onClick:p})=>{const[m,f]=Object(n.useState)(!1),y=Object(n.useCallback)((()=>f(!1)),[f]),h=Object(n.useCallback)((()=>{null==p||p(),f(!m)}),[m,p]);return i.a.createElement(b.EuiPopover,{ownFocus:c,panelPaddingSize:d,button:i.a.createElement(g.a,{dataTestSubj:u,color:t,iconSide:a,iconSize:r,iconType:s,disabled:l,onClick:h},e),closePopover:y,isOpen:m,repositionOnScroll:!0},null==o?void 0:o(y))}));y.displayName="Popover";const h=i.a.memo((({children:e,color:t,dataTestSubj:a,disabled:n,href:r,iconSide:s,iconSize:o,iconType:l,ownFocus:c,onClick:u,popoverContent:p,popoverPanelPaddingSize:m,inProgress:b})=>b?i.a.createElement(d,null,i.a.createElement(f,{"data-test-subj":`${a}-progress`,size:"xs",className:"eui-alignTop",isLoading:!0,iconSide:"right",flush:"both"},e)):i.a.createElement(d,{"data-test-subj":a},p?i.a.createElement(y,{dataTestSubj:`${a}-popover`,disabled:n,color:t,iconSide:s,iconSize:o,iconType:l,ownFocus:c,popoverPanelPaddingSize:m,popoverContent:p,onClick:u},e):i.a.createElement(g.a,{color:t,dataTestSubj:`${a}-linkIcon`,disabled:n,href:r,iconSide:s,iconSize:o,iconType:l,onClick:u},e))));h.displayName="UtilityBarAction";const v=i.a.memo((({grow:e,children:t})=>i.a.createElement(c,{grow:e},t)));v.displayName="UtilityBarGroup";const E=i.a.memo((({grow:e,children:t,dataTestSubj:a})=>i.a.createElement(l,{grow:e,"data-test-subj":a},t)));E.displayName="UtilityBarSection",i.a.memo((({dataTestSubj:e})=>i.a.createElement(p,{"data-test-subj":e}))).displayName="UtilityBarSpacer";const x=i.a.memo((({children:e,dataTestSubj:t,shouldWrap:a=!1,className:n})=>i.a.createElement(u,{"data-test-subj":t,shouldWrap:a,className:n},e)));x.displayName="UtilityBarText"},function(e,t,a){"use strict";a.d(t,"d",(function(){return u})),a.d(t,"c",(function(){return d})),a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return b})),a.d(t,"e",(function(){return g})),a.d(t,"f",(function(){return f}));var n=a(2),i=a.n(n),r=a(40),s=a(41),o=a.n(s),l=a(44),c=a(117);const u=({children:e,...t})=>i.a.createElement(r.EuiButton,t,e),d=({children:e,...t})=>i.a.createElement(r.EuiLink,t,e),p=o()("span").withConfig({displayName:"Comma",componentId:"sc-11tqw5g-0"})(["margin-right:5px;margin-left:5px;&::after{content:' ,';}"]);p.displayName="Comma";const m=({children:e,Component:t,dataTestSubj:a,href:n,onClick:r,title:s,iconType:o="expand"})=>t?i.a.createElement(t,{"data-test-subj":a,href:n,iconType:o,onClick:r,title:s},null!=s?s:e):i.a.createElement(u,{"data-test-subj":a,href:n,onClick:r},null!=s?s:e),b=i.a.memo(m),g=o.a.div.withConfig({displayName:"PortContainer",componentId:"sc-11tqw5g-1"})(["& svg{position:relative;top:-1px;}"]),f=i.a.memo((({moreMaxHeight:e,overflowIndexStart:t=5,render:a,rowItems:s})=>{const[o,c]=Object(n.useState)(!1),u=Object(n.useCallback)((()=>c((e=>!e))),[]),d=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null," ,",i.a.createElement(r.EuiButtonEmpty,{size:"xs",onClick:u},`+${s.length-t} `,i.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.reputationLinks.moreLabel",defaultMessage:"More"})))),[u,t,s.length]);return i.a.createElement(r.EuiFlexItem,{grow:!1},s.length>t&&i.a.createElement(r.EuiPopover,{id:"popover",button:d,isOpen:o,closePopover:u,repositionOnScroll:!0,panelClassName:"withHoverActions__popover"},i.a.createElement(y,{render:a,rowItems:s,moreMaxHeight:e,overflowIndexStart:t})))}));f.displayName="ReputationLinksOverflow";const y=i.a.memo((({moreMaxHeight:e,overflowIndexStart:t,render:a,rowItems:s})=>{const o=Object(n.useMemo)((()=>s.slice(t).map(((e,t)=>{var n;return i.a.createElement(r.EuiFlexItem,{grow:1,key:`${e}-${t}`},null!==(n=a&&a(e))&&void 0!==n?n:Object(c.a)(e))}))),[t,a,s]);return i.a.createElement("div",{"data-test-subj":"more-container",className:"eui-yScroll",style:{maxHeight:e,paddingRight:"2px"}},i.a.createElement(r.EuiFlexGroup,{gutterSize:"s",direction:"column","data-test-subj":"overflow-items"},o))}));y.displayName="MoreReputationLinksContainer"},function(e,t,a){"use strict";a.d(t,"c",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return s}));var n=a(42);const i=e=>Object(n.some)({category:"kibana",field:"kibana.alert.rule.uuid"},e),r=({data:e})=>{var t;if(!i(e))return!1;const a=null===(t=Object(n.find)({field:"agent.type"},e))||void 0===t?void 0:t.values;return!!a&&"endpoint"===a[0]},s=({ecsData:e})=>{if(null==e)return!1;const t=Object(n.getOr)([],"kibana.alert.original_event.module",e),a=Object(n.getOr)([],"kibana.alert.original_event.kind",e);return t.includes("endpoint")&&a.includes("alert")}},function(e,t,a){"use strict";a.d(t,"a",(function(){return m})),a.d(t,"b",(function(){return b})),a.d(t,"c",(function(){return g}));var n=a(109),i=a(42),r=a(2),s=a(188),o=a(1387),l=a(485),c=a(434),u=a(380),d=a(167),p=a(142);const m=(e,t,a,i=p.e,r=!1)=>({and:[],enabled:!0,id:Object(n.j)(t),name:e,excluded:r,kqlQuery:"",queryMatch:{field:e,value:a,operator:i,displayValue:Object(c.d)(a)}}),b=(e,t,a,n=p.e,i=!1)=>{const{and:r,...s}=m(e,t,a,n,i);return s},g=({contextId:e,eventId:t,field:a,fieldFormat:n,fieldFromBrowserField:c,fieldType:p,isObjectArray:b,linkValue:g,values:f})=>Object(r.useMemo)((()=>{if(null==f)return null;const r=Array.isArray(f)?f:[f];let y=[];return r.length>1&&(y=[{meta:{},query:{bool:{must:r.map((e=>({term:{[a]:e}})))}}}]),r.reduce(((r,y,h)=>{let v="",E=Object(i.isString)(y)?y:`${f}`;const x=`${e}-${t}-${a}-${h}-${y}`;if(null==c)return r.values.push(E),r;if(b||p===s.f||[s.i].includes(a))return r.values.push(E),r;if(p===s.h){if(v=`formatted-ip-data-provider-${e}-${a}-${y}-${t}`,Object(i.isString)(y)&&!Object(i.isEmpty)(y)){let e=y;try{e=JSON.parse(y)}catch(e){}return Object(i.isArray)(e)&&(E=e.join(","),e.forEach((e=>r.dataProviders.push(m(a,v,e))))),r.dataProviders.push(m(a,v,e)),r.values.push(E),r}}else u.b.some((e=>a===e))?v=`port-default-draggable-${x}`:a===l.b?v=`duration-default-draggable-${x}`:a===s.g?v=`event-details-value-default-draggable-${x}`:n===o.a?v=`bytes-default-draggable-${x}`:a===s.n?v=`event-details-value-default-draggable-${x}-${g}`:a===s.c?v=`event-details-value-default-draggable-${x}-${y}`:a===s.o?v=`alert-details-value-default-draggable-${x}`:a===s.a?(v=`event-details-value-default-draggable-${x}`,E="string"==typeof y?y:""):v=[s.m,s.l,s.e,d.j].includes(a)?`event-details-value-default-draggable-${x}-${y}`:`event-details-value-default-draggable-${x}`;return r.values.push(E),r.dataProviders.push(m(a,v,y)),r}),{values:[],dataProviders:[],filters:y})}),[e,t,a,n,c,p,b,g,f])},function(e,t,a){"use strict";a.d(t,"a",(function(){return W})),a.d(t,"c",(function(){return Y})),a.d(t,"b",(function(){return ee}));var n=a(104),i=a.n(n),r=a(40),s=a(109),o=a(2),l=a.n(o),c=a(70),u=a(103),d=a(41),p=a.n(d),m=a(119),b=a(227),g=a(152),f=a(339),y=a(637),h=a(153),v=a(638),E=a(670),x=a(658),j=a(5),S=a(59),k=a(118),O=a(8),w=a(13),T=a(115),I=a(111),C=a(102),M=a(958),_=a(110),F=a(116),A=a(699);const D=({field:e,value:t})=>null==t?e:Array.isArray(t)?`${e} ${t.join(" ")}`:`${e} ${t}`;var N=a(272);const P=l.a.memo((({className:e,Component:t,enablePopOver:a,field:n,flush:i,iconSide:s,iconType:c,isExpandable:u,onClick:d,onFilterAdded:p,ownFocus:m,paddingSize:b,showLegend:g,showTooltip:f=!0,showTopN:y,scopeId:h,title:v,value:E,globalFilters:x})=>{const S=Object(T.isActiveTimeline)(null!=h?h:"")?_.SourcererScopeName.timeline:null!=h&&Object(N.c)(h)?_.SourcererScopeName.detections:_.SourcererScopeName.default,{browserFields:k,indexPattern:O}=Object(F.d)(S),w=null!=c?c:"visBarVertical",I=null!=s?s:"left",C=null!=v?v:(P=n,j.i18n.translate("xpack.securitySolution.hoverActions.showTopTooltip",{values:{fieldName:P},defaultMessage:"Show top {fieldName}"}));var P;const R=Object(o.useMemo)((()=>t?l.a.createElement(t,{"aria-label":C,className:e,"data-test-subj":"show-top-field",icon:w,iconType:w,iconSide:I,flush:i,onClick:d,title:C},C):l.a.createElement(r.EuiButtonIcon,{"aria-label":C,className:"securitySolution__hoverActionButton","data-test-subj":"show-top-field",iconSize:"s",iconType:w,onClick:d})),[t,C,e,i,w,d,I]),L=Object(o.useMemo)((()=>f&&!y?l.a.createElement(r.EuiToolTip,{content:l.a.createElement(A.a,{additionalScreenReaderOnlyContext:D({field:n,value:E}),content:C,shortcut:"t",showShortcut:m})},R):R),[R,C,n,m,f,y,E]),B=Object(o.useMemo)((()=>l.a.createElement(M.a,{browserFields:k,field:n,indexPattern:O,onFilterAdded:p,paddingSize:b,showLegend:g,scopeId:null!=h?h:void 0,toggleTopN:d,globalFilters:x})),[k,n,O,p,b,g,h,d,x]);return u?l.a.createElement(l.a.Fragment,null,R,y&&B):y?a?l.a.createElement(r.EuiPopover,{button:R,isOpen:y,closePopover:d,panelClassName:"withHoverActions__popover","data-test-subj":"showTopNContainer"},B):B:L}));P.displayName="ShowTopNButton";var R=a(12),L=a(105),B=a(131);const q=p.a.div.withConfig({displayName:"AdditionalContent",componentId:"sc-hbiy4s-0"})(["padding:2px;"]);q.displayName="AdditionalContent";const z=p.a.div.withConfig({displayName:"StyledHoverActionsContainer",componentId:"sc-hbiy4s-1"})(["display:flex;"," ",""],(e=>e.$isActive?"\n    .hoverActions-active {\n      .timelines__hoverActionButton,\n      .securitySolution__hoverActionButton {\n        opacity: 1;\n      }\n    }\n  ":""),(e=>e.$showOwnFocus?`\n    &:focus-within {\n      .timelines__hoverActionButton,\n      .securitySolution__hoverActionButton {\n        opacity: 1;\n      }\n    }\n\n    &:hover {\n      .timelines__hoverActionButton,\n      .securitySolution__hoverActionButton {\n        opacity: 1;\n      }\n    }\n\n  .timelines__hoverActionButton,\n  .securitySolution__hoverActionButton {\n    opacity: ${e.$showTopN?1:0};\n\n      &:focus {\n        opacity: 1;\n      }\n    }\n  `:"")),$=p()(z).withConfig({displayName:"StyledHoverActionsContainerWithPaddingsAndMinWidth",componentId:"sc-hbiy4s-2"})(["min-width:",";padding:",";position:relative;"],(({$hiddenActionsCount:e})=>138-26*e+"px"),(e=>`0 ${e.theme.eui.euiSizeS}`)),V=({ownFocus:e,showTopN:t})=>!t&&!e,U=l.a.memo((({additionalContent:e=null,closePopOver:t,closeTopN:a,dataProvider:n,dataType:i,draggableId:s,enableOverflowButton:c=!1,applyWidthAndPadding:d=!0,field:p,fieldType:m,isAggregatable:b,goGetTimelineId:g,isObjectArray:f,hideAddToTimeline:y=!1,hideTopN:v=!1,onFilterAdded:E,ownFocus:x,showOwnFocus:M=!0,showTopN:_,scopeId:F,toggleColumn:A,toggleTopN:D,values:N})=>{const[U,H]=Object(o.useState)(),[G,Q]=Object(o.useState)(!1),[W,K]=Object(o.useState)(!1),Y=Object(o.useCallback)((()=>{Q((e=>!e)),K(!W)}),[W,K]),J=Object(o.useCallback)((()=>{a&&a(),Q(!1),K(!1),t&&t()}),[t,a]),X=Object(o.useRef)(!0),Z=Object(o.useRef)(null);Object(o.useEffect)((()=>{X.current&&null!=g&&null==F&&(X.current=!1,g(!0))}),[g,F]),Object(o.useEffect)((()=>{x&&setTimeout((()=>{var e;null===(e=Z.current)||void 0===e||e.focus()}),0)}),[x]);const ee=Object(o.useCallback)((e=>{if(x)switch(e.key){case"t":Object(S.stopPropagationAndPreventDefault)(e),D();break;case"Enter":break;case"Escape":Object(S.stopPropagationAndPreventDefault)(e);break;default:H(e)}}),[x,D]),te=F===k.c.casePage,ae=F===k.c.active,ne=F===k.c.detectionsAlertDetailsPage,ie=F===B.a.entityAnalytics,re=Object(o.useMemo)((()=>(ne||ie)&&!ae),[ae,ne,ie]),se=Object(o.useMemo)((()=>(v?1:0)+(re?2:0)),[re,v]),{overflowActionItems:oe,allActionItems:le}=(({dataProvider:e,dataType:t,defaultFocusedButtonRef:a,draggableId:n,enableOverflowButton:i,field:s,fieldType:c,isAggregatable:d,handleHoverActionClicked:p,hideFilters:m,hideTopN:b,hideAddToTimeline:g,isCaseView:f,isObjectArray:y,isOverflowPopoverOpen:v,itemsToShow:E=2,onFilterAdded:x,onOverflowButtonClick:j,ownFocus:S,showTopN:M,stKeyboardEvent:_,scopeId:F,toggleColumn:A,toggleTopN:D,values:N})=>{const B=Object(C.j)(),q=Object(u.useDispatch)(),{timelines:z,uiSettings:$}=B.services,{getAddToTimelineButton:V,getColumnToggleButton:U,getCopyButton:H,getFilterForValueButton:G,getFilterOutValueButton:Q,getOverflowButton:W}=z.getHoverActions(),K=Object(o.useMemo)((()=>B.services.data.query.filterManager),[B.services.data.query.filterManager]),Y=Object(o.useMemo)((()=>I.b.getTimelineByIdSelector()),[]),J=Object(L.a)((e=>{var t;return Object(T.isActiveTimeline)(null!=F?F:"")?null===(t=Y(e,null!=F?F:""))||void 0===t?void 0:t.filterManager:void 0})),X=Object(o.useMemo)((()=>Object(T.isActiveTimeline)(null!=F?F:"")?null!=J?J:new w.FilterManager($):K),[F,J,$,K]),Z=Object(o.useCallback)((()=>{e&&!Object(O.isEmpty)(e)&&q(Object(R.addProvider)({id:k.c.active,providers:e instanceof Array?e:[e]}))}),[e,q]),ee=Object(o.useCallback)((()=>{p&&p(),Z()}),[p,Z]),te=Object(o.useMemo)((()=>!m&&null!=N&&(i||!M&&!i)&&!f),[i,m,f,M,N]),ae=y&&"geo_point"!==s||f,ne=Object(o.useMemo)((()=>l.a.createElement(P,{Component:i?r.EuiContextMenuItem:void 0,"data-test-subj":"hover-actions-show-top-n",enablePopOver:!i&&f,field:s,key:"hover-actions-show-top-n",onClick:D,onFilterAdded:x,ownFocus:S,showTopN:M,showTooltip:!i,scopeId:F,value:N})),[i,f,s,D,x,S,M,F,N]),ie=Object(o.useMemo)((()=>[te?l.a.createElement("div",{"data-test-subj":"hover-actions-filter-for",key:"hover-actions-filter-for"},G({defaultFocusedButtonRef:a,field:s,filterManager:X,keyboardEvent:_,onClick:p,onFilterAdded:x,ownFocus:S,showTooltip:!i,value:N})):null,te?l.a.createElement("div",{"data-test-subj":"hover-actions-filter-out",key:"hover-actions-filter-out"},Q({field:s,filterManager:X,keyboardEvent:_,onFilterAdded:x,ownFocus:S,onClick:p,showTooltip:!i,value:N})):null,A&&!ae?l.a.createElement("div",{"data-test-subj":"hover-actions-toggle-column",key:"hover-actions-toggle-column"},U({Component:i?r.EuiContextMenuItem:void 0,field:s,isDisabled:y&&"geo_point"!==t,isObjectArray:y,keyboardEvent:_,ownFocus:S,onClick:p,showTooltip:!i,toggleColumn:A,value:N})):null,null==N||null==n&&Object(O.isEmpty)(e)||g?null:l.a.createElement("div",{"data-test-subj":"hover-actions-add-timeline",key:"hover-actions-add-timeline"},V({Component:i?r.EuiContextMenuItem:void 0,dataProvider:e,draggableId:n,field:s,keyboardEvent:_,ownFocus:S,onClick:ee,showTooltip:!i,value:N})),Object(h.e)({fieldType:c,isAggregatable:d,fieldName:s,hideTopN:b})?ne:null,null!=s?l.a.createElement("div",{"data-test-subj":"hover-actions-copy-button",key:"hover-actions-copy-button"},H({Component:i?r.EuiContextMenuItem:void 0,field:s,isHoverAction:!0,keyboardEvent:_,ownFocus:S,onClick:p,showTooltip:!i,value:N})):null].filter((e=>null!=e))),[e,t,a,n,i,s,c,d,X,V,U,H,G,Q,p,ee,g,b,y,x,S,ae,te,ne,_,A,N]);return{overflowActionItems:Object(o.useMemo)((()=>[...ie.slice(0,E),...i&&E>0&&E<ie.length?[W({closePopOver:p,field:s,keyboardEvent:_,ownFocus:S,onClick:j,showTooltip:!i,value:N,items:M?[ne]:ie.slice(E),isOverflowPopoverOpen:!!v})]:[]].filter((e=>null!=e))),[ie,i,s,W,p,v,E,j,ne,S,M,_,N]),allActionItems:Object(o.useMemo)((()=>!M||i||f?ie:[ne]),[M,i,f,ne,ie])}})({dataProvider:n,dataType:i,defaultFocusedButtonRef:Z,draggableId:s,enableOverflowButton:c&&!te,field:p,fieldType:m,hideFilters:re,isAggregatable:b,handleHoverActionClicked:J,hideAddToTimeline:y,hideTopN:v,isCaseView:te,isObjectArray:f,isOverflowPopoverOpen:W,onFilterAdded:E,onOverflowButtonClick:Y,ownFocus:x,showTopN:_,stKeyboardEvent:U,toggleColumn:A,toggleTopN:D,values:N,scopeId:F}),ce=d?$:z;return l.a.createElement(r.EuiFocusTrap,{disabled:V({ownFocus:x,showTopN:_})},l.a.createElement(ce,{"data-test-subj":"hover-actions-container",onKeyDown:ee,$showTopN:_,$showOwnFocus:M,$hiddenActionsCount:se,$isActive:G,className:G?"hoverActions-active":""},l.a.createElement(r.EuiScreenReaderOnly,null,l.a.createElement("p",null,(ue=p,j.i18n.translate("xpack.securitySolution.dragAndDrop.youAreInADialogContainingOptionsScreenReaderOnly",{values:{fieldName:ue},defaultMessage:"You are in a dialog, containing options for field {fieldName}. Press tab to navigate options. Press escape to exit."})))),null!=e&&l.a.createElement(q,null,e),c&&!te?oe:le));var ue}));U.displayName="HoverActions";var H=a(922);const G=({dataProvider:e,isAggregatable:t,fieldType:a,hideTopN:n,isDraggable:i,onFilterAdded:r,render:s,scopeId:c})=>{const{timelineId:u}=Object(o.useContext)(x.b),{tableId:d}=Object(o.useContext)(H.b),p=Object(o.useRef)(null),m=Object(o.useRef)(null),[b,g]=Object(o.useState)(!1),[f,y]=Object(o.useState)(!1),v=Object(o.useMemo)((()=>c||(null!=u?u:d)),[c,d,u]),E=Object(o.useCallback)((()=>{g((e=>!e)),y((e=>(e&&setTimeout((()=>{var e;null===(e=m.current)||void 0===e||e.focus()}),0),!1))),setTimeout((()=>{y(!1)}),0)}),[m]),{closeTopN:j,toggleTopN:S,isShowingTopN:k}=(e=>{const[t,a]=Object(o.useState)(!1),n=Object(o.useCallback)((()=>{a((t=>{const a=!t;return e&&e(a),a}))}),[e]);return{closeTopN:Object(o.useCallback)((()=>{a(!1)}),[]),toggleTopN:n,isShowingTopN:t}})(E),O=Object(o.useMemo)((()=>{const t=e.queryMatch.value;return"number"==typeof t||"boolean"==typeof t?t.toString():Array.isArray(t)?t.map((e=>String(e))):t}),[e.queryMatch.value]),w=Object(o.useMemo)((()=>{const o=f&&!k&&(null!==(u=null==(c=p.current)?void 0:c.querySelectorAll(".euiLink"))&&void 0!==u?u:[]).length>0?l.a.createElement(Y,{"data-test-subj":`draggable-link-content-${e.queryMatch.field}`},s(e,null,{isDragging:!1,isDropAnimating:!1,isClone:!1,dropAnimation:null,draggingOver:null,combineWith:null,combineTargetFor:null,mode:null})):null;var c,u;return l.a.createElement(U,{additionalContent:o,closeTopN:j,closePopOver:E,dataProvider:e,draggableId:i?Object(h.l)(e.id):void 0,field:e.queryMatch.field,isAggregatable:t,fieldType:a,hideTopN:n,isObjectArray:!1,onFilterAdded:r,ownFocus:f,showOwnFocus:!1,showTopN:k,scopeId:v,toggleTopN:S,values:O})}),[f,k,e,s,j,E,i,t,a,n,r,v,S,O]),T=Object(o.useCallback)((e=>{p.current=e}),[]),I=Object(o.useCallback)((()=>{var e;f||null===(e=m.current)||void 0===e||e.focus()}),[f,m]),C=Object(o.useCallback)((()=>{j(),f&&(y(!1),setTimeout((()=>{I()}),0))}),[I,f,j]),M=Object(o.useCallback)((()=>{y(!0)}),[]);return Object(o.useMemo)((()=>({closePopOverTrigger:b,handleClosePopOverTrigger:E,hoverActionsOwnFocus:f,hoverContent:w,keyboardHandlerRef:m,onCloseRequested:C,onFocus:I,openPopover:M,setContainerRef:T,isShowingTopN:k})),[b,E,f,w,C,I,M,T,k])};var Q=a(662);const W=p.a.div.withConfig({displayName:"DragEffects",componentId:"sc-1n4vnmw-0"})([""]);W.displayName="DragEffects";class draggable_wrapper_DragDropErrorBoundary extends l.a.PureComponent{componentDidCatch(){this.forceUpdate()}render(){return this.props.children}}const K=p.a.div.withConfig({displayName:"Wrapper",componentId:"sc-1n4vnmw-1"})(["display:inline-block;max-width:100%;[data-rbd-placeholder-context-id]{display:none !important;}",""],(({disabled:e})=>e&&"\n    [data-rbd-draggable-id]:hover,\n    .euiBadge:hover,\n    .euiBadge__text:hover {\n      cursor: default;\n    }\n  "));K.displayName="Wrapper";const Y=p.a.span.withConfig({displayName:"ProviderContentWrapper",componentId:"sc-1n4vnmw-2"})(["> span.euiToolTipAnchor{display:block;}> span.euiToolTipAnchor.eui-textTruncate{display:inline-block;}"]),J=(e,t)=>t.isDropAnimating?{...e,transitionDuration:"0.00000001s"}:e,X=({dataProvider:e,hideTopN:t=!1,onFilterAdded:a,render:n,fieldType:d="",isAggregatable:p=!1,scopeId:m,truncate:x})=>{const[j,S]=Object(o.useState)(!1),k=e.id.includes(`-${g.a}-`),O=Object(u.useDispatch)(),{closePopOverTrigger:w,handleClosePopOverTrigger:T,hoverActionsOwnFocus:I,hoverContent:C,keyboardHandlerRef:M,onCloseRequested:_,openPopover:F,onFocus:A,setContainerRef:D,isShowingTopN:N}=G({dataProvider:e,hideTopN:t,onFilterAdded:a,render:n,fieldType:d,isAggregatable:p,scopeId:m,truncate:x}),P=Object(o.useCallback)((()=>{k||(O(b.a.registerProvider({provider:e})),S(!0))}),[k,O,e]),R=Object(o.useCallback)((()=>j&&O(b.a.unRegisterProvider({id:e.id}))),[j,O,e.id]);Object(o.useEffect)((()=>()=>{R()}),[R]);const L=Object(o.useCallback)(((t,a)=>l.a.createElement(te,{registerProvider:P},l.a.createElement("div",i()({},t.draggableProps,t.dragHandleProps,{style:J(t.draggableProps.style,a),ref:t.innerRef,"data-test-subj":"providerContainer",tabIndex:-1}),l.a.createElement(Y,{"data-test-subj":`draggable-content-${e.queryMatch.field}`},n(e,t,a))))),[e,P,n]),B=Object(o.useCallback)(((t,a)=>l.a.createElement(v.a,i()({},t.draggableProps,t.dragHandleProps,{ref:e=>{t.innerRef(e),D(e)},"data-test-subj":"providerContainer",isDragging:a.isDragging,registerProvider:P,tabIndex:-1}),l.a.createElement(r.EuiScreenReaderOnly,{"data-test-subj":"screenReaderOnlyField"},l.a.createElement("p",null,e.queryMatch.field)),x&&!a.isDragging?l.a.createElement(f.b,{"data-test-subj":"draggable-truncatable-content"},n(e,t,a)):l.a.createElement(Y,{"data-test-subj":`draggable-content-${e.queryMatch.field}`},n(e,t,a)),!a.isDragging&&l.a.createElement(r.EuiScreenReaderOnly,{"data-test-subj":"draggableKeyboardInstructionsNotDragging"},l.a.createElement("p",null,E.b)))),[e,P,n,D,x]),{onBlur:q,onKeyDown:z}=Object(Q.a)({closePopover:T,draggableId:Object(h.l)(e.id),fieldName:e.queryMatch.field,keyboardHandlerRef:M,openPopover:F}),$=Object(o.useCallback)((t=>l.a.createElement("div",i()({ref:t.innerRef},t.droppableProps),l.a.createElement("div",{className:s.a,"data-test-subj":"draggableWrapperKeyboardHandler",onClick:A,onBlur:q,onKeyDown:z,ref:M,role:"button",tabIndex:0},l.a.createElement(c.Draggable,{draggableId:Object(h.l)(e.id),index:0,key:Object(h.l)(e.id),isDragDisabled:k},B)),t.placeholder)),[B,e.id,k,M,q,A,z]),V=Object(o.useMemo)((()=>l.a.createElement(K,{"data-test-subj":"draggableWrapperDiv",disabled:k},l.a.createElement(draggable_wrapper_DragDropErrorBoundary,null,l.a.createElement(c.Droppable,{isDropDisabled:!0,droppableId:Object(h.m)(e.id),renderClone:L},$)))),[$,L,e.id,k]),U=Object(o.useCallback)((()=>V),[V]);return k?l.a.createElement(l.a.Fragment,null,V):l.a.createElement(y.a,{alwaysShow:N||I,closePopOverTrigger:w,hoverContent:C,onCloseRequested:_,render:U})},Z=({dataProvider:e,hideTopN:t=!1,isDraggable:a=!1,onFilterAdded:n,render:i,isAggregatable:r=!1,fieldType:s="",scopeId:c,truncate:u})=>{const{closePopOverTrigger:d,hoverActionsOwnFocus:p,hoverContent:b,onCloseRequested:v,setContainerRef:E,isShowingTopN:x}=G({dataProvider:e,hideTopN:t,isDraggable:a,isAggregatable:r,fieldType:s,onFilterAdded:n,render:i,scopeId:c,truncate:u}),j=Object(o.useCallback)((()=>l.a.createElement("div",{ref:e=>{E(e)},tabIndex:-1,"data-provider-id":Object(h.l)(e.id)},u?l.a.createElement(f.b,{"data-test-subj":"render-truncatable-content"},i(e,null,{isDragging:!1,isDropAnimating:!1,isClone:!1,dropAnimation:null,draggingOver:null,combineWith:null,combineTargetFor:null,mode:null})):l.a.createElement(Y,{"data-test-subj":`render-content-${e.queryMatch.field}`},i(e,null,{isDragging:!1,isDropAnimating:!1,isClone:!1,dropAnimation:null,draggingOver:null,combineWith:null,combineTargetFor:null,mode:null})))),[e,i,E,u]);return a?l.a.createElement(X,{dataProvider:e,hideTopN:t,onFilterAdded:n,fieldType:s,isAggregatable:r,render:i,scopeId:c,truncate:u}):l.a.createElement(y.a,{alwaysShow:x||p,closePopOverTrigger:d,hoverContent:(S=c,[m.e.rulePreview,g.a].includes(null!=S?S:"")?void 0:b),onCloseRequested:v,render:j});var S},ee=l.a.memo(Z);ee.displayName="DraggableWrapper";const te=l.a.memo((({children:e,registerProvider:t})=>(Object(o.useEffect)((()=>{t()}),[t]),l.a.createElement(l.a.Fragment,null,e))));te.displayName="ConditionalPortal"},function(e,t,a){"use strict";a.d(t,"c",(function(){return c})),a.d(t,"a",(function(){return u})),a.d(t,"b",(function(){return d}));var n=a(40),i=a(2),r=a.n(i);const s="closed",o="open",l=e=>e===s?o:s,c="Header",u="Content",d=({expanded:e,title:t,children:a,"data-test-subj":d})=>{const p=Object(n.useGeneratedHtmlId)({prefix:"accordion"}),{renderContent:m,toggle:b,state:g}=(e=>{const t=e?o:s,[a,n]=Object(i.useReducer)(l,t);return{renderContent:a===o,state:a,toggle:n}})(e),f=d+c,y=d+u,h=r.a.createElement(n.EuiTitle,{size:"xs","data-test-subj":f},r.a.createElement("h4",null,t));return r.a.createElement(n.EuiAccordion,{forceState:g,onToggle:b,id:p,buttonContent:h},r.a.createElement(n.EuiSpacer,{size:"m"}),r.a.createElement(n.EuiFlexGroup,{gutterSize:"none",direction:"column","data-test-subj":y},m&&a))};d.displayName="ExpandableSection"},,,function(e,t,a){(function(t){const a="object"==typeof t&&Object({IS_KIBANA_DISTRIBUTABLE:"true"})&&Object({IS_KIBANA_DISTRIBUTABLE:"true"}).NODE_DEBUG&&/\bsemver\b/i.test(Object({IS_KIBANA_DISTRIBUTABLE:"true"}).NODE_DEBUG)?(...e)=>console.error("SEMVER",...e):()=>{};e.exports=a}).call(this,a(404))},function(e,t){const a=Number.MAX_SAFE_INTEGER||9007199254740991;e.exports={MAX_LENGTH:256,MAX_SAFE_COMPONENT_LENGTH:16,MAX_SAFE_BUILD_LENGTH:250,MAX_SAFE_INTEGER:a,RELEASE_TYPES:["major","premajor","minor","preminor","patch","prepatch","prerelease"],SEMVER_SPEC_VERSION:"2.0.0",FLAG_INCLUDE_PRERELEASE:1,FLAG_LOOSE:2}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"c",(function(){return s}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.chart.dataAllValuesZerosTitle",{defaultMessage:"All values returned zero"}),r=n.i18n.translate("xpack.securitySolution.chart.dataNotAvailableTitle",{defaultMessage:"Chart Data Not Available"}),s=n.i18n.translate("xpack.securitySolution.chart.emptyValueLabel",{defaultMessage:"empty value"})},function(e,t,a){"use strict";a.d(t,"b",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"a",(function(){return u}));var n=a(190),i=a(176),r=a(135),s=a(682);const o=e=>{var t,a;const i=null!==(t=null==e||null===(a=e.isPlatinumPlus)||void 0===a?void 0:a.call(e))&&void 0!==t&&t;return[{columnHeaderType:n.a,displayAsText:r.s,id:"kibana.alert.severity",initialWidth:105},{columnHeaderType:n.a,displayAsText:r.o,id:"kibana.alert.risk_score",initialWidth:100},{columnHeaderType:n.a,displayAsText:r.n,id:"kibana.alert.reason",initialWidth:450},{columnHeaderType:n.a,id:"host.name"},i?{columnHeaderType:n.a,id:"host.risk.calculated_level"}:null,{columnHeaderType:n.a,id:"user.name"},i?{columnHeaderType:n.a,id:"user.risk.calculated_level"}:null,{columnHeaderType:n.a,id:"process.name"},{columnHeaderType:n.a,id:"file.name"},{columnHeaderType:n.a,id:"source.ip"},{columnHeaderType:n.a,id:"destination.ip"}].filter((e=>null!=e))},l=e=>[{columnHeaderType:n.a,id:"@timestamp",initialWidth:i.b+10},{columnHeaderType:n.a,displayAsText:r.p,id:"kibana.alert.rule.name",initialWidth:i.a,linkField:"kibana.alert.rule.uuid"},...o(e)],c=e=>[{columnHeaderType:n.a,id:"kibana.alert.original_time",initialWidth:i.b+10},...o(e)],u=[{columnHeaderType:n.a,id:"@timestamp",displayAsText:r.B.timestamp,initialWidth:s.b+50,actions:!1,isExpandable:!1,isResizable:!1},{columnHeaderType:n.a,displayAsText:r.B.rule,id:"kibana.alert.rule.name",initialWidth:s.a+50,linkField:"kibana.alert.rule.uuid",actions:!1,isExpandable:!1,isResizable:!1},{columnHeaderType:n.a,id:"eventSummary",displayAsText:r.B.eventSummary,actions:!1,isExpandable:!1,isResizable:!1}]},function(e,t,a){"use strict";a.d(t,"a",(function(){return b}));var n=a(2),i=a.n(n),r=a(42),s=a(48),o=a(1408);const{euiColorVis0:l,euiColorVis5:c,euiColorVis7:u,euiColorVis9:d}=s.euiLightVars,p={low:l,medium:c,high:u,critical:d},m=({value:e})=>{var t;const a=Object(r.upperFirst)(e),n=null!==(t=p[e])&&void 0!==t?t:"subdued";return i.a.createElement(o.a,{healthColor:n,tooltipContent:a,dataTestSubj:"severity"},a)},b=i.a.memo(m)},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(40),i=a(2),r=a.n(i),s=a(168);const o=({dataTestSubj:e,descriptionList:t})=>r.a.createElement(n.EuiFlexItem,{grow:!0},r.a.createElement(s.d,{"data-test-subj":e,listItems:t}))},function(e,t,a){"use strict";a.d(t,"b",(function(){return g})),a.d(t,"a",(function(){return x}));var n=a(2),i=a.n(n),r=a(44),s=a(40),o=a(41),l=a.n(o),c=a(165),u=a(153),d=a(117),p=a(168),m=a(224);const b=l.a.div.withConfig({displayName:"Subtext",componentId:"sc-19v49l5-0"})(["font-size:",";"],(e=>e.theme.eui.euiFontSizeXS)),g=({values:e,fieldName:t,idPrefix:a,render:n,displayCount:r=5,maxOverflow:s=5})=>{if(null!=e&&e.length>0){const o=e.slice(0,r).map(((e,r)=>{const s=Object(u.i)(`${a}-${t}-${e}-${r}`);return i.a.createElement(c.c,{key:s,mode:c.a.HOVER_DOWN,visibleCellActions:5,showActionTooltips:!0,triggerId:c.d.DEFAULT,data:{value:e,field:t}},i.a.createElement(i.a.Fragment,null,n?n(e):Object(d.a)(e)))}));return o.length>0?i.a.createElement(i.a.Fragment,null,o," ",i.a.createElement(y,{fieldName:t,values:e,idPrefix:a,maxOverflowItems:s,overflowIndexStart:r})):Object(d.d)()}return Object(d.d)()},f=({fieldName:e,values:t,idPrefix:a,maxOverflowItems:n=5,overflowIndexStart:o=5})=>i.a.createElement(i.a.Fragment,null,t.length>o&&i.a.createElement(v,{count:t.length-o,idPrefix:a},i.a.createElement(s.EuiText,{size:"xs"},i.a.createElement(m.c,{fieldName:e,idPrefix:a,values:t,overflowIndexStart:o,moreMaxHeight:"none"}),t.length>o+n&&i.a.createElement("p",{"data-test-subj":"popover-additional-overflow"},i.a.createElement(s.EuiTextColor,{color:"subdued"},t.length-o-n," ",i.a.createElement(r.FormattedMessage,{id:"xpack.securitySolution.tables.rowItemHelper.moreDescription",defaultMessage:"more not shown"}))))));f.displayName="RowItemOverflowComponent";const y=i.a.memo(f),h=({children:e,count:t,idPrefix:a})=>{const[o,l]=Object(n.useState)(!1),c=Object(n.useCallback)((()=>{l(!o)}),[o]);return i.a.createElement(b,null,i.a.createElement(s.EuiPopover,{button:i.a.createElement(s.EuiLink,{onClick:c,"data-test-subj":"overflow-button"},i.a.createElement(r.FormattedMessage,{id:"xpack.securitySolution.tables.rowItemHelper.overflowButtonDescription",defaultMessage:"+{count} More",values:{count:t}})),closePopover:()=>l(!o),id:`${a}-popover`,isOpen:o,panelClassName:"withHoverActions__popover",repositionOnScroll:!0},e))};h.displayName="PopoverComponent";const v=i.a.memo(h);v.displayName="Popover";const E=({value:e,showToolTip:t=!0,overflowLength:a=50})=>i.a.createElement("span",null,t?i.a.createElement(s.EuiToolTip,{"data-test-subj":"message-tooltip",content:"message"},i.a.createElement(i.a.Fragment,null,e.substring(0,a))):i.a.createElement(i.a.Fragment,null,e.substring(0,a)),e.length>a&&i.a.createElement(s.EuiToolTip,{content:e},i.a.createElement(p.f,{type:"boxesHorizontal"})));E.displayName="OverflowFieldComponent";const x=i.a.memo(E);x.displayName="OverflowField"},function(e,t,a){"use strict";a.d(t,"a",(function(){return c})),a.d(t,"b",(function(){return u})),a.d(t,"c",(function(){return d}));var n=a(46),i=a(2),r=a(4),s=a(143),o=a(354);const l=["GET",r.hb],c=(e,t)=>Object(n.useQuery)([...l,e],(async({signal:t})=>{const a=await Object(s.j)({signal:t,...e});return{rules:a.data,total:a.total}}),{...o.a,staleTime:0,...t}),u=()=>{const e=Object(n.useQueryClient)();return Object(i.useCallback)((()=>{e.invalidateQueries(l,{refetchType:"active"})}),[e])},d=()=>{const e=Object(n.useQueryClient)();return Object(i.useCallback)((t=>{e.setQueriesData(l,(e=>e?{rules:p(e.rules,t),total:e.total}:void 0))}),[e])};function p(e,t){const a=new Map(t.map((e=>[e.id,e])));return e.some((e=>a.has(e.id)))?e.map((e=>{var t;return null!==(t=a.get(e.id))&&void 0!==t?t:e})):e}},function(e,t,a){"use strict";a.d(t,"d",(function(){return s})),a.d(t,"a",(function(){return o})),a.d(t,"c",(function(){return l})),a.d(t,"b",(function(){return c}));var n=a(137),i=a(204),r=a(586);const s=e=>"boolean"==typeof e,o=(e,t)=>{var a;return null==e||!((null===(a=e.actions)||void 0===a?void 0:a.length)>0&&s(t))||t},l=e=>null==e||e,c=(e,t,a,s)=>null==e?void 0:Object(i.d)(e.type)&&!t?r.d:o(e,a)?l(s)?void 0:n.Rb:n.Qb},function(e,t,a){"use strict";a.d(t,"g",(function(){return v})),a.d(t,"b",(function(){return j})),a.d(t,"f",(function(){return k})),a.d(t,"c",(function(){return T})),a.d(t,"h",(function(){return M})),a.d(t,"d",(function(){return R})),a.d(t,"e",(function(){return L})),a.d(t,"a",(function(){return B}));var n=a(62),i=a.n(n),r=a(50),s=a.n(r),o=a(240),l=a.n(o),c=(a(45),a(41)),u=a.n(c),d=a(40),p=a(163),m=a(197),b=a(207),g=a(145),f=a(737),y=a(213),h=a(739);const v=({rule:e,detailsView:t=!1})=>{const a=x(e);return{aboutRuleData:O(e,t),modifiedAboutRuleDetailsData:C(e),defineRuleData:a,scheduleRuleData:S(e),ruleActionsData:E(e)}},E=e=>{const{enabled:t,meta:a,actions:n=[],response_actions:i}=e;return{actions:null==n?void 0:n.map(f.d),responseActions:null==i?void 0:i.map(f.e),kibanaSiemAppUrl:null==a?void 0:a.kibana_siem_app_url,enabled:t}},x=e=>{var t,a,n,i,r,s,o,l,c,u,d,p,g,f,h,v,E,x,S,k,O,w,T,I,C,M,_,F;return{ruleType:e.type,anomalyThreshold:null!==(t=e.anomaly_threshold)&&void 0!==t?t:50,machineLearningJobId:null!==(a=e.machine_learning_job_id)&&void 0!==a?a:[],index:null!==(n=e.index)&&void 0!==n?n:[],dataViewId:e.data_view_id,threatIndex:null!==(i=e.threat_index)&&void 0!==i?i:[],threatQueryBar:{query:{query:null!==(r=e.threat_query)&&void 0!==r?r:"",language:null!==(s=e.threat_language)&&void 0!==s?s:""},filters:null!==(o=e.threat_filters)&&void 0!==o?o:[],saved_id:null},threatMapping:null!==(l=e.threat_mapping)&&void 0!==l?l:[],queryBar:{query:{query:null!==(c=e.query)&&void 0!==c?c:"",language:null!==(u=e.language)&&void 0!==u?u:""},filters:null!==(d=e.filters)&&void 0!==d?d:[],saved_id:null!==(p=e.saved_id)&&void 0!==p?p:null},relatedIntegrations:null!==(g=e.related_integrations)&&void 0!==g?g:[],requiredFields:null!==(f=e.required_fields)&&void 0!==f?f:[],timeline:{id:null!==(h=e.timeline_id)&&void 0!==h?h:null,title:null!==(v=e.timeline_title)&&void 0!==v?v:null},threshold:{field:Object(m.h)(null===(E=e.threshold)||void 0===E?void 0:E.field),value:`${(null===(x=e.threshold)||void 0===x?void 0:x.value)||100}`,...null!==(S=e.threshold)&&void 0!==S&&null!==(k=S.cardinality)&&void 0!==k&&k.length?{cardinality:{field:[`${e.threshold.cardinality[0].field}`],value:`${e.threshold.cardinality[0].value}`}}:{}},eqlOptions:{timestampField:e.timestamp_field,eventCategoryField:e.event_category_override,tiebreakerField:e.tiebreaker_field},dataSourceType:e.data_view_id?y.a.DataView:y.a.IndexPatterns,newTermsFields:null!==(O=e.new_terms_fields)&&void 0!==O?O:[],historyWindowSize:e.history_window_start?j(e.history_window_start):"7d",shouldLoadQueryDynamically:Boolean("saved_query"===e.type&&e.saved_id),groupByFields:null!==(w=null===(T=e.alert_suppression)||void 0===T?void 0:T.group_by)&&void 0!==w?w:[],groupByRadioSelection:null!==(I=e.alert_suppression)&&void 0!==I&&I.duration?y.b.PerTimePeriod:y.b.PerRuleExecution,groupByDuration:null!==(C=null===(M=e.alert_suppression)||void 0===M?void 0:M.duration)&&void 0!==C?C:{value:5,unit:"m"},suppressionMissingFields:null!==(_=null===(F=e.alert_suppression)||void 0===F?void 0:F.missing_fields_strategy)&&void 0!==_?_:b.f}},j=e=>e.startsWith("now-")?e.substring(4):e,S=e=>{const{interval:t,from:a}=e;return{interval:t,from:k(a,t)}},k=(e,t)=>{var a,n;const r=null!==(a=i.a.parse(e))&&void 0!==a?a:s()(),o=null!==(n=i.a.parse(`now-${t}`))&&void 0!==n?n:s()(),l=s.a.duration(o.diff(r)),c=Math.floor(l.asSeconds());return 0===c?"0s":c%3600==0?c/3600+"h":c%60==0?c/60+"m":`${c}s`},O=(e,t)=>{var a;const{name:n,description:i,note:r}=I(e,t),{author:s,building_block_type:o,exceptions_list:l,license:c,risk_score_mapping:u,rule_name_override:d,severity_mapping:m,timestamp_override:b,timestamp_override_fallback_disabled:g,references:f,severity:y,false_positives:h,risk_score:v,investigation_fields:E,tags:x,threat:j,threat_indicator_path:S}=e;return{author:s,isAssociatedToEndpointList:null!==(a=null==l?void 0:l.some((({id:e})=>e===p.k)))&&void 0!==a&&a,isBuildingBlock:void 0!==o,license:null!=c?c:"",ruleNameOverride:null!=d?d:"",timestampOverride:null!=b?b:"",timestampOverrideFallbackDisabled:g,name:n,description:i,note:r,references:f,severity:{value:y,mapping:T(m),isMappingChecked:m.length>0},tags:x,riskScore:{value:v,mapping:u,isMappingChecked:u.length>0},falsePositives:h,investigationFields:null!=E?E:[],threat:j,threatIndicatorPath:S}},w={low:0,medium:1,high:2,critical:3},T=e=>{const t=h.i.flatMap((t=>null==e.find((e=>e.severity===t.value))?[{field:"",value:"",operator:"equals",severity:t.value}]:[]));return[...e,...t].sort(((e,t)=>w[e.severity]-w[t.severity]))},I=(e,t)=>{const{name:a,description:n,note:i}=e;return t?{name:"",description:"",note:""}:{name:a,description:n,note:null!=i?i:""}},C=e=>{var t,a;return{note:null!==(t=e.note)&&void 0!==t?t:"",description:e.description,setup:null!==(a=e.setup)&&void 0!==a?a:""}},M=(e,t,a,n)=>!1===e||!1===t||!1===a||n,_=["id","name","description","false_positives","investigation_fields","rule_id","max_signals","risk_score","output_index","references","severity","timeline_id","timeline_title","threat","type","version"],F=["index","filters","language","query","saved_id","response_actions"],A=["anomaly_threshold","machine_learning_job_id"],D=["threshold",...F],N=e=>{switch(e){case"machine_learning":return A;case"threshold":return D;case"new_terms":case"threat_match":case"query":case"saved_query":case"eql":return F}Object(g.a)(e)},P=e=>({state:[{name:"signals_count",description:"state.signals_count"}],params:[],context:[{name:"results_link",description:"context.results_link",useWithTripleBracesInTemplates:!0},{name:"alerts",description:"context.alerts"},...e.map((e=>{const t=`rule.${e}`;return{name:t,description:`context.${t}`}}))]}),R=l()((e=>{if(!e)return{state:[],params:[]};const t=(e=>[..._,...N(e)].sort())(e);return P(t)})),L=()=>P((()=>{const e=[..._,...F,...A,...D].sort();return Array.from(new Set(e))})()),B=u()(d.EuiFlexItem).withConfig({displayName:"MaxWidthEuiFlexItem",componentId:"sc-15hicli-0"})(["max-width:1000px;overflow:hidden;"])},function(e,t,a){"use strict";a.d(t,"a",(function(){return h}));var n=a(41),i=a.n(n),r=a(40),s=a(2),o=a.n(s),l=(a(21),a(674)),c=a(679),u=a(1051),d=a(169),p=a(102);const m=i.a.div.attrs({className:"securitySolutionHeaderPage__linkBack"}).withConfig({displayName:"LinkBack",componentId:"sc-1acc7vc-0"})(["",""],(({theme:e})=>Object(n.css)(["font-size:",";line-height:",";margin-bottom:",";"],e.eui.euiFontSizeXS,e.eui.euiLineHeight,e.eui.euiSizeS)));m.displayName="LinkBack";const b=i()(r.EuiPageHeaderSection).withConfig({displayName:"HeaderSection",componentId:"sc-1acc7vc-1"})(["min-width:0;max-width:100%;"]);function g(){const{euiTheme:e}=Object(r.useEuiTheme)();return o.a.createElement(v,{$_css:e.border.thin})}b.displayName="HeaderSection";const f=o.a.memo((({backOptions:e})=>{var t,a;const{navigateToUrl:n}=Object(p.j)().services.application,{formatUrl:i}=Object(d.m)(e.pageId),r=i(null!==(t=e.path)&&void 0!==t?t:"");return o.a.createElement(m,null,o.a.createElement(l.a,{dataTestSubj:null!==(a=e.dataTestSubj)&&void 0!==a?a:"link-back",onClick:e=>{e.preventDefault(),n(r)},href:r,iconType:"arrowLeft"},e.text))}));f.displayName="HeaderLinkBack";const y=({backOptions:e,backComponent:t,badgeOptions:a,border:n,children:i,isLoading:s,rightSideItems:l,subtitle:d,subtitle2:p,title:m,titleNode:y})=>o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiPageHeader,{alignItems:"center",rightSideItems:l},o.a.createElement(b,null,e&&o.a.createElement(f,{backOptions:e}),!e&&t&&o.a.createElement(o.a.Fragment,null,t),y||o.a.createElement(u.a,{title:m,badgeOptions:a}),d&&o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiSpacer,{size:"s"}),o.a.createElement(c.a,{"data-test-subj":"header-page-subtitle",items:d})),n&&s&&o.a.createElement(r.EuiProgress,{size:"xs",color:"accent"})),i&&o.a.createElement(r.EuiPageHeaderSection,{"data-test-subj":"header-page-supplements"},i)),p&&o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiSpacer,{size:"xs"}),o.a.createElement(c.a,{"data-test-subj":"header-page-subtitle-2",items:p})),n&&o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiSpacer,{size:"m"}),o.a.createElement(g,null)),o.a.createElement(r.EuiSpacer,{size:"l"})),h=o.a.memo(y);var v=i()("div").withConfig({displayName:"_StyledDiv",componentId:"sc-1acc7vc-2"})(["border-bottom:",";"],(e=>e.$_css))},function(e,t,a){"use strict";a.d(t,"e",(function(){return j})),a.d(t,"f",(function(){return S})),a.d(t,"g",(function(){return k})),a.d(t,"c",(function(){return T})),a.d(t,"a",(function(){return C})),a.d(t,"b",(function(){return M})),a.d(t,"d",(function(){return _}));var n=a(8);const i={"@timestamp":{type:"date",array:!1,required:!0},"agent.build.original":{type:"keyword",array:!1,required:!1},"agent.ephemeral_id":{type:"keyword",array:!1,required:!1},"agent.id":{type:"keyword",array:!1,required:!1},"agent.name":{type:"keyword",array:!1,required:!1},"agent.type":{type:"keyword",array:!1,required:!1},"agent.version":{type:"keyword",array:!1,required:!1},"client.address":{type:"keyword",array:!1,required:!1},"client.as.number":{type:"long",array:!1,required:!1},"client.as.organization.name":{type:"keyword",array:!1,required:!1},"client.bytes":{type:"long",array:!1,required:!1},"client.domain":{type:"keyword",array:!1,required:!1},"client.geo.city_name":{type:"keyword",array:!1,required:!1},"client.geo.continent_code":{type:"keyword",array:!1,required:!1},"client.geo.continent_name":{type:"keyword",array:!1,required:!1},"client.geo.country_iso_code":{type:"keyword",array:!1,required:!1},"client.geo.country_name":{type:"keyword",array:!1,required:!1},"client.geo.location":{type:"geo_point",array:!1,required:!1},"client.geo.name":{type:"keyword",array:!1,required:!1},"client.geo.postal_code":{type:"keyword",array:!1,required:!1},"client.geo.region_iso_code":{type:"keyword",array:!1,required:!1},"client.geo.region_name":{type:"keyword",array:!1,required:!1},"client.geo.timezone":{type:"keyword",array:!1,required:!1},"client.ip":{type:"ip",array:!1,required:!1},"client.mac":{type:"keyword",array:!1,required:!1},"client.nat.ip":{type:"ip",array:!1,required:!1},"client.nat.port":{type:"long",array:!1,required:!1},"client.packets":{type:"long",array:!1,required:!1},"client.port":{type:"long",array:!1,required:!1},"client.registered_domain":{type:"keyword",array:!1,required:!1},"client.subdomain":{type:"keyword",array:!1,required:!1},"client.top_level_domain":{type:"keyword",array:!1,required:!1},"client.user.domain":{type:"keyword",array:!1,required:!1},"client.user.email":{type:"keyword",array:!1,required:!1},"client.user.full_name":{type:"keyword",array:!1,required:!1},"client.user.group.domain":{type:"keyword",array:!1,required:!1},"client.user.group.id":{type:"keyword",array:!1,required:!1},"client.user.group.name":{type:"keyword",array:!1,required:!1},"client.user.hash":{type:"keyword",array:!1,required:!1},"client.user.id":{type:"keyword",array:!1,required:!1},"client.user.name":{type:"keyword",array:!1,required:!1},"client.user.roles":{type:"keyword",array:!0,required:!1},"cloud.account.id":{type:"keyword",array:!1,required:!1},"cloud.account.name":{type:"keyword",array:!1,required:!1},"cloud.availability_zone":{type:"keyword",array:!1,required:!1},"cloud.instance.id":{type:"keyword",array:!1,required:!1},"cloud.instance.name":{type:"keyword",array:!1,required:!1},"cloud.machine.type":{type:"keyword",array:!1,required:!1},"cloud.origin.account.id":{type:"keyword",array:!1,required:!1},"cloud.origin.account.name":{type:"keyword",array:!1,required:!1},"cloud.origin.availability_zone":{type:"keyword",array:!1,required:!1},"cloud.origin.instance.id":{type:"keyword",array:!1,required:!1},"cloud.origin.instance.name":{type:"keyword",array:!1,required:!1},"cloud.origin.machine.type":{type:"keyword",array:!1,required:!1},"cloud.origin.project.id":{type:"keyword",array:!1,required:!1},"cloud.origin.project.name":{type:"keyword",array:!1,required:!1},"cloud.origin.provider":{type:"keyword",array:!1,required:!1},"cloud.origin.region":{type:"keyword",array:!1,required:!1},"cloud.origin.service.name":{type:"keyword",array:!1,required:!1},"cloud.project.id":{type:"keyword",array:!1,required:!1},"cloud.project.name":{type:"keyword",array:!1,required:!1},"cloud.provider":{type:"keyword",array:!1,required:!1},"cloud.region":{type:"keyword",array:!1,required:!1},"cloud.service.name":{type:"keyword",array:!1,required:!1},"cloud.target.account.id":{type:"keyword",array:!1,required:!1},"cloud.target.account.name":{type:"keyword",array:!1,required:!1},"cloud.target.availability_zone":{type:"keyword",array:!1,required:!1},"cloud.target.instance.id":{type:"keyword",array:!1,required:!1},"cloud.target.instance.name":{type:"keyword",array:!1,required:!1},"cloud.target.machine.type":{type:"keyword",array:!1,required:!1},"cloud.target.project.id":{type:"keyword",array:!1,required:!1},"cloud.target.project.name":{type:"keyword",array:!1,required:!1},"cloud.target.provider":{type:"keyword",array:!1,required:!1},"cloud.target.region":{type:"keyword",array:!1,required:!1},"cloud.target.service.name":{type:"keyword",array:!1,required:!1},"container.id":{type:"keyword",array:!1,required:!1},"container.image.name":{type:"keyword",array:!1,required:!1},"container.image.tag":{type:"keyword",array:!0,required:!1},"container.labels":{type:"object",array:!1,required:!1},"container.name":{type:"keyword",array:!1,required:!1},"container.runtime":{type:"keyword",array:!1,required:!1},"destination.address":{type:"keyword",array:!1,required:!1},"destination.as.number":{type:"long",array:!1,required:!1},"destination.as.organization.name":{type:"keyword",array:!1,required:!1},"destination.bytes":{type:"long",array:!1,required:!1},"destination.domain":{type:"keyword",array:!1,required:!1},"destination.geo.city_name":{type:"keyword",array:!1,required:!1},"destination.geo.continent_code":{type:"keyword",array:!1,required:!1},"destination.geo.continent_name":{type:"keyword",array:!1,required:!1},"destination.geo.country_iso_code":{type:"keyword",array:!1,required:!1},"destination.geo.country_name":{type:"keyword",array:!1,required:!1},"destination.geo.location":{type:"geo_point",array:!1,required:!1},"destination.geo.name":{type:"keyword",array:!1,required:!1},"destination.geo.postal_code":{type:"keyword",array:!1,required:!1},"destination.geo.region_iso_code":{type:"keyword",array:!1,required:!1},"destination.geo.region_name":{type:"keyword",array:!1,required:!1},"destination.geo.timezone":{type:"keyword",array:!1,required:!1},"destination.ip":{type:"ip",array:!1,required:!1},"destination.mac":{type:"keyword",array:!1,required:!1},"destination.nat.ip":{type:"ip",array:!1,required:!1},"destination.nat.port":{type:"long",array:!1,required:!1},"destination.packets":{type:"long",array:!1,required:!1},"destination.port":{type:"long",array:!1,required:!1},"destination.registered_domain":{type:"keyword",array:!1,required:!1},"destination.subdomain":{type:"keyword",array:!1,required:!1},"destination.top_level_domain":{type:"keyword",array:!1,required:!1},"destination.user.domain":{type:"keyword",array:!1,required:!1},"destination.user.email":{type:"keyword",array:!1,required:!1},"destination.user.full_name":{type:"keyword",array:!1,required:!1},"destination.user.group.domain":{type:"keyword",array:!1,required:!1},"destination.user.group.id":{type:"keyword",array:!1,required:!1},"destination.user.group.name":{type:"keyword",array:!1,required:!1},"destination.user.hash":{type:"keyword",array:!1,required:!1},"destination.user.id":{type:"keyword",array:!1,required:!1},"destination.user.name":{type:"keyword",array:!1,required:!1},"destination.user.roles":{type:"keyword",array:!0,required:!1},"dll.code_signature.digest_algorithm":{type:"keyword",array:!1,required:!1},"dll.code_signature.exists":{type:"boolean",array:!1,required:!1},"dll.code_signature.signing_id":{type:"keyword",array:!1,required:!1},"dll.code_signature.status":{type:"keyword",array:!1,required:!1},"dll.code_signature.subject_name":{type:"keyword",array:!1,required:!1},"dll.code_signature.team_id":{type:"keyword",array:!1,required:!1},"dll.code_signature.timestamp":{type:"date",array:!1,required:!1},"dll.code_signature.trusted":{type:"boolean",array:!1,required:!1},"dll.code_signature.valid":{type:"boolean",array:!1,required:!1},"dll.hash.md5":{type:"keyword",array:!1,required:!1},"dll.hash.sha1":{type:"keyword",array:!1,required:!1},"dll.hash.sha256":{type:"keyword",array:!1,required:!1},"dll.hash.sha512":{type:"keyword",array:!1,required:!1},"dll.hash.ssdeep":{type:"keyword",array:!1,required:!1},"dll.name":{type:"keyword",array:!1,required:!1},"dll.path":{type:"keyword",array:!1,required:!1},"dll.pe.architecture":{type:"keyword",array:!1,required:!1},"dll.pe.company":{type:"keyword",array:!1,required:!1},"dll.pe.description":{type:"keyword",array:!1,required:!1},"dll.pe.file_version":{type:"keyword",array:!1,required:!1},"dll.pe.imphash":{type:"keyword",array:!1,required:!1},"dll.pe.original_file_name":{type:"keyword",array:!1,required:!1},"dll.pe.product":{type:"keyword",array:!1,required:!1},"dns.answers":{type:"object",array:!0,required:!1},"dns.answers.class":{type:"keyword",array:!1,required:!1},"dns.answers.data":{type:"keyword",array:!1,required:!1},"dns.answers.name":{type:"keyword",array:!1,required:!1},"dns.answers.ttl":{type:"long",array:!1,required:!1},"dns.answers.type":{type:"keyword",array:!1,required:!1},"dns.header_flags":{type:"keyword",array:!0,required:!1},"dns.id":{type:"keyword",array:!1,required:!1},"dns.op_code":{type:"keyword",array:!1,required:!1},"dns.question.class":{type:"keyword",array:!1,required:!1},"dns.question.name":{type:"keyword",array:!1,required:!1},"dns.question.registered_domain":{type:"keyword",array:!1,required:!1},"dns.question.subdomain":{type:"keyword",array:!1,required:!1},"dns.question.top_level_domain":{type:"keyword",array:!1,required:!1},"dns.question.type":{type:"keyword",array:!1,required:!1},"dns.resolved_ip":{type:"ip",array:!0,required:!1},"dns.response_code":{type:"keyword",array:!1,required:!1},"dns.type":{type:"keyword",array:!1,required:!1},"ecs.version":{type:"keyword",array:!1,required:!0},"error.code":{type:"keyword",array:!1,required:!1},"error.id":{type:"keyword",array:!1,required:!1},"error.message":{type:"match_only_text",array:!1,required:!1},"error.stack_trace":{type:"wildcard",array:!1,required:!1},"error.type":{type:"keyword",array:!1,required:!1},"event.action":{type:"keyword",array:!1,required:!1},"event.agent_id_status":{type:"keyword",array:!1,required:!1},"event.category":{type:"keyword",array:!0,required:!1},"event.code":{type:"keyword",array:!1,required:!1},"event.created":{type:"date",array:!1,required:!1},"event.dataset":{type:"keyword",array:!1,required:!1},"event.duration":{type:"long",array:!1,required:!1},"event.end":{type:"date",array:!1,required:!1},"event.hash":{type:"keyword",array:!1,required:!1},"event.id":{type:"keyword",array:!1,required:!1},"event.ingested":{type:"date",array:!1,required:!1},"event.kind":{type:"keyword",array:!1,required:!1},"event.module":{type:"keyword",array:!1,required:!1},"event.original":{type:"keyword",array:!1,required:!1},"event.outcome":{type:"keyword",array:!1,required:!1},"event.provider":{type:"keyword",array:!1,required:!1},"event.reason":{type:"keyword",array:!1,required:!1},"event.reference":{type:"keyword",array:!1,required:!1},"event.risk_score":{type:"float",array:!1,required:!1},"event.risk_score_norm":{type:"float",array:!1,required:!1},"event.sequence":{type:"long",array:!1,required:!1},"event.severity":{type:"long",array:!1,required:!1},"event.start":{type:"date",array:!1,required:!1},"event.timezone":{type:"keyword",array:!1,required:!1},"event.type":{type:"keyword",array:!0,required:!1},"event.url":{type:"keyword",array:!1,required:!1},"faas.coldstart":{type:"boolean",array:!1,required:!1},"faas.execution":{type:"keyword",array:!1,required:!1},"faas.trigger":{type:"nested",array:!1,required:!1},"faas.trigger.request_id":{type:"keyword",array:!1,required:!1},"faas.trigger.type":{type:"keyword",array:!1,required:!1},"file.accessed":{type:"date",array:!1,required:!1},"file.attributes":{type:"keyword",array:!0,required:!1},"file.code_signature.digest_algorithm":{type:"keyword",array:!1,required:!1},"file.code_signature.exists":{type:"boolean",array:!1,required:!1},"file.code_signature.signing_id":{type:"keyword",array:!1,required:!1},"file.code_signature.status":{type:"keyword",array:!1,required:!1},"file.code_signature.subject_name":{type:"keyword",array:!1,required:!1},"file.code_signature.team_id":{type:"keyword",array:!1,required:!1},"file.code_signature.timestamp":{type:"date",array:!1,required:!1},"file.code_signature.trusted":{type:"boolean",array:!1,required:!1},"file.code_signature.valid":{type:"boolean",array:!1,required:!1},"file.created":{type:"date",array:!1,required:!1},"file.ctime":{type:"date",array:!1,required:!1},"file.device":{type:"keyword",array:!1,required:!1},"file.directory":{type:"keyword",array:!1,required:!1},"file.drive_letter":{type:"keyword",array:!1,required:!1},"file.elf.architecture":{type:"keyword",array:!1,required:!1},"file.elf.byte_order":{type:"keyword",array:!1,required:!1},"file.elf.cpu_type":{type:"keyword",array:!1,required:!1},"file.elf.creation_date":{type:"date",array:!1,required:!1},"file.elf.exports":{type:"flattened",array:!0,required:!1},"file.elf.header.abi_version":{type:"keyword",array:!1,required:!1},"file.elf.header.class":{type:"keyword",array:!1,required:!1},"file.elf.header.data":{type:"keyword",array:!1,required:!1},"file.elf.header.entrypoint":{type:"long",array:!1,required:!1},"file.elf.header.object_version":{type:"keyword",array:!1,required:!1},"file.elf.header.os_abi":{type:"keyword",array:!1,required:!1},"file.elf.header.type":{type:"keyword",array:!1,required:!1},"file.elf.header.version":{type:"keyword",array:!1,required:!1},"file.elf.imports":{type:"flattened",array:!0,required:!1},"file.elf.sections":{type:"nested",array:!0,required:!1},"file.elf.sections.chi2":{type:"long",array:!1,required:!1},"file.elf.sections.entropy":{type:"long",array:!1,required:!1},"file.elf.sections.flags":{type:"keyword",array:!1,required:!1},"file.elf.sections.name":{type:"keyword",array:!1,required:!1},"file.elf.sections.physical_offset":{type:"keyword",array:!1,required:!1},"file.elf.sections.physical_size":{type:"long",array:!1,required:!1},"file.elf.sections.type":{type:"keyword",array:!1,required:!1},"file.elf.sections.virtual_address":{type:"long",array:!1,required:!1},"file.elf.sections.virtual_size":{type:"long",array:!1,required:!1},"file.elf.segments":{type:"nested",array:!0,required:!1},"file.elf.segments.sections":{type:"keyword",array:!1,required:!1},"file.elf.segments.type":{type:"keyword",array:!1,required:!1},"file.elf.shared_libraries":{type:"keyword",array:!0,required:!1},"file.elf.telfhash":{type:"keyword",array:!1,required:!1},"file.extension":{type:"keyword",array:!1,required:!1},"file.fork_name":{type:"keyword",array:!1,required:!1},"file.gid":{type:"keyword",array:!1,required:!1},"file.group":{type:"keyword",array:!1,required:!1},"file.hash.md5":{type:"keyword",array:!1,required:!1},"file.hash.sha1":{type:"keyword",array:!1,required:!1},"file.hash.sha256":{type:"keyword",array:!1,required:!1},"file.hash.sha512":{type:"keyword",array:!1,required:!1},"file.hash.ssdeep":{type:"keyword",array:!1,required:!1},"file.inode":{type:"keyword",array:!1,required:!1},"file.mime_type":{type:"keyword",array:!1,required:!1},"file.mode":{type:"keyword",array:!1,required:!1},"file.mtime":{type:"date",array:!1,required:!1},"file.name":{type:"keyword",array:!1,required:!1},"file.owner":{type:"keyword",array:!1,required:!1},"file.path":{type:"keyword",array:!1,required:!1},"file.pe.architecture":{type:"keyword",array:!1,required:!1},"file.pe.company":{type:"keyword",array:!1,required:!1},"file.pe.description":{type:"keyword",array:!1,required:!1},"file.pe.file_version":{type:"keyword",array:!1,required:!1},"file.pe.imphash":{type:"keyword",array:!1,required:!1},"file.pe.original_file_name":{type:"keyword",array:!1,required:!1},"file.pe.product":{type:"keyword",array:!1,required:!1},"file.size":{type:"long",array:!1,required:!1},"file.target_path":{type:"keyword",array:!1,required:!1},"file.type":{type:"keyword",array:!1,required:!1},"file.uid":{type:"keyword",array:!1,required:!1},"file.x509.alternative_names":{type:"keyword",array:!0,required:!1},"file.x509.issuer.common_name":{type:"keyword",array:!0,required:!1},"file.x509.issuer.country":{type:"keyword",array:!0,required:!1},"file.x509.issuer.distinguished_name":{type:"keyword",array:!1,required:!1},"file.x509.issuer.locality":{type:"keyword",array:!0,required:!1},"file.x509.issuer.organization":{type:"keyword",array:!0,required:!1},"file.x509.issuer.organizational_unit":{type:"keyword",array:!0,required:!1},"file.x509.issuer.state_or_province":{type:"keyword",array:!0,required:!1},"file.x509.not_after":{type:"date",array:!1,required:!1},"file.x509.not_before":{type:"date",array:!1,required:!1},"file.x509.public_key_algorithm":{type:"keyword",array:!1,required:!1},"file.x509.public_key_curve":{type:"keyword",array:!1,required:!1},"file.x509.public_key_exponent":{type:"long",array:!1,required:!1},"file.x509.public_key_size":{type:"long",array:!1,required:!1},"file.x509.serial_number":{type:"keyword",array:!1,required:!1},"file.x509.signature_algorithm":{type:"keyword",array:!1,required:!1},"file.x509.subject.common_name":{type:"keyword",array:!0,required:!1},"file.x509.subject.country":{type:"keyword",array:!0,required:!1},"file.x509.subject.distinguished_name":{type:"keyword",array:!1,required:!1},"file.x509.subject.locality":{type:"keyword",array:!0,required:!1},"file.x509.subject.organization":{type:"keyword",array:!0,required:!1},"file.x509.subject.organizational_unit":{type:"keyword",array:!0,required:!1},"file.x509.subject.state_or_province":{type:"keyword",array:!0,required:!1},"file.x509.version_number":{type:"keyword",array:!1,required:!1},"group.domain":{type:"keyword",array:!1,required:!1},"group.id":{type:"keyword",array:!1,required:!1},"group.name":{type:"keyword",array:!1,required:!1},"host.architecture":{type:"keyword",array:!1,required:!1},"host.boot.id":{type:"keyword",array:!1,required:!1},"host.cpu.usage":{type:"scaled_float",array:!1,required:!1,scaling_factor:1e3},"host.disk.read.bytes":{type:"long",array:!1,required:!1},"host.disk.write.bytes":{type:"long",array:!1,required:!1},"host.domain":{type:"keyword",array:!1,required:!1},"host.geo.city_name":{type:"keyword",array:!1,required:!1},"host.geo.continent_code":{type:"keyword",array:!1,required:!1},"host.geo.continent_name":{type:"keyword",array:!1,required:!1},"host.geo.country_iso_code":{type:"keyword",array:!1,required:!1},"host.geo.country_name":{type:"keyword",array:!1,required:!1},"host.geo.location":{type:"geo_point",array:!1,required:!1},"host.geo.name":{type:"keyword",array:!1,required:!1},"host.geo.postal_code":{type:"keyword",array:!1,required:!1},"host.geo.region_iso_code":{type:"keyword",array:!1,required:!1},"host.geo.region_name":{type:"keyword",array:!1,required:!1},"host.geo.timezone":{type:"keyword",array:!1,required:!1},"host.hostname":{type:"keyword",array:!1,required:!1},"host.id":{type:"keyword",array:!1,required:!1},"host.ip":{type:"ip",array:!0,required:!1},"host.mac":{type:"keyword",array:!0,required:!1},"host.name":{type:"keyword",array:!1,required:!1},"host.network.egress.bytes":{type:"long",array:!1,required:!1},"host.network.egress.packets":{type:"long",array:!1,required:!1},"host.network.ingress.bytes":{type:"long",array:!1,required:!1},"host.network.ingress.packets":{type:"long",array:!1,required:!1},"host.os.family":{type:"keyword",array:!1,required:!1},"host.os.full":{type:"keyword",array:!1,required:!1},"host.os.kernel":{type:"keyword",array:!1,required:!1},"host.os.name":{type:"keyword",array:!1,required:!1},"host.os.platform":{type:"keyword",array:!1,required:!1},"host.os.type":{type:"keyword",array:!1,required:!1},"host.os.version":{type:"keyword",array:!1,required:!1},"host.pid_ns_ino":{type:"keyword",array:!1,required:!1},"host.risk.calculated_level":{type:"keyword",array:!1,required:!1},"host.risk.calculated_score":{type:"float",array:!1,required:!1},"host.risk.calculated_score_norm":{type:"float",array:!1,required:!1},"host.risk.static_level":{type:"keyword",array:!1,required:!1},"host.risk.static_score":{type:"float",array:!1,required:!1},"host.risk.static_score_norm":{type:"float",array:!1,required:!1},"host.type":{type:"keyword",array:!1,required:!1},"host.uptime":{type:"long",array:!1,required:!1},"http.request.body.bytes":{type:"long",array:!1,required:!1},"http.request.body.content":{type:"wildcard",array:!1,required:!1},"http.request.bytes":{type:"long",array:!1,required:!1},"http.request.id":{type:"keyword",array:!1,required:!1},"http.request.method":{type:"keyword",array:!1,required:!1},"http.request.mime_type":{type:"keyword",array:!1,required:!1},"http.request.referrer":{type:"keyword",array:!1,required:!1},"http.response.body.bytes":{type:"long",array:!1,required:!1},"http.response.body.content":{type:"wildcard",array:!1,required:!1},"http.response.bytes":{type:"long",array:!1,required:!1},"http.response.mime_type":{type:"keyword",array:!1,required:!1},"http.response.status_code":{type:"long",array:!1,required:!1},"http.version":{type:"keyword",array:!1,required:!1},labels:{type:"object",array:!1,required:!1},"log.file.path":{type:"keyword",array:!1,required:!1},"log.level":{type:"keyword",array:!1,required:!1},"log.logger":{type:"keyword",array:!1,required:!1},"log.origin.file.line":{type:"long",array:!1,required:!1},"log.origin.file.name":{type:"keyword",array:!1,required:!1},"log.origin.function":{type:"keyword",array:!1,required:!1},"log.syslog":{type:"object",array:!1,required:!1},"log.syslog.facility.code":{type:"long",array:!1,required:!1},"log.syslog.facility.name":{type:"keyword",array:!1,required:!1},"log.syslog.priority":{type:"long",array:!1,required:!1},"log.syslog.severity.code":{type:"long",array:!1,required:!1},"log.syslog.severity.name":{type:"keyword",array:!1,required:!1},message:{type:"match_only_text",array:!1,required:!1},"network.application":{type:"keyword",array:!1,required:!1},"network.bytes":{type:"long",array:!1,required:!1},"network.community_id":{type:"keyword",array:!1,required:!1},"network.direction":{type:"keyword",array:!1,required:!1},"network.forwarded_ip":{type:"ip",array:!1,required:!1},"network.iana_number":{type:"keyword",array:!1,required:!1},"network.inner":{type:"object",array:!1,required:!1},"network.inner.vlan.id":{type:"keyword",array:!1,required:!1},"network.inner.vlan.name":{type:"keyword",array:!1,required:!1},"network.name":{type:"keyword",array:!1,required:!1},"network.packets":{type:"long",array:!1,required:!1},"network.protocol":{type:"keyword",array:!1,required:!1},"network.transport":{type:"keyword",array:!1,required:!1},"network.type":{type:"keyword",array:!1,required:!1},"network.vlan.id":{type:"keyword",array:!1,required:!1},"network.vlan.name":{type:"keyword",array:!1,required:!1},"observer.egress":{type:"object",array:!1,required:!1},"observer.egress.interface.alias":{type:"keyword",array:!1,required:!1},"observer.egress.interface.id":{type:"keyword",array:!1,required:!1},"observer.egress.interface.name":{type:"keyword",array:!1,required:!1},"observer.egress.vlan.id":{type:"keyword",array:!1,required:!1},"observer.egress.vlan.name":{type:"keyword",array:!1,required:!1},"observer.egress.zone":{type:"keyword",array:!1,required:!1},"observer.geo.city_name":{type:"keyword",array:!1,required:!1},"observer.geo.continent_code":{type:"keyword",array:!1,required:!1},"observer.geo.continent_name":{type:"keyword",array:!1,required:!1},"observer.geo.country_iso_code":{type:"keyword",array:!1,required:!1},"observer.geo.country_name":{type:"keyword",array:!1,required:!1},"observer.geo.location":{type:"geo_point",array:!1,required:!1},"observer.geo.name":{type:"keyword",array:!1,required:!1},"observer.geo.postal_code":{type:"keyword",array:!1,required:!1},"observer.geo.region_iso_code":{type:"keyword",array:!1,required:!1},"observer.geo.region_name":{type:"keyword",array:!1,required:!1},"observer.geo.timezone":{type:"keyword",array:!1,required:!1},"observer.hostname":{type:"keyword",array:!1,required:!1},"observer.ingress":{type:"object",array:!1,required:!1},"observer.ingress.interface.alias":{type:"keyword",array:!1,required:!1},"observer.ingress.interface.id":{type:"keyword",array:!1,required:!1},"observer.ingress.interface.name":{type:"keyword",array:!1,required:!1},"observer.ingress.vlan.id":{type:"keyword",array:!1,required:!1},"observer.ingress.vlan.name":{type:"keyword",array:!1,required:!1},"observer.ingress.zone":{type:"keyword",array:!1,required:!1},"observer.ip":{type:"ip",array:!0,required:!1},"observer.mac":{type:"keyword",array:!0,required:!1},"observer.name":{type:"keyword",array:!1,required:!1},"observer.os.family":{type:"keyword",array:!1,required:!1},"observer.os.full":{type:"keyword",array:!1,required:!1},"observer.os.kernel":{type:"keyword",array:!1,required:!1},"observer.os.name":{type:"keyword",array:!1,required:!1},"observer.os.platform":{type:"keyword",array:!1,required:!1},"observer.os.type":{type:"keyword",array:!1,required:!1},"observer.os.version":{type:"keyword",array:!1,required:!1},"observer.product":{type:"keyword",array:!1,required:!1},"observer.serial_number":{type:"keyword",array:!1,required:!1},"observer.type":{type:"keyword",array:!1,required:!1},"observer.vendor":{type:"keyword",array:!1,required:!1},"observer.version":{type:"keyword",array:!1,required:!1},"orchestrator.api_version":{type:"keyword",array:!1,required:!1},"orchestrator.cluster.id":{type:"keyword",array:!1,required:!1},"orchestrator.cluster.name":{type:"keyword",array:!1,required:!1},"orchestrator.cluster.url":{type:"keyword",array:!1,required:!1},"orchestrator.cluster.version":{type:"keyword",array:!1,required:!1},"orchestrator.namespace":{type:"keyword",array:!1,required:!1},"orchestrator.organization":{type:"keyword",array:!1,required:!1},"orchestrator.resource.id":{type:"keyword",array:!1,required:!1},"orchestrator.resource.ip":{type:"ip",array:!0,required:!1},"orchestrator.resource.name":{type:"keyword",array:!1,required:!1},"orchestrator.resource.parent.type":{type:"keyword",array:!1,required:!1},"orchestrator.resource.type":{type:"keyword",array:!1,required:!1},"orchestrator.type":{type:"keyword",array:!1,required:!1},"organization.id":{type:"keyword",array:!1,required:!1},"organization.name":{type:"keyword",array:!1,required:!1},"package.architecture":{type:"keyword",array:!1,required:!1},"package.build_version":{type:"keyword",array:!1,required:!1},"package.checksum":{type:"keyword",array:!1,required:!1},"package.description":{type:"keyword",array:!1,required:!1},"package.install_scope":{type:"keyword",array:!1,required:!1},"package.installed":{type:"date",array:!1,required:!1},"package.license":{type:"keyword",array:!1,required:!1},"package.name":{type:"keyword",array:!1,required:!1},"package.path":{type:"keyword",array:!1,required:!1},"package.reference":{type:"keyword",array:!1,required:!1},"package.size":{type:"long",array:!1,required:!1},"package.type":{type:"keyword",array:!1,required:!1},"package.version":{type:"keyword",array:!1,required:!1},"process.args":{type:"keyword",array:!0,required:!1},"process.args_count":{type:"long",array:!1,required:!1},"process.code_signature.digest_algorithm":{type:"keyword",array:!1,required:!1},"process.code_signature.exists":{type:"boolean",array:!1,required:!1},"process.code_signature.signing_id":{type:"keyword",array:!1,required:!1},"process.code_signature.status":{type:"keyword",array:!1,required:!1},"process.code_signature.subject_name":{type:"keyword",array:!1,required:!1},"process.code_signature.team_id":{type:"keyword",array:!1,required:!1},"process.code_signature.timestamp":{type:"date",array:!1,required:!1},"process.code_signature.trusted":{type:"boolean",array:!1,required:!1},"process.code_signature.valid":{type:"boolean",array:!1,required:!1},"process.command_line":{type:"wildcard",array:!1,required:!1},"process.elf.architecture":{type:"keyword",array:!1,required:!1},"process.elf.byte_order":{type:"keyword",array:!1,required:!1},"process.elf.cpu_type":{type:"keyword",array:!1,required:!1},"process.elf.creation_date":{type:"date",array:!1,required:!1},"process.elf.exports":{type:"flattened",array:!0,required:!1},"process.elf.header.abi_version":{type:"keyword",array:!1,required:!1},"process.elf.header.class":{type:"keyword",array:!1,required:!1},"process.elf.header.data":{type:"keyword",array:!1,required:!1},"process.elf.header.entrypoint":{type:"long",array:!1,required:!1},"process.elf.header.object_version":{type:"keyword",array:!1,required:!1},"process.elf.header.os_abi":{type:"keyword",array:!1,required:!1},"process.elf.header.type":{type:"keyword",array:!1,required:!1},"process.elf.header.version":{type:"keyword",array:!1,required:!1},"process.elf.imports":{type:"flattened",array:!0,required:!1},"process.elf.sections":{type:"nested",array:!0,required:!1},"process.elf.sections.chi2":{type:"long",array:!1,required:!1},"process.elf.sections.entropy":{type:"long",array:!1,required:!1},"process.elf.sections.flags":{type:"keyword",array:!1,required:!1},"process.elf.sections.name":{type:"keyword",array:!1,required:!1},"process.elf.sections.physical_offset":{type:"keyword",array:!1,required:!1},"process.elf.sections.physical_size":{type:"long",array:!1,required:!1},"process.elf.sections.type":{type:"keyword",array:!1,required:!1},"process.elf.sections.virtual_address":{type:"long",array:!1,required:!1},"process.elf.sections.virtual_size":{type:"long",array:!1,required:!1},"process.elf.segments":{type:"nested",array:!0,required:!1},"process.elf.segments.sections":{type:"keyword",array:!1,required:!1},"process.elf.segments.type":{type:"keyword",array:!1,required:!1},"process.elf.shared_libraries":{type:"keyword",array:!0,required:!1},"process.elf.telfhash":{type:"keyword",array:!1,required:!1},"process.end":{type:"date",array:!1,required:!1},"process.entity_id":{type:"keyword",array:!1,required:!1},"process.entry_leader.entity_id":{type:"keyword",array:!1,required:!1},"process.executable":{type:"keyword",array:!1,required:!1},"process.exit_code":{type:"long",array:!1,required:!1},"process.hash.md5":{type:"keyword",array:!1,required:!1},"process.hash.sha1":{type:"keyword",array:!1,required:!1},"process.hash.sha256":{type:"keyword",array:!1,required:!1},"process.hash.sha512":{type:"keyword",array:!1,required:!1},"process.hash.ssdeep":{type:"keyword",array:!1,required:!1},"process.name":{type:"keyword",array:!1,required:!1},"process.parent.args":{type:"keyword",array:!0,required:!1},"process.parent.args_count":{type:"long",array:!1,required:!1},"process.parent.code_signature.digest_algorithm":{type:"keyword",array:!1,required:!1},"process.parent.code_signature.exists":{type:"boolean",array:!1,required:!1},"process.parent.code_signature.signing_id":{type:"keyword",array:!1,required:!1},"process.parent.code_signature.status":{type:"keyword",array:!1,required:!1},"process.parent.code_signature.subject_name":{type:"keyword",array:!1,required:!1},"process.parent.code_signature.team_id":{type:"keyword",array:!1,required:!1},"process.parent.code_signature.timestamp":{type:"date",array:!1,required:!1},"process.parent.code_signature.trusted":{type:"boolean",array:!1,required:!1},"process.parent.code_signature.valid":{type:"boolean",array:!1,required:!1},"process.parent.command_line":{type:"wildcard",array:!1,required:!1},"process.parent.elf.architecture":{type:"keyword",array:!1,required:!1},"process.parent.elf.byte_order":{type:"keyword",array:!1,required:!1},"process.parent.elf.cpu_type":{type:"keyword",array:!1,required:!1},"process.parent.elf.creation_date":{type:"date",array:!1,required:!1},"process.parent.elf.exports":{type:"flattened",array:!0,required:!1},"process.parent.elf.header.abi_version":{type:"keyword",array:!1,required:!1},"process.parent.elf.header.class":{type:"keyword",array:!1,required:!1},"process.parent.elf.header.data":{type:"keyword",array:!1,required:!1},"process.parent.elf.header.entrypoint":{type:"long",array:!1,required:!1},"process.parent.elf.header.object_version":{type:"keyword",array:!1,required:!1},"process.parent.elf.header.os_abi":{type:"keyword",array:!1,required:!1},"process.parent.elf.header.type":{type:"keyword",array:!1,required:!1},"process.parent.elf.header.version":{type:"keyword",array:!1,required:!1},"process.parent.elf.imports":{type:"flattened",array:!0,required:!1},"process.parent.elf.sections":{type:"nested",array:!0,required:!1},"process.parent.elf.sections.chi2":{type:"long",array:!1,required:!1},"process.parent.elf.sections.entropy":{type:"long",array:!1,required:!1},"process.parent.elf.sections.flags":{type:"keyword",array:!1,required:!1},"process.parent.elf.sections.name":{type:"keyword",array:!1,required:!1},"process.parent.elf.sections.physical_offset":{type:"keyword",array:!1,required:!1},"process.parent.elf.sections.physical_size":{type:"long",array:!1,required:!1},"process.parent.elf.sections.type":{type:"keyword",array:!1,required:!1},"process.parent.elf.sections.virtual_address":{type:"long",array:!1,required:!1},"process.parent.elf.sections.virtual_size":{type:"long",array:!1,required:!1},"process.parent.elf.segments":{type:"nested",array:!0,required:!1},"process.parent.elf.segments.sections":{type:"keyword",array:!1,required:!1},"process.parent.elf.segments.type":{type:"keyword",array:!1,required:!1},"process.parent.elf.shared_libraries":{type:"keyword",array:!0,required:!1},"process.parent.elf.telfhash":{type:"keyword",array:!1,required:!1},"process.parent.end":{type:"date",array:!1,required:!1},"process.parent.entity_id":{type:"keyword",array:!1,required:!1},"process.parent.executable":{type:"keyword",array:!1,required:!1},"process.parent.exit_code":{type:"long",array:!1,required:!1},"process.parent.hash.md5":{type:"keyword",array:!1,required:!1},"process.parent.hash.sha1":{type:"keyword",array:!1,required:!1},"process.parent.hash.sha256":{type:"keyword",array:!1,required:!1},"process.parent.hash.sha512":{type:"keyword",array:!1,required:!1},"process.parent.hash.ssdeep":{type:"keyword",array:!1,required:!1},"process.parent.name":{type:"keyword",array:!1,required:!1},"process.parent.pe.architecture":{type:"keyword",array:!1,required:!1},"process.parent.pe.company":{type:"keyword",array:!1,required:!1},"process.parent.pe.description":{type:"keyword",array:!1,required:!1},"process.parent.pe.file_version":{type:"keyword",array:!1,required:!1},"process.parent.pe.imphash":{type:"keyword",array:!1,required:!1},"process.parent.pe.original_file_name":{type:"keyword",array:!1,required:!1},"process.parent.pe.product":{type:"keyword",array:!1,required:!1},"process.parent.pgid":{type:"long",array:!1,required:!1},"process.parent.pid":{type:"long",array:!1,required:!1},"process.parent.start":{type:"date",array:!1,required:!1},"process.parent.thread.id":{type:"long",array:!1,required:!1},"process.parent.thread.name":{type:"keyword",array:!1,required:!1},"process.parent.title":{type:"keyword",array:!1,required:!1},"process.parent.uptime":{type:"long",array:!1,required:!1},"process.parent.working_directory":{type:"keyword",array:!1,required:!1},"process.pe.architecture":{type:"keyword",array:!1,required:!1},"process.pe.company":{type:"keyword",array:!1,required:!1},"process.pe.description":{type:"keyword",array:!1,required:!1},"process.pe.file_version":{type:"keyword",array:!1,required:!1},"process.pe.imphash":{type:"keyword",array:!1,required:!1},"process.pe.original_file_name":{type:"keyword",array:!1,required:!1},"process.pe.product":{type:"keyword",array:!1,required:!1},"process.pgid":{type:"long",array:!1,required:!1},"process.pid":{type:"long",array:!1,required:!1},"process.session_leader.entity_id":{type:"keyword",array:!1,required:!1},"process.start":{type:"date",array:!1,required:!1},"process.thread.id":{type:"long",array:!1,required:!1},"process.thread.name":{type:"keyword",array:!1,required:!1},"process.title":{type:"keyword",array:!1,required:!1},"process.uptime":{type:"long",array:!1,required:!1},"process.working_directory":{type:"keyword",array:!1,required:!1},"registry.data.bytes":{type:"keyword",array:!1,required:!1},"registry.data.strings":{type:"wildcard",array:!0,required:!1},"registry.data.type":{type:"keyword",array:!1,required:!1},"registry.hive":{type:"keyword",array:!1,required:!1},"registry.key":{type:"keyword",array:!1,required:!1},"registry.path":{type:"keyword",array:!1,required:!1},"registry.value":{type:"keyword",array:!1,required:!1},"related.hash":{type:"keyword",array:!0,required:!1},"related.hosts":{type:"keyword",array:!0,required:!1},"related.ip":{type:"ip",array:!0,required:!1},"related.user":{type:"keyword",array:!0,required:!1},"rule.author":{type:"keyword",array:!0,required:!1},"rule.category":{type:"keyword",array:!1,required:!1},"rule.description":{type:"keyword",array:!1,required:!1},"rule.id":{type:"keyword",array:!1,required:!1},"rule.license":{type:"keyword",array:!1,required:!1},"rule.name":{type:"keyword",array:!1,required:!1},"rule.reference":{type:"keyword",array:!1,required:!1},"rule.ruleset":{type:"keyword",array:!1,required:!1},"rule.uuid":{type:"keyword",array:!1,required:!1},"rule.version":{type:"keyword",array:!1,required:!1},"server.address":{type:"keyword",array:!1,required:!1},"server.as.number":{type:"long",array:!1,required:!1},"server.as.organization.name":{type:"keyword",array:!1,required:!1},"server.bytes":{type:"long",array:!1,required:!1},"server.domain":{type:"keyword",array:!1,required:!1},"server.geo.city_name":{type:"keyword",array:!1,required:!1},"server.geo.continent_code":{type:"keyword",array:!1,required:!1},"server.geo.continent_name":{type:"keyword",array:!1,required:!1},"server.geo.country_iso_code":{type:"keyword",array:!1,required:!1},"server.geo.country_name":{type:"keyword",array:!1,required:!1},"server.geo.location":{type:"geo_point",array:!1,required:!1},"server.geo.name":{type:"keyword",array:!1,required:!1},"server.geo.postal_code":{type:"keyword",array:!1,required:!1},"server.geo.region_iso_code":{type:"keyword",array:!1,required:!1},"server.geo.region_name":{type:"keyword",array:!1,required:!1},"server.geo.timezone":{type:"keyword",array:!1,required:!1},"server.ip":{type:"ip",array:!1,required:!1},"server.mac":{type:"keyword",array:!1,required:!1},"server.nat.ip":{type:"ip",array:!1,required:!1},"server.nat.port":{type:"long",array:!1,required:!1},"server.packets":{type:"long",array:!1,required:!1},"server.port":{type:"long",array:!1,required:!1},"server.registered_domain":{type:"keyword",array:!1,required:!1},"server.subdomain":{type:"keyword",array:!1,required:!1},"server.top_level_domain":{type:"keyword",array:!1,required:!1},"server.user.domain":{type:"keyword",array:!1,required:!1},"server.user.email":{type:"keyword",array:!1,required:!1},"server.user.full_name":{type:"keyword",array:!1,required:!1},"server.user.group.domain":{type:"keyword",array:!1,required:!1},"server.user.group.id":{type:"keyword",array:!1,required:!1},"server.user.group.name":{type:"keyword",array:!1,required:!1},"server.user.hash":{type:"keyword",array:!1,required:!1},"server.user.id":{type:"keyword",array:!1,required:!1},"server.user.name":{type:"keyword",array:!1,required:!1},"server.user.roles":{type:"keyword",array:!0,required:!1},"service.address":{type:"keyword",array:!1,required:!1},"service.environment":{type:"keyword",array:!1,required:!1},"service.ephemeral_id":{type:"keyword",array:!1,required:!1},"service.id":{type:"keyword",array:!1,required:!1},"service.name":{type:"keyword",array:!1,required:!1},"service.node.name":{type:"keyword",array:!1,required:!1},"service.origin.address":{type:"keyword",array:!1,required:!1},"service.origin.environment":{type:"keyword",array:!1,required:!1},"service.origin.ephemeral_id":{type:"keyword",array:!1,required:!1},"service.origin.id":{type:"keyword",array:!1,required:!1},"service.origin.name":{type:"keyword",array:!1,required:!1},"service.origin.node.name":{type:"keyword",array:!1,required:!1},"service.origin.state":{type:"keyword",array:!1,required:!1},"service.origin.type":{type:"keyword",array:!1,required:!1},"service.origin.version":{type:"keyword",array:!1,required:!1},"service.state":{type:"keyword",array:!1,required:!1},"service.target.address":{type:"keyword",array:!1,required:!1},"service.target.environment":{type:"keyword",array:!1,required:!1},"service.target.ephemeral_id":{type:"keyword",array:!1,required:!1},"service.target.id":{type:"keyword",array:!1,required:!1},"service.target.name":{type:"keyword",array:!1,required:!1},"service.target.node.name":{type:"keyword",array:!1,required:!1},"service.target.state":{type:"keyword",array:!1,required:!1},"service.target.type":{type:"keyword",array:!1,required:!1},"service.target.version":{type:"keyword",array:!1,required:!1},"service.type":{type:"keyword",array:!1,required:!1},"service.version":{type:"keyword",array:!1,required:!1},"source.address":{type:"keyword",array:!1,required:!1},"source.as.number":{type:"long",array:!1,required:!1},"source.as.organization.name":{type:"keyword",array:!1,required:!1},"source.bytes":{type:"long",array:!1,required:!1},"source.domain":{type:"keyword",array:!1,required:!1},"source.geo.city_name":{type:"keyword",array:!1,required:!1},"source.geo.continent_code":{type:"keyword",array:!1,required:!1},"source.geo.continent_name":{type:"keyword",array:!1,required:!1},"source.geo.country_iso_code":{type:"keyword",array:!1,required:!1},"source.geo.country_name":{type:"keyword",array:!1,required:!1},"source.geo.location":{type:"geo_point",array:!1,required:!1},"source.geo.name":{type:"keyword",array:!1,required:!1},"source.geo.postal_code":{type:"keyword",array:!1,required:!1},"source.geo.region_iso_code":{type:"keyword",array:!1,required:!1},"source.geo.region_name":{type:"keyword",array:!1,required:!1},"source.geo.timezone":{type:"keyword",array:!1,required:!1},"source.ip":{type:"ip",array:!1,required:!1},"source.mac":{type:"keyword",array:!1,required:!1},"source.nat.ip":{type:"ip",array:!1,required:!1},"source.nat.port":{type:"long",array:!1,required:!1},"source.packets":{type:"long",array:!1,required:!1},"source.port":{type:"long",array:!1,required:!1},"source.registered_domain":{type:"keyword",array:!1,required:!1},"source.subdomain":{type:"keyword",array:!1,required:!1},"source.top_level_domain":{type:"keyword",array:!1,required:!1},"source.user.domain":{type:"keyword",array:!1,required:!1},"source.user.email":{type:"keyword",array:!1,required:!1},"source.user.full_name":{type:"keyword",array:!1,required:!1},"source.user.group.domain":{type:"keyword",array:!1,required:!1},"source.user.group.id":{type:"keyword",array:!1,required:!1},"source.user.group.name":{type:"keyword",array:!1,required:!1},"source.user.hash":{type:"keyword",array:!1,required:!1},"source.user.id":{type:"keyword",array:!1,required:!1},"source.user.name":{type:"keyword",array:!1,required:!1},"source.user.roles":{type:"keyword",array:!0,required:!1},"span.id":{type:"keyword",array:!1,required:!1},tags:{type:"keyword",array:!0,required:!1},"threat.enrichments":{type:"nested",array:!0,required:!1},"threat.enrichments.indicator":{type:"object",array:!1,required:!1},"threat.enrichments.indicator.as.number":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.as.organization.name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.confidence":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.description":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.email.address":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.accessed":{type:"date",array:!1,required:!1},"threat.enrichments.indicator.file.attributes":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.code_signature.digest_algorithm":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.code_signature.exists":{type:"boolean",array:!1,required:!1},"threat.enrichments.indicator.file.code_signature.signing_id":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.code_signature.status":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.code_signature.subject_name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.code_signature.team_id":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.code_signature.timestamp":{type:"date",array:!1,required:!1},"threat.enrichments.indicator.file.code_signature.trusted":{type:"boolean",array:!1,required:!1},"threat.enrichments.indicator.file.code_signature.valid":{type:"boolean",array:!1,required:!1},"threat.enrichments.indicator.file.created":{type:"date",array:!1,required:!1},"threat.enrichments.indicator.file.ctime":{type:"date",array:!1,required:!1},"threat.enrichments.indicator.file.device":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.directory":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.drive_letter":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.architecture":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.byte_order":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.cpu_type":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.creation_date":{type:"date",array:!1,required:!1},"threat.enrichments.indicator.file.elf.exports":{type:"flattened",array:!0,required:!1},"threat.enrichments.indicator.file.elf.header.abi_version":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.header.class":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.header.data":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.header.entrypoint":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.file.elf.header.object_version":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.header.os_abi":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.header.type":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.header.version":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.imports":{type:"flattened",array:!0,required:!1},"threat.enrichments.indicator.file.elf.sections":{type:"nested",array:!0,required:!1},"threat.enrichments.indicator.file.elf.sections.chi2":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.file.elf.sections.entropy":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.file.elf.sections.flags":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.sections.name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.sections.physical_offset":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.sections.physical_size":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.file.elf.sections.type":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.sections.virtual_address":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.file.elf.sections.virtual_size":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.file.elf.segments":{type:"nested",array:!0,required:!1},"threat.enrichments.indicator.file.elf.segments.sections":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.segments.type":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.elf.shared_libraries":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.elf.telfhash":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.extension":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.fork_name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.gid":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.group":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.hash.md5":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.hash.sha1":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.hash.sha256":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.hash.sha512":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.hash.ssdeep":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.inode":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.mime_type":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.mode":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.mtime":{type:"date",array:!1,required:!1},"threat.enrichments.indicator.file.name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.owner":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.path":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.pe.architecture":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.pe.company":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.pe.description":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.pe.file_version":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.pe.imphash":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.pe.original_file_name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.pe.product":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.size":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.file.target_path":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.type":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.uid":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.x509.alternative_names":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.x509.issuer.common_name":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.x509.issuer.country":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.x509.issuer.distinguished_name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.x509.issuer.locality":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.x509.issuer.organization":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.x509.issuer.organizational_unit":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.x509.issuer.state_or_province":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.x509.not_after":{type:"date",array:!1,required:!1},"threat.enrichments.indicator.file.x509.not_before":{type:"date",array:!1,required:!1},"threat.enrichments.indicator.file.x509.public_key_algorithm":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.x509.public_key_curve":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.x509.public_key_exponent":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.file.x509.public_key_size":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.file.x509.serial_number":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.x509.signature_algorithm":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.x509.subject.common_name":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.x509.subject.country":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.x509.subject.distinguished_name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.file.x509.subject.locality":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.x509.subject.organization":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.x509.subject.organizational_unit":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.x509.subject.state_or_province":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.file.x509.version_number":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.first_seen":{type:"date",array:!1,required:!1},"threat.enrichments.indicator.geo.city_name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.geo.continent_code":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.geo.continent_name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.geo.country_iso_code":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.geo.country_name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.geo.location":{type:"geo_point",array:!1,required:!1},"threat.enrichments.indicator.geo.name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.geo.postal_code":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.geo.region_iso_code":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.geo.region_name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.geo.timezone":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.ip":{type:"ip",array:!1,required:!1},"threat.enrichments.indicator.last_seen":{type:"date",array:!1,required:!1},"threat.enrichments.indicator.marking.tlp":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.modified_at":{type:"date",array:!1,required:!1},"threat.enrichments.indicator.port":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.provider":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.reference":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.registry.data.bytes":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.registry.data.strings":{type:"wildcard",array:!0,required:!1},"threat.enrichments.indicator.registry.data.type":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.registry.hive":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.registry.key":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.registry.path":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.registry.value":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.scanner_stats":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.sightings":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.type":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.url.domain":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.url.extension":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.url.fragment":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.url.full":{type:"wildcard",array:!1,required:!1},"threat.enrichments.indicator.url.original":{type:"wildcard",array:!1,required:!1},"threat.enrichments.indicator.url.password":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.url.path":{type:"wildcard",array:!1,required:!1},"threat.enrichments.indicator.url.port":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.url.query":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.url.registered_domain":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.url.scheme":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.url.subdomain":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.url.top_level_domain":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.url.username":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.x509.alternative_names":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.x509.issuer.common_name":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.x509.issuer.country":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.x509.issuer.distinguished_name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.x509.issuer.locality":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.x509.issuer.organization":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.x509.issuer.organizational_unit":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.x509.issuer.state_or_province":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.x509.not_after":{type:"date",array:!1,required:!1},"threat.enrichments.indicator.x509.not_before":{type:"date",array:!1,required:!1},"threat.enrichments.indicator.x509.public_key_algorithm":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.x509.public_key_curve":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.x509.public_key_exponent":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.x509.public_key_size":{type:"long",array:!1,required:!1},"threat.enrichments.indicator.x509.serial_number":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.x509.signature_algorithm":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.x509.subject.common_name":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.x509.subject.country":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.x509.subject.distinguished_name":{type:"keyword",array:!1,required:!1},"threat.enrichments.indicator.x509.subject.locality":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.x509.subject.organization":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.x509.subject.organizational_unit":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.x509.subject.state_or_province":{type:"keyword",array:!0,required:!1},"threat.enrichments.indicator.x509.version_number":{type:"keyword",array:!1,required:!1},"threat.enrichments.matched.atomic":{type:"keyword",array:!1,required:!1},"threat.enrichments.matched.field":{type:"keyword",array:!1,required:!1},"threat.enrichments.matched.id":{type:"keyword",array:!1,required:!1},"threat.enrichments.matched.index":{type:"keyword",array:!1,required:!1},"threat.enrichments.matched.type":{type:"keyword",array:!1,required:!1},"threat.framework":{type:"keyword",array:!1,required:!1},"threat.group.alias":{type:"keyword",array:!0,required:!1},"threat.group.id":{type:"keyword",array:!1,required:!1},"threat.group.name":{type:"keyword",array:!1,required:!1},"threat.group.reference":{type:"keyword",array:!1,required:!1},"threat.indicator.as.number":{type:"long",array:!1,required:!1},"threat.indicator.as.organization.name":{type:"keyword",array:!1,required:!1},"threat.indicator.confidence":{type:"keyword",array:!1,required:!1},"threat.indicator.description":{type:"keyword",array:!1,required:!1},"threat.indicator.email.address":{type:"keyword",array:!1,required:!1},"threat.indicator.file.accessed":{type:"date",array:!1,required:!1},"threat.indicator.file.attributes":{type:"keyword",array:!0,required:!1},"threat.indicator.file.code_signature.digest_algorithm":{type:"keyword",array:!1,required:!1},"threat.indicator.file.code_signature.exists":{type:"boolean",array:!1,required:!1},"threat.indicator.file.code_signature.signing_id":{type:"keyword",array:!1,required:!1},"threat.indicator.file.code_signature.status":{type:"keyword",array:!1,required:!1},"threat.indicator.file.code_signature.subject_name":{type:"keyword",array:!1,required:!1},"threat.indicator.file.code_signature.team_id":{type:"keyword",array:!1,required:!1},"threat.indicator.file.code_signature.timestamp":{type:"date",array:!1,required:!1},"threat.indicator.file.code_signature.trusted":{type:"boolean",array:!1,required:!1},"threat.indicator.file.code_signature.valid":{type:"boolean",array:!1,required:!1},"threat.indicator.file.created":{type:"date",array:!1,required:!1},"threat.indicator.file.ctime":{type:"date",array:!1,required:!1},"threat.indicator.file.device":{type:"keyword",array:!1,required:!1},"threat.indicator.file.directory":{type:"keyword",array:!1,required:!1},"threat.indicator.file.drive_letter":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.architecture":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.byte_order":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.cpu_type":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.creation_date":{type:"date",array:!1,required:!1},"threat.indicator.file.elf.exports":{type:"flattened",array:!0,required:!1},"threat.indicator.file.elf.header.abi_version":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.header.class":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.header.data":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.header.entrypoint":{type:"long",array:!1,required:!1},"threat.indicator.file.elf.header.object_version":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.header.os_abi":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.header.type":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.header.version":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.imports":{type:"flattened",array:!0,required:!1},"threat.indicator.file.elf.sections":{type:"nested",array:!0,required:!1},"threat.indicator.file.elf.sections.chi2":{type:"long",array:!1,required:!1},"threat.indicator.file.elf.sections.entropy":{type:"long",array:!1,required:!1},"threat.indicator.file.elf.sections.flags":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.sections.name":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.sections.physical_offset":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.sections.physical_size":{type:"long",array:!1,required:!1},"threat.indicator.file.elf.sections.type":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.sections.virtual_address":{type:"long",array:!1,required:!1},"threat.indicator.file.elf.sections.virtual_size":{type:"long",array:!1,required:!1},"threat.indicator.file.elf.segments":{type:"nested",array:!0,required:!1},"threat.indicator.file.elf.segments.sections":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.segments.type":{type:"keyword",array:!1,required:!1},"threat.indicator.file.elf.shared_libraries":{type:"keyword",array:!0,required:!1},"threat.indicator.file.elf.telfhash":{type:"keyword",array:!1,required:!1},"threat.indicator.file.extension":{type:"keyword",array:!1,required:!1},"threat.indicator.file.fork_name":{type:"keyword",array:!1,required:!1},"threat.indicator.file.gid":{type:"keyword",array:!1,required:!1},"threat.indicator.file.group":{type:"keyword",array:!1,required:!1},"threat.indicator.file.hash.md5":{type:"keyword",array:!1,required:!1},"threat.indicator.file.hash.sha1":{type:"keyword",array:!1,required:!1},"threat.indicator.file.hash.sha256":{type:"keyword",array:!1,required:!1},"threat.indicator.file.hash.sha512":{type:"keyword",array:!1,required:!1},"threat.indicator.file.hash.ssdeep":{type:"keyword",array:!1,required:!1},"threat.indicator.file.inode":{type:"keyword",array:!1,required:!1},"threat.indicator.file.mime_type":{type:"keyword",array:!1,required:!1},"threat.indicator.file.mode":{type:"keyword",array:!1,required:!1},"threat.indicator.file.mtime":{type:"date",array:!1,required:!1},"threat.indicator.file.name":{type:"keyword",array:!1,required:!1},"threat.indicator.file.owner":{type:"keyword",array:!1,required:!1},"threat.indicator.file.path":{type:"keyword",array:!1,required:!1},"threat.indicator.file.pe.architecture":{type:"keyword",array:!1,required:!1},"threat.indicator.file.pe.company":{type:"keyword",array:!1,required:!1},"threat.indicator.file.pe.description":{type:"keyword",array:!1,required:!1},"threat.indicator.file.pe.file_version":{type:"keyword",array:!1,required:!1},"threat.indicator.file.pe.imphash":{type:"keyword",array:!1,required:!1},"threat.indicator.file.pe.original_file_name":{type:"keyword",array:!1,required:!1},"threat.indicator.file.pe.product":{type:"keyword",array:!1,required:!1},"threat.indicator.file.size":{type:"long",array:!1,required:!1},"threat.indicator.file.target_path":{type:"keyword",array:!1,required:!1},"threat.indicator.file.type":{type:"keyword",array:!1,required:!1},"threat.indicator.file.uid":{type:"keyword",array:!1,required:!1},"threat.indicator.file.x509.alternative_names":{type:"keyword",array:!0,required:!1},"threat.indicator.file.x509.issuer.common_name":{type:"keyword",array:!0,required:!1},"threat.indicator.file.x509.issuer.country":{type:"keyword",array:!0,required:!1},"threat.indicator.file.x509.issuer.distinguished_name":{type:"keyword",array:!1,required:!1},"threat.indicator.file.x509.issuer.locality":{type:"keyword",array:!0,required:!1},"threat.indicator.file.x509.issuer.organization":{type:"keyword",array:!0,required:!1},"threat.indicator.file.x509.issuer.organizational_unit":{type:"keyword",array:!0,required:!1},"threat.indicator.file.x509.issuer.state_or_province":{type:"keyword",array:!0,required:!1},"threat.indicator.file.x509.not_after":{type:"date",array:!1,required:!1},"threat.indicator.file.x509.not_before":{type:"date",array:!1,required:!1},"threat.indicator.file.x509.public_key_algorithm":{type:"keyword",array:!1,required:!1},"threat.indicator.file.x509.public_key_curve":{type:"keyword",array:!1,required:!1},"threat.indicator.file.x509.public_key_exponent":{type:"long",array:!1,required:!1},"threat.indicator.file.x509.public_key_size":{type:"long",array:!1,required:!1},"threat.indicator.file.x509.serial_number":{type:"keyword",array:!1,required:!1},"threat.indicator.file.x509.signature_algorithm":{type:"keyword",array:!1,required:!1},"threat.indicator.file.x509.subject.common_name":{type:"keyword",array:!0,required:!1},"threat.indicator.file.x509.subject.country":{type:"keyword",array:!0,required:!1},"threat.indicator.file.x509.subject.distinguished_name":{type:"keyword",array:!1,required:!1},"threat.indicator.file.x509.subject.locality":{type:"keyword",array:!0,required:!1},"threat.indicator.file.x509.subject.organization":{type:"keyword",array:!0,required:!1},"threat.indicator.file.x509.subject.organizational_unit":{type:"keyword",array:!0,required:!1},"threat.indicator.file.x509.subject.state_or_province":{type:"keyword",array:!0,required:!1},"threat.indicator.file.x509.version_number":{type:"keyword",array:!1,required:!1},"threat.indicator.first_seen":{type:"date",array:!1,required:!1},"threat.indicator.geo.city_name":{type:"keyword",array:!1,required:!1},"threat.indicator.geo.continent_code":{type:"keyword",array:!1,required:!1},"threat.indicator.geo.continent_name":{type:"keyword",array:!1,required:!1},"threat.indicator.geo.country_iso_code":{type:"keyword",array:!1,required:!1},"threat.indicator.geo.country_name":{type:"keyword",array:!1,required:!1},"threat.indicator.geo.location":{type:"geo_point",array:!1,required:!1},"threat.indicator.geo.name":{type:"keyword",array:!1,required:!1},"threat.indicator.geo.postal_code":{type:"keyword",array:!1,required:!1},"threat.indicator.geo.region_iso_code":{type:"keyword",array:!1,required:!1},"threat.indicator.geo.region_name":{type:"keyword",array:!1,required:!1},"threat.indicator.geo.timezone":{type:"keyword",array:!1,required:!1},"threat.indicator.ip":{type:"ip",array:!1,required:!1},"threat.indicator.last_seen":{type:"date",array:!1,required:!1},"threat.indicator.marking.tlp":{type:"keyword",array:!1,required:!1},"threat.indicator.modified_at":{type:"date",array:!1,required:!1},"threat.indicator.port":{type:"long",array:!1,required:!1},"threat.indicator.provider":{type:"keyword",array:!1,required:!1},"threat.indicator.reference":{type:"keyword",array:!1,required:!1},"threat.indicator.registry.data.bytes":{type:"keyword",array:!1,required:!1},"threat.indicator.registry.data.strings":{type:"wildcard",array:!0,required:!1},"threat.indicator.registry.data.type":{type:"keyword",array:!1,required:!1},"threat.indicator.registry.hive":{type:"keyword",array:!1,required:!1},"threat.indicator.registry.key":{type:"keyword",array:!1,required:!1},"threat.indicator.registry.path":{type:"keyword",array:!1,required:!1},"threat.indicator.registry.value":{type:"keyword",array:!1,required:!1},"threat.indicator.scanner_stats":{type:"long",array:!1,required:!1},"threat.indicator.sightings":{type:"long",array:!1,required:!1},"threat.indicator.type":{type:"keyword",array:!1,required:!1},"threat.indicator.url.domain":{type:"keyword",array:!1,required:!1},"threat.indicator.url.extension":{type:"keyword",array:!1,required:!1},"threat.indicator.url.fragment":{type:"keyword",array:!1,required:!1},"threat.indicator.url.full":{type:"wildcard",array:!1,required:!1},"threat.indicator.url.original":{type:"wildcard",array:!1,required:!1},"threat.indicator.url.password":{type:"keyword",array:!1,required:!1},"threat.indicator.url.path":{type:"wildcard",array:!1,required:!1},"threat.indicator.url.port":{type:"long",array:!1,required:!1},"threat.indicator.url.query":{type:"keyword",array:!1,required:!1},"threat.indicator.url.registered_domain":{type:"keyword",array:!1,required:!1},"threat.indicator.url.scheme":{type:"keyword",array:!1,required:!1},"threat.indicator.url.subdomain":{type:"keyword",array:!1,required:!1},"threat.indicator.url.top_level_domain":{type:"keyword",array:!1,required:!1},"threat.indicator.url.username":{type:"keyword",array:!1,required:!1},"threat.indicator.x509.alternative_names":{type:"keyword",array:!0,required:!1},"threat.indicator.x509.issuer.common_name":{type:"keyword",array:!0,required:!1},"threat.indicator.x509.issuer.country":{type:"keyword",array:!0,required:!1},"threat.indicator.x509.issuer.distinguished_name":{type:"keyword",array:!1,required:!1},"threat.indicator.x509.issuer.locality":{type:"keyword",array:!0,required:!1},"threat.indicator.x509.issuer.organization":{type:"keyword",array:!0,required:!1},"threat.indicator.x509.issuer.organizational_unit":{type:"keyword",array:!0,required:!1},"threat.indicator.x509.issuer.state_or_province":{type:"keyword",array:!0,required:!1},"threat.indicator.x509.not_after":{type:"date",array:!1,required:!1},"threat.indicator.x509.not_before":{type:"date",array:!1,required:!1},"threat.indicator.x509.public_key_algorithm":{type:"keyword",array:!1,required:!1},"threat.indicator.x509.public_key_curve":{type:"keyword",array:!1,required:!1},"threat.indicator.x509.public_key_exponent":{type:"long",array:!1,required:!1},"threat.indicator.x509.public_key_size":{type:"long",array:!1,required:!1},"threat.indicator.x509.serial_number":{type:"keyword",array:!1,required:!1},"threat.indicator.x509.signature_algorithm":{type:"keyword",array:!1,required:!1},"threat.indicator.x509.subject.common_name":{type:"keyword",array:!0,required:!1},"threat.indicator.x509.subject.country":{type:"keyword",array:!0,required:!1},"threat.indicator.x509.subject.distinguished_name":{type:"keyword",array:!1,required:!1},"threat.indicator.x509.subject.locality":{type:"keyword",array:!0,required:!1},"threat.indicator.x509.subject.organization":{type:"keyword",array:!0,required:!1},"threat.indicator.x509.subject.organizational_unit":{type:"keyword",array:!0,required:!1},"threat.indicator.x509.subject.state_or_province":{type:"keyword",array:!0,required:!1},"threat.indicator.x509.version_number":{type:"keyword",array:!1,required:!1},"threat.software.alias":{type:"keyword",array:!0,required:!1},"threat.software.id":{type:"keyword",array:!1,required:!1},"threat.software.name":{type:"keyword",array:!1,required:!1},"threat.software.platforms":{type:"keyword",array:!0,required:!1},"threat.software.reference":{type:"keyword",array:!1,required:!1},"threat.software.type":{type:"keyword",array:!1,required:!1},"threat.tactic.id":{type:"keyword",array:!0,required:!1},"threat.tactic.name":{type:"keyword",array:!0,required:!1},"threat.tactic.reference":{type:"keyword",array:!0,required:!1},"threat.technique.id":{type:"keyword",array:!0,required:!1},"threat.technique.name":{type:"keyword",array:!0,required:!1},"threat.technique.reference":{type:"keyword",array:!0,required:!1},"threat.technique.subtechnique.id":{type:"keyword",array:!0,required:!1},"threat.technique.subtechnique.name":{type:"keyword",array:!0,required:!1},"threat.technique.subtechnique.reference":{type:"keyword",array:!0,required:!1},"tls.cipher":{type:"keyword",array:!1,required:!1},"tls.client.certificate":{type:"keyword",array:!1,required:!1},"tls.client.certificate_chain":{type:"keyword",array:!0,required:!1},"tls.client.hash.md5":{type:"keyword",array:!1,required:!1},"tls.client.hash.sha1":{type:"keyword",array:!1,required:!1},"tls.client.hash.sha256":{type:"keyword",array:!1,required:!1},"tls.client.issuer":{type:"keyword",array:!1,required:!1},"tls.client.ja3":{type:"keyword",array:!1,required:!1},"tls.client.not_after":{type:"date",array:!1,required:!1},"tls.client.not_before":{type:"date",array:!1,required:!1},"tls.client.server_name":{type:"keyword",array:!1,required:!1},"tls.client.subject":{type:"keyword",array:!1,required:!1},"tls.client.supported_ciphers":{type:"keyword",array:!0,required:!1},"tls.client.x509.alternative_names":{type:"keyword",array:!0,required:!1},"tls.client.x509.issuer.common_name":{type:"keyword",array:!0,required:!1},"tls.client.x509.issuer.country":{type:"keyword",array:!0,required:!1},"tls.client.x509.issuer.distinguished_name":{type:"keyword",array:!1,required:!1},"tls.client.x509.issuer.locality":{type:"keyword",array:!0,required:!1},"tls.client.x509.issuer.organization":{type:"keyword",array:!0,required:!1},"tls.client.x509.issuer.organizational_unit":{type:"keyword",array:!0,required:!1},"tls.client.x509.issuer.state_or_province":{type:"keyword",array:!0,required:!1},"tls.client.x509.not_after":{type:"date",array:!1,required:!1},"tls.client.x509.not_before":{type:"date",array:!1,required:!1},"tls.client.x509.public_key_algorithm":{type:"keyword",array:!1,required:!1},"tls.client.x509.public_key_curve":{type:"keyword",array:!1,required:!1},"tls.client.x509.public_key_exponent":{type:"long",array:!1,required:!1},"tls.client.x509.public_key_size":{type:"long",array:!1,required:!1},"tls.client.x509.serial_number":{type:"keyword",array:!1,required:!1},"tls.client.x509.signature_algorithm":{type:"keyword",array:!1,required:!1},"tls.client.x509.subject.common_name":{type:"keyword",array:!0,required:!1},"tls.client.x509.subject.country":{type:"keyword",array:!0,required:!1},"tls.client.x509.subject.distinguished_name":{type:"keyword",array:!1,required:!1},"tls.client.x509.subject.locality":{type:"keyword",array:!0,required:!1},"tls.client.x509.subject.organization":{type:"keyword",array:!0,required:!1},"tls.client.x509.subject.organizational_unit":{type:"keyword",array:!0,required:!1},"tls.client.x509.subject.state_or_province":{type:"keyword",array:!0,required:!1},"tls.client.x509.version_number":{type:"keyword",array:!1,required:!1},"tls.curve":{type:"keyword",array:!1,required:!1},"tls.established":{type:"boolean",array:!1,required:!1},"tls.next_protocol":{type:"keyword",array:!1,required:!1},"tls.resumed":{type:"boolean",array:!1,required:!1},"tls.server.certificate":{type:"keyword",array:!1,required:!1},"tls.server.certificate_chain":{type:"keyword",array:!0,required:!1},"tls.server.hash.md5":{type:"keyword",array:!1,required:!1},"tls.server.hash.sha1":{type:"keyword",array:!1,required:!1},"tls.server.hash.sha256":{type:"keyword",array:!1,required:!1},"tls.server.issuer":{type:"keyword",array:!1,required:!1},"tls.server.ja3s":{type:"keyword",array:!1,required:!1},"tls.server.not_after":{type:"date",array:!1,required:!1},"tls.server.not_before":{type:"date",array:!1,required:!1},"tls.server.subject":{type:"keyword",array:!1,required:!1},"tls.server.x509.alternative_names":{type:"keyword",array:!0,required:!1},"tls.server.x509.issuer.common_name":{type:"keyword",array:!0,required:!1},"tls.server.x509.issuer.country":{type:"keyword",array:!0,required:!1},"tls.server.x509.issuer.distinguished_name":{type:"keyword",array:!1,required:!1},"tls.server.x509.issuer.locality":{type:"keyword",array:!0,required:!1},"tls.server.x509.issuer.organization":{type:"keyword",array:!0,required:!1},"tls.server.x509.issuer.organizational_unit":{type:"keyword",array:!0,required:!1},"tls.server.x509.issuer.state_or_province":{type:"keyword",array:!0,required:!1},"tls.server.x509.not_after":{type:"date",array:!1,required:!1},"tls.server.x509.not_before":{type:"date",array:!1,required:!1},"tls.server.x509.public_key_algorithm":{type:"keyword",array:!1,required:!1},"tls.server.x509.public_key_curve":{type:"keyword",array:!1,required:!1},"tls.server.x509.public_key_exponent":{type:"long",array:!1,required:!1},"tls.server.x509.public_key_size":{type:"long",array:!1,required:!1},"tls.server.x509.serial_number":{type:"keyword",array:!1,required:!1},"tls.server.x509.signature_algorithm":{type:"keyword",array:!1,required:!1},"tls.server.x509.subject.common_name":{type:"keyword",array:!0,required:!1},"tls.server.x509.subject.country":{type:"keyword",array:!0,required:!1},"tls.server.x509.subject.distinguished_name":{type:"keyword",array:!1,required:!1},"tls.server.x509.subject.locality":{type:"keyword",array:!0,required:!1},"tls.server.x509.subject.organization":{type:"keyword",array:!0,required:!1},"tls.server.x509.subject.organizational_unit":{type:"keyword",array:!0,required:!1},"tls.server.x509.subject.state_or_province":{type:"keyword",array:!0,required:!1},"tls.server.x509.version_number":{type:"keyword",array:!1,required:!1},"tls.version":{type:"keyword",array:!1,required:!1},"tls.version_protocol":{type:"keyword",array:!1,required:!1},"trace.id":{type:"keyword",array:!1,required:!1},"transaction.id":{type:"keyword",array:!1,required:!1},"url.domain":{type:"keyword",array:!1,required:!1},"url.extension":{type:"keyword",array:!1,required:!1},"url.fragment":{type:"keyword",array:!1,required:!1},"url.full":{type:"wildcard",array:!1,required:!1},"url.original":{type:"wildcard",array:!1,required:!1},"url.password":{type:"keyword",array:!1,required:!1},"url.path":{type:"wildcard",array:!1,required:!1},"url.port":{type:"long",array:!1,required:!1},"url.query":{type:"keyword",array:!1,required:!1},"url.registered_domain":{type:"keyword",array:!1,required:!1},"url.scheme":{type:"keyword",array:!1,required:!1},"url.subdomain":{type:"keyword",array:!1,required:!1},"url.top_level_domain":{type:"keyword",array:!1,required:!1},"url.username":{type:"keyword",array:!1,required:!1},"user.changes.domain":{type:"keyword",array:!1,required:!1},"user.changes.email":{type:"keyword",array:!1,required:!1},"user.changes.full_name":{type:"keyword",array:!1,required:!1},"user.changes.group.domain":{type:"keyword",array:!1,required:!1},"user.changes.group.id":{type:"keyword",array:!1,required:!1},"user.changes.group.name":{type:"keyword",array:!1,required:!1},"user.changes.hash":{type:"keyword",array:!1,required:!1},"user.changes.id":{type:"keyword",array:!1,required:!1},"user.changes.name":{type:"keyword",array:!1,required:!1},"user.changes.roles":{type:"keyword",array:!0,required:!1},"user.domain":{type:"keyword",array:!1,required:!1},"user.effective.domain":{type:"keyword",array:!1,required:!1},"user.effective.email":{type:"keyword",array:!1,required:!1},"user.effective.full_name":{type:"keyword",array:!1,required:!1},"user.effective.group.domain":{type:"keyword",array:!1,required:!1},"user.effective.group.id":{type:"keyword",array:!1,required:!1},"user.effective.group.name":{type:"keyword",array:!1,required:!1},"user.effective.hash":{type:"keyword",array:!1,required:!1},"user.effective.id":{type:"keyword",array:!1,required:!1},"user.effective.name":{type:"keyword",array:!1,required:!1},"user.effective.roles":{type:"keyword",array:!0,required:!1},"user.email":{type:"keyword",array:!1,required:!1},"user.full_name":{type:"keyword",array:!1,required:!1},"user.group.domain":{type:"keyword",array:!1,required:!1},"user.group.id":{type:"keyword",array:!1,required:!1},"user.group.name":{type:"keyword",array:!1,required:!1},"user.hash":{type:"keyword",array:!1,required:!1},"user.id":{type:"keyword",array:!1,required:!1},"user.name":{type:"keyword",array:!1,required:!1},"user.risk.calculated_level":{type:"keyword",array:!1,required:!1},"user.risk.calculated_score":{type:"float",array:!1,required:!1},"user.risk.calculated_score_norm":{type:"float",array:!1,required:!1},"user.risk.static_level":{type:"keyword",array:!1,required:!1},"user.risk.static_score":{type:"float",array:!1,required:!1},"user.risk.static_score_norm":{type:"float",array:!1,required:!1},"user.roles":{type:"keyword",array:!0,required:!1},"user.target.domain":{type:"keyword",array:!1,required:!1},"user.target.email":{type:"keyword",array:!1,required:!1},"user.target.full_name":{type:"keyword",array:!1,required:!1},"user.target.group.domain":{type:"keyword",array:!1,required:!1},"user.target.group.id":{type:"keyword",array:!1,required:!1},"user.target.group.name":{type:"keyword",array:!1,required:!1},"user.target.hash":{type:"keyword",array:!1,required:!1},"user.target.id":{type:"keyword",array:!1,required:!1},"user.target.name":{type:"keyword",array:!1,required:!1},"user.target.roles":{type:"keyword",array:!0,required:!1},"user_agent.device.name":{type:"keyword",array:!1,required:!1},"user_agent.name":{type:"keyword",array:!1,required:!1},"user_agent.original":{type:"keyword",array:!1,required:!1},"user_agent.os.family":{type:"keyword",array:!1,required:!1},"user_agent.os.full":{type:"keyword",array:!1,required:!1},"user_agent.os.kernel":{type:"keyword",array:!1,required:!1},"user_agent.os.name":{type:"keyword",array:!1,required:!1},"user_agent.os.platform":{type:"keyword",array:!1,required:!1},"user_agent.os.type":{type:"keyword",array:!1,required:!1},"user_agent.os.version":{type:"keyword",array:!1,required:!1},"user_agent.version":{type:"keyword",array:!1,required:!1},"vulnerability.category":{type:"keyword",array:!0,required:!1},"vulnerability.classification":{type:"keyword",array:!1,required:!1},"vulnerability.description":{type:"keyword",array:!1,required:!1},"vulnerability.enumeration":{type:"keyword",array:!1,required:!1},"vulnerability.id":{type:"keyword",array:!1,required:!1},"vulnerability.reference":{type:"keyword",array:!1,required:!1},"vulnerability.report_id":{type:"keyword",array:!1,required:!1},"vulnerability.scanner.vendor":{type:"keyword",array:!1,required:!1},"vulnerability.score.base":{type:"float",array:!1,required:!1},"vulnerability.score.environmental":{type:"float",array:!1,required:!1},"vulnerability.score.temporal":{type:"float",array:!1,required:!1},"vulnerability.score.version":{type:"keyword",array:!1,required:!1},"vulnerability.severity":{type:"keyword",array:!1,required:!1}};var r=a(129);const s={[r.a]:{type:"keyword",array:!1,required:!1},[r.c]:{type:"keyword",array:!0,required:!1},[r.e]:{type:"long",array:!1,required:!1},[r.f]:{type:"date",array:!1,required:!1},[r.j]:{type:"boolean",array:!1,required:!1},[r.k]:{type:"boolean",array:!0,required:!1},[r.n]:{type:"keyword",array:!0,required:!1},[r.l]:{type:"keyword",array:!1,required:!0},[r.m]:{type:"date",required:!1,array:!1},[r.p]:{type:"keyword",array:!1,required:!1},[r.s]:{type:"keyword",array:!1,required:!0},[r.t]:{type:"keyword",array:!1,required:!0},[r.z]:{type:"keyword",array:!1,required:!1},[r.D]:{type:"keyword",array:!1,required:!0},[r.G]:{array:!1,type:"flattened",ignore_above:4096,required:!1},[r.H]:{type:"keyword",array:!1,required:!0},[r.J]:{type:"long",array:!1,required:!0},[r.M]:{type:"keyword",array:!0,required:!1},[r.P]:{type:"keyword",array:!1,required:!0},[r.S]:{type:"keyword",array:!1,required:!0},[r.V]:{type:"date",array:!1,required:!1},[r.W]:{type:"keyword",array:!1,required:!0},[r.fb]:{type:"date_range",format:"epoch_millis||strict_date_optional_time",array:!1,required:!1},[r.gb]:{type:"keyword",array:!1,index:!1,required:!1,ignore_above:2048},[r.hb]:{type:"keyword",array:!1,required:!0},[r.jb]:{type:"keyword",array:!1,required:!1},[r.kb]:{type:"keyword",array:!0,required:!1},[r.ob]:{type:"keyword",array:!1,required:!1},[r.pb]:{type:"keyword",array:!1,required:!1},[r.qb]:{type:"keyword",array:!0,required:!0},[r.rb]:{type:"keyword",array:!0,required:!1},[r.sb]:{type:"date",required:!0,array:!1},[r.tb]:{type:"version",array:!1,required:!1}};var o=a(697);const l=["constant_keyword"],c=(Object.fromEntries(Object.entries(o.a).filter((([e,t])=>!l.includes(t.type))).map((([e,t])=>{const a=o.a[e];return[e,{type:a.type,array:a.normalize.includes("array"),required:!!a.required,...a.scaling_factor?{scaling_factor:a.scaling_factor}:{},...a.ignore_above?{ignore_above:a.ignore_above}:{},...a.multi_fields?{multi_fields:a.multi_fields}:{}}]}))),{[r.q]:{type:"float",array:!1,required:!1},[r.r]:{type:"keyword",array:!1,required:!1},[r.u]:{type:"date",array:!1,required:!1},[r.v]:{type:"keyword",array:!1,required:!1},[r.w]:{type:"keyword",array:!1,required:!1},[r.x]:{type:"keyword",array:!1,required:!1},[r.A]:{type:"keyword",array:!1,required:!1},[r.B]:{type:"keyword",array:!1,required:!1},[r.C]:{type:"keyword",array:!1,required:!1},[r.F]:{type:"keyword",array:!1,required:!1},[r.I]:{type:"keyword",array:!0,required:!1},[r.K]:{type:"keyword",array:!1,required:!1},[r.L]:{type:"keyword",array:!1,required:!1},[r.N]:{type:"keyword",array:!1,required:!1},[r.O]:{type:"keyword",array:!1,required:!1},[r.Q]:{type:"date",array:!1,required:!1},[r.R]:{type:"keyword",array:!1,required:!1},[r.T]:{type:"keyword",array:!1,required:!1},[r.U]:{type:"keyword",array:!1,required:!1},[r.Y]:{type:"long",array:!1,required:!1},[r.Z]:{type:"date",array:!1,required:!1},[r.ab]:{type:"keyword",array:!0,required:!1},[r.bb]:{type:"date",array:!1,required:!1},[r.db]:{type:"keyword",array:!0,required:!1},[r.eb]:{type:"keyword",array:!1,required:!1},[r.ib]:{type:"keyword",array:!1,required:!1},[r.lb]:{type:"keyword",array:!1,required:!1},[r.nb]:{type:"keyword",array:!1,required:!1}}),u={[r.g]:{type:"scaled_float",scaling_factor:100,required:!1},[r.h]:{type:"scaled_float",scaling_factor:100,required:!1},[r.d]:{type:"object",array:!1,required:!1},[r.i]:{type:"scaled_float",scaling_factor:100,required:!1,array:!0}};a(801);var d=a(42);function p(e,...t){const a=Object.keys(e).filter((e=>t.some((t=>{if(t===e)return!0;const a=e.split("."),n=t.split(".");return n.indexOf("*")===n.length-1&&a.every(((e,t)=>{const a=n.length-1<t?"*":n[t];return e===a||"*"===a}))}))));return Object(n.pick)(e,a)}r.t,r.kb,r.U,r.q,r.G;const m={...p(s,"*"),...p(c,"*")};var b=a(4);const g=e=>{if(Array.isArray(e))return e.reduce(((e,t)=>{if(null!=t)switch(typeof t){case"number":case"boolean":return[...e,t.toString()];case"object":try{return[...e,JSON.stringify(t)]}catch{return[...e,"Invalid Object"]}case"string":return[...e,t];default:return[...e,`${t}`]}return e}),[]);if(null==e)return[];if(Array.isArray(e)||"object"!=typeof e)return[`${e}`];try{return[JSON.stringify(e)]}catch{return["Invalid Object"]}},f=["@timestamp","labels","message","tags"],y=e=>{const t=e.length>0?e[0]:null;if(null!=t&&!Object(d.isEmpty)(t.coordinates))try{return g({lon:t.coordinates[0],lat:t.coordinates[1]})}catch{return g(e)}return g(e)},h=(e,t,a)=>Object.keys(e).reduce(((n,r)=>{const s=e[r],o=null!=a?a:(e=>{const t=e.split(".")[0];return!Object(d.isEmpty)(t)&&f.includes(t)?"base":t})(r);if((e=>e.includes("geo.location")||e.includes("geoip.location"))(r))return[...n,{category:o,field:r,values:y(s),originalValue:y(s),isObjectArray:!0}];const l=(e=>{if(Array.isArray(e))return e.reduce(((e,t)=>{if(null!=t)switch(typeof t){case"number":case"boolean":return[...e,{str:t.toString()}];case"object":try{return[...e,{str:JSON.stringify(t),isObjectArray:!0}]}catch{return[...e,{str:"Invalid Object"}]}case"string":return[...e,{str:t}];default:return[...e,{str:`${t}`}]}return e}),[]);if(null==e)return[];if(Array.isArray(e)||"object"!=typeof e)return[{str:`${e}`}];try{return[{str:JSON.stringify(e),isObjectArray:!0}]}catch{return[{str:"Invalid Object"}]}})(s),c=l.map((({str:e})=>e)),p=l.some((e=>e.isObjectArray)),g=t?`${t}.${r}`:r;if(!p||void 0===Object.keys({...i,...m,...u}).find((e=>e===r)))return[...n,{category:o,field:g,values:c,originalValue:c,isObjectArray:p}];const v=((e,t)=>(null==t?void 0:t.includes(b.pb))||e===b.pb)(r,t)?[{category:o,field:g,values:c,originalValue:c,isObjectArray:p}]:[],E=Array.isArray(s)?s.reduce(((e,t)=>[...e,h(t,g,o)]),[]).flat():h(s,t,o),x=[...n,...E,...v].reduce(((e,t)=>({...e,...null!=e[t.field]?{[t.field]:{...t,originalValue:e[t.field].originalValue.includes(t.originalValue[0])?e[t.field].originalValue:[...e[t.field].originalValue,...t.originalValue],values:e[t.field].values.includes(t.values[0])?e[t.field].values:[...e[t.field].values,...t.values]}}:{[t.field]:t}})),{});return Object.values(x)}),[]);var v=a(167),E=a(408),x=a(802);const j=e=>e===v.c.InvestigationTime,S=e=>{const t=e.find((({field:e,originalValue:t})=>e===b.pb&&t));if(!t)return[];const{originalValue:a}=t;return(Array.isArray(a)?a:[a]).reduce(((e,t)=>{try{const a=h(JSON.parse(t));e.push(a)}catch(e){}return e}),[])},k=e=>e.reduce(((e,t)=>(e[t.field]=t.originalValue,e)),{}),O=(e,t)=>Object(x.a)(e[t]),w=(e,t)=>O(e,t)||O(e,`threatintel.${t}`)||O(e,`threat.${t}`),T=e=>({id:O(e,v.m),field:O(e,v.l),value:O(e,v.k),type:O(e,v.n),feedName:w(e,v.e)}),I=e=>{const{id:t,field:a}=T(e);return`${t}${a}`},C=e=>{if(e.length<2)return e;const t=Object(n.groupBy)(e,I);return Object.values(t).map((e=>{var t;return null!==(t=e.find((e=>!j(O(e,v.n)))))&&void 0!==t?t:e[0]}))},M=e=>e.reduce(((e,t)=>{if(Object(E.b)(t.field)){const a=Object(x.a)(t.originalValue);if(a)return{...e,[t.field]:a}}return e}),{}),_=e=>{const t=w(e,v.f),a=Date.parse(null!=t?t:"no date");return Number.isInteger(a)?a:new Date(-1).valueOf()}},,function(e,t,a){"use strict";a.d(t,"f",(function(){return n.b})),a.d(t,"g",(function(){return n.c})),a.d(t,"h",(function(){return n.d})),a.d(t,"w",(function(){return i.d})),a.d(t,"x",(function(){return i.e})),a.d(t,"F",(function(){return i.l})),a.d(t,"b",(function(){return i.a})),a.d(t,"y",(function(){return i.f})),a.d(t,"D",(function(){return i.j})),a.d(t,"E",(function(){return i.k})),a.d(t,"B",(function(){return i.h})),a.d(t,"C",(function(){return i.i})),a.d(t,"A",(function(){return i.g})),a.d(t,"u",(function(){return i.b})),a.d(t,"v",(function(){return i.c})),a.d(t,"i",(function(){return r.a})),a.d(t,"j",(function(){return r.b})),a.d(t,"k",(function(){return r.c})),a.d(t,"m",(function(){return s.c})),a.d(t,"s",(function(){return s.i})),a.d(t,"d",(function(){return s.a})),a.d(t,"e",(function(){return s.b})),a.d(t,"n",(function(){return s.d})),a.d(t,"o",(function(){return s.e})),a.d(t,"p",(function(){return s.f})),a.d(t,"r",(function(){return s.h})),a.d(t,"t",(function(){return s.j})),a.d(t,"q",(function(){return s.g})),a.d(t,"l",(function(){return o.b})),a.d(t,"a",(function(){return o.a})),a.d(t,"z",(function(){return o.c})),a.d(t,"c",(function(){return l})),a(408);var n=a(419),i=a(753),r=a(747),s=a(263),o=a(508);const l="firstlastseen";a(510)},function(e,t,a){"use strict";a.d(t,"a",(function(){return u})),a.d(t,"b",(function(){return d}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(41),l=a.n(o),c=a(40);const u=l.a.span.withConfig({displayName:"EllipsisText",componentId:"sc-saif2w-0"})(["&,& *{display:inline-block;max-width:100%;overflow:hidden;text-overflow:ellipsis;vertical-align:top;white-space:nowrap;}"]);function d({tooltipContent:e,children:t,dataTestSubj:a,...n}){return e?s.a.createElement(c.EuiToolTip,{display:"block",content:e},s.a.createElement(u,i()({"data-test-subj":a},n),t)):s.a.createElement(u,i()({"data-test-subj":a},n),t)}u.displayName="EllipsisText"},function(e,t,a){"use strict";a.d(t,"b",(function(){return n})),a.d(t,"a",(function(){return i}));const n=e=>{const t=e.reduce(((e,t)=>t.trim().startsWith("-")?{includes:e.includes,excludes:[...e.excludes,t]}:{includes:[...e.includes,t],excludes:e.excludes}),{includes:[],excludes:[]});return[...t.includes.sort(),...t.excludes.sort()]},i=e=>n([...new Set(e.reduce(((e,t)=>[...t.split(","),...e]),[]))])},function(e,t,a){var n=a(436),i=a(437);e.exports=function(e){return function(){var t=arguments;switch(t.length){case 0:return new e;case 1:return new e(t[0]);case 2:return new e(t[0],t[1]);case 3:return new e(t[0],t[1],t[2]);case 4:return new e(t[0],t[1],t[2],t[3]);case 5:return new e(t[0],t[1],t[2],t[3],t[4]);case 6:return new e(t[0],t[1],t[2],t[3],t[4],t[5]);case 7:return new e(t[0],t[1],t[2],t[3],t[4],t[5],t[6])}var a=n(e.prototype),r=e.apply(a,t);return i(r)?r:a}}},function(e,t,a){e.exports=a(33)(315)},function(e,t,a){"use strict";var n=function(e){return function(e){return!!e&&"object"==typeof e}(e)&&!function(e){var t=Object.prototype.toString.call(e);return"[object RegExp]"===t||"[object Date]"===t||function(e){return e.$$typeof===i}(e)}(e)},i="function"==typeof Symbol&&Symbol.for?Symbol.for("react.element"):60103;function r(e,t){return!1!==t.clone&&t.isMergeableObject(e)?c((a=e,Array.isArray(a)?[]:{}),e,t):e;var a}function s(e,t,a){return e.concat(t).map((function(e){return r(e,a)}))}function o(e){return Object.keys(e).concat(function(e){return Object.getOwnPropertySymbols?Object.getOwnPropertySymbols(e).filter((function(t){return e.propertyIsEnumerable(t)})):[]}(e))}function l(e,t){try{return t in e}catch(e){return!1}}function c(e,t,a){(a=a||{}).arrayMerge=a.arrayMerge||s,a.isMergeableObject=a.isMergeableObject||n,a.cloneUnlessOtherwiseSpecified=r;var i=Array.isArray(t);return i===Array.isArray(e)?i?a.arrayMerge(e,t,a):function(e,t,a){var n={};return a.isMergeableObject(e)&&o(e).forEach((function(t){n[t]=r(e[t],a)})),o(t).forEach((function(i){(function(e,t){return l(e,t)&&!(Object.hasOwnProperty.call(e,t)&&Object.propertyIsEnumerable.call(e,t))})(e,i)||(l(e,i)&&a.isMergeableObject(t[i])?n[i]=function(e,t){if(!t.customMerge)return c;var a=t.customMerge(e);return"function"==typeof a?a:c}(i,a)(e[i],t[i],a):n[i]=r(t[i],a))})),n}(e,t,a):r(t,a)}c.all=function(e,t){if(!Array.isArray(e))throw new Error("first argument should be an array");return e.reduce((function(e,a){return c(e,a,t)}),{})};var u=c;e.exports=u},function(e,t,a){"use strict";a.d(t,"s",(function(){return s})),a.d(t,"r",(function(){return o})),a.d(t,"m",(function(){return l})),a.d(t,"t",(function(){return c})),a.d(t,"u",(function(){return u})),a.d(t,"o",(function(){return d})),a.d(t,"q",(function(){return p})),a.d(t,"b",(function(){return m})),a.d(t,"n",(function(){return b})),a.d(t,"p",(function(){return g})),a.d(t,"a",(function(){return f})),a.d(t,"k",(function(){return y})),a.d(t,"l",(function(){return h})),a.d(t,"i",(function(){return v})),a.d(t,"j",(function(){return E})),a.d(t,"w",(function(){return x})),a.d(t,"v",(function(){return j})),a.d(t,"h",(function(){return S})),a.d(t,"g",(function(){return k})),a.d(t,"f",(function(){return O})),a.d(t,"c",(function(){return w})),a.d(t,"d",(function(){return T})),a.d(t,"e",(function(){return I}));var n=a(5),i=a(119);const r=(e,t)=>{switch(e){case i.d.alert:return n.i18n.translate("xpack.securitySolution.toolbar.bulkActions.entityAlerts",{values:{count:t},defaultMessage:"{count, plural, =1 {alert} other {alerts}}"});case i.d.event:return n.i18n.translate("xpack.securitySolution.toolbar.bulkActions.entityEvents",{values:{count:t},defaultMessage:"{count, plural, =1 {event} other {events}}"});case i.d.session:return n.i18n.translate("xpack.securitySolution.toolbar.bulkActions.entitySessions",{values:{count:t},defaultMessage:"{count, plural, =1 {session} other {sessions}}"})}},s=(e,t,a)=>n.i18n.translate("xpack.securitySolution.toolbar.bulkActions.selectAllEntitiesTitle",{values:{entityPlural:r(e,a),totalFormatted:t,total:a},defaultMessage:"Select {total, plural, =1 {} other {all}} {totalFormatted} {entityPlural}"}),o=(e,t,a)=>n.i18n.translate("xpack.securitySolution.toolbar.bulkActions.selectedEntitiesTitle",{values:{entityPlural:r(e,a),totalFormatted:t},defaultMessage:"Selected {totalFormatted} {entityPlural}"}),l=n.i18n.translate("xpack.securitySolution.toolbar.bulkActions.clearSelectionTitle",{defaultMessage:"Clear selection"}),c=e=>n.i18n.translate("xpack.securitySolution.bulkActions.updateAlertStatusFailed",{values:{conflicts:e},defaultMessage:"Failed to update { conflicts } {conflicts, plural, =1 {alert} other {alerts}}."}),u=(e,t)=>n.i18n.translate("xpack.securitySolution.bulkActions.updateAlertStatusFailedDetailed",{values:{updated:e,conflicts:t},defaultMessage:"{ updated } {updated, plural, =1 {alert was} other {alerts were}} updated successfully, but { conflicts } failed to update\n         because { conflicts, plural, =1 {it was} other {they were}} already being modified."}),d=e=>n.i18n.translate("xpack.securitySolution.bulkActions.closedAlertSuccessToastMessage",{values:{totalAlerts:e},defaultMessage:"Successfully closed {totalAlerts} {totalAlerts, plural, =1 {alert} other {alerts}}."}),p=e=>n.i18n.translate("xpack.securitySolution.bulkActions.openedAlertSuccessToastMessage",{values:{totalAlerts:e},defaultMessage:"Successfully opened {totalAlerts} {totalAlerts, plural, =1 {alert} other {alerts}}."}),m=e=>n.i18n.translate("xpack.securitySolution.bulkActions.acknowledgedAlertSuccessToastMessage",{values:{totalAlerts:e},defaultMessage:"Successfully marked {totalAlerts} {totalAlerts, plural, =1 {alert} other {alerts}} as acknowledged."}),b=n.i18n.translate("xpack.securitySolution.bulkActions.closedAlertFailedToastMessage",{defaultMessage:"Failed to close alert(s)."}),g=n.i18n.translate("xpack.securitySolution.bulkActions.openedAlertFailedToastMessage",{defaultMessage:"Failed to open alert(s)"}),f=n.i18n.translate("xpack.securitySolution.bulkActions.acknowledgedAlertFailedToastMessage",{defaultMessage:"Failed to mark alert(s) as acknowledged"}),y=n.i18n.translate("xpack.securitySolution.bulkActions.updateAlertStatusFailedSingleAlert",{defaultMessage:"Failed to update alert because it was already being modified."}),h=n.i18n.translate("xpack.securitySolution.bulkActions.openSelectedTitle",{defaultMessage:"Mark as open"}),v=n.i18n.translate("xpack.securitySolution.bulkActions.acknowledgedSelectedTitle",{defaultMessage:"Mark as acknowledged"}),E=n.i18n.translate("xpack.securitySolution.bulkActions.closeSelectedTitle",{defaultMessage:"Mark as closed"}),x=e=>n.i18n.translate("xpack.securitySolution.bulkActions.updateAlertTagsSuccessToastMessage",{values:{totalAlerts:e},defaultMessage:"Successfully updated tags for {totalAlerts} {totalAlerts, plural, =1 {alert} other {alerts}}."}),j=n.i18n.translate("xpack.securitySolution.bulkActions.updateAlertTagsFailedToastMessage",{defaultMessage:"Failed to update alert tags."}),S=n.i18n.translate("xpack.securitySolution.bulkActions.alertTagsMenuSearchPlaceholderMessage",{defaultMessage:"Search tags"}),k=n.i18n.translate("xpack.securitySolution.bulkActions.alertTagsMenuSearchNoTagsFoundMessage",{defaultMessage:"No tags match current search"}),O=n.i18n.translate("xpack.securitySolution.bulkActions.alertTagsMenuEmptyMessage",{defaultMessage:"No alert tag options exist, add tag options in Kibana Advanced Settings."}),w=n.i18n.translate("xpack.securitySolution.bulkActions.alertTagsApplyButtonMessage",{defaultMessage:"Apply tags"}),T=n.i18n.translate("xpack.securitySolution.bulkActions.alertTagsContextMenuItemTitle",{defaultMessage:"Apply alert tags"}),I=n.i18n.translate("xpack.securitySolution.bulkActions.alertTagsContextMenuItemTooltip",{defaultMessage:"Change alert tag options in Kibana Advanced Settings."})},function(e,t,a){"use strict";a.d(t,"a",(function(){return f})),a.d(t,"b",(function(){return y}));var n=a(2),i=a.n(n),r=a(10),s=a.n(r),o=a(3),l=a(45),c=a(908),u=a(115),d=a(102),p=a(199);const m={activeStep:0,endTourStep:()=>{},incrementStep:()=>{},isTourShown:()=>!1,setStep:()=>{}},b=Object(n.createContext)(m),g=({children:e})=>{var t,a;const{guidedOnboardingApi:r}=Object(d.j)().services.guidedOnboarding,l=s()(null!==(t=null==r?void 0:r.isGuideStepActive$(c.a,p.b.rules).pipe(Object(o.timeout)(3e4),Object(o.catchError)((e=>Object(o.of)(!1)))))&&void 0!==t?t:Object(o.of)(!1),!1),u=s()(null!==(a=null==r?void 0:r.isGuideStepActive$(c.a,p.b.alertsCases).pipe(Object(o.timeout)(3e4),Object(o.catchError)((e=>Object(o.of)(!1)))))&&void 0!==a?a:Object(o.of)(!1),!1),m=Object(n.useMemo)((()=>({[p.b.rules]:l,[p.b.alertsCases]:u})),[l,u]),g=Object(n.useCallback)((e=>m[e]),[m]),[f,y]=Object(n.useState)(1),h=Object(n.useCallback)((e=>{y((t=>(t>=p.e[e].length?0:t)+1))}),[]),v=Object(n.useCallback)(((e,t)=>{t<=p.e[e].length&&y(t)}),[]),[E,x]=Object(n.useState)(null);Object(n.useEffect)((()=>{if(!E||!r)return;let e=!1;return(async()=>{await r.completeGuideStep(c.a,E),e||(x(null),y(1))})(),()=>{e=!0}}),[E,r]);const j=Object(n.useCallback)((e=>{x(e)}),[]),S=Object(n.useMemo)((()=>({activeStep:f,endTourStep:j,incrementStep:h,isTourShown:g,setStep:v})),[f,j,h,g,v]);return i.a.createElement(b.Provider,{value:S},e)},f=({children:e})=>{const{pathname:t}=Object(l.useLocation)(),a=Object(n.useMemo)((()=>Object(u.isTourPath)(t)?g:b.Provider),[t]);return i.a.createElement(a,{value:m},e)},y=()=>{const e=Object(n.useContext)(b);if(!e)throw new Error("useTourContext can only be called inside of TourContext!");return e}},function(e,t,a){"use strict";a.d(t,"i",(function(){return s})),a.d(t,"b",(function(){return o})),a.d(t,"g",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"f",(function(){return u})),a.d(t,"d",(function(){return d})),a.d(t,"h",(function(){return p})),a.d(t,"e",(function(){return m})),a.d(t,"a",(function(){return b}));var n=a(42),i=a(106),r=a(389);const s=(e,t)=>"__typename"!==e&&null!=t?t:void 0,o=e=>!Object(n.isEmpty)(e),l=({isAlert:e,isPinned:t,eventHasNotes:a,timelineType:n})=>n===i.l.template?r.b(e):t&&a?r.d(e):t?r.c(e):r.g(e),c=({eventId:e,pinnedEventIds:t})=>!0===t[e],u=({allowUnpinning:e,eventId:t,onPinEvent:a,onUnPinEvent:n,isEventPinned:i})=>{e&&(i?n(t):a(t))},d=(e,t,a)=>e.reduce(((e,n)=>({...e,...t.includes(n._id)?{[n._id]:n.data.filter((e=>a.includes(e.field)))}:{}})),{}),p=e=>{var t;if(!Object(n.isEmpty)(null===(t=e.eql)||void 0===t?void 0:t.sequenceNumber))try{var a,i;const t=(null!==(a=null===(i=e.eql)||void 0===i?void 0:i.sequenceNumber)&&void 0!==a?a:"").split("-")[0];return parseInt(t,10)%2==0}catch{return!1}return!1},m=e=>{var t,a,i,r;return Object(n.isEmpty)(null===(t=e.kibana)||void 0===t||null===(a=t.alert)||void 0===a||null===(i=a.rule)||void 0===i?void 0:i.uuid)?Object(n.isEmpty)(null===(r=e.eql)||void 0===r?void 0:r.parentId)?"raw":"eql":"signal"},b="note-content"},function(e,t,a){"use strict";a.d(t,"a",(function(){return r})),a.d(t,"b",(function(){return s}));var n=a(5),i=a(174);n.i18n.translate("xpack.securitySolution.endpointsTab",{defaultMessage:"Endpoints"}),n.i18n.translate("xpack.securitySolution.policiesTab",{defaultMessage:"Policies"}),n.i18n.translate("xpack.securitySolution.trustedAppsTab",{defaultMessage:"Trusted applications"}),n.i18n.translate("xpack.securitySolution.eventFiltersTab",{defaultMessage:"Event filters"});const r={[i.c.WINDOWS]:n.i18n.translate("xpack.securitySolution.administration.os.windows",{defaultMessage:"Windows"}),[i.c.MAC]:n.i18n.translate("xpack.securitySolution.administration.os.macos",{defaultMessage:"Mac"}),[i.c.LINUX]:n.i18n.translate("xpack.securitySolution.administration.os.linux",{defaultMessage:"Linux"})},s=e=>n.i18n.translate("xpack.securitySolution.exceptions.failedLoadPolicies",{defaultMessage:'There was an error loading policies: "{error}"',values:{error:e.message}})},function(e,t,a){"use strict";a.d(t,"a",(function(){return h}));var n=a(42),i=a(2),r=a(64),s=a.n(r),o=a(130),l=a.n(o),c=a(3),u=a(51),d=a(54),p=a(102),m=a(113),b=a(108),g=a(5);const f=g.i18n.translate("xpack.securitySolution.timeline.failDescription",{defaultMessage:"An error has occurred"}),y=g.i18n.translate("xpack.securitySolution.timeline.failSearchDescription",{defaultMessage:"Failed to run search"}),h=({entityType:e=d.EntityType.EVENTS,indexName:t,eventId:a,runtimeMappings:r,skip:o})=>{const{data:g}=Object(p.j)().services,h=Object(i.useRef)((()=>Promise.resolve())),v=Object(i.useRef)(new AbortController),E=Object(i.useRef)(new c.Subscription),[x,j]=Object(i.useState)(!0),[S,k]=Object(i.useState)(null),{addError:O,addWarning:w}=Object(b.a)(),[T,I]=Object(i.useState)(null),[C,M]=Object(i.useState)(null),[_,F]=Object(i.useState)(void 0),A=Object(i.useCallback)((e=>{if(null==e||o||Object(n.isEmpty)(e.eventId))return;const t=async()=>{v.current=new AbortController,j(!0),E.current=g.search.search(e,{strategy:"timelineSearchStrategy",abortSignal:v.current.signal}).subscribe({next:e=>{Object(u.isCompleteResponse)(e)?Promise.resolve().then((()=>{s.a.unstable_batchedUpdates((()=>{j(!1),I(e.data||[]),F(e.rawResponse.hits.hits[0]),M(e.ecs||null),E.current.unsubscribe()}))})):Object(u.isErrorResponse)(e)&&(j(!1),w(f),E.current.unsubscribe())},error:e=>{j(!1),O(e,{title:y}),E.current.unsubscribe()}})};E.current.unsubscribe(),v.current.abort(),t(),h.current=t}),[g.search,O,w,o]);return Object(i.useEffect)((()=>{k((n=>{const i={...null!=n?n:{},entityType:e,indexName:t,eventId:a,factoryQueryType:m.A.details,runtimeMappings:r};return l()(n,i)?n:i}))}),[e,a,t,r]),Object(i.useEffect)((()=>(A(S),()=>{E.current.unsubscribe(),v.current.abort()})),[S,A]),[x,T,_,C,h.current]}},,function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(42);const i=({category:e,field:t},a)=>{const i=(({category:e,field:t},a)=>{var i,r,s;const o="signal"===e?"kibana":"kibana"===e?"signal":e,l="signal"===e?t.replace("signal","kibana.alert").replace("rule.id","rule.uuid"):"kibana"===e?t.replace("kibana.alert","signal").replace("rule.uuid","rule.id"):t;return null!==(i=null===(r=Object(n.find)({category:e,field:t},a))||void 0===r?void 0:r.values)&&void 0!==i?i:null===(s=Object(n.find)({category:o,field:l},a))||void 0===s?void 0:s.values})({category:e,field:t},a);return i&&i.length>0?i[0]:""}},function(e,t,a){"use strict";a.d(t,"b",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"a",(function(){return o}));var n=a(112),i=a(771);let r;a(145),a(262),function(e){e.trace="trace",e.debug="debug",e.info="info",e.warn="warn",e.error="error"}(r||(r={}));const s=Object(n.u)("LogLevel",r),o=Object.values(r);Object(i.a)(r)},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(43);const i=a(112).n,r=n.partial({total_search_duration_ms:i,total_indexing_duration_ms:i,total_enrichment_duration_ms:i,execution_gap_duration_s:i})},function(e,t,a){"use strict";a.d(t,"a",(function(){return u})),a.d(t,"b",(function(){return d})),a.d(t,"c",(function(){return p}));var n=a(46),i=a(2),r=a(4),s=a(409),o=a(143),l=a(354);const c=["GET",r.gb],u=(e,t)=>Object(n.useQuery)([...c,e],(async({signal:t})=>{const a=await Object(o.h)({signal:t,id:e});return Object(s.a)(a)}),{...l.a,...t,staleTime:0,enabled:!!e}),d=()=>{const e=Object(n.useQueryClient)();return Object(i.useCallback)((()=>{e.invalidateQueries(c,{refetchType:"active"})}),[e])},p=()=>{const e=Object(n.useQueryClient)();return Object(i.useCallback)((t=>{e.setQueryData([...c,t.id],Object(s.a)(t))}),[e])}},,function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"e",(function(){return s})),a.d(t,"f",(function(){return o})),a.d(t,"g",(function(){return l})),a.d(t,"a",(function(){return c})),a.d(t,"h",(function(){return u})),a.d(t,"d",(function(){return d}));var n=a(5);const i=n.i18n.translate("xpack.elasticAssistant.assistant.clearChat",{defaultMessage:"Clear chat"}),r=n.i18n.translate("xpack.elasticAssistant.assistant.defaultAssistantTitle",{defaultMessage:"Elastic AI Assistant"}),s=n.i18n.translate("xpack.elasticAssistant.assistant.settings.showAnonymizedToggleLabel",{defaultMessage:"Show anonymized"}),o=n.i18n.translate("xpack.elasticAssistant.assistant.settings.showAnonymizedTooltip",{defaultMessage:"Show the anonymized values sent to and from the assistant"}),l=n.i18n.translate("xpack.elasticAssistant.assistant.submitMessage",{defaultMessage:"Submit message"}),c=n.i18n.translate("xpack.elasticAssistant.assistant.apiErrorTitle",{defaultMessage:"An error occurred sending your message. If the problem persists, please test the connector configuration."}),u=n.i18n.translate("xpack.elasticAssistant.documentationLinks.ariaLabel",{defaultMessage:"Click to open Elastic Assistant documentation in a new tab"}),d=n.i18n.translate("xpack.elasticAssistant.documentationLinks.documentation",{defaultMessage:"documentation"})},function(e,t,a){"use strict";a.d(t,"b",(function(){return l})),a.d(t,"a",(function(){return c})),a.d(t,"d",(function(){return u})),a.d(t,"c",(function(){return d})),a.d(t,"e",(function(){return p}));var n=a(5);const i=n.i18n.translate("xpack.elasticAssistant.assistant.content.prompts.system.youAreAHelpfulExpertAssistant",{defaultMessage:"You are a helpful, expert assistant who answers questions about Elastic Security."}),r=n.i18n.translate("xpack.elasticAssistant.assistant.content.prompts.system.useTheFollowingContextToAnswer",{defaultMessage:"Use the following context to answer questions:"}),s=n.i18n.translate("xpack.elasticAssistant.assistant.content.prompts.system.ifYouDontKnowTheAnswer",{defaultMessage:"Do not answer questions unrelated to Elastic Security."}),o=n.i18n.translate("xpack.elasticAssistant.assistant.content.prompts.system.superheroPersonality",{defaultMessage:"Provide the most detailed and relevant answer possible, as if you were relaying this information back to a cyber security expert."}),l=`${i} ${s}\n${r}`,c=n.i18n.translate("xpack.elasticAssistant.assistant.content.prompts.system.defaultSystemPromptName",{defaultMessage:"Default system prompt"}),u=`${i} ${s}\n${o}\n${r}`,d=n.i18n.translate("xpack.elasticAssistant.assistant.content.prompts.system.superheroSystemPromptName",{defaultMessage:"Enhanced system prompt"}),p=e=>`CONTEXT:\n"""\n${e}\n"""`},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n={SYSTEM_PROMPT_SELECTOR:"systemPromptSelector",CONVERSATIONS_MULTISELECTOR:"conversationMultiSelector",ADD_SYSTEM_PROMPT:"addSystemPrompt",PROMPT_SUPERSELECT:"promptSuperSelect",CONVERSATIONS_MULTISELECTOR_OPTION:e=>`conversationMultiSelectorOption-${e}`,SETTINGS_MODAL:"settingsModal",SYSTEM_PROMPT_MODAL:{ID:"systemPromptModal",PROMPT_TEXT:"systemPromptModalPromptText",TOGGLE_ALL_DEFAULT_CONVERSATIONS:"systemPromptModalToggleDefaultConversations",SAVE:"systemPromptModalSave",CANCEL:"systemPromptModalCancel"}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(46),i=a(68),r=a(269);const s=["elastic-assistant, load-connectors"],o=({http:e,toasts:t})=>Object(n.useQuery)(s,(async()=>(await Object(i.loadAllActions)({http:e})).filter((e=>!e.isMissingSecrets&&".gen-ai"===e.actionTypeId))),{retry:!1,keepPreviousData:!0,onError:e=>{"AbortError"!==e.name&&(null==t||t.addError(e.body&&e.body.message?new Error(e.body.message):e,{title:r.n}))}})},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(445);t.default=function(e,t){var a=i.useFirstMountState();n.useEffect((function(){if(!a)return e()}),t)}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e){void 0===e&&(e={});var t=n.useState(e),a=t[0],i=t[1];return[a,n.useCallback((function(e){i((function(t){return Object.assign({},t,e instanceof Function?e(t):e)}))}),[i])]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e){n.useEffect(e,[])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(448));t.default=function(e){var t=i.useRef(0),a=i.useState(e),n=a[0],s=a[1],o=i.useCallback((function(e){cancelAnimationFrame(t.current),t.current=requestAnimationFrame((function(){s(e)}))}),[]);return r.default((function(){cancelAnimationFrame(t.current)})),[n,o]}},function(e,t,a){"use strict";var n=a(345);a.d(t,"b",(function(){return n.b})),a.d(t,"a",(function(){return n.a}))},function(e,t,a){"use strict";a.d(t,"i",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"j",(function(){return s})),a.d(t,"d",(function(){return o})),a.d(t,"h",(function(){return l})),a.d(t,"e",(function(){return c})),a.d(t,"f",(function(){return u})),a.d(t,"o",(function(){return d})),a.d(t,"n",(function(){return p})),a.d(t,"k",(function(){return m})),a.d(t,"m",(function(){return b})),a.d(t,"l",(function(){return g})),a.d(t,"b",(function(){return f})),a.d(t,"a",(function(){return y})),a.d(t,"g",(function(){return h}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.locationTitle",{defaultMessage:"Location"}),r=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.autonomousSystemTitle",{defaultMessage:"Autonomous system"}),s=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.maxAnomalyScoreByJobTitle",{defaultMessage:"Max anomaly score by job"}),o=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.firstSeenTitle",{defaultMessage:"First seen"}),l=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.lastSeenTitle",{defaultMessage:"Last seen"}),c=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.hostIdTitle",{defaultMessage:"Host ID"}),u=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.hostNameTitle",{defaultMessage:"Host name"}),d=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.whoIsTitle",{defaultMessage:"WhoIs"}),p=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.viewWhoisTitle",{defaultMessage:"iana.org"}),m=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.ipReputationTitle",{defaultMessage:"Reputation"}),b=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.viewVirusTotalTitle.",{defaultMessage:"virustotal.com"}),g=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.viewTalosIntelligenceTitle",{defaultMessage:"talosIntelligence.com"}),f=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.asSourceDropDownOptionLabel",{defaultMessage:"As Source"}),y=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.asDestinationDropDownOptionLabel",{defaultMessage:"As Destination"}),h=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.inspectTitle",{defaultMessage:"IP overview"})},function(e,t,a){"use strict";a.d(t,"c",(function(){return p})),a.d(t,"a",(function(){return u})),a.d(t,"b",(function(){return d}));var n,i=a(2),r=a(64),s=(n=function(e,t){return n=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var a in t)t.hasOwnProperty(a)&&(e[a]=t[a])},n(e,t)},function(e,t){function a(){this.constructor=e}n(e,t),e.prototype=null===t?Object.create(t):(a.prototype=t.prototype,new a)}),o="html",l="svg",c=function(e,t){var a,n,i,r={};if(e===o)i=document.createElement("div");else{if(e!==l)throw new Error('Invalid element type "'+e+'" for createPortalNode: must be "html" or "svg".');i=document.createElementNS("http://www.w3.org/2000/svg","g")}if(t&&"object"==typeof t)for(var s=0,c=Object.entries(t.attributes);s<c.length;s++){var u=c[s],d=u[0],p=u[1];i.setAttribute(d,p)}var m={element:i,elementType:e,setPortalProps:function(e){r=e},getInitialPortalProps:function(){return r},mount:function(t,i){if(i!==n){if(m.unmount(),t!==a&&!function(e,t){if(t===o)return e instanceof HTMLElement;if(t===l)return e instanceof SVGElement;throw new Error('Unrecognized element type "'+t+'" for validateElementType.')}(t,e))throw new Error('Invalid element type for portal: "'+e+'" portalNodes must be used with '+e+" elements, but OutPortal is within <"+t.tagName+">.");t.replaceChild(m.element,i),a=t,n=i}},unmount:function(e){e&&e!==n||a&&n&&(a.replaceChild(n,m.element),a=void 0,n=void 0)}};return m},u=function(e){function t(t){var a=e.call(this,t)||this;return a.addPropsChannel=function(){Object.assign(a.props.node,{setPortalProps:function(e){a.setState({nodeProps:e})}})},a.state={nodeProps:a.props.node.getInitialPortalProps()},a}return s(t,e),t.prototype.componentDidMount=function(){this.addPropsChannel()},t.prototype.componentDidUpdate=function(){this.addPropsChannel()},t.prototype.render=function(){var e=this,t=this.props,a=t.children,n=t.node;return r.createPortal(i.Children.map(a,(function(t){return i.isValidElement(t)?i.cloneElement(t,e.state.nodeProps):t})),n.element)},t}(i.PureComponent),d=function(e){function t(t){var a=e.call(this,t)||this;return a.placeholderNode=i.createRef(),a.passPropsThroughPortal(),a}return s(t,e),t.prototype.passPropsThroughPortal=function(){var e=Object.assign({},this.props,{node:void 0});this.props.node.setPortalProps(e)},t.prototype.componentDidMount=function(){var e=this.props.node;this.currentPortalNode=e;var t=this.placeholderNode.current,a=t.parentNode;e.mount(a,t),this.passPropsThroughPortal()},t.prototype.componentDidUpdate=function(){var e=this.props.node;this.currentPortalNode&&e!==this.currentPortalNode&&(this.currentPortalNode.unmount(this.placeholderNode.current),this.currentPortalNode=e);var t=this.placeholderNode.current,a=t.parentNode;e.mount(a,t),this.passPropsThroughPortal()},t.prototype.componentWillUnmount=function(){this.props.node.unmount(this.placeholderNode.current)},t.prototype.render=function(){return i.createElement("div",{ref:this.placeholderNode})},t}(i.PureComponent),p=c.bind(null,o);c.bind(null,l)},function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"f",(function(){return i})),a.d(t,"e",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"d",(function(){return o})),a.d(t,"b",(function(){return l}));const n="kibana.alert.ancestors.id",i="kibana.alert.rule.indices",r="kibana.alert.original_event.id",s="process.entry_leader.entity_id",o="process.entry_leader.start",l="kibana.alert.ancestors.index"},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a.n(n),r=a(385),s=a(610);const o=i.a.memo((({influencers:e,startDate:t,endDate:a,children:o,criteriaFields:l,skip:c})=>{const{jobNameById:u}=Object(r.a)(),d=Object(n.useMemo)((()=>Object.keys(u)),[u]),[p,m]=Object(s.a)({criteriaFields:l,influencers:e,startDate:t,endDate:a,skip:c,jobIds:d,aggregationInterval:"auto"});return i.a.createElement(i.a.Fragment,null,o({isLoadingAnomaliesData:p,anomaliesData:m,jobNameById:u}))}));o.displayName="AnomalyTableProvider"},function(e,t,a){"use strict";a.d(t,"d",(function(){return s})),a.d(t,"c",(function(){return o})),a.d(t,"b",(function(){return l})),a.d(t,"a",(function(){return c}));var n=a(47),i=a(226);const r=i.b.length,s=e=>{var t;return void 0!==(null!==(t=e.tags)&&void 0!==t?t:[]).find((e=>e===i.d))},o=e=>!s(e),l=e=>{var t;const a=[],n=null!==(t=e.tags)&&void 0!==t?t:[];for(const e of n)e!==i.d&&e.startsWith(i.b)&&a.push(e.substring(r));return a},c=e=>({comments:[],description:"",entries:[],item_id:void 0,list_id:e,meta:{temporaryUuid:Object(n.v4)()},name:"",namespace_type:"agnostic",tags:[i.d],type:"simple",os_types:["windows"]})},function(e,t,a){"use strict";var n=Object.assign;e.exports=n},function(e,t,a){"use strict";a.d(t,"g",(function(){return o})),a.d(t,"i",(function(){return l})),a.d(t,"e",(function(){return c})),a.d(t,"f",(function(){return u})),a.d(t,"d",(function(){return d})),a.d(t,"h",(function(){return p})),a.d(t,"c",(function(){return m})),a.d(t,"a",(function(){return b})),a.d(t,"j",(function(){return g})),a.d(t,"b",(function(){return f}));var n=a(47),i=a(5),r=a(174),s=a(193);const o=(e,t,a)=>a.reduce(((a,i,r)=>{const s=((e,t,a,i,r=n.v4)=>{var s;const{fields:o}=e,{fields:l}=t,c=a.field,u=a.value,[d]=o.filter((({name:e})=>null!=c&&c===e)),[p]=l.filter((({name:e})=>null!=u&&u===e));return{id:null!==(s=a.id)&&void 0!==s?s:r(),field:d,type:"mapping",value:p,entryIndex:i}})(e,t,i,r);return[...a,s]}),[]),l=(e,t)=>({...e,entries:[...e.entries.slice(0,t),...e.entries.slice(t+1)]}),c=(e,t)=>{const{entryIndex:a}=e;return{updatedEntry:{id:e.id,field:null!=t?t.name:"",type:"mapping",value:null!=e.value?e.value.name:""},index:a}},u=(e,t)=>{const{entryIndex:a}=e;return{updatedEntry:{id:e.id,field:null!=e.field?e.field.name:"",type:"mapping",value:null!=t?t.name:""},index:a}},d=()=>Object(r.d)({field:"",type:"mapping",value:""}),p=()=>Object(r.d)({entries:[Object(r.d)({field:"",type:"mapping",value:""})]}),m=e=>e.reduce(((e,t)=>{const a={...t,entries:t.entries};return s.w.is(a)?[...e,a]:e}),[]),b=e=>e.some((e=>e.entries.some((e=>""===e.field||""===e.value)))),g=e=>1===e.length&&1===e[0].entries.length&&""===e[0].entries[0].field&&""===e[0].entries[0].value,f={forbiddenField:(e,t)=>{let a;if(a="string"==typeof e?e===t:!!Array.isArray(e)&&!!e.find((e=>e===t)),a)return{code:"ERR_FIELD_FORMAT",message:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.threatMatchIndexForbiddenError",{defaultMessage:"The index pattern cannot be { forbiddenString }. Please choose a more specific index pattern.",values:{forbiddenString:t}})}}}},function(e,t,a){"use strict";a.d(t,"m",(function(){return i})),a.d(t,"k",(function(){return r})),a.d(t,"l",(function(){return s})),a.d(t,"i",(function(){return o})),a.d(t,"j",(function(){return l})),a.d(t,"h",(function(){return c})),a.d(t,"g",(function(){return u})),a.d(t,"b",(function(){return d})),a.d(t,"a",(function(){return p})),a.d(t,"d",(function(){return m})),a.d(t,"c",(function(){return b})),a.d(t,"f",(function(){return g})),a.d(t,"e",(function(){return f}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.detectionEngine.eqlValidation.requestError",{defaultMessage:"An error occurred while validating your EQL query"}),r=n.i18n.translate("xpack.securitySolution.detectionEngine.eqlValidation.title",{defaultMessage:"EQL Validation Errors"}),s=n.i18n.translate("xpack.securitySolution.detectionEngine.eqlValidation.showErrorsLabel",{defaultMessage:"Show EQL Validation Errors"}),o=n.i18n.translate("xpack.securitySolution.detectionEngine.eqlOverViewLink.text",{defaultMessage:"Event Query Language (EQL) Overview"}),l=n.i18n.translate("xpack.securitySolution.detectionEngine.eqlSettings.title",{defaultMessage:"EQL settings"}),c=n.i18n.translate("xpack.securitySolution.detectionEngine.eqlOptionsSize.label",{defaultMessage:"Size"}),u=n.i18n.translate("xpack.securitySolution.detectionEngine.eqlOptionsSize.text",{defaultMessage:"For basic queries, the maximum number of matching events to return. For sequence queries, the maximum number of matching sequences to return."}),d=n.i18n.translate("xpack.securitySolution.detectionEngine.eqlOptionsEventCategoryField.label",{defaultMessage:"Event category field"}),p=n.i18n.translate("xpack.securitySolution.detectionEngine.eqlOptionsEventCategoryField.text",{defaultMessage:"Field containing the event classification, such as process, file, or network. This field is typically mapped as a field type in the keyword family"}),m=n.i18n.translate("xpack.securitySolution.detectionEngine.eqlOptionsEventTiebreakerField.label",{defaultMessage:"Tiebreaker field"}),b=n.i18n.translate("xpack.securitySolution.detectionEngine.eqlOptionsEventTiebreakerField.text",{defaultMessage:"Field used to sort hits with the same timestamp in ascending, lexicographic order"}),g=n.i18n.translate("xpack.securitySolution.detectionEngine.eqlOptionsEventTimestampField.label",{defaultMessage:"Timestamp field"}),f=n.i18n.translate("xpack.securitySolution.detectionEngine.eqlOptionsEventTimestampField.text",{defaultMessage:"Field containing event timestamp"})},function(e,t,a){"use strict";a.d(t,"b",(function(){return Ue})),a.d(t,"c",(function(){return He})),a.d(t,"d",(function(){return Ge})),a.d(t,"a",(function(){return at}));var n=a(2),i=a.n(n),r=a(40),s=a(41),o=a.n(s),l=a(21),c=a(775),u=a(136),d=a(869),p=a(305),m=a(897),b=a(885),g=a(5);g.i18n.translate("xpack.elasticAssistant.dataAnonymization.settings.anonymizationSettings.calloutParagraph1",{defaultMessage:"The fields below are allowed by default"}),g.i18n.translate("xpack.elasticAssistant.dataAnonymization.settings.anonymizationSettings.calloutParagraph2",{defaultMessage:"Optionally enable anonymization for these fields"}),g.i18n.translate("xpack.elasticAssistant.dataAnonymization.settings.anonymizationSettings.calloutTitle",{defaultMessage:"Anonymization defaults"});const f=g.i18n.translate("xpack.elasticAssistant.dataAnonymization.settings.anonymizationSettings.settingsTitle",{defaultMessage:"Anonymization"}),y=g.i18n.translate("xpack.elasticAssistant.dataAnonymization.settings.anonymizationSettings.settingsDescription",{defaultMessage:"When adding Prompt Context throughout the Security App that may contain sensitive information, you can choose which fields are sent, and whether to enable anonymization for these fields. This will replace the field's value with a random string before sending the conversation. Helpful defaults are provided below."}),h=o()(r.EuiFlexItem)`
  margin-right: ${({theme:e})=>e.eui.euiSizeL};
`,v=({defaultAllow:e,defaultAllowReplacement:t,pageSize:a,setUpdatedDefaultAllow:s,setUpdatedDefaultAllowReplacement:o})=>{const{baseAllow:c,baseAllowReplacement:g}=Object(u.b)(),v=Object(n.useCallback)((a=>{Object(p.e)({defaultAllow:e,defaultAllowReplacement:t,setDefaultAllow:s,setDefaultAllowReplacement:o,updates:a})}),[e,t,s,o]),E=Object(n.useCallback)((()=>{s(c),o(g)}),[c,g,s,o]),x=Object(n.useMemo)((()=>{const a=new Set(e);return t.reduce(((e,t)=>a.has(t)?e+1:e),0)}),[e,t]);return Object(l.jsx)(i.a.Fragment,null,Object(l.jsx)(r.EuiTitle,{size:"s"},Object(l.jsx)("h2",null,f)),Object(l.jsx)(r.EuiSpacer,{size:"xs"}),Object(l.jsx)(r.EuiText,{size:"xs"},y),Object(l.jsx)(r.EuiHorizontalRule,{margin:"s"}),Object(l.jsx)(r.EuiFlexGroup,{alignItems:"center","data-test-subj":"summary",gutterSize:"none"},Object(l.jsx)(h,{grow:!1},Object(l.jsx)(m.a,{allowed:e.length,total:e.length})),Object(l.jsx)(h,{grow:!1},Object(l.jsx)(b.a,{anonymized:x,isDataAnonymizable:!0}))),Object(l.jsx)(r.EuiSpacer,{size:"s"}),Object(l.jsx)(d.a,{allow:e,allowReplacement:t,onListUpdated:v,onReset:E,rawData:null,pageSize:a}))};v.displayName="AnonymizationSettingsComponent";const E=i.a.memo(v),x=g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.settings.settingsTitle",{defaultMessage:"Quick Prompts"}),j=g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.settings.settingsDescription",{defaultMessage:"Create and manage Quick Prompts. Quick Prompts are shortcuts to common actions."}),S=(g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.settings.modalTitle",{defaultMessage:"Quick Prompts"}),g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.settings.nameLabel",{defaultMessage:"Name"})),k=g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.settings.promptLabel",{defaultMessage:"Prompt"}),O=g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.settings.promptPlaceholder",{defaultMessage:"Enter a Quick Prompt"}),w=g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.settings.badgeColorLabel",{defaultMessage:"Badge color"}),T=g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.settings.contextsLabel",{defaultMessage:"Contexts"}),I=g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.settings.contextsHelpText",{defaultMessage:"Select the Prompt Contexts that this Quick Prompt will be available for. Selecting none will make this Quick Prompt available at all times."}),C=(g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.modalCancelButtonTitle",{defaultMessage:"Cancel"}),g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.modalSaveButtonTitle",{defaultMessage:"Save"}),g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.quickPromptSelector.ariaLabel",{defaultMessage:"Select or type to create new..."})),M=g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.quickPromptSelector.deletePromptTitle",{defaultMessage:"Delete Quick Prompt"}),_=g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.quickPromptSelector.customOptionText",{defaultMessage:"Create new Quick Prompt named"});var F={name:"4109g5",styles:"visibility:hidden;.parentFlexGroup:hover &{visibility:visible;}"},A={name:"d3v9zr",styles:"overflow:hidden"},D={name:"1e5733u",styles:"width:calc(100% - 60px)"};const N=i.a.memo((({isDisabled:e=!1,quickPrompts:t,onQuickPromptDeleted:a,onQuickPromptSelectionChange:i,selectedQuickPrompt:s})=>{const[o,c]=Object(n.useState)(t.map((e=>{var t;return{value:{isDefault:null!==(t=e.isDefault)&&void 0!==t&&t},label:e.title,color:e.color}}))),u=Object(n.useMemo)((()=>s?[{value:{isDefault:!0},label:s.title,color:s.color}]:[]),[s]),d=Object(n.useCallback)((e=>{var a,n;const r=0===e.length?void 0:null!==(a=t.find((t=>{var a;return t.title===(null===(a=e[0])||void 0===a?void 0:a.label)})))&&void 0!==a?a:null===(n=e[0])||void 0===n?void 0:n.label;i(r)}),[i,t]),p=Object(n.useCallback)(((e,t=[])=>{if(!e||!e.trim().toLowerCase())return;const a=e.trim().toLowerCase(),n={value:e,label:e};-1!==t.findIndex((e=>e.label.trim().toLowerCase()===a))||c([...o,n]),d([n])}),[d,o]),m=Object(n.useCallback)((e=>{0===e.length?d([]):-1!==o.findIndex((t=>t.label===(null==e?void 0:e[0].label)))&&d(e)}),[d,o]),b=Object(n.useCallback)((e=>{var t;c(o.filter((t=>t.label!==e))),(null==u||null===(t=u[0])||void 0===t?void 0:t.label)===e&&d([]),a(e)}),[d,a,o,u]);return Object(l.jsx)(r.EuiComboBox,{"aria-label":C,compressed:!0,isDisabled:e,placeholder:C,customOptionText:`${_} {searchValue}`,singleSelection:!0,options:o,selectedOptions:u,onChange:m,onCreateOption:p,renderOption:(e,t,a)=>{const{color:n,label:i,value:s}=e;return Object(l.jsx)(r.EuiFlexGroup,{alignItems:"center",className:"parentFlexGroup",component:"span",justifyContent:"spaceBetween"},Object(l.jsx)(r.EuiFlexItem,{component:"span",grow:!1,css:D},Object(l.jsx)(r.EuiHealth,{color:n,css:A},Object(l.jsx)(r.EuiHighlight,{search:t},i))),!(null!=s&&s.isDefault)&&Object(l.jsx)(r.EuiFlexItem,{grow:!1},Object(l.jsx)(r.EuiToolTip,{position:"right",content:M},Object(l.jsx)(r.EuiButtonIcon,{iconType:"cross","aria-label":M,color:"danger",onClick:e=>{e.stopPropagation(),b(i)},css:F}))))},fullWidth:!0})}));N.displayName="QuickPromptSelector";const P=g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.promptContextSelector.ariaLabel",{defaultMessage:"Select Prompt Context categories this Quick Prompt will be available for."}),R=g.i18n.translate("xpack.elasticAssistant.assistant.quickPrompts.promptContextSelector.placeholderLabel",{defaultMessage:"(Quick Prompt will always be visible)."}),L=i.a.memo((({isDisabled:e,onPromptContextSelectionChange:t,promptContexts:a,selectedPromptContexts:i=[]})=>{const s=Object(n.useMemo)((()=>a.map((e=>({value:{category:e.category},label:e.description})))),[a]),o=Object(n.useMemo)((()=>null!=i?i.map((e=>({value:{category:e.category},label:e.description}))):[]),[i]),c=Object(n.useCallback)((e=>{const n=a.filter((t=>e.some((e=>t.description===e.label))));t(n)}),[t,a]),u=Object(n.useCallback)((e=>{0===e.length?c([]):-1!==s.findIndex((t=>t.label===(null==e?void 0:e[0].label)))&&c(e)}),[c,s]);return Object(l.jsx)(r.EuiComboBox,{"aria-label":P,compressed:!0,fullWidth:!0,isDisabled:e,placeholder:R,options:s,selectedOptions:o,onChange:u,renderOption:(e,t,a)=>{const{label:n,value:i}=e;return Object(l.jsx)("span",{className:a},Object(l.jsx)(r.EuiHighlight,{search:t},n),Object(l.jsx)("span",null,` / (${null==i?void 0:i.category})`))}})}));L.displayName="PromptContextSelector";const B="#D36086";var q={name:"xpz1vu",styles:"min-height:150px"};const z=i.a.memo((({onSelectedQuickPromptChange:e,quickPromptSettings:t,selectedQuickPrompt:a,setUpdatedQuickPromptSettings:s})=>{const{basePromptContexts:o}=Object(u.b)(),c=Object(n.useMemo)((()=>{var e;return null!==(e=null==a?void 0:a.prompt)&&void 0!==e?e:""}),[null==a?void 0:a.prompt]),d=Object(n.useCallback)((e=>{null!=a&&s((t=>t.some((e=>e.title===a.title))?t.map((t=>t.title===a.title?{...t,prompt:e.target.value}:t)):t))}),[a,s]),p=Object(n.useMemo)((()=>{var e;return null!==(e=null==a?void 0:a.color)&&void 0!==e?e:B}),[null==a?void 0:a.color]),m=Object(n.useCallback)(((e,{hex:t,isValid:n})=>{null!=a&&s((t=>t.some((e=>e.title===a.title))?t.map((t=>t.title===a.title?{...t,color:e}:t)):t))}),[a,s]),b=Object(n.useMemo)((()=>{var e;return null!==(e=o.filter((e=>{var t;return null==a||null===(t=a.categories)||void 0===t?void 0:t.some((t=>(null==e?void 0:e.category)===t))})))&&void 0!==e?e:[]}),[o,null==a?void 0:a.categories]),g=Object(n.useCallback)((e=>{null!=a&&s((t=>t.some((e=>e.title===a.title))?t.map((t=>t.title===a.title?{...t,categories:e.map((e=>e.category))}:t)):t))}),[a,s]),f=Object(n.useCallback)((t=>{const a="string"==typeof t?{title:null!=t?t:"",prompt:"",color:B,categories:[]}:t;null!=a&&s((e=>e.some((e=>e.title===a.title))?e:[...e,a])),e(a)}),[e,s]),y=Object(n.useCallback)((e=>{s((t=>t.filter((t=>t.title!==e))))}),[s]);return Object(l.jsx)(i.a.Fragment,null,Object(l.jsx)(r.EuiTitle,{size:"s"},Object(l.jsx)("h2",null,x)),Object(l.jsx)(r.EuiSpacer,{size:"xs"}),Object(l.jsx)(r.EuiText,{size:"s"},j),Object(l.jsx)(r.EuiHorizontalRule,{margin:"s"}),Object(l.jsx)(r.EuiFormRow,{label:S,display:"rowCompressed",fullWidth:!0},Object(l.jsx)(N,{onQuickPromptDeleted:y,onQuickPromptSelectionChange:f,quickPrompts:t,selectedQuickPrompt:a})),Object(l.jsx)(r.EuiFormRow,{label:k,display:"rowCompressed",fullWidth:!0},Object(l.jsx)(r.EuiTextArea,{compressed:!0,disabled:null==a,fullWidth:!0,onChange:d,placeholder:O,value:c,css:q})),Object(l.jsx)(r.EuiFormRow,{display:"rowCompressed",fullWidth:!0,label:T,helpText:I},Object(l.jsx)(L,{isDisabled:null==a,onPromptContextSelectionChange:g,promptContexts:o,selectedPromptContexts:b})),Object(l.jsx)(r.EuiFormRow,{display:"rowCompressed",label:w},Object(l.jsx)(r.EuiColorPicker,{color:p,compressed:!0,disabled:null==a,onChange:m})))}));z.displayName="AddQuickPromptModal";var $=a(42);const V=g.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.settings.settingsTitle",{defaultMessage:"System Prompts"}),U=g.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.settings.settingsDescription",{defaultMessage:"Create and manage System Prompts. System Prompts are configurable chunks of context that are always sent for a given conversations."}),H=(g.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.settings.modalTitle",{defaultMessage:"System Prompts"}),g.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.settings.nameLabel",{defaultMessage:"Name"})),G=g.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.settings.promptLabel",{defaultMessage:"Prompt"}),Q=g.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.settings.promptPlaceholder",{defaultMessage:"Enter a System Prompt"}),W=g.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.settings.defaultConversationsLabel",{defaultMessage:"Default conversations"}),K=g.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.settings.defaultNewConversationTitle",{defaultMessage:"Use as default for all new conversations"}),Y=g.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.settings.defaultConversationsHelpText",{defaultMessage:"Conversations that should use this System Prompt by default"});g.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.slCancelButtonTitle",{defaultMessage:"Cancel"}),g.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.slSaveButtonTitle",{defaultMessage:"Save"});var J=a(357);const X=i.a.memo((({conversations:e,isDisabled:t=!1,onConversationSelectionChange:a,selectedConversations:i=[]})=>{const s=Object(n.useMemo)((()=>e.map((e=>({label:e.id,"data-test-subj":J.a.CONVERSATIONS_MULTISELECTOR_OPTION(e.id)})))),[e]),o=Object(n.useMemo)((()=>null!=i?i.map((e=>({label:e.id}))):[]),[i]),c=Object(n.useCallback)((t=>{const n=e.filter((e=>t.some((t=>e.id===t.label))));a(n)}),[a,e]),u=Object(n.useCallback)((e=>{0===e.length?c([]):-1!==s.findIndex((t=>t.label===(null==e?void 0:e[0].label)))&&c(e)}),[c,s]);return Object(l.jsx)(r.EuiComboBox,{"aria-label":W,compressed:!0,"data-test-subj":J.a.CONVERSATIONS_MULTISELECTOR,isDisabled:t,fullWidth:!0,options:s,selectedOptions:o,onChange:u})}));X.displayName="ConversationMultiSelector";const Z=g.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.systemPromptModal.systemPromptSelector.ariaLabel",{defaultMessage:"Select or type to create new..."}),ee=g.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.systemPromptModal.systemPromptSelector.deletePromptTitle",{defaultMessage:"Delete System Prompt"}),te=g.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.systemPromptModal.systemPromptSelector.customOptionText",{defaultMessage:"Create new System Prompt named"});var ae={name:"4109g5",styles:"visibility:hidden;.parentFlexGroup:hover &{visibility:visible;}"},ne={name:"1gz2b5f",styles:"overflow:hidden;text-overflow:ellipsis"},ie={name:"qhxz92",styles:"max-width:100%"},re={name:"1e5733u",styles:"width:calc(100% - 60px)"};const se=i.a.memo((({autoFocus:e=!1,systemPrompts:t,onSystemPromptDeleted:a,onSystemPromptSelectionChange:i,selectedSystemPrompt:s})=>{const[o,c]=Object(n.useState)(t.map((e=>{var t,a;return{value:{isDefault:null!==(t=e.isDefault)&&void 0!==t&&t,isNewConversationDefault:null!==(a=e.isNewConversationDefault)&&void 0!==a&&a},label:e.name,"data-test-subj":`${J.a.SYSTEM_PROMPT_SELECTOR}-${e.id}`}}))),u=Object(n.useMemo)((()=>{var e,t;return s?[{value:{isDefault:null!==(e=s.isDefault)&&void 0!==e&&e,isNewConversationDefault:null!==(t=s.isNewConversationDefault)&&void 0!==t&&t},label:s.name}]:[]}),[s]),d=Object(n.useCallback)((e=>{var a,n;const r=0===e.length?void 0:null!==(a=t.find((t=>{var a;return t.name===(null===(a=e[0])||void 0===a?void 0:a.label)})))&&void 0!==a?a:null===(n=e[0])||void 0===n?void 0:n.label;i(r)}),[i,t]),p=Object(n.useCallback)(((e,t=[])=>{if(!e||!e.trim().toLowerCase())return;const a=e.trim().toLowerCase(),n={value:e,label:e};-1!==t.findIndex((e=>e.label.trim().toLowerCase()===a))||c([...o,n]),d([n])}),[d,o]),m=Object(n.useCallback)((e=>{0===e.length?d([]):-1!==o.findIndex((t=>t.label===(null==e?void 0:e[0].label)))&&d(e)}),[d,o]),b=Object(n.useCallback)((e=>{var t;c(o.filter((t=>t.label!==e))),(null==u||null===(t=u[0])||void 0===t?void 0:t.label)===e&&d([]),a(e)}),[d,a,o,u]);return Object(l.jsx)(r.EuiComboBox,{"aria-label":Z,className:"systemPromptSelector",compressed:!0,"data-test-subj":J.a.SYSTEM_PROMPT_SELECTOR,fullWidth:!0,placeholder:Z,customOptionText:`${te} {searchValue}`,singleSelection:{asPlainText:!0},options:o,selectedOptions:u,onChange:m,onCreateOption:p,renderOption:(e,t,a)=>{const{label:n,value:i}=e;return Object(l.jsx)(r.EuiFlexGroup,{alignItems:"center",className:"parentFlexGroup",component:"span",justifyContent:"spaceBetween","data-test-subj":"systemPromptOptionSelector"},Object(l.jsx)(r.EuiFlexItem,{grow:!1,component:"span",css:re},Object(l.jsx)(r.EuiFlexGroup,{alignItems:"center",component:"span",gutterSize:"s"},Object(l.jsx)(r.EuiFlexItem,{component:"span",grow:!1,css:ie},Object(l.jsx)(r.EuiHighlight,{search:t,css:ne},n)),(null==i?void 0:i.isNewConversationDefault)&&Object(l.jsx)(r.EuiFlexItem,{grow:!1,component:"span"},Object(l.jsx)(r.EuiToolTip,{position:"right",content:K},Object(l.jsx)(r.EuiIcon,{type:"starFilled"}))))),!(null!=i&&i.isDefault)&&Object(l.jsx)(r.EuiFlexItem,{grow:!1,component:"span"},Object(l.jsx)(r.EuiToolTip,{position:"right",content:ee},Object(l.jsx)(r.EuiButtonIcon,{iconType:"cross","aria-label":ee,color:"danger",onClick:e=>{e.stopPropagation(),b(n)},css:ae}))))},autoFocus:e})}));se.displayName="SystemPromptSelector";var oe={name:"xpz1vu",styles:"min-height:150px"};const le=i.a.memo((({conversationSettings:e,onSelectedSystemPromptChange:t,selectedSystemPrompt:a,setUpdatedSystemPromptSettings:s,setUpdatedConversationSettings:o,systemPromptSettings:c})=>{const u=Object(n.useMemo)((()=>{var e;return null!==(e=null==a?void 0:a.content)&&void 0!==e?e:""}),[null==a?void 0:a.content]),d=Object(n.useCallback)((e=>{null!=a&&s((t=>t.some((e=>e.id===a.id))?t.map((t=>t.id===a.id?{...t,content:e.target.value}:t)):t))}),[a,s]),p=Object(n.useMemo)((()=>Object.values(e)),[e]),m=Object(n.useMemo)((()=>null!=a?Object.values(e).filter((e=>e.apiConfig.defaultSystemPromptId===a.id)):[]),[e,a]),b=Object(n.useCallback)((e=>{const t=e.map((e=>e.id));null!=a&&o((e=>Object($.keyBy)("id",Object.values(e).map((e=>({...e,apiConfig:{...e.apiConfig,defaultSystemPromptId:t.includes(e.id)?null==a?void 0:a.id:e.apiConfig.defaultSystemPromptId===(null==a?void 0:a.id)?void 0:e.apiConfig.defaultSystemPromptId}}))))))}),[a,o]),g=Object(n.useMemo)((()=>{var e;return null!==(e=null==a?void 0:a.isNewConversationDefault)&&void 0!==e&&e}),[null==a?void 0:a.isNewConversationDefault]),f=Object(n.useCallback)((e=>{const t=e.target.checked;null!=a&&s((e=>e.map((e=>({...e,isNewConversationDefault:a.id===e.id&&t})))))}),[a,s]),y=Object(n.useCallback)((e=>{const a="string"==typeof e?{id:null!=e?e:"",content:"",name:null!=e?e:"",promptType:"system"}:e;null!=a&&s((e=>e.some((e=>e.id===a.id))?e:[...e,a])),t(a)}),[t,s]),h=Object(n.useCallback)((e=>{s((t=>t.filter((t=>t.id!==e))))}),[s]);return Object(l.jsx)(i.a.Fragment,null,Object(l.jsx)(r.EuiTitle,{size:"s"},Object(l.jsx)("h2",null,V)),Object(l.jsx)(r.EuiSpacer,{size:"xs"}),Object(l.jsx)(r.EuiText,{size:"s"},U),Object(l.jsx)(r.EuiHorizontalRule,{margin:"s"}),Object(l.jsx)(r.EuiFormRow,{display:"rowCompressed",label:H,fullWidth:!0},Object(l.jsx)(se,{onSystemPromptDeleted:h,onSystemPromptSelectionChange:y,systemPrompts:c,selectedSystemPrompt:a})),Object(l.jsx)(r.EuiFormRow,{display:"rowCompressed",label:G,fullWidth:!0},Object(l.jsx)(r.EuiTextArea,{"data-test-subj":J.a.SYSTEM_PROMPT_MODAL.PROMPT_TEXT,disabled:null==a,onChange:d,placeholder:Q,value:u,compressed:!0,fullWidth:!0,css:oe})),Object(l.jsx)(r.EuiFormRow,{display:"rowCompressed",fullWidth:!0,helpText:Y,label:W},Object(l.jsx)(X,{conversations:p,isDisabled:null==a,onConversationSelectionChange:b,selectedConversations:m})),Object(l.jsx)(r.EuiFormRow,{display:"rowCompressed"},Object(l.jsx)(r.EuiCheckbox,{"data-test-subj":J.a.SYSTEM_PROMPT_MODAL.TOGGLE_ALL_DEFAULT_CONVERSATIONS,disabled:null==a,id:"defaultNewConversation",label:Object(l.jsx)(r.EuiFlexGroup,{alignItems:"center",gutterSize:"xs"},Object(l.jsx)(r.EuiFlexItem,null,K),Object(l.jsx)(r.EuiFlexItem,{grow:!1},Object(l.jsx)(r.EuiIcon,{type:g?"starFilled":"starEmpty"}))),checked:g,onChange:f,compressed:!0})))}));le.displayName="SystemPromptSettings";const ce=g.i18n.translate("xpack.elasticAssistant.assistant.settings.advancedSettings.settingsTitle",{defaultMessage:"Advanced Settings"}),ue=g.i18n.translate("xpack.elasticAssistant.assistant.settings.advancedSettings.settingsDescription",{defaultMessage:"They're not further along, they just have a different set of problems."}),de=i.a.memo((({onAdvancedSettingsChange:e})=>Object(l.jsx)(i.a.Fragment,null,Object(l.jsx)(r.EuiTitle,{size:"s"},Object(l.jsx)("h2",null,ce)),Object(l.jsx)(r.EuiSpacer,{size:"xs"}),Object(l.jsx)(r.EuiText,{size:"s"},ue),Object(l.jsx)(r.EuiHorizontalRule,{margin:"s"}),Object(l.jsx)(r.EuiFormRow,{display:"rowCompressed",label:"Disable LocalStorage"},Object(l.jsx)(i.a.Fragment,null,"Disable LocalStorage")),Object(l.jsx)(r.EuiFormRow,{display:"rowCompressed",label:"Clear LocalStorage"},Object(l.jsx)(i.a.Fragment,null,"Clear LocalStorage")),Object(l.jsx)(r.EuiFormRow,{display:"rowCompressed",label:"Reset Something Else"},Object(l.jsx)(i.a.Fragment,null,"Reset Something Else")))));de.displayName="AdvancedSettings";var pe=a(44),me=a(66);const be=g.i18n.translate("xpack.elasticAssistant.assistant.conversations.settings.settingsTitle",{defaultMessage:"Conversations"}),ge=g.i18n.translate("xpack.elasticAssistant.assistant.conversations.settings.settingsDescription",{defaultMessage:"Create and manage conversations with the Elastic AI Assistant"}),fe=g.i18n.translate("xpack.elasticAssistant.assistant.conversations.settings.connectorTitle",{defaultMessage:"Connector"}),ye=g.i18n.translate("xpack.elasticAssistant.assistant.conversations.settings.promptTitle",{defaultMessage:"System Prompt"}),he=g.i18n.translate("xpack.elasticAssistant.assistant.conversations.settings.promptHelpTextTitle",{defaultMessage:"Context provided as part of every conversation"});var ve=a(776),Ee=a(68),xe=a(358),je=a(269),Se=a(554),ke=a(444);const Oe="ADD_NEW_CONNECTOR",we=i.a.memo((({actionTypeRegistry:e,http:t,isDisabled:a=!1,onConnectorModalVisibilityChange:s,selectedConnectorId:o,onConnectorSelectionChange:c})=>{var d;const{assistantAvailability:p}=Object(u.b)(),[m,b]=Object(n.useState)(!1),{data:g}=Object(Se.a)({http:t}),f=null!==(d=null==g?void 0:g.find((e=>e.id===me.GEN_AI_CONNECTOR_ID)))&&void 0!==d?d:{enabledInConfig:!0,enabledInLicense:!0,minimumLicenseRequired:"platinum",supportedFeatureIds:["general"],isSystemActionType:!1,id:".gen-ai",name:"Generative AI",enabled:!0},{data:y,isLoading:h,isFetching:v,refetch:E}=Object(xe.a)({http:t}),x=h||v,j=a||!p.hasConnectorsReadPrivilege,S=Object(n.useMemo)((()=>({value:Oe,inputDisplay:je.e,dropdownDisplay:Object(l.jsx)(r.EuiFlexGroup,{gutterSize:"none",key:Oe},Object(l.jsx)(r.EuiFlexItem,{grow:!0},Object(l.jsx)(r.EuiButtonEmpty,{iconType:"plus",size:"xs"},je.e)),Object(l.jsx)(r.EuiFlexItem,{grow:!1},Object(l.jsx)("div",{style:{width:"24px"}})))})),[]),k=Object(n.useMemo)((()=>{var e;return null!==(e=null==y?void 0:y.map((e=>{var t;const a=null===(t=Object(ke.a)(e))||void 0===t?void 0:t.apiProvider,n=e.isPreconfigured?je.q:a;return{value:e.id,inputDisplay:e.name,dropdownDisplay:Object(l.jsx)(i.a.Fragment,{key:e.id},Object(l.jsx)("strong",null,e.name),n&&Object(l.jsx)(r.EuiText,{size:"xs",color:"subdued"},Object(l.jsx)("p",null,n)))}})))&&void 0!==e?e:[]}),[y]),O=Object(n.useMemo)((()=>p.hasConnectorsAllPrivilege?[...k,S]:[...k]),[S,p.hasConnectorsAllPrivilege,k]),w=Object(n.useCallback)((()=>{null==s||s(!1),b(!1)}),[s]),T=Object(n.useCallback)((e=>{if(e===Oe)return null==s||s(!0),void b(!0);const t=null==y?void 0:y.find((t=>t.id===e));c(t)}),[y,c,s]);return Object(l.jsx)(i.a.Fragment,null,Object(l.jsx)(r.EuiSuperSelect,{"aria-label":je.f,compressed:!0,disabled:j,hasDividers:!0,isLoading:x,onChange:T,options:O,valueOfSelected:null!=o?o:""}),m&&Object(l.jsx)(Ee.ConnectorAddModal,{actionType:f,onClose:w,postSaveEventHandler:e=>{c(e),null==E||E(),w()},actionTypeRegistry:e}))}));we.displayName="ConnectorSelector";var Te=a(898),Ie=a(777);const Ce=g.i18n.translate("xpack.elasticAssistant.assistant.conversationSelectorSettings.defaultConversationTitle",{defaultMessage:"Conversations"}),Me=g.i18n.translate("xpack.elasticAssistant.assistant.conversationSelectorSettings.ariaLabel",{defaultMessage:"Conversation selector"}),_e=g.i18n.translate("xpack.elasticAssistant.assistant.conversationSelectorSettings.placeholderTitle",{defaultMessage:"Select or type to create new..."}),Fe=g.i18n.translate("xpack.elasticAssistant.assistant.conversationSelectorSettings.CustomOptionTextTitle",{defaultMessage:"Create new conversation:"}),Ae=g.i18n.translate("xpack.elasticAssistant.assistant.conversationSelectorSettings.previousConversationTitle",{defaultMessage:"Previous conversation"}),De=g.i18n.translate("xpack.elasticAssistant.assistant.conversationSelectorSettings.nextConversationTitle",{defaultMessage:"Next conversation"}),Ne=g.i18n.translate("xpack.elasticAssistant.assistant.conversationSelectorSettings.deleteConversationTitle",{defaultMessage:"Delete conversation"});var Pe={name:"1v0pok0",styles:"min-width:300px"},Re={name:"4109g5",styles:"visibility:hidden;.parentFlexGroup:hover &{visibility:visible;}"},Le={name:"1gz2b5f",styles:"overflow:hidden;text-overflow:ellipsis"},Be={name:"1e5733u",styles:"width:calc(100% - 60px)"};const qe=i.a.memo((({allSystemPrompts:e,conversations:t,onConversationDeleted:a,onConversationSelectionChange:i,selectedConversationId:s,defaultConnectorId:o,defaultProvider:c})=>{const u=Object(n.useMemo)((()=>Object.keys(t)),[t]),[d,p]=Object(n.useState)((()=>Object.values(t).map((e=>{var t;return{value:{isDefault:null!==(t=e.isDefault)&&void 0!==t&&t},label:e.id}})))),m=Object(n.useMemo)((()=>{var e;return s&&null!==(e=d.filter((e=>e.label===s)))&&void 0!==e?e:[]}),[d,s]),b=Object(n.useCallback)((e=>{var a,n;const r=0===e.length?void 0:null!==(a=Object.values(t).find((t=>{var a;return t.id===(null===(a=e[0])||void 0===a?void 0:a.label)})))&&void 0!==a?a:null===(n=e[0])||void 0===n?void 0:n.label;i(r)}),[i,t]),g=Object(n.useCallback)(((e,t=[])=>{if(!e||!e.trim().toLowerCase())return;const a=e.trim().toLowerCase(),n={value:e,label:e};-1!==t.findIndex((e=>e.label.trim().toLowerCase()===a))||p([...d,n]),b([n])}),[d,b]),f=Object(n.useCallback)((e=>{0===e.length?b([]):-1!==d.findIndex((t=>t.label===(null==e?void 0:e[0].label)))&&b(e)}),[d,b]),y=Object(n.useCallback)((e=>{var t;p(d.filter((t=>t.label!==e))),(null==m||null===(t=m[0])||void 0===t?void 0:t.label)===e&&b([]),a(e)}),[d,b,a,m]),h=Object(n.useCallback)((()=>{const e=((e,t="")=>0===e.indexOf(t)?e[e.length-1]:e[e.indexOf(t)-1])(u,s),t=d.filter((t=>t.label===e));b(t)}),[u,d,b,s]),v=Object(n.useCallback)((()=>{const e=((e,t="")=>e.indexOf(t)+1>=e.length?e[0]:e[e.indexOf(t)+1])(u,s),t=d.filter((t=>t.label===e));b(t)}),[u,d,b,s]);return Object(l.jsx)(r.EuiFormRow,{label:Ce,display:"rowCompressed",css:Pe},Object(l.jsx)(r.EuiComboBox,{"aria-label":Me,customOptionText:`${Fe} {searchValue}`,placeholder:_e,singleSelection:{asPlainText:!0},options:d,selectedOptions:m,onChange:f,onCreateOption:g,renderOption:(e,t,a)=>{const{label:n,value:i}=e;return Object(l.jsx)(r.EuiFlexGroup,{alignItems:"center",className:"parentFlexGroup",component:"span",justifyContent:"spaceBetween"},Object(l.jsx)(r.EuiFlexItem,{component:"span",grow:!1,css:Be},Object(l.jsx)(r.EuiHighlight,{search:t,css:Le},n)),!(null!=i&&i.isDefault)&&Object(l.jsx)(r.EuiFlexItem,{grow:!1,component:"span"},Object(l.jsx)(r.EuiToolTip,{position:"right",content:Ne},Object(l.jsx)(r.EuiButtonIcon,{iconType:"cross","aria-label":Ne,color:"danger",onClick:e=>{e.stopPropagation(),y(n)},css:Re}))))},compressed:!0,prepend:Object(l.jsx)(r.EuiButtonIcon,{iconType:"arrowLeft","aria-label":Ae,onClick:h,disabled:u.length<=1}),append:Object(l.jsx)(r.EuiButtonIcon,{iconType:"arrowRight","aria-label":De,onClick:v,disabled:u.length<=1})}))}));qe.displayName="ConversationSelectorSettings";var ze=a(307);const $e=i.a.memo((({actionTypeRegistry:e,allSystemPrompts:t,defaultConnectorId:a,defaultProvider:s,selectedConversation:o,onSelectedConversationChange:c,conversationSettings:u,http:d,setUpdatedConversationSettings:p,isDisabled:m=!1})=>{const b=Object(n.useMemo)((()=>Object(ze.b)({allSystemPrompts:t,conversation:void 0})),[t]),g=Object(n.useMemo)((()=>Object(ze.b)({allSystemPrompts:t,conversation:o})),[t,o]),{data:f,isSuccess:y}=Object(xe.a)({http:d}),h=Object(n.useCallback)((e=>{const t="string"==typeof e?{id:null!=e?e:"",messages:[],apiConfig:{connectorId:a,provider:s,defaultSystemPromptId:null==b?void 0:b.id}}:e;null!=t&&p((e=>({...e,[t.id]:t}))),c(t)}),[a,s,null==b?void 0:b.id,c,p]),v=Object(n.useCallback)((e=>{p((t=>{const{[e]:a,...n}=t;return null!=a?n:t}))}),[p]),E=Object(n.useCallback)((e=>{null!=o&&p((t=>({...t,[o.id]:{...o,apiConfig:{...o.apiConfig,defaultSystemPromptId:e}}})))}),[o,p]),x=Object(n.useMemo)((()=>{const e=null==o?void 0:o.apiConfig.connectorId;if(y)return null==f?void 0:f.find((t=>t.id===e))}),[y,f,null==o?void 0:o.apiConfig.connectorId]),j=Object(n.useMemo)((()=>null==o?void 0:o.apiConfig.provider),[null==o?void 0:o.apiConfig.provider]),S=Object(n.useCallback)((e=>{if(null!=o){const t=Object(ke.a)(e);p((a=>({...a,[o.id]:{...o,apiConfig:{...o.apiConfig,connectorId:null==e?void 0:e.id,provider:null==t?void 0:t.apiProvider,model:null==t?void 0:t.defaultModel}}})))}}),[o,p]),k=Object(n.useMemo)((()=>{var e,t;const a=null===(e=Object(ke.a)(x))||void 0===e?void 0:e.defaultModel;return null!==(t=null==o?void 0:o.apiConfig.model)&&void 0!==t?t:a}),[x,null==o?void 0:o.apiConfig.model]),O=Object(n.useCallback)((e=>{null!=o&&p((t=>({...t,[o.id]:{...o,apiConfig:{...o.apiConfig,model:e}}})))}),[o,p]);return Object(l.jsx)(i.a.Fragment,null,Object(l.jsx)(r.EuiTitle,{size:"s"},Object(l.jsx)("h2",null,be)),Object(l.jsx)(r.EuiSpacer,{size:"xs"}),Object(l.jsx)(r.EuiText,{size:"s"},ge),Object(l.jsx)(r.EuiHorizontalRule,{margin:"s"}),Object(l.jsx)(qe,{selectedConversationId:null==o?void 0:o.id,allSystemPrompts:t,conversations:u,onConversationDeleted:v,onConversationSelectionChange:h}),Object(l.jsx)(r.EuiFormRow,{"data-test-subj":"prompt-field",display:"rowCompressed",fullWidth:!0,label:ye,helpText:he},Object(l.jsx)(Te.a,{allSystemPrompts:t,compressed:!0,conversation:o,isEditing:!0,isDisabled:null==o,onSystemPromptSelectionChange:E,selectedPrompt:g,showTitles:!0,isSettingsModalVisible:!0,setIsSettingsModalVisible:$.noop})),Object(l.jsx)(r.EuiFormRow,{"data-test-subj":"connector-field",display:"rowCompressed",label:fe,helpText:Object(l.jsx)(r.EuiLink,{href:`${d.basePath.get()}/app/management/insightsAndAlerting/triggersActionsConnectors/connectors`,target:"_blank",external:!0},Object(l.jsx)(pe.FormattedMessage,{id:"xpack.elasticAssistant.assistant.settings.connectorHelpTextTitle",defaultMessage:"Kibana Connector to make requests with"}))},Object(l.jsx)(we,{actionTypeRegistry:e,http:d,isDisabled:null==o,onConnectorModalVisibilityChange:()=>{},onConnectorSelectionChange:S,selectedConnectorId:null==x?void 0:x.id})),!1===(null==x?void 0:x.isPreconfigured)&&j===me.OpenAiProviderType.OpenAi&&Object(l.jsx)(r.EuiFormRow,{"data-test-subj":"model-field",display:"rowCompressed",label:ve.c,helpText:ve.b},Object(l.jsx)(Ie.b,{onModelSelectionChange:O,selectedModel:k})))}));$e.displayName="ConversationSettings";const Ve=o()(r.EuiModal)`
  width: 800px;
  height: 575px;
`,Ue="CONVERSATION_TAB",He="QUICK_PROMPTS_TAB",Ge="SYSTEM_PROMPTS_TAB",Qe="ANONYMIZATION_TAB";var We={name:"1r962iv",styles:"padding:4px"},Ke={name:"1tk8yx0",styles:"padding:8px"},Ye={name:"zd35ug",styles:"max-height:550px;overflow-y:scroll"},Je={name:"16zl6ct",styles:"position:absolute;top:11px;left:14px"},Xe={name:"16zl6ct",styles:"position:absolute;top:11px;left:14px"},Ze={name:"57t0bw",styles:"position:relative;transform:rotateY(180deg);top:-7px"},et={name:"15ag9ng",styles:"position:relative;top:-10px"},tt={name:"18wygtw",styles:"min-inline-size:unset!important;max-width:104px"};const at=i.a.memo((({defaultConnectorId:e,defaultProvider:t,onClose:a,onSave:s,selectedConversation:o,setSelectedConversationId:d})=>{const{actionTypeRegistry:p,http:m,selectedSettingsTab:b,setSelectedSettingsTab:g}=Object(u.b)(),{conversationSettings:f,defaultAllow:y,defaultAllowReplacement:h,quickPromptSettings:v,systemPromptSettings:x,setUpdatedConversationSettings:j,setUpdatedDefaultAllow:S,setUpdatedDefaultAllowReplacement:k,setUpdatedQuickPromptSettings:O,setUpdatedSystemPromptSettings:w,saveSettings:T}=(()=>{const{allQuickPrompts:e,allSystemPrompts:t,conversations:a,defaultAllow:i,defaultAllowReplacement:r,setAllQuickPrompts:s,setAllSystemPrompts:o,setConversations:l,setDefaultAllow:c,setDefaultAllowReplacement:d}=Object(u.b)(),[p,m]=Object(n.useState)(a),[b,g]=Object(n.useState)(e),[f,y]=Object(n.useState)(t),[h,v]=Object(n.useState)(i),[E,x]=Object(n.useState)(r),j=Object(n.useCallback)((()=>{m(a),g(e),y(t),v(i),x(r)}),[e,t,a,i,r]),S=Object(n.useCallback)((()=>{s(b),o(f),l(p),c(h),d(E)}),[s,o,l,c,d,p,h,E,b,f]);return{conversationSettings:p,defaultAllow:h,defaultAllowReplacement:E,quickPromptSettings:b,resetSettings:j,systemPromptSettings:f,saveSettings:S,setUpdatedDefaultAllow:v,setUpdatedDefaultAllowReplacement:x,setUpdatedConversationSettings:m,setUpdatedQuickPromptSettings:g,setUpdatedSystemPromptSettings:y}})(),[I,C]=Object(n.useState)((()=>f[o.id])),M=Object(n.useCallback)((e=>{C(e)}),[]);Object(n.useEffect)((()=>{null!=I&&C(f[I.id])}),[f,I]);const[_,F]=Object(n.useState)(),A=Object(n.useCallback)((e=>{F(e)}),[]);Object(n.useEffect)((()=>{null!=_&&F(v.find((e=>e.title===_.title)))}),[v,_]);const[D,N]=Object(n.useState)(),P=Object(n.useCallback)((e=>{N(e)}),[]);Object(n.useEffect)((()=>{null!=D&&N(x.find((e=>e.id===D.id)))}),[D,x]);const R=Object(n.useCallback)((()=>{const e=null==f[o.id],t=Object.keys(f)[0];e&&null!=t&&d(f[t].id),T(),s()}),[f,o.id,s,T,d]);return Object(l.jsx)(Ve,{"data-test-subj":J.a.SETTINGS_MODAL,onClose:a},Object(l.jsx)(r.EuiPage,{paddingSize:"none"},Object(l.jsx)(r.EuiPageSidebar,{paddingSize:"xs",css:tt},Object(l.jsx)(r.EuiKeyPadMenu,null,Object(l.jsx)(r.EuiKeyPadMenuItem,{id:Ue,label:c.c,isSelected:b===Ue,onClick:()=>g(Ue)},Object(l.jsx)(i.a.Fragment,null,Object(l.jsx)(r.EuiIcon,{type:"editorComment",size:"xl",css:et}),Object(l.jsx)(r.EuiIcon,{type:"editorComment",size:"l",css:Ze}))),Object(l.jsx)(r.EuiKeyPadMenuItem,{id:He,label:c.d,isSelected:b===He,onClick:()=>g(He)},Object(l.jsx)(i.a.Fragment,null,Object(l.jsx)(r.EuiIcon,{type:"editorComment",size:"xxl"}),Object(l.jsx)(r.EuiIcon,{type:"bolt",size:"s",color:"warning",css:Xe}))),Object(l.jsx)(r.EuiKeyPadMenuItem,{id:Ge,label:c.h,isSelected:b===Ge,onClick:()=>g(Ge)},Object(l.jsx)(r.EuiIcon,{type:"editorComment",size:"xxl"}),Object(l.jsx)(r.EuiIcon,{type:"storage",size:"s",color:"success",css:Je})),Object(l.jsx)(r.EuiKeyPadMenuItem,{id:Qe,label:c.a,isSelected:b===Qe,onClick:()=>g(Qe)},Object(l.jsx)(r.EuiIcon,{type:"eyeClosed",size:"l"})))),Object(l.jsx)(r.EuiPageBody,{paddingSize:"none",panelled:!0},Object(l.jsx)(r.EuiSplitPanel.Outer,{grow:!0},Object(l.jsx)(r.EuiSplitPanel.Inner,{className:"eui-scrollBar",grow:!0,css:Ye},b===Ue&&Object(l.jsx)($e,{defaultConnectorId:e,defaultProvider:t,conversationSettings:f,setUpdatedConversationSettings:j,allSystemPrompts:x,actionTypeRegistry:p,selectedConversation:I,onSelectedConversationChange:M,http:m}),b===He&&Object(l.jsx)(z,{quickPromptSettings:v,onSelectedQuickPromptChange:A,selectedQuickPrompt:_,setUpdatedQuickPromptSettings:O}),b===Ge&&Object(l.jsx)(le,{conversationSettings:f,systemPromptSettings:x,onSelectedSystemPromptChange:P,selectedSystemPrompt:D,setUpdatedConversationSettings:j,setUpdatedSystemPromptSettings:w}),b===Qe&&Object(l.jsx)(E,{defaultAllow:y,defaultAllowReplacement:h,pageSize:5,setUpdatedDefaultAllow:S,setUpdatedDefaultAllowReplacement:k}),"FUNCTIONS_TAB"===b&&Object(l.jsx)(i.a.Fragment,null),"ADVANCED_TAB"===b&&Object(l.jsx)(de,null)),Object(l.jsx)(r.EuiSplitPanel.Inner,{grow:!1,color:"subdued",css:Ke},Object(l.jsx)(r.EuiModalFooter,{css:We},Object(l.jsx)(r.EuiButtonEmpty,{size:"s",onClick:a},c.b),Object(l.jsx)(r.EuiButton,{size:"s",type:"submit",onClick:R,fill:!0},c.e)))))))}));at.displayName="AssistantSettings"},function(e,t,a){"use strict";a.d(t,"g",(function(){return i.ab})),a.d(t,"h",(function(){return i.jb})),a.d(t,"i",(function(){return i.kb})),a.d(t,"f",(function(){return i.K})),a.d(t,"a",(function(){return r.b})),a.d(t,"b",(function(){return r.c})),a.d(t,"c",(function(){return r.d})),a.d(t,"d",(function(){return r.f})),a.d(t,"e",(function(){return s.f}));var n=a(43),i=a(128);n.exact(n.type({tags:i.V,ids:i.U})),a(602),a(691),a(749);var r=a(506),s=a(283);n.intersection([i.J,i.T,n.type({invocationCount:n.number,timeframeEnd:n.string})]);var o=a(112);n.exact(n.partial({query:n.object,aggs:n.object,size:o.n,track_total_hits:n.boolean,_source:n.union([n.boolean,n.string,n.array(n.string)]),fields:n.array(n.string),runtime_mappings:n.unknown,sort:n.object})),n.intersection([n.type({status:i.ib}),n.partial({conflicts:i.X,signal_ids:i.gb,query:i.hb})]);const l=n.partial({requests_per_second:n.number,size:o.o,slices:o.n});n.intersection([n.exact(n.type({index:i.i})),n.exact(l)]),n.exact(n.type({migration_ids:n.array(n.string)})),n.exact(n.type({migration_ids:n.array(n.string)}));var c=a(193);n.exact(n.type({from:c.n}))},,function(e,t,a){"use strict";a.d(t,"c",(function(){return i})),a.d(t,"d",(function(){return r})),a.d(t,"b",(function(){return s})),a.d(t,"a",(function(){return o}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.containers.detectionEngine.alerts.errorGetAlertDescription",{defaultMessage:"Failed to get signal index name"}),r=n.i18n.translate("xpack.securitySolution.containers.detectionEngine.alerts.errorPostAlertDescription",{defaultMessage:"Failed to create signal index"}),s=n.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.failedToIsolate.title",{defaultMessage:"Failed to isolate host"}),o=n.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.casesFromAlerts.title",{defaultMessage:"Failed to find associated cases"})},function(e,t,a){"use strict";a.r(t),a.d(t,"selectTimeline",(function(){return r})),a.d(t,"selectInsertTimeline",(function(){return s})),a.d(t,"autoSaveMsgSelector",(function(){return o})),a.d(t,"timelineByIdSelector",(function(){return l})),a.d(t,"getShowCallOutUnauthorizedMsg",(function(){return c})),a.d(t,"getTimelineByIdSelector",(function(){return u})),a.d(t,"getKqlFilterQuerySelector",(function(){return d})),a.d(t,"getKqlFilterKuerySelector",(function(){return p}));var n=a(139);const i=e=>e.timeline.showCallOutUnauthorizedMsg,r=(e,t)=>e.timeline.timelineById[t],s=e=>e.timeline.insertTimeline,o=Object(n.createSelector)((e=>e.timeline.autoSavedWarningMsg),(e=>e)),l=Object(n.createSelector)((e=>e.timeline.timelineById),(e=>e)),c=()=>Object(n.createSelector)(i,(e=>e)),u=()=>Object(n.createSelector)(r,(e=>e)),d=()=>Object(n.createSelector)(r,(e=>e&&e.kqlQuery&&e.kqlQuery.filterQuery&&e.kqlQuery.filterQuery.kuery?e.kqlQuery.filterQuery.kuery.expression:null)),p=()=>Object(n.createSelector)(r,(e=>e&&e.kqlQuery&&e.kqlQuery.filterQuery&&e.kqlQuery.filterQuery.kuery?e.kqlQuery.filterQuery.kuery:null))},function(e,t,a){"use strict";a.d(t,"a",(function(){return b})),a.d(t,"b",(function(){return g}));var n=a(2),i=a(103),r=a(240),s=a.n(r),o=a(79),l=a(102),c=a(158),u=a(110),d=a(665),p=a(513),m=a(108);const b=s()(((e,t)=>{if(null==t)return{browserFields:{}};{const e={};for(const[a,n]of Object.entries(t)){const t=Object(o.getCategory)(a);null==e[t]&&(e[t]={fields:{}});const i=e[t].fields;i&&(i[a]=n)}return{browserFields:e}}}),((e,t)=>{var a,n;return e[0]===t[0]&&(null===(a=e[1])||void 0===a?void 0:a.length)===(null===(n=t[1])||void 0===n?void 0:n.length)})),g=()=>{const{data:e}=Object(l.j)().services,t=Object(n.useRef)({}),a=Object(n.useRef)({}),r=Object(i.useDispatch)(),{addError:s}=Object(m.a)(),o=Object(n.useCallback)((({id:e,loading:t})=>{r(c.a.setDataViewLoading({id:e,loading:t}))}),[r]);return{indexFieldsSearch:Object(n.useCallback)((({dataViewId:n,scopeId:i=u.SourcererScopeName.default,needToBeInit:l=!1,cleanCache:m=!1,skipScopeUpdate:b=!1})=>(a.current[n]&&a.current[n].unsubscribe(),t.current[n]&&t.current[n].abort(),(async()=>{try{t.current={...t.current,[n]:new AbortController},o({id:n,loading:!0});const a=await Object(d.a)(n,e.dataViews,m);l&&i&&!b&&r(c.a.setSelectedDataView({id:i,selectedDataViewId:n,selectedPatterns:a.patternList})),r(c.a.setDataView({...a,loading:!1}))}catch(e){s(null==e?void 0:e.message,{title:p.a})}})())),[o,e.dataViews,r,s])}}},function(e,t,a){"use strict";a.d(t,"c",(function(){return E})),a.d(t,"b",(function(){return x})),a.d(t,"a",(function(){return j}));var n=a(62),i=a.n(n),r=a(40),s=a(42),o=a(2),l=a.n(o),c=a(103),u=a(130),d=a.n(u),p=a(707),m=a(4),b=a(111),g=a(102),f=a(182),y=a(114),h=a(187);const v=l.a.memo((({duration:e,end:t,fromStr:a,id:n,isLoading:i,kqlQuery:c,policy:u,queries:d,setDuration:p,showUpdateButton:b=!0,start:f,startAutoReload:y,stopAutoReload:h,timelineId:v,toStr:x,updateReduxTime:j,disabled:S,width:k="restricted",compressed:O=!1})=>{const[w,T]=Object(o.useState)([]),I=Object(o.useCallback)((({start:e,end:a})=>{const i=e.includes("now")||a.includes("now"),{kqlHaveBeenUpdated:r}=j({end:a,id:n,isInvalid:!1,isQuickSelection:i,kql:c,start:e,timelineId:v}),s=E(e),o=i?E(a,{roundUp:!0}):E(a);!d||r||i&&(f!==s||t!==o)||M(d)}),[t,n,c,d,f,v,j]),C=Object(o.useCallback)((({isPaused:t,refreshInterval:i})=>{const r=null!=a&&a.includes("now")||null!=x&&x.includes("now");e!==i&&p({id:n,duration:i}),t&&"interval"===u?h({id:n}):t||"manual"!==u||y({id:n}),d&&!t&&(!r||r&&"now"!==x)&&M(d)}),[a,x,e,u,p,n,h,y,d]),M=e=>{e.forEach((e=>e.refetch&&e.refetch()))},_=Object(o.useCallback)((({start:e,end:t,isInvalid:a})=>{const i=e.includes("now")||t.includes("now");if(!a){j({end:t,id:n,isInvalid:a,isQuickSelection:i,kql:c,start:e,timelineId:v});const r=[{start:e,end:t},...Object(s.take)(9,w.filter((a=>!(a.start===e&&a.end===t))))];T(r)}}),[j,n,c,v,w]),F=null!=x?x:new Date(t).toISOString(),A=null!=a?a:new Date(f).toISOString(),[D]=Object(g.p)(m.V),N=Object(s.isEmpty)(D)?[]:D.map((({from:e,to:t,display:a})=>({start:e,end:t,label:a})));return l.a.createElement(r.EuiSuperDatePicker,{commonlyUsedRanges:N,end:F,isLoading:i,isPaused:"manual"===u,onRefresh:I,onRefreshChange:C,onTimeChange:_,recentlyUsedRanges:w,refreshInterval:e,showUpdateButton:b,start:A,isDisabled:S,width:k,compressed:O})}),((e,t)=>e.duration===t.duration&&e.end===t.end&&e.fromStr===t.fromStr&&e.id===t.id&&e.isLoading===t.isLoading&&e.policy===t.policy&&e.setDuration===t.setDuration&&e.start===t.start&&e.startAutoReload===t.startAutoReload&&e.stopAutoReload===t.stopAutoReload&&e.timelineId===t.timelineId&&e.disabled===t.disabled&&e.toStr===t.toStr&&e.updateReduxTime===t.updateReduxTime&&d()(e.kqlQuery,t.kqlQuery)&&d()(e.queries,t.queries))),E=(e,t)=>{const a=i.a.parse(e,t);return null!=a&&a.isValid()?a.toISOString():""},x=e=>({end:t,id:a,isQuickSelection:n,kql:i,start:r,timelineId:s})=>{const o=E(r);let l=E(t,{roundUp:!0});var c;return n?e(t===r?f.c.setAbsoluteRangeDatePicker({id:a,fromStr:r,toStr:t,from:o,to:l}):f.c.setRelativeRangeDatePicker({id:a,fromStr:r,toStr:t,from:o,to:l})):(l=E(t),e(f.c.setAbsoluteRangeDatePicker({id:a,from:E(r),to:E(t)}))),null!=s&&e(b.a.updateRange({id:s,start:o,end:l})),i&&i.refetch?{kqlHaveBeenUpdated:null!==(c=i.refetch(e))&&void 0!==c&&c}:{kqlHaveBeenUpdated:!1}};v.displayName="SuperDatePickerComponent";const j=Object(c.connect)((()=>{const e=Object(h.a)(),t=Object(h.b)(),a=Object(h.c)(),n=Object(h.d)(),i=Object(h.e)(),r=Object(h.f)(),o=Object(h.g)(),l=Object(h.h)(),c=Object(h.i)(),u=Object(h.j)();return(d,{id:m})=>{const b=Object(s.getOr)({},`inputs.${m}`,d);return{duration:e(b),end:t(b),fromStr:a(b),kind:i(b),policy:o(b),start:c(b),toStr:u(b),isLoading:!1,...Object(p.c)(b)&&(m===y.a.timeline||m===y.a.global)&&{isLoading:n(b),kqlQuery:r(b),queries:l(d,m)}}}}),(e=>({startAutoReload:({id:t})=>e(f.c.startAutoReload({id:t})),stopAutoReload:({id:t})=>e(f.c.stopAutoReload({id:t})),setDuration:({id:t,duration:a})=>e(f.c.setDuration({id:t,duration:a})),updateReduxTime:x(e)})))(v)},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(42),i=a(2),r=a.n(i),s=a(150),o=a(950);const l=r.a.memo((({dataProvider:e})=>{var t;const[a,l]=Object(i.useState)(!1);return r.a.createElement(o.a,{deleteProvider:n.noop,field:e.queryMatch.displayField||e.queryMatch.field,kqlQuery:e.kqlQuery,isEnabled:e.enabled,isExcluded:e.excluded,providerId:e.id,isPopoverOpen:a,setIsPopoverOpen:l,toggleExcludedProvider:n.noop,toggleEnabledProvider:n.noop,toggleTypeProvider:n.noop,displayValue:String(null!==(t=e.queryMatch.displayValue)&&void 0!==t?t:e.queryMatch.value),val:e.queryMatch.value,operator:e.queryMatch.operator||s.d,type:e.type||s.a.default})}));l.displayName="Provider"},,,function(e,t,a){"use strict";a.d(t,"b",(function(){return A})),a.d(t,"a",(function(){return D}));var n=a(601),i=a(2),r=a.n(i),s=a(321),o=a(153),l=a(117),c=a(150),u=a(379),d=a(1407);const p={isInstance:(e,t)=>((e,t)=>-1===t.findIndex((t=>t.field===e)))(e,t),renderColumn:({columnName:e,eventId:t,field:a,isDraggable:n=!0,scopeId:i,truncate:p})=>n?r.a.createElement(s.b,{dataProvider:{enabled:!0,id:Object(o.i)(`empty-column-renderer-draggable-wrapper-${i}-${e}-${t}-${a.id}`),name:`${e}: ${Object(d.a)(null)}`,queryMatch:{field:a.id,value:Object(d.a)(null),displayValue:Object(l.e)(),operator:c.b},excluded:!0,kqlQuery:"",and:[]},isDraggable:n,key:`empty-column-renderer-draggable-wrapper-${i}-${e}-${t}-${a.id}`,render:(e,t,a)=>a.isDragging?r.a.createElement(s.a,null,r.a.createElement(u.a,{dataProvider:e})):r.a.createElement("span",null,Object(l.e)()),truncate:p,scopeId:i}):r.a.createElement("span",null,Object(l.e)())};var m=a(820),b=a(42),g=a(337);const f={isInstance:(e,t)=>((e,t)=>-1!==t.findIndex((t=>t.field===e)))(e,t),renderColumn:({asPlainText:e,columnName:t,eventId:a,field:n,isDraggable:i=!0,scopeId:s,truncate:o,values:c,linkValues:u})=>{return Array.isArray(c)&&0!==c.length?i?c.map(((l,c)=>{var d,p,m;return r.a.createElement(g.a,{asPlainText:e,contextId:`plain-column-renderer-formatted-field-value-${s}`,eventId:a,fieldFormat:null!==(d=n.format)&&void 0!==d?d:"",fieldName:t,isAggregatable:null!==(p=n.aggregatable)&&void 0!==p&&p,fieldType:null!==(m=n.type)&&void 0!==m?m:"",isDraggable:i,key:`plain-column-renderer-formatted-field-value-${s}-${t}-${a}-${n.id}-${l}-${c}`,linkValue:Object(b.head)(u),truncate:o,value:l})})):r.a.createElement(g.a,{asPlainText:e,contextId:`plain-column-renderer-formatted-field-value-${s}`,eventId:a,fieldFormat:null!==(d=n.format)&&void 0!==d?d:"",fieldName:t,isAggregatable:null!==(p=n.aggregatable)&&void 0!==p&&p,fieldType:null!==(m=n.type)&&void 0!==m?m:"",isDraggable:i,key:`plain-column-renderer-formatted-field-value-${s}-${t}-${a}-${n.id}`,linkValue:Object(b.head)(u),truncate:o,value:y(c)}):Object(l.d)();var d,p,m}};function y(e){return Array.isArray(e)?e.length>0?e.join(", "):e[0]:e}var h=a(871);const v={isInstance:()=>!0,renderColumn:()=>Object(l.d)()};var E=a(873),x=a(206),j=a(870),S=a(40),k=a(119),O=a(188),w=a(420);const T={isInstance:Object(b.isEqual)(O.k),renderColumn:({columnName:e,ecsData:t,eventId:a,field:n,isDetails:i,isDraggable:s=!0,linkValues:o,rowRenderers:l=[],scopeId:c,truncate:u,values:d})=>i&&d&&t&&l?d.map(((i,s)=>r.a.createElement(I,{ecsData:t,key:`reason-column-renderer-value-${c}-${e}-${a}-${n.id}-${i}-${s}`,rowRenderers:l,scopeId:c,value:i}))):f.renderColumn({columnName:e,eventId:a,field:n,isDetails:i,isDraggable:s,linkValues:o,scopeId:c,truncate:u,values:d})},I=({ecsData:e,rowRenderers:t,scopeId:a,value:n})=>{const s=Object(i.useMemo)((()=>Object(w.a)({data:e,rowRenderers:t})),[e,t]),o=Object(i.useMemo)((()=>s&&s.renderRow({data:e,isDraggable:!1,scopeId:a})),[s,e,a]),l=Object(i.useMemo)((()=>a===k.e.rulePreview),[a]);return r.a.createElement(r.a.Fragment,null,s&&o&&!l?r.a.createElement(S.EuiPanel,{color:"subdued",className:"eui-xScroll","data-test-subj":"reason-cell-renderer"},r.a.createElement(S.EuiText,{size:"xs"},r.a.createElement("div",{className:"eui-displayInlineBlock"},o))):n)};var C=a(41);const M=a.n(C)()(S.EuiFlexItem).withConfig({displayName:"EventRenderedFlexItem",componentId:"sc-1jiiiew-0"})(["div:first-child{padding-left:0px;div{margin:0px;}}"]),_={isInstance:Object(b.isEqual)(O.d),renderColumn:({ecsData:e,columnName:t,eventId:a,field:n,isDetails:i,linkValues:s,rowRenderers:o=[],scopeId:l,truncate:c,values:u})=>e&&o?r.a.createElement(F,{ecsData:e,key:`reason-column-renderer-value-${l}-${t}-${a}-${n.id}`,rowRenderers:o,scopeId:l,values:u}):f.renderColumn({columnName:t,eventId:a,field:n,isDetails:i,isDraggable:!1,linkValues:s,scopeId:l,truncate:c,values:u})},F=({ecsData:e,rowRenderers:t,scopeId:a,values:n})=>{const s=Object(i.useMemo)((()=>Object(w.a)({data:e,rowRenderers:t})),[e,t]),o=Object(i.useMemo)((()=>s&&s.renderRow({data:e,isDraggable:!1,scopeId:a})),[s,e,a]);return r.a.createElement(S.EuiFlexGroup,{gutterSize:"none",direction:"column",className:"eui-fullWidth"},s&&o?r.a.createElement(M,{className:"eui-xScroll"},r.a.createElement("div",{className:"eui-displayInlineBlock",style:{width:"fit-content"}},o)):n&&r.a.createElement(S.EuiFlexItem,{"data-test-subj":"plain-text-reason"},n))},A=[j.a,...n.a,...x.k,h.a,E.a,m.a],D=[T,_,f,p,v]},function(e,t,a){"use strict";a.d(t,"b",(function(){return x})),a.d(t,"a",(function(){return j.a}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(42),l=a(40),c=a(496),u=a.n(c),d=a(44),p=a(654);const m=({disableLinks:e,href:t,target:a,children:n,...i})=>s.a.createElement(l.EuiToolTip,{content:t},s.a.createElement(l.EuiLink,{href:e?void 0:t,"data-test-subj":"markdown-link",rel:"nofollow",target:"_blank"},n)),b=Object(r.memo)(m);var g=a(102),f=a(17),y=a(5);const h=y.i18n.translate("xpack.securitySolution.markdown.platinumWarning",{defaultMessage:"The following markdown may make use of subscription features"}),v=y.i18n.translate("xpack.securitySolution.markdown.invalid",{defaultMessage:"Invalid markdown detected"}),E=({children:e,disableLinks:t,textSize:a="m"})=>{const n=Object(r.useMemo)((()=>e=>s.a.createElement(b,i()({},e,{disableLinks:t}))),[t]),c=Object(o.cloneDeep)(p.c);c[1][1].components.a=n;const m=Object(f.b)().isAtLeast("platinum"),{application:y}=Object(g.j)().services,E=Object(r.useMemo)((()=>{if(!1===m){const t=String(e);return p.b.some((e=>new RegExp(e).test(t)))}return!1}),[e,m]),x=Object(r.useMemo)((()=>u()().use(p.a).use(c)),[c]),j=Object(r.useMemo)((()=>{try{return x.processSync(e),null}catch(e){return String(e.message)}}),[e,x]);return s.a.createElement(s.a.Fragment,null,E&&s.a.createElement(s.a.Fragment,null,s.a.createElement(l.EuiCallOut,{title:h,color:"primary",iconType:"lock"},s.a.createElement(d.FormattedMessage,{id:"xpack.securitySolution.markdown.premiumPluginLinkPrefix",defaultMessage:"To use these interactive markdown features, you must {link}.",values:{link:s.a.createElement(l.EuiLink,{href:y.getUrlForApp("management",{path:"stack/license_management/home"})},s.a.createElement(d.FormattedMessage,{id:"xpack.securitySolution.markdown.premiumPluginLinkSuffix",defaultMessage:"start a trial or upgrade your subscription"}))}})),s.a.createElement(l.EuiSpacer,{size:"s"})),null!==j&&s.a.createElement(s.a.Fragment,null,s.a.createElement(l.EuiCallOut,{title:v,color:"danger",iconType:"error"},j),s.a.createElement(l.EuiSpacer,{size:"s"})),s.a.createElement(l.EuiMarkdownFormat,{parsingPluginList:p.a,processingPluginList:c,textSize:a},e))};E.displayName="MarkdownRendererComponent";const x=Object(r.memo)(E);var j=a(452);a(481)},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(365),l=a(40),c=a(1102);const u=s.a.header.withConfig({displayName:"FiltersGlobalContainer",componentId:"sc-sjn739-0"})(["display:",";"],(({show:e})=>e?"block":"none"));u.displayName="FiltersGlobalContainer";const d=i.a.memo((({children:e,show:t=!0})=>{const{globalKQLHeaderPortalNode:a}=Object(c.a)();return i.a.createElement(o.a,{node:a},i.a.createElement(l.EuiPanel,{borderRadius:"none",color:"subdued",paddingSize:"none"},i.a.createElement(u,{"data-test-subj":"filters-global-container",show:t},e)))}));d.displayName="FiltersGlobal"},function(e,t,a){"use strict";a.d(t,"b",(function(){return p})),a.d(t,"a",(function(){return m}));var n=a(2),i=a(486),r=a(231),s=a(4);const o=e=>e.groups.some((e=>s.Lb.includes(e)));var l=a(108),c=a(1041),u=a(1436),d=a(162);const p=()=>{const{addError:e}=Object(l.a)(),t=Object(d.a)(),a=Object(r.a)(t),n=Object(i.a)(t),{isFetching:s,data:p=[]}=Object(u.a)({},{enabled:a&&n,onError:t=>{e(t,{title:c.a})}});return{isLicensed:n,isMlUser:a,jobs:p.filter(o),loading:s}},m=()=>{const{jobs:e,loading:t}=p();return{jobNameById:Object(n.useMemo)((()=>e.reduce(((e,t)=>{var a;return e[t.id]=null===(a=t.customSettings)||void 0===a?void 0:a.security_app_display_name,e}),{})),[e]),loading:t}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return c})),a.d(t,"b",(function(){return u}));var n=a(2);const i=a(5).i18n.translate("xpack.securitySolution.userDetails.failSearchDescription",{defaultMessage:"Failed to run search on user details"});var r=a(508),s=a(425),o=a(194),l=a(124);const c="observedUsersDetailsQuery",u=({endDate:e,userName:t,indexNames:a,id:u=c,skip:d=!1,startDate:p})=>{const m=Object(l.a)("newUserDetailsFlyout"),{loading:b,result:g,search:f,refetch:y,inspect:h}=Object(o.a)({factoryQueryType:r.c.observedDetails,initialResult:{userDetails:{}},errorMessage:i,abort:d}),v=Object(n.useMemo)((()=>({endDate:e,userDetails:g.userDetails,id:u,inspect:h,refetch:y,startDate:p})),[e,u,h,y,g.userDetails,p]),E=Object(n.useMemo)((()=>({defaultIndex:a,factoryQueryType:r.c.observedDetails,userName:t,timerange:{interval:"12h",from:p,to:e},filterQuery:m?s.a:void 0})),[e,a,p,t,m]);return Object(n.useEffect)((()=>{d||f(E)}),[E,f,d]),[b,v]}},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(286),i=a(712);const r=(e,t=!0)=>{const a=Object(i.a)(e.to),r=Object(i.a)(e.from),{to:s,from:o}=Object(n.d)(t),l=a.isValid()?a.toISOString():s,c=r.isValid()?r.toISOString():o;return{...e,to:l,from:c}}},function(e,t,a){t.set=t.assoc=t.assocPath=a(972),t.setWith=a(1030)},function(e,t,a){"use strict";a.d(t,"g",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"d",(function(){return s})),a.d(t,"e",(function(){return o})),a.d(t,"f",(function(){return l})),a.d(t,"b",(function(){return c})),a.d(t,"a",(function(){return u}));var n=a(5);const i=e=>n.i18n.translate("xpack.securitySolution.timeline.body.pinning.pinTooltip",{values:{isAlert:e},defaultMessage:"Pin {isAlert, select, true{alert} other{event}}"}),r=e=>n.i18n.translate("xpack.securitySolution.timeline.body.pinning.unpinTooltip",{values:{isAlert:e},defaultMessage:"Unpin {isAlert, select, true{alert} other{event}}"}),s=e=>n.i18n.translate("xpack.securitySolution.timeline.body.pinning.pinnnedWithNotesTooltip",{values:{isAlert:e},defaultMessage:"This {isAlert, select, true{alert} other{event}} cannot be unpinned because it has notes"}),o=n.i18n.translate("xpack.securitySolution.timeline.body.sort.sortedAscendingTooltip",{defaultMessage:"Sorted ascending"}),l=n.i18n.translate("xpack.securitySolution.timeline.body.sort.sortedDescendingTooltip",{defaultMessage:"Sorted descending"}),c=e=>n.i18n.translate("xpack.securitySolution.timeline.body.pinning.disablePinnnedTooltip",{values:{isAlert:e},defaultMessage:"This {isAlert, select, true{alert} other{event}} may not be pinned while editing a template timeline"}),u=({ariaRowindex:e,columnValues:t})=>n.i18n.translate("xpack.securitySolution.timeline.body.actions.attachAlertToCaseForRowAriaLabel",{values:{ariaRowindex:e,columnValues:t},defaultMessage:"Attach the alert or event in row {ariaRowindex} to a case, with columns {columnValues}"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return E}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(114),c=a(407),u=a(454),d=a(561),p=a(642),m=a(643),b=a(644),g=a(230),f=a(211),y=a(110);const h=o.a.div.withConfig({displayName:"Wrapper",componentId:"sc-9cci34-0"})(["&.viz-actions{position:absolute;top:0;right:0;z-index:1;}&.histogram-viz-actions{padding:",";}"],(({theme:e})=>e.eui.euiSizeS)),v=({applyGlobalQueriesAndFilters:e=!0,className:t,extraActions:a,extraOptions:s,getLensAttributes:o,inputId:v=l.a.global,inspectIndex:E=0,isInspectButtonDisabled:x,isMultipleQuery:j,lensAttributes:S,onCloseInspect:k,queryId:O,timerange:w,title:T,scopeId:I=y.SourcererScopeName.default,stackByField:C,withDefaultActions:M=!0})=>{const{lens:_}=Object(c.b)().services,{canUseEditor:F,navigateToPrefilledEditor:A}=_,[D,N]=Object(i.useState)(!1),[P,R]=Object(i.useState)(!1),L=Object(i.useCallback)((()=>{N(!D)}),[D]),B=()=>{N(!1)},q=Object(p.a)({applyGlobalQueriesAndFilters:e,extraOptions:s,getLensAttributes:o,lensAttributes:S,scopeId:I,stackByField:C,title:""}),z=`stat-${O}`,{disabled:$,onAddToExistingCaseClicked:V}=Object(m.a)({onAddToCaseClicked:B,lensAttributes:q,timeRange:w}),{onAddToNewCaseClicked:U,disabled:H}=Object(b.a)({onClick:B,timeRange:w,lensAttributes:q}),G=Object(i.useCallback)((()=>{B(),w&&q&&A({id:"",timeRange:w,attributes:q},{openInNewTab:!0})}),[q,A,w]),Q=Object(i.useCallback)((()=>{B(),R(!0)}),[]),W=Object(i.useCallback)((()=>{R(!1),k&&k()}),[k]),{additionalRequests:K,additionalResponses:Y,handleClick:J,handleCloseModal:X,isButtonDisabled:Z,request:ee,response:te}=Object(d.a)({inputId:v,inspectIndex:E,isDisabled:x,multiple:j,onCloseInspect:W,onClick:Q,queryId:O}),ae=Object(i.useMemo)((()=>!F()||null==q),[q,F]),ne=Object(i.useMemo)((()=>{var e;const t={};return[...(null!==(e=null==a?void 0:a.map((e=>r.a.createElement(n.EuiContextMenuItem,{icon:null==e?void 0:e.getIconType(t),key:e.id,onClick:()=>e.execute(t),"data-test-subj":`viz-actions-${e.id}`},e.getDisplayName(t)))))&&void 0!==e?e:[])||[],...M?[r.a.createElement(n.EuiContextMenuItem,{icon:"inspect",key:"visualizationActionsInspect",onClick:J,disabled:Z,"data-test-subj":"viz-actions-inspect"},g.j),r.a.createElement(n.EuiContextMenuItem,{disabled:H,icon:"plusInCircle",key:"visualizationActionsAddToNewCase",onClick:U,"data-test-subj":"viz-actions-add-to-new-case"},g.c),r.a.createElement(n.EuiContextMenuItem,{disabled:$,"data-test-subj":"viz-actions-add-to-existing-case",icon:"plusInCircle",key:"visualizationActionsAddToExistingCase",onClick:V},g.b),r.a.createElement(n.EuiContextMenuItem,{icon:"visArea",key:"visualizationActionsOpenInLens","data-test-subj":"viz-actions-open-in-lens",disabled:ae,onClick:G},g.l)]:[]]}),[Z,ae,a,J,$,H,V,U,G,M]),ie=Object(i.useMemo)((()=>r.a.createElement(n.EuiButtonIcon,{"aria-label":g.k,className:f.a,"data-test-subj":z,iconType:"boxesHorizontal",onClick:L})),[z,L]);return r.a.createElement(h,{className:t},ne.length>0&&r.a.createElement(n.EuiPopover,{button:ie,isOpen:D,closePopover:B,panelPaddingSize:"none",anchorPosition:"downLeft",panelClassName:"withHoverActions__popover","data-test-subj":"viz-actions-popover"},r.a.createElement(n.EuiContextMenuPanel,{"data-test-subj":"viz-actions-panel",size:"s",items:ne})),P&&null!==ee&&null!==te&&r.a.createElement(u.a,{additionalRequests:K,additionalResponses:Y,closeModal:X,inputId:v,request:ee,response:te,title:T}))};v.displayName="VisualizationActionsComponent";const E=r.a.memo(v)},function(e,t,a){"use strict";a.d(t,"a",(function(){return l})),a.d(t,"b",(function(){return d}));var n=a(2),i=a(45),r=a(116),s=a(183),o=a(921);const l=({setQuery:e,response:t,request:a,refetch:i,uniqueQueryId:r,deleteQuery:s,loading:o,searchSessionId:l})=>{Object(n.useEffect)((()=>(null!=i&&null!=e&&e({id:r,inspect:{dsl:[a],response:[t]},loading:o,refetch:i,searchSessionId:l}),()=>{s&&s({id:r})})),[e,o,t,a,i,r,s,l])};function c(e){var t;const a=null==e?void 0:e.subType;return!(null==a||null===(t=a.nested)||void 0===t||!t.path)}function u(e,t){const a=[];for(const[n,i]of Object.entries(e))t?i.aggregatable&&Object(o.a)(i.type)&&!c(i)&&a.push({label:n,value:n}):!0===i.aggregatable&&a.push({label:n,value:n});return a}const d=e=>{const{pathname:t}=Object(i.useLocation)(),{browserFields:a}=Object(r.d)(Object(r.a)(t)),o=Object(n.useMemo)((()=>Object(s.a)(a)),[a]),[l,c]=Object(n.useState)((()=>u(o,e)));return Object(n.useEffect)((()=>{c(u(o,e))}),[o,e]),Object(n.useMemo)((()=>l),[l])}},,function(e,t,a){"use strict";a.d(t,"b",(function(){return u})),a.d(t,"a",(function(){return d}));var n=a(2),i=a.n(n),r=a(40),s=a(886),o=a(117),l=a(132),c=a(113);let u;!function(e){e.FIRST_SEEN="first-seen",e.LAST_SEEN="last-seen"}(u||(u={}));const d=i.a.memo((({indexPatterns:e,field:t,type:a,value:d})=>{const[p,{firstSeen:m,lastSeen:b,errorMessage:g}]=Object(s.a)({field:t,value:d,order:a===u.FIRST_SEEN?c.b.asc:c.b.desc,defaultIndex:e}),f=Object(n.useMemo)((()=>a===u.FIRST_SEEN?m:b),[m,b,a]);return null!=g?i.a.createElement(r.EuiToolTip,{position:"top",content:g,"data-test-subj":"firstLastSeenErrorToolTip","aria-label":`firstLastSeenError-${a}`,id:`firstLastSeenError-${t}-${a}`},i.a.createElement(r.EuiIcon,{"aria-describedby":`firstLastSeenError-${t}-${a}`,type:"warning"})):i.a.createElement(i.a.Fragment,null,p&&i.a.createElement(r.EuiLoadingSpinner,{"data-test-subj":"loading-spinner",size:"m"}),p||null==f||"Invalid Date"!==new Date(f).toString()?!p&&null!==f&&i.a.createElement(r.EuiText,{"data-test-subj":"first-last-seen-value",size:"s"},i.a.createElement(l.b,{value:`${f}`})):f,!p&&null===f&&Object(o.d)())}));d.displayName="FirstLastSeen"},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(2),i=a(4),r=a(134),s=a(233),o=a(232),l=a(105),c=a(122);const u="countOfAlertsWithSameFieldAndValue",d=({field:e,value:t,isActiveTimelines:a,signalIndexName:i,includeAlertIds:d=!1,ignoreTimerange:m=!1})=>{const b=Object(l.a)((e=>c.d.timelineTimeRangeSelector(e))),g=Object(r.a)();let f,y;!1===m&&({to:f,from:y}=a?b:g);const[h]=Object(n.useState)((()=>p(e,t,y,f,d))),{loading:v,data:E,setQuery:x}=Object(s.a)({query:h,indexName:i,queryName:o.a.PREVALENCE});let j;if(Object(n.useEffect)((()=>{x(p(e,t,y,f,d))}),[x,e,t,y,f,d]),E){var S,k;const e=null===(S=E.aggregations)||void 0===S||null===(k=S[u])||void 0===k?void 0:k.buckets;e&&e.length>0&&(j=e[0].doc_count)}const O=!v&&void 0===j;return Object(n.useMemo)((()=>({loading:v,count:j,error:O,alertIds:null==E?void 0:E.hits.hits.map((({_id:e})=>e))})),[j,E,O,v])},p=(e,t,a,n,r)=>{const s=r?{size:i.N}:{size:0},o=r?{sort:{"@timestamp":"desc"}}:{},l=Array.isArray(t)&&1===t.length?t[0]:t;let c;return c={bool:{must:{match:{[e]:l}}}},void 0!==a&&void 0!==n&&(c={...c,bool:{...c.bool,filter:[{range:{"@timestamp":{gte:a,lte:n}}}]}}),Array.isArray(t)&&t.length>1&&(c={bool:{must:t.map((t=>({term:{[e]:t}})))}},void 0!==a&&void 0!==n&&c.bool.must.push({range:{"@timestamp":{gte:a,lte:n}}})),{...s,...o,_source:!1,aggs:{[u]:{terms:{field:e,size:i.N}}},query:c,runtime_mappings:{}}}},,function(e,t,a){const n=a(192);e.exports=(e,t,a)=>n(e,t,a)<=0},function(e,t,a){"use strict";a.d(t,"a",(function(){return c})),a.d(t,"b",(function(){return u}));var n=a(2),i=a(46),r=a(547),s=a(143),o=a(354);const l=["GET",r.b],c=e=>Object(i.useQuery)(l,(async({signal:e})=>await Object(s.i)({signal:e})),{...o.a,...e}),u=()=>{const e=Object(i.useQueryClient)();return Object(n.useCallback)((()=>{e.invalidateQueries(l,{refetchType:"active"})}),[e])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return de})),a.d(t,"b",(function(){return he}));var n=a(666),i=a(1405),r=a(772),s=a(3),o=a(1401),l=a.n(o),c=a(119),u=a(770),d=a(4),p=a(18),m=a(179),b=a(111),g=a(12),f=a(138),y=a(543),h=a(42),v=a(49),E=a(60),x=a(106),j=a(241),S=a(209),k=a(479),O=a(710),w=a(0),T=a.n(w);const I=new class manage_timeline_id_ManageEpicTimelineId{constructor(){T()(this,"timelineId",null),T()(this,"version",null),T()(this,"templateTimelineId",null),T()(this,"templateVersion",null)}getTimelineId(){return this.timelineId}getTimelineVersion(){return this.version}getTemplateTimelineId(){return this.templateTimelineId}getTemplateTimelineVersion(){return this.templateVersion}setTimelineId(e){this.timelineId=e}setTimelineVersion(e){this.version=e}setTemplateTimelineId(e){this.templateTimelineId=e}setTemplateTimelineVersion(e){this.templateVersion=e}},C=new s.Subject;var M=a(102);const _=[g.addNote.type,g.addNoteToEvent.type],F=(e,t)=>null!=e?t[e].note:"",A=[g.pinEvent.type,g.unPinEvent.type],D=[g.updateIsFavorite.type];var N=a(711);const P=[g.applyKqlFilterQuery.type,g.addProvider.type,g.addTimeline.type,g.dataProviderEdited.type,g.removeProvider.type,g.saveTimeline.type,g.setExcludedRowRendererIds.type,g.setFilters.type,g.setSavedQueryId.type,g.updateDataProviderEnabled.type,g.updateDataProviderExcluded.type,g.updateDataProviderType.type,g.updateEqlOptions.type,g.updateKqlMode.type,g.updateProviders.type,g.updateTitleAndDescription.type,g.updateDataView.type,g.removeColumn.type,g.updateColumns.type,g.updateSort.type,g.updateRange.type,g.upsertColumn.type],R=e=>e&&e.toLowerCase().startsWith("timeline"),L=()=>(e,t,{selectAllTimelineQuery:a,selectNotesByIdSelector:n,timelineByIdSelector:i,timelineTimeRangeSelector:r,kibana$:o})=>{const l=t.pipe(Object(E.map)(i),Object(E.filter)(N.h)),c=t.pipe(Object(E.map)((e=>a()(e,k.a))),Object(E.filter)(N.h)),u=t.pipe(Object(E.map)(n),Object(E.filter)(N.h)),p=t.pipe(Object(E.map)(r),Object(E.filter)(N.h));return Object(s.merge)(e.pipe(Object(E.withLatestFrom)(l),Object(E.filter)((([e,t])=>{const a=Object(h.get)("payload.id",e),n=t[a];if(e.type===j.addError.type)return!0;if(R(a)&&null!=n&&null!=n.status&&x.k.immutable===n.status)return!1;if(e.type===g.createTimeline.type&&R(a))I.setTimelineVersion(null),I.setTimelineId(null),I.setTemplateTimelineId(null),I.setTemplateTimelineVersion(null);else{if(e.type===g.addTimeline.type&&R(a)){const t=Object(h.get)("payload.timeline",e);return I.setTimelineId(t.savedObjectId),I.setTimelineVersion(t.version),I.setTemplateTimelineId(t.templateTimelineId),I.setTemplateTimelineVersion(t.templateTimelineVersion),Object(h.getOr)(!1,"payload.savedTimeline",e)}if(P.includes(e.type)&&!n.isLoading&&R(a))return!0}})),Object(E.debounceTime)(500),Object(E.mergeMap)((([e])=>(C.next({action:e}),Object(s.empty)())))),C.pipe(Object(E.delay)(500),Object(E.withLatestFrom)(l,u,p),Object(E.concatMap)((([t,a,n,i])=>{const r=Object(h.get)("action",t),p=I.getTimelineId(),m=I.getTimelineVersion(),b=I.getTemplateTimelineId(),f=I.getTemplateTimelineVersion();return _.includes(r.type)?((e,t,a,n,i,r,o)=>Object(s.from)((async({note:e,noteId:t,version:a,overrideOwner:n})=>{let i;try{i=JSON.stringify({noteId:t,version:a,note:e,overrideOwner:n})}catch(e){return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(e)}`))}return await M.b.get().http.patch(d.Ob,{method:"PATCH",body:i})})({noteId:null,version:null,note:{eventId:e.payload.eventId,note:F(e.payload.noteId,a),timelineId:I.getTimelineId()}})).pipe(Object(E.withLatestFrom)(i,r,o),Object(E.mergeMap)((([t,a,n,i])=>{const r=e.payload.noteId,s=Object(h.get)("data.persistNote",t),o=403===s.code?[Object(g.showCallOutUnauthorizedMsg)()]:[];return null!=i.refetch&&i.refetch(),[...o,null==a[e.payload.id].savedObjectId?Object(g.updateTimeline)({id:e.payload.id,timeline:{...a[e.payload.id],savedObjectId:s.note.timelineId||null,version:s.note.timelineVersion||null}}):null,Object(j.updateNote)({note:{...n[r],created:null!=s.note.updated?new Date(s.note.updated):n[r].created,user:null!=s.note.updatedBy?s.note.updatedBy:n[r].user,saveObjectId:s.note.noteId,version:s.note.version}}),Object(g.endTimelineSaving)({id:e.payload.id})].filter((e=>null!=e))})),Object(E.startWith)(Object(g.startTimelineSaving)({id:e.payload.id})),Object(E.takeUntil)(n.pipe(Object(E.withLatestFrom)(i),Object(E.filter)((([e,t])=>e.type===j.addError.type||e.type===g.endTimelineSaving.type&&null!=t[Object(h.get)("payload.id",e)].savedObjectId&&(I.setTimelineId(t[Object(h.get)("payload.id",e)].savedObjectId),I.setTimelineVersion(t[Object(h.get)("payload.id",e)].version),!0)))))))(r,0,n,e,l,u,c):A.includes(r.type)?((e,t,a,n,i)=>Object(s.from)((async({eventId:e,pinnedEventId:t,timelineId:a})=>{let n;try{n=JSON.stringify({eventId:e,pinnedEventId:t,timelineId:a})}catch(e){return Promise.reject(new Error(`Failed to stringify query: ${JSON.stringify(e)}`))}return await M.b.get().http.patch(d.Ub,{method:"PATCH",body:n})})({pinnedEventId:null!=t[e.payload.id].pinnedEventsSaveObject[e.payload.eventId]?t[e.payload.id].pinnedEventsSaveObject[e.payload.eventId].pinnedEventId:null,eventId:e.payload.eventId,timelineId:I.getTimelineId()})).pipe(Object(E.withLatestFrom)(n,i),Object(E.mergeMap)((([t,a,n])=>{const i=a[e.payload.id],r=Object(h.get)("data.persistPinnedEventOnTimeline",t),s=r&&403===r.code?[Object(g.showCallOutUnauthorizedMsg)()]:[];return null!=n.refetch&&n.refetch(),[null!=r?Object(g.updateTimeline)({id:e.payload.id,timeline:{...i,savedObjectId:null==i.savedObjectId&&null!=r.timelineId?r.timelineId:i.savedObjectId,version:null==i.version&&null!=r.timelineVersion?r.timelineVersion:i.version,pinnedEventIds:{...i.pinnedEventIds,[e.payload.eventId]:!0},pinnedEventsSaveObject:{...i.pinnedEventsSaveObject,[e.payload.eventId]:r}}}):Object(g.updateTimeline)({id:e.payload.id,timeline:{...i,pinnedEventIds:Object(h.omit)(e.payload.eventId,i.pinnedEventIds),pinnedEventsSaveObject:Object(h.omit)(e.payload.eventId,i.pinnedEventsSaveObject)}}),...s,Object(g.endTimelineSaving)({id:e.payload.id})]})),Object(E.startWith)(Object(g.startTimelineSaving)({id:e.payload.id})),Object(E.takeUntil)(a.pipe(Object(E.withLatestFrom)(n),Object(E.filter)((([e,t])=>e.type===j.addError.type||e.type===g.endTimelineSaving.type&&null!=t[Object(h.get)("payload.id",e)].savedObjectId&&(I.setTimelineId(t[Object(h.get)("payload.id",e)].savedObjectId),I.setTimelineVersion(t[Object(h.get)("payload.id",e)].version),!0)))))))(r,a,e,l,c):D.includes(r.type)?((e,t,a,n,i)=>{var r;return Object(s.from)(Object(S.g)({timelineId:I.getTimelineId(),templateTimelineId:t[e.payload.id].templateTimelineId,templateTimelineVersion:t[e.payload.id].templateTimelineVersion,timelineType:null!==(r=t[e.payload.id].timelineType)&&void 0!==r?r:x.l.default})).pipe(Object(E.withLatestFrom)(n,i),Object(E.mergeMap)((([t,a,n])=>{const i=a[e.payload.id],r=Object(h.get)("data.persistFavorite",t),s=403===r.code?[Object(g.showCallOutUnauthorizedMsg)()]:[];return null!=n.refetch&&n.refetch(),[...s,Object(g.updateTimeline)({id:e.payload.id,timeline:{...i,isFavorite:null!=r.favorite&&r.favorite.length>0,savedObjectId:r.savedObjectId||null,version:r.version||null}}),Object(g.endTimelineSaving)({id:e.payload.id})]})),Object(E.startWith)(Object(g.startTimelineSaving)({id:e.payload.id})),Object(E.takeUntil)(a.pipe(Object(E.withLatestFrom)(n),Object(E.filter)((([e,t])=>e.type===j.addError.type||e.type===g.endTimelineSaving.type&&null!=t[Object(h.get)("payload.id",e)].savedObjectId&&(I.setTimelineId(t[Object(h.get)("payload.id",e)].savedObjectId),I.setTimelineVersion(t[Object(h.get)("payload.id",e)].version),I.setTemplateTimelineId(t[Object(h.get)("payload.id",e)].templateTimelineId),I.setTemplateTimelineVersion(t[Object(h.get)("payload.id",e)].templateTimelineVersion),!0))))))})(r,a,e,l,c):P.includes(r.type)?Object(s.from)(Object(S.h)({timelineId:p,version:m,timeline:{...q(a[r.payload.id],i),templateTimelineId:b,templateTimelineVersion:f}})).pipe(Object(E.withLatestFrom)(l,c,o),Object(E.mergeMap)((([e,t,a,n])=>{var i,s,o,l,c;const u=e;var d;if(null!=u.status_code&&405===u.status_code)return n.notifications.toasts.addDanger({title:O.f,text:null!==(d=u.message)&&void 0!==d?d:O.e}),[Object(g.endTimelineSaving)({id:r.payload.id})];const p=t[r.payload.id],m=Object(h.get)("data.persistTimeline",e);if(null==m)return[Object(g.endTimelineSaving)({id:r.payload.id})];const b=403===m.code?[Object(g.showCallOutUnauthorizedMsg)()]:[];return null!=a.refetch&&a.refetch(),[409===m.code?Object(g.updateAutoSaveMsg)({timelineId:r.payload.id,newTimelineModel:$(p,m.timeline)}):Object(g.updateTimeline)({id:r.payload.id,timeline:{...p,updated:null!==(i=m.timeline.updated)&&void 0!==i?i:void 0,savedObjectId:m.timeline.savedObjectId,version:m.timeline.version,status:null!==(s=m.timeline.status)&&void 0!==s?s:x.k.active,timelineType:null!==(o=m.timeline.timelineType)&&void 0!==o?o:x.l.default,templateTimelineId:null!==(l=m.timeline.templateTimelineId)&&void 0!==l?l:null,templateTimelineVersion:null!==(c=m.timeline.templateTimelineVersion)&&void 0!==c?c:null,isSaving:!1}}),...b,Object(g.endTimelineSaving)({id:r.payload.id})]})),Object(E.startWith)(Object(g.startTimelineSaving)({id:r.payload.id})),Object(E.takeUntil)(e.pipe(Object(E.withLatestFrom)(l),Object(E.filter)((([e,t])=>e.type===g.endTimelineSaving.type&&null!=t[Object(h.get)("payload.id",e)].savedObjectId&&(I.setTimelineId(t[Object(h.get)("payload.id",e)].savedObjectId),I.setTimelineVersion(t[Object(h.get)("payload.id",e)].version),I.setTemplateTimelineId(t[Object(h.get)("payload.id",e)].templateTimelineId),I.setTemplateTimelineVersion(t[Object(h.get)("payload.id",e)].templateTimelineVersion),!0)))))):Object(s.empty)()}))))},B={columns:null,dataProviders:null,dataViewId:null,description:null,eqlOptions:null,eventType:null,excludedRowRendererIds:null,filters:null,kqlMode:null,kqlQuery:null,indexNames:null,title:null,timelineType:x.l.default,templateTimelineVersion:null,templateTimelineId:null,dateRange:null,savedQueryId:null,sort:null,status:null},q=(e,t)=>Object.keys(B).reduce(((a,n)=>{if(Object(h.has)(n,e)){if("kqlQuery"===n)return Object(h.set)(`${n}.filterQuery`,Object(h.get)(`${n}.filterQuery`,e),a);if("dateRange"===n)return Object(h.set)(`${n}`,{start:t.from,end:t.to},a);if("columns"===n&&null!=Object(h.get)(n,e))return Object(h.set)(n,Object(h.get)(n,e).map((e=>Object(h.omit)(["initialWidth","width","__typename","esTypes"],e))),a);if("filters"===n&&null!=Object(h.get)(n,e)){const t=Object(h.get)(n,e);return Object(h.set)(n,null!=t?t.map((e=>{const t=Object(h.omit)(["$state"],e);return{...t,meta:{...t.meta,field:(Object(v.isMatchAllFilter)(t)||Object(v.isPhraseFilter)(t)||Object(v.isPhrasesFilter)(t)||Object(v.isRangeFilter)(t))&&null!=t.meta.field?V(t.meta.field):null,value:null!=t.meta.value?V(t.meta.value):null,params:null!=t.meta.params?V(t.meta.params):null},...Object(v.isMatchAllFilter)(t)?{query:{match_all:V(t.query.match_all)}}:{match_all:null},...Object(v.isExistsFilter)(t)&&null!=t.query.exists?{query:{exists:V(t.query.exists)}}:{exists:null},...!Object(v.isQueryStringFilter)(t)&&null==Object(h.get)("query",t)||null==t.query?{query:null}:{query:V(t.query)},...Object(v.isRangeFilter)(t)&&null!=t.query.range?{query:{range:V(t.query.range)}}:{range:null},...Object(v.isScriptedRangeFilter)(t)&&null!=t.query.script?{query:{script:V(t.query.script)}}:{script:null}}})):[],a)}return Object(h.set)(n,Object(h.get)(n,e),a)}return a}),B),z=(e,t)=>"__typename"===e?void 0:t,$=(e,t)=>JSON.parse(JSON.stringify(Object(h.merge)(e,t)),z),V=e=>{try{return Object(h.isObject)(e)?JSON.stringify(e):Object(h.toString)(e)}catch{return""}};var U=a(714);const{applyDeltaToColumnWidth:H,changeViewMode:G,removeColumn:Q,toggleDetailPanel:W,updateColumnOrder:K,updateColumns:Y,updateColumnWidth:J,updateIsLoading:X,updateItemsPerPage:Z,updateShowBuildingBlockAlertsFilter:ee,updateSort:te,upsertColumn:ae}=c.h,ne=e=>null!==e,ie=[Q.type,ae.type,H.type,Y.type,K.type,J.type,Z.type,te.type,G.type,ee.type,g.updateTotalCount.type,X.type,W.type];var re=a(110),se=a(689),oe=a(1433);function le(e){return e?{timeRange:{from:e.from,to:e.to}}:[]}var ce=a(158);let ue=null;const de=async(e,t,a,n,i)=>{var r,o,c,p;let m={name:null};try{!0===e.application.capabilities[d.tc].show&&(m=await e.http.fetch(d.bb,{method:"GET"}))}catch{m={name:null}}const b=e.uiSettings.get(d.H);let g,f;try{var h,v;const e=await Object(se.a)({body:{patternList:[...b,...null!=m.name?[m.name]:[]]},dataViewService:t.data.dataViews,dataViewId:`${d.C}-${null===(h=await(null===(v=t.spaces)||void 0===v?void 0:v.getActiveSpace()))||void 0===h?void 0:h.id}`});if(void 0===e)throw new Error("");g={...re.initDataView,...e.defaultDataView},f=e.kibanaDataViews.map((e=>({...re.initDataView,...e})))}catch(e){g={...re.initDataView,error:e},f=[]}const E={kibana:e},x=new s.BehaviorSubject(E),j={timeline:{...a.timelines.store.initialState.timeline,timelineById:{...a.timelines.store.initialState.timeline.timelineById}}},S={dataTable:{tableById:{...a.alerts.storageDataTables.tableById,...a.rules.storageDataTables.tableById,...a.exceptions.storageDataTables.tableById,...a.explore.exploreDataTables.hosts.tableById,...a.explore.exploreDataTables.network.tableById,...a.explore.exploreDataTables.users.tableById}}},k={groups:u.b},O=l()(j.timeline,null!==(r=null===(o=t.timelines)||void 0===o?void 0:o.getTimelineReducer())&&void 0!==r?r:{},a.timelines.store.reducer.timeline),w=Object(y.a)({...a.explore.store.initialState,...j,...a.management.store.initialState},{defaultDataView:g,kibanaDataViews:f,signalIndexName:m.name,enableExperimental:i},S,k,{analyzer:{}}),T={...a.explore.store.reducer,timeline:O,...a.management.store.reducer};return ye(w,T,x.pipe(Object(s.pluck)("kibana")),n,[...null!==(c=a.management.store.middleware)&&void 0!==c?c:[],null!==(p=Object(oe.a)((I=e,{relatedEvents:async({entityID:e,timeRange:t,indexPatterns:a})=>({...await I.http.post("/api/endpoint/resolver/events",{query:{},body:JSON.stringify({indexPatterns:a,...le(t),filter:JSON.stringify({bool:{filter:[{term:{"process.entity_id":e}},{bool:{must_not:{term:{"event.category":"process"}}}}]}})})}),entityID:e}),eventsWithEntityIDAndCategory({entityID:e,category:t,after:a,timeRange:n,indexPatterns:i}){const r={query:{afterEvent:a,limit:25},body:{...le(n),indexPatterns:i}};return"alert"===t?I.http.post("/api/endpoint/resolver/events",{query:r.query,body:JSON.stringify({...r.body,entityType:"alerts",eventID:e})}):I.http.post("/api/endpoint/resolver/events",{query:r.query,body:JSON.stringify({...r.body,filter:JSON.stringify({bool:{filter:[{term:{"process.entity_id":e}},{term:{"event.category":t}}]}})})})},async nodeData({ids:e,timeRange:t,indexPatterns:a,limit:n}){const i={query:{limit:n},body:JSON.stringify({indexPatterns:a,...le(t),filter:JSON.stringify({bool:{filter:[{terms:{"process.entity_id":e}},{term:{"event.category":"process"}}]}})})};return(await I.http.post("/api/endpoint/resolver/events",i)).events},async event({nodeID:e,eventID:t,eventCategory:a,eventTimestamp:n,winlogRecordID:i,timeRange:r,indexPatterns:s}){const o=void 0===t?{bool:{filter:[{terms:{"event.category":a}},{term:{"process.entity_id":e}},{term:{"@timestamp":n}},{term:{"winlog.record_id":i}}]}}:{bool:{filter:[{term:{"event.id":t}}]}};if(!1===a.includes("alert")){const e=await I.http.post("/api/endpoint/resolver/events",{query:{limit:1},body:JSON.stringify({indexPatterns:s,...le(r),filter:JSON.stringify(o)})}),[t]=e.events;return null!=t?t:null}{const e=await I.http.post("/api/endpoint/resolver/events",{query:{limit:1},body:JSON.stringify({indexPatterns:s,...le(r),entityType:"alertDetail",eventID:t})}),[a]=e.events;return null!=a?a:null}},resolverTree:async({dataId:e,schema:t,timeRange:a,indices:n,ancestors:i,descendants:r})=>I.http.post("/api/endpoint/resolver/tree",{body:JSON.stringify({ancestors:i,descendants:r,timeRange:a,schema:t,nodes:[e],indexPatterns:n})}),entities:async({_id:e,indices:t,signal:a})=>I.http.get("/api/endpoint/resolver/entity",{signal:a,query:{_id:e,indices:t}})})))&&void 0!==p?p:[]]);var I},pe=[g.updateTimeline.type,g.addTimeline.type,g.updateAutoSaveMsg.type,g.initializeTimelineSettings.type],me=e=>{if(e.type===ce.a.setDataView.type)return{...e,payload:{...e.payload,dataView:"dataView",browserFields:"browserFields",indexFields:"indexFields",fields:"fields"}};if(pe.includes(e.type)){const{type:t,payload:a}=e;if(t===g.addTimeline.type||t===g.updateTimeline.type)return{...e,payload:{...a,timeline:ge(a.timeline)}};if(t===g.updateAutoSaveMsg.type)return{...e,payload:{...a,newTimelineModel:ge(a.newTimelineModel)}};if(t===g.initializeTimelineSettings.type)return{...e,payload:{...a,timeline:ge(a.timeline)}}}return e},be=e=>({...e,browserFields:"browserFields",indexFields:"indexFields",fields:"fields",dataView:"dataView"}),ge=e=>({...e,filterManager:"filterManager",footerText:"footerText",loadingText:"loadingText"}),fe=e=>e.sourcerer?{...e,sourcerer:{...e.sourcerer,defaultDataView:be(e.sourcerer.defaultDataView),kibanaDataViews:e.sourcerer.kibanaDataViews.map(be)}}:e,ye=(e,t,a,o,l)=>{const u={name:"Kibana Security Solution",actionsBlacklist:["USER_MOVED_POINTER","USER_SET_RASTER_SIZE"],actionSanitizer:me,stateSanitizer:fe},d=Object(i.composeWithDevTools)(u),g={kibana$:a,selectAllTimelineQuery:f.d.globalQueryByIdSelector,selectNotesByIdSelector:m.c.selectNotesByIdSelector,timelineByIdSelector:b.b.timelineByIdSelector,timelineTimeRangeSelector:f.d.timelineTimeRangeSelector,tableByIdSelector:c.j.tableByIdSelector,storage:o},v=Object(r.createEpicMiddleware)({dependencies:g}),x=Object(n.applyMiddleware)(v,p.g,...null!=l?l:[]);return ue=Object(n.createStore)(Object(y.b)(t),e,d(x)),v.run(Object(r.combineEpics)(L(),(e=>e.pipe(Object(E.filter)((e=>D.includes(e.type))),Object(E.mergeMap)((e=>(C.next({action:e}),Object(s.empty)()))))),(e=>e.pipe(Object(E.filter)((e=>_.includes(e.type))),Object(E.switchMap)((e=>(C.next({action:e}),Object(s.empty)()))))),(e=>e.pipe(Object(E.filter)((e=>A.includes(e.type))),Object(E.mergeMap)((e=>(C.next({action:e}),Object(s.empty)()))))),((e,t,{tableByIdSelector:a,storage:n})=>{const i=t.pipe(Object(E.map)(a),Object(E.filter)(ne));return e.pipe(Object(E.delay)(500),Object(E.withLatestFrom)(i),Object(E.tap)((([e,t])=>{if(ie.includes(e.type)&&n){const a=Object(h.get)("payload.id",e);Object(U.a)(n,a,t[a])}})),Object(E.ignoreElements)())}))),ue},he=()=>ue},function(e,t,a){"use strict";a.d(t,"c",(function(){return h})),a.d(t,"b",(function(){return E})),a.d(t,"d",(function(){return x})),a.d(t,"a",(function(){return j}));var n=a(2),i=a.n(n),r=a(40),s=a(44),o=a(5);const l=o.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.cancel",{defaultMessage:"Cancel"}),c=o.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.confirm",{defaultMessage:"Confirm"}),u=o.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.comment",{defaultMessage:"Comment"}),d=o.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.comment.placeholder",{defaultMessage:"You may leave an optional note here."}),p=e=>o.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.isolation.successfulMessage",{defaultMessage:"Isolation on host {hostName} successfully submitted",values:{hostName:e}}),m=e=>o.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.unisolate.successfulMessage",{defaultMessage:"Release on host {hostName} successfully submitted",values:{hostName:e}}),b=o.i18n.translate("xpack.securitySolution.endpoint.hostisolation.unisolate",{defaultMessage:"release"}),g=o.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.isolated",{defaultMessage:"isolated"});var f=a(822),y=a(123);const h=Object(n.memo)((({hostName:e,alertId:t,isolateAction:a="isolateHost",additionalInfo:o})=>i.a.createElement(r.EuiCallOut,{iconType:"check",color:"success",title:"isolateHost"===a?p(e):m(e),"data-test-subj":"isolateHost"===a?"hostIsolateSuccessMessage":"hostUnisolateSuccessMessage"},void 0!==t?(({alertIdForCase:e})=>{const{casesInfo:t}=Object(f.a)({alertId:e}),a=Object(n.useMemo)((()=>t.length),[t]),o=Object(n.useMemo)((()=>t.map(((e,t)=>i.a.createElement("li",{key:e.id},i.a.createElement(y.a,{detailName:e.id},i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.endpoint.hostIsolation.placeholderCase",defaultMessage:"{caseName}",values:{caseName:e.title}})))))),[t]);return i.a.createElement(i.a.Fragment,null,a>0&&i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiText,{size:"s"},i.a.createElement("p",null,i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.endpoint.hostIsolation.successfulIsolation.cases",defaultMessage:"This action has been attached to the following {caseCount, plural, one {case} other {cases}}:",values:{caseCount:a}}))),i.a.createElement(r.EuiText,{size:"s"},i.a.createElement("ul",null,o))))})({alertIdForCase:t}):o)));h.displayName="EndpointIsolateSuccess";var v=a(1065);const E=Object(n.memo)((({hostName:e,onCancel:t,onConfirm:a,onChange:o,comment:p="",messageAppend:m,isLoading:b=!1})=>{const g=Object(n.useCallback)((e=>{o({comment:e.target.value})}),[o]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(v.a,null),i.a.createElement(r.EuiForm,{"data-test-subj":"endpointHostIsolationForm"},i.a.createElement(r.EuiFormRow,{fullWidth:!0},i.a.createElement(r.EuiText,{size:"s"},i.a.createElement("p",null,i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.endpoint.hostIsolation.isolateThisHost",defaultMessage:"Isolate host {hostName} from network.",values:{hostName:i.a.createElement("b",null,e)}}),i.a.createElement("br",null)),i.a.createElement("p",null,i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.endpoint.hostIsolation.isolateThisHostAbout",defaultMessage:"Isolating a host will disconnect it from the network. The host will only be able to communicate with the Kibana platform."})," ",m))),i.a.createElement(r.EuiFormRow,{label:u,fullWidth:!0},i.a.createElement(r.EuiTextArea,{"data-test-subj":"host_isolation_comment",fullWidth:!0,placeholder:d,value:p,onChange:g})),i.a.createElement(r.EuiFormRow,{fullWidth:!0},i.a.createElement(r.EuiFlexGroup,{justifyContent:"flexEnd"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonEmpty,{onClick:t,disabled:b,"data-test-subj":"hostIsolateCancelButton"},l)),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButton,{fill:!0,onClick:a,disabled:b,isLoading:b,"data-test-subj":"hostIsolateConfirmButton"},c))))))}));E.displayName="EndpointIsolateForm";const x=Object(n.memo)((({hostName:e,onCancel:t,onConfirm:a,onChange:o,comment:p="",messageAppend:m,isLoading:f=!1})=>{const y=Object(n.useCallback)((e=>{o({comment:e.target.value})}),[o]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(v.a,null),i.a.createElement(r.EuiForm,{"data-test-subj":"endpointHostIsolationForm"},i.a.createElement(r.EuiFormRow,{fullWidth:!0},i.a.createElement(r.EuiText,{size:"s"},i.a.createElement("p",null,i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.endpoint.hostIsolation.unIsolateThisHost",defaultMessage:"{hostName} is currently {isolated}. Are you sure you want to {unisolate} this host?",values:{hostName:i.a.createElement("b",null,e),isolated:i.a.createElement("b",null,g),unisolate:i.a.createElement("b",null,b)}})," ",m))),i.a.createElement(r.EuiFormRow,{label:u,fullWidth:!0},i.a.createElement(r.EuiTextArea,{"data-test-subj":"host_isolation_comment",fullWidth:!0,placeholder:d,value:p,onChange:y})),i.a.createElement(r.EuiFormRow,{fullWidth:!0},i.a.createElement(r.EuiFlexGroup,{justifyContent:"flexEnd"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonEmpty,{onClick:t,disabled:f,"data-test-subj":"hostIsolateCancelButton"},l)),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButton,{fill:!0,onClick:a,disabled:f,isLoading:f},c))))))}));x.displayName="EndpointUnisolateForm";const j=i.a.memo((({onClick:e,buttonText:t})=>{const a=Object(n.useCallback)((()=>e()),[e]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiSpacer,{size:"m"}),i.a.createElement(r.EuiFlexGroup,{gutterSize:"none",justifyContent:"flexEnd"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonEmpty,{flush:"right",onClick:a,"data-test-subj":"hostIsolateSuccessCompleteButton"},i.a.createElement(r.EuiText,{size:"s"},i.a.createElement("p",null,t))))))}));j.displayName="ActionCompletionReturnButton"},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"d",(function(){return n})),a.d(t,"e",(function(){return E})),a.d(t,"c",(function(){return x}));var n={};a.r(n),a.d(n,"authenticationsSelector",(function(){return c})),a.d(n,"hostsSelector",(function(){return u})),a.d(n,"hostRiskScoreSelector",(function(){return d})),a.d(n,"hostRiskScoreSeverityFilterSelector",(function(){return p})),a.d(n,"uncommonProcessesSelector",(function(){return m})),a.d(n,"hostsAnomaliesJobIdFilterSelector",(function(){return b})),a.d(n,"hostsAnomaliesIntervalSelector",(function(){return g}));var i=a(525),r=a(200),s=a(42),o=a(139);const l=(e,t)=>Object(s.get)(t,e.hosts),c=()=>Object(o.createSelector)(l,(e=>e.queries.authentications)),u=()=>Object(o.createSelector)(l,(e=>e.queries[r.HostsTableType.hosts])),d=()=>Object(o.createSelector)(l,(e=>e.queries[r.HostsTableType.risk])),p=()=>Object(o.createSelector)(l,(e=>e.queries[r.HostsTableType.risk].severitySelection)),m=()=>Object(o.createSelector)(l,(e=>e.queries.uncommonProcesses)),b=()=>Object(o.createSelector)(l,(e=>e.queries[r.HostsTableType.anomalies].jobIdSelection)),g=()=>Object(o.createSelector)(l,(e=>e.queries[r.HostsTableType.anomalies].intervalSelection));var f=a(208),y=a(113),h=a(314),v=a(835);const E={page:{queries:{[r.HostsTableType.authentications]:{activePage:h.a,limit:h.b},[r.HostsTableType.hosts]:{activePage:h.a,limit:h.b,direction:y.b.desc,sortField:y.h.lastSeen},[r.HostsTableType.events]:{activePage:h.a,limit:h.b},[r.HostsTableType.uncommonProcesses]:{activePage:h.a,limit:h.b},[r.HostsTableType.anomalies]:{jobIdSelection:[],intervalSelection:"auto"},[r.HostsTableType.risk]:{activePage:h.a,limit:h.b,sort:{field:y.x.hostRiskScore,direction:y.b.desc},severitySelection:[]},[r.HostsTableType.sessions]:{activePage:h.a,limit:h.b}}},details:{queries:{[r.HostsTableType.authentications]:{activePage:h.a,limit:h.b},[r.HostsTableType.hosts]:{activePage:h.a,direction:y.b.desc,limit:h.b,sortField:y.h.lastSeen},[r.HostsTableType.events]:{activePage:h.a,limit:h.b},[r.HostsTableType.uncommonProcesses]:{activePage:h.a,limit:h.b},[r.HostsTableType.anomalies]:{jobIdSelection:[],intervalSelection:"auto"},[r.HostsTableType.risk]:{activePage:h.a,limit:h.b,sort:{field:y.x.hostRiskScore,direction:y.b.desc},severitySelection:[]},[r.HostsTableType.sessions]:{activePage:h.a,limit:h.b}}}},x=Object(f.reducerWithInitialState)(E).case(i.setHostTablesActivePageToZero,(e=>({...e,page:{...e.page,queries:Object(v.c)(e)},details:{...e.details,queries:Object(v.b)(e)}}))).case(i.setHostDetailsTablesActivePageToZero,(e=>({...e,details:{...e.details,queries:Object(v.b)(e)}}))).case(i.updateTableActivePage,((e,{activePage:t,hostsType:a,tableType:n})=>({...e,[a]:{...e[a],queries:{...e[a].queries,[n]:{...e[a].queries[n],activePage:t}}}}))).case(i.updateTableLimit,((e,{limit:t,hostsType:a,tableType:n})=>({...e,[a]:{...e[a],queries:{...e[a].queries,[n]:{...e[a].queries[n],limit:t}}}}))).case(i.updateHostsSort,((e,{sort:t,hostsType:a})=>({...e,[a]:{...e[a],queries:{...e[a].queries,[r.HostsTableType.hosts]:{...e[a].queries[r.HostsTableType.hosts],direction:t.direction,sortField:t.field,activePage:h.a}}}}))).case(i.updateHostRiskScoreSort,((e,{sort:t,hostsType:a})=>({...e,[a]:{...e[a],queries:{...e[a].queries,[r.HostsTableType.risk]:{...e[a].queries[r.HostsTableType.risk],sort:t}}}}))).case(i.updateHostRiskScoreSeverityFilter,((e,{severitySelection:t,hostsType:a})=>({...e,[a]:{...e[a],queries:{...e[a].queries,[r.HostsTableType.risk]:{...e[a].queries[r.HostsTableType.risk],severitySelection:t,activePage:h.a}}}}))).case(i.updateHostsAnomaliesJobIdFilter,((e,{jobIds:t,hostsType:a})=>({...e,[a]:{...e[a],queries:{...e[a].queries,[r.HostsTableType.anomalies]:{...e[a].queries[r.HostsTableType.anomalies],jobIdSelection:t}}}}))).case(i.updateHostsAnomaliesInterval,((e,{interval:t,hostsType:a})=>({...e,[a]:{...e[a],queries:{...e[a].queries,[r.HostsTableType.anomalies]:{...e[a].queries[r.HostsTableType.anomalies],intervalSelection:t}}}}))).build()},function(e,t,a){"use strict";a.d(t,"a",(function(){return g})),a.d(t,"b",(function(){return f}));var n=a(46),i=a(2),r=a(373),s=a(143),o=a(8);const l=["TA0043","TA0042","TA0001","TA0002","TA0003","TA0004","TA0005","TA0006","TA0007","TA0008","TA0009","TA0011","TA0010","TA0040"],c=()=>a.e(19).then(a.bind(null,1443));function u(e){const t={totalRulesCount:Object.keys(e).length,totalEnabledRulesCount:0};for(const a of Object.keys(e))e[a].activity===r.b.Enabled&&t.totalEnabledRulesCount++;return t}function d(e){const t={enabledRules:[],disabledRules:[],availableRules:[]};for(const a of e.unmapped_rule_ids)p(t,a,e.rules_data[a]);return t}function p(e,t,a){a&&(a.activity===r.b.Enabled?e.enabledRules.push({id:t,name:a.name}):a.activity===r.b.Disabled&&e.disabledRules.push({id:t,name:a.name}))}var m=a(354);const b=["POST",r.d],g=(e={},t)=>Object(n.useQuery)([...b,e],(async({signal:t})=>async function(e){const t=await c(),{tactics:a,techniques:n,subtechniques:i}=t,r=function(e,t,a){const n=new Map;for(const e of a){const t={id:e.id,name:e.name,reference:e.reference,enabledRules:[],disabledRules:[],availableRules:[]},a=n.get(e.techniqueId);a?a.push(t):n.set(e.techniqueId,[t])}const i=new Map;for(const e of t){var r;const t={id:e.id,name:e.name,reference:e.reference,subtechniques:null!==(r=n.get(e.id))&&void 0!==r?r:[],enabledRules:[],disabledRules:[],availableRules:[]};for(const a of e.tactics){const e=i.get(a);e?e.push(t):i.set(a,[t])}}const s=e.sort(((e,t)=>l.indexOf(e.id)-l.indexOf(t.id))),c=[];for(const e of s){var u;c.push({id:e.id,name:e.name,reference:e.reference,techniques:null!==(u=i.get(Object(o.kebabCase)(e.name)))&&void 0!==u?u:[],enabledRules:[],disabledRules:[],availableRules:[]})}return c}(a,n,i);for(const t of r){for(const a of null!==(s=e.coverage[t.id])&&void 0!==s?s:[]){var s;p(t,a,e.rules_data[a])}for(const a of t.techniques){for(const t of null!==(m=e.coverage[a.id])&&void 0!==m?m:[]){var m;p(a,t,e.rules_data[t])}for(const t of a.subtechniques)for(const a of null!==(b=e.coverage[t.id])&&void 0!==b?b:[]){var b;p(t,a,e.rules_data[a])}}}return{mitreTactics:r,unmappedRules:d(e),metrics:u(e.rules_data)}}(await Object(s.g)({signal:t,filter:e}))),{...m.a,...t}),f=()=>{const e=Object(n.useQueryClient)();return Object(i.useCallback)((()=>{e.invalidateQueries(b,{refetchType:"active"})}),[e])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return E})),a.d(t,"b",(function(){return j}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(155),c=a(383),u=a(639),d=a(5);const p=d.i18n.translate("xpack.securitySolution.alertDetails.summary.readMore",{defaultMessage:"Read More"}),m=d.i18n.translate("xpack.securitySolution.alertDetails.summary.readLess",{defaultMessage:"Read Less"}),b=o()(n.EuiButtonEmpty).withConfig({displayName:"ReadMore",componentId:"sc-1cdn95f-0"})(["span.euiButtonContent{padding:0;}"]),g=o.a.div.withConfig({displayName:"ExpandedContent",componentId:"sc-1cdn95f-1"})(["max-height:33vh;overflow-wrap:break-word;overflow-x:hidden;overflow-y:auto;"]),f=o.a.div.withConfig({displayName:"StyledLineClamp",componentId:"sc-1cdn95f-2"})(["display:-webkit-box;-webkit-line-clamp:",";-webkit-box-orient:vertical;overflow:hidden;max-height:","em;height:","em;"],3,(({lineClampHeight:e})=>e),(({lineClampHeight:e})=>e)),y=({children:e,lineClampHeight:t=5.5})=>{const[a,n]=Object(i.useState)(null),[s,o]=Object(u.a)(e),l=Object(i.useCallback)((()=>{n((e=>!e))}),[]);return a?r.a.createElement(r.a.Fragment,null,r.a.createElement(g,{"data-test-subj":"expanded-line-clamp"},r.a.createElement("p",null,e)),s&&r.a.createElement(b,{onClick:l,size:"s","data-test-subj":"summary-view-readmore"},m)):r.a.createElement(r.a.Fragment,null,null==s||!0===s?r.a.createElement(f,{"data-test-subj":"styled-line-clamp",ref:o,lineClampHeight:t},e):e,s&&r.a.createElement(b,{onClick:l,size:"s","data-test-subj":"summary-view-readmore"},p))},h=r.a.memo(y),v=o.a.div.withConfig({displayName:"Indent",componentId:"sc-1pv3muo-0"})(["padding:0 8px;word-break:break-word;"]),E=Object(i.createContext)({}),x=({basicData:e,ruleNote:t,showFullView:a=!1,showTitle:i=!0})=>r.a.createElement(E.Provider,{value:e},i&&r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiSpacer,{size:"l"}),r.a.createElement(n.EuiTitle,{size:"xxxs","data-test-subj":"summary-view-guide"},r.a.createElement("h5",null,l.q)),r.a.createElement(n.EuiSpacer,{size:"s"})),r.a.createElement(v,null,a?r.a.createElement(n.EuiText,{size:"xs","data-test-subj":"investigation-guide-full-view"},r.a.createElement(c.b,null,t)):r.a.createElement(n.EuiText,{size:"xs","data-test-subj":"investigation-guide-clamped"},r.a.createElement(h,{lineClampHeight:4.5},r.a.createElement(c.b,null,t))))),j=r.a.memo(x)},function(e,t,a){"use strict";a.d(t,"a",(function(){return U}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(103),l=a(41),c=a.n(l),u=a(723),d=a(105),p=a(138),m=a(724),b=a(114),g=a(482),f=a(44),y=a(73),h=a(40),v=a(151),E=a(102),x=a(642),j=a(407),S=a(643),k=a(644),O=a(230),w=a(455);const T=({callback:e})=>({id:"openInLens",getDisplayName:e=>O.l,getIconType:e=>"visArea",type:"actionButton",isCompatible:async e=>!0,async execute(t){e()},order:1}),I=({callback:e,disabled:t})=>({id:"addToNewCase",getDisplayName:e=>O.c,getIconType:e=>"casesApp",type:"actionButton",isCompatible:async e=>!0,async execute(t){e()},disabled:t,order:3}),C=({callback:e,disabled:t})=>({id:"inspect",getDisplayName:e=>w.d,getIconType:e=>"inspect",type:"actionButton",isCompatible:async e=>!0,async execute(t){e()},disabled:t,order:4}),M=({callback:e,disabled:t})=>({id:"addToExistingCase",getDisplayName:e=>O.b,getIconType:e=>"casesApp",type:"actionButton",isCompatible:async e=>!0,async execute(t){e()},disabled:t,order:2});var _=a(122),F=a(454),A=a(211),D=a(110),N=a(390);const P=c.a.div.withConfig({displayName:"LensComponentWrapper",componentId:"sc-1ajgxgj-0"})(["height:",";width:",";"," .embPanel__header{z-index:2;position:absolute;right:0;}.expExpressionRenderer__expression{padding:2px 0 0 0 !important;}.legacyMtrVis__container{padding:0;}"],(({$height:e})=>e?`${e}px`:"auto"),(({width:e})=>null!=e?e:"auto"),(({$addHoverActionsPadding:e})=>e?".embPanel__header { top: -24px; }":"")),R={requests:void 0,responses:void 0,isLoading:!0},L=({applyGlobalQueriesAndFilters:e=!0,extraActions:t,extraOptions:a,getLensAttributes:n,height:i,id:l,inputsModelId:c=b.a.global,inspectTitle:u,lensAttributes:p,onLoad:m,scopeId:g=D.SourcererScopeName.default,stackByField:O,timerange:w,width:L,withActions:q=!0})=>{var z,$,V,U;const H=Object(r.useMemo)((()=>({height:null!=i?i:"100%",minWidth:"100px",width:null!=L?L:"100%"})),[i,L]),{lens:G,data:{actions:{createFiltersFromValueClickAction:Q}}}=Object(E.j)().services,W=Object(o.useDispatch)(),[K,Y]=Object(r.useState)(!1),[J,X]=Object(r.useState)(R),Z=_.d.globalQueryByIdSelector(),{searchSessionId:ee}=Object(d.a)((e=>Z(e,l))),te=Object(x.a)({applyGlobalQueriesAndFilters:e,extraOptions:a,getLensAttributes:n,lensAttributes:p,scopeId:g,stackByField:O,title:""}),ae=null==te||null===(z=te.state)||void 0===z||null===($=z.visualization)||void 0===$?void 0:$.preferredSeriesType,ne="lnsLegacyMetric"!==(null==te?void 0:te.visualizationType)&&"lnsPie"!==(null==te?void 0:te.visualizationType),ie=G.EmbeddableComponent,re=Object(r.useMemo)((()=>({onInspectActionClicked:()=>{Y(!0)},isDisabled:J.isLoading})),[J.isLoading]),se=(({attributes:e,extraActions:t,inspectActionProps:a,timeRange:n,withActions:i})=>{const{lens:s}=Object(j.b)().services,{navigateToPrefilledEditor:o}=s,[l,c]=Object(r.useState)(["inspect","addToNewCase","addToExistingCase","openInLens"]);Object(r.useEffect)((()=>{!1===i&&c([])}),[i]);const u=Object(r.useCallback)((()=>{n&&e&&o({id:"",timeRange:n,attributes:e},{openInNewTab:!0})}),[e,o,n]),{disabled:d,onAddToExistingCaseClicked:p}=Object(S.a)({lensAttributes:e,timeRange:n}),{onAddToNewCaseClicked:m,disabled:b}=Object(k.a)({timeRange:n,lensAttributes:e});return Object(r.useMemo)((()=>null==l?void 0:l.reduce(((e,t)=>"inspect"===t&&null!=a?[...e,C({callback:null==a?void 0:a.onInspectActionClicked,disabled:null==a?void 0:a.isDisabled})]:"addToExistingCase"===t?[...e,M({callback:p,disabled:d})]:"addToNewCase"===t?[...e,I({callback:m,disabled:b})]:"openInLens"===t?[...e,T({callback:u})]:e),[])),[l,a,p,d,m,b,u]).concat(null!=t?t:[])})({attributes:te,extraActions:t,inspectActionProps:re,timeRange:w,withActions:q}),oe=Object(r.useCallback)((()=>{Y(!1)}),[]),le=Object(r.useCallback)((({range:e})=>{const[t,a]=e;W(Object(v.setAbsoluteRangeDatePicker)({id:c,from:new Date(t).toISOString(),to:new Date(a).toISOString()}))}),[W,c]),ce=Object(r.useMemo)((()=>{var e;const[t,...a]=null!==(e=J.requests)&&void 0!==e?e:[];return{request:t,additionalRequests:a}}),[J.requests]),ue=Object(r.useMemo)((()=>{var e;const[t,...a]=null!==(e=J.responses)&&void 0!==e?e:[];return{response:t,additionalResponses:a}}),[J.responses]),de=Object(r.useCallback)(((e,t)=>{var a;if(!t)return;const n=Object(A.f)(null==t||null===(a=t.requests)||void 0===a?void 0:a.getRequests());X({requests:n.requests,responses:n.responses,isLoading:e}),null!=m&&m({requests:n.requests,responses:n.responses,isLoading:e})}),[m]),pe=Object(r.useCallback)((async e=>{if(!B(e)||"area"!==ae)return;const[{query:t}]=await Q({data:e.data,negate:e.negate}),a=null==t?void 0:t.range["@timestamp"];null!=a&&a.gte&&null!=a&&a.lt&&le({range:[a.gte,a.lt]})}),[Q,le,ae]),me=Object(r.useMemo)((()=>{var e,t;return null!=(null==te||null===(e=te.state)||void 0===e?void 0:e.adHocDataViews)?Object.values(null==te||null===(t=te.state)||void 0===t?void 0:t.adHocDataViews).reduce(((e,t)=>(null!=(null==t?void 0:t.name)&&e.push(null==t?void 0:t.name),e)),[]):null}),[null==te||null===(V=te.state)||void 0===V?void 0:V.adHocDataViews]);return ee?!te||null!=(null==J?void 0:J.responses)&&0===(null==J||null===(U=J.responses)||void 0===U?void 0:U.length)?s.a.createElement(h.EuiFlexGroup,null,s.a.createElement(h.EuiFlexItem,{grow:1},s.a.createElement(h.EuiEmptyPrompt,{body:s.a.createElement(h.EuiText,{size:"xs"},s.a.createElement(f.FormattedMessage,{id:"xpack.securitySolution.lensEmbeddable.NoDataToDisplay.title",defaultMessage:"No data to display"}))})),s.a.createElement(h.EuiFlexItem,{grow:!1},s.a.createElement(N.a,{extraActions:t,getLensAttributes:n,inputId:c,isInspectButtonDisabled:!0,lensAttributes:te,queryId:l,stackByField:O,timerange:w,title:u,withDefaultActions:!1}))):s.a.createElement(s.a.Fragment,null,te&&ee&&s.a.createElement(P,{$height:i,width:L,$addHoverActionsPadding:ne},s.a.createElement(ie,{id:l,style:H,timeRange:w,attributes:te,onLoad:de,onBrushEnd:le,onFilter:pe,viewMode:y.ViewMode.VIEW,withDefaultActions:!1,extraActions:se,searchSessionId:ee,showInspector:!1,syncTooltips:!1,syncCursor:!1})),K&&null!=ce.request&&null!=ue.response&&s.a.createElement(F.a,{adHocDataViews:me,additionalRequests:ce.additionalRequests,additionalResponses:ue.additionalResponses,closeModal:oe,"data-test-subj":"inspect-modal",inputId:c,request:ce.request,response:ue.response,title:u})):null},B=e=>Array.isArray(e.data)&&"column"in e.data[0],q=s.a.memo(L);var z=a(116),$=a(413);const V=e=>{var t,a;const n=Object(o.useDispatch)(),{inputId:c=b.a.global,id:f,isDonut:y,label:h,donutTextWrapperClassName:v,onLoad:E,...x}=e,{session:j,refetchByRestartingSession:S,refetchByDeletingSession:k}=Object(g.a)({inputId:c,queryId:f}),{indicesExist:O}=Object(z.d)(x.scopeId),w=Object(r.useRef)(x.timerange),T=p.d.globalQueryByIdSelector(),{searchSessionId:I}=Object(d.a)((e=>T(e,f))),C=Object($.a)({visualizationId:f}),M=null!=C&&0!==(null===(t=C[0])||void 0===t||null===(a=t.hits)||void 0===a?void 0:a.total),_=M?Object(l.css)(["top:40%;right:12%;"]):Object(l.css)(["top:66%;right:12%;"]),F=Object(r.useCallback)((({requests:e,responses:t,isLoading:a})=>{n(p.b.setQuery({inputId:c,id:f,searchSessionId:j.current.start(),refetch:S,loading:a,inspect:{dsl:e,response:t}})),"function"==typeof E&&E({requests:e,responses:t,isLoading:a})}),[n,c,f,j,S,E]);return Object(r.useEffect)((()=>{var e,t;(!O&&(null===(e=w.current)||void 0===e?void 0:e.from)!==x.timerange.from||(null===(t=w.current)||void 0===t?void 0:t.to)!==x.timerange.to)&&(w.current=x.timerange,n(p.b.deleteOneQuery({inputId:c,id:f})))}),[n,f,O,c,x.timerange]),Object(r.useEffect)((()=>{I||setTimeout((()=>{n(p.b.setQuery({inputId:c,id:f,searchSessionId:j.current.start(),refetch:M?S:k,loading:!1,inspect:null}))}),200)}),[n,c,f,j,M,S,I,k]),Object(r.useEffect)((()=>()=>{n(p.b.deleteOneQuery({inputId:c,id:f}))}),[n,f,c]),(x.getLensAttributes||x.lensAttributes)&&x.timerange?y?s.a.createElement(m.b,{isChartEmbeddablesEnabled:!0,dataExists:M,label:h,title:M?s.a.createElement(u.a,{count:null===(A=C[0])||void 0===A||null===(D=A.hits)||void 0===D?void 0:D.total}):null,donutTextWrapperClassName:v,donutTextWrapperStyles:_},s.a.createElement(q,i()({},x,{id:f,onLoad:F}))):s.a.createElement(q,i()({},x,{id:f,onLoad:F})):null;var A,D},U=s.a.memo(V)},function(e,t,a){e.exports=a(33)(448)},function(e,t,a){"use strict";e.exports=a(963)},function(e,t,a){"use strict";e.exports=a(969)},,function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return s}));var n=a(167);let i;!function(e){e.eventEnrichment="eventEnrichment",e.dataSource="dataSource"}(i||(i={}));const r=Object.keys(n.d),s=e=>r.includes(e)},function(e,t,a){"use strict";a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return s}));var n=a(324),i=a(174);const r=e=>Object(n.flow)(l)(e),s=e=>Object(n.flow)(o)(e),o=e=>{if("threat_match"===e.type&&null!=e.threat_mapping){const t=e.threat_mapping.map((e=>{const t=e.entries.map((e=>Object(i.d)(e)));return Object(i.d)({entries:t})}));return{...e,threat_mapping:t}}return e},l=e=>{if("threat_match"===e.type&&null!=e.threat_mapping){const t=e.threat_mapping.map((e=>{const t=e.entries.map((e=>Object(i.g)(e)));return{...Object(i.g)(e),entries:t}}));return{...e,threat_mapping:t}}return e}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(239);const i=({status:e,query:t,signalIds:a,signal:i})=>{if(a&&a.length>0)return Object(n.j)({status:e,signalIds:a,signal:i}).then((({items:e})=>({updated:e.length,version_conflicts:0})));if(t)return Object(n.k)({status:e,query:t,signal:i}).then((({updated:e,version_conflicts:t})=>({updated:null!=e?e:0,version_conflicts:t})));throw new Error("Either query or signalIds must be provided")}},function(e,t,a){"use strict";a.d(t,"b",(function(){return s})),a.d(t,"a",(function(){return o}));var n=a(263),i=a(668),r=a(195);const s=e=>`${Object(r.a)(e)}`,o=(e,t,a,s=i.a.flows)=>`/ip/${e}/${t||n.a.source}/${s}${Object(r.a)(a)}`},function(e,t,a){"use strict";a.d(t,"a",(function(){return f})),a.d(t,"c",(function(){return y})),a.d(t,"b",(function(){return h})),a.d(t,"d",(function(){return E}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(103),c=a(106),u=a(111),d=a(105),p=a(248),m=a(242),b=a(133);o()(n.EuiBadge).withConfig({displayName:"NotesCountBadge",componentId:"sc-v4xtfs-0"})(["margin-left:5px;"]).displayName="NotesCountBadge";const g=({timelineId:e})=>{const t=Object(l.useDispatch)(),a=Object(i.useMemo)((()=>u.b.getTimelineByIdSelector()),[]),s=Object(d.b)((t=>{var n;return(null!==(n=a(t,e))&&void 0!==n?n:b.b).isFavorite})),o=Object(d.b)((t=>{var n;return(null!==(n=a(t,e))&&void 0!==n?n:b.b).status}))===c.k.immutable,m=Object(i.useCallback)((()=>t(u.a.updateIsFavorite({id:e,isFavorite:!s}))),[t,e,s]);return r.a.createElement(n.EuiButton,{isSelected:s,fill:s,iconType:s?"starFilled":"starEmpty",onClick:m,"data-test-subj":`timeline-favorite-${s?"filled":"empty"}-star`,disabled:o},s?p.j:p.b)};g.displayName="AddToFavoritesButtonComponent";const f=r.a.memo(g),y=r.a.memo((({closeGearMenu:e,outline:t=!1,timelineId:a,title:n=p.h})=>{const{getButton:i}=Object(m.b)({timelineId:a,timelineType:c.l.default,closeGearMenu:e});return i({outline:t,title:n})}));y.displayName="NewTimeline";const h="notes-button",v=r.a.memo((({ariaLabel:e=p.i,isDisabled:t,toggleShowNotes:a,timelineType:i})=>{const s=i===c.l.template;return r.a.createElement(n.EuiButtonIcon,{"aria-label":e,className:h,"data-test-subj":"timeline-notes-button-small",disabled:t,iconType:"editorComment",onClick:a,size:"s",isDisabled:s})}));v.displayName="SmallNotesButton";const E=r.a.memo((({ariaLabel:e,isDisabled:t,showNotes:a,timelineType:i,toggleShowNotes:s,toolTip:o})=>a?r.a.createElement(v,{ariaLabel:e,isDisabled:t,toggleShowNotes:s,timelineType:i}):r.a.createElement(n.EuiToolTip,{content:o||"","data-test-subj":"timeline-notes-tool-tip"},r.a.createElement(v,{ariaLabel:e,isDisabled:t,toggleShowNotes:s,timelineType:i}))));E.displayName="NotesButton"},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(211),r=a(105),s=a(122);const o=({visualizationId:e})=>{const t=s.d.globalQueryByIdSelector(),{inspect:a}=Object(r.a)((a=>t(a,e)));return Object(n.useMemo)((()=>a?Object(i.g)(null==a?void 0:a.response):null),[a])}},function(e,t,a){"use strict";a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return s}));var n=a(2),i=a(102);const r=()=>{const[e,t]=Object(n.useState)(!1),a=Object(n.useCallback)((()=>{t(!1)}),[]);return[e,Object(n.useCallback)((()=>{t(!0)}),[]),a]},s=e=>{const{capabilities:t}=Object(i.j)().services.application;return!!t.siem[e]}},function(e,t,a){"use strict";a.d(t,"l",(function(){return i})),a.d(t,"o",(function(){return r})),a.d(t,"u",(function(){return s})),a.d(t,"s",(function(){return o})),a.d(t,"q",(function(){return l})),a.d(t,"r",(function(){return c})),a.d(t,"m",(function(){return u})),a.d(t,"k",(function(){return d})),a.d(t,"p",(function(){return p})),a.d(t,"x",(function(){return m})),a.d(t,"t",(function(){return b})),a.d(t,"n",(function(){return g})),a.d(t,"w",(function(){return f})),a.d(t,"v",(function(){return y})),a.d(t,"h",(function(){return h})),a.d(t,"i",(function(){return v})),a.d(t,"j",(function(){return E})),a.d(t,"b",(function(){return x})),a.d(t,"e",(function(){return j})),a.d(t,"c",(function(){return S})),a.d(t,"d",(function(){return k})),a.d(t,"a",(function(){return O})),a.d(t,"g",(function(){return w})),a.d(t,"f",(function(){return T}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.filtersLabel",{defaultMessage:"Filters"}),r=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.QueryLabel",{defaultMessage:"Custom query"}),s=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.threatQueryLabel",{defaultMessage:"Indicator index query"}),o=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.savedIdLabel",{defaultMessage:"Saved query name"}),l=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.savedQueryFiltersLabel",{defaultMessage:"Saved query filters"}),c=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.savedQueryLabel",{defaultMessage:"Saved query"}),u=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.mlRuleTypeDescription",{defaultMessage:"Machine Learning"}),d=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.eqlRuleTypeDescription",{defaultMessage:"Event Correlation"}),p=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.queryRuleTypeDescription",{defaultMessage:"Query"}),m=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.thresholdRuleTypeDescription",{defaultMessage:"Threshold"}),b=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.threatMatchRuleTypeDescription",{defaultMessage:"Indicator Match"}),g=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.newTermsRuleTypeDescription",{defaultMessage:"New Terms"}),f=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.thresholdResultsAllDescription",{defaultMessage:"All results"}),y=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.thresholdResultsAggregatedByDescription",{defaultMessage:"Results aggregated by"}),h=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.eqlEventCategoryFieldLabel",{defaultMessage:"Event category field"}),v=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.eqlTiebreakerFieldLabel",{defaultMessage:"Tiebreaker field"}),E=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.eqlTimestampFieldLabel",{defaultMessage:"Timestamp field"}),x=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.alertSuppressionInsufficientLicense",{defaultMessage:"Alert suppression is configured but will not be applied due to insufficient licensing"}),j=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.alertSuppressionTechnicalPreview",{defaultMessage:"Technical Preview"}),S=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.alertSuppressionPerRuleExecution",{defaultMessage:"One rule execution"}),k=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.alertSuppressionSuppressOnMissingFieldsDescription",{defaultMessage:"Suppress and group alerts for events with missing fields"}),O=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.alertSuppressionDoNotSuppressOnMissingFieldsDescription",{defaultMessage:"Do not suppress alerts for events with missing fields"}),w=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.buildingBlockLabel",{defaultMessage:"Building block"}),T=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.buildingBlockDescription",{defaultMessage:'All generated alerts will be marked as "building block" alerts'})},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(2),i=a.n(n),r=a(10),s=a.n(r),o=a(102);const l=Object(n.memo)((()=>{const{getStartedComponent$:e}=Object(o.j)().services,t=s()(e);return i.a.createElement(i.a.Fragment,null,t)}));l.displayName="LandingPageComponent"},function(e,t,a){"use strict";a.d(t,"f",(function(){return f})),a.d(t,"b",(function(){return y})),a.d(t,"a",(function(){return v})),a.d(t,"e",(function(){return E})),a.d(t,"d",(function(){return O})),a.d(t,"c",(function(){return w}));var n=a(42),i=a(50),r=a.n(i),s=a(343),o=a.n(s),l=a(1309),c=a.n(l),u=a(163),d=a(145),p=a(737),m=a(213),b=a(207),g=a(528);const f=e=>{const t={unit:"ms",value:0},a=e.match(/\d+/g),i=e.match(/[a-zA-Z]+/g);return Object(n.isEmpty)(a)||null==a||isNaN(Number(a[0]))||(t.value=Number(a[0])),!Object(n.isEmpty)(i)&&null!=i&&["s","m","h","d"].includes(i[0])&&(t.unit=i[0]),t},y=(e,t)=>{switch(t){case"machine_learning":const{index:t,queryBar:a,threshold:n,threatIndex:i,threatQueryBar:r,threatMapping:s,eqlOptions:o,newTermsFields:l,historyWindowSize:c,...u}=e;return u;case"threshold":const{anomalyThreshold:d,machineLearningJobId:p,threatIndex:m,threatQueryBar:b,threatMapping:g,eqlOptions:f,newTermsFields:y,historyWindowSize:h,...v}=e;return v;case"threat_match":const{anomalyThreshold:E,machineLearningJobId:x,threshold:j,eqlOptions:S,newTermsFields:k,historyWindowSize:O,...w}=e;return w;case"query":case"saved_query":const{anomalyThreshold:T,machineLearningJobId:I,threshold:C,threatIndex:M,threatQueryBar:_,threatMapping:F,eqlOptions:A,newTermsFields:D,historyWindowSize:N,...P}=e;return P;case"eql":const{anomalyThreshold:R,machineLearningJobId:L,threshold:B,threatIndex:q,threatQueryBar:z,threatMapping:$,newTermsFields:V,historyWindowSize:U,...H}=e;return H;case"new_terms":const{anomalyThreshold:G,machineLearningJobId:Q,threshold:W,threatIndex:K,threatQueryBar:Y,threatMapping:J,eqlOptions:X,...Z}=e;return Z}Object(d.a)(t)};function h(e){return e.filter((e=>"none"!==e.name))}const v=e=>e.filter((e=>"none"!==e.tactic.name)).map((e=>{var t;return{...e,technique:h(null!==(t=e.technique)&&void 0!==t?t:[]).map((e=>({...e,subtechnique:null!=e.subtechnique?h(e.subtechnique):[]})))}})),E=e=>{const t={...e};return e.dataSourceType===m.a.DataView?c()(t,["index","dataSourceType"]):e.dataSourceType===m.a.IndexPatterns?c()(t,["dataViewId","dataSourceType"]):t},x=e=>{var t,a,i,r,s,o,l,c,u,d,p,g,f,h,v,x,j,S,k,O,w,T,I,C,M,_,F,A,D,N,P,R,L,B,q,z,$,V,U,H,G,Q,W,K,Y,J;const X=E(e),Z=y(X,X.ruleType),{ruleType:ee,timeline:te}=Z;var ae;return{...{type:ee,...null!=te.id&&null!=te.title&&{timeline_id:te.id,timeline_title:te.title}},...(ae=Z,Object(n.has)("anomalyThreshold",ae)?{anomaly_threshold:Z.anomalyThreshold,machine_learning_job_id:Z.machineLearningJobId}:(e=>Object(n.has)("threshold",e))(Z)?{index:Z.index,filters:null===(t=Z.queryBar)||void 0===t?void 0:t.filters,language:null===(a=Z.queryBar)||void 0===a||null===(i=a.query)||void 0===i?void 0:i.language,query:null===(r=Z.queryBar)||void 0===r||null===(s=r.query)||void 0===s?void 0:s.query,saved_id:null!==(o=null===(l=Z.queryBar)||void 0===l?void 0:l.saved_id)&&void 0!==o?o:void 0,..."threshold"===ee&&{threshold:{field:null!==(c=null===(u=Z.threshold)||void 0===u?void 0:u.field)&&void 0!==c?c:[],value:null!==(d=parseInt(null===(p=Z.threshold)||void 0===p?void 0:p.value,10))&&void 0!==d?d:0,cardinality:Object(n.isEmpty)(null===(g=Z.threshold.cardinality)||void 0===g?void 0:g.field)||null==(null===(f=Z.threshold.cardinality)||void 0===f?void 0:f.value)?[]:[{field:Z.threshold.cardinality.field[0],value:parseInt(Z.threshold.cardinality.value,10)}]}}}:(e=>Object(n.has)("threatIndex",e))(Z)?{index:Z.index,filters:null===(h=Z.queryBar)||void 0===h?void 0:h.filters,language:null===(v=Z.queryBar)||void 0===v||null===(x=v.query)||void 0===x?void 0:x.language,query:null===(j=Z.queryBar)||void 0===j||null===(S=j.query)||void 0===S?void 0:S.query,saved_id:null!==(k=null===(O=Z.queryBar)||void 0===O?void 0:O.saved_id)&&void 0!==k?k:void 0,threat_index:Z.threatIndex,threat_query:null===(w=Z.threatQueryBar)||void 0===w||null===(T=w.query)||void 0===T?void 0:T.query,threat_filters:null===(I=Z.threatQueryBar)||void 0===I?void 0:I.filters,threat_mapping:Z.threatMapping,threat_language:null===(C=Z.threatQueryBar)||void 0===C||null===(M=C.query)||void 0===M?void 0:M.language}:(e=>Object(n.has)("eqlOptions",e))(Z)?{index:Z.index,filters:null===(_=Z.queryBar)||void 0===_?void 0:_.filters,language:null===(F=Z.queryBar)||void 0===F||null===(A=F.query)||void 0===A?void 0:A.language,query:null===(D=Z.queryBar)||void 0===D||null===(N=D.query)||void 0===N?void 0:N.query,saved_id:null!==(P=null===(R=Z.queryBar)||void 0===R?void 0:R.saved_id)&&void 0!==P?P:void 0,timestamp_field:null===(L=Z.eqlOptions)||void 0===L?void 0:L.timestampField,event_category_override:null===(B=Z.eqlOptions)||void 0===B?void 0:B.eventCategoryField,tiebreaker_field:null===(q=Z.eqlOptions)||void 0===q?void 0:q.tiebreakerField}:(e=>Object(n.has)("newTermsFields",e))(Z)?{index:Z.index,filters:null===(z=Z.queryBar)||void 0===z?void 0:z.filters,language:null===($=Z.queryBar)||void 0===$||null===(V=$.query)||void 0===V?void 0:V.language,query:null===(U=Z.queryBar)||void 0===U||null===(H=U.query)||void 0===H?void 0:H.query,new_terms_fields:Z.newTermsFields,history_window_start:`now-${Z.historyWindowSize}`}:{...Z.groupByFields.length>0?{alert_suppression:{group_by:Z.groupByFields,duration:Z.groupByRadioSelection===m.b.PerTimePeriod?Z.groupByDuration:void 0,missing_fields_strategy:Z.suppressionMissingFields||b.f}}:{},index:Z.index,filters:null===(G=Z.queryBar)||void 0===G?void 0:G.filters,language:null===(Q=Z.queryBar)||void 0===Q||null===(W=Q.query)||void 0===W?void 0:W.language,query:null===(K=Z.queryBar)||void 0===K||null===(Y=K.query)||void 0===Y?void 0:Y.query,saved_id:void 0,type:"query",...["query","saved_query"].includes(ee)&&(null===(J=Z.queryBar)||void 0===J?void 0:J.saved_id)&&Z.shouldLoadQueryDynamically&&{type:"saved_query",query:void 0,filters:void 0,saved_id:Z.queryBar.saved_id}}),data_view_id:Z.dataViewId}},j=e=>{const{...t}=e;if(!Object(n.isEmpty)(t.interval)&&!Object(n.isEmpty)(t.from)){const{unit:e,value:a}=f(t.interval),{unit:n,value:i}=f(t.from),s=r.a.duration(a,e);s.add(i,n),t.from=`now-${s.asSeconds()}s`,t.to="now"}return{...t,meta:{from:e.from}}},S=(e,t)=>{const{author:a,falsePositives:i,investigationFields:r,references:s,riskScore:o,severity:l,threat:c,isAssociatedToEndpointList:d,isBuildingBlock:p,note:m,ruleNameOverride:b,threatIndicatorPath:g,timestampOverride:f,timestampOverrideFallbackDisabled:y,...h}=e,E=null!=t?t.filter((e=>"endpoint"!==e.type)):[];return{author:a.filter((e=>!Object(n.isEmpty)(e))),...p?{building_block_type:"default"}:{},...d?{exceptions_list:[{id:u.k,list_id:u.k,namespace_type:"agnostic",type:"endpoint"},...E]}:null!=t?{exceptions_list:[...E]}:{},false_positives:i.filter((e=>!Object(n.isEmpty)(e))),references:s.filter((e=>!Object(n.isEmpty)(e))),investigation_fields:r.filter((e=>!Object(n.isEmpty)(e.trim()))),risk_score:o.value,risk_score_mapping:o.isMappingChecked?o.mapping.filter((e=>null!=e.field&&""!==e.field)):[],rule_name_override:""!==b?b:void 0,severity:l.value,severity_mapping:l.isMappingChecked?l.mapping.filter((e=>null!=e.field&&""!==e.field&&null!=e.value)):[],threat:v(c).map((e=>({...e,framework:"MITRE ATT&CK"}))),threat_indicator_path:g,timestamp_override:""!==f?f:void 0,timestamp_override_fallback_disabled:y,...Object(n.isEmpty)(m)?{}:{note:m},...h}},k=e=>{const{actions:t=[],responseActions:a,enabled:n,kibanaSiemAppUrl:i}=e;return{actions:t.map(p.b),response_actions:null==a?void 0:a.map(p.c),enabled:n,meta:{kibana_siem_app_url:i}}},O=(e,t,a,n,i)=>o.a.all([x(e),S(t,i),j(a),k(n)]),w=({defineRuleData:e,aboutRuleData:t,scheduleRuleData:a,exceptionsList:n})=>{const i={...t,name:"Preview Rule",description:"Preview Rule"};return{...O(e,i,a,g.c,n)}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return oe}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(42),l=a(40),c=a(163),u=a(120),d=a(5);const p=d.i18n.translate("xpack.securitySolution.ruleExceptions.addException.cancel",{defaultMessage:"Cancel"}),m=d.i18n.translate("xpack.securitySolution.ruleExceptions.addException.createRuleExceptionLabel",{defaultMessage:"Add rule exception"}),b=d.i18n.translate("xpack.securitySolution.ruleExceptions.addException.addEndpointException",{defaultMessage:"Add Endpoint Exception"}),g=d.i18n.translate("xpack.securitySolution.ruleExceptions.addException.submitError.title",{defaultMessage:"An error occured submitting exception"}),f=d.i18n.translate("xpack.securitySolution.ruleExceptions.addException.submitError.dismissButton",{defaultMessage:"Dismiss"}),y=d.i18n.translate("xpack.securitySolution.ruleExceptions.addException.submitError.message",{defaultMessage:"View toast for error details."}),h=d.i18n.translate("xpack.securitySolution.ruleExceptions.addException.success",{defaultMessage:"Rule exception added to shared exception list"}),v=d.i18n.translate("xpack.securitySolution.ruleExceptions.addExceptionFlyout.addRuleExceptionToastSuccessTitle",{defaultMessage:"Rule exception added"});var E=a(611),x=a(281);const j={initialItems:[],exceptionItems:[],exceptionItemMeta:{name:""},newComment:"",itemConditionValidationErrorExists:!1,closeSingleAlert:!1,bulkCloseAlerts:!1,disableBulkClose:!1,bulkCloseIndex:void 0,selectedOs:void 0,exceptionListsToAddTo:[],addExceptionToRadioSelection:"add_to_rule",selectedRulesToAddTo:[],listType:u.b.RULE_DEFAULT,errorSubmitting:null,expireTime:void 0,expireErrorExists:!1};var S=a(890),k=a(891),O=a(806),w=a(882);const T=d.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.addExceptionToRuleOrList.addToListsLabel",{defaultMessage:"Add to rule or lists"});var I=a(44),C=a(874);const M=({possibleRules:e,isSingleRule:t,isBulkAction:a,selectedRadioOption:r,onRuleSelectionChange:s,onRadioChange:o})=>{const c=Object(n.useMemo)((()=>a&&null!=e?{id:"add_to_rules",label:i.a.createElement(l.EuiText,{"data-test-subj":"addToRulesRadioOption"},i.a.createElement(I.FormattedMessage,{defaultMessage:"Add to [{numRules}] selected rules: {ruleNames}",id:"xpack.securitySolution.exceptions.common.addToRulesOptionLabel",values:{numRules:e.length,ruleNames:i.a.createElement("span",{style:{fontWeight:"bold"}},e.map((({name:e})=>e)).join(","))}})),checked:"add_to_rules"===r,"data-test-subj":"addToRulesOptionsRadio",onChange:()=>{o("add_to_rules"),s(e)}}:t&&null!=e?{id:"add_to_rule",label:i.a.createElement(l.EuiText,{"data-test-subj":"addToRuleRadioOption"},i.a.createElement(I.FormattedMessage,{defaultMessage:"Add to this rule: {ruleName}",id:"xpack.securitySolution.exceptions.common.addToRuleOptionLabel",values:{ruleName:i.a.createElement("span",{style:{fontWeight:"bold"}},e[0].name)}})),checked:"add_to_rule"===r,"data-test-subj":"addToRuleOptionsRadio",onChange:()=>{o("add_to_rule"),s(e)}}:{id:"select_rules_to_add_to",label:i.a.createElement(l.EuiText,{"data-test-subj":"selectRulesToAddToRadioOption"},i.a.createElement(I.FormattedMessage,{defaultMessage:"Add to rules",id:"xpack.securitySolution.exceptions.common.selectRulesOptionLabel"})),checked:"select_rules_to_add_to"===r,"data-test-subj":"selectRulesToAddToOptionRadio",onChange:()=>o("select_rules_to_add_to")}),[a,e,t,r,o,s]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(l.EuiRadio,c),"select_rules_to_add_to"===r&&i.a.createElement(C.a,{onRuleSelectionChange:s,initiallySelectedRules:[]}))},_=i.a.memo(M);_.displayName="ExceptionsAddToRulesOptions";const F=d.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.addToListsOptions.addToListsOptionLabel",{defaultMessage:"Add to shared exception lists"}),A=d.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.addToListsOptions.gotToSharedExceptions",{defaultMessage:"Manage shared exception lists"}),D=d.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.addToListsOptions.addToListsTooltip",{defaultMessage:"Shared exception list is a group of exceptions. Select this option if you’d like to add this exception to shared exception lists."}),N=e=>d.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.addToListsOptions.addToListsTooltipTitle",{values:{rulesCount:e},defaultMessage:"Shared exception list is a group of exceptions shared across rules. {rulesCount, plural, =1 {This rule currently has no shared} other {These rules currently have no commonly shared}} exception lists attached. To create one, visit the Shared Exception Lists page."});var P=a(605);const R=d.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.addToListsTableSelection.addToListsDescription",{defaultMessage:"After you create the exception, it is added to the exception lists you select."}),L=(d.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.addToListsTableSelection.viewListDetailActionLabel",{defaultMessage:"View list detail"}),d.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.addToListsTableSelection.referencesFetchError",{defaultMessage:"Unable to load shared exception lists"}));var B=a(565);const q=Object(n.memo)((({list:e,linkedList:t,onListLinkChange:a,dataTestSubj:r})=>{const s=Object(n.useMemo)((()=>Boolean(t.find((t=>t.id===e.id)))),[t,e.id]),o=Object(n.useCallback)((({target:{checked:n}})=>{const i=n?[...t,e]:null==t?void 0:t.filter((t=>t.id!==e.id));"function"==typeof a&&a(i)}),[t,a,e]);return i.a.createElement(l.EuiFlexItem,{grow:!1},i.a.createElement(l.EuiSwitch,{"data-test-subj":r,onChange:o,label:"",checked:s}))}));q.displayName="LinkListSwitch";var z=a(313);const $=({showAllSharedLists:e,sharedExceptionLists:t,onListSelectionChange:a})=>{const{error:r,isLoading:s,pagination:o,lists:c,listTableColumnsWithLinkSwitch:d,onTableChange:p,addToSelectedListDescription:m}=(({showAllSharedLists:e,sharedExceptionLists:t,onListSelectionChange:a})=>{const[r,s]=Object(n.useState)([]),[o,l]=Object(n.useState)(!1),c=Object(n.useMemo)((()=>e?[]:t),[e,t]),[d,p]=Object(n.useState)([]),[m,b]=Object(n.useState)({pageIndex:0,initialPageSize:5,showPerPageOptions:!1}),[g,f]=Object(n.useState)(void 0),y=Object(n.useCallback)((async()=>{try{return l(!0),Object(P.c)(c.length?c:[{namespace_type:"single"}])}catch(e){f(L)}}),[c]),h=Object(n.useCallback)((async()=>{const e=await y();if(!e)return l(!1);const t=[];for(const a of Object.values(e))a.type===u.b.DETECTION&&t.push(a);s(t),l(!1)}),[y]);Object(n.useEffect)((()=>{h()}),[c,y,h]),Object(n.useEffect)((()=>{a(d.map((({referenced_rules:e,namespace_type:t,os_types:a,tags:n,...i})=>({...i,namespace_type:null!=t?t:"single",os_types:null!=a?a:[],tags:null!=n?n:[]}))))}),[d,a]);const v=Object(n.useMemo)((()=>[{field:"link",name:B.b,align:"left","data-test-subj":"ruleActionLinkRuleSwitch",render:(e,t)=>i.a.createElement(q,{dataTestSubj:"addToSharedListSwitch",list:t,linkedList:d,onListLinkChange:p})},...Object(z.d)()]),[d]),E=Object(n.useCallback)((({page:{index:e}})=>b({...m,pageIndex:e})),[m]);return{error:g,isLoading:o,pagination:m,lists:r,listTableColumnsWithLinkSwitch:v,addToSelectedListDescription:R,onTableChange:E}})({showAllSharedLists:e,sharedExceptionLists:t,onListSelectionChange:a});return i.a.createElement(l.EuiPanel,{color:"subdued",borderRadius:"none",hasShadow:!1},i.a.createElement(i.a.Fragment,null,i.a.createElement(l.EuiText,{size:"s"},m),i.a.createElement(l.EuiSpacer,{size:"s"}),i.a.createElement(l.EuiSpacer,{size:"s"}),i.a.createElement(l.EuiInMemoryTable,{sorting:!0,tableLayout:"auto",tableCaption:"Table of exception lists","data-test-subj":"addExceptionToSharedListsTable",error:r,items:c,loading:s,message:s?i.a.createElement(l.EuiSkeletonText,{lines:4,"data-test-subj":"exceptionItemViewerEmptyPrompts-loading"}):void 0,columns:d,pagination:o,onTableChange:p})))},V=i.a.memo($);V.displayName="ExceptionsAddToListsTable";var U=a(102);const H=({rulesCount:e,selectedRadioOption:t,sharedLists:a,onListsSelectionChange:r,onRadioChange:s})=>{const{navigateToApp:o}=Object(U.j)().services.application,[c,u]=Object(n.useState)(!1);return i.a.createElement(i.a.Fragment,null,i.a.createElement(l.EuiRadio,{id:"add_to_lists",label:i.a.createElement(l.EuiFlexGroup,{alignItems:"flexStart",gutterSize:"none",responsive:!1,"data-test-subj":"addToListsRadioOptionLabel"},i.a.createElement(l.EuiFlexItem,{grow:!1},i.a.createElement(l.EuiText,null,F)),i.a.createElement(l.EuiFlexItem,{grow:!1,"data-test-subj":"addToListsOption"},i.a.createElement(l.EuiPopover,{button:i.a.createElement(l.EuiButtonIcon,{iconType:"iInCircle",onClick:()=>u(!c)}),isOpen:c,closePopover:()=>u(!1),anchorPosition:"upCenter"},i.a.createElement("div",{style:{width:"300px"}},i.a.createElement(l.EuiText,{size:"s"},0===a.length?N(e):D)),i.a.createElement(l.EuiPopoverFooter,null,i.a.createElement(l.EuiButtonEmpty,{size:"s",iconType:"popout",iconSide:"right",onClick:()=>o("security",{openInNewTab:!0,path:"/exceptions"})},A))))),checked:"add_to_lists"===t,disabled:0===a.length&&e>0,onChange:()=>s("add_to_lists"),"data-test-subj":"addToListsRadioOption"}),"add_to_lists"===t&&(a.length>0||0===e)&&i.a.createElement(V,{showAllSharedLists:0===e,sharedExceptionLists:a,onListSelectionChange:r,"data-test-subj":"exceptionsAddToListTable"}))},G=i.a.memo(H);G.displayName="ExceptionsAddToListsOptions";const Q=s()(l.EuiTitle).withConfig({displayName:"SectionHeader",componentId:"sc-oec11w-0"})(["",""],(()=>Object(r.css)(["font-weight:",";"],(({theme:e})=>e.eui.euiFontWeightSemiBold)))),W=({rules:e,isBulkAction:t,selectedRadioOption:a,onListSelectionChange:r,onRuleSelectionChange:s,onRadioChange:o})=>{const c=Object(n.useMemo)((()=>null!=e&&1===e.length),[e]),d=Object(n.useMemo)((()=>{var t,a,n;if(null==e)return[];if(1===e.length)return null!==(t=null===(a=e[0].exceptions_list)||void 0===a?void 0:a.filter((e=>e.type===u.b.DETECTION)))&&void 0!==t?t:[];const i=null!==(n=null==e?void 0:e.map((e=>null!=e.exceptions_list?e.exceptions_list:[])))&&void 0!==n?n:[];i.sort(((e,t)=>e.length-t.length));const r=i.shift();return null!=r&&r.length?r.filter((e=>i.every((t=>t.some((({id:t})=>e.id===t)))))).filter((e=>e.type===u.b.DETECTION)):[]}),[e]),p=Object(n.useMemo)((()=>null!=e?e.length:0),[e]);return i.a.createElement(l.EuiPanel,{paddingSize:"none",hasShadow:!1,"data-test-subj":"exceptionItemAddToRuleOrListSection"},i.a.createElement(Q,{size:"xs"},i.a.createElement("h3",null,T)),i.a.createElement(l.EuiSpacer,{size:"s"}),i.a.createElement(_,{possibleRules:e,isSingleRule:c,isBulkAction:t,selectedRadioOption:a,onRuleSelectionChange:s,onRadioChange:o}),i.a.createElement(G,{rulesCount:p,selectedRadioOption:a,sharedLists:d,onListsSelectionChange:r,onRadioChange:o}))},K=i.a.memo(W);K.displayName="ExceptionsAddToRulesOrLists";var Y=a(108),J=a(808),X=a(143);var Z=a(883);const ee=["query","machine_learning","saved_query","threat_match"];var te=a(353),ae=a(892);const ne=s()(l.EuiTitle).withConfig({displayName:"SectionHeader",componentId:"sc-v0j9bz-0"})(["",""],(()=>Object(r.css)(["font-weight:",";"],(({theme:e})=>e.eui.euiFontWeightSemiBold)))),ie=s()(l.EuiFlyoutBody).withConfig({displayName:"FlyoutBodySection",componentId:"sc-v0j9bz-1"})(["",""],(()=>Object(r.css)(["&.builder-section{overflow-y:scroll;}"]))),re=s()(l.EuiFlyoutHeader).withConfig({displayName:"FlyoutHeader",componentId:"sc-v0j9bz-2"})(["",""],(({theme:e})=>Object(r.css)(["border-bottom:1px solid ",";"],e.eui.euiColorLightShade))),se=s()(l.EuiFlexGroup).withConfig({displayName:"FlyoutFooterGroup",componentId:"sc-v0j9bz-3"})(["",""],(({theme:e})=>Object(r.css)(["padding:",";"],e.eui.euiSizeS))),oe=Object(n.memo)((function({rules:e,isBulkAction:t,isEndpointItem:a,alertData:r,showAlertCloseOptions:s,isAlertDataLoading:T,alertStatus:I,sharedListToAddTo:C,onCancel:M,onConfirm:_}){const{isLoading:F,indexPatterns:A,getExtendedFields:D}=Object(O.a)(e),[N,P]=(()=>{const{addSuccess:e,addError:t,addWarning:a}=Object(Y.a)(),[i,r]=(()=>{const[e,t]=Object(n.useState)(!1),a=Object(n.useRef)(null);return Object(n.useEffect)((()=>{const e=new AbortController;return a.current=async(a,n)=>{t(!0);const i=await Promise.all(n.map((async t=>Object(X.a)({items:a,ruleId:t.id,signal:e.signal}))));return t(!1),i.flatMap((e=>e))},()=>{t(!1),e.abort()}}),[]),[e,a.current]})(),[s,o]=Object(J.a)(),[l,c]=Object(n.useState)(!1),p=Object(n.useRef)(null),m=Object(n.useCallback)((e=>e.every((e=>u.i.is(e)))),[]),b=Object(n.useCallback)((e=>e.every((e=>u.n.is(e)||u.h.is(e)))),[]);return Object(n.useEffect)((()=>{const a=new AbortController;return p.current=async({itemsToAdd:a,listType:n,selectedRulesToAddTo:i,addToRules:s,addToSharedLists:l,sharedLists:p})=>{try{let t=[];if(c(!0),s&&null!=r&&n!==u.b.ENDPOINT&&m(a)){t=await r(a,i);const n=i.map((({name:e})=>e)).join(", ");e({title:v,text:(y=n,d.i18n.translate("xpack.securitySolution.ruleExceptions.addExceptionFlyout.addRuleExceptionToastSuccessText",{values:{ruleName:y},defaultMessage:"Exception has been added to rules - {ruleName}."}))})}else if((n===u.b.ENDPOINT||l)&&null!=o&&b(a)){t=await o(a);const n=p.map((({name:e})=>e));e({title:h,text:(f=n.join(","),d.i18n.translate("xpack.securitySolution.ruleExceptions.addExceptionFlyout.closeAlerts.successDetails",{values:{listNames:f},defaultMessage:"Rule exception has been added to shared lists: {listNames}."}))})}return c(!1),t}catch(e){throw c(!1),t(e,{title:g}),e}var f,y},()=>{a.abort()}}),[e,t,a,r,o,m,b]),[l||s||i,p.current]})(),[R,L]=Object(Z.a)(),B=Object(te.b)(),q=Object(n.useMemo)((()=>null==e||1!==e.length||ee.includes(e[0].type)),[e]),$=Object(n.useMemo)((()=>t?"add_to_rules":1===(null==e?void 0:e.length)||void 0!==T?"add_to_rule":"select_rules_to_add_to"),[T,t,e]),V=Object(n.useMemo)((()=>a?u.b.ENDPOINT:C?u.b.DETECTION:u.b.RULE_DEFAULT),[a,C]),[{exceptionItemMeta:{name:U},listType:H,selectedOs:G,initialItems:Q,exceptionItems:W,disableBulkClose:oe,bulkCloseAlerts:le,closeSingleAlert:ce,bulkCloseIndex:ue,addExceptionToRadioSelection:de,selectedRulesToAddTo:pe,exceptionListsToAddTo:me,newComment:be,itemConditionValidationErrorExists:ge,errorSubmitting:fe,expireTime:ye,expireErrorExists:he},ve]=Object(n.useReducer)(((e,t)=>{switch(t.type){case"setExceptionItemMeta":{const{value:a}=t;return{...e,exceptionItemMeta:{...e.exceptionItemMeta,[a[0]]:a[1]}}}case"setInitialExceptionItems":{const{items:a}=t;return{...e,initialItems:a}}case"setExceptionItems":{const{items:a}=t;return{...e,exceptionItems:a}}case"setConditionValidationErrorExists":{const{errorExists:a}=t;return{...e,itemConditionValidationErrorExists:a}}case"setComment":{const{comment:a}=t;return{...e,newComment:a}}case"setCloseSingleAlert":{const{close:a}=t;return{...e,closeSingleAlert:a}}case"setBulkCloseAlerts":{const{bulkClose:a}=t;return{...e,bulkCloseAlerts:a}}case"setBulkCloseIndex":{const{bulkCloseIndex:a}=t;return{...e,bulkCloseIndex:a}}case"setSelectedOsOptions":{const{selectedOs:a}=t;return{...e,selectedOs:a}}case"setAddExceptionToLists":{const{listsToAddTo:a}=t;return{...e,exceptionListsToAddTo:a}}case"setListOrRuleRadioOption":{const{option:a}=t;return{...e,addExceptionToRadioSelection:a,listType:"add_to_lists"===a?u.b.DETECTION:u.b.RULE_DEFAULT,selectedRulesToAddTo:"add_to_lists"===a?[]:e.selectedRulesToAddTo}}case"setSelectedRulesToAddTo":{const{rules:a}=t;return{...e,selectedRulesToAddTo:a}}case"setListType":{const{listType:a}=t;return{...e,listType:a}}case"setDisableBulkCloseAlerts":{const{disableBulkCloseAlerts:a}=t;return{...e,disableBulkClose:a}}case"setErrorSubmitting":{const{err:a}=t;return{...e,errorSubmitting:a}}case"setExpireTime":{const{expireTime:a}=t;return{...e,expireTime:a}}case"setExpireError":{const{errorExists:a}=t;return{...e,expireErrorExists:a}}default:return e}}),{...j,addExceptionToRadioSelection:$,listType:V,selectedRulesToAddTo:null!=e?e:[]}),Ee=Object(n.useMemo)((()=>null!=r),[r]),xe=Object(n.useCallback)((e=>{ve({type:"setInitialExceptionItems",items:e})}),[ve]),je=Object(n.useCallback)((e=>{ve({type:"setExceptionItems",items:e})}),[ve]),Se=Object(n.useCallback)((e=>{ve({type:"setListOrRuleRadioOption",option:e})}),[ve]),ke=Object(n.useCallback)((e=>{ve({type:"setSelectedRulesToAddTo",rules:e})}),[ve]),Oe=Object(n.useCallback)((e=>{ve({type:"setAddExceptionToLists",listsToAddTo:e})}),[ve]),we=Object(n.useCallback)((e=>{ve({type:"setExceptionItemMeta",value:e})}),[ve]),Te=Object(n.useCallback)((e=>{ve({type:"setConditionValidationErrorExists",errorExists:e})}),[ve]),Ie=Object(n.useCallback)((e=>{ve({type:"setSelectedOsOptions",selectedOs:e})}),[ve]),Ce=Object(n.useCallback)((e=>{ve({type:"setComment",comment:e})}),[ve]),Me=Object(n.useCallback)((e=>{ve({type:"setBulkCloseIndex",bulkCloseIndex:e})}),[ve]),_e=Object(n.useCallback)((e=>{ve({type:"setCloseSingleAlert",close:e})}),[ve]),Fe=Object(n.useCallback)((e=>{ve({type:"setBulkCloseAlerts",bulkClose:e})}),[ve]),Ae=Object(n.useCallback)((e=>{ve({type:"setDisableBulkCloseAlerts",disableBulkCloseAlerts:e})}),[ve]),De=Object(n.useCallback)((e=>{ve({type:"setErrorSubmitting",err:e})}),[ve]),Ne=Object(n.useCallback)((e=>{ve({type:"setExpireTime",expireTime:e})}),[ve]),Pe=Object(n.useCallback)((e=>{ve({type:"setExpireError",errorExists:e})}),[ve]);Object(n.useEffect)((()=>{if(r)switch(H){case u.b.ENDPOINT:return xe(Object(x.b)(c.k,U,r));case u.b.RULE_DEFAULT:{var t,a;const i=Object(x.k)({alertData:r,exceptionItemName:U,ruleCustomHighlightedFields:null!==(t=null==e||null===(a=e[0])||void 0===a?void 0:a.investigation_fields)&&void 0!==t?t:[]});if(i)return Ce((n=r._id,d.i18n.translate("xpack.securitySolution.ruleExceptions.addExceptionFlyout.addRuleExceptionFromAlertComment",{values:{alertId:n},defaultMessage:"Exception conditions are pre-filled with relevant data from an alert with the alert id (_id): {alertId}."}))),xe([i])}}var n}),[H,U,r,e,xe,Ce]);const Re=Object(n.useMemo)((()=>Ee?Object(x.n)(r):G?[...G]:[]),[Ee,r,G]),Le=Object(n.useCallback)((async()=>{if(null!=P)try{const t=["add_to_rule","add_to_rules","select_rules_to_add_to"].includes(de),a=!(null==C||!C.length)||"add_to_lists"===de&&!Object(o.isEmpty)(me),n=null!=C&&C.length?C:me,i=Object(z.b)({itemName:U,commentToAdd:be,addToRules:t,addToSharedLists:a,sharedLists:n,listType:H,selectedOs:Re,expireTime:ye,items:W}),s=await P({itemsToAdd:i,selectedRulesToAddTo:pe,listType:H,addToRules:t&&!Object(o.isEmpty)(pe),addToSharedLists:a,sharedLists:n}),l=ce&&r?r._id:void 0,c=t?pe.map((({rule_id:e})=>e)):(null!=e?e:[]).map((({rule_id:e})=>e));null==L||Object(o.isEmpty)(c)||!le&&!ce||await L(c,s,l,ue),B(),_(!0,ce,le)}catch(e){De(e)}}),[C,P,de,U,be,me,H,Re,W,pe,ce,r,e,L,le,_,ue,De,B,ye]),Be=Object(n.useMemo)((()=>N||R||null!=fe||""===U.trim()||W.every((e=>0===e.entries.length))||ge||he||"add_to_lists"===de&&Object(o.isEmpty)(me)||"select_rules_to_add_to"===de&&Object(o.isEmpty)(pe)&&H===u.b.RULE_DEFAULT),[N,R,fe,U,W,ge,de,me,he,pe,H]),qe=Object(n.useCallback)((()=>{De(null)}),[De]),ze=Object(n.useCallback)((()=>{M(!1)}),[M]),$e=Object(n.useMemo)((()=>H===u.b.ENDPOINT?b:m),[H]);return i.a.createElement(l.EuiFlyout,{size:"l",onClose:ze,"data-test-subj":"addExceptionFlyout"},i.a.createElement(re,null,i.a.createElement(l.EuiTitle,null,i.a.createElement("h2",{"data-test-subj":"exceptionFlyoutTitle"},$e)),i.a.createElement(l.EuiSpacer,{size:"m"})),i.a.createElement(ie,{className:"builder-section"},i.a.createElement(l.EuiSkeletonText,{"data-test-subj":"loadingAddExceptionFlyout",lines:4,isLoading:F},null!=fe&&i.a.createElement(i.a.Fragment,null,i.a.createElement(l.EuiCallOut,{title:g,color:"danger",iconType:"warning"},i.a.createElement(l.EuiText,null,y),i.a.createElement(l.EuiSpacer,{size:"s"}),i.a.createElement(l.EuiButton,{color:"danger",onClick:qe},f)),i.a.createElement(l.EuiSpacer,{size:"s"})),i.a.createElement(S.a,{exceptionItemName:U,onChange:we}),i.a.createElement(l.EuiHorizontalRule,null),i.a.createElement(k.a,{exceptionItemName:U,allowLargeValueLists:q,exceptionListItems:Q,exceptionListType:H,indexPatterns:A,rules:e,selectedOs:G,showOsTypeOptions:H===u.b.ENDPOINT&&!Ee,isEdit:!1,onOsChange:Ie,onExceptionItemAdd:je,onSetErrorExists:Te,getExtendedFields:D}),H!==u.b.ENDPOINT&&!(null!=C&&C.length)&&i.a.createElement(i.a.Fragment,null,i.a.createElement(l.EuiHorizontalRule,null),i.a.createElement(K,{rules:e,isBulkAction:t,selectedRadioOption:de,onListSelectionChange:Oe,onRuleSelectionChange:ke,onRadioChange:Se})),i.a.createElement(l.EuiHorizontalRule,null),i.a.createElement(E.a,{accordionTitle:i.a.createElement(ne,{size:"xs"},i.a.createElement("h3",null,(Ve=be?1:0,d.i18n.translate("xpack.securitySolution.ruleExceptions.addExceptionFlyout.commentsTitle",{values:{comments:Ve},defaultMessage:"Add comments ({comments})"})))),initialIsOpen:!!be,newCommentValue:be,newCommentOnChange:Ce}),H!==u.b.ENDPOINT&&i.a.createElement(i.a.Fragment,null,i.a.createElement(l.EuiHorizontalRule,null),i.a.createElement(ae.a,{expireTime:ye,setExpireTime:Ne,setExpireError:Pe})),s&&i.a.createElement(i.a.Fragment,null,i.a.createElement(l.EuiHorizontalRule,null),i.a.createElement(w.a,{exceptionListType:H,shouldCloseSingleAlert:ce,shouldBulkCloseAlert:le,disableBulkClose:oe,exceptionListItems:W,alertData:r,alertStatus:I,isAlertDataLoading:null!=T&&T,onDisableBulkClose:Ae,onUpdateBulkCloseIndex:Me,onBulkCloseCheckboxChange:Fe,onSingleAlertCloseCheckboxChange:_e})))),i.a.createElement(l.EuiFlyoutFooter,null,i.a.createElement(se,{justifyContent:"spaceBetween"},i.a.createElement(l.EuiButtonEmpty,{"data-test-subj":"cancelExceptionAddButton",onClick:ze},p),i.a.createElement(l.EuiButton,{"data-test-subj":"addExceptionConfirmButton",onClick:Le,isDisabled:Be,fill:!0},$e))));var Ve}))},function(e,t,a){"use strict";let n,i,r,s;a.d(t,"a",(function(){return n})),a.d(t,"b",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"d",(function(){return s})),function(e){e.success="success",e.failure="failure",e.warning="warning",e.unsupported="unsupported"}(n||(n={})),function(e){e.lastSeen="lastSeen",e.hostName="hostName"}(i||(i={})),function(e){e.kpiHosts="hostsKpiHosts",e.kpiUniqueIps="hostsKpiUniqueIps"}(r||(r={})),function(e){e.details="hostDetails",e.hosts="hosts",e.overview="overviewHost",e.uncommonProcesses="uncommonProcesses"}(s||(s={}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return G}));var n=a(42),i=a(40),r=a(2),s=a.n(r),o=a(41),l=a.n(o),c=a(121),u=a(142);const d="destination.ip",p="destination.port",m="event.category",b="file.name",g="host.name",f="kibana.alert.rule.name",y="kibana.alert.severity",h="process.parent.name",v="process.name",E="source.ip",x="source.port",j="user.name",S=[d,p,b,v,h,E,x],k=l()(i.EuiFlexGroup).withConfig({displayName:"AlertFieldFlexGroup",componentId:"sc-1itxfus-0"})(["flex-grow:0;gap:","px;"],(({$scopeId:e})=>e===u.f.active?0:3)),O=({contextId:e,eventId:t,field:a,fieldType:n="keyword",isAggregatable:r=!0,isDraggable:o,showSeparator:l,scopeId:u,value:d})=>s.a.createElement(k,{alignItems:"center","data-test-subj":"alertFieldBadge",$scopeId:u,gutterSize:"none"},s.a.createElement(i.EuiFlexItem,{grow:!1},s.a.createElement(c.c,{contextId:`${e}-alert-field`,eventId:t,field:a,fieldType:n,isAggregatable:r,isDraggable:o,scopeId:u,value:d})),l&&s.a.createElement(i.EuiFlexItem,{grow:!1},s.a.createElement("span",{"data-test-subj":"separator"},", ")));O.displayName="AlertFieldBadgeComponent";const w=s.a.memo(O),T=({contextId:e,"data-test-subj":t="alertField",eventId:a,field:n,fieldType:r="keyword",isAggregatable:o=!0,isDraggable:l,prefix:c,suffix:u,scopeId:d,values:p})=>null!=p?s.a.createElement(k,{alignItems:"center","data-test-subj":t,$scopeId:d,gutterSize:"none"},null!=c&&s.a.createElement(i.EuiFlexItem,{"data-test-subj":"prefix",grow:!1},c),p.map(((t,c)=>s.a.createElement(i.EuiFlexItem,{key:`${t}-${c}`,grow:!1},s.a.createElement(w,{contextId:`${e}-alert-field`,eventId:a,field:n,fieldType:r,isAggregatable:o,isDraggable:l,showSeparator:c<p.length-1,scopeId:d,value:t})))),null!=u&&s.a.createElement(i.EuiFlexItem,{"data-test-subj":"suffix",grow:!1},u)):null;T.displayName="AlertFieldComponent";const I=s.a.memo(T);var C=a(106),M=a(127),_=a(275),F=a(5);const A=F.i18n.translate("xpack.securitySolution.renderers.alertRenderer.alertLabel",{defaultMessage:"alert"}),D=F.i18n.translate("xpack.securitySolution.renderers.alertRenderer.byLabel",{defaultMessage:"by"}),N=F.i18n.translate("xpack.securitySolution.renderers.alertRenderer.createdLabel",{defaultMessage:"created"}),P=F.i18n.translate("xpack.securitySolution.renderers.alertRenderer.destinationLabel",{defaultMessage:"destination"}),R=F.i18n.translate("xpack.securitySolution.renderers.alertRenderer.eventLabel",{defaultMessage:"event"}),L=F.i18n.translate("xpack.securitySolution.renderers.alertRenderer.fileLabel",{defaultMessage:"file"}),B=F.i18n.translate("xpack.securitySolution.renderers.alertRenderer.onLabel",{defaultMessage:"on"}),q=F.i18n.translate("xpack.securitySolution.renderers.alertRenderer.parentProcessLabel",{defaultMessage:"parent process"}),z=F.i18n.translate("xpack.securitySolution.renderers.alertRenderer.processLabel",{defaultMessage:"process"}),$=F.i18n.translate("xpack.securitySolution.renderers.alertRenderer.sourceLabel",{defaultMessage:"source"}),V=F.i18n.translate("xpack.securitySolution.renderers.alertRenderer.withLabel",{defaultMessage:"with"}),U=l()(i.EuiFlexGroup).withConfig({displayName:"AlertRendererFlexGroup",componentId:"sc-fjuibw-0"})(["gap:",";"],(({theme:e})=>e.eui.euiSizeXS)),H={id:C.d.alert,isInstance:e=>{return null!==(a=null==(t=Object(n.get)("event.kind",e))?void 0:t.some((e=>null!=e.toLocaleLowerCase&&"signal"===e.toLowerCase())))&&void 0!==a&&a;var t,a},renderRow:({contextId:e="alert-renderer",data:t,isDraggable:a,scopeId:r})=>{const o=Object(n.get)("_id",t),l=Object(n.get)(d,t),c=Object(n.get)(p,t),u=Object(n.get)(m,t),k=Object(n.get)(b,t),O=Object(n.get)(g,t),w=Object(n.get)(f,t),T=Object(n.get)(y,t),C=Object(n.get)(v,t),F=Object(n.get)(h,t),H=Object(n.get)(E,t),G=Object(n.get)(x,t),Q=Object(n.get)(j,t);return s.a.createElement(_.a,null,s.a.createElement(M.b,{"data-test-subj":"alertRenderer"},s.a.createElement(U,{alignItems:"center",gutterSize:"none",justifyContent:"center",wrap:!0},s.a.createElement(I,{contextId:e,"data-test-subj":m,eventId:o,field:m,isDraggable:a,scopeId:r,values:u}),s.a.createElement(i.EuiFlexItem,{grow:!1},s.a.createElement("span",{"data-test-subj":"event"},` ${R} `)),(({data:e,fieldNames:t})=>t.some((t=>Object(n.has)(t,e))))({data:t,fieldNames:S})&&s.a.createElement(i.EuiFlexItem,{grow:!1},s.a.createElement("span",{"data-test-subj":"with"},` ${V} `)),s.a.createElement(I,{contextId:e,"data-test-subj":v,eventId:o,field:v,isDraggable:a,prefix:` ${z} `,suffix:", ",scopeId:r,values:C}),s.a.createElement(I,{contextId:e,"data-test-subj":h,eventId:o,field:h,isDraggable:a,prefix:` ${q} `,suffix:", ",scopeId:r,values:F}),s.a.createElement(I,{contextId:e,"data-test-subj":b,eventId:o,field:b,isDraggable:a,prefix:` ${L} `,suffix:", ",scopeId:r,values:k}),s.a.createElement(I,{contextId:e,"data-test-subj":E,eventId:o,field:E,isDraggable:a,prefix:` ${$} `,scopeId:r,values:H}),s.a.createElement(I,{contextId:e,"data-test-subj":x,eventId:o,field:x,isDraggable:a,prefix:":",suffix:", ",scopeId:r,values:G}),s.a.createElement(I,{contextId:e,"data-test-subj":d,eventId:o,field:d,isDraggable:a,prefix:` ${P} `,scopeId:r,values:l}),s.a.createElement(I,{contextId:e,"data-test-subj":p,eventId:o,field:p,isDraggable:a,prefix:":",suffix:", ",scopeId:r,values:c}),s.a.createElement(I,{contextId:e,"data-test-subj":j,eventId:o,field:j,isDraggable:a,prefix:` ${D} `,scopeId:r,values:Q}),s.a.createElement(I,{contextId:e,"data-test-subj":g,eventId:o,field:g,isDraggable:a,prefix:` ${B} `,scopeId:r,values:O}),s.a.createElement(I,{contextId:e,"data-test-subj":y,eventId:o,field:y,isDraggable:a,prefix:` ${N} `,suffix:` ${A} `,scopeId:r,values:T}),s.a.createElement(I,{contextId:e,"data-test-subj":f,eventId:o,field:f,isDraggable:a,suffix:".",scopeId:r,values:w}))))}},G=({data:e,rowRenderers:t})=>{var a;const n=null!==(a=t.find((t=>t.isInstance(e))))&&void 0!==a?a:null;return H.isInstance(e)?null!=n?(({a:e,b:t,id:a})=>({id:a,isInstance:a=>e.isInstance(a)||t.isInstance(a),renderRow:({contextId:a,data:n,isDraggable:i,scopeId:r})=>s.a.createElement(s.a.Fragment,null,e.isInstance(n)&&e.renderRow({contextId:a,data:n,isDraggable:i,scopeId:r}),t.isInstance(n)&&t.renderRow({contextId:a,data:n,isDraggable:i,scopeId:r}))}))({a:H,b:n,id:n.id}):H:n}},,function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"c",(function(){return s})),a.d(t,"a",(function(){return G}));var n=a(48);const i=parseInt(n.euiThemeVars.euiSizeXL,10)-parseInt(n.euiThemeVars.euiSizeXS,10),r=e=>"signal"===e,s=e=>(e>0?e*i:i)+2*parseInt(n.euiThemeVars.euiDataGridCellPaddingM,10);var o=a(2),l=a.n(o),c=a(103),u=a(40),d=a(41),p=a.n(d),m=a(119),b=a(346),g=a(115),f=a(683),y=a(111),h=a(142),v=a(412),E=a(106),x=a(126),j=a(564),S=a(803);const k=({ariaLabel:e,showNotes:t,timelineType:a,toggleShowNotes:n})=>{const{kibanaSecuritySolutionsPrivileges:i}=Object(x.a)();return l.a.createElement(S.a,null,l.a.createElement(v.d,{ariaLabel:e,"data-test-subj":"add-note",isDisabled:!1===i.crud,showNotes:t,timelineType:a,toggleShowNotes:n,toolTip:a===E.l.template?j.g:j.h}))};k.displayName="AddEventNoteActionComponent";const O=l.a.memo(k);var w=a(170),T=a(804);const I=({ariaLabel:e,isAlert:t,noteIds:a,onPinClicked:n,eventIsPinned:r,timelineType:s})=>{const{kibanaSecuritySolutionsPrivileges:c}=Object(x.a)(),d=Object(o.useMemo)((()=>Object(b.g)({isPinned:r,isAlert:t,eventHasNotes:Object(b.b)(a),timelineType:s})),[r,t,a,s]);return l.a.createElement("div",{key:"timeline-action-pin-tool-tip"},l.a.createElement(w.l,{textAlign:"center",width:i},l.a.createElement(u.EuiToolTip,{"data-test-subj":"timeline-action-pin-tool-tip",content:d},l.a.createElement(T.a,{ariaLabel:e,allowUnpinning:!Object(b.b)(a),"data-test-subj":"pin-event",isDisabled:!1===c.crud,isAlert:t,onClick:n,pinned:r,timelineType:s}))))};I.displayName="PinEventActionComponent";const C=l.a.memo(I);var M=a(105),_=a(133),F=a(159),A=a(17),D=a(178),N=a(196),P=a(12),R=a(124),L=a(875),B=a(928),q=a(363),z=a(199),$=a(272),V=a(291);const U=p.a.div.withConfig({displayName:"ActionsContainer",componentId:"sc-3eeodk-0"})(["align-items:center;display:flex;"]),H=({ariaRowindex:e,checked:t,columnValues:a,ecsData:n,eventId:s,eventIdToNoteIds:d,isEventPinned:p=!1,isEventViewer:v=!1,loadingEventIds:E,onEventDetailsPanelOpened:x,onRowSelected:S,onRuleChange:k,showCheckboxes:T,showNotes:I,timelineId:H,toggleShowNotes:G,refetch:Q,setEventsLoading:W})=>{const K=Object(c.useDispatch)(),Y=Object(R.a)("tGridEnabled"),J=Object(o.useMemo)((()=>y.b.getTimelineByIdSelector()),[]),X=Object(M.b)((e=>(Object(g.isTimelineScope)(H)?J(e,H):_.b).timelineType)),{startTransaction:Z}=Object(F.b)(),ee=Object(A.b)().isEnterprise(),te=Object(o.useCallback)((e=>K(y.a.pinEvent({id:H,eventId:e}))),[K,H]),ae=Object(o.useCallback)((e=>K(y.a.unPinEvent({id:H,eventId:e}))),[K,H]),ne=Object(o.useCallback)((e=>S({eventIds:[s],isSelected:e.currentTarget.checked})),[s,S]),ie=Object(o.useCallback)((()=>Object(b.f)({allowUnpinning:!d||!Object(b.b)(d[s]),eventId:s,onPinEvent:te,onUnPinEvent:ae,isEventPinned:p})),[d,s,p,te,ae]),re=Object(b.e)(n),se=Object(o.useMemo)((()=>{var e,t,a,i;return"signal"!==re&&!(null!==(e=n.event)&&void 0!==e&&null!==(t=e.kind)&&void 0!==t&&t.includes("event")&&null!==(a=n.agent)&&void 0!==a&&null!==(i=a.type)&&void 0!==i&&i.includes("endpoint"))}),[n,re]),oe=Object(o.useMemo)((()=>!Object(f.a)(n)),[n]),{setGlobalFullScreen:le}=Object(D.a)(),{setTimelineFullScreen:ce}=Object(D.c)(),ue=Object(g.getScopedActions)(H),de=Object(o.useCallback)((()=>{Z({name:N.a.OPEN_ANALYZER});const e=document.querySelector(".euiDataGrid--fullScreen");ue&&K(ue.updateGraphEventId({id:H,graphEventId:n._id})),H===h.f.active?(e&&ce(!0),K(Object(P.setActiveTabTimeline)({id:H,activeTab:m.f.graph}))):e&&le(!0)}),[Z,ue,H,K,n._id,ce,le]),pe=Object(o.useMemo)((()=>{var e,t,a,i,r,s,o,l,c,u;const{process:d,_id:p,_index:m,timestamp:b,kibana:g}=n,f=null==d||null===(e=d.entry_leader)||void 0===e||null===(t=e.entity_id)||void 0===t?void 0:t[0],y=null==d||null===(a=d.entry_leader)||void 0===a||null===(i=a.start)||void 0===i?void 0:i[0],h=(null==g||null===(r=g.alert)||void 0===r||null===(s=r.ancestors)||void 0===s||null===(o=s.index)||void 0===o?void 0:o[0])||m;if(void 0===h||void 0===f||void 0===y)return null;const v=null==d||null===(l=d.entity_id)||void 0===l?void 0:l[0],E="signal"===re||"eql"===re?p:void 0;return{index:h,sessionEntityId:f,sessionStartTime:y,jumpToEntityId:v,jumpToCursor:E&&(null===(c=n.kibana)||void 0===c||null===(u=c.alert.original_time)||void 0===u?void 0:u[0])||b,investigatedAlertId:E}}),[n,re]),me=Object(o.useCallback)((()=>{const e=document.querySelector(".euiDataGrid--fullScreen");Z({name:N.a.OPEN_SESSION_VIEW}),H===h.f.active?(e&&ce(!0),null!==pe&&K(Object(P.setActiveTabTimeline)({id:H,activeTab:m.f.session}))):e&&le(!0),null!==pe&&ue&&K(ue.updateSessionViewConfig({id:H,sessionViewConfig:pe}))}),[Z,H,pe,ce,K,le,ue]),{activeStep:be,isTourShown:ge,incrementStep:fe}=Object(q.b)(),ye=Object(o.useMemo)((()=>ge(z.b.alertsCases)&&"signal"===re&&Object($.c)(H)&&1===e),[ge,e,re,H]),he=Object(o.useCallback)((()=>{ye&&be===z.a.expandEvent&&ge(z.b.alertsCases)&&fe(z.b.alertsCases),x()}),[be,fe,ye,ge,x]);return l.a.createElement(U,null,T&&!Y&&l.a.createElement("div",{key:"select-event-container","data-test-subj":"select-event-container"},l.a.createElement(w.l,{textAlign:"center",width:i},E.includes(s)?l.a.createElement(u.EuiLoadingSpinner,{size:"m","data-test-subj":"event-loader"}):l.a.createElement(u.EuiCheckbox,{"aria-label":j.d({ariaRowindex:e,columnValues:a,checked:t}),"data-test-subj":"select-event",id:s,checked:t,onChange:ne}))),l.a.createElement(V.a,{isTourAnchor:ye,onClick:he,step:z.a.expandEvent,tourId:z.b.alertsCases},l.a.createElement("div",{key:"expand-event"},l.a.createElement(w.l,{textAlign:"center",width:i},l.a.createElement(u.EuiToolTip,{"data-test-subj":"expand-event-tool-tip",content:j.m},l.a.createElement(u.EuiButtonIcon,{"aria-label":j.n({ariaRowindex:e,columnValues:a}),"data-test-subj":"expand-event",iconType:"expand",onClick:he,size:"s"}))))),l.a.createElement(l.a.Fragment,null,H!==h.f.active&&l.a.createElement(B.a,{ariaLabel:j.k({ariaRowindex:e,columnValues:a}),key:"investigate-in-timeline",ecsRowData:n}),!v&&G&&l.a.createElement(l.a.Fragment,null,l.a.createElement(O,{ariaLabel:j.c({ariaRowindex:e,columnValues:a}),key:"add-event-note",showNotes:null!=I&&I,toggleShowNotes:G,timelineType:X}),l.a.createElement(C,{ariaLabel:j.j({ariaRowindex:e,columnValues:a,isEventPinned:p}),isAlert:r(re),key:"pin-event",onPinClicked:ie,noteIds:d&&d[s]||[],eventIsPinned:p,timelineType:X})),l.a.createElement(L.b,{ariaLabel:j.f({ariaRowindex:e,columnValues:a}),ariaRowindex:e,columnValues:a,key:"alert-context-menu",ecsRowData:n,scopeId:H,disabled:se,onRuleChange:k,refetch:Q}),!1===oe?l.a.createElement("div",null,l.a.createElement(w.l,{textAlign:"center",width:i},l.a.createElement(u.EuiToolTip,{"data-test-subj":"view-in-analyzer-tool-tip",content:j.a},l.a.createElement(u.EuiButtonIcon,{"aria-label":j.b({ariaRowindex:e,columnValues:a}),"data-test-subj":"view-in-analyzer",iconType:"analyzeEvent",onClick:de,size:"s"})))):null,null===pe||!ee&&H!==m.e.kubernetesPageSessions?null:l.a.createElement("div",null,l.a.createElement(w.l,{textAlign:"center",width:i},l.a.createElement(u.EuiToolTip,{"data-test-subj":"expand-event-tool-tip",content:j.i},l.a.createElement(u.EuiButtonIcon,{"aria-label":j.n({ariaRowindex:e,columnValues:a}),"data-test-subj":"session-view-button",iconType:"sessionViewer",onClick:me,size:"s"}))))))};H.displayName="ActionsComponent";const G=l.a.memo(H);a(652)},function(e,t,a){"use strict";a.d(t,"a",(function(){return I}));var n=a(388),i=a(42),r=a(2),s=a.n(r),o=a(103),l=a(3),c=a(130),u=a.n(c),d=a(138),p=a(378),m=a(139),b=a(187);const g=e=>e.query,f=e=>e.savedQuery;var y=a(111),h=a(102),v=a(475),E=a(400),x=a(280),j=a(122),S=a(160),k=a(221),O=a(124);const w=Object(r.memo)((({end:e,filterQuery:t,fromStr:a,hideFilterBar:c=!1,hideQueryInput:m=!1,id:b,indexPattern:g,isLoading:f=!1,pollForSignalIndex:y,queries:w,savedQuery:T,setSavedQuery:I,setSearchBarFilter:C,start:M,toStr:_,updateSearch:F,dataTestSubj:A})=>{const{data:{query:{timefilter:{timefilter:D},filterManager:N}},unifiedSearch:{ui:{SearchBar:P}}}=Object(h.j)().services,R=Object(o.useDispatch)(),L=Object(r.useCallback)((()=>{R(v.b.setUsersTablesActivePageToZero()),R(E.a.setHostTablesActivePageToZero()),R(x.b.setNetworkTablesActivePageToZero())}),[R]);(()=>{const e=Object(S.d)(k.a.savedQuery),t=Object(S.d)(k.a.appQuery),a=Object(S.d)(k.a.filters),n=Object(r.useMemo)((()=>j.d.globalQuerySelector()),[]),s=Object(r.useMemo)((()=>j.d.globalFiltersQuerySelector()),[]),l=Object(r.useMemo)((()=>j.d.globalSavedQuerySelector()),[]),c=Object(o.useSelector)(n),u=Object(o.useSelector)(s),d=Object(o.useSelector)(l);Object(r.useEffect)((()=>{var n;null!=d&&""!==d.id?(e(null!==(n=null==d?void 0:d.id)&&void 0!==n?n:null),t(null),a(null)):(e(null),t(Object(i.isEmpty)(c.query)?null:c),a(Object(i.isEmpty)(u)?null:u))}),[d,c,u,e,t,a])})(),(()=>{const e=Object(S.d)(k.a.timerange),t=Object(r.useMemo)((()=>d.d.inputsSelector()),[]),a=Object(o.useSelector)(t),n=Object(O.a)("socTrendsEnabled"),{linkTo:i,timerange:s}=a.global,{linkTo:l,timerange:c}=a.timeline,u=Object(r.useMemo)((()=>{if(n&&a.socTrends){const{linkTo:e,timerange:t}=a.socTrends;return{socTrends:{[k.a.timerange]:t,linkTo:e}}}return{}}),[a.socTrends,n]);Object(r.useEffect)((()=>{e({global:{[k.a.timerange]:s,linkTo:i},timeline:{[k.a.timerange]:c,linkTo:l},...u})}),[e,i,s,l,c,u])})(),Object(r.useEffect)((()=>{null!=a&&null!=_?D.setTime({from:a,to:_}):null!=M&&null!=e&&(L(),D.setTime({from:new Date(M).toISOString(),to:new Date(e).toISOString()}))}),[e,a,M,D,_,L]);const B=Object(r.useCallback)((i=>{null!=y&&y();const r=i.dateRange.from.includes("now")||i.dateRange.to.includes("now");let s={id:b,end:null!=_?_:new Date(e).toISOString(),start:null!=a?a:new Date(M).toISOString(),isInvalid:!1,isQuickSelection:r,updateTime:!1,filterManager:N,setTablesActivePageToZero:L},o=!1;(!r||a===i.dateRange.from&&_===i.dateRange.to)&&(r||M===Object(p.c)(i.dateRange.from)&&e===Object(p.c)(i.dateRange.to))||(o=!0,s.updateTime=!0,s.end=i.dateRange.to,s.start=i.dateRange.from),null==i.query||u()(i.query,t)||(o=!0,s=Object(n.set)("query",i.query,s)),o||(r&&i.dateRange.to!==i.dateRange.from?(s.updateTime=!0,s.end=i.dateRange.to,s.start=i.dateRange.from):w.forEach((e=>e.refetch&&e.refetch()))),window.setTimeout((()=>F(s)),0)}),[b,y,_,e,a,M,N,t,w,F,L]),q=Object(r.useCallback)((e=>{e.dateRange.from.includes("now")||e.dateRange.to.includes("now")?F({id:b,end:e.dateRange.to,start:e.dateRange.from,isInvalid:!1,isQuickSelection:!0,updateTime:!0,filterManager:N,setTablesActivePageToZero:L}):w.forEach((e=>e.refetch&&e.refetch()))}),[F,b,N,w,L]),z=Object(r.useCallback)((e=>{I({id:b,savedQuery:e})}),[b,I]),$=Object(r.useCallback)((t=>{const i=!!t.attributes.timefilter&&(t.attributes.timefilter.from.includes("now")||t.attributes.timefilter.to.includes("now"));let r={id:b,filters:t.attributes.filters||[],end:null!=_?_:new Date(e).toISOString(),start:null!=a?a:new Date(M).toISOString(),isInvalid:!1,isQuickSelection:i,updateTime:!1,filterManager:N,setTablesActivePageToZero:L};t.attributes.timefilter&&(r.end=t.attributes.timefilter?t.attributes.timefilter.to:r.end,r.start=t.attributes.timefilter?t.attributes.timefilter.from:r.start,r.updateTime=!0),r=Object(n.set)("query",t.attributes.query,r),r=Object(n.set)("savedQuery",t,r),F(r)}),[b,_,e,a,M,N,F,L]),V=Object(r.useCallback)((()=>{null!=T&&F({id:b,filters:[],end:null!=_?_:new Date(e).toISOString(),start:null!=a?a:new Date(M).toISOString(),isInvalid:!1,isQuickSelection:!1,updateTime:!1,query:{query:"",language:T.attributes.query.language},resetSavedQuery:!0,savedQuery:void 0,filterManager:N,setTablesActivePageToZero:L})}),[T,F,b,_,e,a,M,N,L]);Object(r.useEffect)((()=>{let e=!0;const t=new l.Subscription;return t.add(N.getUpdates$().subscribe({next:()=>{if(e){const e=N.getFilters();C({id:b,filters:e}),L()}}})),()=>{e=!1,t.unsubscribe()}}),[]);const U=Object(r.useMemo)((()=>[g]),[g]),H=Object(r.useCallback)((({query:e,dateRange:t})=>{const a=t.from.includes("now")||t.to.includes("now");F({end:t.to,filterManager:N,id:b,isInvalid:!1,isQuickSelection:a,query:e,setTablesActivePageToZero:L,start:t.from,updateTime:!0})}),[N,b,L,F]);return s.a.createElement("div",{"data-test-subj":`${b}DatePicker`},s.a.createElement(P,{appName:"siem",isLoading:f,indexPatterns:U,query:t,onClearSavedQuery:V,onQuerySubmit:B,onRefresh:q,onSaved:z,onTimeRangeChange:H,onSavedQueryUpdated:$,savedQuery:T,showFilterBar:!c,showDatePicker:!0,showQueryInput:!m,showSaveQuery:!0,dataTestSubj:A}))}),((e,t)=>e.end===t.end&&e.filterQuery===t.filterQuery&&e.fromStr===t.fromStr&&e.id===t.id&&e.isLoading===t.isLoading&&e.savedQuery===t.savedQuery&&e.setSavedQuery===t.setSavedQuery&&e.setSearchBarFilter===t.setSearchBarFilter&&e.start===t.start&&e.toStr===t.toStr&&e.updateSearch===t.updateSearch&&e.dataTestSubj===t.dataTestSubj&&u()(e.indexPattern,t.indexPattern)&&u()(e.queries,t.queries)));w.displayName="SiemSearchBar";const T=e=>({end:t,filters:a,id:n,isQuickSelection:i,query:r,resetSavedQuery:s,savedQuery:o,start:l,timelineId:c,updateTime:u=!1,filterManager:m,setTablesActivePageToZero:b})=>{if(u){const a=Object(p.c)(l);let r=Object(p.c)(t,{roundUp:!0});i?e(t===l?d.b.setAbsoluteRangeDatePicker({id:n,fromStr:l,toStr:t,from:a,to:r}):d.b.setRelativeRangeDatePicker({id:n,fromStr:l,toStr:t,from:a,to:r})):(r=Object(p.c)(t),e(d.b.setAbsoluteRangeDatePicker({id:n,from:Object(p.c)(l),to:Object(p.c)(t)}))),null!=c&&e(y.a.updateRange({id:c,start:a,end:r}))}null!=r&&e(d.b.setFilterQuery({id:n,...r})),null!=a&&m.setFilters(a),(null!=o||s)&&e(d.b.setSavedQuery({id:n,savedQuery:o})),b()},I=Object(o.connect)((()=>{const e=Object(b.b)(),t=Object(b.c)(),a=Object(b.d)(),n=Object(b.h)(),r=Object(b.i)(),s=Object(b.j)(),o=Object(m.createSelector)(g,(e=>e)),l=Object(m.createSelector)(f,(e=>e));return(c,{id:u})=>{const d=Object(i.getOr)({},`inputs.${u}`,c);return{end:e(d),fromStr:t(d),filterQuery:o(d),isLoading:a(d),queries:n(c,u),savedQuery:l(d),start:r(d),toStr:s(d)}}}),(e=>({updateSearch:T(e),setSavedQuery:({id:t,savedQuery:a})=>e(d.b.setSavedQuery({id:t,savedQuery:a})),setSearchBarFilter:({id:t,filters:a})=>e(d.b.setSearchBarFilter({id:t,filters:a}))})))(w)},function(e,t,a){"use strict";a.d(t,"a",(function(){return j}));var n=a(40),i=a(287),r=a(2),s=a.n(r),o=a(41),l=a.n(o),c=a(55),u=a.n(c),d=a(4),p=a(121),m=a(102),b=a(327),g=a(228);const f=l()(n.EuiFlexItem).withConfig({displayName:"CountFlexItem",componentId:"sc-1yje3m6-0"})(["",""],(({theme:e})=>`margin-right: ${e.eui.euiSizeS};`)),y=s.a.memo((({value:e})=>Object(g.a)(e)?s.a.createElement(s.a.Fragment,null,e):s.a.createElement("em",{"data-test-subj":"value-wrapper-empty"},b.c)));y.displayName="ValueWrapper";const h=({legendItem:e})=>{const[t]=Object(m.p)(d.O),{color:a,count:i,dataProviderId:r,field:o,scopeId:l,value:c}=e;return s.a.createElement(n.EuiText,{size:"xs"},s.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"none",responsive:!1},null!=a&&s.a.createElement(n.EuiFlexItem,{grow:!1},s.a.createElement(n.EuiHealth,{"data-test-subj":"legend-color",color:a})),s.a.createElement(n.EuiFlexItem,{grow:!0},s.a.createElement(n.EuiFlexGroup,{alignItems:"center",justifyContent:"spaceBetween",gutterSize:"none",responsive:!1},s.a.createElement(n.EuiFlexItem,{grow:!1},s.a.createElement(p.b,{"data-test-subj":`legend-item-${r}`,field:o,hideTopN:!0,id:r,isDraggable:!1,scopeId:l,value:c},null==e.render?s.a.createElement(y,{value:c}):e.render({field:o,value:c}))),null!=i&&s.a.createElement(f,{"data-test-subj":"legendItemCount",grow:!1},u()(i).format(t))))))};h.displayName="DraggableLegendItemComponent";const v=s.a.memo(h),E=l.a.div.withConfig({displayName:"DraggableLegendContainer",componentId:"sc-94chus-0"})(["height:",";overflow:auto;scrollbar-width:thin;width:100%;@media only screen and (min-width:","){width:165px;}min-width:",";&::-webkit-scrollbar{height:",";width:",";}&::-webkit-scrollbar-thumb{background-clip:content-box;background-color:",";border:"," solid transparent;}&::-webkit-scrollbar-corner,&::-webkit-scrollbar-track{background-color:transparent;}"],(({height:e})=>`${e}px`),(({theme:e})=>e.eui.euiBreakpoints.m),(({$minWidth:e})=>`${e}px`),(({theme:e})=>e.eui.euiScrollBar),(({theme:e})=>e.eui.euiScrollBar),(({theme:e})=>Object(i.rgba)(e.eui.euiColorDarkShade,.5)),(({theme:e})=>e.eui.euiScrollBarCorner)),x=({className:e,height:t=0,legendItems:a,minWidth:i=165})=>0===a.length?null:s.a.createElement(E,{className:e,"data-test-subj":"draggable-legend",height:0===t?175:t,$minWidth:i},s.a.createElement(n.EuiText,{size:"xs"},s.a.createElement(n.EuiFlexGroup,{direction:"column",gutterSize:"none"},a.map((e=>s.a.createElement(n.EuiFlexItem,{key:e.dataProviderId,grow:!1},s.a.createElement(v,{legendItem:e}),s.a.createElement(n.EuiSpacer,{"data-test-subj":"draggable-legend-spacer",size:"s"})))))));x.displayName="DraggableLegendComponent";const j=s.a.memo(x)},function(e,t,a){"use strict";let n;a.d(t,"b",(function(){return n})),a.d(t,"a",(function(){return i})),function(e){e.name="name",e.domain="domain",e.lastSeen="lastSeen"}(n||(n={}));const i={bool:{must_not:[{term:{"event.kind":"asset"}}]}}},function(e,t,a){"use strict";const n=a(301),i={};e.exports=function(e,t,a){if(!1===t||null==t)return e;"string"==typeof(a=a||{})&&(a={separator:a});const r=Array.isArray(t);n(!r||!a.separator,"Separator option no valid for array-based chain");const s=r?t:t.split(a.separator||".");let o=e;for(let e=0;e<s.length;++e){let r=s[e];const l=a.iterables&&i.iterables(o);if(Array.isArray(o)||"set"===l){const e=Number(r);Number.isInteger(e)&&(r=e<0?o.length+e:e)}if(!o||"function"==typeof o&&!1===a.functions||!l&&void 0===o[r]){n(!a.strict||e+1===s.length,"Missing segment",r,"in reach path ",t),n("object"==typeof o||!0===a.functions||"function"!=typeof o,"Invalid segment",r,"in reach path ",t),o=a.default;break}o=l?"set"===l?[...o][r]:o.get(r):o[r]}return o},i.iterables=function(e){return e instanceof Set?"set":e instanceof Map?"map":void 0}},function(e,t,a){"use strict";a.d(t,"b",(function(){return s})),a.d(t,"c",(function(){return o})),a.d(t,"a",(function(){return l})),a.d(t,"d",(function(){return c}));var n=a(374),i=a(42);const r=[n.b.DATE,n.b.IP,n.b.STRING,n.b.NUMBER,n.b.BOOLEAN],s=e=>r.includes(e),o=e=>e.every((e=>Object(i.isString)(e)||Object(i.isNumber)(e)||Object(i.isBoolean)(e)))&&(e=>e.every((t=>typeof t==typeof e[0])))(e),l=e=>e.filter((e=>null!=e)),c=e=>Array.isArray(e)?e:[e]},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=a(5).i18n.translate("cellActions.actions.incompatibility.warningMessage",{defaultMessage:"The action can not be executed because the value and type are incompatible"})},function(e,t,a){"use strict";a.d(t,"c",(function(){return o})),a.d(t,"d",(function(){return l})),a.d(t,"a",(function(){return c})),a.d(t,"b",(function(){return u}));var n=a(43),i=a(112),r=a(771),s=a(351);let o;!function(e){e.message="message",e["status-change"]="status-change",e["execution-metrics"]="execution-metrics"}(o||(o={}));const l=Object(i.u)("RuleExecutionEventType",o),c=Object.values(o),u=(Object(r.a)(o),n.type({timestamp:i.h,sequence:n.number,level:s.c,type:l,message:n.string}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return r})),a.d(t,"b",(function(){return s}));var n=a(43),i=a(112);const r=n.type({execution_uuid:n.string,timestamp:i.h,duration_ms:n.number,status:n.string,message:n.string,num_active_alerts:n.number,num_new_alerts:n.number,num_recovered_alerts:n.number,num_triggered_actions:n.number,num_succeeded_actions:n.number,num_errored_actions:n.number,total_search_duration_ms:n.number,es_search_duration_ms:n.number,schedule_delay_ms:n.number,timed_out:n.boolean,indexing_duration_ms:n.number,search_duration_ms:n.number,gap_duration_s:n.number,security_status:n.string,security_message:n.string}),s=n.keyof({timestamp:i.h,duration_ms:n.number,gap_duration_s:n.number,indexing_duration_ms:n.number,search_duration_ms:n.number,schedule_delay_ms:n.number})},function(e,t,a){"use strict";let n;a.d(t,"a",(function(){return n})),function(e){e.trace="trace",e.debug="debug",e.info="info",e.warn="warn",e.error="error",e.off="off"}(n||(n={}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(43),i=a(112),r=a(262),s=a(352);const o=n.type({last_execution:n.type({date:i.h,status:r.c,status_order:r.b,message:n.string,metrics:s.a})})},function(e,t,a){"use strict";a.d(t,"k",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"n",(function(){return o})),a.d(t,"d",(function(){return l})),a.d(t,"i",(function(){return c})),a.d(t,"l",(function(){return u})),a.d(t,"m",(function(){return d})),a.d(t,"a",(function(){return p})),a.d(t,"g",(function(){return m})),a.d(t,"e",(function(){return b})),a.d(t,"r",(function(){return g})),a.d(t,"f",(function(){return f})),a.d(t,"s",(function(){return y})),a.d(t,"o",(function(){return h})),a.d(t,"h",(function(){return v})),a.d(t,"j",(function(){return E})),a.d(t,"p",(function(){return x})),a.d(t,"q",(function(){return j})),a.d(t,"b",(function(){return k}));var n=a(43),i=a(112);n.string,n.boolean;const r=n.string,s=(n.union([r,n[void 0]]),i.n),o=n.keyof({open:null,closed:null,acknowledged:null,"in-progress":null}),l=n.keyof({abort:null,proceed:null}),c=n.string,u=(n.union([c,n[void 0]]),n.array(n.string)),d=n.object,p=n.array(n.string),m=n.array(n.string),b=(n.union([m,n[void 0]]),i.h),g=i.h,f=n.string,y=n.string,h=i.n,v=n.string,E=(i.n,i.n,i.n),x=n.boolean,j=i.n,S=n.record(n.string,n.type({all:n.boolean,maintenance:n.boolean,manage_ilm:n.boolean,read:n.boolean,create_index:n.boolean,read_cross_cluster:n.boolean,index:n.boolean,monitor:n.boolean,delete:n.boolean,manage:n.boolean,delete_index:n.boolean,create_doc:n.boolean,view_index_metadata:n.boolean,create:n.boolean,manage_follow_index:n.boolean,manage_leader_index:n.boolean,write:n.boolean})),k=(n.type({index:S}),n.type({username:n.string,has_all_requested:n.boolean,cluster:n.type({monitor_ml:n.boolean,manage_ccr:n.boolean,manage_index_templates:n.boolean,monitor_watcher:n.boolean,monitor_transform:n.boolean,read_ilm:n.boolean,manage_security:n.boolean,manage_own_api_key:n.boolean,manage_saml:n.boolean,all:n.boolean,manage_ilm:n.boolean,manage_ingest_pipelines:n.boolean,read_ccr:n.boolean,manage_rollup:n.boolean,monitor:n.boolean,manage_watcher:n.boolean,manage:n.boolean,manage_transform:n.boolean,manage_token:n.boolean,manage_ml:n.boolean,manage_pipeline:n.boolean,monitor_rollup:n.boolean,transport_client:n.boolean,create_snapshot:n.boolean}),index:S,is_authenticated:n.boolean,has_encryption_key:n.boolean}),n.type({tags_to_add:n.array(n.string),tags_to_remove:n.array(n.string)}))},function(e,t,a){"use strict";a.d(t,"c",(function(){return l})),a.d(t,"a",(function(){return p})),a.d(t,"e",(function(){return m})),a.d(t,"b",(function(){return b})),a.d(t,"d",(function(){return g}));var n=a(42),i=a(12),r=a(148);const s=e=>Object(n.omit)("and",e),o=e=>null!=e,l=e=>e.reduce(((e,t)=>[...e,[s(t),...t.and]]),[]),c=e=>Number(e.substring(e.lastIndexOf(".")+1)),u=({index:e,dataProviderGroups:t})=>e>=0&&e<t.length,d=e=>e.reduce(((e,t)=>[...e,{...t[0],and:t.slice(1)}]),[]),p=[[]],m=({dataProviders:e,destination:t,dispatch:a,source:n,timelineId:r})=>{if(!o(t))return;const s=[...l(e),...p];(({destination:e,source:t})=>t.droppableId===e.droppableId)({source:n,destination:t})?(({dataProviderGroups:e,destination:t,dispatch:a,source:n,timelineId:r})=>{const s=c(n.droppableId);if(u({index:s,dataProviderGroups:e})){const o=(({endIndex:e,group:t,startIndex:a})=>{const n=[...t],[i]=n.splice(a,1);return n.splice(e,0,i),n})({group:e[s],startIndex:n.index,endIndex:t.index}),l=e.reduce(((e,t,a)=>[...e,a===s?[...o]:[...t]]),[]);a(Object(i.updateProviders)({id:r,providers:d(l.filter((e=>e.length)))}))}})({dataProviderGroups:s,destination:t,dispatch:a,source:n,timelineId:r}):(({dataProviderGroups:e,destination:t,dispatch:a,source:n,timelineId:r})=>{const s=c(n.droppableId),o=c(t.droppableId);if(u({index:s,dataProviderGroups:e})&&u({index:o,dataProviderGroups:e})){const l=e[s],c=e[o],u=n.index,p=t.index,{updatedDestinationGroup:m,updatedSourcererScope:b}=(({destinationGroup:e,moveProviderFromSourceIndex:t,moveProviderToDestinationIndex:a,sourceGroup:n})=>{const i=[...n],r=[...e],[s]=i.splice(t,1);return r.splice(a,0,s),{updatedDestinationGroup:r.filter(((e,t)=>e.id!==s.id||t===a)),updatedSourcererScope:i}})({destinationGroup:c,moveProviderFromSourceIndex:u,moveProviderToDestinationIndex:p,sourceGroup:l}),g=e.reduce(((e,t,a)=>[...e,a===s?[...b]:a===o?[...m]:[...t]]),[]);a(Object(i.updateProviders)({id:r,providers:d(g.filter((e=>e.length)))}))}})({dataProviderGroups:s,destination:t,dispatch:a,source:n,timelineId:r})},b=({dataProviders:e,destination:t,dispatch:a,onAddedToTimeline:n,providerToAdd:r,timelineId:m})=>{0===e.length?(({dispatch:e,onAddedToTimeline:t,providerToAdd:a,timelineId:n})=>{e(Object(i.updateProviders)({id:n,providers:[a]})),t(a.name)})({dispatch:a,onAddedToTimeline:n,providerToAdd:r,timelineId:m}):(({dataProviders:e,destination:t,dispatch:a,onAddedToTimeline:n,providerToAdd:r,timelineId:m})=>{const b=[...l(e),...p];if(!o(t))return;const g=c(t.droppableId);if(u({index:g,dataProviderGroups:b})){const e=[...b[g]];e.splice(t.index,0,s(r));const o=e.filter(((e,a)=>e.id!==r.id||a===t.index)),l=b.reduce(((e,t,a)=>[...e,a===g?[...o]:[...t]]),[]);a(Object(i.updateProviders)({id:m,providers:d(l.filter((e=>e.length)))})),n(r.name)}})({dataProviders:e,destination:t,dispatch:a,onAddedToTimeline:n,providerToAdd:r,timelineId:m})},g=e=>Object(r.k)(e)?e.length?`( ${e.join(" OR ")} )`:"":e},function(e,t,a){var n=a(613),i=a(977),r=a(978),s=a(617),o=a(996),l=a(621),c=a(997),u=a(623),d=a(624),p=a(627),m=Math.max;e.exports=function(e,t,a,b,g,f,y,h){var v=2&t;if(!v&&"function"!=typeof e)throw new TypeError("Expected a function");var E=b?b.length:0;if(E||(t&=-97,b=g=void 0),y=void 0===y?y:m(p(y),0),h=void 0===h?h:p(h),E-=g?g.length:0,64&t){var x=b,j=g;b=g=void 0}var S=v?void 0:l(e),k=[e,t,a,b,g,x,j,f,y,h];if(S&&c(k,S),e=k[0],t=k[1],a=k[2],b=k[3],g=k[4],!(h=k[9]=void 0===k[9]?v?0:e.length:m(k[9]-E,0))&&24&t&&(t&=-25),t&&1!=t)O=8==t||16==t?r(e,t,h):32!=t&&33!=t||g.length?s.apply(void 0,k):o(e,t,a,b);else var O=i(e,t,a);return d((S?n:u)(O,k),e,t)}},function(e,t,a){e.exports=a(33)(3657)},function(e,t,a){e.exports=a(33)(360)},function(e,t,a){var n=a(436),i=a(439),r=4294967295;function s(e){this.__wrapped__=e,this.__actions__=[],this.__dir__=1,this.__filtered__=!1,this.__iteratees__=[],this.__takeCount__=r,this.__views__=[]}s.prototype=n(i.prototype),s.prototype.constructor=s,e.exports=s},function(e,t){e.exports=function(){}},function(e,t,a){e.exports=a(33)(282)},function(e,t,a){e.exports=a(33)(3647)},function(e,t,a){e.exports=a(33)(1609)},function(e,t){var a="__lodash_placeholder__";e.exports=function(e,t){for(var n=-1,i=e.length,r=0,s=[];++n<i;){var o=e[n];o!==t&&o!==a||(e[n]=a,s[r++]=n)}return s}},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=e=>{if(null==e||!e.isPreconfigured)return null==e?void 0:e.config}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.useFirstMountState=void 0;var n=a(2);t.useFirstMountState=function(){var e=n.useRef(!0);return e.current?(e.current=!1,!0):e.current}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.resolveHookState=void 0,t.resolveHookState=function(e,t){return"function"==typeof e?e(t):e}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(146).isClient?window:null,r=function(e){return!!e.addEventListener},s=function(e){return!!e.on};t.default=function(e,t,a,o){void 0===a&&(a=i),n.useEffect((function(){if(t&&a)return r(a)?a.addEventListener(e,t,o):s(a)&&a.on(e,t,o),function(){r(a)?a.removeEventListener(e,t,o):s(a)&&a.off(e,t,o)}}),[e,t,a,JSON.stringify(o)])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(361));t.default=function(e){var t=i.useRef(e);t.current=e,r.default((function(){return function(){return t.current()}}))}},function(e,t,a){"use strict";a.d(t,"c",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return s}));var n=a(42);const i=e=>e.replace(/:/g,"-"),r=e=>e.replace(/-/g,":"),s=e=>Object(n.isUndefined)(e)?void 0:Object(n.castArray)(e)},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n,i=(n=a(2))&&"object"==typeof n&&"default"in n?n:{default:n},r=e=>"checkbox"===e.type,s=e=>e instanceof Date,o=e=>null==e;const l=e=>"object"==typeof e;var c=e=>!o(e)&&!Array.isArray(e)&&l(e)&&!s(e),u=e=>c(e)&&e.target?r(e.target)?e.target.checked:e.target.value:e,d=(e,t)=>e.has((e=>e.substring(0,e.search(/\.\d+(\.|$)/))||e)(t)),p="undefined"!=typeof window&&void 0!==window.HTMLElement&&"undefined"!=typeof document;function m(e){let t;const a=Array.isArray(e);if(e instanceof Date)t=new Date(e);else if(e instanceof Set)t=new Set(e);else{if(p&&(e instanceof Blob||e instanceof FileList)||!a&&!c(e))return e;if(t=a?[]:{},a||(e=>{const t=e.constructor&&e.constructor.prototype;return c(t)&&t.hasOwnProperty("isPrototypeOf")})(e))for(const a in e)e.hasOwnProperty(a)&&(t[a]=m(e[a]));else t=e}return t}var b=e=>Array.isArray(e)?e.filter(Boolean):[],g=e=>void 0===e,f=(e,t,a)=>{if(!t||!c(e))return a;const n=b(t.split(/[,[\].]+?/)).reduce(((e,t)=>o(e)?e:e[t]),e);return g(n)||n===e?g(e[t])?a:e[t]:n};const y="blur",h="focusout",v="change",E="onChange",x="onSubmit",j="all",S="pattern",k="required",O=i.default.createContext(null),w=()=>i.default.useContext(O);var T=(e,t,a,n=!0)=>{const i={defaultValues:t._defaultValues};for(const r in e)Object.defineProperty(i,r,{get:()=>{const i=r;return t._proxyFormState[i]!==j&&(t._proxyFormState[i]=!n||j),a&&(a[i]=!0),e[i]}});return i},I=e=>c(e)&&!Object.keys(e).length,C=(e,t,a,n)=>{a(e);const{name:i,...r}=e;return I(r)||Object.keys(r).length>=Object.keys(t).length||Object.keys(r).find((e=>t[e]===(!n||j)))},M=e=>Array.isArray(e)?e:[e],_=(e,t,a)=>a&&t?e===t:!e||!t||e===t||M(e).some((e=>e&&(e.startsWith(t)||t.startsWith(e))));function F(e){const t=i.default.useRef(e);t.current=e,i.default.useEffect((()=>{const a=!e.disabled&&t.current.subject&&t.current.subject.subscribe({next:t.current.next});return()=>{a&&a.unsubscribe()}}),[e.disabled])}function A(e){const t=w(),{control:a=t.control,disabled:n,name:r,exact:s}=e||{},[o,l]=i.default.useState(a._formState),c=i.default.useRef(!0),u=i.default.useRef({isDirty:!1,isLoading:!1,dirtyFields:!1,touchedFields:!1,isValidating:!1,isValid:!1,errors:!1}),d=i.default.useRef(r);return d.current=r,F({disabled:n,next:e=>c.current&&_(d.current,e.name,s)&&C(e,u.current,a._updateFormState)&&l({...a._formState,...e}),subject:a._subjects.state}),i.default.useEffect((()=>(c.current=!0,u.current.isValid&&a._updateValid(!0),()=>{c.current=!1})),[a]),T(o,a,u.current,!1)}var D=e=>"string"==typeof e,N=(e,t,a,n,i)=>D(e)?(n&&t.watch.add(e),f(a,e,i)):Array.isArray(e)?e.map((e=>(n&&t.watch.add(e),f(a,e)))):(n&&(t.watchAll=!0),a);function P(e){const t=w(),{control:a=t.control,name:n,defaultValue:r,disabled:s,exact:o}=e||{},l=i.default.useRef(n);l.current=n,F({disabled:s,subject:a._subjects.values,next:e=>{_(l.current,e.name,o)&&u(m(N(l.current,a._names,e.values||a._formValues,!1,r)))}});const[c,u]=i.default.useState(a._getWatch(n,r));return i.default.useEffect((()=>a._removeUnmounted())),c}var R=e=>/^\w*$/.test(e),L=e=>b(e.replace(/["|']|\]/g,"").split(/\.|\[/));function B(e,t,a){let n=-1;const i=R(t)?[t]:L(t),r=i.length,s=r-1;for(;++n<r;){const t=i[n];let r=a;if(n!==s){const a=e[t];r=c(a)||Array.isArray(a)?a:isNaN(+i[n+1])?{}:[]}e[t]=r,e=e[t]}return e}function q(e){const t=w(),{name:a,control:n=t.control,shouldUnregister:r}=e,s=d(n._names.array,a),o=P({control:n,name:a,defaultValue:f(n._formValues,a,f(n._defaultValues,a,e.defaultValue)),exact:!0}),l=A({control:n,name:a}),c=i.default.useRef(n.register(a,{...e.rules,value:o}));return c.current=n.register(a,e.rules),i.default.useEffect((()=>{const e=n._options.shouldUnregister||r,t=(e,t)=>{const a=f(n._fields,e);a&&(a._f.mount=t)};if(t(a,!0),e){const e=m(f(n._options.defaultValues,a));B(n._defaultValues,a,e),g(f(n._formValues,a))&&B(n._formValues,a,e)}return()=>{(s?e&&!n._state.action:e)?n.unregister(a):t(a,!1)}}),[a,n,s,r]),{field:{name:a,value:o,onChange:i.default.useCallback((e=>c.current.onChange({target:{value:u(e),name:a},type:v})),[a]),onBlur:i.default.useCallback((()=>c.current.onBlur({target:{value:f(n._formValues,a),name:a},type:y})),[a,n]),ref:e=>{const t=f(n._fields,a);t&&e&&(t._f.ref={focus:()=>e.focus(),select:()=>e.select(),setCustomValidity:t=>e.setCustomValidity(t),reportValidity:()=>e.reportValidity()})}},formState:l,fieldState:Object.defineProperties({},{invalid:{enumerable:!0,get:()=>!!f(l.errors,a)},isDirty:{enumerable:!0,get:()=>!!f(l.dirtyFields,a)},isTouched:{enumerable:!0,get:()=>!!f(l.touchedFields,a)},error:{enumerable:!0,get:()=>f(l.errors,a)}})}}const z="post";var $=(e,t,a,n,i)=>t?{...a[e],types:{...a[e]&&a[e].types?a[e].types:{},[n]:i||!0}}:{};const V=(e,t,a)=>{for(const n of a||Object.keys(e)){const a=f(e,n);if(a){const{_f:e,...n}=a;if(e&&t(e.name)){if(e.ref.focus){e.ref.focus();break}if(e.refs&&e.refs[0].focus){e.refs[0].focus();break}}else c(n)&&V(n,t)}}};var U=()=>{const e="undefined"==typeof performance?Date.now():1e3*performance.now();return"xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g,(t=>{const a=(16*Math.random()+e)%16|0;return("x"==t?a:3&a|8).toString(16)}))},H=(e,t,a={})=>a.shouldFocus||g(a.shouldFocus)?a.focusName||`${e}.${g(a.focusIndex)?t:a.focusIndex}.`:"",G=e=>({isOnSubmit:!e||e===x,isOnBlur:"onBlur"===e,isOnChange:e===E,isOnAll:e===j,isOnTouch:"onTouched"===e}),Q=(e,t,a)=>!a&&(t.watchAll||t.watch.has(e)||[...t.watch].some((t=>e.startsWith(t)&&/^\.\w+/.test(e.slice(t.length))))),W=(e,t,a)=>{const n=b(f(e,a));return B(n,"root",t[a]),B(e,a,n),e},K=e=>"boolean"==typeof e,Y=e=>"file"===e.type,J=e=>"function"==typeof e,X=e=>{if(!p)return!1;const t=e?e.ownerDocument:0;return e instanceof(t&&t.defaultView?t.defaultView.HTMLElement:HTMLElement)},Z=e=>D(e),ee=e=>"radio"===e.type,te=e=>e instanceof RegExp;const ae={value:!1,isValid:!1},ne={value:!0,isValid:!0};var ie=e=>{if(Array.isArray(e)){if(e.length>1){const t=e.filter((e=>e&&e.checked&&!e.disabled)).map((e=>e.value));return{value:t,isValid:!!t.length}}return e[0].checked&&!e[0].disabled?e[0].attributes&&!g(e[0].attributes.value)?g(e[0].value)||""===e[0].value?ne:{value:e[0].value,isValid:!0}:ne:ae}return ae};const re={isValid:!1,value:null};var se=e=>Array.isArray(e)?e.reduce(((e,t)=>t&&t.checked&&!t.disabled?{isValid:!0,value:t.value}:e),re):re;function oe(e,t,a="validate"){if(Z(e)||Array.isArray(e)&&e.every(Z)||K(e)&&!e)return{type:a,message:Z(e)?e:"",ref:t}}var le=e=>c(e)&&!te(e)?e:{value:e,message:""},ce=async(e,t,a,n,i)=>{const{ref:s,refs:l,required:u,maxLength:d,minLength:p,min:m,max:b,pattern:y,validate:h,name:v,valueAsNumber:E,mount:x,disabled:j}=e._f,O=f(t,v);if(!x||j)return{};const w=l?l[0]:s,T=e=>{n&&w.reportValidity&&(w.setCustomValidity(K(e)?"":e||""),w.reportValidity())},C={},M=ee(s),_=r(s),F=M||_,A=(E||Y(s))&&g(s.value)&&g(O)||X(s)&&""===s.value||""===O||Array.isArray(O)&&!O.length,N=$.bind(null,v,a,C),P=(e,t,a,n="maxLength",i="minLength")=>{const r=e?t:a;C[v]={type:e?n:i,message:r,ref:s,...N(e?n:i,r)}};if(i?!Array.isArray(O)||!O.length:u&&(!F&&(A||o(O))||K(O)&&!O||_&&!ie(l).isValid||M&&!se(l).isValid)){const{value:e,message:t}=Z(u)?{value:!!u,message:u}:le(u);if(e&&(C[v]={type:k,message:t,ref:w,...N(k,t)},!a))return T(t),C}if(!(A||o(m)&&o(b))){let e,t;const n=le(b),i=le(m);if(o(O)||isNaN(O)){const a=s.valueAsDate||new Date(O),r=e=>new Date((new Date).toDateString()+" "+e),o="time"==s.type,l="week"==s.type;D(n.value)&&O&&(e=o?r(O)>r(n.value):l?O>n.value:a>new Date(n.value)),D(i.value)&&O&&(t=o?r(O)<r(i.value):l?O<i.value:a<new Date(i.value))}else{const a=s.valueAsNumber||(O?+O:O);o(n.value)||(e=a>n.value),o(i.value)||(t=a<i.value)}if((e||t)&&(P(!!e,n.message,i.message,"max","min"),!a))return T(C[v].message),C}if((d||p)&&!A&&(D(O)||i&&Array.isArray(O))){const e=le(d),t=le(p),n=!o(e.value)&&O.length>+e.value,i=!o(t.value)&&O.length<+t.value;if((n||i)&&(P(n,e.message,t.message),!a))return T(C[v].message),C}if(y&&!A&&D(O)){const{value:e,message:t}=le(y);if(te(e)&&!O.match(e)&&(C[v]={type:S,message:t,ref:s,...N(S,t)},!a))return T(t),C}if(h)if(J(h)){const e=oe(await h(O,t),w);if(e&&(C[v]={...e,...N("validate",e.message)},!a))return T(e.message),C}else if(c(h)){let e={};for(const n in h){if(!I(e)&&!a)break;const i=oe(await h[n](O,t),w,n);i&&(e={...i,...N(n,i.message)},T(i.message),a&&(C[v]=e))}if(!I(e)&&(C[v]={ref:w,...e},!a))return C}return T(!0),C};function ue(e,t){return[...e,...M(t)]}var de=e=>Array.isArray(e)?e.map((()=>{})):void 0;function pe(e,t,a){return[...e.slice(0,t),...M(a),...e.slice(t)]}var me=(e,t,a)=>Array.isArray(e)?(g(e[a])&&(e[a]=void 0),e.splice(a,0,e.splice(t,1)[0]),e):[];function be(e,t){return[...M(t),...M(e)]}var ge=(e,t)=>g(t)?[]:function(e,t){let a=0;const n=[...e];for(const e of t)n.splice(e-a,1),a++;return b(n).length?n:[]}(e,M(t).sort(((e,t)=>e-t))),fe=(e,t,a)=>{e[t]=[e[a],e[a]=e[t]][0]};function ye(e,t){const a=Array.isArray(t)?t:R(t)?[t]:L(t),n=1===a.length?e:function(e,t){const a=t.slice(0,-1).length;let n=0;for(;n<a;)e=g(e)?n++:e[t[n++]];return e}(e,a),i=a.length-1,r=a[i];return n&&delete n[r],0!==i&&(c(n)&&I(n)||Array.isArray(n)&&function(e){for(const t in e)if(e.hasOwnProperty(t)&&!g(e[t]))return!1;return!0}(n))&&ye(e,a.slice(0,-1)),e}var he=(e,t,a)=>(e[t]=a,e);function ve(){let e=[];return{get observers(){return e},next:t=>{for(const a of e)a.next&&a.next(t)},subscribe:t=>(e.push(t),{unsubscribe:()=>{e=e.filter((e=>e!==t))}}),unsubscribe:()=>{e=[]}}}var Ee=e=>o(e)||!l(e);function xe(e,t){if(Ee(e)||Ee(t))return e===t;if(s(e)&&s(t))return e.getTime()===t.getTime();const a=Object.keys(e),n=Object.keys(t);if(a.length!==n.length)return!1;for(const i of a){const a=e[i];if(!n.includes(i))return!1;if("ref"!==i){const e=t[i];if(s(a)&&s(e)||c(a)&&c(e)||Array.isArray(a)&&Array.isArray(e)?!xe(a,e):a!==e)return!1}}return!0}var je=e=>"select-multiple"===e.type,Se=e=>X(e)&&e.isConnected,ke=e=>{for(const t in e)if(J(e[t]))return!0;return!1};function Oe(e,t={}){const a=Array.isArray(e);if(c(e)||a)for(const a in e)Array.isArray(e[a])||c(e[a])&&!ke(e[a])?(t[a]=Array.isArray(e[a])?[]:{},Oe(e[a],t[a])):o(e[a])||(t[a]=!0);return t}function we(e,t,a){const n=Array.isArray(e);if(c(e)||n)for(const n in e)Array.isArray(e[n])||c(e[n])&&!ke(e[n])?g(t)||Ee(a[n])?a[n]=Array.isArray(e[n])?Oe(e[n],[]):{...Oe(e[n])}:we(e[n],o(t)?{}:t[n],a[n]):a[n]=!xe(e[n],t[n]);return a}var Te=(e,t)=>we(e,t,Oe(t)),Ie=(e,{valueAsNumber:t,valueAsDate:a,setValueAs:n})=>g(e)?e:t?""===e?NaN:e?+e:e:a&&D(e)?new Date(e):n?n(e):e;function Ce(e){const t=e.ref;if(!(e.refs?e.refs.every((e=>e.disabled)):t.disabled))return Y(t)?t.files:ee(t)?se(e.refs).value:je(t)?[...t.selectedOptions].map((({value:e})=>e)):r(t)?ie(e.refs).value:Ie(g(t.value)?e.ref.value:t.value,e)}var Me=e=>g(e)?e:te(e)?e.source:c(e)?te(e.value)?e.value.source:e.value:e;function _e(e,t,a){const n=f(e,a);if(n||R(a))return{error:n,name:a};const i=a.split(".");for(;i.length;){const n=i.join("."),r=f(t,n),s=f(e,n);if(r&&!Array.isArray(r)&&a!==n)return{name:a};if(s&&s.type)return{name:n,error:s};i.pop()}return{name:a}}const Fe={mode:x,reValidateMode:E,shouldFocusError:!0};function Ae(e={},t){let a,n={...Fe,...e},i={submitCount:0,isDirty:!1,isLoading:J(n.defaultValues),isValidating:!1,isSubmitted:!1,isSubmitting:!1,isSubmitSuccessful:!1,isValid:!1,touchedFields:{},dirtyFields:{},errors:{}},l={},v=(c(n.defaultValues)||c(n.values))&&m(n.defaultValues||n.values)||{},E=n.shouldUnregister?{}:m(v),x={action:!1,mount:!1,watch:!1},S={mount:new Set,unMount:new Set,array:new Set,watch:new Set},k=0;const O={isDirty:!1,dirtyFields:!1,touchedFields:!1,isValidating:!1,isValid:!1,errors:!1},w={values:ve(),array:ve(),state:ve()},T=e.resetOptions&&e.resetOptions.keepDirtyValues,C=G(n.mode),_=G(n.reValidateMode),F=n.criteriaMode===j,A=async e=>{if(O.isValid||e){const e=n.resolver?I((await z()).errors):await $(l,!0);e!==i.isValid&&w.state.next({isValid:e})}},P=e=>O.isValidating&&w.state.next({isValidating:e}),R=(e,t,a,n)=>{const i=f(l,e);if(i){const r=f(E,e,g(a)?f(v,e):a);g(r)||n&&n.defaultChecked||t?B(E,e,t?r:Ce(i._f)):Z(e,r),x.mount&&A()}},L=(e,t,a,n,r)=>{let s=!1,o=!1;const l={name:e};if(!a||n){O.isDirty&&(o=i.isDirty,i.isDirty=l.isDirty=U(),s=o!==l.isDirty);const a=xe(f(v,e),t);o=f(i.dirtyFields,e),a?ye(i.dirtyFields,e):B(i.dirtyFields,e,!0),l.dirtyFields=i.dirtyFields,s=s||O.dirtyFields&&o!==!a}if(a){const t=f(i.touchedFields,e);t||(B(i.touchedFields,e,a),l.touchedFields=i.touchedFields,s=s||O.touchedFields&&t!==a)}return s&&r&&w.state.next(l),s?l:{}},q=(t,n,r,s)=>{const o=f(i.errors,t),l=O.isValid&&K(n)&&i.isValid!==n;var c;if(e.delayError&&r?(c=()=>((e,t)=>{B(i.errors,e,t),w.state.next({errors:i.errors})})(t,r),a=e=>{clearTimeout(k),k=setTimeout(c,e)},a(e.delayError)):(clearTimeout(k),a=null,r?B(i.errors,t,r):ye(i.errors,t)),(r?!xe(o,r):o)||!I(s)||l){const e={...s,...l&&K(n)?{isValid:n}:{},errors:i.errors,name:t};i={...i,...e},w.state.next(e)}P(!1)},z=async e=>n.resolver(E,n.context,((e,t,a,n)=>{const i={};for(const a of e){const e=f(t,a);e&&B(i,a,e._f)}return{criteriaMode:a,names:[...e],fields:i,shouldUseNativeValidation:n}})(e||S.mount,l,n.criteriaMode,n.shouldUseNativeValidation)),$=async(e,t,a={valid:!0})=>{for(const r in e){const s=e[r];if(s){const{_f:e,...r}=s;if(e){const r=S.array.has(e.name),o=await ce(s,E,F,n.shouldUseNativeValidation&&!t,r);if(o[e.name]&&(a.valid=!1,t))break;!t&&(f(o,e.name)?r?W(i.errors,o,e.name):B(i.errors,e.name,o[e.name]):ye(i.errors,e.name))}r&&await $(r,t,a)}}return a.valid},U=(e,t)=>(e&&t&&B(E,e,t),!xe(re(),v)),H=(e,t,a)=>N(e,S,{...x.mount?E:g(t)?v:D(e)?{[e]:t}:t},a,t),Z=(e,t,a={})=>{const n=f(l,e);let i=t;if(n){const a=n._f;a&&(!a.disabled&&B(E,e,Ie(t,a)),i=X(a.ref)&&o(t)?"":t,je(a.ref)?[...a.ref.options].forEach((e=>e.selected=i.includes(e.value))):a.refs?r(a.ref)?a.refs.length>1?a.refs.forEach((e=>(!e.defaultChecked||!e.disabled)&&(e.checked=Array.isArray(i)?!!i.find((t=>t===e.value)):i===e.value))):a.refs[0]&&(a.refs[0].checked=!!i):a.refs.forEach((e=>e.checked=e.value===i)):Y(a.ref)?a.ref.value="":(a.ref.value=i,a.ref.type||w.values.next({name:e,values:{...E}})))}(a.shouldDirty||a.shouldTouch)&&L(e,i,a.shouldTouch,a.shouldDirty,!0),a.shouldValidate&&ie(e)},te=(e,t,a)=>{for(const n in t){const i=t[n],r=`${e}.${n}`,o=f(l,r);!S.array.has(e)&&Ee(i)&&(!o||o._f)||s(i)?Z(r,i,a):te(r,i,a)}},ae=(e,a,n={})=>{const r=f(l,e),s=S.array.has(e),c=m(a);B(E,e,c),s?(w.array.next({name:e,values:{...E}}),(O.isDirty||O.dirtyFields)&&n.shouldDirty&&w.state.next({name:e,dirtyFields:Te(v,E),isDirty:U(e,c)})):!r||r._f||o(c)?Z(e,c,n):te(e,c,n),Q(e,S)&&w.state.next({...i}),w.values.next({name:e,values:{...E}}),!x.mount&&t()},ne=async e=>{const t=e.target;let r=t.name,s=!0;const o=f(l,r);if(o){let d,p;const m=t.type?Ce(o._f):u(e),b=e.type===y||e.type===h,g=!((c=o._f).mount&&(c.required||c.min||c.max||c.maxLength||c.minLength||c.pattern||c.validate)||n.resolver||f(i.errors,r)||o._f.deps)||((e,t,a,n,i)=>!i.isOnAll&&(!a&&i.isOnTouch?!(t||e):(a?n.isOnBlur:i.isOnBlur)?!e:!(a?n.isOnChange:i.isOnChange)||e))(b,f(i.touchedFields,r),i.isSubmitted,_,C),v=Q(r,S,b);B(E,r,m),b?(o._f.onBlur&&o._f.onBlur(e),a&&a(0)):o._f.onChange&&o._f.onChange(e);const x=L(r,m,b,!1),j=!I(x)||v;if(!b&&w.values.next({name:r,type:e.type,values:{...E}}),g)return O.isValid&&A(),j&&w.state.next({name:r,...v?{}:x});if(!b&&v&&w.state.next({...i}),P(!0),n.resolver){const{errors:e}=await z([r]),t=_e(i.errors,l,r),a=_e(e,l,t.name||r);d=a.error,r=a.name,p=I(e)}else d=(await ce(o,E,F,n.shouldUseNativeValidation))[r],s=isNaN(m)||m===f(E,r,m),s&&(d?p=!1:O.isValid&&(p=await $(l,!0)));s&&(o._f.deps&&ie(o._f.deps),q(r,p,d,x))}var c},ie=async(e,t={})=>{let a,r;const s=M(e);if(P(!0),n.resolver){const t=await(async e=>{const{errors:t}=await z();if(e)for(const a of e){const e=f(t,a);e?B(i.errors,a,e):ye(i.errors,a)}else i.errors=t;return t})(g(e)?e:s);a=I(t),r=e?!s.some((e=>f(t,e))):a}else e?(r=(await Promise.all(s.map((async e=>{const t=f(l,e);return await $(t&&t._f?{[e]:t}:t)})))).every(Boolean),(r||i.isValid)&&A()):r=a=await $(l);return w.state.next({...!D(e)||O.isValid&&a!==i.isValid?{}:{name:e},...n.resolver||!e?{isValid:a}:{},errors:i.errors,isValidating:!1}),t.shouldFocus&&!r&&V(l,(e=>e&&f(i.errors,e)),e?s:S.mount),r},re=e=>{const t={...v,...x.mount?E:{}};return g(e)?t:D(e)?f(t,e):e.map((e=>f(t,e)))},se=(e,t)=>({invalid:!!f((t||i).errors,e),isDirty:!!f((t||i).dirtyFields,e),isTouched:!!f((t||i).touchedFields,e),error:f((t||i).errors,e)}),oe=(e,t,a)=>{const n=(f(l,e,{_f:{}})._f||{}).ref;B(i.errors,e,{...t,ref:n}),w.state.next({name:e,errors:i.errors,isValid:!1}),a&&a.shouldFocus&&n&&n.focus&&n.focus()},le=(e,t={})=>{for(const a of e?M(e):S.mount)S.mount.delete(a),S.array.delete(a),t.keepValue||(ye(l,a),ye(E,a)),!t.keepError&&ye(i.errors,a),!t.keepDirty&&ye(i.dirtyFields,a),!t.keepTouched&&ye(i.touchedFields,a),!n.shouldUnregister&&!t.keepDefaultValue&&ye(v,a);w.values.next({values:{...E}}),w.state.next({...i,...t.keepDirty?{isDirty:U()}:{}}),!t.keepIsValid&&A()},ue=(e,t={})=>{let a=f(l,e);const i=K(t.disabled);return B(l,e,{...a||{},_f:{...a&&a._f?a._f:{ref:{name:e}},name:e,mount:!0,...t}}),S.mount.add(e),a?i&&B(E,e,t.disabled?void 0:f(E,e,Ce(a._f))):R(e,!0,t.value),{...i?{disabled:t.disabled}:{},...n.progressive?{required:!!t.required,min:Me(t.min),max:Me(t.max),minLength:Me(t.minLength),maxLength:Me(t.maxLength),pattern:Me(t.pattern)}:{},name:e,onChange:ne,onBlur:ne,ref:i=>{if(i){ue(e,t),a=f(l,e);const n=g(i.value)&&i.querySelectorAll&&i.querySelectorAll("input,select,textarea")[0]||i,s=(e=>ee(e)||r(e))(n),o=a._f.refs||[];if(s?o.find((e=>e===n)):n===a._f.ref)return;B(l,e,{_f:{...a._f,...s?{refs:[...o.filter(Se),n,...Array.isArray(f(v,e))?[{}]:[]],ref:{type:n.type,name:e}}:{ref:n}}}),R(e,!1,void 0,n)}else a=f(l,e,{}),a._f&&(a._f.mount=!1),(n.shouldUnregister||t.shouldUnregister)&&(!d(S.array,e)||!x.action)&&S.unMount.add(e)}}},de=()=>n.shouldFocusError&&V(l,(e=>e&&f(i.errors,e)),S.mount),pe=(e,t)=>async a=>{a&&(a.preventDefault&&a.preventDefault(),a.persist&&a.persist());let r=m(E);if(w.state.next({isSubmitting:!0}),n.resolver){const{errors:e,values:t}=await z();i.errors=e,r=t}else await $(l);ye(i.errors,"root"),I(i.errors)?(w.state.next({errors:{}}),await e(r,a)):(t&&await t({...i.errors},a),de(),setTimeout(de)),w.state.next({isSubmitted:!0,isSubmitting:!1,isSubmitSuccessful:I(i.errors),submitCount:i.submitCount+1,errors:i.errors})},me=(a,n={})=>{const r=a||v,s=m(r),o=a&&!I(a)?s:v;if(n.keepDefaultValues||(v=r),!n.keepValues){if(n.keepDirtyValues||T)for(const e of S.mount)f(i.dirtyFields,e)?B(o,e,f(E,e)):ae(e,f(o,e));else{if(p&&g(a))for(const e of S.mount){const t=f(l,e);if(t&&t._f){const e=Array.isArray(t._f.refs)?t._f.refs[0]:t._f.ref;if(X(e)){const t=e.closest("form");if(t){t.reset();break}}}}l={}}E=e.shouldUnregister?n.keepDefaultValues?m(v):{}:m(o),w.array.next({values:{...o}}),w.values.next({values:{...o}})}S={mount:new Set,unMount:new Set,array:new Set,watch:new Set,watchAll:!1,focus:""},!x.mount&&t(),x.mount=!O.isValid||!!n.keepIsValid,x.watch=!!e.shouldUnregister,w.state.next({submitCount:n.keepSubmitCount?i.submitCount:0,isDirty:n.keepDirty?i.isDirty:!(!n.keepDefaultValues||xe(a,v)),isSubmitted:!!n.keepIsSubmitted&&i.isSubmitted,dirtyFields:n.keepDirtyValues?i.dirtyFields:n.keepDefaultValues&&a?Te(v,a):{},touchedFields:n.keepTouched?i.touchedFields:{},errors:n.keepErrors?i.errors:{},isSubmitting:!1,isSubmitSuccessful:!1})},be=(e,t)=>me(J(e)?e(E):e,t);return{control:{register:ue,unregister:le,getFieldState:se,handleSubmit:pe,setError:oe,_executeSchema:z,_getWatch:H,_getDirty:U,_updateValid:A,_removeUnmounted:()=>{for(const e of S.unMount){const t=f(l,e);t&&(t._f.refs?t._f.refs.every((e=>!Se(e))):!Se(t._f.ref))&&le(e)}S.unMount=new Set},_updateFieldArray:(e,t=[],a,n,r=!0,s=!0)=>{if(n&&a){if(x.action=!0,s&&Array.isArray(f(l,e))){const t=a(f(l,e),n.argA,n.argB);r&&B(l,e,t)}if(s&&Array.isArray(f(i.errors,e))){const t=a(f(i.errors,e),n.argA,n.argB);r&&B(i.errors,e,t),((e,t)=>{!b(f(e,t)).length&&ye(e,t)})(i.errors,e)}if(O.touchedFields&&s&&Array.isArray(f(i.touchedFields,e))){const t=a(f(i.touchedFields,e),n.argA,n.argB);r&&B(i.touchedFields,e,t)}O.dirtyFields&&(i.dirtyFields=Te(v,E)),w.state.next({name:e,isDirty:U(e,t),dirtyFields:i.dirtyFields,errors:i.errors,isValid:i.isValid})}else B(E,e,t)},_getFieldArray:t=>b(f(x.mount?E:v,t,e.shouldUnregister?f(v,t,[]):[])),_reset:me,_resetDefaultValues:()=>J(n.defaultValues)&&n.defaultValues().then((e=>{be(e,n.resetOptions),w.state.next({isLoading:!1})})),_updateFormState:e=>{i={...i,...e}},_subjects:w,_proxyFormState:O,get _fields(){return l},get _formValues(){return E},get _state(){return x},set _state(e){x=e},get _defaultValues(){return v},get _names(){return S},set _names(e){S=e},get _formState(){return i},set _formState(e){i=e},get _options(){return n},set _options(e){n={...n,...e}}},trigger:ie,register:ue,handleSubmit:pe,watch:(e,t)=>J(e)?w.values.subscribe({next:a=>e(H(void 0,t),a)}):H(e,t,!0),setValue:ae,getValues:re,reset:be,resetField:(e,t={})=>{f(l,e)&&(g(t.defaultValue)?ae(e,f(v,e)):(ae(e,t.defaultValue),B(v,e,t.defaultValue)),t.keepTouched||ye(i.touchedFields,e),t.keepDirty||(ye(i.dirtyFields,e),i.isDirty=t.defaultValue?U(e,f(v,e)):U()),t.keepError||(ye(i.errors,e),O.isValid&&A()),w.state.next({...i}))},clearErrors:e=>{e&&M(e).forEach((e=>ye(i.errors,e))),w.state.next({errors:e?i.errors:{}})},unregister:le,setError:oe,setFocus:(e,t={})=>{const a=f(l,e),n=a&&a._f;if(n){const e=n.refs?n.refs[0]:n.ref;e.focus&&(e.focus(),t.shouldSelect&&e.select())}},getFieldState:se}}t.Controller=e=>e.render(q(e)),t.Form=function(e){const t=w(),[a,n]=i.default.useState(!1),{control:r=t.control,onSubmit:s,children:o,action:l,method:c=z,headers:u,encType:d,onError:p,render:m,onSuccess:b,validateStatus:g,...y}=e,h=async t=>{let a=!1,n="";await r.handleSubmit((async e=>{const i=new FormData;let o="";try{o=JSON.stringify(e)}catch(e){}for(const t of r._names.mount)i.append(t,f(e,t));if(s&&s({data:e,event:t,method:c,formData:i,formDataJson:o}),l)try{const e=[u&&u["Content-Type"],d].some((e=>e&&e.includes("json"))),t=await fetch(l,{method:c,headers:{...u,...d?{"Content-Type":d}:{}},body:e?o:i});t&&(g?!g(t.status):t.status<200||t.status>=300)?(a=!0,p&&p({response:t}),n=String(t.status)):b&&b({response:t})}catch(e){a=!0,p&&p({error:e})}}))(t),a&&e.control&&(e.control._subjects.state.next({isSubmitSuccessful:!1}),e.control.setError("root.server",{type:n}))};return i.default.useEffect((()=>{n(!0)}),[]),m?i.default.createElement(i.default.Fragment,null,m({submit:h})):i.default.createElement("form",{noValidate:a,action:l,method:c,encType:d,onSubmit:h,...y},o)},t.FormProvider=e=>{const{children:t,...a}=e;return i.default.createElement(O.Provider,{value:a},t)},t.appendErrors=$,t.get=f,t.set=B,t.useController=q,t.useFieldArray=function(e){const t=w(),{control:a=t.control,name:n,keyName:r="id",shouldUnregister:s}=e,[o,l]=i.default.useState(a._getFieldArray(n)),c=i.default.useRef(a._getFieldArray(n).map(U)),u=i.default.useRef(o),d=i.default.useRef(n),p=i.default.useRef(!1);d.current=n,u.current=o,a._names.array.add(n),e.rules&&a.register(n,e.rules),F({next:({values:e,name:t})=>{if(t===d.current||!t){const t=f(e,d.current);Array.isArray(t)&&(l(t),c.current=t.map(U))}},subject:a._subjects.array});const b=i.default.useCallback((e=>{p.current=!0,a._updateFieldArray(n,e)}),[a,n]);return i.default.useEffect((()=>{if(a._state.action=!1,Q(n,a._names)&&a._subjects.state.next({...a._formState}),p.current&&(!G(a._options.mode).isOnSubmit||a._formState.isSubmitted))if(a._options.resolver)a._executeSchema([n]).then((e=>{const t=f(e.errors,n),i=f(a._formState.errors,n);(i?!t&&i.type||t&&(i.type!==t.type||i.message!==t.message):t&&t.type)&&(t?B(a._formState.errors,n,t):ye(a._formState.errors,n),a._subjects.state.next({errors:a._formState.errors}))}));else{const e=f(a._fields,n);e&&e._f&&ce(e,a._formValues,a._options.criteriaMode===j,a._options.shouldUseNativeValidation,!0).then((e=>!I(e)&&a._subjects.state.next({errors:W(a._formState.errors,e,n)})))}a._subjects.values.next({name:n,values:{...a._formValues}}),a._names.focus&&V(a._fields,(e=>!!e&&e.startsWith(a._names.focus||""))),a._names.focus="",a._updateValid()}),[o,n,a]),i.default.useEffect((()=>(!f(a._formValues,n)&&a._updateFieldArray(n),()=>{(a._options.shouldUnregister||s)&&a.unregister(n)})),[n,a,r,s]),{swap:i.default.useCallback(((e,t)=>{const i=a._getFieldArray(n);fe(i,e,t),fe(c.current,e,t),b(i),l(i),a._updateFieldArray(n,i,fe,{argA:e,argB:t},!1)}),[b,n,a]),move:i.default.useCallback(((e,t)=>{const i=a._getFieldArray(n);me(i,e,t),me(c.current,e,t),b(i),l(i),a._updateFieldArray(n,i,me,{argA:e,argB:t},!1)}),[b,n,a]),prepend:i.default.useCallback(((e,t)=>{const i=M(m(e)),r=be(a._getFieldArray(n),i);a._names.focus=H(n,0,t),c.current=be(c.current,i.map(U)),b(r),l(r),a._updateFieldArray(n,r,be,{argA:de(e)})}),[b,n,a]),append:i.default.useCallback(((e,t)=>{const i=M(m(e)),r=ue(a._getFieldArray(n),i);a._names.focus=H(n,r.length-1,t),c.current=ue(c.current,i.map(U)),b(r),l(r),a._updateFieldArray(n,r,ue,{argA:de(e)})}),[b,n,a]),remove:i.default.useCallback((e=>{const t=ge(a._getFieldArray(n),e);c.current=ge(c.current,e),b(t),l(t),a._updateFieldArray(n,t,ge,{argA:e})}),[b,n,a]),insert:i.default.useCallback(((e,t,i)=>{const r=M(m(t)),s=pe(a._getFieldArray(n),e,r);a._names.focus=H(n,e,i),c.current=pe(c.current,e,r.map(U)),b(s),l(s),a._updateFieldArray(n,s,pe,{argA:e,argB:de(t)})}),[b,n,a]),update:i.default.useCallback(((e,t)=>{const i=m(t),r=he(a._getFieldArray(n),e,i);c.current=[...r].map(((t,a)=>t&&a!==e?c.current[a]:U())),b(r),l([...r]),a._updateFieldArray(n,r,he,{argA:e,argB:i},!0,!1)}),[b,n,a]),replace:i.default.useCallback((e=>{const t=M(m(e));c.current=t.map(U),b([...t]),l([...t]),a._updateFieldArray(n,[...t],(e=>e),{},!0,!1)}),[b,n,a]),fields:i.default.useMemo((()=>o.map(((e,t)=>({...e,[r]:c.current[t]||U()})))),[o,r])}},t.useForm=function(e={}){const t=i.default.useRef(),[a,n]=i.default.useState({isDirty:!1,isValidating:!1,isLoading:J(e.defaultValues),isSubmitted:!1,isSubmitting:!1,isSubmitSuccessful:!1,isValid:!1,submitCount:0,dirtyFields:{},touchedFields:{},errors:{},defaultValues:J(e.defaultValues)?void 0:e.defaultValues});t.current||(t.current={...Ae(e,(()=>n((e=>({...e}))))),formState:a});const r=t.current.control;return r._options=e,F({subject:r._subjects.state,next:e=>{C(e,r._proxyFormState,r._updateFormState,!0)&&n({...r._formState})}}),i.default.useEffect((()=>{e.values&&!xe(e.values,r._defaultValues)?r._reset(e.values,r._options.resetOptions):r._resetDefaultValues()}),[e.values,r]),i.default.useEffect((()=>{r._state.mount||(r._updateValid(),r._state.mount=!0),r._state.watch&&(r._state.watch=!1,r._subjects.state.next({...r._formState})),r._removeUnmounted()})),t.current.formState=T(a,r),t.current},t.useFormContext=w,t.useFormState=A,t.useWatch=P},function(e,t){const a=Object.freeze({loose:!0}),n=Object.freeze({});e.exports=e=>e?"object"!=typeof e?a:e:n},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a.n(n),r=a(40),s=a(654),o=a(453);const l=Object(n.forwardRef)((({onChange:e,value:t,ariaLabel:a,editorId:l,dataTestSubj:c,height:u,autoFocusDisabled:d,setIsMarkdownInvalid:p},m)=>{const[b,g]=Object(n.useState)([]),f=Object(n.useCallback)(((e,{messages:t})=>{g(e?[e]:t),p(!!e)}),[p]),y=Object(n.useRef)(null);Object(n.useEffect)((()=>{var e,t;d||null===(e=y.current)||void 0===e||null===(t=e.textarea)||void 0===t||t.focus()}),[d]);const h=Object(o.b)("investigation_guide"),v=Object(n.useMemo)((()=>Object(s.d)({insightsUpsellingMessage:h})),[h]);return Object(n.useImperativeHandle)(m,(()=>{var e,t;if(!y.current)return null;const a=null===(e=y.current)||void 0===e||null===(t=e.textarea)||void 0===t?void 0:t.closest(".euiMarkdownEditor");return{...y.current,toolbar:null==a?void 0:a.querySelector(".euiMarkdownEditorToolbar")}})),i.a.createElement(r.EuiMarkdownEditor,{ref:y,"aria-label":a,editorId:l,onChange:e,value:t,uiPlugins:v,parsingPluginList:s.a,processingPluginList:s.c,onParse:f,errors:b,"data-test-subj":c,height:u})}));l.displayName="MarkdownEditorComponent";const c=Object(n.memo)(l)},function(e,t,a){"use strict";a.d(t,"a",(function(){return o})),a.d(t,"b",(function(){return l})),a.d(t,"c",(function(){return c}));var n=a(2),i=a(10),r=a.n(i),s=a(535);const o=e=>{const t=Object(s.b)(),a=r()(t.sections$,t.getSectionsValue());return Object(n.useMemo)((()=>{var t;return null!==(t=null==a?void 0:a.get(e))&&void 0!==t?t:null}),[e,a])},l=e=>{const t=Object(s.b)(),a=r()(t.messages$,t.getMessagesValue());return Object(n.useMemo)((()=>{var t;return null!==(t=null==a?void 0:a.get(e))&&void 0!==t?t:null}),[e,a])},c=e=>{const t=Object(s.b)(),a=Object(n.useMemo)((()=>t.getPageUpselling(e)),[e,t]);return null!=a?a:null}},function(e,t,a){"use strict";a.d(t,"a",(function(){return v}));var n=a(40),i=a(55),r=a.n(i),s=a(2),o=a.n(s),l=a(41),c=a.n(l),u=a(45),d=a(4),p=a(455),m=a(116),b=a(110);const g=c()(n.EuiDescriptionList).withConfig({displayName:"DescriptionListStyled",componentId:"sc-67qpo8-0"})(["@media only screen and (min-width:","){.euiDescriptionList__title{width:30% !important;}.euiDescriptionList__description{width:70% !important;}}"],(e=>e.theme.eui.euiBreakpoints.s));g.displayName="DescriptionListStyled";const f=c()(n.EuiModal).withConfig({displayName:"MyEuiModal",componentId:"sc-67qpo8-1"})(["width:min(768px,calc(100vw - 16px));min-height:41vh;.euiModal__flex{width:60vw;}.euiCodeBlock{height:auto !important;max-width:718px;}"]);f.displayName="MyEuiModal";const y=function(e){try{return e.map((e=>JSON.parse(e)))}catch{return[]}},h=(e=[])=>1===e.length&&e[0]===d.Sb?o.a.createElement("i",null,p.f):e.length>0?e.filter((e=>e!==d.Sb)).join(", "):p.k,v=({adHocDataViews:e,additionalRequests:t,additionalResponses:a,closeModal:i,inputId:l,request:c,response:d,title:v})=>{var E,x,j,S;const{pathname:k}=Object(u.useLocation)(),{selectedPatterns:O}=Object(m.d)("timeline"===l?b.SourcererScopeName.timeline:Object(m.a)(k)),w=[c,...null!=t?t:[]],T=[d,...null!=a?a:[]],I=y(w),C=y(T),M=Object(s.useMemo)((()=>{var e,t;return(null!==(e=null===(t=I[0])||void 0===t?void 0:t.index)&&void 0!==e?e:[]).every((e=>O.includes(e.trim())))}),[I,O]),_=[{title:o.a.createElement("span",{"data-test-subj":"index-pattern-title"},p.b," ",o.a.createElement(n.EuiIconTip,{color:"subdued",content:p.c,type:"iInCircle"})),description:o.a.createElement("span",{"data-test-subj":"index-pattern-description"},o.a.createElement("p",null,h(null!=e&&e.length>0?e:null!==(E=null===(x=I[0])||void 0===x?void 0:x.index)&&void 0!==E?E:[])),!M&&o.a.createElement("p",null,o.a.createElement("small",null,o.a.createElement("i",{"data-test-subj":"not-sourcerer-msg"},p.e))))},{title:o.a.createElement("span",{"data-test-subj":"query-time-title"},p.g," ",o.a.createElement(n.EuiIconTip,{color:"subdued",content:p.h,type:"iInCircle"})),description:o.a.createElement("span",{"data-test-subj":"query-time-description"},0===(null===(j=C[0])||void 0===j?void 0:j.took)?"0ms":null!==(S=C[0])&&void 0!==S&&S.took?`${r()(C[0].took).format("0,0")}ms`:p.k)},{title:o.a.createElement("span",{"data-test-subj":"request-timestamp-title"},p.i," ",o.a.createElement(n.EuiIconTip,{color:"subdued",content:p.j,type:"iInCircle"})),description:o.a.createElement("span",{"data-test-subj":"request-timestamp-description"},(new Date).toISOString())}],F=[{id:"statistics",name:"Statistics",content:o.a.createElement(o.a.Fragment,null,o.a.createElement(n.EuiSpacer,null),o.a.createElement(g,{listItems:_,type:"column"}))},{id:"request",name:"Request",content:I.length>0?I.map(((e,t)=>o.a.createElement(s.Fragment,{key:t},o.a.createElement(n.EuiSpacer,null),o.a.createElement(n.EuiCodeBlock,{language:"js",fontSize:"m",paddingSize:"m",color:"dark",overflowHeight:300,isCopyable:!0},(e=>{try{return JSON.stringify(e,null,2)}catch{return p.k}})(e.body))))):o.a.createElement(n.EuiCodeBlock,null,p.k)},{id:"response",name:"Response",content:C.length>0?T.map(((e,t)=>o.a.createElement(s.Fragment,{key:t},o.a.createElement(n.EuiSpacer,null),o.a.createElement(n.EuiCodeBlock,{language:"js",fontSize:"m",paddingSize:"m",color:"dark",overflowHeight:300,isCopyable:!0},e)))):o.a.createElement(n.EuiCodeBlock,null,p.k)}];return o.a.createElement(f,{onClose:i,"data-test-subj":"modal-inspect-euiModal"},o.a.createElement(n.EuiModalHeader,null,o.a.createElement(n.EuiModalHeaderTitle,null,p.d," ",v)),o.a.createElement(n.EuiModalBody,null,o.a.createElement(n.EuiTabbedContent,{tabs:F,initialSelectedTab:F[0],autoFocus:"selected"})),o.a.createElement(n.EuiModalFooter,null,o.a.createElement(n.EuiButton,{onClick:i,fill:!0,"data-test-subj":"modal-inspect-close"},p.a)))}},function(e,t,a){"use strict";a.d(t,"d",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"k",(function(){return s})),a.d(t,"b",(function(){return o})),a.d(t,"c",(function(){return l})),a.d(t,"e",(function(){return c})),a.d(t,"g",(function(){return u})),a.d(t,"h",(function(){return d})),a.d(t,"i",(function(){return p})),a.d(t,"j",(function(){return m})),a.d(t,"f",(function(){return b}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.inspectDescription",{defaultMessage:"Inspect"}),r=n.i18n.translate("xpack.securitySolution.inspect.modal.closeTitle",{defaultMessage:"Close"}),s=n.i18n.translate("xpack.securitySolution.inspect.modal.somethingWentWrongDescription",{defaultMessage:"Sorry about that, something went wrong."}),o=n.i18n.translate("xpack.securitySolution.inspect.modal.indexPatternLabel",{defaultMessage:"Index pattern"}),l=n.i18n.translate("xpack.securitySolution.inspect.modal.indexPatternDescription",{defaultMessage:"The index pattern that connected to the Elasticsearch indices. These indices can be configured in Kibana > Advanced Settings."}),c=n.i18n.translate("xpack.securitySolution.inspectPatternDifferent",{defaultMessage:"This element has a unique index pattern separate from the data view setting."}),u=n.i18n.translate("xpack.securitySolution.inspect.modal.queryTimeLabel",{defaultMessage:"Query time"}),d=n.i18n.translate("xpack.securitySolution.inspect.modal.queryTimeDescription",{defaultMessage:"The time it took to process the query. Does not include the time to send the request or parse it in the browser."}),p=n.i18n.translate("xpack.securitySolution.inspect.modal.reqTimestampLabel",{defaultMessage:"Request timestamp"}),m=n.i18n.translate("xpack.securitySolution.inspect.modal.reqTimestampDescription",{defaultMessage:"Time when the start of the request has been logged"}),b=n.i18n.translate("xpack.securitySolution.inspect.modal.noAlertIndexFound",{defaultMessage:"No alert index found"})},function(e,t,a){"use strict";a.d(t,"b",(function(){return o})),a.d(t,"a",(function(){return l})),a.d(t,"c",(function(){return u}));var n=a(57),i=a(42),r=a(293);const s=e=>e.toLocaleString(),o=({chartHeight:e,from:t,legendPosition:a,to:i,onBrushEnd:o,yTickFormatter:l,showLegend:c})=>({series:{xScaleType:n.ScaleType.Time,yScaleType:n.ScaleType.Linear,stackAccessors:["g"]},axis:{xTickFormatter:Object(r.a)([t,i]),yTickFormatter:null!=l?l:s,tickSize:8},settings:{legendPosition:null!=a?a:n.Position.Right,onBrushEnd:o,showLegend:null==c||c,showLegendExtra:!0,theme:{scales:{barsPadding:.08},chartMargins:{left:0,right:0,top:0,bottom:0},chartPaddings:{left:0,right:0,top:0,bottom:0}}},customHeight:null!=e?e:174}),l=["#1EA593","#2B70F7","#CE0060","#38007E","#FCA5D3","#F37020","#E49E29","#B0916F","#7B000B","#34130C","#GGGGGG"],c=([e,t])=>({key:e,value:t}),u=(e,t)=>{if(!e)return[];const a=Object(i.groupBy)("g",e),n=Object(i.toPairs)(a);return Object(i.map)(c,n).map(((e,a)=>{var n;const r=Object(i.get)(e.key,t);return{...e,color:null!==(n=null==r?void 0:r.color)&&void 0!==n?n:l[a]}}))}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"d",(function(){return s})),a.d(t,"f",(function(){return o})),a.d(t,"g",(function(){return l})),a.d(t,"h",(function(){return c})),a.d(t,"i",(function(){return u})),a.d(t,"j",(function(){return d})),a.d(t,"b",(function(){return p})),a.d(t,"k",(function(){return m})),a.d(t,"l",(function(){return b})),a.d(t,"m",(function(){return g})),a.d(t,"n",(function(){return f})),a.d(t,"o",(function(){return y})),a.d(t,"e",(function(){return h}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.dataQualityDashboard.addToCaseSuccessToast",{defaultMessage:"Successfully added data quality results to the case"}),r=(n.i18n.translate("xpack.securitySolution.dataQualityDashboard.betaBadge",{defaultMessage:"Beta"}),n.i18n.translate("xpack.securitySolution.overview.ilmPhaseCold",{defaultMessage:"cold"})),s=n.i18n.translate("xpack.securitySolution.dataQualityDashboard.pageTitle",{defaultMessage:"Data Quality"}),o=n.i18n.translate("xpack.securitySolution.dataQualityDashboard.elasticCommonSchemaReferenceLink",{defaultMessage:"Elastic Common Schema (ECS)"}),l=(n.i18n.translate("xpack.securitySolution.overview.eventsTitle",{defaultMessage:"Event count"}),n.i18n.translate("xpack.securitySolution.overview.ilmPhaseFrozen",{defaultMessage:"frozen"})),c=n.i18n.translate("xpack.securitySolution.overview.ilmPhaseHot",{defaultMessage:"hot"}),u=n.i18n.translate("xpack.securitySolution.overview.newsFeedSidebarTitle",{defaultMessage:"Security news"}),d=n.i18n.translate("xpack.securitySolution.overview.recentTimelinesSidebarTitle",{defaultMessage:"Recent timelines"}),p=n.i18n.translate("xpack.securitySolution.overview.signalCountTitle",{defaultMessage:"Alert trend"}),m=e=>n.i18n.translate("xpack.securitySolution.overview.topNLabel",{values:{fieldName:e},defaultMessage:"Top {fieldName}"}),b=n.i18n.translate("xpack.securitySolution.overview.ilmPhaseUnmanaged",{defaultMessage:"unmanaged"}),g=n.i18n.translate("xpack.securitySolution.overview.viewAlertsButtonLabel",{defaultMessage:"View alerts"}),f=n.i18n.translate("xpack.securitySolution.overview.viewEventsButtonLabel",{defaultMessage:"View events"}),y=n.i18n.translate("xpack.securitySolution.overview.ilmPhaseWarm",{defaultMessage:"warm"}),h=n.i18n.translate("xpack.securitySolution.detectionResponse.pageTitle",{defaultMessage:"Detection & Response"});n.i18n.translate("xpack.securitySolution.entityAnalytics.technicalPreviewLabel",{defaultMessage:"Technical Preview"})},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"d",(function(){return r})),a.d(t,"a",(function(){return s})),a.d(t,"g",(function(){return o})),a.d(t,"f",(function(){return l})),a.d(t,"h",(function(){return c})),a.d(t,"e",(function(){return u})),a.d(t,"c",(function(){return d}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.exceptions.commentEventLabel",{defaultMessage:"added a comment"}),r=n.i18n.translate("xpack.securitySolution.exceptions.operatingSystemFullLabel",{defaultMessage:"Operating System"}),s=(n.i18n.translate("xpack.securitySolution.exceptions.viewer.addToEndpointListLabel",{defaultMessage:"Add endpoint exception"}),n.i18n.translate("xpack.securitySolution.exceptions.viewer.addToDetectionsListLabel",{defaultMessage:"Add rule exception"}),n.i18n.translate("xpack.securitySolution.exceptions.viewer.addCommentPlaceholder",{defaultMessage:"Add a new comment..."}),n.i18n.translate("xpack.securitySolution.exceptions.viewer.addToClipboard",{defaultMessage:"Comment"})),o=(n.i18n.translate("xpack.securitySolution.exceptions.clearExceptionsLabel",{defaultMessage:"Remove Exception List"}),n.i18n.translate("xpack.securitySolution.exceptions.fetchError",{defaultMessage:"Error fetching exception list"}),n.i18n.translate("xpack.securitySolution.exceptions.errorLabel",{defaultMessage:"Error"}),n.i18n.translate("xpack.securitySolution.exceptions.cancelLabel",{defaultMessage:"Cancel"}),n.i18n.translate("xpack.securitySolution.exceptions.modalErrorAccordionText",{defaultMessage:"Show rule reference information:"}),n.i18n.translate("xpack.securitySolution.exceptions.disassociateExceptionListError",{defaultMessage:"Failed to remove exception list"}),n.i18n.translate("xpack.securitySolution.exceptions.operatingSystemWindows",{defaultMessage:"Windows"})),l=n.i18n.translate("xpack.securitySolution.exceptions.operatingSystemMac",{defaultMessage:"macOS"}),c=n.i18n.translate("xpack.securitySolution.exceptions.operatingSystemWindowsAndMac",{defaultMessage:"Windows and macOS"}),u=n.i18n.translate("xpack.securitySolution.exceptions.operatingSystemLinux",{defaultMessage:"Linux"}),d=n.i18n.translate("xpack.securitySolution.exceptions.fetchingReferencesErrorToastTitle",{defaultMessage:"Error fetching exception references"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"d",(function(){return o})),a.d(t,"e",(function(){return l})),a.d(t,"g",(function(){return c})),a.d(t,"h",(function(){return u})),a.d(t,"i",(function(){return d})),a.d(t,"f",(function(){return p}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.timeline.categoryTooltip",{defaultMessage:"Category"}),r=n.i18n.translate("xpack.securitySolution.timeline.descriptionTooltip",{defaultMessage:"Description"}),s=n.i18n.translate("xpack.securitySolution.timeline.fieldTooltip",{defaultMessage:"Field"}),o=n.i18n.translate("xpack.securitySolution.timeline.fullScreenButton",{defaultMessage:"Full screen"}),l=n.i18n.translate("xpack.securitySolution.timeline.hideColumnLabel",{defaultMessage:"Hide column"}),c=n.i18n.translate("xpack.securitySolution.timeline.sortAZLabel",{defaultMessage:"Sort A-Z"}),u=n.i18n.translate("xpack.securitySolution.timeline.sortZALabel",{defaultMessage:"Sort Z-A"}),d=n.i18n.translate("xpack.securitySolution.timeline.typeTooltip",{defaultMessage:"Type"}),p=n.i18n.translate("xpack.securitySolution.timeline.flyout.pane.removeColumnButtonLabel",{defaultMessage:"Remove column"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"b",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"d",(function(){return s})),a.d(t,"e",(function(){return o})),a.d(t,"f",(function(){return l}));const n="network.bytes",i="network.community_id",r="network.direction",s="network.packets",o="network.protocol",l="network.transport"},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"d",(function(){return r})),a.d(t,"a",(function(){return s})),a.d(t,"c",(function(){return o}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.isolateHost",{defaultMessage:"Isolate host"}),r=n.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.unisolateHost",{defaultMessage:"Release host"}),s=e=>n.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.isolateHost.casesAssociatedWithAlert",{defaultMessage:"{caseCount} {caseCount, plural, one {case} other {cases}} associated with this host",values:{caseCount:e}}),o=n.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.returnToAlertDetails",{defaultMessage:"Return to alert details"})},function(e,t,a){const n=a(192);e.exports=(e,t,a)=>n(e,t,a)>0},function(e,t,a){const n=Symbol("SemVer ANY");class Comparator{static get ANY(){return n}constructor(e,t){if(t=i(t),e instanceof Comparator){if(e.loose===!!t.loose)return e;e=e.value}e=e.trim().split(/\s+/).join(" "),l("comparator",e,t),this.options=t,this.loose=!!t.loose,this.parse(e),this.semver===n?this.value="":this.value=this.operator+this.semver.version,l("comp",this)}parse(e){const t=this.options.loose?r[s.COMPARATORLOOSE]:r[s.COMPARATOR],a=e.match(t);if(!a)throw new TypeError(`Invalid comparator: ${e}`);this.operator=void 0!==a[1]?a[1]:"","="===this.operator&&(this.operator=""),a[2]?this.semver=new c(a[2],this.options.loose):this.semver=n}toString(){return this.value}test(e){if(l("Comparator.test",e,this.options.loose),this.semver===n||e===n)return!0;if("string"==typeof e)try{e=new c(e,this.options)}catch(e){return!1}return o(e,this.operator,this.semver,this.options)}intersects(e,t){if(!(e instanceof Comparator))throw new TypeError("a Comparator is required");return""===this.operator?""===this.value||new u(e.value,t).test(this.value):""===e.operator?""===e.value||new u(this.value,t).test(e.semver):!((t=i(t)).includePrerelease&&("<0.0.0-0"===this.value||"<0.0.0-0"===e.value)||!t.includePrerelease&&(this.value.startsWith("<0.0.0")||e.value.startsWith("<0.0.0"))||(!this.operator.startsWith(">")||!e.operator.startsWith(">"))&&(!this.operator.startsWith("<")||!e.operator.startsWith("<"))&&(this.semver.version!==e.semver.version||!this.operator.includes("=")||!e.operator.includes("="))&&!(o(this.semver,"<",e.semver,t)&&this.operator.startsWith(">")&&e.operator.startsWith("<"))&&!(o(this.semver,">",e.semver,t)&&this.operator.startsWith("<")&&e.operator.startsWith(">")))}}e.exports=Comparator;const i=a(451),{safeRe:r,t:s}=a(310),o=a(838),l=a(325),c=a(157),u=a(205)},function(e,t,a){const n=a(205);e.exports=(e,t,a)=>{try{t=new n(t,a)}catch(e){return!1}return t.test(e)}},function(e,t,a){"use strict";var n=String.fromCharCode;e.exports=n},function(e,t,a){"use strict";var n=a(147),i=a(154),r={tokenize:function(e,t,a){return i(e,(function(e){return null===e||n(e)?t(e):a(e)}),"linePrefix")},partial:!0};e.exports=r},function(e,t,a){"use strict";var n=a(841);e.exports=function(e,t){var a=e[e.length-1];return a&&a[1].type===t?n(a[2].sliceStream(a[1])):0}},function(e,t,a){"use strict";var n=a(253)(/[\dA-Za-z]/);e.exports=n},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a.n(n),r=a(41);const s=a.n(r).a.div.withConfig({displayName:"StyledDiv",componentId:"sc-1qyhc9r-0"})(["padding-left:",";"],(({addPadding:e})=>e&&"53px"));s.defaultProps={addPadding:!1};const o=i.a.memo(s);o.displayName="StepContentWrapper"},function(e,t,a){"use strict";a.d(t,"a",(function(){return c})),a.d(t,"b",(function(){return u}));var n=a(27),i=a(46),r=a(2),s=a(143),o=a(354);const l=["GET",n.INTERNAL_ALERTING_API_FIND_RULES_PATH],c=(e,t)=>Object(i.useQuery)([...l,...e],(({signal:t})=>Object(s.k)({ids:e,signal:t})),{...o.a,...t}),u=()=>{const e=Object(i.useQueryClient)();return Object(r.useCallback)((()=>e.invalidateQueries(l,{refetchType:"active"})),[e])}},function(e,t,a){"use strict";a.d(t,"d",(function(){return i})),a.d(t,"f",(function(){return r})),a.d(t,"j",(function(){return s})),a.d(t,"i",(function(){return o})),a.d(t,"m",(function(){return l})),a.d(t,"h",(function(){return c})),a.d(t,"k",(function(){return u})),a.d(t,"l",(function(){return d})),a.d(t,"e",(function(){return p})),a.d(t,"n",(function(){return m})),a.d(t,"s",(function(){return b})),a.d(t,"t",(function(){return g})),a.d(t,"q",(function(){return f})),a.d(t,"r",(function(){return y})),a.d(t,"p",(function(){return h})),a.d(t,"o",(function(){return v})),a.d(t,"b",(function(){return E})),a.d(t,"c",(function(){return x})),a.d(t,"a",(function(){return j})),a.d(t,"g",(function(){return S}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.customQueryFieldRequiredError",{defaultMessage:"A custom query is required."}),r=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.eqlQueryFieldRequiredError",{defaultMessage:"An EQL query is required."}),s=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.customQueryFieldInvalidError",{defaultMessage:"The KQL is invalid"}),o=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.indicesHelperDescription",{defaultMessage:"Enter the pattern of Elasticsearch indices where you would like this rule to run. By default, these will include index patterns defined in Security Solution advanced settings."}),l=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.resetDefaultIndicesButton",{defaultMessage:"Reset to default index patterns"}),c=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.importTimelineQueryButton",{defaultMessage:"Import query from saved timeline"}),u=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.mlJobSelectPlaceholderText",{defaultMessage:"Select a job"}),d=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldQuerBarLabel",{defaultMessage:"Custom query"}),p=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.EqlQueryBarLabel",{defaultMessage:"EQL query"}),m=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.SavedQueryFormRowLabel",{defaultMessage:"Saved query"}),b=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldShouldLoadQueryDynamicallyLabel",{defaultMessage:'Load saved query "{savedQueryName}" dynamically on each rule execution',values:{savedQueryName:e}}),g=()=>n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldShouldLoadQueryDynamicallyLabelWithoutName",{defaultMessage:"Load saved query dynamically on each rule execution"}),f=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.threatMatchingIcesHelperDescription",{defaultMessage:"Select threat indices"}),y=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.customThreatQueryFieldRequiredError",{defaultMessage:"At least one indicator match is required."}),h=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.customThreatQueryFieldRequiredEmptyError",{defaultMessage:"All matches require both a field and threat index field."}),v=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.source",{defaultMessage:"Source"}),E=(n.i18n.translate("xpack.securitySolution.detections.dataSource.popover.title",{defaultMessage:"Select a data source"}),n.i18n.translate("xpack.securitySolution.detections.dataSource.popover.subTitle",{defaultMessage:"Data sources"}),n.i18n.translate("xpack.securitySolution.detections.dataSource.popover.content",{defaultMessage:"Rules can now query index patterns or data views."}),n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.rulePreviewTitle",{defaultMessage:"Rule Preview"}),n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.alertSuppressionMissingFieldsLabel",{defaultMessage:"If a suppression field is missing"})),x=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.alertSuppressionMissingFieldsSuppressLabel",{defaultMessage:"Suppress and group alerts for events with missing fields"}),j=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.alertSuppressionMissingFieldsDoNotSuppressLabel",{defaultMessage:"Do not suppress alerts for events with missing fields"}),S=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.groupBy.licenseWarning",{defaultMessage:"Alert suppression is enabled with Platinum license or above"})},,function(e,t,a){"use strict";a.d(t,"a",(function(){return M}));var n=a(2),i=a.n(n),r=a(40),s=a(117),o=a(42),l=a(41),c=a.n(l),u=a(1078),d=a(798),p=a(132),m=a(799);const b=(e=[])=>e.filter((e=>!Object(o.isEmpty)(e))).map((e=>{const t=(e=>{const[t,a]=Object(m.a)(e);return null!=t&&null!=a?`${t}: "${a}"`:""})(e);return i.a.createElement(r.EuiFlexItem,{key:t,grow:!1},t)}));var g=a(5);const f=g.i18n.translate("xpack.securitySolution.ml.score.influencedByTitle",{defaultMessage:"Influenced By"}),y=g.i18n.translate("xpack.securitySolution.ml.score.maxAnomalyScoreTitle",{defaultMessage:"Max Anomaly Score"}),h=g.i18n.translate("xpack.securitySolution.ml.score.anomalyJobTitle",{defaultMessage:"Job"}),v=g.i18n.translate("xpack.securitySolution.ml.score.viewInMachineLearningLink",{defaultMessage:"View in Machine Learning"}),E=g.i18n.translate("xpack.securitySolution.ml.score.detectedTitle",{defaultMessage:"Detected"}),x=g.i18n.translate("xpack.securitySolution.ml.score.narrowToThisDateRangeLink",{defaultMessage:"Narrow to this date range"}),j=g.i18n.translate("xpack.securitySolution.ml.score.anomalousEntityTitle",{defaultMessage:"Anomalous Entity"});var S=a(1079);const k=c()(r.EuiText).withConfig({displayName:"LargeScore",componentId:"sc-vz3ecp-0"})(["font-size:45px;font-weight:lighter;"]);k.displayName="LargeScore";const O=(e,t,a,n,s,o)=>[{title:y,description:i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiSpacer,{size:"m"}),i.a.createElement(k,null,Object(d.a)(e.severity)))},{title:i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiSpacer,{size:"m"}),h),description:i.a.createElement(r.EuiFlexGroup,{direction:"column",gutterSize:"none",responsive:!1},i.a.createElement(r.EuiFlexItem,{grow:!1},o),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(S.a,{score:e,startDate:t,endDate:a,linkName:v})))},{title:E,description:i.a.createElement(r.EuiFlexGroup,{direction:"column",gutterSize:"none",responsive:!1},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(p.c,{value:new Date(e.time)})),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiLink,{"data-test-subj":"anomaly-description-narrow-range-link",onClick:()=>{s(e,n)},target:"_blank"},x)))},{title:j,description:i.a.createElement(r.EuiFlexGroup,{direction:"column",gutterSize:"none",responsive:!1},i.a.createElement(r.EuiFlexItem,{grow:!1},`${e.entityName}: "${e.entityValue}"`))},{title:f,description:i.a.createElement(r.EuiFlexGroup,{direction:"column",gutterSize:"none",responsive:!1},b(e.influencers))}],w=c()(r.EuiIcon).withConfig({displayName:"Icon",componentId:"sc-1ms1asc-0"})(["vertical-align:text-bottom;cursor:pointer;"]);w.displayName="Icon";const T=({startDate:e,endDate:t,index:a=0,score:s,interval:o,narrowDateRange:l,jobName:c})=>{const[d,p]=Object(n.useState)(!1);return i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiFlexItem,{grow:!1,"data-test-subj":"anomaly-score"},i.a.createElement(u.a,{index:a,score:s})),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiPopover,{"data-test-subj":"anomaly-score-popover",id:"anomaly-score-popover",isOpen:d,onClick:()=>p(!d),closePopover:()=>p(!d),button:i.a.createElement(w,{type:"iInCircle"}),repositionOnScroll:!0},i.a.createElement(r.EuiDescriptionList,{"data-test-subj":"anomaly-description-list",listItems:O(s,e,t,o,l,c)}))))};T.displayName="AnomalyScoreComponent";const I=i.a.memo(T);I.displayName="AnomalyScore";const C=({anomalies:e,startDate:t,endDate:a,isLoading:n,narrowDateRange:l,limit:c,jobNameById:u})=>n?i.a.createElement(r.EuiLoadingSpinner,{"data-test-subj":"anomaly-score-spinner",size:"m"}):null==e||0===e.anomalies.length?Object(s.d)():i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiFlexGroup,{gutterSize:"none",responsive:!1,"data-test-subj":"anomaly-scores"},((e,t)=>{const a=e.reduce(((e,t)=>{const a=t.jobId,n=t.severity;return(null==e[a]||e[a].severity<n)&&(e[a]=t),e}),{}),n=Object(o.toArray)(a).sort(((e,t)=>t.severity-e.severity));return null==t?n:n.slice(0,t)})(e.anomalies,c).map(((n,r)=>{var s;const o=(e=>`${e.jobId}-${e.severity}-${e.entityName}-${e.entityValue}`)(n);return i.a.createElement(I,{key:o,startDate:t,endDate:a,index:r,score:n,jobName:null!==(s=u[n.jobId])&&void 0!==s?s:n.jobId,interval:e.interval,narrowDateRange:l})}))));C.displayName="AnomalyScoresComponent";const M=i.a.memo(C);M.displayName="AnomalyScores"},,function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"e",(function(){return n})),a.d(t,"a",(function(){return j})),a.d(t,"d",(function(){return S}));var n={};a.r(n),a.d(n,"allUsersSelector",(function(){return c})),a.d(n,"userRiskScoreSelector",(function(){return u})),a.d(n,"userRiskScoreSeverityFilterSelector",(function(){return d})),a.d(n,"authenticationsSelector",(function(){return p})),a.d(n,"usersAnomaliesJobIdFilterSelector",(function(){return m})),a.d(n,"usersAnomaliesIntervalSelector",(function(){return b}));var i=a(524),r=a(184),s=a(139);const o=e=>e.users.page,l=(e,t)=>e.users[t],c=()=>Object(s.createSelector)(o,(e=>e.queries[r.UsersTableType.allUsers])),u=()=>Object(s.createSelector)(o,(e=>e.queries[r.UsersTableType.risk])),d=()=>Object(s.createSelector)(o,(e=>e.queries[r.UsersTableType.risk].severitySelection)),p=()=>Object(s.createSelector)(o,(e=>e.queries[r.UsersTableType.authentications])),m=()=>Object(s.createSelector)(l,(e=>e.queries[r.UsersTableType.anomalies].jobIdSelection)),b=()=>Object(s.createSelector)(l,(e=>e.queries[r.UsersTableType.anomalies].intervalSelection));var g=a(208),f=a(388),y=a(314);const h=e=>({...e.page.queries,[r.UsersTableType.allUsers]:{...e.page.queries[r.UsersTableType.allUsers],activePage:y.a}});var v=a(536),E=a(113),x=a(425);const j={page:{queries:{[r.UsersTableType.allUsers]:{activePage:y.a,limit:y.b,sort:{field:x.b.lastSeen,direction:v.a.desc}},[r.UsersTableType.authentications]:{activePage:y.a,limit:y.b},[r.UsersTableType.risk]:{activePage:y.a,limit:y.b,sort:{field:E.x.userRiskScore,direction:v.a.desc},severitySelection:[]},[r.UsersTableType.anomalies]:{jobIdSelection:[],intervalSelection:"auto"},[r.UsersTableType.events]:{activePage:y.a,limit:y.b}}},details:{queries:{[r.UsersTableType.anomalies]:{jobIdSelection:[],intervalSelection:"auto"},[r.UsersTableType.events]:{activePage:y.a,limit:y.b}}}},S=Object(g.reducerWithInitialState)(j).case(i.setUsersTablesActivePageToZero,(e=>({...e,page:{...e.page,queries:h(e)}}))).case(i.updateTableActivePage,((e,{activePage:t,tableType:a})=>({...e,page:{...e.page,queries:{...e.page.queries,[a]:{...e.page.queries[a],activePage:t}}}}))).case(i.updateTableLimit,((e,{limit:t,tableType:a})=>({...e,page:{...e.page,queries:{...e.page.queries,[a]:{...e.page.queries[a],limit:t}}}}))).case(i.updateTableSorting,((e,{sort:t,tableType:a})=>({...e,page:{...e.page,queries:{...e.page.queries,[a]:{...e.page.queries[a],sort:t,activePage:y.a}}}}))).case(i.updateUserRiskScoreSeverityFilter,((e,{severitySelection:t})=>({...e,page:{...e.page,queries:{...e.page.queries,[r.UsersTableType.risk]:{...e.page.queries[r.UsersTableType.risk],severitySelection:t,activePage:y.a}}}}))).case(i.updateUsersAnomaliesJobIdFilter,((e,{jobIds:t,usersType:a})=>"page"===a?Object(f.set)("page.queries.anomalies.jobIdSelection",t,e):Object(f.set)("details.queries.anomalies.jobIdSelection",t,e))).case(i.updateUsersAnomaliesInterval,((e,{interval:t,usersType:a})=>"page"===a?Object(f.set)("page.queries.anomalies.intervalSelection",t,e):Object(f.set)("details.queries.anomalies.intervalSelection",t,e))).build()},function(e,t,a){"use strict";a.d(t,"a",(function(){return S})),a.d(t,"c",(function(){return k})),a.d(t,"d",(function(){return O})),a.d(t,"b",(function(){return T}));var n=a(40),i=a(220),r=a(2),s=a.n(r),o=a(104),l=a.n(o),c=a(103),u=a(105),d=a(122),p=a(182),m=a(138),b=a(114),g=a(110),f=a(118),y=a(106),h=a(135),v=a(242),E=a(12);const x=({asEmptyButton:e,children:t,dataProviders:a,filters:i,timeRange:o,keepDataView:x,...j})=>{const S=Object(c.useDispatch)(),k=Object(r.useMemo)((()=>d.e.getSourcererDataViewsSelector()),[]),{defaultDataView:O,signalIndexName:w}=Object(u.a)((e=>k(e))),T=a&&a.find((e=>"template"===e.type)),I=Object(v.a)({timelineId:f.c.active,timelineType:T?y.l.template:y.l.default}),C=Object(r.useCallback)((()=>{if(a||i){if(o?I({timeRange:o}):I(),a)switch(S(Object(E.updateDataView)({id:f.c.active,dataViewId:"security-solution-default",indexNames:["logs-*"]})),a[0].queryType){case"eql":S(Object(E.updateEqlOptions)({id:f.c.active,field:"query",value:a[0].kqlQuery})),S(Object(E.setActiveTabTimeline)({id:f.c.active,activeTab:f.d.eql}));break;case"kql":S(Object(E.applyKqlFilterQuery)({id:f.c.active,filterQuery:{kuery:{kind:"kuery",expression:a[0].kqlQuery},serializedQuery:a[0].kqlQuery}})),S(Object(E.setActiveTabTimeline)({id:f.c.active,activeTab:f.d.query}));break;case"dsl":const e={meta:{type:"custom",disabled:!1,negate:!1,alias:a[0].name,key:"query",value:a[0].kqlQuery},query:JSON.parse(a[0].kqlQuery)};S(Object(E.setFilters)({id:f.c.active,filters:[e]})),S(Object(E.setActiveTabTimeline)({id:f.c.active,activeTab:f.d.query}))}i&&S(Object(E.setFilters)({id:f.c.active,filters:i})),x||S(p.d.setSelectedDataView({id:g.SourcererScopeName.timeline,selectedDataViewId:O.id,selectedPatterns:[w||""]})),S(m.b.removeLinkTo([b.a.timeline,b.a.global]))}}),[a,I,S,O.id,w,i,o,x]);return e?s.a.createElement(n.EuiButtonEmpty,{"aria-label":h.h,onClick:C,color:"text",flush:"both",size:"xs"},t):s.a.createElement(n.EuiButton,l()({"aria-label":h.h,onClick:C},j),t)};x.displayName="SendToTimelineButton";var j=a(721);const S="securityAssistant",k=e=>e.map((e=>`Rule Name:${e.name}\nRule Description:${e.description}`)).join("\n\n"),O=e=>e.filter((({field:e})=>!e.startsWith("signal."))).reduce(((e,{field:t,values:a})=>({...e,[t]:null!=a?a:[]})),{}),w=["kql","dsl","eql"],T=e=>e.messages.map((({content:t})=>Object(i.i)((({messageContent:e,replacements:t})=>null!=t?Object.keys(t).reduce(((e,a)=>e.replaceAll(a,t[a])),e):e)({messageContent:t,replacements:e.replacements})))).map(((t,a)=>t.map(((t,i)=>{var r;return{...t,getControlContainer:()=>document.querySelectorAll(`.message-${a} .euiCodeBlock__controls`)[i],button:w.includes(t.type)?s.a.createElement(x,{asEmptyButton:!0,dataProviders:[{id:"assistant-data-provider",name:`Assistant Query from conversation ${e.id}`,enabled:!0,excluded:!1,queryType:t.type,kqlQuery:null!==(r=t.content)&&void 0!==r?r:"",queryMatch:{field:"host.name",operator:":",value:"test"},and:[]}],keepDataView:!0},s.a.createElement(n.EuiToolTip,{position:"right",content:j.f},s.a.createElement(n.EuiIcon,{type:"timeline"}))):null}}))))},function(e,t,a){"use strict";a.d(t,"b",(function(){return s})),a.d(t,"c",(function(){return o})),a.d(t,"a",(function(){return l}));var n=a(8),i=a(110),r=a(340);const s=(e,t,a,n)=>{const s=null!=e&&null!==e.id?e.patternList:[];if(!n)return Object(r.b)(s);switch(t){case i.SourcererScopeName.default:return Object(r.b)(s.filter((e=>e!==a)));case i.SourcererScopeName.detections:return null!=a?[a]:[];case i.SourcererScopeName.timeline:return Object(r.b)(s)}},o=(e,t,a)=>{var o;const{id:l,...c}=t,u=e.kibanaDataViews.find((e=>e.id===c.selectedDataViewId)),d=Object(r.a)(c.selectedPatterns);let p=[];if(null==u||u.id===e.defaultDataView.id){const t=Object(r.a)((null!=u?u:e.defaultDataView).title.split(","));p=d.filter((e=>!t.includes(e)))}const m=a&&null!=u&&0===p.length&&u.id!==e.defaultDataView.id&&u.patternList.length>0?d.filter((t=>null!=u&&u.patternList.includes(t)||null==e.signalIndexName||e.signalIndexName===t)):d;return{[l]:{...e.sourcererScopes[l],...c,selectedDataViewId:null!==(o=null==u?void 0:u.id)&&void 0!==o?o:null,selectedPatterns:m,missingPatterns:p,...Object(n.isEmpty)(m)&&l!==i.SourcererScopeName.timeline?{selectedPatterns:s(null!=u?u:e.defaultDataView,l,e.signalIndexName,(null!=u?u:e.defaultDataView).id===e.defaultDataView.id)}:{},loading:!1}}},l=({patternList:e,scopeId:t,signalIndexName:a,isDefaultDataViewSelected:n})=>t===i.SourcererScopeName.detections?e.includes(`${a}`):t===i.SourcererScopeName.default&&n?e.filter((e=>e!==a)).length>0:e.length>0},function(e,t,a){"use strict";const n=a(1152),i=a(1153),r=a(1154);function s(e){if("string"!=typeof e||1!==e.length)throw new TypeError("arrayFormatSeparator must be single character string")}function o(e,t){return t.encode?t.strict?n(e):encodeURIComponent(e):e}function l(e,t){return t.decode?i(e):e}function c(e){return Array.isArray(e)?e.sort():"object"==typeof e?c(Object.keys(e)).sort(((e,t)=>Number(e)-Number(t))).map((t=>e[t])):e}function u(e){const t=e.indexOf("#");return-1!==t&&(e=e.slice(0,t)),e}function d(e){const t=(e=u(e)).indexOf("?");return-1===t?"":e.slice(t+1)}function p(e,t){return t.parseNumbers&&!Number.isNaN(Number(e))&&"string"==typeof e&&""!==e.trim()?e=Number(e):!t.parseBooleans||null===e||"true"!==e.toLowerCase()&&"false"!==e.toLowerCase()||(e="true"===e.toLowerCase()),e}function m(e,t){s((t=Object.assign({decode:!0,sort:!0,arrayFormat:"none",arrayFormatSeparator:",",parseNumbers:!1,parseBooleans:!1},t)).arrayFormatSeparator);const a=function(e){let t;switch(e.arrayFormat){case"index":return(e,a,n)=>{t=/\[(\d*)\]$/.exec(e),e=e.replace(/\[\d*\]$/,""),t?(void 0===n[e]&&(n[e]={}),n[e][t[1]]=a):n[e]=a};case"bracket":return(e,a,n)=>{t=/(\[\])$/.exec(e),e=e.replace(/\[\]$/,""),t?void 0!==n[e]?n[e]=[].concat(n[e],a):n[e]=[a]:n[e]=a};case"comma":case"separator":return(t,a,n)=>{const i="string"==typeof a&&a.split("").indexOf(e.arrayFormatSeparator)>-1?a.split(e.arrayFormatSeparator).map((t=>l(t,e))):null===a?a:l(a,e);n[t]=i};default:return(e,t,a)=>{void 0!==a[e]?a[e]=[].concat(a[e],t):a[e]=t}}}(t),n=Object.create(null);if("string"!=typeof e)return n;if(!(e=e.trim().replace(/^[?#&]/,"")))return n;for(const i of e.split("&")){let[e,s]=r(t.decode?i.replace(/\+/g," "):i,"=");s=void 0===s?null:["comma","separator"].includes(t.arrayFormat)?s:l(s,t),a(l(e,t),s,n)}for(const e of Object.keys(n)){const a=n[e];if("object"==typeof a&&null!==a)for(const e of Object.keys(a))a[e]=p(a[e],t);else n[e]=p(a,t)}return!1===t.sort?n:(!0===t.sort?Object.keys(n).sort():Object.keys(n).sort(t.sort)).reduce(((e,t)=>{const a=n[t];return Boolean(a)&&"object"==typeof a&&!Array.isArray(a)?e[t]=c(a):e[t]=a,e}),Object.create(null))}t.extract=d,t.parse=m,t.stringify=(e,t)=>{if(!e)return"";s((t=Object.assign({encode:!0,strict:!0,arrayFormat:"none",arrayFormatSeparator:","},t)).arrayFormatSeparator);const a=a=>t.skipNull&&null==e[a]||t.skipEmptyString&&""===e[a],n=function(e){switch(e.arrayFormat){case"index":return t=>(a,n)=>{const i=a.length;return void 0===n||e.skipNull&&null===n||e.skipEmptyString&&""===n?a:null===n?[...a,[o(t,e),"[",i,"]"].join("")]:[...a,[o(t,e),"[",o(i,e),"]=",o(n,e)].join("")]};case"bracket":return t=>(a,n)=>void 0===n||e.skipNull&&null===n||e.skipEmptyString&&""===n?a:null===n?[...a,[o(t,e),"[]"].join("")]:[...a,[o(t,e),"[]=",o(n,e)].join("")];case"comma":case"separator":return t=>(a,n)=>null==n||0===n.length?a:0===a.length?[[o(t,e),"=",o(n,e)].join("")]:[[a,o(n,e)].join(e.arrayFormatSeparator)];default:return t=>(a,n)=>void 0===n||e.skipNull&&null===n||e.skipEmptyString&&""===n?a:null===n?[...a,o(t,e)]:[...a,[o(t,e),"=",o(n,e)].join("")]}}(t),i={};for(const t of Object.keys(e))a(t)||(i[t]=e[t]);const r=Object.keys(i);return!1!==t.sort&&r.sort(t.sort),r.map((a=>{const i=e[a];return void 0===i?"":null===i?o(a,t):Array.isArray(i)?i.reduce(n(a),[]).join("&"):o(a,t)+"="+o(i,t)})).filter((e=>e.length>0)).join("&")},t.parseUrl=(e,t)=>{t=Object.assign({decode:!0},t);const[a,n]=r(e,"#");return Object.assign({url:a.split("?")[0]||"",query:m(d(e),t)},t&&t.parseFragmentIdentifier&&n?{fragmentIdentifier:l(n,t)}:{})},t.stringifyUrl=(e,a)=>{a=Object.assign({encode:!0,strict:!0},a);const n=u(e.url).split("?")[0]||"",i=t.extract(e.url),r=t.parse(i,{sort:!1}),s=Object.assign(r,e.query);let l=t.stringify(s,a);l&&(l=`?${l}`);let c=function(e){let t="";const a=e.indexOf("#");return-1!==a&&(t=e.slice(a)),t}(e.url);return e.fragmentIdentifier&&(c=`#${o(e.fragmentIdentifier,a)}`),`${n}${l}${c}`}},function(e,t,a){"use strict";a.d(t,"a",(function(){return g})),a.d(t,"b",(function(){return y}));var n=a(42),i=a(240),r=a.n(i),s=a(2),o=a(103),l=a(518),c=a(114),u=a(531),d=a(138),p=a(710),m=a(106),b=a(209);const g="FETCH_ALL_TIMELINES",f=r()(((e,t)=>t.map((e=>{var t;return{created:e.created,description:e.description,eventIdToNoteIds:null!=e.eventIdToNoteIds?e.eventIdToNoteIds.reduce(((e,t)=>{if(null!=t.eventId){const a=Object(n.getOr)([],t.eventId,e);return{...e,[t.eventId]:[...a,t.noteId]}}return e}),{}):null,excludedRowRendererIds:e.excludedRowRendererIds,favorite:e.favorite,noteIds:e.noteIds,notes:null!=e.notes?e.notes.map((e=>({...e,savedObjectId:e.noteId}))):null,pinnedEventIds:null!=e.pinnedEventIds?e.pinnedEventIds.reduce(((e,t)=>({...e,[t]:!0})),{}):null,savedObjectId:e.savedObjectId,status:e.status,title:e.title,updated:e.updated,updatedBy:e.updatedBy,timelineType:null!==(t=e.timelineType)&&void 0!==t?t:m.l.default,templateTimelineId:e.templateTimelineId,queryType:Object(l.b)(e)}})))),y=()=>{const e=Object(o.useDispatch)(),[,t]=Object(u.f)(),[a,n]=Object(s.useState)({loading:!1,totalCount:0,timelines:null,customTemplateTimelineCount:0,defaultTimelineCount:0,elasticTemplateTimelineCount:0,templateTimelineCount:0,favoriteCount:0}),i=Object(s.useCallback)((async({onlyUserFavorite:a,pageInfo:i,search:r,sort:s,status:o,timelineType:l})=>{let m=!1;const y=new AbortController,h=async()=>{try{var v,E,x,j,S,k,O;n((e=>({...e,loading:!0})));const t={onlyUserFavorite:a,pageInfo:i,search:r,sort:s,status:o,timelineType:l},u=await Object(b.c)(t,y.signal),p=null!==(v=null==u?void 0:u.totalCount)&&void 0!==v?v:0,w=null!==(E=null==u?void 0:u.timeline)&&void 0!==E?E:[],T=null!==(x=null==u?void 0:u.customTemplateTimelineCount)&&void 0!==x?x:0,I=null!==(j=null==u?void 0:u.defaultTimelineCount)&&void 0!==j?j:0,C=null!==(S=null==u?void 0:u.elasticTemplateTimelineCount)&&void 0!==S?S:0,M=null!==(k=null==u?void 0:u.templateTimelineCount)&&void 0!==k?k:0,_=null!==(O=null==u?void 0:u.favoriteCount)&&void 0!==O?O:0;m||(e(d.b.setQuery({inputId:c.a.global,id:g,loading:!1,refetch:h,inspect:null})),n({loading:!1,totalCount:p,timelines:f(JSON.stringify(t),w),customTemplateTimelineCount:T,defaultTimelineCount:I,elasticTemplateTimelineCount:C,templateTimelineCount:M,favoriteCount:_}))}catch(e){m||(Object(u.e)({title:p.c,error:e.body&&e.body.message?new Error(e.body.message):e,dispatchToaster:t}),n({loading:!1,totalCount:0,timelines:[],customTemplateTimelineCount:0,defaultTimelineCount:0,elasticTemplateTimelineCount:0,templateTimelineCount:0,favoriteCount:0}))}};return h(),()=>{m=!0,y.abort()}}),[e,t]);return Object(s.useEffect)((()=>()=>{e(d.b.deleteOneQuery({inputId:c.a.global,id:g}))}),[e]),{...a,fetchAllTimeline:i}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=function(){const e=this.Parser,t=e.prototype.blockTokenizers,a=e.prototype.blockMethods;t.osquery=function(e,t,a){if(!1===t.startsWith("!{osquery"))return!1;const n=t[9];if("{"!==n&&"}"!==n)return!1;if(a)return!0;let i="!{osquery",r={};if("{"===n){let a="",n=0;for(let e=9;e<t.length;e++){const i=t[e];if("{"===i)n++,a+=i;else if("}"===i){if(n--,-1===n)break;a+=i}else a+=i}i+=a;try{r=JSON.parse(a)}catch(t){const a=e.now();this.file.fail(`Unable to parse osquery JSON configuration: ${t}`,{line:a.line,column:a.column+9})}}return i+="}",e(i)({type:"osquery",configuration:r})},a.splice(a.indexOf("text"),0,"osquery")}},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(40),l=a(125),c=a(452);const u=s()(o.EuiFlexGroup).withConfig({displayName:"BottomContentWrapper",componentId:"sc-1819ayg-0"})(["",""],(({theme:e})=>`\n    padding: ${e.eui.euiSizeM} 0;\n  `)),d=i.a.memo(Object(n.forwardRef)((({id:e,field:t,dataTestSubj:a,idAria:r,bottomRightContent:s},d)=>{const{isInvalid:p,errorMessage:m}=Object(l.i)(t),[b,g]=Object(n.useState)(!1);return i.a.createElement(o.EuiFormRow,{"data-test-subj":a,describedByIds:r?[r]:void 0,error:m,fullWidth:!0,helpText:t.helpText,isInvalid:p||b,label:t.label,labelAppend:t.labelAppend},i.a.createElement(i.a.Fragment,null,i.a.createElement(c.a,{ref:d,ariaLabel:r,editorId:e,onChange:t.setValue,value:t.value,"data-test-subj":`${a}-markdown-editor`,setIsMarkdownInvalid:g}),s&&i.a.createElement(u,{justifyContent:"flexEnd"},i.a.createElement(o.EuiFlexItem,{grow:!1},s))))})));d.displayName="MarkdownEditorForm"},function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(2),i=a(103),r=a(105),s=a(102),o=a(122),l=a(182),c=a(114);const u=({inputId:e,queryId:t,skip:a})=>{const u=Object(i.useDispatch)(),{data:d}=Object(s.j)().services,p=Object(n.useRef)(d.search.session),m=o.d.globalQueryByIdSelector(),b=o.d.timelineQueryByIdSelector(),{selectedInspectIndex:g}=Object(r.a)((a=>e===c.a.global?m(a,t):b(a,t))),f=Object(n.useCallback)((()=>{const e=p.current.start();u(l.c.setInspectionParameter({id:t,selectedInspectIndex:g,isInspected:!1,inputId:c.a.global,searchSessionId:a?void 0:e}))}),[u,t,g,a]),y=Object(n.useCallback)((()=>{u(l.c.deleteOneQuery({inputId:c.a.global,id:t}))}),[u,t]);return{session:p,refetchByRestartingSession:f,refetchByDeletingSession:y}}},function(e,t,a){"use strict";a.d(t,"d",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"e",(function(){return s})),a.d(t,"c",(function(){return o})),a.d(t,"b",(function(){return l}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.stackByLabel",{defaultMessage:"Stack by"}),r=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.groupByLabel",{defaultMessage:"Group by"}),s=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.stackByPlaceholder",{defaultMessage:"Select a field to stack by"}),o=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.stackByAriaLabel",{defaultMessage:"Stack the alerts histogram by a field value"}),l=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.stackByOptions.groupByTopLabel",{defaultMessage:"Group by top"})},function(e,t,a){"use strict";a.d(t,"e",(function(){return i})),a.d(t,"f",(function(){return r})),a.d(t,"g",(function(){return s})),a.d(t,"h",(function(){return o})),a.d(t,"i",(function(){return l})),a.d(t,"j",(function(){return c})),a.d(t,"k",(function(){return u})),a.d(t,"c",(function(){return d})),a.d(t,"d",(function(){return p})),a.d(t,"n",(function(){return m})),a.d(t,"m",(function(){return b})),a.d(t,"o",(function(){return g})),a.d(t,"p",(function(){return f})),a.d(t,"q",(function(){return y})),a.d(t,"t",(function(){return h})),a.d(t,"s",(function(){return v})),a.d(t,"u",(function(){return E})),a.d(t,"w",(function(){return x})),a.d(t,"a",(function(){return j})),a.d(t,"b",(function(){return S})),a.d(t,"v",(function(){return k})),a.d(t,"r",(function(){return O})),a.d(t,"l",(function(){return w}));var n=a(5);n.i18n.translate("xpack.securitySolution.dataProviders.and",{defaultMessage:"AND"});const i=n.i18n.translate("xpack.securitySolution.dataProviders.deleteDataProvider",{defaultMessage:"Delete"}),r=n.i18n.translate("xpack.securitySolution.dataProviders.dropAnything",{defaultMessage:"Drop anything"}),s=(n.i18n.translate("xpack.securitySolution.dataProviders.edit",{defaultMessage:"Edit"}),n.i18n.translate("xpack.securitySolution.dataProviders.editMenuItem",{defaultMessage:"Edit filter"})),o=n.i18n.translate("xpack.securitySolution.dataProviders.editTitle",{defaultMessage:"EDIT FILTER"}),l=n.i18n.translate("xpack.securitySolution.dataProviders.excludeDataProvider",{defaultMessage:"Exclude results"}),c=n.i18n.translate("xpack.securitySolution.dataProviders.existsLabel",{defaultMessage:"exists"}),u=(n.i18n.translate("xpack.securitySolution.dataProviders.fieldLabel",{defaultMessage:"Field"}),n.i18n.translate("xpack.securitySolution.dataProviders.filterForFieldPresentLabel",{defaultMessage:"Filter for field present"})),d=n.i18n.translate("xpack.securitySolution.dataProviders.convertToFieldLabel",{defaultMessage:"Convert to field"}),p=n.i18n.translate("xpack.securitySolution.dataProviders.convertToTemplateFieldLabel",{defaultMessage:"Convert to template field"}),m=n.i18n.translate("xpack.securitySolution.dataProviders.highlighted",{defaultMessage:"highlighted"}),b=n.i18n.translate("xpack.securitySolution.dataProviders.hereToBuildAn",{defaultMessage:"here to build an"}),g=n.i18n.translate("xpack.securitySolution.dataProviders.includeDataProvider",{defaultMessage:"Include results"}),f=n.i18n.translate("xpack.securitySolution.dataProviders.not",{defaultMessage:"NOT"}),y=(n.i18n.translate("xpack.securitySolution.dataProviders.or",{defaultMessage:"or"}),n.i18n.translate("xpack.securitySolution.dataProviders.query",{defaultMessage:"query"})),h=(n.i18n.translate("xpack.securitySolution.dataProviders.toggle",{defaultMessage:"toggle"}),n.i18n.translate("xpack.securitySolution.dataProviders.reEnableDataProvider",{defaultMessage:"Re-enable"})),v=n.i18n.translate("xpack.securitySolution.dataProviders.removeDataProvider",{defaultMessage:"Remove Data Provider"}),E=({field:e,value:t})=>n.i18n.translate("xpack.securitySolution.dataProviders.showOptionsDataProviderAriaLabel",{values:{field:e,value:t},defaultMessage:"{field} {value} Press enter for options, or press space to begin dragging"}),x=n.i18n.translate("xpack.securitySolution.dataProviders.temporaryDisableDataProvider",{defaultMessage:"Temporarily disable"}),j=(n.i18n.translate("xpack.securitySolution.dataProviders.valuePlaceholder",{defaultMessage:"value"}),n.i18n.translate("xpack.securitySolution.dataProviders.addFieldPopoverButtonLabel",{defaultMessage:"Add field"})),S=n.i18n.translate("xpack.securitySolution.dataProviders.addTemplateFieldPopoverButtonLabel",{defaultMessage:"Add template field"}),k=n.i18n.translate("xpack.securitySolution.dataProviders.templateFieldLabel",{defaultMessage:"Template field"}),O=n.i18n.translate("xpack.securitySolution.dataProviders.queryAreaAriaLabel",{defaultMessage:"You are in the timeline query area, which contains groups of data providers that query for events"}),w=e=>n.i18n.translate("xpack.securitySolution.dataProviders.groupAreaAriaLabel",{values:{group:e},defaultMessage:"You are in group {group}"})},,,function(e,t,a){"use strict";var n=a(368);a.d(t,"e",(function(){return n.d})),a.d(t,"d",(function(){return n.c})),a.d(t,"c",(function(){return n.b}));var i=a(226);a.d(t,"a",(function(){return i.b})),a.d(t,"b",(function(){return i.d}))},,function(e,t,a){const n=a(192);e.exports=(e,t,a)=>n(e,t,a)>=0},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(453);const i=()=>Object(n.a)("endpointPolicyProtections")},,function(e,t,a){"use strict";a.d(t,"a",(function(){return g}));var n=a(2),i=a.n(n),r=a(113),s=a(41),o=a.n(s),l=(a(21),a(40)),c=a(19);const u=({text:e,className:t})=>{const{euiTheme:a}=Object(l.useEuiTheme)();return i.a.createElement(d,{label:null!=e?e:c.a,size:"s",className:t,$_css:a.size.s,$_css2:a.colors.text,$_css3:a.size.xxs})};var d=o()(l.EuiBetaBadge).withConfig({displayName:"_StyledEuiBetaBadge",componentId:"sc-ftlp1b-0"})(["margin-left:",";color:",";vertical-align:middle;margin-bottom:",";"],(e=>e.$_css),(e=>e.$_css2),(e=>e.$_css3)),p=a(800),m=a(1040);const b=({riskScoreEntity:e,title:t,showTechnicalPreviewBadge:a=!1})=>i.a.createElement(i.a.Fragment,null,null!=t?t:e===r.w.user?p.f:p.b,a&&i.a.createElement(u,{text:m.d,className:"eui-alignMiddle"})),g=i.a.memo(b);g.displayName="RiskScoreHeaderTitle"},,function(e,t,a){"use strict";a.d(t,"d",(function(){return s})),a.d(t,"a",(function(){return o})),a.d(t,"f",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"e",(function(){return u})),a.d(t,"b",(function(){return d}));var n=a(4);const i=`${n.gb}/prepackaged`,r=`${n.Cb}/prebuilt_rules`,s=`${i}/_status`,o=`${r}/status`,l=`${r}/upgrade/_review`,c=`${r}/upgrade/_perform`,u=`${r}/installation/_review`,d=`${r}/installation/_perform`},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(2),i=a(13),r=a(102);const s=()=>{const e=Object(r.j)(),{http:t}=e.services,[a,s]=Object(n.useState)(Object(i.createSavedQueryService)(t));return Object(n.useEffect)((()=>{s(Object(i.createSavedQueryService)(t))}),[t]),a}},function(e,t,a){e.exports=a(33)(1061)},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=a(5).i18n.translate("xpack.securitySolution.exitFullScreenButton",{defaultMessage:"Exit full screen"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(2),i=a(45),r=a(105),s=a(187),o=a(110),l=a(116),c=a(122);function u(e){const t=Object(n.useMemo)((()=>Object(s.i)()),[]),a=Object(n.useMemo)((()=>Object(s.b)()),[]),u=Object(n.useMemo)((()=>Object(s.d)()),[]),d=Object(r.a)((t=>u(e?t.inputs.timeline:t.inputs.global))),p=Object(r.a)((a=>t(e?a.inputs.timeline:a.inputs.global))),m=Object(r.a)((t=>a(e?t.inputs.timeline:t.inputs.global))),b=Object(n.useMemo)((()=>c.e.defaultDataViewSelector()),[]),g=Object(r.a)(b),{pathname:f}=Object(i.useLocation)(),{selectedPatterns:y}=Object(l.d)(Object(l.a)(f)),{selectedPatterns:h}=Object(l.d)(o.SourcererScopeName.timeline);return{selectedPatterns:Object(n.useMemo)((()=>e?[...new Set([...h,...g.patternList])]:[...new Set([...y,...g.patternList])]),[e,h,y,g.patternList]),from:p,to:m,shouldUpdate:d}}},function(e,t,a){"use strict";a.d(t,"b",(function(){return n})),a.d(t,"a",(function(){return i})),a.d(t,"c",(function(){return r}));const n={critical:"#E7664C",high:"#DA8B45",medium:"#D6BF57",low:"#54B399"},i=4,r=(e=0)=>Math.ceil(Math.min(e||0,100)/i)},function(e,t,a){"use strict";a.d(t,"a",(function(){return S}));var n=a(2),i=a(103),r=a(5),s=a(129),o=a(120),l=a(214),c=a(133),u=a(102),d=a(118),p=a(106),m=a(111),b=a(1045),g=a(164),f=a(242),y=a(135),h=a(105),v=a(115),E=a(108),x=a(159),j=a(196);const S=({ecsRowData:e,onInvestigateInTimelineAlertClick:t})=>{const{addError:a}=Object(E.a)(),{data:{search:S,query:k}}=Object(u.j)().services,O=Object(i.useDispatch)(),{startTransaction:w}=Object(x.b)(),{services:T}=Object(u.j)(),{getExceptionFilterFromIds:I}=Object(l.c)(T.http),C=Object(n.useCallback)((async e=>{const t=(e=>{var t;let a=null!==(t=Object(v.getField)(e,s.y))&&void 0!==t?t:[],n=[];try{if(Array.isArray(a)&&0===a.length){var i;const t=null!==(i=Object(v.getField)(e,s.G))&&void 0!==i?i:{};if(t.length>0){var r;const e=JSON.parse(t[0]);a=null!==(r=null==e?void 0:e.exceptions_list)&&void 0!==r?r:[]}}else if(a&&a.list_id)return a.list_id.map(((e,t)=>{const n=a.type[t];return{exception_list_id:e,namespace_type:a.namespace_type[t],type:n}})).filter((e=>e.type===o.b.DETECTION))}catch(e){}return n=a.reduce(((e,t)=>{try{const a="string"==typeof t?JSON.parse(t):t;if(a.type===o.b.DETECTION){const t={exception_list_id:a.list_id,namespace_type:a.namespace_type};e.push(t)}}catch{}return e}),[]),n})(e);let n;return t.length>0&&await I({exceptionListIds:t,excludeExceptions:!0,chunkSize:20,alias:"Exceptions",onSuccess:e=>{n=e},onError:e=>{a(e,{title:r.i18n.translate("xpack.securitySolution.detectionEngine.alerts.fetchExceptionFilterFailure",{defaultMessage:"Error fetching exception filter."})})}}),n}),[a,I]),M=Object(n.useMemo)((()=>k.filterManager),[k.filterManager]),_=Object(n.useMemo)((()=>m.b.getTimelineByIdSelector()),[]),{filterManager:F}=Object(h.a)((e=>{var t,a;return null!==(t=_(e,null!==(a=d.c.active)&&void 0!==a?a:""))&&void 0!==t?t:c.b})),A=Object(n.useMemo)((()=>null!=F?F:M),[F,M]),D=Object(n.useCallback)((e=>O(m.a.updateIsLoading(e))),[O]),N=Object(f.a)({timelineId:d.c.active,timelineType:p.l.default}),P=Object(n.useCallback)((({from:e,timeline:t,to:a,ruleNote:n})=>{var i;N(),D({id:d.c.active,isLoading:!1}),Object(g.b)(O)({duplicate:!0,from:e,id:d.c.active,notes:[],timeline:{...t,filterManager:A,indexNames:null!==(i=t.indexNames)&&void 0!==i?i:[],show:!0},to:a,ruleNote:n})()}),[O,A,D,N]),R=Object(n.useCallback)((async()=>{w({name:j.a.INVESTIGATE_IN_TIMELINE}),t&&t(),null!=e&&await Object(b.a)({createTimeline:P,ecsData:e,searchStrategyClient:S,updateTimelineIsLoading:D,getExceptionFilter:C})}),[w,P,e,t,S,D,C]);return{investigateInTimelineActionItems:Object(n.useMemo)((()=>[{key:"investigate-in-timeline-action-item","data-test-subj":"investigate-in-timeline-action-item",disabled:null==e,onClick:R,name:y.h}]),[e,R]),investigateInTimelineAlertClick:R}}},function(e,t,a){"use strict";a.d(t,"d",(function(){return u})),a.d(t,"c",(function(){return d})),a.d(t,"b",(function(){return m})),a.d(t,"a",(function(){return b}));var n=a(42),i=a(49),r=a(106),s=a(150);const o=["host.name","host.hostname","host.domain","host.id","host.ip","client.ip","destination.ip","server.ip","source.ip","network.community_id","user.name","process.name"],l=(e,t,a=console)=>{var n,i;const r=null!==(n=null===(i=t.find((t=>t.field===e)))||void 0===i?void 0:i.values)&&void 0!==n?n:null;return null==r?[]:"string"==typeof r?[r]:Array.isArray(r)&&r.every((e=>"string"==typeof e))?r:(a.trace("Data type that is not a string or string array detected:",r,"when trying to access field:",e,"from data object of:",t),[])},c=(e,t=[])=>{let a=t;return"is"===e.function&&o.includes(e.arguments[0].value)&&(a=[...a,{field:e.arguments[0].value,valueToChange:e.arguments[1].value}]),e.arguments.reduce(((e,t)=>"is"===t.function&&o.includes(t.arguments[0].value)?[...e,{field:t.arguments[0].value,valueToChange:t.arguments[1].value}]:t.arguments?c(t,e):e),a)},u=(e,t,a=r.l.default)=>a===r.l.default?""!==e.trim()?c(Object(i.fromKueryExpression)(e)).reduce(((e,a)=>{const n=l(a.field,t);return n.length?e.replace(a.valueToChange,n[0]):e}),e):"":e.trim(),d=(e,t)=>e.map((e=>{if("phrase"===e.meta.type&&null!=e.meta.key&&o.includes(e.meta.key)){const a=l(e.meta.key,t);a.length&&(e.meta.params={query:a[0]},e.query={match_phrase:{[e.meta.key]:a[0]}})}return e})),p=(e,t,a=r.l.default)=>{if(a!==r.l.template){if(o.includes(e.queryMatch.field)){const a=l(e.queryMatch.field,t);a.length&&(e.id=e.id.replace(e.name,a[0]),e.name=a[0],e.queryMatch.value=a[0],e.queryMatch.displayField=void 0,e.queryMatch.displayValue=void 0)}return e.type=s.a.default,e}if(a===r.l.template){var n;if(e.type===s.a.template&&":"===e.queryMatch.operator){const a=l(e.queryMatch.field,t);return a.length||(e.enabled=!1),e.id=e.id.replace(e.name,a[0]),e.name=a[0],e.queryMatch.value=a[0],e.queryMatch.displayField=void 0,e.queryMatch.displayValue=void 0,e.type=s.a.default,e}return e.type=null!==(n=e.type)&&void 0!==n?n:s.a.default,e}return e},m=(e,t,a=r.l.default)=>e.map((e=>{const i=p(e,t,a);return null==i.and||Object(n.isEmpty)(i.and)||(i.and=i.and.map((e=>p(e,t,a)))),i})),b=(e,t)=>[{range:{"@timestamp":{gte:e,lt:t,format:"strict_date_optional_time"}},meta:{type:"range",disabled:!1,negate:!1,alias:null,key:"@timestamp",params:{gte:e,lt:t,format:"strict_date_optional_time"}},$state:{store:i.FilterStateStore.APP_STATE}}]},function(e,t,a){"use strict";a.d(t,"a",(function(){return g}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(40),l=a(41),c=a.n(l),u=a(488),d=a(107);const p=c()(o.EuiContextMenuItem).withConfig({displayName:"StyledEuiContextMenuItem",componentId:"sc-t3r55d-0"})([".additional-info{display:none;max-width:50%;}&:hover{.additional-info{display:block !important;}}"]),m=c()("div").withConfig({displayName:"StyledEuiFlexItem",componentId:"sc-t3r55d-1"})(["max-width:50%;padding-right:",";"],(e=>e.theme.eui.euiSizeS)),b=c()(o.EuiText).withConfig({displayName:"StyledEuiText",componentId:"sc-t3r55d-2"})(["padding:",";line-height:",";"],(e=>e.theme.eui.euiSizeM),(e=>e.theme.eui.euiFontSizeM)),g=Object(r.memo)((({navigateAppId:e,navigateOptions:t,onClick:a,textTruncate:n,hoverInfo:l,children:c,isNavigationDisabled:g=!1,...f})=>{const y=Object(u.a)(null!=e?e:"",{...t,onClick:a}),h=Object(d.a)(f["data-test-subj"]),v=Object(r.useMemo)((()=>{const e="additional-info "+("object"!=typeof l?"eui-textTruncate":"");return l?s.a.createElement(m,{className:e},l):null}),[l]),E=n?s.a.createElement(s.a.Fragment,null,s.a.createElement("div",i()({className:"eui-textTruncate","data-test-subj":h("truncateWrapper")},"string"==typeof c?{title:c}:{}),c),v):s.a.createElement(s.a.Fragment,null,s.a.createElement(o.EuiFlexItem,null,c),v);return g?s.a.createElement(b,{size:"s",className:"eui-textTruncate","data-test-subj":f["data-test-subj"]},E):s.a.createElement(p,i()({},f,{onClick:e?y:a}),s.a.createElement(o.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},E))}));g.displayName="EuiContextMenuItemNavByRouter"},function(e,t,a){"use strict";a.d(t,"b",(function(){return l})),a.d(t,"a",(function(){return c}));var n=a(46),i=a(102),r=a(173),s=a(504),o=a(934);function l({onError:e,page:t,perPage:a}={page:1,perPage:r.c}){const s=Object(i.i)();return Object(n.useQuery)(["endpointSpecificPolicies",t,a],(()=>Object(o.a)(s,{query:{page:t,perPage:a,withAgentCount:!0}})),e?{onError:e}:void 0)}function c({customQueryOptions:e}){const t=Object(i.i)();return Object(n.useQuery)(["endpointPackageVersion",e],(()=>Object(s.c)(t)),e)}},function(e,t,a){"use strict";a.d(t,"a",(function(){return r})),a.d(t,"e",(function(){return o})),a.d(t,"b",(function(){return l})),a.d(t,"f",(function(){return c})),a.d(t,"d",(function(){return u})),a.d(t,"c",(function(){return d}));var n=a(65);const i="/api/fleet",r=`${i}/package_policies`,s=`${i}/agent_status`,o=(e,t,a)=>e.get(`${r}/${t}`,a),l=(e,t,a)=>e.post(`${r}/_bulk_get`,{...a,body:JSON.stringify({ids:t,ignoreMissing:!0})}),c=(e,t,a,n={})=>e.put(`${r}/${t}`,{...n,body:JSON.stringify(a)}),u=(e,t,a={})=>e.get(s,{...a,query:{policyId:t}}),d=async e=>{const t=n.epmRouteService.getInfoPath("endpoint"),a=(await e.get(t)).item;if(!a)throw new Error("Endpoint package was not found.");return a}},,function(e,t,a){"use strict";a.d(t,"b",(function(){return n.b})),a.d(t,"a",(function(){return n.a})),a.d(t,"c",(function(){return l})),a.d(t,"d",(function(){return u})),a.d(t,"e",(function(){return E})),a.d(t,"g",(function(){return x.b})),a.d(t,"f",(function(){return x.a}));var n=a(172),i=a(43),r=a(128);i.array(r.r);const s=i.exact(i.partial({rule_id:r.E,id:r.z}));i.array(s),i.array(r.A),i.array(r.G),i.array(i.union([r.D,r.ab]));var o=a(112);let l;!function(e){e.Enabled="enabled",e.Disabled="disabled"}(l||(l={}));const c=Object(o.u)("CoverageOverviewRuleActivity",l);let u;!function(e){e.Prebuilt="prebuilt",e.Custom="custom"}(u||(u={}));const d=Object(o.u)("CoverageOverviewRuleSource",u),p=i.partial({search_term:o.k,activity:Object(o.j)(c),source:Object(o.j)(d)}),m=(i.exact(i.partial({filter:p})),i.type({name:i.string,activity:c}));i.exact(i.type({coverage:i.record(i.string,Object(o.j)(i.string)),unmapped_rule_ids:i.array(i.string),rules_data:i.record(i.string,m)})),r.r,r.D,r.D,r.A,r.D,r.D,r.G,r.D;var b=a(120);const g={exported_count:i.number,exported_rules_count:i.number,missing_rules:i.array(i.exact(i.type({rule_id:o.k}))),missing_rules_count:i.number},f=i.intersection([i.exact(i.type({id:o.k,type:o.k})),i.exact(i.partial({reason:i.string}))]),y={exported_action_connector_count:i.number,missing_action_connection_count:i.number,missing_action_connections:i.array(i.exact(i.type({id:o.k,type:o.k}))),excluded_action_connection_count:i.number,excluded_action_connections:i.array(f)};i.intersection([i.exact(i.type(g)),i.exact(i.partial(b.p)),i.exact(i.partial(y))]);var h=a(193);const v=i.array(i.exact(i.type({rule_id:r.E}))),E=(i.union([i.exact(i.type({objects:v})),i.null]),i.exact(i.partial({file_name:h.a,exclude_export_details:o.d})),i.union([i.literal("created_at"),i.literal("createdAt"),i.literal("enabled"),i.literal("execution_summary.last_execution.date"),i.literal("execution_summary.last_execution.metrics.execution_gap_duration_s"),i.literal("execution_summary.last_execution.metrics.total_indexing_duration_ms"),i.literal("execution_summary.last_execution.metrics.total_search_duration_ms"),i.literal("execution_summary.last_execution.status"),i.literal("name"),i.literal("risk_score"),i.literal("riskScore"),i.literal("severity"),i.literal("updated_at"),i.literal("updatedAt")]));i.union([E,i[void 0]]),i.exact(i.partial({fields:r.bb,filter:r.db,sort_field:E,sort_order:r.K,page:h.b,per_page:h.c})),i.exact(i.type({rules_summary:i.type({custom_count:o.n,prebuilt_installed_count:o.n}),aggregated_fields:i.type({tags:i.array(i.string)})})),i.exact(i.partial({overwrite:o.d,overwrite_exceptions:o.d,overwrite_action_connectors:o.d,as_new_list:o.d})),i.exact(i.type({exceptions_success:i.boolean,exceptions_success_count:o.n,exceptions_errors:i.array(r.ab),rules_count:o.n,success:i.boolean,success_count:o.n,errors:i.array(r.ab),action_connectors_errors:i.array(r.ab),action_connectors_warnings:i.array(r.nb),action_connectors_success:i.boolean,action_connectors_success_count:o.n})),i.intersection([r.b,r.T,i.exact(i.type({rule_id:r.E})),i.exact(i.partial({id:r.z,immutable:o.m,updated_at:r.lb,updated_by:r.mb,created_at:r.Y,created_by:r.Z,related_integrations:r.o,required_fields:r.p,revision:r.eb,setup:r.I}))]);var x=a(547);i.array(i.string)},function(e,t,a){"use strict";a.d(t,"a",(function(){return Y})),a.d(t,"b",(function(){return J}));var n=a(2),i=a.n(n),r=a(40),s=a(223),o=a(235),l=a(261),c=a(103),u=a(47),d=a(115),p=a(249),m=a(797),b=a(367),g=a(149),f=a(123),y=a(113),h=a(212),v=a(224),E=a(165),x=a(114),j=a(134),S=a(116),k=a(298),O=a(151),w=a(647),T=a(218),I=a(386),C=a(510),M=a(194),_=a(5);const F=_.i18n.translate("xpack.securitySolution.flyout.entities.failRelatedHostsDescription",{defaultMessage:"Failed to run search on related hosts"});var A=a(124),D=a(162),N=a(117),P=a(191),R=a(225),L=a(1081),B=a(414);const q=Object(T.a)(m.a),z=Object(T.a)(g.c),$=({userName:e,timestamp:t,scopeId:a})=>{const{to:o,from:l,deleteQuery:m,setQuery:T,isInitializing:_}=Object(j.a)(),{selectedPatterns:$}=Object(S.d)(),V=Object(c.useDispatch)(),U=Object(n.useMemo)((()=>`entities-users-details-${Object(u.v4)()}`),[]),H=Object(n.useMemo)((()=>`entities-users-related-hosts-${Object(u.v4)()}`),[]),G=Object(B.a)("entity-analytics"),Q=Object(D.a)().isPlatinumOrTrialLicense&&G,W=Object(n.useCallback)(((e,t)=>{const a=Object(k.a)(e,t);V(Object(O.setAbsoluteRangeDatePicker)({id:x.a.global,from:a.from,to:a.to}))}),[V]),[K,{inspect:Y,userDetails:J,refetch:X}]=Object(I.b)({id:U,startDate:l,endDate:o,userName:e,indexNames:$,skip:0===$.length}),{loading:Z,inspect:ee,relatedHosts:te,totalCount:ae,refetch:ne}=(({userName:e,indexNames:t,from:a,skip:i=!1})=>{const{loading:r,result:s,search:o,refetch:l,inspect:c}=Object(M.a)({factoryQueryType:C.a.relatedHosts,initialResult:{totalCount:0,relatedHosts:[]},errorMessage:F,abort:i}),u=Object(A.a)("riskScoringRoutesEnabled"),d=Object(n.useMemo)((()=>({inspect:c,totalCount:s.totalCount,relatedHosts:s.relatedHosts,refetch:l,loading:r})),[c,l,s.totalCount,s.relatedHosts,r]),p=Object(n.useMemo)((()=>({defaultIndex:t,factoryQueryType:C.a.relatedHosts,userName:e,from:a,isNewRiskScoreModuleAvailable:u})),[t,a,e,u]);return Object(n.useEffect)((()=>{i||o(p)}),[p,o,i]),d})({userName:e,indexNames:$,from:t,skip:0===$.length}),ie=Object(n.useMemo)((()=>[{field:"host",name:s.C,render:e=>i.a.createElement(r.EuiText,{grow:!1,size:"xs"},i.a.createElement(E.c,{data:{value:e,field:"host.name"},mode:E.a.HOVER_RIGHT,triggerId:E.d.DEFAULT,visibleCellActions:5,sourcererScopeId:Object(d.getSourcererScopeId)(a),metadata:{scopeId:a},showActionTooltips:!0},e))},{field:"ip",name:s.B,render:e=>i.a.createElement(v.a,{rowItems:e,attrName:"host.ip",idPrefix:"",isDraggable:!1,render:e=>null!=e?i.a.createElement(f.h,{ip:e}):Object(N.d)()})},...Q?[{field:"risk",name:i.a.createElement(r.EuiToolTip,{content:L.c},i.a.createElement(i.a.Fragment,null,Object(R.b)(y.w.host)," ",i.a.createElement(r.EuiIcon,{color:"subdued",type:"iInCircle",className:"eui-alignTop"}))),truncateText:!1,mobileOptions:{show:!0},sortable:!1,render:e=>null!=e?i.a.createElement(h.b,{severity:e}):Object(N.d)()}]:[]]),[Q,a]),re=Object(n.useMemo)((()=>i.a.createElement(r.EuiFlexGroup,{alignItems:"center",gutterSize:"m"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiIcon,{type:"storage"})),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiTitle,{size:"xxxs"},i.a.createElement(r.EuiText,null,`${s.E}: ${ae}`))))),[ae]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiTitle,{size:"xs"},i.a.createElement("h4",null,s.N)),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(p.a,{header:{title:e,iconType:"user",headerContent:re},expand:{expandable:!0,expandedOnFirstRender:!0},"data-test-subj":P.I},i.a.createElement(r.EuiTitle,{size:"xxs"},i.a.createElement("h5",null,s.L)),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(b.a,{criteriaFields:Object(w.a)(J),startDate:l,endDate:o,skip:_},(({isLoadingAnomaliesData:t,anomaliesData:a,jobNameById:n})=>i.a.createElement(q,{id:U,isInDetailsSidePanel:!1,data:J,anomaliesData:a,isLoadingAnomaliesData:t,loading:K,startDate:l,endDate:o,narrowDateRange:W,setQuery:T,refetch:X,inspect:Y,userName:e,indexPatterns:$,jobNameById:n}))),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(r.EuiPanel,{hasBorder:!0},i.a.createElement(r.EuiFlexGroup,{direction:"row",gutterSize:"xs",alignItems:"center"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiTitle,{size:"xxs"},i.a.createElement("h5",null,s.E))),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiToolTip,{content:s.F(e)},i.a.createElement(r.EuiIcon,{color:"subdued",type:"iInCircle",className:"eui-alignTop"})))),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(z,{id:H,inspect:ee,loading:Z,setQuery:T,deleteQuery:m,refetch:ne},i.a.createElement(r.EuiInMemoryTable,{columns:ie,items:te,loading:Z,"data-test-subj":P.H,pagination:{pageSize:4,showPerPageOptions:!1},message:s.D}),i.a.createElement(g.b,{queryId:H,title:s.E,inspectIndex:0})))))};var V=a(879),U=a(663);const H=_.i18n.translate("xpack.securitySolution.flyout.entities.failRelatedUsersDescription",{defaultMessage:"Failed to run search on related users"});var G=a(1388);const Q=Object(T.a)(V.a),W=Object(T.a)(g.c),K=({hostName:e,timestamp:t,scopeId:a})=>{const{to:o,from:l,deleteQuery:m,setQuery:T,isInitializing:I}=Object(j.a)(),{selectedPatterns:_}=Object(S.d)(),F=Object(c.useDispatch)(),L=Object(n.useMemo)((()=>`entities-hosts-details-${Object(u.v4)()}`),[]),q=Object(n.useMemo)((()=>`entities-hosts-related-users-${Object(u.v4)()}`),[]),z=Object(B.a)("entity-analytics"),$=Object(D.a)().isPlatinumOrTrialLicense&&z,V=Object(n.useCallback)(((e,t)=>{const a=Object(k.a)(e,t);F(Object(O.setAbsoluteRangeDatePicker)({id:x.a.global,from:a.from,to:a.to}))}),[F]),[K,{inspect:Y,hostDetails:J,refetch:X}]=Object(U.b)({id:L,startDate:l,endDate:o,hostName:e,indexNames:_,skip:0===_.length}),{loading:Z,inspect:ee,relatedUsers:te,totalCount:ae,refetch:ne}=(({hostName:e,indexNames:t,from:a,skip:i=!1})=>{const r=Object(A.a)("riskScoringRoutesEnabled"),{loading:s,result:o,search:l,refetch:c,inspect:u}=Object(M.a)({factoryQueryType:C.a.relatedUsers,initialResult:{totalCount:0,relatedUsers:[]},errorMessage:H,abort:i}),d=Object(n.useMemo)((()=>({inspect:u,totalCount:o.totalCount,relatedUsers:o.relatedUsers,refetch:c,loading:s})),[u,c,o.totalCount,o.relatedUsers,s]),p=Object(n.useMemo)((()=>({defaultIndex:t,factoryQueryType:C.a.relatedUsers,hostName:e,from:a,isNewRiskScoreModuleAvailable:r})),[t,a,e,r]);return Object(n.useEffect)((()=>{i||l(p)}),[p,l,i]),d})({hostName:e,indexNames:_,from:t,skip:0===_.length}),ie=Object(n.useMemo)((()=>[{field:"user",name:s.C,render:e=>i.a.createElement(r.EuiText,{grow:!1,size:"xs"},i.a.createElement(E.c,{data:{field:"user.name",value:e},mode:E.a.HOVER_RIGHT,triggerId:E.d.DEFAULT,visibleCellActions:5,sourcererScopeId:Object(d.getSourcererScopeId)(a),metadata:{scopeId:a},showActionTooltips:!0},e))},{field:"ip",name:s.B,render:e=>i.a.createElement(v.a,{rowItems:e,attrName:"host.ip",idPrefix:"",isDraggable:!1,render:e=>null!=e?i.a.createElement(f.h,{ip:e}):Object(N.d)()})},...$?[{field:"risk",name:i.a.createElement(r.EuiToolTip,{content:G.i},i.a.createElement(i.a.Fragment,null,Object(R.b)(y.w.user)," ",i.a.createElement(r.EuiIcon,{color:"subdued",type:"iInCircle",className:"eui-alignTop"}))),truncateText:!1,mobileOptions:{show:!0},sortable:!1,render:e=>null!=e?i.a.createElement(h.b,{severity:e}):Object(N.d)()}]:[]]),[$,a]),re=Object(n.useMemo)((()=>i.a.createElement(r.EuiFlexGroup,{alignItems:"center",gutterSize:"s"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiIcon,{type:"user"})),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiTitle,{size:"xxxs"},i.a.createElement(r.EuiText,null,`${s.H}: ${ae}`))))),[ae]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiTitle,{size:"xs"},i.a.createElement("h4",null,s.m)),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(p.a,{header:{title:e,iconType:"storage",headerContent:re},expand:{expandable:!0,expandedOnFirstRender:!0},"data-test-subj":P.m},i.a.createElement(r.EuiTitle,{size:"xxs"},i.a.createElement("h5",null,s.k)),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(b.a,{criteriaFields:Object(w.a)(J),startDate:l,endDate:o,skip:I},(({isLoadingAnomaliesData:t,anomaliesData:a,jobNameById:n})=>i.a.createElement(Q,{id:L,hostName:e,data:J,indexNames:_,jobNameById:n,anomaliesData:a,isLoadingAnomaliesData:t,isInDetailsSidePanel:!1,loading:K,startDate:l,endDate:o,narrowDateRange:V,setQuery:T,refetch:X,inspect:Y,deleteQuery:m}))),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(r.EuiPanel,{hasBorder:!0},i.a.createElement(r.EuiFlexGroup,{direction:"row",gutterSize:"xs",alignItems:"center"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiTitle,{size:"xxs"},i.a.createElement("h5",null,s.H))),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiToolTip,{content:s.I(e)},i.a.createElement(r.EuiIcon,{color:"subdued",type:"iInCircle",className:"eui-alignTop"})))),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(W,{id:q,inspect:ee,loading:Z,setQuery:T,deleteQuery:m,refetch:ne},i.a.createElement(r.EuiInMemoryTable,{columns:ie,items:te,loading:Z,"data-test-subj":P.l,pagination:{pageSize:4,showPerPageOptions:!1},message:s.G}),i.a.createElement(g.b,{queryId:q,title:s.H,inspectIndex:0})))))};K.displayName="HostDetails";const Y="entities-details",J=()=>{const{getFieldsData:e,scopeId:t}=Object(o.b)(),a=Object(l.a)(e("host.name")),n=Object(l.a)(e("user.name")),c=Object(l.a)(e("@timestamp")),u=c&&(a||n),d=n&&c,p=a&&c;return i.a.createElement(i.a.Fragment,null,u?i.a.createElement(r.EuiFlexGroup,{direction:"column",gutterSize:"m","data-test-subj":P.k},d&&i.a.createElement(r.EuiFlexItem,null,i.a.createElement($,{userName:n,timestamp:c,scopeId:t})),p&&i.a.createElement(r.EuiFlexItem,null,i.a.createElement(K,{hostName:a,timestamp:c,scopeId:t}))):i.a.createElement("div",{"data-test-subj":P.j},s.j))};J.displayName="EntitiesDetails"},function(e,t,a){"use strict";a.d(t,"b",(function(){return n.a})),a.d(t,"a",(function(){return i.a})),a.d(t,"c",(function(){return r}));var n=a(425),i=a(705);let r;!function(e){e.observedDetails="observedUserDetails",e.managedDetails="managedUserDetails",e.kpiTotalUsers="usersKpiTotalUsers",e.users="allUsers",e.authentications="authentications",e.kpiAuthentications="usersKpiAuthentications"}(r||(r={}))},function(e,t,a){"use strict";a.d(t,"b",(function(){return l})),a.d(t,"a",(function(){return x})),a.d(t,"c",(function(){return k}));var n=a(141),i=a(60),r=a(51),s=a(408);const o=Object(n.d)((e=>(({data:e,defaultIndex:t,eventFields:a,filterQuery:n,timerange:i,signal:r})=>e.search.search({defaultIndex:t,eventFields:a,factoryQueryType:s.a.eventEnrichment,filterQuery:n,timerange:i},{strategy:"securitySolutionSearchStrategy",abortSignal:r}))(e).pipe(Object(i.filter)((e=>Object(r.isErrorResponse)(e)||Object(r.isCompleteResponse)(e)))))),l=()=>Object(n.c)(o);var c=a(2),u=a(103),d=a(8),p=a(246),m=a.n(p),b=a(114),g=a(167),f=a(108),y=a(102),h=a(182);const v=a(5).i18n.translate("xpack.securitySolution.investigationEnrichment.requestError",{defaultMessage:"An error occurred while requesting threat intelligence"});var E=a(4);const x="investigation_time_enrichment",j=()=>{},S={enrichments:[]},k=e=>{const{addError:t}=Object(f.a)(),{data:a,uiSettings:n}=Object(y.j)().services,i=n.get(E.T),r=Object(u.useDispatch)(),[s,o]=Object(c.useState)({from:g.a,to:g.b}),{error:p,loading:k,result:O,start:w}=l(),T=Object(c.useCallback)((()=>{r(h.c.deleteOneQuery({inputId:b.a.global,id:x}))}),[r]);Object(c.useEffect)((()=>(!k&&O&&r(h.c.setQuery({inputId:b.a.global,id:x,inspect:{dsl:O.inspect.dsl,response:[JSON.stringify(O.rawResponse,null,2)]},loading:k,refetch:j})),T)),[T,r,k,O]),Object(c.useEffect)((()=>{p&&t(p,{title:v})}),[t,p]);const I=m()(e),C=m()(s);return Object(c.useEffect)((()=>{Object(d.isEmpty)(e)||Object(d.isEqual)(e,I)&&Object(d.isEqual)(s,C)||w({data:a,timerange:{...s,interval:""},defaultIndex:i,eventFields:e,filterQuery:""})}),[w,a,e,I,s,C,i]),{result:Object(d.isEmpty)(e)?S:O,range:s,setRange:o,loading:k}}},function(e,t,a){"use strict";let n;a.d(t,"a",(function(){return n})),function(e){e.relatedHosts="relatedHosts",e.relatedUsers="relatedUsers"}(n||(n={}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return f}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(40),l=a(46),c=a(102),u=a(44);const d=({handleClick:e})=>i.a.createElement(o.EuiFlexGroup,{justifyContent:"flexEnd"},i.a.createElement(o.EuiFlexItem,{grow:!1},i.a.createElement(o.EuiButtonEmpty,{onClick:e,"data-test-subj":"osquery-empty-button"},i.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.footer.cancel",defaultMessage:"Cancel"})))),p=i.a.memo(d);var m=a(677);const b=s.a.div.withConfig({displayName:"OsqueryActionWrapper",componentId:"sc-flf6q3-0"})(["padding:8px;"]),g=({agentId:e,defaultValues:t,onClose:a,ecsData:r})=>{const{services:{osquery:s}}=Object(c.j)(),u=Object(l.useQueryClient)(),d=Object(n.useCallback)((()=>{var e;u.invalidateQueries({queryKey:["actions",{alertId:null==t||null===(e=t.alertIds)||void 0===e?void 0:e[0]}]})}),[null==t?void 0:t.alertIds,u]);return null!=s&&s.OsqueryAction?i.a.createElement(o.EuiFlyout,{size:"m",onClose:a},i.a.createElement(o.EuiFlyoutHeader,{hasBorder:!0,"data-test-subj":"flyout-header-osquery"},i.a.createElement(o.EuiTitle,null,i.a.createElement("h2",null,m.a))),i.a.createElement(o.EuiFlyoutBody,null,i.a.createElement(b,{"data-test-subj":"flyout-body-osquery"},i.a.createElement(s.OsqueryAction,{agentId:e,formType:"steps",defaultValues:t,ecsData:r,onSuccess:d}))),i.a.createElement(o.EuiFlyoutFooter,null,i.a.createElement(p,{handleClick:a,"data-test-subj":"flyout-footer-osquery"}))):null},f=i.a.memo(g)},,function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.indexFieldsSearch.errorSearchDescription",{defaultMessage:"An error has occurred creating the ad-hoc data view"}),r=n.i18n.translate("xpack.securitySolution.dataView.fetchFields.warning",{defaultMessage:"Failed to fetch detailed fields information"})},function(e,t,a){"use strict";a.r(t),a.d(t,"registerUrlParam",(function(){return r})),a.d(t,"deregisterUrlParam",(function(){return s})),a.d(t,"updateUrlParam",(function(){return o}));var n=a(22);const i=a.n(n)()("x-pack/security_solution/local/global_url_param"),r=i("REGISTER_URL_PARAM"),s=i("DEREGISTER_URL_PARAM"),o=i("UPDATE_URL_PARAM")},function(e,t,a){"use strict";a.r(t),a.d(t,"selectNotesById",(function(){return o})),a.d(t,"getNotes",(function(){return c})),a.d(t,"getNotesAsCommentsList",(function(){return u})),a.d(t,"selectNotesByIdSelector",(function(){return d})),a.d(t,"notesByIdsSelector",(function(){return p})),a.d(t,"selectNotesAsCommentsListSelector",(function(){return m})),a.d(t,"errorsSelector",(function(){return b}));var n=a(42),i=a(240),r=a.n(i),s=a(139);const o=e=>e.app.notesById,l=e=>e.app.errors,c=r()(((e,t)=>Object(n.keys)(e).reduce(((a,n)=>{if(t.includes(n)){const t=e[n];return[...a,t]}return a}),[]))),u=e=>Object(n.values)(e).map((e=>{var t;return{eventId:e.eventId,savedObjectId:e.saveObjectId,note:e.note,noteId:e.id,updated:(null!==(t=e.lastEdit)&&void 0!==t?t:e.created).getTime(),updatedBy:e.user}})),d=Object(s.createSelector)(o,(e=>e)),p=()=>Object(s.createSelector)(o,(e=>e)),m=()=>Object(s.createSelector)(o,u),b=()=>Object(s.createSelector)(l,(e=>e))},function(e,t,a){"use strict";var n=a(1155),i={"text/plain":"Text","text/html":"Url",default:"Text"};e.exports=function(e,t){var a,r,s,o,l,c,u=!1;t||(t={}),a=t.debug||!1;try{if(s=n(),o=document.createRange(),l=document.getSelection(),(c=document.createElement("span")).textContent=e,c.style.all="unset",c.style.position="fixed",c.style.top=0,c.style.clip="rect(0, 0, 0, 0)",c.style.whiteSpace="pre",c.style.webkitUserSelect="text",c.style.MozUserSelect="text",c.style.msUserSelect="text",c.style.userSelect="text",c.addEventListener("copy",(function(n){if(n.stopPropagation(),t.format)if(n.preventDefault(),void 0===n.clipboardData){a&&console.warn("unable to use e.clipboardData"),a&&console.warn("trying IE specific stuff"),window.clipboardData.clearData();var r=i[t.format]||i.default;window.clipboardData.setData(r,e)}else n.clipboardData.clearData(),n.clipboardData.setData(t.format,e);t.onCopy&&(n.preventDefault(),t.onCopy(n.clipboardData))})),document.body.appendChild(c),o.selectNodeContents(c),l.addRange(o),!document.execCommand("copy"))throw new Error("copy command was unsuccessful");u=!0}catch(n){a&&console.error("unable to copy using execCommand: ",n),a&&console.warn("trying IE specific stuff");try{window.clipboardData.setData(t.format||"text",e),t.onCopy&&t.onCopy(window.clipboardData),u=!0}catch(n){a&&console.error("unable to copy using clipboardData: ",n),a&&console.error("falling back to prompt"),r=function(e){var t=(/mac os x/i.test(navigator.userAgent)?"⌘":"Ctrl")+"+C";return e.replace(/#{\s*key\s*}/g,t)}("message"in t?t.message:"Copy to clipboard: #{key}, Enter"),window.prompt(r,e)}}finally{l&&("function"==typeof l.removeRange?l.removeRange(o):l.removeAllRanges()),c&&document.body.removeChild(c),s()}return u}},,function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"a",(function(){return r}));var n=a(119);a(4);const i=e=>({hasQuery:null!=e.kqlQuery&&null!=e.kqlQuery.filterQuery&&null!=e.kqlQuery.filterQuery.kuery&&""!==e.kqlQuery.filterQuery.kuery.expression||null!=e.dataProviders&&e.dataProviders.length>0||null!=e.filters&&e.filters.length>0,hasEql:null!=e.eqlOptions&&null!=e.eqlOptions.query&&e.eqlOptions.query.length>0}),r=[n.e.alertsOnAlertsPage,n.e.alertsOnRuleDetailsPage]},function(e,t,a){"use strict";a.d(t,"d",(function(){return l})),a.d(t,"b",(function(){return c})),a.d(t,"c",(function(){return u})),a.d(t,"a",(function(){return d}));var n=a(2),i=a.n(n),r=a(365);const s=Object(r.c)(),o=Object(r.c)(),l=()=>{const[e]=Object(n.useState)(s);return{portalNode:e}},c=i.a.memo((()=>{const{portalNode:e}=l();return i.a.createElement(r.b,{node:e})}));c.displayName="TimelineEventsCountBadge";const u=()=>{const[e]=Object(n.useState)(o);return{portalNode:e}},d=i.a.memo((()=>{const{portalNode:e}=u();return i.a.createElement(r.b,{node:e})}));d.displayName="EqlEventsCountBadge"},function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(104),i=a.n(n),r=a(41),s=a.n(r),o=a(2),l=a.n(o),c=a(40);const u=s()((({loading:e,...t})=>l.a.createElement(c.EuiPanel,i()({},t,{hasBorder:!0})))).withConfig({displayName:"Panel",componentId:"sc-h09jgf-0"})(["position:relative;",""],(({loading:e})=>e&&"\n    overflow: hidden;\n  "));u.displayName="Panel"},function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"b",(function(){return i})),a.d(t,"d",(function(){return r})),a.d(t,"c",(function(){return s}));const n="kibana.alert.rule.name",i="host.name",r=300,s=500},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"f",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"d",(function(){return o})),a.d(t,"a",(function(){return l})),a.d(t,"e",(function(){return c}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.threatMatch.fieldDescription",{defaultMessage:"Field"}),r=n.i18n.translate("xpack.securitySolution.threatMatch.threatFieldDescription",{defaultMessage:"Indicator index field"}),s=n.i18n.translate("xpack.securitySolution.threatMatch.fieldPlaceholderDescription",{defaultMessage:"Search"}),o=n.i18n.translate("xpack.securitySolution.threatMatch.matchesLabel",{defaultMessage:"MATCHES"}),l=n.i18n.translate("xpack.securitySolution.threatMatch.andDescription",{defaultMessage:"AND"}),c=n.i18n.translate("xpack.securitySolution.threatMatch.orDescription",{defaultMessage:"OR"})},function(e,t,a){"use strict";a.r(t),a.d(t,"updateNetworkTable",(function(){return r})),a.d(t,"setNetworkDetailsTablesActivePageToZero",(function(){return s})),a.d(t,"setNetworkTablesActivePageToZero",(function(){return o})),a.d(t,"updateNetworkAnomaliesJobIdFilter",(function(){return l})),a.d(t,"updateNetworkAnomaliesInterval",(function(){return c}));var n=a(22);const i=a.n(n)()("x-pack/security_solution/local/network"),r=i("UPDATE_NETWORK_TABLE"),s=i("SET_IP_DETAILS_TABLES_ACTIVE_PAGE_TO_ZERO"),o=i("SET_NETWORK_TABLES_ACTIVE_PAGE_TO_ZERO"),l=i("UPDATE_NETWORK_ANOMALIES_JOB_ID_FILTER"),c=i("UPDATE_NETWORK_ANOMALIES_INTERVAL")},function(e,t,a){"use strict";a.r(t),a.d(t,"setUsersTablesActivePageToZero",(function(){return r})),a.d(t,"setUsersDetailsTablesActivePageToZero",(function(){return s})),a.d(t,"updateTableLimit",(function(){return o})),a.d(t,"updateTableActivePage",(function(){return l})),a.d(t,"updateTableSorting",(function(){return c})),a.d(t,"updateUserRiskScoreSeverityFilter",(function(){return u})),a.d(t,"updateUsersAnomaliesJobIdFilter",(function(){return d})),a.d(t,"updateUsersAnomaliesInterval",(function(){return p}));var n=a(22);const i=a.n(n)()("x-pack/security_solution/local/users"),r=i("SET_USERS_TABLES_ACTIVE_PAGE_TO_ZERO"),s=i("SET_USERS_DETAILS_TABLES_ACTIVE_PAGE_TO_ZERO"),o=i("UPDATE_USERS_TABLE_LIMIT"),l=i("UPDATE_USERS_ACTIVE_PAGE"),c=i("UPDATE_USERS_SORTING"),u=i("UPDATE_USERS_RISK_SEVERITY_FILTER"),d=i("UPDATE_USERS_ANOMALIES_JOB_ID_FILTER"),p=i("UPDATE_USERS_ANOMALIES_INTERVAL")},function(e,t,a){"use strict";a.r(t),a.d(t,"updateTableActivePage",(function(){return r})),a.d(t,"setHostTablesActivePageToZero",(function(){return s})),a.d(t,"setHostDetailsTablesActivePageToZero",(function(){return o})),a.d(t,"updateTableLimit",(function(){return l})),a.d(t,"updateHostsSort",(function(){return c})),a.d(t,"updateHostRiskScoreSort",(function(){return u})),a.d(t,"updateHostRiskScoreSeverityFilter",(function(){return d})),a.d(t,"updateHostsAnomaliesJobIdFilter",(function(){return p})),a.d(t,"updateHostsAnomaliesInterval",(function(){return m}));var n=a(22);const i=a.n(n)()("x-pack/security_solution/local/hosts"),r=i("UPDATE_HOST_TABLE_ACTIVE_PAGE"),s=i("SET_HOST_TABLES_ACTIVE_PAGE_TO_ZERO"),o=i("SET_HOST_DETAILS_TABLES_ACTIVE_PAGE_TO_ZERO"),l=i("UPDATE_HOST_TABLE_LIMIT"),c=i("UPDATE_HOSTS_SORT"),u=i("UPDATE_HOST_RISK_SCORE_SORT"),d=i("UPDATE_HOST_RISK_SCORE_SEVERITY"),p=i("UPDATE_HOSTS_ANOMALIES_JOB_ID_FILTER"),m=i("UPDATE_HOSTS_ANOMALIES_INTERVAL")},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(2),i=a.n(n),r=a(44),s=a(40),o=a(222);const l=i.a.memo((()=>i.a.createElement(o.a,null,i.a.createElement(s.EuiPageTemplate_Deprecated,{template:"centeredContent"},i.a.createElement(s.EuiEmptyPrompt,{"data-test-subj":"notFoundPage",iconColor:"default",iconType:"logoElastic",title:i.a.createElement("p",null,i.a.createElement(r.FormattedMessage,{id:"xpack.securitySolution.pages.fourohfour.pageNotFoundDescription",defaultMessage:"Page not found"}))})))));l.displayName="NotFoundPage"},function(e,t,a){"use strict";a.r(t),a.d(t,"listData",(function(){return p})),a.d(t,"pageIndex",(function(){return m})),a.d(t,"pageSize",(function(){return b})),a.d(t,"sortField",(function(){return g})),a.d(t,"sortDirection",(function(){return f})),a.d(t,"totalHits",(function(){return y})),a.d(t,"listLoading",(function(){return h})),a.d(t,"listError",(function(){return v})),a.d(t,"policyItems",(function(){return E})),a.d(t,"policyItemsLoading",(function(){return x})),a.d(t,"selectedPolicyId",(function(){return j})),a.d(t,"endpointPackageInfo",(function(){return S})),a.d(t,"getIsEndpointPackageInfoUninitialized",(function(){return k})),a.d(t,"isAutoRefreshEnabled",(function(){return O})),a.d(t,"autoRefreshInterval",(function(){return w})),a.d(t,"endpointPackageVersion",(function(){return T})),a.d(t,"patterns",(function(){return I})),a.d(t,"patternsError",(function(){return C})),a.d(t,"isOnEndpointPage",(function(){return M})),a.d(t,"uiQueryParams",(function(){return _})),a.d(t,"hasSelectedEndpoint",(function(){return F})),a.d(t,"showView",(function(){return A})),a.d(t,"nonExistingPolicies",(function(){return D})),a.d(t,"agentPolicies",(function(){return N})),a.d(t,"endpointsExist",(function(){return P})),a.d(t,"searchBarQuery",(function(){return R})),a.d(t,"getCurrentIsolationRequestState",(function(){return L})),a.d(t,"getIsIsolationRequestPending",(function(){return B})),a.d(t,"getWasIsolationRequestSuccessful",(function(){return q})),a.d(t,"getIsolationRequestError",(function(){return z})),a.d(t,"getIsOnEndpointDetailsActivityLog",(function(){return $})),a.d(t,"getEndpointPendingActionsState",(function(){return V})),a.d(t,"getMetadataTransformStats",(function(){return U})),a.d(t,"metadataTransformStats",(function(){return H})),a.d(t,"isMetadataTransformStatsLoading",(function(){return G})),a.d(t,"getEndpointPendingActionsCallback",(function(){return Q}));var n=a(933),i=a.n(n),r=a(139),s=a(45),o=a(56),l=a(245),c=a(173),u=a(1064),d=a(1442);const p=e=>e.hosts,m=e=>e.pageIndex,b=e=>e.pageSize,g=e=>e.sortField,f=e=>e.sortDirection,y=e=>e.total,h=e=>e.loading,v=e=>e.error,E=e=>e.policyItems,x=e=>e.policyItemsLoading,j=e=>e.selectedPolicyId,S=e=>e.endpointPackageInfo,k=Object(r.createSelector)(S,(e=>Object(u.i)(e))),O=e=>e.isAutoRefreshEnabled,w=e=>e.autoRefreshInterval,T=Object(r.createSelector)(S,(e=>Object(u.g)(e)?e.data.version:void 0)),I=e=>e.patterns,C=e=>e.patternsError,M=e=>{var t,a;return null!==Object(s.matchPath)(null!==(t=null===(a=e.location)||void 0===a?void 0:a.pathname)&&void 0!==t?t:"",{path:c.h,exact:!0})},_=Object(r.createSelector)((e=>e.location),(e=>{const t={page_index:String(c.b),page_size:String(c.c)};if(e){const a=i.a.parse(e.search.slice(1)),n=Object(l.a)(a),r=["selected_endpoint","show","admin_query","sort_field","sort_direction"],s=["policy_response","details","isolate","unisolate","activity_log"];for(const e of r){const n="string"==typeof a[e]?a[e]:Array.isArray(a[e])?a[e][a[e].length-1]:void 0;void 0!==n&&("show"===e?s.includes(n)&&(t[e]=n):"sort_direction"===e?["asc","desc"].includes(n)&&(t[e]=n):t[e]=n)}t.page_size=String(n.page_size),t.page_index=String(n.page_index)}return t})),F=Object(r.createSelector)(_,(({selected_endpoint:e})=>void 0!==e)),A=Object(r.createSelector)(_,(e=>{var t;return null!==(t=e.show)&&void 0!==t?t:"details"})),D=e=>e.nonExistingPolicies,N=e=>e.agentPolicies,P=e=>e.endpointsExist,R=Object(r.createSelector)(_,(({admin_query:e})=>{const t={query:"",language:"kuery"};if(e){const a=Object(o.decode)(e);a&&"string"==typeof a.query&&(t.query=a.query),!a||"string"!=typeof a.language||"kuery"!==a.language&&"lucene"!==a.language||(t.language=a.language)}return t})),L=e=>e.isolationRequestState,B=Object(r.createSelector)(L,(e=>Object(u.h)(e))),q=Object(r.createSelector)(L,(e=>Object(u.g)(e))),z=Object(r.createSelector)(L,(e=>{if(Object(u.f)(e))return e.error})),$=Object(r.createSelector)(_,(e=>e.show===d.b.activityLog)),V=e=>e.endpointPendingActions,U=e=>e.metadataTransformStats,H=e=>Object(u.g)(e.metadataTransformStats)?e.metadataTransformStats.data:[],G=e=>Object(u.h)(e.metadataTransformStats),Q=Object(r.createSelector)(V,(e=>t=>{let a={};var n;return Object(u.g)(e)&&(a=null!==(n=e.data.get(t))&&void 0!==n?n:{}),a}))},function(e,t,a){"use strict";a.d(t,"c",(function(){return qe})),a.d(t,"a",(function(){return Ue})),a.d(t,"b",(function(){return Ge}));var n=a(40),i=a(2),r=a.n(i),s=a(44),o=a(52),l=a(197),c=a(124),u=a(8),d=a(839),p=a.n(d),m=a(45),b=a(41),g=a.n(b);const f=r.a.memo((({onClick:e,queriesLength:t})=>{const[a,o]=Object(i.useState)(!1),l=Object(i.useCallback)((()=>{e(),o(!0)}),[e]);return a?null:r.a.createElement(y,{color:"primary",paddingSize:"xs"},r.a.createElement(h,{direction:"row",alignItems:"center"},r.a.createElement(n.EuiFlexItem,{grow:!0},r.a.createElement(n.EuiText,{size:"s"},r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.responseActionsList.investigationGuideSuggestion",defaultMessage:"You have {queriesLength, plural, one {a query} other {queries}} in the investigation guide. Add {queriesLength, plural, one {it as a response action} other {them as response actions}}?",values:{queriesLength:t}}))),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiButtonEmpty,{size:"m",color:"primary",onClick:l,"data-test-subj":"osqueryAddInvestigationGuideQueries"},r.a.createElement(n.EuiText,{size:"s"},r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.responseActionsList.addButton",defaultMessage:"Add"}))))))}));f.displayName="OsqueryInvestigationGuidePanel";var y=g()(n.EuiPanel).withConfig({displayName:"_StyledEuiPanel",componentId:"sc-10xybv0-0"})(["",""],{marginBottom:"16px"}),h=g()(n.EuiFlexGroup).withConfig({displayName:"_StyledEuiFlexGroup",componentId:"sc-10xybv0-1"})(["",""],{padding:"0 24px"}),v=a(600),E=a(5),x=a(938),j=a(702),S=a(126),k=a(67);const O={label:E.i18n.translate("xpack.securitySolution.responseActions.endpoint.commentLabel",{defaultMessage:"Comment (optional)"}),helpText:r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.responseActions.endpoint.commentDescription",defaultMessage:"Leave a note that explains or describes the action. You can see your comment in the response actions history log."})},w=({basePath:e,disabled:t,readDefaultValueOnForm:a})=>r.a.createElement(o.UseField,{path:`${e}.comment`,readDefaultValueOnForm:a,config:O,isDisabled:t,component:k.TextField}),T=r.a.memo(w);var I=a(75),C=a(102);E.i18n.translate("xpack.securitySolution.endpoint.action.permissionDenied",{defaultMessage:"Permission denied"});const M=E.i18n.translate("xpack.securitySolution.endpoint.action.chooseFromTheList",{defaultMessage:"Choose action from the list"}),_=E.i18n.translate("xpack.securitySolution.responseActions.endpoint.commentLearnMore",{defaultMessage:"Learn more"}),F=({name:e,isDisabled:t})=>{const{title:a,description:i,tooltip:s}=A(e),o=r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiTitle,{size:"xs"},r.a.createElement(n.EuiText,null,a)),r.a.createElement(n.EuiSpacer,{size:"xs"}),r.a.createElement(n.EuiText,null,i));return t?r.a.createElement(n.EuiToolTip,{position:"top",content:s},o):o},A=e=>"isolate"===e?{title:r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.responseActions.endpoint.isolate",defaultMessage:"Isolate"}),description:r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.responseActions.endpoint.isolateDescription",defaultMessage:"Quarantine a host from the network to prevent further spread of threats and limit potential damage"}),tooltip:r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.responseActions.endpoint.isolateTooltip",defaultMessage:"Insufficient privileges to isolate hosts. Contact your Kibana administrator if you think you should have this permission."})}:{title:"",description:"",tooltip:""},D=r.a.memo(F);var N=a(493);const P=({basePath:e,disabled:t,readDefaultValueOnForm:a})=>{const{endpointPrivileges:l}=Object(S.a)(),[c]=Object(o.useFormData)(),{docLinks:{links:{securitySolution:{responseActions:d}}}}=Object(C.j)().services,p=Object(i.useMemo)((()=>N.a.map((e=>{const t=!Object(x.b)({commandName:Object(j.d)(e),privileges:l}),a=Object(u.map)(c.responseActions,"params.command").includes(e)||t;return{value:e,inputDisplay:e,dropdownDisplay:r.a.createElement(D,{name:e,isDisabled:t}),disabled:a,"data-test-subj":`command-type-${e}`}}))),[c.responseActions,l]);return r.a.createElement(o.UseField,{path:`${e}.command`,readDefaultValueOnForm:a,config:{label:E.i18n.translate("xpack.securitySolution.responseActions.endpoint.commandLabel",{defaultMessage:"Response action"}),helpText:r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.responseActions.endpoint.commandDescription",defaultMessage:"Select an endpoint response action. The response action only runs on hosts with Elastic Defend installed. {docs}",values:{docs:r.a.createElement(n.EuiLink,{href:d,target:"_blank"},_)}}),validations:[{validator:I.fieldValidators.emptyField(E.i18n.translate("xpack.securitySolution.responseActions.endpoint.validations.commandIsRequiredErrorMessage",{defaultMessage:"Action is a required field."}))}]},component:k.SuperSelectField,isDisabled:t,componentProps:{euiFieldProps:{options:p,placeholder:M,"data-test-subj":"commandTypeField"}}})},R=r.a.memo(P),L=({basePath:e,editDisabled:t})=>{const[a]=Object(o.useFormData)(),i=Object(u.get)(a,`${e}.command`);return t?r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiSpacer,{size:"s"}),r.a.createElement(n.EuiCallOut,{color:"warning",iconType:"warning",title:r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.responseActionsList.endpoint.privileges",defaultMessage:"Insufficient privileges"})},r.a.createElement(n.EuiText,{size:"xs"},r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.responseActions.endpoint.isolateTooltip",defaultMessage:"Insufficient privileges to isolate hosts. Contact your Kibana administrator if you think you should have this permission."}))),r.a.createElement(n.EuiSpacer,{size:"s"})):"isolate"===i?r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiSpacer,{size:"s"}),r.a.createElement(n.EuiCallOut,{color:"warning",iconType:"warning",title:r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.responseActionsList.endpoint.cautionTitle",defaultMessage:"Proceed with caution"})},r.a.createElement(n.EuiText,{size:"xs"},r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.responseActionsList.endpoint.cautionDescription",defaultMessage:"Only select this option if you’re certain that you want to automatically block communication with other hosts on your network until you release this host."}))),r.a.createElement(n.EuiSpacer,{size:"s"})):r.a.createElement(r.a.Fragment,null)},B=r.a.memo(L),q=r.a.memo((e=>{const t=`${e.item.path}.params`;return r.a.createElement(r.a.Fragment,null,r.a.createElement(R,{basePath:t,disabled:e.editDisabled,readDefaultValueOnForm:!e.item.isNew}),r.a.createElement(B,{basePath:t,editDisabled:e.editDisabled}),r.a.createElement(T,{basePath:t,disabled:e.editDisabled,readDefaultValueOnForm:!e.item.isNew}))}));q.displayName="EndpointResponseAction";var z=a(238),$=a(141),V=a(453),U=a(36);const H=r.a.memo((({field:e})=>{const{setErrors:t,clearErrors:a,value:n,setValue:s}=e,{osquery:o}=Object(C.j)().services,l=Object(i.useMemo)((()=>null==o?void 0:o.OsqueryResponseActionTypeForm),[null==o?void 0:o.OsqueryResponseActionTypeForm]),c=Object(i.useCallback)((e=>{Object(u.isEmpty)(e)?a():t(Object(u.map)(e,(e=>({message:e.message}))))}),[t,a]);return r.a.createElement(l,{defaultValues:n,onError:c,onChange:s})}));H.displayName="ResponseActionFormField";var G=a(809),Q=a(125);const W=()=>r.a.createElement(r.a.Fragment,null),K=r.a.memo((e=>{const{osquery:t,application:a}=Object(C.j)().services,o=Object(i.useMemo)((()=>null==t?void 0:t.OsqueryResponseActionTypeForm),[null==t?void 0:t.OsqueryResponseActionTypeForm]),l=Object($.b)(),c=Object(V.a)(U.AppFeatureKey.osqueryAutomatedResponseActions);if(t){var u,d,p,m,b,g,f,y;const{disabled:i,permissionDenied:h}=t.fetchInstallationStatus(),v=!(null!=a&&null!==(u=a.capabilities)&&void 0!==u&&null!==(d=u.osquery)&&void 0!==d&&d.writeLiveQueries||null!=a&&null!==(p=a.capabilities)&&void 0!==p&&null!==(m=p.osquery)&&void 0!==m&&m.runSavedQueries&&(null!=a&&null!==(b=a.capabilities)&&void 0!==b&&null!==(g=b.osquery)&&void 0!==g&&g.readSavedQueries||null!=a&&null!==(f=a.capabilities)&&void 0!==f&&null!==(y=f.osquery)&&void 0!==y&&y.readPacks));if(c)return r.a.createElement(c,null);if(h||v)return r.a.createElement(r.a.Fragment,null,r.a.createElement(Q.e,{path:`${e.item.path}.params`,component:W}),r.a.createElement(n.EuiEmptyPrompt,{title:r.a.createElement("h2",null,G.b),titleSize:"xs",iconType:"logoOsquery",body:r.a.createElement("p",null,r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.osquery.action.missingPrivileges",defaultMessage:"To access this page, ask your administrator for {osquery} Kibana privileges.",values:{osquery:r.a.createElement(n.EuiCode,null,"osquery")}}))}));if(i)return r.a.createElement(r.a.Fragment,null,r.a.createElement(Q.e,{path:`${e.item.path}.params`,component:W}),r.a.createElement(n.EuiEmptyPrompt,{iconType:"logoOsquery",title:r.a.createElement("h2",null,G.c),titleSize:"xs",body:r.a.createElement("p",null,G.a)}));if(l()&&o)return r.a.createElement(Q.e,{path:`${e.item.path}.params`,component:H,readDefaultValueOnForm:!e.item.isNew})}return null}));K.displayName="OsqueryResponseAction";const Y=e=>{switch(e){case z.a.OSQUERY:return{logo:"logoOsquery",name:"Osquery"};case z.a.ENDPOINT:return{logo:"logoSecurity",name:"Endpoint Security"};default:return{logo:"logoOsquery",name:"Osquery"}}},J=g()(n.EuiAccordion).withConfig({displayName:"StyledEuiAccordion",componentId:"sc-16pdpi-0"})(["background:",";.euiAccordion__buttonContent{padding:",";}"],(({theme:e})=>e.eui.euiColorLightestShade),(({theme:e})=>e.eui.euiSizeM)),X=({item:e,onDeleteAction:t})=>{var a;const[s,o]=Object(i.useState)(!0),[l]=Object(Q.m)(),c=Object(u.get)(l,e.path),d=null!==(a=(e=>{var t;const a=Object(S.a)().endpointPrivileges;if(".endpoint"===(null==e?void 0:e.actionTypeId)&&null!=e&&null!==(t=e.params)&&void 0!==t&&t.command)return!Object(x.b)({commandName:Object(j.d)(e.params.command),privileges:a})})(c))&&void 0!==a&&a,p=Object(i.useMemo)((()=>(null==c?void 0:c.actionTypeId)===z.a.OSQUERY?r.a.createElement(K,{item:e}):(null==c?void 0:c.actionTypeId)===z.a.ENDPOINT?r.a.createElement(q,{item:e,editDisabled:d}):null),[null==c?void 0:c.actionTypeId,d,e]),m=Object(i.useCallback)((()=>{t(e.id)}),[e,t]),b=Object(i.useMemo)((()=>{const{logo:e,name:t}=Y(null==c?void 0:c.actionTypeId);return r.a.createElement(n.EuiFlexGroup,{gutterSize:"s",alignItems:"center"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiIcon,{type:e,size:"m"})),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiText,null,t)))}),[null==c?void 0:c.actionTypeId]),g=Object(i.useMemo)((()=>r.a.createElement(n.EuiButtonIcon,{"data-test-subj":"remove-response-action",iconType:"minusInCircle",color:"danger",className:"actAccordionActionForm__extraAction","aria-label":E.i18n.translate("xpack.securitySolution.actionTypeForm.accordion.deleteIconAriaLabel",{defaultMessage:"Delete"}),disabled:d,onClick:m})),[d,m]);return r.a.createElement(J,{initialIsOpen:!0,key:e.id,id:e.id.toString(),onToggle:o,paddingSize:"l","data-test-subj":"alertActionAccordion",buttonContent:b,extraAction:g},p)};X.displayName="ResponseActionTypeForm";const Z=r.a.memo(X);var ee=a(496),te=a.n(ee),ae=a(1370),ne=a.n(ae),ie=a(480);const re=()=>r.a.createElement(r.a.Fragment,null),se=r.a.memo((({items:e,removeItem:t})=>{const{detailName:a}=Object(m.useParams)(),{data:s}=Object(v.f)(a),o=Object(i.useMemo)((()=>null!=s&&s.note?(e=>{const t=te()().use([[ne.a,{}],ie.a]).parse(e);return Object(u.filter)(null==t?void 0:t.children,["type","osquery"])})(s.note):[]),[null==s?void 0:s.note]),l=Object(Q.l)(),[c]=Object(Q.m)(),d=Object(i.useCallback)((()=>{const e=((e,t=[])=>Object(u.reduce)(e,((e,{configuration:t})=>(e.responseActions.push({actionTypeId:z.a.OSQUERY,params:{savedQueryId:void 0,packId:void 0,queries:void 0,query:t.query,ecsMapping:t.ecs_mapping}}),e)),{responseActions:t}))(o,c.responseActions);l.updateFieldValues(e)}),[l,null==c?void 0:c.responseActions,o]);return r.a.createElement("div",{"data-test-subj":"response-actions-list"},e.map(((e,a)=>r.a.createElement("div",{key:e.id,"data-test-subj":`response-actions-list-item-${a}`},r.a.createElement(n.EuiSpacer,{size:"m"}),r.a.createElement(Z,{item:e,onDeleteAction:t}),r.a.createElement(Q.e,{path:`${e.path}.actionTypeId`,component:re})))),r.a.createElement(n.EuiSpacer,{size:"m"}),o.length?r.a.createElement(f,{onClick:d,queriesLength:o.length}):null)}));se.displayName="ResponseActionsList";var oe=a(17);const le=E.i18n.translate("xpack.securitySolution.actionForm.platinumOnly",{defaultMessage:"This functionality is available only in Platinum and above."}),ce=({supportedResponseActionTypes:e,addActionType:t,updateActionTypeId:a})=>{const[o]=Object(Q.m)(),[l,c]=Object(i.useState)(o.responseActions&&o.responseActions.length>0),u=Object(oe.b)().isPlatinumPlus(),d=Object(i.useCallback)((e=>{c(!1),t(),a(e.id)}),[t,a]),p=Object(i.useMemo)((()=>r.a.createElement(n.EuiFlexGroup,{direction:"row"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiSpacer,{size:"m"}),r.a.createElement(n.EuiButton,{size:"s","data-test-subj":"addAlertActionButton",onClick:()=>c(!1)},r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.sections.actionForm.addResponseActionButtonLabel",defaultMessage:"Add response action"}))))),[]),m=Object(i.useMemo)((()=>(null==e?void 0:e.length)&&e.map((function(e,t){const a=r.a.createElement(n.EuiKeyPadMenuItem,{key:t,isDisabled:!u||e.disabled,"data-test-subj":`${e.name}-response-action-type-selection-option`,label:e.name,betaBadgeTooltipContent:"should be visible",onClick:()=>d(e)},r.a.createElement(n.EuiIcon,{size:"xl",type:e.iconClass}));return u?r.a.createElement(n.EuiFlexItem,{grow:!1,key:`keypad-${e.id}`},a):r.a.createElement(n.EuiToolTip,{position:"top",content:le},r.a.createElement(n.EuiFlexItem,{grow:!1,key:`keypad-${e.id}`},a))}))),[d,u,e]);return null!=e&&e.length?r.a.createElement(r.a.Fragment,null,l?p:r.a.createElement(n.EuiFlexGroup,{direction:"row"},m)):r.a.createElement(r.a.Fragment,null)},ue=r.a.memo((({items:e,removeItem:t,supportedResponseActionTypes:a,addItem:n})=>{const s=Object(i.useRef)(null),o=Object(i.useCallback)((e=>{s.current=e}),[]),l=Object(Q.l)(),c=Object(i.useMemo)((()=>r.a.createElement(ce,{supportedResponseActionTypes:a,addActionType:n,updateActionTypeId:o})),[n,o,a]);return Object(i.useEffect)((()=>{if(s.current){const t=`responseActions[${e.length-1}].actionTypeId`;l.setFieldValue(t,s.current),s.current=null}}),[l,e.length]),r.a.createElement("div",{"data-test-subj":"response-actions-wrapper"},r.a.createElement(se,{items:e,removeItem:t}),c)}));ue.displayName="ResponseActionsWrapper";var de=a(852);const pe=()=>r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiFlexItem,{grow:!1,"data-test-subj":"response-actions-header"},r.a.createElement(n.EuiTitle,{size:"s"},r.a.createElement("h4",null,r.a.createElement(s.FormattedMessage,{defaultMessage:"Response Actions",id:"xpack.securitySolution.actionForm.responseActionSectionsDescription"})))),r.a.createElement(n.EuiSpacer,{size:"m"}),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(s.FormattedMessage,{defaultMessage:"Response actions are run on each rule execution.",id:"xpack.securitySolution.actionForm.responseActionSectionsTitle"})),r.a.createElement(n.EuiSpacer,{size:"m"})),me=[{id:z.a.OSQUERY,name:"Osquery",iconClass:"logoOsquery"},{id:z.a.ENDPOINT,name:"Endpoint Security",iconClass:"logoSecurity"}],be=({items:e,addItem:t,removeItem:a,form:s})=>{const o=(()=>{const[e,t]=Object(i.useState)(),a=Object(c.a)("endpointResponseActionsEnabled"),{canIsolateHost:n}=Object(S.a)().endpointPrivileges,r=Object(i.useMemo)((()=>({endpoint:a})),[a]),s=Object(i.useMemo)((()=>({endpoint:n})),[n]);return Object(i.useEffect)((()=>{const e=((e,t,a)=>e.reduce(((e,n)=>{const i=n.id===z.a.ENDPOINT;return!t.endpoint&&i?e:z.c.includes(n.id)?[...e,{...n,disabled:i?!a.endpoint:void 0}]:e}),[]))(me,r,s);t(e)}),[a,r,s]),e})(),[l,d]=Object(i.useState)(null),m=s.getFields(),b=s.getErrors(),g=Object(i.useMemo)((()=>null!=o&&o.length?r.a.createElement(ue,{items:e,removeItem:a,supportedResponseActionTypes:o,addItem:t}):null),[t,e,a,o]);return Object(i.useEffect)((()=>{d((()=>{const t=Object(u.reduce)(Object(u.map)(e,"path"),((e,t)=>{var a,n;return null!==(a=m[`${t}.params`])&&void 0!==a&&null!==(n=a.errors)&&void 0!==n&&n.length?(e.push({type:Object(u.upperFirst)(m[`${t}.actionTypeId`].value.substring(1)),errors:Object(u.map)(m[`${t}.params`].errors,"message")}),e):e}),[]);return Object(u.reduce)(t,((e,t)=>(e.push(`**${t.type}:**\n`),t.errors.forEach((t=>{e.push(`- ${t}\n`)})),e)),[]).join("\n")}))}),[m,b,e]),r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiSpacer,{size:"xxl","data-test-subj":"response-actions-form"}),r.a.createElement(pe,null),null!=l&&l.length?r.a.createElement(r.a.Fragment,null,r.a.createElement("p",null,r.a.createElement(n.EuiCallOut,{"data-test-subj":"response-actions-error",title:de.b,color:"danger",iconType:"warning"},r.a.createElement(p.a,null,l))),r.a.createElement(n.EuiSpacer,null)):null,g)};var ge=a(469),fe=a(1105),ye=a(46),he=a(69),ve=a(108),Ee=a(143);const xe=E.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.actions.connectorsFetchError",{defaultMessage:"Failed to fetch connectors"}),je=E.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.actions.connectorTypesFetchError",{defaultMessage:"Failed to fetch connector types"}),Se=E.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.actions.actionsFetchErrorDescription",{defaultMessage:"Viewing actions is not available"}),ke=E.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepRuleActions.noReadActionsPrivileges",{defaultMessage:'Cannot create rule actions. You do not have "Read" permissions for the "Actions" plugin.'}),Oe=E.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepRuleActions.docsLinkText",{defaultMessage:"Learn more"});function we(){const{docLinks:{links:{securitySolution:{manageDetectionRules:e}}}}=Object(C.j)().services,t=`${e}#edit-rules-settings`;return r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.createRule.stepRuleActions.snoozeDescription",defaultMessage:"Choose when to perform actions or snooze them. Notifications are not created for snoozed actions. {docs}.",values:{docs:r.a.createElement(n.EuiLink,{href:t,target:"_blank"},Oe)}})}const Te=r.a.createElement(we,null),Ie=(E.i18n.translate("xpack.securitySolution.detectionEngine.actionsSectionLabel",{defaultMessage:"Actions"}),E.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.notificationActions",{defaultMessage:"Notification actions"})),Ce=E.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.responseActions",{defaultMessage:"Response actions"}),Me=E.i18n.translate("xpack.securitySolution.detectionEngine.actionNotifyWhen.forEachOption",{defaultMessage:"For each alert. Per rule run."}),_e=E.i18n.translate("xpack.securitySolution.detectionEngine.actionNotifyWhen.summaryOption",{defaultMessage:"Summary of alerts. Per rule run."}),Fe=E.i18n.translate("xpack.securitySolution.detectionEngine.actionNotifyWhen.periodically",{defaultMessage:"Periodically"});var Ae=a(752);function De({ruleId:e}){return r.a.createElement(n.EuiFlexGroup,{direction:"column",gutterSize:"s"},r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiText,{size:"s"},Te)),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(Ae.a,{ruleId:e,showTooltipInline:!0})))}var Ne=a(417);const Pe=({children:e})=>r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiText,{size:"xs",color:"subdued"},e)),Re=({frequency:e})=>{if(!e)return null;if(!e.summary)return r.a.createElement(Pe,null,Me);if("onActiveAlert"===e.notifyWhen)return r.a.createElement(Pe,null,_e);if(!e.throttle)return null;const{unit:t,value:a}=Object(Ne.f)(e.throttle),n={s:r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.ruleDetails.onceInEverySecondsLabel",defaultMessage:"Once {secondsCount, plural, one {a} other {in every}} {secondsCount, plural, one {second} other {# seconds}}",values:{secondsCount:a}}),m:r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.ruleDetails.onceInEveryMinutesLabel",defaultMessage:"Once {minutesCount, plural, one {a} other {in every}} {minutesCount, plural, one {minute} other {# minutes}}",values:{minutesCount:a}}),h:r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.ruleDetails.onceInEveryHoursLabel",defaultMessage:"Once {hoursCount, plural, one {an} other {in every}} {hoursCount, plural, one {hour} other {# hours}}",values:{hoursCount:a}}),d:r.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.ruleDetails.onceInEveryDaysLabel",defaultMessage:"Once {daysCount, plural, one {a} other {in every}} {daysCount, plural, one {day} other {# days}}",values:{daysCount:a}})};return r.a.createElement(Pe,null,n[t]||Fe)};function Le({action:e,connectorTypes:t,connectors:a,actionTypeRegistry:i}){var s,o,l,c;const u=t.find((({id:t})=>t===e.actionTypeId)),d=null!==(s=null==u?void 0:u.name)&&void 0!==s?s:"",p=a.find((({id:t})=>t===e.id)),m=null!==(o=null==p?void 0:p.name)&&void 0!==o?o:"",b=null!==(l=null===(c=i.get(e.actionTypeId))||void 0===c?void 0:c.iconClass)&&void 0!==l?l:"apps";return r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"s",component:"span",responsive:!1},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiToolTip,{content:d,anchorClassName:"eui-textTruncate"},r.a.createElement(n.EuiIcon,{size:"m",type:b}))),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiText,{size:"s"},m),r.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"xs",component:"span",responsive:!1},r.a.createElement(n.EuiSpacer,{size:"xs"}),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiIcon,{size:"s",type:"bell",color:"subdued"})),r.a.createElement(Re,{frequency:e.frequency})))))}function Be({action:e}){const{name:t,logo:a}=Y(e.actionTypeId);return r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"s",component:"span",responsive:!1},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiToolTip,{content:t,anchorClassName:"eui-textTruncate"},r.a.createElement(n.EuiIcon,{size:"m",type:a}))),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiText,{size:"s"},t))))}const qe={enabled:!0,actions:[],responseActions:[],kibanaSiemAppUrl:""},ze=()=>r.a.createElement(r.a.Fragment,null),$e=()=>r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiTitle,{size:"s"},r.a.createElement("h4",null,r.a.createElement(s.FormattedMessage,{defaultMessage:"Actions",id:"xpack.securitySolution.detectionEngine.rule.editRule.actionSectionsTitle"}))),r.a.createElement(n.EuiSpacer,{size:"l"})),Ve=({ruleId:e,isUpdateView:t=!1,actionMessageParams:a,summaryActionMessageParams:s,ruleType:u,form:d})=>{const{services:{application:p}}=Object(C.j)(),m=Object(c.a)("responseActionsEnabled"),b=Object(i.useMemo)((()=>r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiSpacer,null),r.a.createElement(Q.e,{path:"actions",component:fe.a,componentProps:{messageVariables:a,summaryMessageVariables:s}}))),[a,s]),g=Object(i.useMemo)((()=>Object(l.e)(u)?r.a.createElement(o.UseArray,{path:"responseActions",initialNumberOfItems:0},be):null),[u]),f=Object(i.useMemo)((()=>p.capabilities.actions.show?r.a.createElement(r.a.Fragment,null,r.a.createElement($e,null),e&&r.a.createElement(De,{ruleId:e}),b,m&&g,r.a.createElement(Q.e,{path:"kibanaSiemAppUrl",component:ze}),r.a.createElement(Q.e,{path:"enabled",component:ze})):r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiText,null,ke))),[e,p.capabilities.actions.show,b,g,m]);return r.a.createElement(r.a.Fragment,null,r.a.createElement(ge.a,{addPadding:!t},r.a.createElement(Q.c,{form:d,"data-test-subj":"stepRuleActions"},r.a.createElement(n.EuiForm,null,f))))},Ue=Object(i.memo)(Ve),He=({addPadding:e,defaultValues:t})=>{const{services:{triggersActionsUi:a}}=Object(C.j)(),i=a.actionTypeRegistry,{data:s}=(()=>{const{addError:e}=Object(ve.a)();return Object(ye.useQuery)(["GET",he.BASE_ACTION_API_PATH,"connectors"],(({signal:e})=>Object(Ee.f)(e)),{onError:t=>{e(t,{title:xe,toastMessage:Se})}})})(),{data:o}=(()=>{const{addError:e}=Object(ve.a)();return Object(ye.useQuery)(["GET",he.BASE_ACTION_API_PATH,"connector_types","siem"],(({signal:e})=>Object(Ee.e)(e)),{onError:t=>{e(t,{title:je,toastMessage:Se})}})})(),l=t.actions,c=t.responseActions||[];if(!(l.length>0||c.length>0)||!s||!o)return null;const u=l.length>0&&c.length>0;return r.a.createElement(ge.a,{addPadding:e},l.length>0&&r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiText,{size:"m"},Ie),r.a.createElement(n.EuiSpacer,{size:"s"})),l.map(((e,t)=>{const a=t===l.length-1;return r.a.createElement(r.a.Fragment,null,r.a.createElement(Le,{action:e,connectorTypes:o,connectors:s,actionTypeRegistry:i,key:e.id}),!a&&r.a.createElement(n.EuiSpacer,{size:"s"}))})),u&&r.a.createElement(n.EuiSpacer,{size:"l"}),c.length>0&&r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiText,{size:"m"},Ce),r.a.createElement(n.EuiSpacer,{size:"s"})),c.map(((e,t)=>{const a=t===c.length-1;return r.a.createElement(r.a.Fragment,null,r.a.createElement(Be,{action:e,key:`${e.actionTypeId}-${t}`}),!a&&r.a.createElement(n.EuiSpacer,{size:"s"}))})))},Ge=Object(i.memo)(He)},function(e,t,a){"use strict";a.d(t,"b",(function(){return ce})),a.d(t,"a",(function(){return de}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(70),l=a(103),c=a(12),u=a(321),d=a(287),p=a(41),m=a.n(p);const b=m.a.div.attrs((({width:e})=>{if(e)return{style:{width:`${e}px`}}})).withConfig({displayName:"Field",componentId:"sc-1xzawmf-0"})(["background-color:",";border:",";box-shadow:0 2px 2px -1px ",",0 1px 5px -2px ",";font-size:",";font-weight:",";line-height:",";padding:",";"],(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiBorderThin),(({theme:e})=>Object(d.rgba)(e.eui.euiColorMediumShade,.3)),(({theme:e})=>Object(d.rgba)(e.eui.euiColorMediumShade,.3)),(({theme:e})=>e.eui.euiFontSizeXS),(({theme:e})=>e.eui.euiFontWeightSemiBold),(({theme:e})=>e.eui.euiLineHeight),(({theme:e})=>e.eui.euiSizeXS));b.displayName="Field";const g=s.a.memo((({fieldId:e,fieldWidth:t})=>s.a.createElement(b,{"data-test-subj":"field",width:t},e)));g.displayName="DraggableFieldBadge";var f=a(153),y=a(170),h=a(40),v=a(1268),E=a(109),x=a(662),j=a(176),S=a(118),k=a(113),O=a(148),w=a(42),T=a(49),I=a(105),C=a(111),M=a(459);const _=s.a.memo((({columnId:e,onColumnRemoved:t})=>{const a=Object(r.useCallback)((a=>{a.preventDefault(),a.stopPropagation(),t(e)}),[e,t]);return s.a.createElement(h.EuiButtonIcon,{"aria-label":M.f,color:"text","data-test-subj":"remove-column",iconType:"cross",onClick:a})}));_.displayName="CloseButton";const F=s.a.memo((({header:e,onColumnRemoved:t,sort:a,isLoading:n})=>s.a.createElement(s.a.Fragment,null,a.some((t=>t.columnId===e.id))&&n?s.a.createElement(y.d,{className:"siemEventsHeading__extra--loading"},s.a.createElement(y.h,{"data-test-subj":"timeline-loading-spinner"})):s.a.createElement(y.d,{className:"siemEventsHeading__extra--close"},s.a.createElement(_,{columnId:e.id,onColumnRemoved:t})))));F.displayName="Actions";const A=m()(h.EuiFieldText).withConfig({displayName:"FieldText",componentId:"sc-14rl5n4-0"})(["min-width:",";"],(e=>e.minwidth));A.displayName="FieldText";const D=s.a.memo((({columnId:e,minWidth:t,filter:a="",onFilterChange:n=w.noop,placeholder:i="Filter"})=>s.a.createElement(A,{"data-test-subj":"textFilter",minwidth:`${t}px`,placeholder:i,value:a,onChange:t=>{n({columnId:e,filter:t.target.value})}})));D.displayName="TextFilter";const N=s.a.memo((({header:e,onFilterChange:t=w.noop})=>{var a;return"text-filter"===e.columnHeaderType?s.a.createElement(D,{columnId:e.id,minWidth:null!==(a=e.initialWidth)&&void 0!==a?a:j.a,onFilterChange:t,placeholder:e.placeholder}):null}));N.displayName="Filter";const P=({header:e,sort:t})=>t.reduce(((t,a)=>e.id===a.columnId?a.sortDirection:t),"none"),R=({header:e,sort:t})=>t.findIndex((t=>t.columnId===e.id));var L=a(339),B=a(389);const q=s.a.memo((({sortNumber:e})=>e>=0?s.a.createElement(h.EuiNotificationBadge,{color:"subdued","data-test-subj":"sortNumber"},e+1):s.a.createElement(h.EuiIcon,{"data-test-subj":"sortEmptyNumber",type:"empty"})));var z;q.displayName="SortNumber",function(e){e.SORT_UP="sortUp",e.SORT_DOWN="sortDown"}(z||(z={}));const $=s.a.memo((({sortDirection:e,sortNumber:t})=>{const a=(e=>{switch(e){case k.b.asc:return z.SORT_UP;case k.b.desc:return z.SORT_DOWN;case"none":return;default:throw new Error("Unhandled sort direction")}})(e);return null!=a?s.a.createElement(h.EuiToolTip,{content:a===z.SORT_UP?B.e:B.f,"data-test-subj":"sort-indicator-tooltip"},s.a.createElement(s.a.Fragment,null,s.a.createElement(h.EuiIcon,{"data-test-subj":"sortIndicator",type:a}),s.a.createElement(q,{sortNumber:t}))):s.a.createElement(h.EuiIcon,{"data-test-subj":"sortIndicator",type:"empty"})}));$.displayName="SortIndicator";var V=a(217);const U=m()(h.EuiIcon).withConfig({displayName:"IconType",componentId:"sc-1mjgpab-0"})(["margin-right:3px;position:relative;top:-2px;"]);U.displayName="IconType";const H=m.a.span.withConfig({displayName:"P",componentId:"sc-1mjgpab-1"})(["margin-bottom:5px;"]);H.displayName="P";const G=m.a.span.withConfig({displayName:"ToolTipTableMetadata",componentId:"sc-1mjgpab-2"})(["margin-right:5px;display:block;font-weight:bold;"]);G.displayName="ToolTipTableMetadata";const Q=m.a.span.withConfig({displayName:"ToolTipTableValue",componentId:"sc-1mjgpab-3"})(["word-wrap:break-word;"]);Q.displayName="ToolTipTableValue";const W=s.a.memo((({header:e})=>{var t;return s.a.createElement(s.a.Fragment,null,!Object(w.isEmpty)(e.category)&&s.a.createElement(H,null,s.a.createElement(G,{"data-test-subj":"category"},M.a,":"),s.a.createElement(Q,{"data-test-subj":"category-value"},e.category)),s.a.createElement(H,null,s.a.createElement(G,{"data-test-subj":"field"},M.c,":"),s.a.createElement(Q,{"data-test-subj":"field-value"},e.id)),s.a.createElement(H,null,s.a.createElement(G,{"data-test-subj":"type"},M.i,":"),s.a.createElement(Q,null,s.a.createElement(U,{"data-test-subj":"type-icon",type:Object(V.d)(e.type)}),null===(t=e.esTypes)||void 0===t?void 0:t.map((e=>s.a.createElement(h.EuiBadge,{"data-test-subj":`type-value-${e}`,key:e},e))))),!Object(w.isEmpty)(e.description)&&s.a.createElement(H,null,s.a.createElement(G,{"data-test-subj":"description"},M.b,":"),s.a.createElement(Q,{"data-test-subj":"description-value"},e.description)))}));W.displayName="HeaderToolTipContent";const K=({children:e,header:t,isLoading:a,isResizing:n,onClick:i,showSortingCapability:r,sort:o})=>{var l,c;return s.a.createElement(y.c,{"data-test-subj":`header-${t.id}`,isLoading:a},t.aggregatable&&r?s.a.createElement(y.f,{"data-test-subj":"header-sort-button",onClick:n||a?w.noop:i},s.a.createElement(L.b,{"data-test-subj":`header-text-${t.id}`},s.a.createElement(h.EuiToolTip,{"data-test-subj":"header-tooltip",content:s.a.createElement(W,{header:t})},s.a.createElement(s.a.Fragment,null,s.a.isValidElement(t.display)?t.display:null!==(l=t.displayAsText)&&void 0!==l?l:t.id))),s.a.createElement($,{"data-test-subj":"header-sort-indicator",sortDirection:P({header:t,sort:o}),sortNumber:R({header:t,sort:o})})):s.a.createElement(y.g,null,s.a.createElement(L.b,{"data-test-subj":`header-text-${t.id}`},s.a.createElement(h.EuiToolTip,{"data-test-subj":"header-tooltip",content:s.a.createElement(W,{header:t})},s.a.createElement(s.a.Fragment,null,s.a.isValidElement(t.display)?t.display:null!==(c=t.displayAsText)&&void 0!==c?c:t.id)))),e)},Y=s.a.memo(K);var J=a(139),X=a(376);const Z=({header:e,onFilterChange:t=w.noop,sort:a,timelineId:n})=>{const i=Object(l.useDispatch)(),o=Object(r.useMemo)((()=>Object(J.createSelector)(X.selectTimeline,(e=>(null==e?void 0:e.activeTab)===S.d.eql))),[]),c=Object(I.b)((e=>o(e,n))),u=Object(r.useCallback)((()=>{var t,r;const s=e.id,o=null!==(t=e.type)&&void 0!==t?t:"",l=null!==(r=e.esTypes)&&void 0!==r?r:[],c=(({clickedHeader:e,currentSort:t})=>t.reduce(((t,a)=>e.id===a.columnId?(e=>{switch(e.sortDirection){case k.b.desc:return k.b.asc;case k.b.asc:default:return k.b.desc}})(a):t),k.b.desc))({clickedHeader:e,currentSort:a}),u=a.findIndex((e=>e.columnId===s));let d=[];d=-1===u?[...a,{columnId:s,columnType:o,esTypes:l,sortDirection:c}]:[...a.slice(0,u),{columnId:s,columnType:o,esTypes:l,sortDirection:c},...a.slice(u+1)],i(C.a.updateSort({id:n,sort:d}))}),[i,e,a,n]),d=Object(r.useCallback)((e=>i(C.a.removeColumn({id:n,columnId:e}))),[i,n]),p=Object(r.useMemo)((()=>C.b.getTimelineByIdSelector()),[]),{isLoading:m}=Object(I.a)((e=>p(e,n)||{isLoading:!1})),b=!c&&!Object(T.isDataViewFieldSubtypeNested)(e);return s.a.createElement(s.a.Fragment,null,s.a.createElement(Y,{header:e,isLoading:m,isResizing:!1,onClick:u,showSortingCapability:b,sort:a},s.a.createElement(F,{header:e,isLoading:m,onColumnRemoved:d,sort:a})),s.a.createElement(N,{header:e,onFilterChange:t}))},ee=s.a.memo(Z),te=m()(h.EuiContextMenu).withConfig({displayName:"ContextMenu",componentId:"sc-wn02ez-0"})(["width:115px;& .euiContextMenuItem{font-size:12px;padding:4px 8px;width:115px;}"]),ae=m.a.div.withConfig({displayName:"PopoverContainer",componentId:"sc-wn02ez-1"})(["& .euiPopover__anchor{padding-right:8px;width:","px;}"],(({$width:e})=>e)),ne={right:!0},ie=({draggableIndex:e,header:t,timelineId:a,isDragging:n,onFilterChange:c,sort:u,tabType:d})=>{const p=Object(r.useRef)(null),[m,b]=Object(r.useState)(!1),g=Object(r.useCallback)((()=>{var e;return null===(e=p.current)||void 0===e?void 0:e.focus()}),[]),w=Object(l.useDispatch)(),T=Object(r.useMemo)((()=>{var e;return{width:null!==(e=t.initialWidth)&&void 0!==e?e:j.a,height:"auto"}}),[t.initialWidth]),I=Object(r.useMemo)((()=>({position:n?"absolute":"relative"})),[n]),_=Object(r.useMemo)((()=>({right:s.a.createElement(y.e,null)})),[]),F=Object(r.useCallback)(((e,n,i,r)=>{w(C.a.applyDeltaToColumnWidth({columnId:t.id,delta:r.width,id:a}))}),[w,t.id,a]),A=Object(r.useMemo)((()=>Object(f.k)({contextId:`timeline-column-headers-${d}-${a}`,fieldId:t.id})),[d,a,t.id]),D=Object(r.useCallback)((e=>{var n,i;const r=t.id,s=null!==(n=t.type)&&void 0!==n?n:"",o=null!==(i=t.esTypes)&&void 0!==i?i:[],l=u.findIndex((e=>e.columnId===r)),c=-1===l?[...u,{columnId:r,columnType:s,esTypes:o,sortDirection:e}]:[...u.slice(0,l),{columnId:r,columnType:s,esTypes:o,sortDirection:e},...u.slice(l+1)];w(C.a.updateSort({id:a,sort:c}))}),[w,t,u,a]),N=Object(r.useCallback)((()=>{b(!1),g()}),[g]),P=Object(r.useMemo)((()=>[{id:0,items:[{icon:s.a.createElement(h.EuiIcon,{type:"eyeClosed",size:"s"}),name:M.e,onClick:()=>{w(C.a.removeColumn({id:a,columnId:t.id})),N()}},...d!==S.d.eql?[{disabled:!t.aggregatable,icon:s.a.createElement(h.EuiIcon,{type:"sortUp",size:"s"}),name:M.g,onClick:()=>{D(k.b.asc),N()}},{disabled:!t.aggregatable,icon:s.a.createElement(h.EuiIcon,{type:"sortDown",size:"s"}),name:M.h,onClick:()=>{D(k.b.desc),N()}}]:[]]}]),[w,N,t.aggregatable,t.id,D,d,a]),R=Object(r.useMemo)((()=>s.a.createElement(ee,{timelineId:a,header:t,onFilterChange:c,sort:u})),[t,c,u,a]),L=Object(r.useCallback)((e=>{var a;return s.a.createElement(y.o,i()({"data-test-subj":"draggable-header"},e.draggableProps,e.dragHandleProps,{ref:e.innerRef}),s.a.createElement(y.p,null,s.a.createElement(ae,{$width:null!==(a=t.initialWidth)&&void 0!==a?a:j.a},s.a.createElement(h.EuiPopover,{anchorPosition:"downLeft",button:R,closePopover:N,isOpen:m,ownFocus:!0,panelPaddingSize:"none"},s.a.createElement(te,{initialPanelId:0,panels:P})))))}),[N,R,t.initialWidth,m,P]),B=Object(r.useCallback)((()=>{var e;null===(e=p.current)||void 0===e||e.focus()}),[]),q=Object(r.useCallback)((()=>{b(!0)}),[]),{onBlur:z,onKeyDown:$}=Object(x.a)({closePopover:N,draggableId:A,fieldName:t.id,keyboardHandlerRef:p,openPopover:q}),V=Object(r.useCallback)((e=>{m||$(e)}),[m,$]);return s.a.createElement(v.Resizable,{enable:ne,size:T,style:I,handleComponent:_,onResizeStop:F},s.a.createElement("div",{"aria-colindex":null!=e?e+O.c:void 0,className:E.a,"data-test-subj":"draggableWrapperKeyboardHandler",onClick:B,onBlur:z,onKeyDown:V,ref:p,role:"columnheader",tabIndex:0},s.a.createElement(o.Draggable,{"data-test-subj":"draggable",disableInteractiveElementBlocking:!0,draggableId:A,index:e,key:t.id},L)))},re=s.a.memo(ie);var se=a(110),oe=a(1060);const le=s.a.memo((({children:e,onMount:t,onUnmount:a})=>(Object(r.useEffect)((()=>(t(),()=>a())),[t,a]),s.a.createElement(s.a.Fragment,null,e))));le.displayName="DraggableContainer";const ce=({globalFullScreen:e,isActiveTimelines:t,timelineFullScreen:a})=>t&&a||!1===t&&e,ue=({actionsColumnWidth:e,browserFields:t,columnHeaders:a,isEventViewer:n=!1,isSelectAllChecked:d,onSelectAll:p,show:m,showEventsSelect:b,showSelectAllCheckbox:h,sort:v,tabType:E,timelineId:x,leadingControlColumns:j,trailingControlColumns:S})=>{const k=Object(l.useDispatch)(),[O,w]=Object(r.useState)(null),T=Object(r.useRef)(null);Object(r.useEffect)((()=>()=>{T.current&&T.current.closeEditor()}),[]),Object(r.useEffect)((()=>{!m&&T.current&&T.current.closeEditor()}),[m]);const I=Object(r.useCallback)(((e,t,n)=>{const r=n.source.index,o=a[r];return s.a.createElement(y.o,i()({"data-test-subj":"draggable-header"},e.draggableProps,e.dragHandleProps,{ref:e.innerRef}),s.a.createElement(le,{onMount:()=>w(r),onUnmount:()=>w(null)},s.a.createElement(u.a,null,s.a.createElement(g,{fieldId:o.id,fieldWidth:o.initialWidth}))))}),[a,w]),C=Object(r.useMemo)((()=>a.map(((e,t)=>s.a.createElement(re,{key:e.id,draggableIndex:t,timelineId:x,header:e,isDragging:O===t,sort:v,tabType:E})))),[a,x,O,v,E]),M=Object(r.useCallback)(((e,t)=>s.a.createElement(s.a.Fragment,null,s.a.createElement(y.r,i()({"data-test-subj":"headers-group",ref:e.innerRef,isDragging:t.isDraggingOver},e.droppableProps),C))),[C]),_=Object(r.useMemo)((()=>j?j.map((e=>e.headerCellRender)):[]),[j]),F=Object(r.useMemo)((()=>S?S.map((e=>e.headerCellRender)):[]),[S]),A=Object(oe.a)({sourcererScope:se.SourcererScopeName.timeline,editorActionsRef:T,upsertColumn:(e,t)=>k(Object(c.upsertColumn)({column:e,id:x,index:t})),removeColumn:e=>k(Object(c.removeColumn)({columnId:e,id:x}))}),D=Object(r.useMemo)((()=>_.map(((i,r)=>{const o=j[r]&&j[r].width||e;return s.a.createElement(y.q,{actionsColumnWidth:o,"data-test-subj":"actions-container",isEventViewer:n,key:r},i&&s.a.createElement(i,{width:o,browserFields:t,columnHeaders:a,isEventViewer:n,isSelectAllChecked:d,onSelectAll:p,showEventsSelect:b,showSelectAllCheckbox:h,sort:v,tabType:E,timelineId:x,fieldBrowserOptions:A}))}))),[_,j,e,t,a,A,n,d,p,b,h,v,E,x]),N=Object(r.useMemo)((()=>F.map(((i,r)=>{const o=S[r]&&S[r].width||e;return s.a.createElement(y.q,{actionsColumnWidth:o,"data-test-subj":"actions-container",isEventViewer:n,key:r},i&&s.a.createElement(i,{width:o,browserFields:t,columnHeaders:a,isEventViewer:n,isSelectAllChecked:d,onSelectAll:p,showEventsSelect:b,showSelectAllCheckbox:h,sort:v,tabType:E,timelineId:x,fieldBrowserOptions:A}))}))),[F,S,e,t,a,A,n,d,p,b,h,v,E,x]);return s.a.createElement(y.s,{"data-test-subj":"column-headers"},s.a.createElement(y.v,null,D,s.a.createElement(o.Droppable,{direction:"horizontal",droppableId:`${f.g}-${E}.${x}`,isDropDisabled:!1,type:f.a,renderClone:I},M),N))},de=s.a.memo(ue)},function(e,t,a){"use strict";a.d(t,"b",(function(){return n.LastEventIndexKey})),a.d(t,"c",(function(){return i})),a.d(t,"a",(function(){return r}));var n=a(54);let i,r;!function(e){e.all="eventsAll",e.details="eventsDetails",e.kpi="eventsKpi",e.lastEventTime="eventsLastEventTime"}(i||(i={})),function(e){e.uniDirectional="uniDirectional",e.biDirectional="biDirectional"}(r||(r={}))},,function(e,t,a){"use strict";a.d(t,"c",(function(){return h})),a.d(t,"d",(function(){return v})),a.d(t,"a",(function(){return E})),a.d(t,"b",(function(){return x})),a.d(t,"e",(function(){return T}));var n=a(40),i=a(55),r=a.n(i),s=a(2),o=a.n(s),l=a(41),c=a.n(l);const u=c.a.span.withConfig({displayName:"ArrowBody",componentId:"sc-11kjqat-0"})(["background-color:",";height:",";width:25px;"],(e=>e.theme.eui.euiColorLightShade),(({height:e})=>`${e}px`));u.displayName="ArrowBody";const d=o.a.memo((({direction:e})=>o.a.createElement(n.EuiIcon,{color:"subdued","data-test-subj":"arrow-icon",size:"s",type:e})));d.displayName="ArrowHead";var p=a(1275);const m=Object(p.scaleLinear)().domain([0,100]).range([1,4]).clamp(!0),b=e=>Array.isArray(e)&&1===e.length;var g=a(121),f=a(727),y=a(815);const h="source.bytes",v="source.packets",E="destination.bytes",x="destination.packets",j=c.a.span.withConfig({displayName:"Percent",componentId:"sc-19xyyc3-0"})(["margin-right:5px;"]);j.displayName="Percent";const S=c()(n.EuiFlexGroup).withConfig({displayName:"SourceDestinationArrowsContainer",componentId:"sc-19xyyc3-1"})(["margin:0 2px;.euiToolTipAnchor{white-space:nowrap;}"]);S.displayName="SourceDestinationArrowsContainer";const k=c()(n.EuiText).withConfig({displayName:"Data",componentId:"sc-19xyyc3-2"})(["margin:0 5px;"]);k.displayName="Data";const O=o.a.memo((({contextId:e,eventId:t,isDraggable:a,sourceBytes:i,sourceBytesPercent:s,sourcePackets:l})=>{const c=null!=s?m(s):1;return o.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"none",justifyContent:"center"},o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(u,{height:null!=c?c:0})),null==i||isNaN(Number(i))?null:o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(g.b,{field:h,id:`source-arrow-default-draggable-${e}-${t}-${h}-${i}`,isDraggable:a,value:i},o.a.createElement(k,{size:"xs"},null!=s?o.a.createElement(j,null,`(${r()(s).format("0.00")}%)`):null,o.a.createElement("span",null,o.a.createElement(f.a,{value:i}))))),o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(u,{height:null!=c?c:0})),null==l||isNaN(Number(l))?null:o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(g.b,{field:v,id:`source-arrow-default-draggable-${e}-${t}-${v}-${l}`,isDraggable:a,value:l},o.a.createElement(k,{size:"xs"},o.a.createElement("span",null,`${l} ${y.a}`)))),o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(u,{height:null!=c?c:0})),o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(d,{direction:"arrowRight"})))}));O.displayName="SourceArrow";const w=o.a.memo((({contextId:e,destinationBytes:t,destinationBytesPercent:a,destinationPackets:i,eventId:s,isDraggable:l})=>{const c=null!=a?m(a):1;return o.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"none",justifyContent:"center"},o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(d,{direction:"arrowLeft"})),o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(u,{height:null!=c?c:0})),null==t||isNaN(Number(t))?null:o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(g.b,{field:E,id:`destination-arrow-default-draggable-${e}-${s}-${E}-${t}`,isDraggable:l,value:t},o.a.createElement(k,{size:"xs"},null!=a?o.a.createElement(j,null,`(${r()(a).format("0.00")}%)`):null,o.a.createElement("span",null,o.a.createElement(f.a,{value:t}))))),o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(u,{height:null!=c?c:0})),null==i||isNaN(Number(i))?null:o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(g.b,{field:x,id:`destination-arrow-default-draggable-${e}-${s}-${x}-${i}`,isDraggable:l,value:i},o.a.createElement(k,{size:"xs"},o.a.createElement("span",null,`${r()(i).format("0,0")} ${y.a}`)))),o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(u,{height:null!=c?c:0})))}));w.displayName="DestinationArrow";const T=o.a.memo((({contextId:e,destinationBytes:t,destinationPackets:a,eventId:i,isDraggable:r,sourceBytes:s,sourcePackets:l})=>{const c=null!=s&&b(s)?s[0]:void 0,u=null!=l&&b(l)?l[0]:void 0,d=null!=t&&b(t)?t[0]:void 0,p=null!=a&&b(a)?a[0]:void 0,m=null!=c&&null!=d?(({numerator:e,denominator:t})=>{if(!(Math.abs(t)<Number.EPSILON)&&Number.isFinite(e)&&Number.isFinite(t))return e/t*100})({numerator:Number(c),denominator:Number(c)+Number(d)}):void 0,g=null!=m?100-m:void 0;return o.a.createElement(S,{alignItems:"center",justifyContent:"center",direction:"column",gutterSize:"none"},null!=c?o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(O,{contextId:e,eventId:i,isDraggable:r,sourceBytes:c,sourcePackets:u,sourceBytesPercent:m})):null,null!=d?o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(w,{contextId:e,destinationBytes:d,destinationPackets:p,destinationBytesPercent:g,eventId:i,isDraggable:r})):null)}));T.displayName="SourceDestinationArrows"},function(e,t,a){"use strict";a.d(t,"b",(function(){return s})),a.d(t,"a",(function(){return l}));var n=a(2),i=a(303);const r=(e,t)=>{switch(t.type){case"FETCH_INIT":return{...e,parameters:t.payload,isLoading:!0};case"FETCH_SUCCESS":return{...e,data:t.payload,isLoading:!1,error:void 0};case"FETCH_FAILURE":return{...e,error:t.payload,isLoading:!1};case"FETCH_REPEAT":return{...e,isLoading:!0};default:return e}},s=(e,t,{disabled:a=!1,initialParameters:s}={})=>{const{startTracking:o}=Object(i.a)(),[{parameters:l,data:c,isLoading:u,error:d},p]=Object(n.useReducer)(r,{data:void 0,isLoading:!a&&void 0!==s,error:void 0,parameters:s}),m=Object(n.useCallback)((e=>p({type:"FETCH_INIT",payload:e})),[]),b=Object(n.useCallback)((()=>p({type:"FETCH_REPEAT"})),[]);return Object(n.useEffect)((()=>{if(!1===u||void 0===l||a)return;let n=!1;const i=new AbortController;return(async()=>{const{endTracking:a}=o({name:e});try{const e=await t(l,i.signal);a("success"),n||p({type:"FETCH_SUCCESS",payload:e})}catch(e){a(i.signal.aborted?"aborted":"error"),n||p({type:"FETCH_FAILURE",payload:e})}})(),()=>{n=!0,i.abort()}}),[u,l,a,t,o,e]),{fetch:m,refetch:b,data:c,isLoading:u,error:d}};var o=a(4);const l={SECURITY_DASHBOARDS:`${o.l} fetch security dashboards`,SECURITY_TAGS:`${o.l} fetch security tags`,SECURITY_CREATE_TAG:`${o.l} fetch security create tag`,CTI_TAGS:`${o.l} fetch cti tags`,ANOMALIES_TABLE:`${o.l} fetch anomalies table data`,GET_RISK_SCORE_DEPRECATED:`${o.l} fetch is risk score deprecated`,ENABLE_RISK_SCORE:`${o.l} fetch enable risk score`,REFRESH_RISK_SCORE:`${o.l} fetch refresh risk score`,UPGRADE_RISK_SCORE:`${o.l} fetch upgrade risk score`}},function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return b})),a.d(t,"c",(function(){return g}));var n=a(74),i=(a(8),a(119)),r=a(5);const s=r.i18n.translate("xpack.securitySolution.selector.groups.ruleName.label",{defaultMessage:"Rule name"}),o=r.i18n.translate("xpack.securitySolution.selector.grouping.userName.label",{defaultMessage:"User name"}),l=r.i18n.translate("xpack.securitySolution.selector.grouping.hostName.label",{defaultMessage:"Host name"}),c=r.i18n.translate("xpack.securitySolution.selector.grouping.sourceIP.label",{defaultMessage:"Source IP"}),u=r.i18n.translate("xpack.securitySolution.selector.groups.sourceAddress.label",{defaultMessage:"Source address"}),d=r.i18n.translate("xpack.securitySolution.selector.groups.destinationAddress.label",{defaultMessage:"Destination address"}),p=e=>0===e.length?{}:{query:{bool:{filter:{ids:{values:e}}}},size:1e4},m=(e,t)=>{const a=e.split(".");return 1===a.length?{[a[0]]:t}:{[a[0]]:m(a.slice(1).join("."),t)}},b=e=>{return t=e,Array.isArray(t)?t:Object.entries(t).reduce(((e,[t,a])=>Object(n.merge)(e,m(t,a))),{});var t},g=e=>e===i.e.alertsOnAlertsPage||e===i.e.alertsRiskInputs?[{label:s,key:"kibana.alert.rule.name"},{label:o,key:"user.name"},{label:l,key:"host.name"},{label:c,key:"source.ip"}]:e===i.e.alertsOnRuleDetailsPage?[{label:u,key:"source.address"},{label:o,key:"user.name"},{label:l,key:"host.name"},{label:d,key:"destination.address,"}]:[]},function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return o}));var n=a(2),i=a.n(n);const r=i.a.createContext(null),s=Object(n.memo)((({upsellingService:e,children:t})=>i.a.createElement(r.Provider,{value:e},t)));s.displayName="UpsellingProvider";const o=()=>{const e=Object(n.useContext)(r);if(!e)throw new Error("UpsellingProviderContext not found");return e}},function(e,t,a){"use strict";var n=a(54);a.d(t,"a",(function(){return n.Direction}))},function(e,t,a){"use strict";a.r(t),a.d(t,"sourcererKibanaDataViewsSelector",(function(){return i})),a.d(t,"sourcererSignalIndexNameSelector",(function(){return r})),a.d(t,"sourcererDefaultDataViewSelector",(function(){return s})),a.d(t,"dataViewSelector",(function(){return o})),a.d(t,"sourcererScopeIdSelector",(function(){return l})),a.d(t,"scopeIdSelector",(function(){return c})),a.d(t,"kibanaDataViewsSelector",(function(){return u})),a.d(t,"signalIndexNameSelector",(function(){return d})),a.d(t,"defaultDataViewSelector",(function(){return p})),a.d(t,"sourcererDataViewSelector",(function(){return m})),a.d(t,"getSourcererDataViewsSelector",(function(){return b})),a.d(t,"getSourcererScopeSelector",(function(){return g})),a.d(t,"getSelectedDataviewSelector",(function(){return f}));var n=a(139);const i=({sourcerer:e})=>e.kibanaDataViews,r=({sourcerer:e})=>e.signalIndexName,s=({sourcerer:e})=>e.defaultDataView,o=({sourcerer:e},t)=>e.kibanaDataViews.find((e=>e.id===t)),l=({sourcerer:e},t)=>e.sourcererScopes[t],c=()=>Object(n.createSelector)(l,(e=>e)),u=()=>Object(n.createSelector)(i,(e=>e)),d=()=>Object(n.createSelector)(r,(e=>e)),p=()=>Object(n.createSelector)(s,(e=>e)),m=()=>Object(n.createSelector)(o,(e=>e)),b=()=>{const e=u(),t=p(),a=d();return n=>{const i=e(n);return{defaultDataView:t(n),kibanaDataViews:i,signalIndexName:a(n)}}},g=()=>{const e=b(),t=m(),a=c();return(n,i)=>{const r=e(n),s=a(n,i);return{...r,selectedDataView:t(n,s.selectedDataViewId),sourcererScope:s}}},f=()=>{const e=m(),t=c();return(a,n)=>{const i=t(a,n),r=e(a,i.selectedDataViewId);return null==r?void 0:r.dataView}}},,function(e,t,a){"use strict";(function(t){const n=a(426),i=a(764),r=a(540),s={needsProtoHack:new Set([i.set,i.map,i.weakSet,i.weakMap])};e.exports=s.clone=function(e,a={},n=null){if("object"!=typeof e||null===e)return e;let o=s.clone,l=n;if(a.shallow){if(!0!==a.shallow)return s.cloneWithShallow(e,a);o=e=>e}else if(l){const t=l.get(e);if(t)return t}else l=new Map;const c=i.getInternalProto(e);if(c===i.buffer)return t&&t.from(e);if(c===i.date)return new Date(e.getTime());if(c===i.regex)return new RegExp(e);const u=s.base(e,c,a);if(u===e)return e;if(l&&l.set(e,u),c===i.set)for(const t of e)u.add(o(t,a,l));else if(c===i.map)for(const[t,n]of e)u.set(t,o(n,a,l));const d=r.keys(e,a);for(const t of d){if("__proto__"===t)continue;if(c===i.array&&"length"===t){u.length=e.length;continue}const n=Object.getOwnPropertyDescriptor(e,t);n?n.get||n.set?Object.defineProperty(u,t,n):n.enumerable?u[t]=o(e[t],a,l):Object.defineProperty(u,t,{enumerable:!1,writable:!0,configurable:!0,value:o(e[t],a,l)}):Object.defineProperty(u,t,{enumerable:!0,writable:!0,configurable:!0,value:o(e[t],a,l)})}return u},s.cloneWithShallow=function(e,t){const a=t.shallow;(t=Object.assign({},t)).shallow=!1;const i=new Map;for(const t of a){const a=n(e,t);"object"!=typeof a&&"function"!=typeof a||i.set(a,a)}return s.clone(e,t,i)},s.base=function(e,t,a){if(!1===a.prototype)return s.needsProtoHack.has(t)?new t.constructor:t===i.array?[]:{};const n=Object.getPrototypeOf(e);if(n&&n.isImmutable)return e;if(t===i.array){const e=[];return n!==t&&Object.setPrototypeOf(e,n),e}if(s.needsProtoHack.has(t)){const e=new n.constructor;return n!==t&&Object.setPrototypeOf(e,n),e}return Object.create(n)}}).call(this,a(300).Buffer)},function(e,t,a){"use strict";t.keys=function(e,t={}){return!1!==t.symbols?Reflect.ownKeys(e):Object.getOwnPropertyNames(e)}},function(e,t,a){"use strict";a.d(t,"b",(function(){return n})),a.d(t,"a",(function(){return i}));const n=e=>"relative"===e.kind,i=e=>"absolute"===e.kind},function(e,t,a){"use strict";a.r(t),a.d(t,"inputsSelector",(function(){return c})),a.d(t,"timelineTimeRangeSelector",(function(){return u})),a.d(t,"socTrendsTimeRangeSelector",(function(){return d})),a.d(t,"globalFullScreenSelector",(function(){return p})),a.d(t,"timelineFullScreenSelector",(function(){return m})),a.d(t,"globalTimeRangeSelector",(function(){return b})),a.d(t,"globalQuery",(function(){return g})),a.d(t,"globalQueryByIdSelector",(function(){return f})),a.d(t,"timelineQueryByIdSelector",(function(){return y})),a.d(t,"globalSelector",(function(){return h})),a.d(t,"globalQuerySelector",(function(){return E})),a.d(t,"globalSavedQuerySelector",(function(){return x})),a.d(t,"globalFiltersQuerySelector",(function(){return S})),a.d(t,"getTimelineSelector",(function(){return k})),a.d(t,"getTimelinePolicySelector",(function(){return O}));var n=a(139);const i=e=>e.inputs,r=e=>e.inputs.global,s=e=>e.inputs.timeline,o=(e,t)=>e.inputs.global.queries.find((e=>e.id===t))||{id:"kql",inspect:null,isInspected:!1,loading:!1,refetch:null,selectedInspectIndex:0},l=(e,t)=>e.inputs.timeline.queries.find((e=>e.id===t))||e.inputs.global.queries.find((e=>e.id===t))||{id:"kql",inspect:null,isInspected:!1,loading:!1,refetch:null,selectedInspectIndex:0},c=()=>Object(n.createSelector)(i,(e=>e)),u=Object(n.createSelector)(s,(e=>e.timerange)),d=Object(n.createSelector)((e=>e.inputs.socTrends),(e=>null==e?void 0:e.timerange)),p=Object(n.createSelector)(r,(e=>e.fullScreen)),m=Object(n.createSelector)(s,(e=>e.fullScreen)),b=Object(n.createSelector)(r,(e=>e.timerange)),g=()=>Object(n.createSelector)(r,(e=>e.queries)),f=()=>Object(n.createSelector)(o,(e=>e)),y=()=>Object(n.createSelector)(l,(e=>e)),h=()=>Object(n.createSelector)(r,(e=>e)),v={query:"",language:"kuery"},E=()=>Object(n.createSelector)(r,(e=>e.query||v)),x=()=>Object(n.createSelector)(r,(e=>e.savedQuery||null)),j=[],S=()=>Object(n.createSelector)(r,(e=>e.filters||j)),k=()=>Object(n.createSelector)(s,(e=>e)),O=()=>Object(n.createSelector)(s,(e=>e.policy))},function(e,t,a){"use strict";a.d(t,"a",(function(){return g})),a.d(t,"b",(function(){return f}));var n=a(666),i=a(119),r=a(1402),s=a(179),o=a(227),l=a(138),c=a(158),u=a(110),d=a(477),p=a(754),m=a(770),b=a(1431);Object(r.enableMapSet)();const g=(e,{defaultDataView:t,kibanaDataViews:a,signalIndexName:n,enableExperimental:i},r,m,b)=>{const g={[u.SourcererScopeName.default]:Object(d.b)(t,u.SourcererScopeName.default,n,!0),[u.SourcererScopeName.detections]:Object(d.b)(t,u.SourcererScopeName.detections,n,!0),[u.SourcererScopeName.timeline]:Object(d.b)(t,u.SourcererScopeName.timeline,n,!0)};return{...e,app:{...s.d,enableExperimental:i},dragAndDrop:o.d,inputs:Object(l.a)(i.socTrendsEnabled),sourcerer:{...c.b.initialSourcererState,sourcererScopes:{...c.b.initialSourcererState.sourcererScopes,[u.SourcererScopeName.default]:{...c.b.initialSourcererState.sourcererScopes.default,selectedDataViewId:t.id,selectedPatterns:g[u.SourcererScopeName.default]},[u.SourcererScopeName.detections]:{...c.b.initialSourcererState.sourcererScopes.detections,selectedDataViewId:t.id,selectedPatterns:g[u.SourcererScopeName.detections]},[u.SourcererScopeName.timeline]:{...c.b.initialSourcererState.sourcererScopes.timeline,selectedDataViewId:t.id,selectedPatterns:g[u.SourcererScopeName.timeline]}},defaultDataView:t,kibanaDataViews:a.map((e=>({...u.initDataView,...e}))),signalIndexName:n},globalUrlParam:p.d,dataTable:r.dataTable,groups:m.groups,analyzer:b.analyzer}},f=e=>Object(n.combineReducers)({app:s.b,dragAndDrop:o.b,inputs:l.c,sourcerer:c.c,globalUrlParam:p.b,dataTable:i.i,groups:m.a,analyzer:b.a,...e})},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(545));t.default=function(e,t){void 0===t&&(t=[]);var a=r.default(e,t,{loading:!0}),n=a[0],s=a[1];return i.useEffect((function(){s()}),[s]),n}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(267));t.default=function(e,t,a){void 0===t&&(t=[]),void 0===a&&(a={loading:!1});var s=i.useRef(0),o=r.default(),l=i.useState(a),c=l[0],u=l[1],d=i.useCallback((function(){for(var t=[],a=0;a<arguments.length;a++)t[a]=arguments[a];var i=++s.current;return u((function(e){return n.__assign(n.__assign({},e),{loading:!0})})),e.apply(void 0,t).then((function(e){return o()&&i===s.current&&u({value:e,loading:!1}),e}),(function(e){return o()&&i===s.current&&u({error:e,loading:!1}),e}))}),t);return[c,d]}},function(e,t,a){"use strict";var n=a(429);a.d(t,"a",(function(){return n.b})),a.d(t,"f",(function(){return n.d})),a(352);var i=a(430);a.d(t,"b",(function(){return i.a})),a.d(t,"d",(function(){return i.b})),a(431);var r=a(262);a.d(t,"g",(function(){return r.c}));var s=a(432);a.d(t,"c",(function(){return s.a}));var o=a(351);a.d(t,"e",(function(){return o.c}))},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"a",(function(){return r}));var n=a(4);const i=`${n.Cb}/rules/_rule_management_filters`,r=`${n.Cb}/rules/_coverage_overview`},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.warn=t.deprecate=t.resetDeprecationsSeen=void 0;var n={};t.resetDeprecationsSeen=function(){n={}};var i="object"==typeof console&&"function"==typeof console.warn?function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];return console.warn.apply(console,e)}:function(){};t.deprecate=function(e){n[e]||(n[e]=!0,i("redux-observable | DEPRECATION: "+e))},t.warn=function(e){i("redux-observable | WARNING: "+e)}},function(e,t,a){var n=a(973),i=a(974);e.exports=function(e,t,a){return n(i,e,t,a)}},function(e,t,a){e.exports=a(33)(3824)},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"d",(function(){return r})),a.d(t,"e",(function(){return s})),a.d(t,"f",(function(){return o})),a.d(t,"b",(function(){return l})),a.d(t,"g",(function(){return c})),a.d(t,"h",(function(){return u})),a.d(t,"c",(function(){return d}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.notes.addNoteButtonLabel",{defaultMessage:"Add Note"}),r=n.i18n.translate("xpack.securitySolution.notes.noteLabel",{defaultMessage:"Note"}),s=n.i18n.translate("xpack.securitySolution.notes.notesTitle",{defaultMessage:"Notes"}),o=n.i18n.translate("xpack.securitySolution.notes.search.FilterByUserOrNotePlaceholder",{defaultMessage:"Filter by User or Note"}),l=n.i18n.translate("xpack.securitySolution.notes.cancelButtonLabel",{defaultMessage:"Cancel"}),c=n.i18n.translate("xpack.securitySolution.notes.youAreEditingANoteScreenReaderOnly",{defaultMessage:"You are editing a note. Click Add Note when finished, or press escape to cancel."}),u=e=>n.i18n.translate("xpack.securitySolution.notes.youAreViewingNotesScreenReaderOnly",{values:{row:e},defaultMessage:"You are viewing notes for the event in row {row}. Press the up arrow key when finished to return to the event."}),d=n.i18n.translate("xpack.securitySolution.notes.createdByLabel",{defaultMessage:"Created by"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(108),i=a(353),r=a(304);const s=(e,t=!0)=>{const{addError:a}=Object(n.a)();return Object(i.a)(e,t?{onError:e=>{a(e,{title:r.b})}}:void 0)}},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n="xs"},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(46),i=a(68),r=a(69),s=a(269);const o=["elastic-assistant, load-action-types"],l=({http:e,toasts:t})=>Object(n.useQuery)(o,(async()=>(await Object(i.loadActionTypes)({http:e,featureId:r.GeneralConnectorFeatureId})).sort(((e,t)=>e.name.localeCompare(t.name)))),{retry:!1,keepPreviousData:!0,staleTime:6e4,onError:e=>{"AbortError"!==e.name&&(null==t||t.addError(e.body&&e.body.message?new Error(e.body.message):e,{title:s.m}))}})},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"e",(function(){return s})),a.d(t,"a",(function(){return o})),a.d(t,"d",(function(){return l}));var n=a(5);const i=n.i18n.translate("xpack.elasticAssistant.assistant.firstPromptEditor.addSystemPromptTooltip",{defaultMessage:"Add system prompt"}),r=n.i18n.translate("xpack.elasticAssistant.assistant.firstPromptEditor.clearSystemPrompt",{defaultMessage:"Clear system prompt"}),s=n.i18n.translate("xpack.elasticAssistant.assistant.firstPromptEditor.selectASystemPromptPlaceholder",{defaultMessage:"Select a system prompt"}),o=n.i18n.translate("xpack.elasticAssistant.assistant.firstPromptEditor.addNewSystemPrompt",{defaultMessage:"Add new system prompt..."}),l=n.i18n.translate("xpack.elasticAssistant.assistant.firstPromptEditor.emptyPrompt",{defaultMessage:"(empty prompt)"})},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e,t,a){var i=n.useRef(void 0);i.current&&a(t,i.current)||(i.current=t),n.useEffect(e,i.current)}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e,t){void 0===t&&(t=0);var a=n.useRef(!1),i=n.useRef(),r=n.useRef(e),s=n.useCallback((function(){return a.current}),[]),o=n.useCallback((function(){a.current=!1,i.current&&clearTimeout(i.current),i.current=setTimeout((function(){a.current=!0,r.current()}),t)}),[t]),l=n.useCallback((function(){a.current=null,i.current&&clearTimeout(i.current)}),[]);return n.useEffect((function(){r.current=e}),[e]),n.useEffect((function(){return o(),l}),[t]),[s,l,o]}},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(2),i=a(103),r=a(1075),s=a(115),o=a(285);const l=({alertStatus:e,closePopover:t,eventId:a,scopeId:l,refetch:c})=>{const u=Object(i.useDispatch)(),{hasIndexWrite:d}=Object(o.a)(),p=Object(n.useCallback)((()=>{t(),c&&c()}),[t,c]),m=Object(s.getScopedActions)(l),b=Object(n.useCallback)((({eventIds:e,isLoading:t})=>{m&&u(m.setEventsLoading({id:l,eventIds:e,isLoading:t}))}),[u,l,m]),g=Object(n.useCallback)((({eventIds:e,isDeleted:t})=>{m&&u(m.setEventsDeleted({id:l,eventIds:e,isDeleted:t}))}),[u,l,m]),f=Object(r.a)({eventIds:[a],currentStatus:e,setEventsLoading:b,setEventsDeleted:g,onUpdateSuccess:p,onUpdateFailure:p});return{actionItems:d?f:[]}}},function(e,t){const a=/^[0-9]+$/,n=(e,t)=>{const n=a.test(e),i=a.test(t);return n&&i&&(e=+e,t=+t),e===t?0:n&&!i?-1:i&&!n?1:e<t?-1:1};e.exports={compareIdentifiers:n,rcompareIdentifiers:(e,t)=>n(t,e)}},function(e,t,a){"use strict";a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return s})),a.d(t,"f",(function(){return o})),a.d(t,"k",(function(){return l})),a.d(t,"l",(function(){return c})),a.d(t,"j",(function(){return u})),a.d(t,"g",(function(){return d})),a.d(t,"h",(function(){return p})),a.d(t,"d",(function(){return m})),a.d(t,"e",(function(){return b})),a.d(t,"c",(function(){return g})),a.d(t,"p",(function(){return f})),a.d(t,"o",(function(){return y})),a.d(t,"n",(function(){return h})),a.d(t,"m",(function(){return v})),a.d(t,"i",(function(){return E}));var n=a(5),i=a(106);const r=n.i18n.translate("xpack.securitySolution.timeline.callOut.unauthorized.message.description",{defaultMessage:"You can use Timeline to investigate events, but you do not have the required permissions to save timelines for future use. If you need to save timelines, contact your Kibana administrator."}),s=n.i18n.translate("xpack.securitySolution.timeline.callOut.immutable.message.description",{defaultMessage:"This prebuilt timeline template cannot be modified. To make changes, please duplicate this template and make modifications to the duplicate template."}),o=n.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.button",{defaultMessage:"Edit timeline name and description"}),l=n.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.header",{defaultMessage:"Save Timeline"}),c=n.i18n.translate("xpack.securitySolution.timeline.saveTimelineTemplate.modal.header",{defaultMessage:"Save Timeline Template"}),u=n.i18n.translate("xpack.securitySolution.timeline.nameTimeline.save.title",{defaultMessage:"Save"}),d=n.i18n.translate("xpack.securitySolution.timeline.nameTimeline.modal.header",{defaultMessage:"Name Timeline"}),p=n.i18n.translate("xpack.securitySolution.timeline.nameTimelineTemplate.modal.header",{defaultMessage:"Name Timeline Template"}),m=n.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.discard.title",{defaultMessage:"Discard Timeline"}),b=n.i18n.translate("xpack.securitySolution.timeline.saveTimelineTemplate.modal.discard.title",{defaultMessage:"Discard Timeline Template"}),g=n.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.close.title",{defaultMessage:"Close"}),f=e=>n.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.warning.title",{values:{timeline:e===i.l.template?"timeline template":"timeline"},defaultMessage:"You have an unsaved {timeline}. Do you wish to save it?"}),y=n.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.titleTitle",{defaultMessage:"Title"}),h=n.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.titleAriaLabel",{defaultMessage:"Title"}),v=n.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.descriptionLabel",{defaultMessage:"Description"}),E=n.i18n.translate("xpack.securitySolution.timeline.saveTimeline.modal.optionalLabel",{defaultMessage:"Optional"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a(103),r=a(114),s=a(105),o=a(122),l=a(182);const c=({inputId:e=r.a.global,inspectIndex:t=0,isDisabled:a,multiple:c=!1,onClick:u,onCloseInspect:d,queryId:p})=>{const m=Object(i.useDispatch)(),b=o.d.globalQueryByIdSelector(),g=o.d.timelineQueryByIdSelector(),{loading:f,inspect:y,selectedInspectIndex:h,isInspected:v}=Object(s.a)((t=>e===r.a.global?b(t,p):g(t,p))),E=Object(n.useCallback)((()=>{u&&u(),m(l.c.setInspectionParameter({id:p,inputId:e,isInspected:!0,selectedInspectIndex:t}))}),[u,m,p,e,t]),x=Object(n.useCallback)((()=>{null!=d&&d(),m(l.c.setInspectionParameter({id:p,inputId:e,isInspected:!1,selectedInspectIndex:t}))}),[d,m,p,e,t]);let j=null,S=null;null!=y&&y.dsl.length>0&&(c?[j,...S]=y.dsl:j=y.dsl[t]);let k=null,O=null;null!=y&&y.response.length>0&&(c?[k,...O]=y.response:k=y.response[t]);const w=Object(n.useMemo)((()=>!f&&h===t&&v),[t,v,f,h]);return{additionalRequests:S,additionalResponses:O,handleClick:E,handleCloseModal:x,isButtonDisabled:Object(n.useMemo)((()=>f||a||null==j||null==k||null==p),[a,f,p,j,k]),isShowingModal:w,loading:f,request:j,response:k}}},function(e,t,a){"use strict";let n;a.d(t,"a",(function(){return n})),function(e){e.flows="flows",e.dns="dns",e.anomalies="anomalies",e.tls="tls",e.http="http",e.events="events"}(n||(n={}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"e",(function(){return r})),a.d(t,"h",(function(){return s})),a.d(t,"b",(function(){return o})),a.d(t,"c",(function(){return l})),a.d(t,"d",(function(){return c})),a.d(t,"g",(function(){return u})),a.d(t,"f",(function(){return d}));var n=a(129);n.o,n.o,n.o;const i=`${n.o}.group.id`,r=(n.o,`${n.o}.original_time`),s=`${n.o}.threshold_result`,o=`${n.o}.new_terms`,l=`${n.G}.new_terms_fields`,c=`${n.o}.original_event`,u=(n.E,n.E,n.E,n.E,n.E,n.E,n.E,n.E,n.E,n.E,`${n.E}.timeline_id`),d=(n.E,n.E,`${n.E}.indices`)},function(e,t,a){"use strict";a.d(t,"i",(function(){return i})),a.d(t,"g",(function(){return r})),a.d(t,"h",(function(){return s})),a.d(t,"l",(function(){return o})),a.d(t,"e",(function(){return l})),a.d(t,"m",(function(){return c})),a.d(t,"n",(function(){return u})),a.d(t,"a",(function(){return d})),a.d(t,"d",(function(){return p})),a.d(t,"b",(function(){return m})),a.d(t,"k",(function(){return b})),a.d(t,"c",(function(){return g})),a.d(t,"j",(function(){return f})),a.d(t,"f",(function(){return y}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.timeline.body.openSessionViewLabel",{defaultMessage:"Open Session View"}),r=n.i18n.translate("xpack.securitySolution.timeline.body.notes.disableEventTooltip",{defaultMessage:"Notes may not be added here while editing a template timeline"}),s=n.i18n.translate("xpack.securitySolution.timeline.body.notes.addNoteTooltip",{defaultMessage:"Add note"}),o=n.i18n.translate("xpack.securitySolution.timeline.sortFieldsButton",{defaultMessage:"Sort fields"}),l=n.i18n.translate("xpack.securitySolution.timeline.fullScreenButton",{defaultMessage:"Full screen"}),c=n.i18n.translate("xpack.securitySolution.hoverActions.viewDetailsAriaLabel",{defaultMessage:"View details"}),u=({ariaRowindex:e,columnValues:t})=>n.i18n.translate("xpack.securitySolution.hoverActions.viewDetailsForRowAriaLabel",{values:{ariaRowindex:e,columnValues:t},defaultMessage:"View details for the alert or event in row {ariaRowindex}, with columns {columnValues}"}),d=n.i18n.translate("xpack.securitySolution.hoverActions.investigateInResolverTooltip",{defaultMessage:"Analyze event"}),p=({ariaRowindex:e,columnValues:t,checked:a})=>n.i18n.translate("xpack.securitySolution.hoverActions.checkboxForRowAriaLabel",{values:{ariaRowindex:e,checked:a,columnValues:t},defaultMessage:"{checked, select, false {unchecked} true {checked}} checkbox for the alert or event in row {ariaRowindex}, with columns {columnValues}"}),m=({ariaRowindex:e,columnValues:t})=>n.i18n.translate("xpack.securitySolution.hoverActions.investigateInResolverForRowAriaLabel",{values:{ariaRowindex:e,columnValues:t},defaultMessage:"Analyze the alert or event in row {ariaRowindex}, with columns {columnValues}"}),b=({ariaRowindex:e,columnValues:t})=>n.i18n.translate("xpack.securitySolution.hoverActions.sendAlertToTimelineForRowAriaLabel",{values:{ariaRowindex:e,columnValues:t},defaultMessage:"Send the alert in row {ariaRowindex} to timeline, with columns {columnValues}"}),g=({ariaRowindex:e,columnValues:t})=>n.i18n.translate("xpack.securitySolution.hoverActions.addNotesForRowAriaLabel",{values:{ariaRowindex:e,columnValues:t},defaultMessage:"Add notes for the event in row {ariaRowindex} to timeline, with columns {columnValues}"}),f=({ariaRowindex:e,columnValues:t,isEventPinned:a})=>n.i18n.translate("xpack.securitySolution.hoverActions.pinEventForRowAriaLabel",{values:{ariaRowindex:e,columnValues:t,isEventPinned:a},defaultMessage:"{isEventPinned, select, false {Pin} true {Unpin}} the event in row {ariaRowindex} to timeline, with columns {columnValues}"}),y=({ariaRowindex:e,columnValues:t})=>n.i18n.translate("xpack.securitySolution.hoverActions.moreActionsForRowAriaLabel",{values:{ariaRowindex:e,columnValues:t},defaultMessage:"Select more actions for the alert or event in row {ariaRowindex}, with columns {columnValues}"})},function(e,t,a){"use strict";a.d(t,"e",(function(){return i})),a.d(t,"f",(function(){return r})),a.d(t,"b",(function(){return s})),a.d(t,"c",(function(){return o})),a.d(t,"a",(function(){return l})),a.d(t,"d",(function(){return c}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.viewListDetailActionLabel",{defaultMessage:"View list detail"}),r=n.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.viewRuleDetailActionLabel",{defaultMessage:"View rule detail"}),s=n.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.addToRulesTableSelection.link_column",{defaultMessage:"Link"}),o=n.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.addToRulesTableSelection.name_column",{defaultMessage:"Name"}),l=n.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.addToRulesTableSelection.action_column",{defaultMessage:"Action"}),c=n.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.addToRulesTableSelection.tags_column",{defaultMessage:"Tags"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(141),i=a(4);const r=Object(n.d)((async({name:e,description:t,http:a,signal:n})=>await a.post(i.uc,{body:JSON.stringify({name:e,description:t}),headers:{"Content-Type":"application/json"},method:"POST",signal:n}))),s=()=>Object(n.a)(r)},function(e,t,a){"use strict";a.d(t,"d",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"b",(function(){return s})),a.d(t,"a",(function(){return o})),a.d(t,"e",(function(){return l}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.exceptions.list.exception.item.card.edit.label",{defaultMessage:"Edit rule exception"}),r=n.i18n.translate("xpack.securitySolution.exceptions.list.exception.endpoint.item.card.edit.label",{defaultMessage:"Edit endpoint exception"}),s=n.i18n.translate("xpack.securitySolution.exceptions.list.exception.item.card.delete.label",{defaultMessage:"Delete rule exception"}),o=n.i18n.translate("xpack.securitySolution.exceptions.list.exception.endpoint.item.card.delete.label",{defaultMessage:"Delete endpoint exception"}),l=n.i18n.translate("xpack.securitySolution.exceptions.list.utility.title",{defaultMessage:"rule exceptions"})},function(e,t,a){"use strict";a.d(t,"b",(function(){return S})),a.d(t,"a",(function(){return k}));var n=a(220),i=a(42),r=a(40),s=a(2),o=a.n(s),l=a(41),c=a.n(l),u=a(309),d=a(124),p=a(169),m=a(123),b=a(596),g=a(821),f=a(155),y=a(132),h=a(4),v=a(952);const E=c()(r.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-4qbs0b-0"})(["flex:0 1 auto;",""],(({theme:e})=>`margin-top: ${e.eui.euiSizeS};`)),x=c()(r.EuiFlexGroup).withConfig({displayName:"StyledFlexGroup",componentId:"sc-4qbs0b-1"})(["height:100%;"]),j=c()(r.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItem",componentId:"sc-4qbs0b-2"})(["&.euiFlexItem{flex:1 0 0;overflow:hidden;}"]),S=o.a.memo((({eventId:e,eventIndex:t,isAlert:a,loading:s,handleOnEventClosed:l,promptContextId:c,ruleName:b,timestamp:x})=>{const{hasAssistantPrivilege:j}=Object(u.a)(),S=Object(d.a)("alertDetailsPageEnabled"),{onClick:k}=Object(m.o)()({deepLinkId:h.wc.alerts,path:e&&a?Object(p.a)(e):""}),O=Object(v.a)({_id:e,_index:t,timestamp:x});return o.a.createElement(E,{gutterSize:"none",justifyContent:"spaceBetween",wrap:!0},o.a.createElement(r.EuiFlexItem,{grow:!1},!s&&o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiTitle,{size:"s"},o.a.createElement("h4",null,a&&!Object(i.isEmpty)(b)?b:g.c)),x&&o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiSpacer,{size:"s"}),o.a.createElement(y.c,{value:new Date(x)})),a&&e&&S&&o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiSpacer,{size:"l"}),o.a.createElement(m.k,{"data-test-subj":"open-alert-details-page",deepLinkId:h.wc.alerts,onClick:k},g.e),o.a.createElement(r.EuiSpacer,{size:"m"})))),o.a.createElement(r.EuiFlexItem,{grow:!1},o.a.createElement(r.EuiFlexGroup,{direction:"column",alignItems:"flexEnd"},l&&o.a.createElement(r.EuiFlexItem,{grow:!1},o.a.createElement(r.EuiButtonIcon,{iconType:"cross","aria-label":g.b,onClick:l})),o.a.createElement(r.EuiFlexItem,{grow:!1},o.a.createElement(r.EuiFlexGroup,{alignItems:"center",direction:"row",gutterSize:"none"},j&&null!=c&&o.a.createElement(r.EuiFlexItem,{grow:!1},o.a.createElement(n.g,{conversationId:a?f.e:f.i,promptContextId:c})),a&&O&&o.a.createElement(r.EuiFlexItem,{grow:!1},o.a.createElement(r.EuiCopy,{textToCopy:O},(e=>o.a.createElement(r.EuiButtonEmpty,{onClick:e,iconType:"share","data-test-subj":"copy-alert-flyout-link"},g.f)))))))))}));S.displayName="ExpandableEventTitle";const k=o.a.memo((({browserFields:e,event:t,scopeId:a,timelineTabType:n,isAlert:i,isDraggable:s,loading:l,detailsData:c,detailsEcsData:u,rawEventData:d,handleOnEventClosed:p,isReadOnly:m})=>t.eventId?l?o.a.createElement(r.EuiSkeletonText,{lines:10}):o.a.createElement(x,{direction:"column",gutterSize:"none"},o.a.createElement(j,{grow:!0},o.a.createElement(b.a,{browserFields:e,data:null!=c?c:[],detailsEcsData:u,id:t.eventId,isAlert:i,isDraggable:s,rawEventData:d,scopeId:a,timelineTabType:n,handleOnEventClosed:p,isReadOnly:m}))):o.a.createElement(r.EuiTextColor,{color:"subdued"},g.d)));k.displayName="ExpandableEvent"},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n="_id"},function(e,t,a){"use strict";a.d(t,"h",(function(){return d})),a.d(t,"j",(function(){return p})),a.d(t,"i",(function(){return m})),a.d(t,"k",(function(){return b})),a.d(t,"g",(function(){return g})),a.d(t,"b",(function(){return f})),a.d(t,"d",(function(){return y})),a.d(t,"c",(function(){return h})),a.d(t,"e",(function(){return v})),a.d(t,"a",(function(){return E})),a.d(t,"f",(function(){return k}));var n=a(40),i=a(42),r=a(2),s=a.n(r),o=a(41),l=a.n(o),c=a(121),u=a(1044);const d="source.geo.continent_name",p="source.geo.country_name",m="source.geo.country_iso_code",b="source.geo.region_name",g="source.geo.city_name",f="destination.geo.continent_name",y="destination.geo.country_name",h="destination.geo.country_iso_code",v="destination.geo.region_name",E="destination.geo.city_name",x=[{prop:"GeoContinentName",fieldName:"geo.continent_name"},{prop:"GeoCountryName",fieldName:"geo.country_name"},{prop:"GeoCountryIsoCode",fieldName:"geo.country_iso_code"},{prop:"GeoRegionName",fieldName:"geo.region_name"},{prop:"GeoCityName",fieldName:"geo.city_name"}],j=l()(n.EuiFlexItem).withConfig({displayName:"GeoFlexItem",componentId:"sc-19jrcd0-0"})(["margin-right:5px;"]);j.displayName="GeoFlexItem";const S=s.a.memo((({contextId:e,eventId:t,fieldName:a,isDraggable:r,values:o})=>null!=o?s.a.createElement(s.a.Fragment,null,Object(i.uniq)(o).map((i=>s.a.createElement(j,{grow:!1,key:`${e}-${t}-${a}-${i}`},s.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},a===m||a===h?s.a.createElement(n.EuiFlexItem,{grow:!1},s.a.createElement(u.a,{countryCode:i})):null,s.a.createElement(n.EuiFlexItem,{grow:!1},s.a.createElement(c.b,{"data-test-subj":a,field:a,id:`geo-field-values-default-draggable-${e}-${t}-${a}-${i}`,isDraggable:r,tooltipContent:a,value:i}))))))):null));S.displayName="GeoFieldValues";const k=s.a.memo((e=>{const{contextId:t,eventId:a,isDraggable:r,type:o}=e,l=(e=>x.map((({prop:t,fieldName:a})=>({prop:`${e}${t}`,fieldName:`${e}.${a}`}))))(o);return s.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},Object(i.uniq)(l).map((n=>s.a.createElement(S,{contextId:t,eventId:a,fieldName:n.fieldName,isDraggable:r,key:n.fieldName,values:Object(i.get)(n.prop,e)}))))}));k.displayName="GeoFields"},function(e,t,a){"use strict";a.d(t,"c",(function(){return m})),a.d(t,"b",(function(){return b})),a.d(t,"a",(function(){return f}));var n=a(40),i=a(42),r=a(2),s=a.n(r),o=a(41),l=a.n(o),c=a(121),u=a(485),d=a(132),p=a(1435);const m="event.start",b="event.end",g=l()(n.EuiIcon).withConfig({displayName:"TimeIcon",componentId:"sc-181wv62-0"})(["margin-right:3px;position:relative;top:-1px;"]);g.displayName="TimeIcon";const f=s.a.memo((({contextId:e,eventDuration:t,eventId:a,eventEnd:r,eventStart:o,isDraggable:l})=>s.a.createElement(n.EuiFlexGroup,{alignItems:"flexStart","data-test-subj":"duration-and-start-group",direction:"column",justifyContent:"center",gutterSize:"none"},null!=t?Object(i.uniq)(t).map((t=>s.a.createElement(n.EuiFlexItem,{grow:!1,key:t},s.a.createElement(c.b,{field:u.b,id:`duration-event-start-end-default-draggable-${e}-${a}-${u.b}-${t}`,isDraggable:l,name:name,tooltipContent:null,value:t},s.a.createElement(n.EuiText,{size:"xs"},s.a.createElement(g,{size:"m",type:"clock"}),s.a.createElement(p.a,{maybeDurationNanoseconds:t,tooltipTitle:u.b})))))):null,null!=o?Object(i.uniq)(o).map((t=>s.a.createElement(n.EuiFlexItem,{grow:!1,key:t},s.a.createElement(c.b,{field:m,id:`duration-event-start-end-default-draggable-${e}-${a}-${m}-${t}`,isDraggable:l,tooltipContent:null,value:t},s.a.createElement(n.EuiText,{size:"xs"},s.a.createElement(g,{size:"m",type:"clock"}),s.a.createElement(d.a,{fieldName:m,value:t})))))):null,null!=r?Object(i.uniq)(r).map((t=>s.a.createElement(n.EuiFlexItem,{grow:!1,key:t},s.a.createElement(c.b,{field:b,id:`duration-event-start-end-default-draggable-${e}-${a}-${b}-${t}`,isDraggable:l,tooltipContent:null,value:t},s.a.createElement(n.EuiText,{size:"xs"},s.a.createElement(g,{size:"m",type:"clock"}),s.a.createElement(d.a,{fieldName:b,value:t})))))):null)));f.displayName="DurationEventStartEnd"},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(2),i=a.n(n),r=a(121),s=a(127);const o=({args:e,contextId:t,eventId:a,processTitle:n,isDraggable:o})=>Object(s.e)(e)&&Object(s.e)(n)?null:i.a.createElement(i.a.Fragment,null,null!=e&&e.map(((e,n)=>i.a.createElement(s.c,{key:`${t}-args-${n}-${e}`,grow:!1,component:"span"},i.a.createElement(r.c,{contextId:`${t}-args-${n}-${e}`,eventId:a,field:"process.args",isDraggable:o,value:e,fieldType:"keyword",isAggregatable:!0})))),!Object(s.e)(n)&&i.a.createElement(s.c,{grow:!1,component:"span"},i.a.createElement(r.c,{contextId:t,eventId:a,field:"process.title",isDraggable:o,value:n,fieldType:"keyword",isAggregatable:!0})));o.displayName="ArgsComponent";const l=i.a.memo(o);l.displayName="Args"},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(1095);const r={isolateAction:"isolateHost",isHostIsolationPanelOpen:!1,isIsolateActionSuccessBannerVisible:!1};function s(e,t){switch(t.type){case"setIsolateAction":return{...e,isolateAction:t.isolateAction};case"setIsHostIsolationPanel":return{...e,isHostIsolationPanelOpen:t.isHostIsolationPanelOpen};case"setIsIsolateActionSuccessBannerVisible":return{...e,isIsolateActionSuccessBannerVisible:t.isIsolateActionSuccessBannerVisible};default:throw new Error}}const o=()=>{const[{isolateAction:e,isHostIsolationPanelOpen:t,isIsolateActionSuccessBannerVisible:a},o]=Object(n.useReducer)(s,r),l=Object(n.useCallback)((()=>{o({type:"setIsHostIsolationPanel",isHostIsolationPanelOpen:!1}),o({type:"setIsIsolateActionSuccessBannerVisible",isIsolateActionSuccessBannerVisible:!1})}),[]),c=Object(n.useCallback)((e=>{"isolateHost"!==e&&"unisolateHost"!==e||(o({type:"setIsHostIsolationPanel",isHostIsolationPanelOpen:!0}),o({type:"setIsolateAction",isolateAction:e}))}),[]),u=Object(i.b)(),d=Object(n.useCallback)((()=>{o({type:"setIsIsolateActionSuccessBannerVisible",isIsolateActionSuccessBannerVisible:!0}),u&&u.refreshCase()}),[u]);return Object(n.useMemo)((()=>({isolateAction:e,isHostIsolationPanelOpen:t,isIsolateActionSuccessBannerVisible:a,handleIsolationActionSuccess:d,showAlertDetails:l,showHostIsolationPanel:c})),[t,a,e,d,l,c])}},,,function(e,t,a){"use strict";a.d(t,"b",(function(){return s})),a.d(t,"a",(function(){return o}));var n=a(278),i=a(279);const r=window.localStorage,s={groupById:n.b},o=(e,t)=>{let a={};r&&(a=Object(i.c)(r));const s=((e,t,a)=>{switch(t.type){case n.a.updateActiveGroups:{const{id:i,activeGroups:r}=t.payload;return{...e,groupById:{...a,[i]:{...n.c,...a[i],activeGroups:r}}}}case n.a.updateGroupOptions:{const{id:i,newOptionList:r}=t.payload;return{...e,groupById:{...a,[i]:{...n.c,...a[i],options:r}}}}}throw Error("Unknown grouping action")})(e,t,{...e.groupById,...a});if(r){const e=t.payload.id;Object(i.b)(r,e,s.groupById[e])}return s}},function(e,t,a){const n=a(157);e.exports=(e,t,a)=>{const i=new n(e,a),r=new n(t,a);return i.compare(r)||i.compareBuild(r)}},function(e,t,a){const n=a(192);e.exports=(e,t,a)=>n(e,t,a)<0},function(e,t,a){const n=a(157),i=a(463),{ANY:r}=i,s=a(205),o=a(464),l=a(462),c=a(578),u=a(396),d=a(489);e.exports=(e,t,a,p)=>{let m,b,g,f,y;switch(e=new n(e,p),t=new s(t,p),a){case">":m=l,b=u,g=c,f=">",y=">=";break;case"<":m=c,b=d,g=l,f="<",y="<=";break;default:throw new TypeError('Must provide a hilo val of "<" or ">"')}if(o(e,t,p))return!1;for(let a=0;a<t.set.length;++a){const n=t.set[a];let s=null,o=null;if(n.forEach((e=>{e.semver===r&&(e=new i(">=0.0.0")),s=s||e,o=o||e,m(e.semver,s.semver,p)?s=e:g(e.semver,o.semver,p)&&(o=e)})),s.operator===f||s.operator===y)return!1;if((!o.operator||o.operator===f)&&b(e,o.semver))return!1;if(o.operator===y&&g(e,o.semver))return!1}return!0}},function(e,t,a){"use strict";e.exports=function(e){return e.replace(/[\t\n\r ]+/g," ").replace(/^ | $/g,"").toLowerCase().toUpperCase()}},function(e,t,a){"use strict";e.exports=function(e){return null==e?[]:"length"in e?e:[e]}},function(e,t,a){"use strict";var n=a(251);e.exports=function(e,t){return e.length?(n(e,e.length,0,t),e):t}},function(e,t,a){"use strict";e.exports=function(e,t,a){for(var n,i=[],r=-1;++r<e.length;)(n=e[r].resolveAll)&&i.indexOf(n)<0&&(t=n(t,a),i.push(n));return t}},function(e,t,a){"use strict";var n=a(253)(/[A-Za-z]/);e.exports=n},function(e,t,a){"use strict";var n=a(252),i=a(582),r=a(251),s=a(580),o=a(583),l=a(315),c=a(847),u=a(848),d=a(850),p=a(849),m={name:"labelEnd",tokenize:function(e,t,a){for(var n,i,r=this,o=r.events.length;o--;)if(("labelImage"===r.events[o][1].type||"labelLink"===r.events[o][1].type)&&!r.events[o][1]._balanced){n=r.events[o][1];break}return function(t){return n?n._inactive?c(t):(i=r.parser.defined.indexOf(s(r.sliceSerialize({start:n.end,end:r.now()})))>-1,e.enter("labelEnd"),e.enter("labelMarker"),e.consume(t),e.exit("labelMarker"),e.exit("labelEnd"),l):a(t)};function l(a){return 40===a?e.attempt(b,t,i?t:c)(a):91===a?e.attempt(g,t,i?e.attempt(f,t,c):c)(a):i?t(a):c(a)}function c(e){return n._balanced=!0,a(e)}},resolveTo:function(e,t){for(var a,n,s,c,u,d,p,m=e.length,b=0;m--;)if(c=e[m][1],u){if("link"===c.type||"labelLink"===c.type&&c._inactive)break;"enter"===e[m][0]&&"labelLink"===c.type&&(c._inactive=!0)}else if(d){if("enter"===e[m][0]&&("labelImage"===c.type||"labelLink"===c.type)&&!c._balanced&&(u=m,"labelLink"!==c.type)){b=2;break}}else"labelEnd"===c.type&&(d=m);return a={type:"labelLink"===e[u][1].type?"link":"image",start:l(e[u][1].start),end:l(e[e.length-1][1].end)},n={type:"label",start:l(e[u][1].start),end:l(e[d][1].end)},s={type:"labelText",start:l(e[u+b+2][1].end),end:l(e[d-2][1].start)},p=i(p=[["enter",a,t],["enter",n,t]],e.slice(u+1,u+b+3)),p=i(p,[["enter",s,t]]),p=i(p,o(t.parser.constructs.insideSpan.null,e.slice(u+b+4,d-3),t)),p=i(p,[["exit",s,t],e[d-2],e[d-1],["exit",n,t]]),p=i(p,e.slice(d+1)),p=i(p,[["exit",a,t]]),r(e,u,e.length,p),e},resolveAll:function(e){for(var t,a=-1;++a<e.length;)(t=e[a][1])._used||"labelImage"!==t.type&&"labelLink"!==t.type&&"labelEnd"!==t.type||(e.splice(a+1,"labelImage"===t.type?4:2),t.type="data",a++);return e}},b={tokenize:function(e,t,a){return function(t){return e.enter("resource"),e.enter("resourceMarker"),e.consume(t),e.exit("resourceMarker"),p(e,i)};function i(t){return 41===t?o(t):c(e,r,a,"resourceDestination","resourceDestinationLiteral","resourceDestinationLiteralMarker","resourceDestinationRaw","resourceDestinationString",3)(t)}function r(t){return n(t)?p(e,s)(t):o(t)}function s(t){return 34===t||39===t||40===t?d(e,p(e,o),a,"resourceTitle","resourceTitleMarker","resourceTitleString")(t):o(t)}function o(n){return 41===n?(e.enter("resourceMarker"),e.consume(n),e.exit("resourceMarker"),e.exit("resource"),t):a(n)}}},g={tokenize:function(e,t,a){var n=this;return function(t){return u.call(n,e,i,a,"reference","referenceMarker","referenceString")(t)};function i(e){return n.parser.defined.indexOf(s(n.sliceSerialize(n.events[n.events.length-1][1]).slice(1,-1)))<0?a(e):t(e)}}},f={tokenize:function(e,t,a){return function(t){return e.enter("reference"),e.enter("referenceMarker"),e.consume(t),e.exit("referenceMarker"),n};function n(n){return 93===n?(e.enter("referenceMarker"),e.consume(n),e.exit("referenceMarker"),e.exit("reference"),t):a(n)}}};e.exports=m},function(e,t,a){"use strict";a.d(t,"k",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"b",(function(){return s})),a.d(t,"j",(function(){return o})),a.d(t,"h",(function(){return l})),a.d(t,"i",(function(){return c})),a.d(t,"g",(function(){return u})),a.d(t,"f",(function(){return d})),a.d(t,"c",(function(){return p})),a.d(t,"m",(function(){return m})),a.d(t,"l",(function(){return b})),a.d(t,"d",(function(){return g})),a.d(t,"e",(function(){return f}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.detectionEngine.detectionsPageTitle",{defaultMessage:"Alerts"}),r=n.i18n.translate("xpack.securitySolution.detectionEngine.alertTitle",{defaultMessage:"Alerts"}),s=n.i18n.translate("xpack.securitySolution.detectionEngine.buttonManageRules",{defaultMessage:"Manage rules"}),o=n.i18n.translate("xpack.securitySolution.detectionEngine.noIndexTitle",{defaultMessage:"Let’s set up your detection engine"}),l=n.i18n.translate("xpack.securitySolution.detectionEngine.needsSignalsAndListsIndexesMessage",{defaultMessage:"You need permissions for the signals and lists indices."}),c=n.i18n.translate("xpack.securitySolution.detectionEngine.needsSignalsIndexMessage",{defaultMessage:"You need permissions for the signals index."}),u=n.i18n.translate("xpack.securitySolution.detectionEngine.needsListsIndexesMessage",{defaultMessage:"You need permissions for the lists indices."}),d=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.needsIndexPermissionsMessage",{values:{additionalContext:e},defaultMessage:"To use the detection engine, a user with the required cluster and index privileges must first access this page. {additionalContext} For more help, contact your Elastic Stack administrator."}),p=n.i18n.translate("xpack.securitySolution.detectionEngine.goToDocumentationButton",{defaultMessage:"View documentation"}),m=n.i18n.translate("xpack.securitySolution.detectionEngine.userUnauthenticatedTitle",{defaultMessage:"Detection engine permissions required"}),b=n.i18n.translate("xpack.securitySolution.detectionEngine.userUnauthenticatedMsgBody",{defaultMessage:"You do not have the required permissions for viewing the detection engine. For more help, contact your administrator."}),g=n.i18n.translate("xpack.securitySolution.detectionEngine.mlRulesDisabledMessageTitle",{defaultMessage:"ML rules require Platinum License and ML Admin Permissions"}),f=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.mlUnavailableTitle",{values:{totalRules:e},defaultMessage:"{totalRules} {totalRules, plural, =1 {rule requires} other {rules require}} Machine Learning to enable."})},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(0),i=a.n(n);class InvariantError extends Error{constructor(...e){super(...e),i()(this,"name","InvariantError")}}function r(e,t){if(!e)throw new InvariantError(t)}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"c",(function(){return s}));var n=a(4);const i=20,r=[5,10,20,50,n.nc],s="securitySolution.rulesTable"},function(e,t,a){"use strict";a.d(t,"d",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return s})),a.d(t,"g",(function(){return o})),a.d(t,"e",(function(){return l})),a.d(t,"i",(function(){return c})),a.d(t,"j",(function(){return u})),a.d(t,"h",(function(){return d})),a.d(t,"f",(function(){return p})),a.d(t,"k",(function(){return m})),a.d(t,"c",(function(){return b}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.advancedSettingsButton",{defaultMessage:"Advanced settings"}),r=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.addReferenceDescription",{defaultMessage:"Add reference URL"}),s=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.addFalsePositiveDescription",{defaultMessage:"Add false positive example"}),o=(n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.addCustomHighlightedFieldDescription",{defaultMessage:"Add a custom highlighted field"}),n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.endpointExceptionListLabel",{defaultMessage:"Elastic Endpoint exceptions"})),l=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.buildingBlockLabel",{defaultMessage:"Building block"}),c=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.severityOptionLowDescription",{defaultMessage:"Low"}),u=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.severityOptionMediumDescription",{defaultMessage:"Medium"}),d=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.severityOptionHighDescription",{defaultMessage:"High"}),p=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRuleForm.severityOptionCriticalDescription",{defaultMessage:"Critical"}),m=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.referencesUrlInvalidError",{defaultMessage:"URL is invalid format"}),b=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutrule.noteHelpText",{defaultMessage:"Add rule investigation guide..."})},function(e,t,a){"use strict";a.d(t,"a",(function(){return y}));var n=a(8),i=a(5),r=a(40),s=a(2),o=a.n(s),l=a(49),c=a(370),u=a(197),d=a(4),p=a(204),m=a(125),b=a(213),g=a(750),f=a(471);const y={index:{defaultValue:[],fieldsToValidateOnChange:["index","queryBar"],type:m.a.COMBO_BOX,label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fiedIndexPatternsLabel",{defaultMessage:"Index patterns"}),helpText:o.a.createElement(r.EuiText,{size:"xs"},f.i),validations:[{validator:(...e)=>{const[{formData:t}]=e;if(!Object(p.d)(t.ruleType)&&t.dataSourceType===b.a.IndexPatterns)return m.h.emptyField(i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.outputIndiceNameFieldRequiredError",{defaultMessage:"A minimum of one index pattern is required."}))(...e)}}]},dataViewId:{label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.dataViewSelector",{defaultMessage:"Data view"}),fieldsToValidateOnChange:["dataViewId"],validations:[{validator:(...e)=>{const[{path:t,formData:a}]=e,n=null!=a.dataViewId&&""!==a.dataViewId;if(!Object(p.d)(a.ruleType)&&!n&&a.dataSourceType===b.a.DataView)return{path:t,message:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.dataViewSelectorFieldRequired",{defaultMessage:"Please select an available Data View or Index Pattern."})}}}]},dataViewTitle:{label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.dataViewTitleSelector",{defaultMessage:"Data view index pattern"}),validations:[]},eqlOptions:{},queryBar:{validations:[{validator:(...e)=>{const[{value:t,path:a,formData:i}]=e,{query:r,filters:s,saved_id:o}=t;if(!Object(p.d)(i.ruleType)&&Object(n.isEmpty)(r.query)&&Object(n.isEmpty)(s)&&!o)return{code:"ERR_FIELD_MISSING",path:a,message:Object(u.b)(i.ruleType)?f.f:f.d}}},{validator:(...e)=>{const[{value:t,path:a,formData:i}]=e,{query:r}=t;if(!Object(p.d)(i.ruleType)&&!Object(n.isEmpty)(r.query)&&"kuery"===r.language)try{Object(l.fromKueryExpression)(r.query)}catch(e){return{code:"ERR_FIELD_FORMAT",path:a,message:f.j}}}},{validator:Object(g.a)(g.b,300)}]},ruleType:{label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldRuleTypeLabel",{defaultMessage:"Rule type"}),validations:[]},anomalyThreshold:{label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldAnomalyThresholdLabel",{defaultMessage:"Anomaly score threshold"}),validations:[]},machineLearningJobId:{label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldMachineLearningJobIdLabel",{defaultMessage:"Machine Learning job"}),validations:[{validator:(...e)=>{const[{formData:t}]=e;if(Object(p.d)(t.ruleType))return m.h.emptyField(i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.machineLearningJobIdRequired",{defaultMessage:"A Machine Learning job is required."}))(...e)}}]},relatedIntegrations:{label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldRelatedIntegrationsLabel",{defaultMessage:"Related integrations"}),helpText:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldRelatedIntegrationsHelpText",{defaultMessage:"Integration related to this Rule."})},requiredFields:{label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldRequiredFieldsLabel",{defaultMessage:"Required fields"}),helpText:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldRequiredFieldsHelpText",{defaultMessage:"Fields required for this Rule to function."})},timeline:{label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldTimelineTemplateLabel",{defaultMessage:"Timeline template"}),helpText:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldTimelineTemplateHelpText",{defaultMessage:"Select which timeline to use when investigating generated alerts."})},threshold:{label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdLabel",{defaultMessage:"Threshold"}),field:{type:m.a.COMBO_BOX,label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldThresholdFieldLabel",{defaultMessage:"Group by"}),helpText:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldThresholdFieldHelpText",{defaultMessage:"Select fields to group by. Fields are joined together with 'AND'"}),validations:[{validator:(...e)=>{const[{formData:t}]=e;if(Object(u.g)(t.ruleType))return m.h.maxLengthField({length:3,message:i.i18n.translate("xpack.securitySolution.detectionEngine.validations.thresholdFieldFieldData.arrayLengthGreaterThanMaxErrorMessage",{defaultMessage:"Number of fields must be 3 or less."})})(...e)}}]},value:{type:m.a.NUMBER,label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldThresholdValueLabel",{defaultMessage:"Threshold"}),validations:[{validator:(...e)=>{const[{formData:t}]=e;if(Object(u.g)(t.ruleType))return m.h.numberGreaterThanField({than:1,message:i.i18n.translate("xpack.securitySolution.detectionEngine.validations.thresholdValueFieldData.numberGreaterThanOrEqualOneErrorMessage",{defaultMessage:"Value must be greater than or equal to one."}),allowEquality:!0})(...e)}}]},cardinality:{field:{defaultValue:[],fieldsToValidateOnChange:["threshold.cardinality.field","threshold.cardinality.value"],type:m.a.COMBO_BOX,label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdCardinalityFieldLabel",{defaultMessage:"Count"}),validations:[{validator:(...e)=>{const[{formData:t}]=e;if(Object(u.g)(t.ruleType))return Object(n.isEmpty)(t["threshold.cardinality.field"])&&!Object(n.isEmpty)(t["threshold.cardinality.value"])?m.h.emptyField(i.i18n.translate("xpack.securitySolution.detectionEngine.validations.thresholdCardinalityFieldFieldData.thresholdCardinalityFieldNotSuppliedMessage",{defaultMessage:"A Cardinality Field is required."}))(...e):void 0}}],helpText:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdFieldCardinalityFieldHelpText",{defaultMessage:"Select a field to check cardinality"})},value:{fieldsToValidateOnChange:["threshold.cardinality.field","threshold.cardinality.value"],type:m.a.NUMBER,label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThresholdCardinalityValueFieldLabel",{defaultMessage:"Unique values"}),validations:[{validator:(...e)=>{const[{formData:t}]=e;if(Object(u.g)(t.ruleType))return Object(n.isEmpty)(t["threshold.cardinality.field"])?void 0:m.h.numberGreaterThanField({than:1,message:i.i18n.translate("xpack.securitySolution.detectionEngine.validations.thresholdCardinalityValueFieldData.numberGreaterThanOrEqualOneErrorMessage",{defaultMessage:"Value must be greater than or equal to one."}),allowEquality:!0})(...e)}}]}}},threatIndex:{type:m.a.COMBO_BOX,label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThreatIndexPatternsLabel",{defaultMessage:"Indicator index patterns"}),helpText:o.a.createElement(r.EuiText,{size:"xs"},f.q),validations:[{validator:(...e)=>{const[{formData:t}]=e;if(Object(u.f)(t.ruleType))return m.h.emptyField(i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.threatMatchoutputIndiceNameFieldRequiredError",{defaultMessage:"A minimum of one index pattern is required."}))(...e)}},{validator:(...e)=>{const[{formData:t,value:a}]=e;if(Object(u.f)(t.ruleType))return c.b.forbiddenField(a,"*")}}]},threatMapping:{label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThreatMappingLabel",{defaultMessage:"Indicator mapping"}),validations:[{validator:(...e)=>{const[{path:t,formData:a}]=e;if(Object(u.f)(a.ruleType))return Object(c.j)(a.threatMapping)?{code:"ERR_FIELD_MISSING",path:t,message:f.r}:Object(c.a)(a.threatMapping)?{code:"ERR_FIELD_MISSING",path:t,message:f.p}:void 0}}]},threatQueryBar:{label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldThreatQueryBarLabel",{defaultMessage:"Indicator index query"}),validations:[{validator:(...e)=>{const[{value:t,path:a,formData:i}]=e;if(!Object(u.f)(i.ruleType))return;const{query:r,filters:s}=t;return Object(n.isEmpty)(r.query)&&Object(n.isEmpty)(s)?{code:"ERR_FIELD_MISSING",path:a,message:f.d}:void 0}},{validator:(...e)=>{const[{value:t,path:a,formData:i}]=e;if(!Object(u.f)(i.ruleType))return;const{query:r}=t;if(!Object(n.isEmpty)(r.query)&&"kuery"===r.language)try{Object(l.fromKueryExpression)(r.query)}catch(e){return{code:"ERR_FIELD_FORMAT",path:a,message:f.j}}}}]},groupByFields:{type:m.a.COMBO_BOX,label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.groupByFieldsLabel",{defaultMessage:"Suppress alerts by"}),labelAppend:o.a.createElement(r.EuiText,{color:"subdued",size:"xs"},i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.groupByFieldsLabelAppend",{defaultMessage:"Optional (Technical Preview)"})),helpText:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldGroupByFieldHelpText",{defaultMessage:"Select field(s) to use for suppressing extra alerts"}),validations:[{validator:(...e)=>{const[{formData:t}]=e;if(Object(u.e)(t.ruleType))return m.h.maxLengthField({length:3,message:i.i18n.translate("xpack.securitySolution.detectionEngine.validations.stepDefineRule.groupByFieldsMax",{defaultMessage:"Number of grouping fields must be at most 3"})})(...e)}}]},groupByRadioSelection:{},groupByDuration:{label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.groupByDurationValueLabel",{defaultMessage:"Suppress alerts for"}),helpText:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.fieldGroupByDurationValueHelpText",{defaultMessage:"Suppress alerts for"}),value:{},unit:{}},suppressionMissingFields:{label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.suppressionMissingFieldsLabel",{defaultMessage:"If a suppression field is missing"})},newTermsFields:{type:m.a.COMBO_BOX,label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.newTermsFieldsLabel",{defaultMessage:"Fields"}),helpText:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldNewTermsFieldHelpText",{defaultMessage:"Select a field to check for new terms."}),validations:[{validator:(...e)=>{const[{formData:t}]=e;if(Object(u.d)(t.ruleType))return m.h.emptyField(i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.newTermsFieldsMin",{defaultMessage:"A minimum of one field is required."}))(...e)}},{validator:(...e)=>{const[{formData:t}]=e;if(Object(u.d)(t.ruleType))return m.h.maxLengthField({length:d.Kb,message:i.i18n.translate("xpack.securitySolution.detectionEngine.validations.stepDefineRule.newTermsFieldsMax",{defaultMessage:"Number of fields must be 3 or less."})})(...e)}}]},historyWindowSize:{label:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.historyWindowSizeLabel",{defaultMessage:"History Window Size"}),helpText:i.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRule.historyWindowSizeHelpText",{defaultMessage:"New terms rules only alert if terms don't appear in historical data."})},shouldLoadQueryDynamically:{type:m.a.CHECKBOX,defaultValue:!1}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(2),i=a(108),r=a(858);function s(){const e=Object(i.a)();return Object(n.useCallback)((({actionType:t,error:a})=>{e.addError(function(e){return e.stack=JSON.stringify(e.body,null,2),e}(a),{title:Object(r.d)(t),toastMessage:Object(r.b)(t,a)})}),[e])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return m}));var n=a(2),i=a(120),r=a(244),s=a(40),o=a(123),l=a(4),c=a(593),u=a(198),d=a(900),p=a(743);const m=({exceptionsList:e,handleExport:t,handleDelete:a,handleDuplicate:m,handleManageRules:b})=>{const[g,f]=Object(n.useState)(r.i.LOADING),[y,h]=Object(n.useState)(),[v,E]=Object(n.useState)(!1),[x,j]=Object(n.useState)(!1),[S,k]=Object(n.useState)(null),{name:O,list_id:w,rules:T,type:I,created_by:C,created_at:M,description:_}=e,F=Object(n.useCallback)((()=>{f("")}),[f]),A=e=>{h(e),j(!0)},{lastUpdated:D,exceptionViewerStatus:N,exceptions:P,pagination:R,ruleReferences:L,fetchItems:B,onDeleteException:q,onPaginationChange:z}=Object(c.a)({list:e,deleteToastTitle:u.u,deleteToastBody:e=>u.t(e),errorToastBody:u.p,errorToastTitle:u.q,onEditListExceptionItem:A,onFinishFetchingExceptions:F});Object(n.useEffect)((()=>{B(null,r.i.LOADING)}),[B]);const[$,V]=Object(n.useState)(!1),U=Object(s.useGeneratedHtmlId)({prefix:"openAccordion"}),H=Object(d.a)(e),G=Object(n.useMemo)((()=>g===r.i.EMPTY?u.B:""),[g]),Q=Object(n.useMemo)((()=>g===r.i.EMPTY?u.y(e.name):""),[e.name,g]),W=Object(n.useMemo)((()=>e.type===i.b.ENDPOINT?u.A:u.z),[e.type]),K=Object(n.useMemo)((()=>[{key:"Export",icon:"exportAction",label:u.O,onClick:a=>{I===i.b.ENDPOINT?t({id:e.id,listId:e.list_id,name:e.name,namespaceType:e.namespace_type,includeExpiredExceptions:!0})():k(p.a.EXPORT)}},{key:"Duplicate",icon:"copy",label:u.k,disabled:H,onClick:e=>{k(p.a.DUPLICATE)}},{key:"Delete",icon:"trash",disabled:H,label:u.j,onClick:t=>{a({id:e.id,listId:e.list_id,namespaceType:e.namespace_type})()}},{key:"LinkRules",icon:"gear",disabled:H,label:u.W,onClick:e=>{b()}}]),[H,I,t,e.id,e.list_id,e.name,e.namespace_type,a,b]),Y=Object(n.useCallback)((()=>{E(!0)}),[E]),J=Object(n.useCallback)((e=>{E(!1),j(!1),e&&B()}),[B,E,j]),X=Object(n.useCallback)((()=>{k(p.a.EXPORT)}),[k]),Z=Object(n.useCallback)((a=>{S===p.a.EXPORT&&t({id:e.id,listId:e.list_id,name:e.name,namespaceType:e.namespace_type,includeExpiredExceptions:a})(),S===p.a.DUPLICATE&&m({listId:e.list_id,name:e.name,namespaceType:e.namespace_type,includeExpiredExceptions:a})()}),[S,t,e.id,e.list_id,e.name,e.namespace_type,m]),{onClick:ee}=Object(o.o)()({deepLinkId:l.wc.exceptions,path:`/details/${e.list_id}`});return{listId:w,listName:O,listDescription:_,createdAt:new Date(M).toDateString(),createdBy:C,listRulesCount:T.length.toString(),exceptionItemsCount:R.totalItemCount.toString(),listType:I,menuActionItems:K,showAddExceptionFlyout:v,toggleAccordion:$,openAccordionId:U,viewerStatus:g,exceptionToEdit:y,showEditExceptionFlyout:x,lastUpdated:D,exceptions:P,ruleReferences:L,pagination:R,exceptionViewerStatus:N,onEditExceptionItem:A,onDeleteException:q,onPaginationChange:z,setToggleAccordion:V,onAddExceptionClick:Y,handleConfirmExceptionFlyout:J,handleCancelExceptionItemFlyout:()=>{E(!1),j(!1)},goToExceptionDetail:ee,emptyViewerTitle:G,emptyViewerBody:Q,emptyViewerButtonText:W,showIncludeExpiredExceptionsModal:S,onExportListClick:X,handleCancelExpiredExceptionsModal:()=>{k(null)},handleConfirmExpiredExceptionsModal:Z}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(244),r=a(102),s=a(605);const o=({list:e,deleteToastTitle:t,deleteToastBody:a,errorToastTitle:o,errorToastBody:l,onEditListExceptionItem:c,onFinishFetchingExceptions:u})=>{const{services:d}=Object(r.j)(),{http:p}=d,m=Object(r.n)(),[b,g]=Object(n.useState)([]),[f,y]=Object(n.useState)({}),[h,v]=Object(n.useState)({pageIndex:0,pageSize:0,totalItemCount:0}),[E,x]=Object(n.useState)(null),[j,S]=Object(n.useState)(""),k=Object(n.useCallback)(((e,t,a)=>{null==m||m.addError(e,{title:t||o,toastMessage:a||l}),S(i.i.ERROR)}),[l,o,m]),O=Object(n.useCallback)((async()=>{try{const t=await Object(s.c)([e]);y(t)}catch(e){k(e)}}),[k,e,y]),w=Object(n.useCallback)(((e,t,a)=>{v(e),x(Date.now()),setTimeout((()=>{if(a===i.i.EMPTY_SEARCH)return S(t?"":a);S(t?"":i.i.EMPTY)}),200)}),[]),T=Object(n.useCallback)((async(t,a)=>{try{S(i.i.LOADING);const{data:n,pagination:r}=await Object(s.b)({http:p,...Object(s.g)(null,e,t)});g(n),O(),w(r,n.length,a),"function"==typeof u&&u()}catch(e){k(e)}}),[p,e,O,w,u,k]),I=Object(n.useCallback)((async({id:e,name:n,namespaceType:r})=>{try{S(i.i.LOADING),await Object(s.a)({id:e,http:p,namespaceType:r}),null==m||m.addSuccess({title:t,text:"function"==typeof a?a(n):""}),T()}catch(e){k(e)}}),[p,m,t,a,T,k]),C=Object(n.useCallback)((async e=>{T(e)}),[T]);return{exceptions:b,lastUpdated:E,pagination:h,exceptionViewerStatus:j,ruleReferences:f,fetchItems:T,onDeleteException:I,onEditExceptionItem:e=>{"function"==typeof c&&c(e)},onPaginationChange:C}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(163),i=a(141);const r=Object(i.d)((async({file:e,http:t,signal:a,overwrite:i,overwriteExceptions:r,asNewList:s})=>{const o=new FormData;return o.append("file",e),await t.post(`${n.t}/_import`,{body:o,query:{overwrite:i,overwrite_exceptions:r,as_new_list:s},headers:{"Content-Type":void 0},method:"POST",signal:a})})),s=()=>Object(i.a)(r)},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(2),i=a(120),r=a(244),s=a(198),o=a(757);const l=(e,t)=>{const[a,l]=Object(n.useState)(!1),[c,u]=Object(n.useState)(!1),[d,p]=Object(n.useState)(),[m,b]=Object(n.useState)(r.i.LOADING),g=Object(n.useCallback)((()=>{b("")}),[b]),f=e=>{p(e),u(!0)},{exceptionViewerStatus:y,exceptions:h,lastUpdated:v,pagination:E,ruleReferences:x,fetchItems:j,onDeleteException:S,onPaginationChange:k}=Object(o.b)({list:e,deleteToastTitle:s.u,deleteToastBody:e=>s.t(e),errorToastBody:s.p,errorToastTitle:s.q,onEditListExceptionItem:f,onFinishFetchingExceptions:g});Object(n.useEffect)((()=>{j(null,r.i.LOADING)}),[j,t]);const O=Object(n.useMemo)((()=>m===r.i.EMPTY?s.B:""),[m]),w=Object(n.useMemo)((()=>m===r.i.EMPTY?s.y(e.name):""),[e.name,m]),T=Object(n.useMemo)((()=>e.type===i.b.ENDPOINT?s.A:s.z),[e.type]),I=Object(n.useCallback)((async e=>{b(r.i.SEARCHING),j(e,r.i.EMPTY_SEARCH)}),[j,b]),C=Object(n.useCallback)((()=>{l(!0),j()}),[j,l]),M=Object(n.useCallback)((e=>{l(!1),u(!1),e&&j()}),[j,l,u]);return{exceptionViewerStatus:y,listName:e.name,exceptions:h,listType:e.type,lastUpdated:v,pagination:E,viewerStatus:m,emptyViewerTitle:O,emptyViewerBody:w,emptyViewerButtonText:T,ruleReferences:x,showAddExceptionFlyout:a,showEditExceptionFlyout:c,exceptionToEdit:d,onSearch:I,onAddExceptionClick:C,onDeleteException:S,onEditExceptionItem:f,onPaginationChange:k,handleCancelExceptionItemFlyout:()=>{l(!1),u(!1)},handleConfirmExceptionFlyout:M}}},function(e,t,a){"use strict";a.d(t,"b",(function(){return ht})),a.d(t,"a",(function(){return Ot}));var n=a(104),i=a.n(n),r=a(40),s=a(2),o=a.n(s),l=a(41),c=a.n(l),u=a(8),d=a(186),p=a(282),m=a(944),b=a(124),g=a(929),f=a(291),y=a(272),h=a(199),v=a(948),E=a(930),x=a(236),j=a(44),S=a(212),k=a(113),O=a(117),w=a(813),T=a(492);const I=({risk:e,riskEntity:t,originalRisk:a})=>{var n,i,s,l,c,u,d,p;const m=t===k.w.host?null==e||null===(n=e.result)||void 0===n||null===(i=n[0])||void 0===i||null===(s=i.host)||void 0===s||null===(l=s.risk)||void 0===l?void 0:l.calculated_level:null==e||null===(c=e.result)||void 0===c||null===(u=c[0])||void 0===u||null===(d=u.user)||void 0===d||null===(p=d.risk)||void 0===p?void 0:p.calculated_level;return o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiPanel,{hasBorder:!0,paddingSize:"s",grow:!1},o.a.createElement(Q,{title:o.a.createElement(T.a,{title:x.o(t),riskScoreEntity:t}),toolTipTitle:o.a.createElement(T.a,{title:x.o(t),riskScoreEntity:t,showTechnicalPreviewBadge:!0}),toolTipContent:o.a.createElement(j.FormattedMessage,{id:"xpack.securitySolution.alertDetails.overview.riskDataTooltipContent",defaultMessage:"Risk classification is displayed only when available for a {riskEntity}. Ensure {riskScoreDocumentationLink} is enabled within your environment.",values:{riskEntity:t,riskScoreDocumentationLink:o.a.createElement(w.a,{riskScoreEntity:t,title:x.p(t)})}})}),e.loading&&o.a.createElement(r.EuiLoadingSpinner,{"data-test-subj":"loading"}),!e.loading&&o.a.createElement(o.a.Fragment,null,o.a.createElement(G,{field:x.a(t),value:m?o.a.createElement(S.b,{severity:m,hideBackgroundColor:!0}):Object(O.e)()}),a&&m!==a&&o.a.createElement(o.a.Fragment,null,o.a.createElement(G,{field:x.m(t),value:o.a.createElement(S.b,{severity:a,hideBackgroundColor:!0})})))))},C=o.a.memo(I);var M=a(42),_=a(165),F=a(336),A=a(337),D=a(115);const N=c.a.span.withConfig({displayName:"EnrichmentFieldFeedName",componentId:"sc-1cy82j8-0"})(["white-space:nowrap;font-style:italic;"]),P=c()(r.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-1cy82j8-1"})([".inlineActions{opacity:0;}.inlineActions-popoverOpen{opacity:1;}&:hover{.inlineActions{opacity:1;}}"]),R=({browserField:e,data:t,eventId:a,index:n,feedName:i,scopeId:l,value:c,isDraggable:u,isReadOnly:d})=>{const p=Object(s.useMemo)((()=>({scopeId:l})),[l]);if(!t||!c)return null;const m=`alert-details-value-formatted-field-value-${l}-${a}-${t.field}-${c}-${n}-${i}`;return o.a.createElement(P,{key:m,direction:"row",gutterSize:"xs",alignItems:"center"},o.a.createElement(r.EuiFlexItem,{grow:!1},o.a.createElement("div",null,o.a.createElement(A.a,{contextId:l,eventId:m,fieldFormat:t.format,fieldName:t.field,fieldType:t.type,isDraggable:u,isObjectArray:t.isObjectArray,value:c,truncate:!1}),i&&o.a.createElement(N,null," ",x.e," ",i))),o.a.createElement(r.EuiFlexItem,null,c&&!d&&o.a.createElement(_.c,{data:{field:t.field,value:c},triggerId:_.d.DETAILS_FLYOUT,mode:_.a.INLINE,sourcererScopeId:Object(D.getSourcererScopeId)(l),metadata:p,visibleCellActions:3})))},L=({browserFields:e,data:t,enrichments:a,scopeId:n,eventId:i,isDraggable:s,isReadOnly:l})=>{const c=a.map(((a,n)=>{var i,r,s,o;const{field:l,type:c,feedName:u,value:d}=Object(F.c)(a),p=t.find((e=>e.field===l)),m=null!==(i=null==p?void 0:p.category)&&void 0!==i?i:"",b=Object(M.get)([m,"fields",null!=l?l:""],e);return{fieldsData:{field:null!=l?l:"",format:null!==(r=null==b?void 0:b.format)&&void 0!==r?r:"",type:null!==(s=null==b?void 0:b.type)&&void 0!==s?s:"",isObjectArray:null!==(o=null==p?void 0:p.isObjectArray)&&void 0!==o&&o},type:c,feedName:u,index:n,field:l,browserField:b,value:d}})),[d,p]=Object(u.partition)(c,(({type:e})=>Object(F.e)(e)));return o.a.createElement(o.a.Fragment,null,p.length>0&&o.a.createElement(r.EuiFlexItem,{grow:!1},o.a.createElement(r.EuiPanel,{hasBorder:!0,paddingSize:"s",grow:!1},o.a.createElement(Q,{title:x.f,toolTipContent:x.g}),p.map((({fieldsData:e,index:t,field:a,feedName:r,browserField:c,value:u})=>o.a.createElement(G,{key:a,field:a,value:o.a.createElement(R,{eventId:i,index:t,feedName:r,scopeId:n,value:u,data:e,browserField:c,isDraggable:s,isReadOnly:l})}))))),d.length>0&&o.a.createElement(r.EuiFlexItem,{grow:!1},o.a.createElement(r.EuiPanel,{hasBorder:!0,paddingSize:"s",grow:!1},o.a.createElement(Q,{title:x.i,toolTipContent:x.k}),d.map((({fieldsData:e,index:t,field:a,feedName:r,browserField:c,value:u})=>o.a.createElement(G,{key:a,field:a,value:o.a.createElement(R,{eventId:i,index:t,feedName:r,scopeId:n,value:u,data:e,browserField:c,isDraggable:s,isReadOnly:l})}))))))},B=o.a.memo(L);var q=a(414);const z=c()(r.EuiTitle).withConfig({displayName:"UppercaseEuiTitle",componentId:"sc-1az7ye2-0"})(["text-transform:uppercase;"]),$=({children:e})=>o.a.createElement(z,{size:"xxxs"},o.a.createElement("h5",null,e)),V=c()(r.EuiTitle).withConfig({displayName:"StyledEnrichmentFieldTitle",componentId:"sc-1az7ye2-1"})(["width:220px;"]),U=({title:e})=>o.a.createElement(V,{size:"xxxs"},o.a.createElement("h6",null,e)),H=c()(r.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-1az7ye2-2"})(["font-size:",";margin-top:",";"],(({theme:e})=>e.eui.euiFontSizeXS),(({theme:e})=>e.eui.euiSizeS)),G=({field:e,value:t})=>o.a.createElement(H,{direction:"row",gutterSize:"none",responsive:!0,alignItems:"center","data-test-subj":"EnrichedDataRow"},o.a.createElement(r.EuiFlexItem,{style:{flexShrink:0},grow:!1},o.a.createElement(U,{title:e})),o.a.createElement(r.EuiFlexItem,{className:"eui-textBreakWord"},t)),Q=({title:e,toolTipContent:t,toolTipTitle:a})=>{const[n,i]=Object(s.useState)(!1),l=Object(s.useCallback)((()=>{i(!n)}),[n,i]),c=Object(s.useCallback)((()=>{i(!1)}),[i]);return o.a.createElement(r.EuiFlexGroup,{direction:"row",gutterSize:"none",alignItems:"center"},o.a.createElement(r.EuiFlexItem,null,o.a.createElement($,null,e)),o.a.createElement(r.EuiFlexItem,{grow:!1},o.a.createElement(r.EuiPopover,{isOpen:n,closePopover:c,anchorPosition:"leftCenter",button:o.a.createElement(r.EuiButtonIcon,{color:"text",size:"xs",iconSize:"m",iconType:"iInCircle","aria-label":x.h,onClick:l})},o.a.createElement(r.EuiPopoverTitle,null,null!=a?a:e),o.a.createElement(r.EuiText,{size:"s",style:{width:"270px"}},t))))},W=({browserFields:e,data:t,enrichments:a,eventId:n,scopeId:i,hostRisk:s,userRisk:l,isDraggable:c,isReadOnly:u})=>{var d,p,m,b;const g=null==t||null===(d=t.find((e=>"host.risk.calculated_level"===(null==e?void 0:e.field))))||void 0===d||null===(p=d.values)||void 0===p?void 0:p[0],f=null==t||null===(m=t.find((e=>"user.risk.calculated_level"===(null==e?void 0:e.field))))||void 0===m||null===(b=m.values)||void 0===b?void 0:b[0],y=Object(q.a)("entity-analytics");return y||0!==a.length?o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiHorizontalRule,null),o.a.createElement(r.EuiTitle,{size:"xxxs"},o.a.createElement("h5",null,x.b)),o.a.createElement(r.EuiSpacer,{size:"m"}),o.a.createElement(r.EuiFlexGroup,{direction:"column",gutterSize:"m",style:{flexGrow:0}},y&&o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiFlexItem,{grow:!1},o.a.createElement(C,{riskEntity:k.w.host,risk:s,originalRisk:g})),o.a.createElement(r.EuiFlexItem,{grow:!1},o.a.createElement(C,{riskEntity:k.w.user,risk:l,originalRisk:f}))),o.a.createElement(B,{browserFields:e,data:t,enrichments:a,scopeId:i,eventId:n,isDraggable:c,isReadOnly:u}))):null},K=o.a.memo(W);var Y=a(943),J=a(155),X=a(655);const Z=c()(r.EuiInMemoryTable).withConfig({displayName:"SummaryTable",componentId:"sc-12oammb-0"})([".inlineActions{opacity:0;}.flyoutTableHoverActions{.inlineActions-popoverOpen{opacity:1;}&:hover{.inlineActions{opacity:1;}}}"]);var ee=a(812),te=a(217),ae=a(142);const ne={flexGrow:0},ie=({data:e,eventId:t,fieldFromBrowserField:a,isDraggable:n,linkValue:i,scopeId:r,values:s,isReadOnly:l})=>{const c=Object(te.e)(e.field);return o.a.createElement(o.a.Fragment,null,o.a.createElement(ee.a,{contextId:r,data:e,eventId:t,fieldFromBrowserField:a,linkValue:i,isDraggable:n,style:ne,values:s}),r!==ae.f.active&&!l&&c&&o.a.createElement(_.c,{data:{field:e.field,value:s},triggerId:_.d.DETAILS_FLYOUT,mode:_.a.INLINE,visibleCellActions:3,sourcererScopeId:Object(D.getSourcererScopeId)(r),metadata:{scopeId:r}}))};ie.displayName="SummaryValueCell";var re=a(271),se=a(320),oe=a(394);const le=({data:e,eventId:t,fieldFromBrowserField:a,linkValue:n,scopeId:i,values:s})=>{const{loading:l,count:c}=Object(oe.a)({field:e.field,isActiveTimelines:i===ae.f.active,value:s,signalIndexName:null}),u=Object(se.c)({contextId:i,eventId:t,field:e.field,fieldFormat:e.format,fieldFromBrowserField:a,fieldType:e.type,isObjectArray:e.isObjectArray,linkValue:n,values:s});return l?o.a.createElement(r.EuiLoadingSpinner,null):"number"==typeof c&&null!=u&&u.dataProviders&&null!=u&&u.dataProviders.length?o.a.createElement(re.a,{asEmptyButton:!0,dataProviders:u.dataProviders,filters:u.filters},o.a.createElement("span",{"data-test-subj":"alert-prevalence"},c)):Object(O.d)()};le.displayName="PrevalenceCell";const ce=[{field:"title",truncateText:!1,name:J.o,textOnly:!0},{field:"description",truncateText:!1,render:ie,name:J.p}],ue=[...ce,{field:"description",truncateText:!0,render:e=>o.a.createElement(le,e),name:o.a.createElement(o.a.Fragment,null,J.m," ",o.a.createElement(r.EuiIconTip,{type:"iInCircle",color:"subdued",title:J.m,content:o.a.createElement("span",null,J.n)})),align:"right",width:"130px"}],de={className:"flyoutTableHoverActions"},pe=({goToTable:e,rows:t,title:a,isReadOnly:n})=>{const i=n?ce:ue;return o.a.createElement("div",null,o.a.createElement(r.EuiFlexGroup,null,o.a.createElement(r.EuiFlexItem,null,o.a.createElement(r.EuiTitle,{size:"xxxs"},o.a.createElement("h5",null,a))),o.a.createElement(r.EuiFlexItem,{grow:!1},o.a.createElement(r.EuiLink,{onClick:e,"data-test-subj":"summary-view-go-to-table-link"},o.a.createElement(r.EuiText,{size:"xs"},J.F)))),o.a.createElement(r.EuiSpacer,{size:"s"}),o.a.createElement(Z,{"data-test-subj":"summary-view",items:t,columns:i,rowProps:de,compressed:!0}))},me=o.a.memo(pe),be=({browserFields:e,data:t,eventId:a,isDraggable:n,scopeId:i,title:r,goToTable:l,isReadOnly:c,investigationFields:u})=>{const d=Object(s.useMemo)((()=>Object(X.c)({browserFields:e,data:t,eventId:a,isDraggable:n,scopeId:i,isReadOnly:c,investigationFields:u})),[e,t,a,n,i,c,u]);return o.a.createElement(me,{goToTable:l,isReadOnly:c,rows:d,title:r})},ge=o.a.memo(be);var fe=a(509),ye=a(927),he=a(402),ve=a(61),Ee=a(135),xe=a(188);const je=ve.euiStyled.div`
  margin-left: ${({theme:e})=>e.eui.euiSizeS};
`,Se=Object(ve.euiStyled)(r.EuiPanel)`
  &&& {
    background-color: ${({theme:e})=>e.eui.euiColorLightestShade};
    padding: ${({theme:e})=>e.eui.euiSizeS};
    height: 78px;
  }

  &:hover {
    .inlineActions {
      opacity: 1;
      width: auto;
      transform: translate(0);
    }
  }

  .inlineActions {
    opacity: 0;
    width: 0;
    transform: translate(6px);
    transition: transform 50ms ease-in-out;

    &.inlineActions-popoverOpen {
      opacity: 1;
      width: auto;
      transform: translate(0);
    }
   }
`,ke=({title:e,children:t})=>o.a.createElement(Se,{borderRadius:"none",hasShadow:!1,hasBorder:!1,paddingSize:"s"},o.a.createElement(r.EuiText,{size:"s"},e),o.a.createElement(r.EuiSpacer,{size:"s"}),t);ke.displayName="OverviewCard";const Oe=ve.euiStyled.div`
  /* Clamp text content to 2 lines */
  display: -webkit-box;
  -webkit-line-clamp: 2;
  -webkit-box-orient: vertical;
  overflow: hidden;
`;Oe.displayName="ClampedContent";const we=({title:e,children:t,contextId:a,dataTestSubj:n,enrichedFieldInfo:i})=>o.a.createElement(ke,{title:e},o.a.createElement(r.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},o.a.createElement(Oe,{"data-test-subj":n},t),o.a.createElement(je,null,o.a.createElement(_.c,{data:{field:i.data.field,value:null==i?void 0:i.values},triggerId:_.d.DETAILS_FLYOUT,mode:_.a.INLINE,sourcererScopeId:Object(D.getSourcererScopeId)(a),metadata:{scopeId:a},visibleCellActions:3}))));we.displayName="OverviewCardWithActions";var Te=a(906),Ie=a(329),Ce=a(293),Me=a(711);const _e=Object(ve.euiStyled)(r.EuiFlexGroup)`
  flex-grow: 0;
`,Fe=o.a.memo((({browserFields:e,contextId:t,data:a,eventId:n,handleOnEventClosed:i,scopeId:l,isReadOnly:c})=>{const u=Object(s.useMemo)((()=>{const i=Object(M.find)({field:xe.o,category:"kibana"},a);return i&&Object(te.b)({eventId:n,contextId:t,scopeId:l,browserFields:e,item:i})}),[e,t,a,n,l]),d=Object(s.useMemo)((()=>{const i=Object(M.find)({field:"kibana.alert.severity",category:"kibana"},a);return i&&Object(te.b)({eventId:n,contextId:t,scopeId:l,browserFields:e,item:i})}),[e,t,a,n,l]),p=Object(s.useMemo)((()=>{const i=Object(M.find)({field:"kibana.alert.risk_score",category:"kibana"},a);return i&&Object(te.b)({eventId:n,contextId:t,scopeId:l,browserFields:e,item:i})}),[e,t,a,n,l]),m=Object(s.useMemo)((()=>{const i=Object(M.find)({field:xe.n,category:"kibana"},a),r=Object(M.find)({field:"kibana.alert.rule.uuid",category:"kibana"},a);return i&&Object(te.b)({eventId:n,contextId:t,scopeId:l,browserFields:e,item:i,linkValueField:r})}),[e,t,a,n,l]),b=Ae(u)&&!c?o.a.createElement(r.EuiFlexItem,{key:"status"},o.a.createElement(we,{title:Ee.J,enrichedFieldInfo:u,contextId:t},o.a.createElement(Te.a,{eventId:n,contextId:t,enrichedFieldInfo:u,scopeId:l,handleOnEventClosed:i}))):null,g=Ae(d)?o.a.createElement(r.EuiFlexItem,{key:"severity"},c?o.a.createElement(ke,{title:Ee.s},o.a.createElement(Ie.a,{value:d.values[0]})):o.a.createElement(we,{title:Ee.s,enrichedFieldInfo:d,contextId:t},o.a.createElement(Ie.a,{value:d.values[0]}))):null,f=Ae(p)?o.a.createElement(r.EuiFlexItem,{key:"riskScore"},c?o.a.createElement(ke,{title:Ee.o},p.values[0]):o.a.createElement(we,{title:Ee.o,enrichedFieldInfo:p,contextId:t,dataTestSubj:"riskScore"},p.values[0])):null,y=Ae(m)&&!c?o.a.createElement(r.EuiFlexItem,{key:"ruleName"},o.a.createElement(we,{title:Ee.p,enrichedFieldInfo:m,contextId:t},o.a.createElement(A.a,{contextId:t,eventId:n,value:m.values[0],fieldName:m.data.field,linkValue:m.linkValue,fieldType:m.data.type,fieldFormat:m.data.format,isDraggable:!1,truncate:!1}))):null,{width:h,ref:v}=Object(Ce.b)(),E=0===h||h&&h>=675,x=[b,g,f,y].filter(Me.h),j=E?o.a.createElement(_e,{gutterSize:"s"},x):o.a.createElement(o.a.Fragment,null,Object(M.chunk)(2,x).map(((e,t,{length:a})=>{const n=t<a-1;return o.a.createElement(s.Fragment,{key:t},o.a.createElement(_e,{gutterSize:"s"},e),n&&o.a.createElement(r.EuiSpacer,{size:"s"}))})));return o.a.createElement("div",{ref:v},j)}));function Ae(e){return!!e&&Array.isArray(e.values)}Fe.displayName="Overview";var De=a(129),Ne=a(243);function Pe(e){return Boolean(e&&e.values&&e.values.length)}var Re=a(102),Le=a(17),Be=a(684);const qe=Object(ve.euiStyled)(r.EuiAccordion)`
  border: 1px solid ${({theme:e})=>e.eui.euiColorLightShade};
  padding: 10px 8px;
  border-radius: 6px;
`,ze=o.a.memo((({prefix:e,state:t,text:a,renderContent:n,onToggle:i=M.noop,extraAction:s,forceState:l})=>{const c=Object(r.useGeneratedHtmlId)({prefix:e});switch(t){case"loading":return o.a.createElement(qe,{id:c,buttonContent:a,onToggle:i,isLoading:!0});case"error":return o.a.createElement(qe,{id:c,buttonContent:o.a.createElement("span",null,o.a.createElement(r.EuiIcon,{type:"warning",color:"danger",style:{marginRight:"6px"}}),a),onToggle:i,extraAction:s});case"success":return o.a.createElement(qe,{"tour-step":`${e}-accordion`,"data-test-subj":`${e}-accordion`,id:c,buttonContent:a,onToggle:i,paddingSize:"l",extraAction:s,forceState:l},n());default:return null}}));ze.displayName="InsightAccordion";var $e=a(132),Ve=a(233),Ue=a(232);const He=(e,t)=>({fields:t,_source:!1,query:{ids:{values:e}}}),Ge=["@timestamp","kibana.alert.rule.name","kibana.alert.severity"],Qe=[{field:"kibana.alert.rule.name",name:"Rule"},{field:"@timestamp",name:"@timestamp",render:e=>o.a.createElement($e.c,{value:new Date(e)})},{field:"kibana.alert.severity",name:"Severity",render:e=>o.a.createElement(Ie.a,{value:e})}],We=o.a.memo((({alertIds:e})=>{const t=Object(s.useMemo)((()=>e.slice(0,10)),[e]),{loading:a,error:n,data:i}=(({alertIds:e,fields:t=["*"]})=>{const[a]=Object(s.useState)((()=>He(e,t))),{loading:n,data:i,setQuery:r}=Object(Ve.a)({query:a,queryName:Ue.a.BY_ID});return Object(s.useEffect)((()=>{r(He(e,t))}),[r,e,t]),{loading:n,error:!n&&void 0===i,data:null==i?void 0:i.hits.hits}})({alertIds:t,fields:Ge}),l=Object(s.useMemo)((()=>{if(i)return i.map((e=>e.fields))}),[i]);if(a)return o.a.createElement(r.EuiSkeletonText,{lines:2});if(n)return o.a.createElement(o.a.Fragment,null,Ne.p);if(l){const t=e.length>10;return o.a.createElement(o.a.Fragment,null,t&&o.a.createElement("div",null,o.a.createElement("em",null,Ne.q),o.a.createElement(r.EuiSpacer,null)),o.a.createElement(r.EuiBasicTable,{compressed:!0,items:l,columns:Qe}))}return null}));We.displayName="SimpleAlertTable";const Ke=o.a.memo((({originalDocumentId:e,index:t,eventId:a,scopeId:n})=>{const[i,r]=Object(s.useState)(!1),[l,c]=Object(s.useState)({}),u=Object(s.useCallback)((e=>r(e)),[]),d=Object(s.useCallback)((()=>i?l.alertIds?o.a.createElement(Je,{eventId:a,scopeId:n,alertIds:l.alertIds}):o.a.createElement(Ye,{index:t,originalDocumentId:e,eventId:a,isActiveTimelines:Object(D.isActiveTimeline)(null!=n?n:""),onCacheLoad:c}):null),[i,l.alertIds,t,e,a,n]);return o.a.createElement(ze,{prefix:"RelatedAlertsByProcessAncestry",state:"success",text:l.alertIds?Object(Ne.h)(l.alertIds.length):Ne.g,renderContent:d,onToggle:u})}));Ke.displayName="RelatedAlertsByProcessAncestry";const Ye=({originalDocumentId:e,index:t,isActiveTimelines:a,onCacheLoad:n,eventId:i})=>{const{values:l}=t,{values:c}=e,u=Array.isArray(c)?c[0]:"",{loading:d,error:p,alertIds:m}=Object(Be.a)({isActiveTimeline:a,documentId:u,indices:null!=l?l:[]});return Object(s.useEffect)((()=>{m&&0!==m.length&&n({alertIds:m})}),[m,n]),d?o.a.createElement(r.EuiLoadingSpinner,null):p?o.a.createElement(o.a.Fragment,null,Ne.j):m&&0!==m.length?null:o.a.createElement(o.a.Fragment,null,Ne.i)};Ye.displayName="FetchAndNotifyCachedAlertsByProcessAncestry";const Je=({alertIds:e,eventId:t,scopeId:a})=>{const n=e&&e.length&&e.length>=5,i=Object(s.useMemo)((()=>e&&e.length?n?null:e.reduce(((e,n,i)=>{const r=`${a}-${t}-event.id-${i}-${n}`;return e.push(Object(se.a)("_id",r,n)),e}),[]):null),[e,n,a,t]),l=Object(s.useMemo)((()=>n?[{meta:{alias:Ne.k,type:"phrases",key:"_id",params:[...e],negate:!1,disabled:!1,value:e.join()},query:{bool:{should:e.map((e=>({match_phrase:{_id:e}}))),minimum_should_match:1}}}]:null),[e,n]);return i||l?o.a.createElement(o.a.Fragment,null,o.a.createElement(We,{alertIds:e}),o.a.createElement(r.EuiSpacer,null),o.a.createElement(re.a,{asEmptyButton:!1,dataProviders:i,filters:l,"data-test-subj":"investigate-ancestry-in-timeline"},Ee.h)):null};Je.displayName="ActualRelatedAlertsByProcessAncestry";var Xe=a(363),Ze=a(123),et=a(4);const tt=o.a.memo((({eventId:e})=>{const{services:{cases:t}}=Object(Re.j)(),a=Object(Re.n)(),[n,i]=Object(s.useState)(void 0),[r,l]=Object(s.useState)(!1),{activeStep:c,isTourShown:u}=Object(Xe.b)(),d=Object(s.useMemo)((()=>c===h.a.viewCase&&u(h.b.alertsCases)),[c,u]),p=Object(s.useCallback)((()=>function(e=[]){const t=e.length;return o.a.createElement("span",null,o.a.createElement(j.FormattedMessage,{defaultMessage:"This alert was found in {caseCount}",id:"xpack.securitySolution.alertDetails.overview.insights_related_cases_found_content",values:{caseCount:o.a.createElement("strong",null,o.a.createElement(j.FormattedMessage,{id:"xpack.securitySolution.alertDetails.overview.insights_related_cases_found_content_count",defaultMessage:"{caseCount} {caseCount, plural, =0 {cases.} =1 {case:} other {cases:}}",values:{caseCount:t}}))}}),e.map((({id:t,title:a},n)=>t&&a?o.a.createElement("span",{key:t}," ",o.a.createElement(Ze.a,{detailName:t,title:a,index:n},a),e[n+1]?",":""):o.a.createElement(o.a.Fragment,null))))}(n)),[n]),[m,b]=Object(s.useState)(!1);Object(s.useEffect)((()=>{if(!m)return;let n=!1;return(async()=>{let r=[];try{var s;e&&(r=null!==(s=await t.api.getRelatedCases(e,{owner:et.i}))&&void 0!==s?s:[])}catch(e){n||l(!0),a.addWarning(Object(Ne.c)(e))}n||(i(r),b(!1))})(),()=>{n=!0}}),[t.api,e,m,a]),Object(s.useEffect)((()=>{b(!0)}),[e]);let g="loading";return r?g="error":n&&(g="success"),o.a.createElement(ze,{prefix:"RelatedCases",state:g,text:at(g,null==n?void 0:n.length),renderContent:p,forceState:d?"open":void 0})}));function at(e,t=0){switch(e){case"loading":return Ne.d;case"error":return Ne.b;case"success":return Object(Ne.a)(t);default:return""}}tt.displayName="RelatedCases";const nt=o.a.memo((({browserFields:e,data:t,eventId:a,scopeId:n})=>{const{field:i,values:l}=t,{error:c,count:u,alertIds:d}=Object(oe.a)({field:i,value:l,isActiveTimelines:Object(D.isActiveTimeline)(n),signalIndexName:null,includeAlertIds:!0}),{fieldFromBrowserField:p}=Object(te.b)({browserFields:e,contextId:n,eventId:a,field:{id:t.field},scopeId:n,item:t}),m=Object(se.c)({field:i,values:l,contextId:n,eventId:a,fieldFromBrowserField:p,fieldFormat:null==p?void 0:p.format,fieldType:null==p?void 0:p.type}),b=0===u;let g="loading";c?g="error":d&&(g="success");const f=Object(s.useCallback)((()=>d&&null!=m&&m.dataProviders?b&&"loading"!==g?Ne.s:o.a.createElement(o.a.Fragment,null,o.a.createElement(We,{alertIds:d}),o.a.createElement(r.EuiSpacer,null),o.a.createElement(re.a,{asEmptyButton:!1,dataProviders:null==m?void 0:m.dataProviders},Ee.h)):null),[d,null==m?void 0:m.dataProviders,b,g]);return o.a.createElement(ze,{prefix:"RelatedAlertsBySourceEvent",state:g,text:it(g,u),renderContent:f})}));function it(e,t){switch(e){case"loading":return Ne.u;case"error":return Ne.t;case"success":return Object(Ne.r)(t);default:return""}}nt.displayName="RelatedAlertsBySourceEvent";const rt=o.a.memo((({browserFields:e,data:t,eventId:a,scopeId:n})=>{const{field:i,values:l}=t,{error:c,count:u,alertIds:d}=Object(oe.a)({field:i,value:l,isActiveTimelines:Object(D.isActiveTimeline)(n),signalIndexName:null,includeAlertIds:!0,ignoreTimerange:!0}),{fieldFromBrowserField:p}=Object(te.b)({browserFields:e,contextId:n,eventId:a,field:{id:t.field},scopeId:n,item:t}),m=Object(se.c)({field:i,values:l,contextId:n,eventId:a,fieldFromBrowserField:p,fieldFormat:null==p?void 0:p.format,fieldType:null==p?void 0:p.type}),b=0===u;let g="loading";c?g="error":(d||b)&&(g="success");const f=Object(s.useCallback)((()=>d&&null!=m&&m.dataProviders?b&&"loading"!==g?Ne.m:o.a.createElement(o.a.Fragment,null,o.a.createElement(We,{alertIds:d}),o.a.createElement(r.EuiSpacer,null),o.a.createElement(re.a,{asEmptyButton:!1,dataProviders:null==m?void 0:m.dataProviders},Ee.h)):null),[d,null==m?void 0:m.dataProviders,b,g]);return o.a.createElement(ze,{prefix:"RelatedAlertsBySession",state:g,text:st(g,u),renderContent:f})}));function st(e,t){switch(e){case"loading":return Ne.o;case"error":return Ne.n;case"success":return Object(Ne.l)(t);default:return""}}rt.displayName="RelatedAlertsBySession";const ot=ve.euiStyled.div`
  border: 1px solid ${({theme:e})=>e.eui.euiColorLightShade};
  padding: 12px;
  border-radius: 6px;
`,lt=Object(ve.euiStyled)(r.EuiIcon)`
  margin-right: 10px;
`,ct=o.a.memo((()=>{const{getAppUrl:e,navigateTo:t}=Object(Re.l)(),a=e({appId:"management",path:"stack/license_management"}),n=Object(s.useCallback)((()=>{t({url:a})}),[t,a]);return o.a.createElement(ot,null,o.a.createElement(r.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},o.a.createElement(r.EuiFlexItem,{grow:!1},o.a.createElement(lt,{size:"m",type:"lock"})),o.a.createElement(r.EuiFlexItem,null,o.a.createElement(r.EuiText,{size:"s"},o.a.createElement(r.EuiLink,{color:"subdued",onClick:n,target:"_blank"},Ne.f)))))}));ct.displayName="RelatedAlertsUpsell";const ut=Object(ve.euiStyled)(r.EuiFlexItem)`
  border: 1px solid ${({theme:e})=>e.eui.euiColorLightShade};
  padding: 10px 8px;
  border-radius: 6px;
  display: inline-flex;
`,dt=o.a.memo((({browserFields:e,eventId:t,data:a,isReadOnly:n,scopeId:i})=>{const s=Object(b.a)("insightsRelatedAlertsByProcessAncestry"),l=Object(Le.b)().isPlatinumPlus(),c=Object(M.find)({category:"kibana",field:"kibana.alert.ancestors.id"},a),u=Object(M.find)({category:"kibana",field:"kibana.alert.rule.parameters.index"},a),d=Object(M.find)({category:"agent",field:"agent.type"},a),p=Object(M.find)({category:"event",field:"event.module"},a),m=Pe(Object(M.find)({category:"process",field:"process.entity_id"},a))&&function(e,t){return Pe(e)&&("endpoint"===e.values[0]||"winlogbeat"===e.values[0]&&Pe(t)&&"sysmon"===t.values[0])}(d,p),g=Object(M.find)({category:"process",field:"process.entry_leader.entity_id"},a),f=s&&Pe(g),y=Object(M.find)({category:"kibana",field:"kibana.alert.original_event.id"},a),h=Pe(y),v=Object(M.find)({category:"kibana",field:De.Y},a),E=Pe(v),x=Object(Re.h)().read,j=s&&m&&c&&u;return n||!(x||m||h||f)?null:o.a.createElement("div",null,o.a.createElement(r.EuiFlexGroup,{direction:"column",gutterSize:"m"},o.a.createElement(r.EuiFlexItem,null,o.a.createElement(r.EuiTitle,{size:"xxxs"},o.a.createElement("h5",null,Ne.e))),E&&o.a.createElement(ut,null,o.a.createElement("div",null,o.a.createElement(r.EuiIcon,{type:"layers",style:{marginLeft:"4px",marginRight:"8px"}}),Ne.v(parseInt(v.values[0],10)),o.a.createElement(r.EuiBetaBadge,{label:Ne.w,style:{verticalAlign:"middle",marginLeft:"8px"},size:"s"}))),x&&o.a.createElement(r.EuiFlexItem,null,o.a.createElement(tt,{eventId:t})),y&&y.values&&o.a.createElement(r.EuiFlexItem,null,o.a.createElement(nt,{browserFields:e,data:y,eventId:t,scopeId:i})),g&&g.values&&o.a.createElement(r.EuiFlexItem,{"data-test-subj":"related-alerts-by-session"},o.a.createElement(rt,{browserFields:e,data:g,eventId:t,scopeId:i})),j&&(l?o.a.createElement(r.EuiFlexItem,{"data-test-subj":"related-alerts-by-ancestry"},o.a.createElement(Ke,{originalDocumentId:c,index:u,eventId:t,scopeId:i})):o.a.createElement(r.EuiFlexItem,null,o.a.createElement(ct,null)))))}));dt.displayName="Insights";var pt=a(284);const mt={cursorStart:0,querySize:1};var bt=a(420),gt=a(127),ft=a(382),yt=a(931);let ht;!function(e){e.tableView="table-view",e.jsonView="json-view",e.summaryView="summary-view",e.threatIntelView="threat-intel-view",e.osqueryView="osquery-results-view",e.responseActionsView="response-actions-results-view"}(ht||(ht={}));const vt=c()(r.EuiTabbedContent).withConfig({displayName:"StyledEuiTabbedContent",componentId:"sc-xa1bmm-0"})(["display:flex;flex:1;flex-direction:column;overflow:hidden;> [role='tabpanel']{display:flex;flex:1;flex-direction:column;overflow:hidden;overflow-y:auto;::-webkit-scrollbar{-webkit-appearance:none;width:7px;}::-webkit-scrollbar-thumb{border-radius:4px;background-color:rgba(0,0,0,0.5);-webkit-box-shadow:0 0 1px rgba(255,255,255,0.5);}}"]),Et=c.a.div.withConfig({displayName:"TabContentWrapper",componentId:"sc-xa1bmm-1"})(["height:100%;position:relative;"]),xt=c.a.div.withConfig({displayName:"RendererContainer",componentId:"sc-xa1bmm-2"})(["overflow-x:auto;padding-right:",";& ."," .euiFlexGroup{justify-content:flex-start;}"],(e=>e.theme.eui.euiSizeXS),gt.a),jt=c()(r.EuiFlexGroup).withConfig({displayName:"ThreatTacticContainer",componentId:"sc-xa1bmm-3"})(["flex-grow:0;flex-wrap:nowrap;& .euiFlexGroup{flex-wrap:nowrap;}"]),St=c.a.div.withConfig({displayName:"ThreatTacticDescription",componentId:"sc-xa1bmm-4"})(["padding-left:",";"],(e=>e.theme.eui.euiSizeL)),kt=({browserFields:e,data:t,detailsEcsData:a,id:n,isAlert:l,isDraggable:c,rawEventData:x,scopeId:j,timelineTabType:S,handleOnEventClosed:O,isReadOnly:w})=>{const[T,I]=Object(s.useState)(ht.summaryView),C=Object(s.useCallback)((e=>I(e.id)),[]),M=Object(s.useCallback)((()=>I(ht.tableView)),[]),_=Object(s.useMemo)((()=>Object(F.b)(t)),[t]),A=Object(d.b)(t),{rule:D}=Object(p.a)(A.ruleId),N=Object(s.useMemo)((()=>l?Object(F.f)(t).map((e=>Object(F.g)(e))):[]),[t,l]),{result:P,loading:R,setRange:L,range:B}=Object(fe.c)(_),q=Object(s.useMemo)((()=>Object(g.a)(x)),[x]),z=Object(s.useMemo)((()=>R||null==P||!P.enrichments?N:Object(F.a)([...N,...P.enrichments])),[R,P,N]),$=z.length,{hostRisk:V,userRisk:U,isAuthorized:H}=(e=>{const{hostName:t,userName:a}=Object(d.b)(e),n=Object(s.useMemo)((()=>t?Object(k.D)([t]):void 0),[t]),{data:i,loading:r,isAuthorized:o,isModuleEnabled:l}=Object(pt.c)({filterQuery:n,pagination:mt,riskEntity:k.w.host,skip:!n}),c=Object(s.useMemo)((()=>({loading:r,isModuleEnabled:l,result:i})),[i,r,l]),u=Object(s.useMemo)((()=>a?Object(k.E)([a]):void 0),[a]),{data:p,loading:m,isAuthorized:b,isModuleEnabled:g}=Object(pt.c)({filterQuery:u,pagination:mt,riskEntity:k.w.user,skip:!u});return{userRisk:Object(s.useMemo)((()=>({loading:m,isModuleEnabled:g,result:p})),[m,g,p]),hostRisk:c,isAuthorized:o&&b}})(t),G=Object(s.useMemo)((()=>null!=a?Object(bt.a)({data:a,rowRenderers:ft.b}):null),[a]),Q=Object(s.useMemo)((()=>Object(y.c)(j)),[j]),W=Object(s.useMemo)((()=>$>0||H&&(V||U)),[$,V,H,U]),X=Object(b.a)("endpointResponseActionsEnabled"),Z=Object(s.useMemo)((()=>{var i;return l?{id:ht.summaryView,name:J.v,"data-test-subj":"overviewTab",content:o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiSpacer,{size:"m"}),o.a.createElement(Fe,{browserFields:e,contextId:j,data:t,eventId:n,scopeId:j,handleOnEventClosed:O,isReadOnly:w}),o.a.createElement(r.EuiSpacer,{size:"l"}),q&&q[0]&&o.a.createElement(jt,{alignItems:"flexStart",direction:"column",wrap:!1,gutterSize:"none"},o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiTitle,{size:"xxs"},o.a.createElement("h5",null,q[0].title)),o.a.createElement(St,null,q[0].description))),o.a.createElement(r.EuiSpacer,{size:"l"}),null!=G&&null!=a&&o.a.createElement("div",null,o.a.createElement(r.EuiTitle,{size:"xs"},o.a.createElement("h5",null,J.c)),o.a.createElement(r.EuiSpacer,{size:"s"}),o.a.createElement(xt,{"data-test-subj":"renderer"},G.renderRow({contextId:"event-details",data:a,isDraggable:null!=c&&c,scopeId:j}))),o.a.createElement(r.EuiHorizontalRule,null),o.a.createElement(ge,{data:t,eventId:n,browserFields:e,isDraggable:c,scopeId:j,title:J.l,isReadOnly:w,goToTable:M,investigationFields:null!==(i=null==D?void 0:D.investigation_fields)&&void 0!==i?i:[]}),o.a.createElement(r.EuiSpacer,{size:"xl"}),o.a.createElement(dt,{browserFields:e,eventId:n,data:t,scopeId:j,isReadOnly:w}),W&&o.a.createElement(K,{isDraggable:c,hostRisk:V,userRisk:U,browserFields:e,data:t,eventId:n,scopeId:j,enrichments:z,isReadOnly:w}),R&&o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiSkeletonText,{lines:2})),A.ruleId&&(null==D?void 0:D.note)&&o.a.createElement(he.b,{basicData:A,ruleNote:D.note}))}:void 0}),[l,e,j,t,n,O,w,q,G,a,c,M,null==D?void 0:D.investigation_fields,null==D?void 0:D.note,W,V,U,z,R,A]),ee=Object(s.useMemo)((()=>l&&!w?{id:ht.threatIntelView,"data-test-subj":"threatIntelTab",name:J.C,append:o.a.createElement(o.a.Fragment,null,R?o.a.createElement(r.EuiLoadingSpinner,null):o.a.createElement(r.EuiNotificationBadge,{"data-test-subj":"enrichment-count-notification"},$)),content:o.a.createElement(Y.a,{before:o.a.createElement(r.EuiSpacer,{size:"m"}),loading:R,enrichments:z,showInvestigationTimeEnrichments:!Object(u.isEmpty)(_)},o.a.createElement(o.a.Fragment,null,o.a.createElement(ye.a,{setRange:L,loading:R,range:B}),o.a.createElement(r.EuiSpacer,{size:"m"})))}:void 0),[z,L,B,$,l,_,R,w]),te=Object(s.useMemo)((()=>({id:ht.tableView,"data-test-subj":"tableTab",name:J.B,content:o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiSpacer,{size:"l"}),o.a.createElement(v.a,{browserFields:e,data:t,eventId:n,isDraggable:c,scopeId:j,timelineTabType:S,isReadOnly:w}))})),[e,t,n,c,j,S,w]),ae=Object(s.useMemo)((()=>({id:ht.jsonView,"data-test-subj":"jsonViewTab",name:J.r,content:o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiSpacer,{size:"m"}),o.a.createElement(Et,{"data-test-subj":"jsonViewWrapper"},o.a.createElement(E.a,{rawEventData:x})))})),[x]),ne=Object(m.a)({rawEventData:x,...null!==a?{ecsData:a}:{}}),ie=Object(yt.a)({rawEventData:x,...null!==a?{ecsData:a}:{}}),re=Object(s.useMemo)((()=>X?[ne]:[ie]),[X,ie,ne]),se=Object(s.useMemo)((()=>[Z,ee,te,ae,...re].filter((e=>!!e))),[Z,ee,te,ae,re]),oe=Object(s.useMemo)((()=>{var e;return null!==(e=se.find((e=>e.id===T)))&&void 0!==e?e:se[0]}),[se,T]),le=Object(s.useMemo)((()=>Q?{"tour-step":Object(h.c)(3,h.b.alertsCases)}:{}),[Q]);return o.a.createElement(f.a,{isTourAnchor:Q,step:h.a.reviewAlertDetailsFlyout,tourId:h.b.alertsCases},o.a.createElement(o.a.Fragment,null,o.a.createElement(r.EuiSpacer,{size:"s"}),o.a.createElement(vt,i()({},le,{"data-test-subj":"eventDetails",tabs:se,selectedTab:oe,onTabClick:C,key:"event-summary-tabs"}))))};kt.displayName="EventDetailsComponent";const Ot=o.a.memo(kt)},function(e,t,a){"use strict";a.d(t,"a",(function(){return ue}));var n=a(40),i=a(42),r=a(2),s=a.n(r),o=a(41),l=a.n(o),c=a(180),u=a(49),d=a(13),p=a(1061),m=a(268),b=a(102),g=a(896),f=a(415),y=a(162),h=a(648),v=a(231),E=a(474),x=a(957),j=a(1415),S=a(5);const k=S.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.mlRunJobLabel",{defaultMessage:"Run job"}),O=S.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.mlStopJobLabel",{defaultMessage:"Stop job"}),w=(S.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.mlJobStoppedDescription",{defaultMessage:"Stopped"}),S.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.mlAdminPermissionsRequiredDescription",{defaultMessage:"ML Admin Permissions required to perform this action"}));var T,I=a(204),C=a(1104);!function(e){e.info="info",e.warning="warning",e.error="error"}(T||(T={}));const M=({message:e})=>{if(!e)return null;let t="primary",a="warning";return e.level===T.info?a="iInCircle":e.level===T.warning?t="warning":e.level===T.error&&(t="danger"),s.a.createElement(n.EuiToolTip,{content:e.text},s.a.createElement(n.EuiIcon,{"data-test-subj":"mlJobAuditIcon",type:a,color:t}))},_=Object(r.memo)(M),F=S.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.mlJobStartedDescription",{defaultMessage:"Started"}),A=S.i18n.translate("xpack.securitySolution.detectionEngine.ruleDescription.mlJobStoppedDescription",{defaultMessage:"Stopped"}),D=({job:e})=>{const t=Object(I.c)(e.jobState,e.datafeedState),a=t?"success":"danger",i=t?F:A;return s.a.createElement(n.EuiBadge,{"data-test-subj":"machineLearningJobStatus",color:a},i)},N=Object(r.memo)(D),P=l.a.div.withConfig({displayName:"Wrapper",componentId:"sc-ilmnak-0"})(["overflow:hidden;"]),R=({job:e,switchComponent:t,...a})=>{var i;const r=Object(I.c)(e.jobState,e.datafeedState);return s.a.createElement(P,a,s.a.createElement("div",null,s.a.createElement(C.a,{jobId:e.id,jobName:null===(i=e.customSettings)||void 0===i?void 0:i.security_app_display_name}),s.a.createElement(_,{message:e.auditMessage})),s.a.createElement(n.EuiFlexGroup,{justifyContent:"flexStart"},s.a.createElement(n.EuiFlexItem,{grow:!1,style:{marginRight:"0"}},s.a.createElement(N,{job:e})),s.a.createElement(n.EuiFlexItem,{grow:!1},t),s.a.createElement(n.EuiFlexItem,{grow:!1,style:{marginLeft:"0"},"data-test-subj":"mlJobActionLabel"},r?O:k)))},L=Object(r.memo)(R),B=({job:e,loading:t,refreshJob:a})=>{const{enableDatafeed:n,disableDatafeed:i,isLoading:o}=Object(x.a)(),l=Object(r.useCallback)((async(t,r,s)=>{s?await n(e,r):await i(e),a(e)}),[n,i,e,a]),c=Object(r.useMemo)((()=>s.a.createElement(j.a,{job:e,isSecurityJobsLoading:t||o,onJobStateChange:l})),[l,o,e,t]);return s.a.createElement(L,{job:e,switchComponent:c})},q=Object(r.memo)(B),z=({jobIds:e})=>{const{loading:t,jobs:a,refetch:n,isMlAdmin:i}=Object(E.a)();if(!i)return null;const r=a.filter((t=>e.includes(t.id)));return s.a.createElement(s.a.Fragment,null,r.map((e=>s.a.createElement(q,{key:e.id,job:e,loading:t,refreshJob:n}))))},$=Object(r.memo)(z);var V=a(385),U=a(667),H=a.n(U);const G=({job:e})=>{const t=Object(r.useMemo)((()=>s.a.createElement(n.EuiToolTip,{content:w},s.a.createElement(n.EuiSwitch,{disabled:!0,"data-test-subj":"mlUserJobSwitch",showLabel:!1,label:"",checked:Object(I.c)(e.jobState,e.datafeedState),onChange:H.a}))),[e]);return s.a.createElement(L,{job:e,switchComponent:t})},Q=Object(r.memo)(G),W=({jobIds:e})=>{const{isMlUser:t,jobs:a}=Object(V.b)();if(!t)return null;const n=a.filter((t=>e.includes(t.id)));return s.a.createElement(s.a.Fragment,null,n.map((e=>s.a.createElement(Q,{key:e.id,job:e}))))},K=Object(r.memo)(W),Y=({jobIds:e})=>{const t=Object(y.a)(),a=Object(v.a)(t);return Object(h.a)(t)?s.a.createElement($,{jobIds:e}):a?s.a.createElement(K,{jobIds:e}):null},J=Object(r.memo)(Y),X=({actions:e})=>e.length?s.a.createElement("ul",null,e.map(((e,t)=>s.a.createElement("li",{key:t},Z(e.actionTypeId))))):null,Z=e=>{if(!e)return"";const t=e.split(".")[1];return t?Object(i.startCase)(t):""};a(104);var ee=a(4);a(125);const te=[{value:ee.Rb,text:"On each rule execution"},{value:"1h",text:"Hourly"},{value:"1d",text:"Daily"},{value:"7d",text:"Weekly"}],ae=[{value:ee.Qb,text:"Perform no actions"},...te],ne=ae[0],ie=(e=ne.value,t)=>{const a=Object(i.find)(["value",e],ae);return{title:t,description:a?a.text:e}};var re=a(417),se=a(17);const oe=l()(n.EuiDescriptionList).withConfig({displayName:"DescriptionListContainer",componentId:"sc-157un4q-0"})(["max-width:600px;&.euiDescriptionList--column .euiDescriptionList__title{width:30%;}&.euiDescriptionList--column .euiDescriptionList__description{width:70%;overflow-wrap:anywhere;}"]),le=c.css`
  dt {
    font-size: 90% !important;
  }
  text-overflow: ellipsis;
`,ce=({data:e,columns:t="multi",indexPatterns:a,schema:o,isInPanelView:l})=>{const c=Object(b.j)(),u=Object(se.b)(),[p]=Object(r.useState)(new d.FilterManager(c.services.uiSettings)),m=Object.keys(o).reduce(((t,n)=>{return"machineLearningJobId"===n?[...t,(r=Object(i.get)(n,e),l=Object(i.get)(n,o).label,{title:l,description:s.a.createElement(J,{jobIds:r})})]:"throttle"===n?[...t,ie(Object(i.get)(n,e),Object(i.get)([n,"label"],o))]:"actions"===n?[...t,(c=Object(i.get)(n,e),d=Object(i.get)([n,"label"],o),{title:c.length?d:"",description:s.a.createElement(X,{actions:c})})]:[...t,...de(e,Object(i.pick)(n,o),p,u,a)];var r,l,c,d}),[]);return"multi"===t?s.a.createElement(n.EuiFlexGroup,null,Object(i.chunk)(Math.ceil(m.length/2),m).map(((e,t)=>s.a.createElement(n.EuiFlexItem,{"data-test-subj":"listItemColumnStepRuleDescription",key:`description-step-rule-${t}`},s.a.createElement(n.EuiDescriptionList,{listItems:e}))))):l?s.a.createElement(n.EuiFlexGroup,null,s.a.createElement(n.EuiFlexItem,{"data-test-subj":"listItemColumnStepRuleDescriptionPanel"},s.a.createElement(n.EuiDescriptionList,{listItems:m,className:le}))):s.a.createElement(n.EuiFlexGroup,null,s.a.createElement(n.EuiFlexItem,{"data-test-subj":"listItemColumnStepRuleDescription"},"single"===t?s.a.createElement(n.EuiDescriptionList,{listItems:m}):s.a.createElement(oe,{"data-test-subj":"singleSplitStepRuleDescriptionList",type:"column",listItems:m})))},ue=Object(r.memo)(ce),de=(e,t,a,n,r)=>Object.keys(t).reduce(((s,o)=>[...s,...me(o,Object(i.get)([o,"label"],t),e,a,n,r)]),[]),pe=e=>e.map((e=>null==e.$state?{$state:{store:u.FilterStateStore.APP_STATE},...e}:e)),me=(e,t,a,n,r,s)=>{if("queryBar"===e){var o;const t=pe(null!==(o=Object(i.get)("queryBar.filters",a))&&void 0!==o?o:[]),r=Object(i.get)("queryBar.query.query",a),l=Object(i.get)("queryBar.saved_id",a),c=Object(i.get)("queryBar.title",a);return Object(g.g)({field:e,filters:t,filterManager:n,query:r,savedId:l,savedQueryName:c,indexPatterns:s})}if("responseActions"===e)return[];if("groupByFields"===e){const n=Object(i.get)(e,a);return Object(g.a)(t,n,r)}if("groupByRadioSelection"===e)return[];if("groupByDuration"===e){if(Object(i.get)("groupByFields",a).length>0){const n=Object(i.get)(e,a);return Object(g.c)(t,n,r,Object(i.get)("groupByRadioSelection",a))}return[]}if("suppressionMissingFields"===e){if(Object(i.get)("groupByFields",a).length>0){const n=Object(i.get)(e,a);return Object(g.b)(t,n,r)}return[]}if("eqlOptions"===e){const t=Object(i.get)(e,a);return Object(g.d)(t)}if("threat"===e){const n=Object(i.get)(e,a);return Object(g.m)({label:t,threat:Object(re.a)(n)})}if("threshold"===e){const n=Object(i.get)(e,a);return Object(g.o)(t,n)}if("references"===e){const n=Object(i.get)(e,a);return Object(g.q)(t,n)}if("falsePositives"===e){const n=Object(i.get)(e,a);return Object(g.p)(t,e,n)}if("investigationFields"===e){const n=Object(i.get)(e,a);return Object(g.e)(t,n)}if("riskScore"===e){const t=Object(i.get)(e,a);return Object(g.i)(t)}if("severity"===e){const t=Object(i.get)(e,a);return Object(g.k)(t)}if("requiredFields"===e){const n=Object(i.get)(e,a);return Object(g.h)(t,n)}if("relatedIntegrations"===e){const n=Object(i.get)(e,a);return Object(p.c)(t,n)}var l;if("timeline"===e)return[{title:t,description:null!==(l=Object(i.get)(e,a).title)&&void 0!==l?l:m.b}];if("note"===e){const n=Object(i.get)(e,a);return Object(g.f)(t,n)}if("ruleType"===e){const n=Object(i.get)(e,a);return Object(g.j)(t,n)}if("kibanaSiemAppUrl"===e)return[];if("threatQueryBar"===e){var c;const t=pe(null!==(c=Object(i.get)("threatQueryBar.filters",a))&&void 0!==c?c:[]),r=Object(i.get)("threatQueryBar.query.query",a),o=Object(i.get)("threatQueryBar.saved_id",a);return Object(g.g)({field:e,filters:t,filterManager:n,query:r,savedId:o,indexPatterns:s,queryLabel:f.u})}if("threatMapping"===e){const n=Object(i.get)(e,a);return Object(g.n)(t,n)}if(Array.isArray(Object(i.get)(e,a))&&"threatMapping"!==e){const n=Object(i.get)(e,a);return Object(g.l)(t,e,n)}if("index"===e){if(Object(i.get)("dataViewId",a))return[]}else if("isBuildingBlock"===e)return Object(i.get)("isBuildingBlock",a)?[{title:f.g,description:f.f}]:[];const u=Object(i.get)(e,a);return Object(i.isNumber)(u)||!Object(i.isEmpty)(u)?[{title:t,description:u}]:[]}},function(e,t,a){"use strict";a.d(t,"a",(function(){return U}));var n=a(42),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(40),c=a(120),u=a(50),d=a.n(u),p=a(197),m=a(890),b=a(5);const g=b.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.linkedToListSection.title",{defaultMessage:"Linked to shared list"}),f=b.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.linkedToListSection.error",{defaultMessage:"Unable to fetch exception list."});var y=a(313);const h=o()(l.EuiTitle).withConfig({displayName:"SectionHeader",componentId:"sc-1rq9jba-0"})(["",""],(()=>Object(s.css)(["font-weight:",";"],(({theme:e})=>e.eui.euiFontWeightSemiBold)))),v=({isLoadingReferences:e,errorFetchingReferences:t,listAndReferences:a})=>{const[n,s]=Object(i.useState)(r.a.createElement(l.EuiSkeletonText,{lines:4,"data-test-subj":"exceptionItemListsTableLoading"})),[o,c]=Object(i.useState)(void 0);return Object(i.useEffect)((()=>{t?c(f):e||s(void 0)}),[t,e]),r.a.createElement(l.EuiPanel,{paddingSize:"none",hasShadow:!1,"data-test-subj":"exceptionItemLinkedToListSection"},r.a.createElement(h,{size:"xs"},r.a.createElement("h3",null,g)),r.a.createElement(l.EuiSpacer,{size:"s"}),r.a.createElement(l.EuiInMemoryTable,{tableCaption:"Table of exception lists",itemId:"id",message:n,loading:e,items:a,error:o,columns:Object(y.d)(),isSelectable:!1,sorting:!0,"data-test-subj":"exceptionItemSharedList"}))},E=r.a.memo(v);E.displayName="ExceptionsLinkedToLists";const x=b.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.linkedToRule.title",{defaultMessage:"Linked to rule"}),j=o()(l.EuiTitle).withConfig({displayName:"SectionHeader",componentId:"sc-6bqv6k-0"})(["",""],(()=>Object(s.css)(["font-weight:",";"],(({theme:e})=>e.eui.euiFontWeightSemiBold)))),S=({rule:e})=>r.a.createElement(r.a.Fragment,null,r.a.createElement(j,{size:"xs","data-test-subj":"exceptionItemLinkedToRuleSection"},r.a.createElement("h3",null,x)),r.a.createElement(l.EuiSpacer,{size:"s"}),r.a.createElement(l.EuiInMemoryTable,{tableCaption:"Rules table",itemId:"id",items:[e],columns:Object(y.c)(),sorting:!0,"data-test-subj":"addExceptionToRulesTable"})),k=r.a.memo(S);k.displayName="ExceptionsLinkedToRule";var O=a(882),w=a(891),T=a(806),I=a(883),C=a(807),M=a(611);const _=b.i18n.translate("xpack.securitySolution.ruleExceptions.editException.cancel",{defaultMessage:"Cancel"}),F=b.i18n.translate("xpack.securitySolution.ruleExceptions.editException.editExceptionTitle",{defaultMessage:"Edit rule exception"}),A=b.i18n.translate("xpack.securitySolution.ruleExceptions.editException.editEndpointExceptionTitle",{defaultMessage:"Edit endpoint exception"}),D=b.i18n.translate("xpack.securitySolution.ruleExceptions.editException.editRuleExceptionToastSuccessTitle",{defaultMessage:"Rule exception updated"}),N=b.i18n.translate("xpack.securitySolution.ruleExceptions.editException.editRuleExceptionToastErrorTitle",{defaultMessage:"Error updating exception"});var P=a(108),R=a(808),L=a(892);const B=o()(l.EuiFlyoutHeader).withConfig({displayName:"FlyoutHeader",componentId:"sc-1j5dcqi-0"})(["",""],(({theme:e})=>Object(s.css)(["border-bottom:1px solid ",";"],e.eui.euiColorLightShade))),q=o()(l.EuiFlyoutBody).withConfig({displayName:"FlyoutBodySection",componentId:"sc-1j5dcqi-1"})(["",""],(()=>Object(s.css)(["&.builder-section{overflow-y:scroll;}"]))),z=o()(l.EuiFlexGroup).withConfig({displayName:"FlyoutFooterGroup",componentId:"sc-1j5dcqi-2"})(["",""],(({theme:e})=>Object(s.css)(["padding:",";"],e.eui.euiSizeS))),$=o()(l.EuiTitle).withConfig({displayName:"SectionHeader",componentId:"sc-1j5dcqi-3"})(["",""],(()=>Object(s.css)(["font-weight:",";"],(({theme:e})=>e.eui.euiFontWeightSemiBold)))),V=({list:e,itemToEdit:t,rule:a,showAlertCloseOptions:s,openedFromListDetailPage:o,onCancel:u,onConfirm:g})=>{var f;const h=Object(i.useMemo)((()=>t.os_types),[t]),v=Object(i.useMemo)((()=>null!=a?[a]:null),[a]),x=Object(i.useMemo)((()=>e.type),[e]),{isLoading:j,indexPatterns:S,getExtendedFields:V}=Object(T.a)(v),[U,H]=(()=>{const{addSuccess:e,addError:t,addWarning:a}=Object(P.a)(),[n,r]=Object(R.a)(),[s,o]=Object(i.useState)(!1),l=Object(i.useRef)(null);return Object(i.useEffect)((()=>{let a=!0;const n=new AbortController;return l.current=async({itemsToUpdate:n})=>{var i,s;if(null!=r)try{o(!0),await r(n),e({title:D,text:(i=n.map((({name:e})=>e)).join(", "),s=n.length,b.i18n.translate("xpack.securitySolution.ruleExceptions.editException.editRuleExceptionToastSuccessText",{values:{exceptionItemName:i,numItems:s},defaultMessage:"{numItems, plural, =1 {Exception} other {Exceptions}} - {exceptionItemName} - {numItems, plural, =1 {has} other {have}} been updated."}))}),a&&o(!1)}catch(e){if(a)throw o(!1),t(e,{title:N}),new Error(e)}},()=>{a=!1,n.abort()}}),[e,t,a,r]),[s||n,l.current]})(),[G,Q]=Object(I.a)(),[{exceptionItems:W,exceptionItemMeta:{name:K},newComment:Y,bulkCloseAlerts:J,disableBulkClose:X,bulkCloseIndex:Z,entryErrorExists:ee,expireTime:te,expireErrorExists:ae},ne]=Object(i.useReducer)(((e,t)=>{switch(t.type){case"setExceptionItemMeta":{const{value:a}=t;return{...e,exceptionItemMeta:{...e.exceptionItemMeta,[a[0]]:a[1]}}}case"setComment":{const{comment:a}=t;return{...e,newComment:a}}case"setBulkCloseAlerts":{const{bulkClose:a}=t;return{...e,bulkCloseAlerts:a}}case"setDisableBulkCloseAlerts":{const{disableBulkCloseAlerts:a}=t;return{...e,disableBulkClose:a}}case"setBulkCloseIndex":{const{bulkCloseIndex:a}=t;return{...e,bulkCloseIndex:a}}case"setExceptionItems":{const{items:a}=t;return{...e,exceptionItems:a}}case"setConditionValidationErrorExists":{const{errorExists:a}=t;return{...e,entryErrorExists:a}}case"setExpireTime":{const{expireTime:a}=t;return{...e,expireTime:a}}case"setExpireError":{const{errorExists:a}=t;return{...e,expireErrorExists:a}}default:return e}}),{exceptionItems:[t],exceptionItemMeta:{name:t.name},newComment:"",bulkCloseAlerts:!1,disableBulkClose:!0,bulkCloseIndex:void 0,entryErrorExists:!1,expireTime:void 0!==t.expire_time?d()(t.expire_time):void 0,expireErrorExists:!1}),ie=Object(i.useMemo)((()=>null==a||!Object(p.b)(a.type)&&!Object(p.g)(a.type)&&!Object(p.d)(a.type)),[a]),[re,se,oe,le]=Object(C.a)();Object(i.useEffect)((()=>{null!=le&&le([{id:e.id,listId:e.list_id,namespaceType:e.namespace_type}])}),[e,le]);const ce=Object(i.useCallback)((e=>{ne({type:"setExceptionItems",items:e})}),[ne]),ue=Object(i.useCallback)((e=>{ne({type:"setExceptionItemMeta",value:e})}),[ne]),de=Object(i.useCallback)((e=>{ne({type:"setComment",comment:e})}),[ne]),pe=Object(i.useCallback)((e=>{ne({type:"setBulkCloseAlerts",bulkClose:e})}),[ne]),me=Object(i.useCallback)((e=>{ne({type:"setDisableBulkCloseAlerts",disableBulkCloseAlerts:e})}),[ne]),be=Object(i.useCallback)((e=>{ne({type:"setBulkCloseIndex",bulkCloseIndex:e})}),[ne]),ge=Object(i.useCallback)((e=>{ne({type:"setConditionValidationErrorExists",errorExists:e})}),[ne]),fe=Object(i.useCallback)((e=>{ne({type:"setExpireTime",expireTime:e})}),[ne]),ye=Object(i.useCallback)((e=>{ne({type:"setExpireError",errorExists:e})}),[ne]),he=Object(i.useCallback)((()=>{u(!1)}),[u]),ve=Object(i.useCallback)((e=>e.every((e=>c.E.is(e)))),[]),Ee=Object(i.useCallback)((async()=>{if(null!=H)try{const i=Object(y.a)({itemName:K,commentToAdd:Y,listType:x,selectedOs:t.os_types,expireTime:te,items:W});if(ve(i)){await H({itemsToUpdate:i});const t=null!=a?[a.rule_id]:[],r=null!=oe?oe[e.list_id].referenced_rules.map((({rule_id:e})=>e)):[],s=x===c.b.RULE_DEFAULT?t:r;null!=Q&&!Object(n.isEmpty)(s)&&J&&await Q(s,i,void 0,Z),g(!0)}}catch(e){u(!1)}}),[H,K,Y,x,t.os_types,W,ve,a,oe,e.list_id,Q,J,g,Z,u,te]),xe=Object(i.useMemo)((()=>x===c.b.ENDPOINT?A:F),[x]),je=Object(i.useMemo)((()=>U||G||W.every((e=>0===e.entries.length))||j||ee||ae),[j,ee,W,U,G,ae]);return r.a.createElement(l.EuiFlyout,{size:"l",onClose:he,"data-test-subj":"editExceptionFlyout"},r.a.createElement(B,null,r.a.createElement(l.EuiTitle,null,r.a.createElement("h2",{"data-test-subj":"exceptionFlyoutTitle"},xe)),r.a.createElement(l.EuiSpacer,{size:"m"})),j&&r.a.createElement(l.EuiSkeletonText,{"data-test-subj":"loadingEditExceptionFlyout",lines:4}),r.a.createElement(q,{className:"builder-section"},r.a.createElement(m.a,{exceptionItemName:K,onChange:ue}),r.a.createElement(l.EuiHorizontalRule,null),r.a.createElement(w.a,{exceptionItemName:K,allowLargeValueLists:ie,exceptionListItems:[t],exceptionListType:x,indexPatterns:S,rules:v,selectedOs:h,showOsTypeOptions:x===c.b.ENDPOINT,isEdit:!0,onExceptionItemAdd:ce,onSetErrorExists:ge,getExtendedFields:V}),!o&&x===c.b.DETECTION&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.EuiHorizontalRule,null),r.a.createElement(E,{isLoadingReferences:re,errorFetchingReferences:se,listAndReferences:null!=oe?[oe[e.list_id]]:[]})),!o&&x===c.b.RULE_DEFAULT&&null!=a&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.EuiHorizontalRule,null),r.a.createElement(k,{rule:a})),r.a.createElement(l.EuiHorizontalRule,null),r.a.createElement(M.a,{accordionTitle:r.a.createElement($,{size:"xs"},r.a.createElement("h3",null,(Se=null!==(f=t.comments.length)&&void 0!==f?f:0,b.i18n.translate("xpack.securitySolution.ruleExceptions.editExceptionFlyout.commentsTitle",{values:{comments:Se},defaultMessage:"Add comments ({comments})"})))),exceptionItemComments:t.comments,newCommentValue:Y,newCommentOnChange:de}),x!==c.b.ENDPOINT&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.EuiHorizontalRule,null),r.a.createElement(L.a,{expireTime:te,setExpireTime:fe,setExpireError:ye})),s&&r.a.createElement(r.a.Fragment,null,r.a.createElement(l.EuiHorizontalRule,null),r.a.createElement(O.a,{exceptionListType:x,shouldBulkCloseAlert:J,disableBulkClose:X,exceptionListItems:W,onDisableBulkClose:me,onUpdateBulkCloseIndex:be,onBulkCloseCheckboxChange:pe}))),r.a.createElement(l.EuiFlyoutFooter,null,r.a.createElement(z,{justifyContent:"spaceBetween"},r.a.createElement(l.EuiButtonEmpty,{"data-test-subj":"cancelExceptionEditButton",onClick:he},_),r.a.createElement(l.EuiButton,{"data-test-subj":"editExceptionConfirmButton",onClick:Ee,isDisabled:je,fill:!0},xe))));var Se},U=r.a.memo(V);U.displayName="EditExceptionFlyout"},function(e,t,a){"use strict";a.d(t,"c",(function(){return o.b})),a.d(t,"b",(function(){return o.a})),a.d(t,"d",(function(){return l})),a.d(t,"a",(function(){return c}));var n=a(43);const i=n.record(n.string,n.string);let r,s;n.exact(n.partial({host:i,user:i})),function(e){e.global="global_identifier",e.riskCategory="risk_category"}(r||(r={})),function(e){e.category_1="category_1"}(s||(s={})),n.keyof({user:null,host:null});var o=a(704);const l=(e="default")=>`risk-score.risk-score-latest-${e}`,c=2},function(e,t,a){"use strict";a.d(t,"d",(function(){return n.q})),a.d(t,"c",(function(){return n.n})),a.d(t,"g",(function(){return b})),a.d(t,"e",(function(){return f})),a.d(t,"a",(function(){return w})),a.d(t,"b",(function(){return T})),a.d(t,"f",(function(){return I.a}));var n=a(143),i=a(108),r=a(46),s=a(409),o=a(4),l=a(332),c=a(353),u=a(397),d=a(401);const p=["PUT",o.gb];var m=a(304);const b=()=>{const{addError:e}=Object(i.a)();return(e=>{const t=Object(l.b)(),a=Object(u.b)(),i=Object(d.b)(),o=Object(c.c)();return Object(r.useMutation)((e=>Object(n.y)({rule:Object(s.b)(e)})),{...e,mutationKey:p,onSettled:(...n)=>{var r;t(),a(),i();const[s]=n;s&&o(s),null==e||null===(r=e.onSettled)||void 0===r||r.call(e,...n)}})})({onError:t=>{e(t,{title:m.a})}})},g=["POST",o.gb],f=()=>{const{addError:e}=Object(i.a)();return(e=>{const t=Object(l.b)(),a=Object(u.b)(),i=Object(d.b)();return Object(r.useMutation)((e=>Object(n.d)({rule:Object(s.b)(e)})),{...e,mutationKey:g,onSettled:(...n)=>{t(),a(),i(),null!=e&&e.onSettled&&e.onSettled(...n)}})})({onError:t=>{e(t,{title:m.a})}})};var y=a(43),h=a(193),v=a(112),E=a(283),x=a(207),j=a(506),S=a(373);y.exact(y.type({group:y.string,id:y.string,action_type_id:y.string,params:y.record(y.string,y.any)}));const k=y.intersection([y.type({from:y.string}),y.partial({throttle:y.string,kibana_siem_app_url:y.string})]),O=y.intersection([y.type({author:x.t,created_at:y.string,created_by:y.string,description:x.w,enabled:x.m,false_positives:x.x,from:h.n,id:x.D,interval:h.m,immutable:x.n,name:x.B,max_signals:x.p,references:x.G,related_integrations:x.r,required_fields:x.s,risk_score:h.d,risk_score_mapping:h.e,rule_id:x.I,severity:h.p,severity_mapping:h.q,setup:x.P,tags:x.J,type:h.D,to:h.o,threat:x.R,updated_at:y.string,updated_by:y.string,actions:h.g,throttle:y.union([h.l,y.null])}),y.partial({outcome:x.O,alias_target_id:x.N,alias_purpose:x.M,building_block_type:x.e,anomaly_threshold:y.number,filters:x.y,index:x.k,data_view_id:x.g,language:y.string,license:x.z,meta:k,machine_learning_job_id:y.array(y.string),new_terms_fields:y.array(y.string),history_window_start:y.string,output_index:x.c,query:x.F,rule_name_override:x.C,saved_id:y.string,threshold:x.S,threat_query:h.C,threat_filters:h.x,threat_index:h.y,threat_indicator_path:h.z,threat_mapping:h.B,threat_language:h.A,timeline_id:x.U,timeline_title:x.V,timestamp_override:x.X,timestamp_override_fallback_disabled:x.Y,event_category_override:x.h,timestamp_field:x.W,tiebreaker_field:x.T,note:x.l,exceptions_list:x.i,uuid:y.string,version:x.L,execution_summary:E.g,alert_suppression:x.a,investigation_fields:x.v})]),w=(y.array(O),y.type({page:v.n,perPage:v.n,total:v.n})),T=y.type({field:j.e,order:S.f});var I=a(552)},function(e,t,a){"use strict";a.d(t,"b",(function(){return k})),a.d(t,"c",(function(){return O})),a.d(t,"a",(function(){return _e}));var n=a(42),i=a(2),r=a.n(i),s=a(106),o=a(275),l=a(40),c=a(121),u=a(276),d=a(250),p=a(127),m=a(277),b=a(572),g=a(819);const f=e=>null==e||"unset"===e.toLowerCase(),y=r.a.memo((({contextId:e,eventId:t,primary:a,secondary:n,isDraggable:i})=>f(a)&&f(n)?null:!f(a)&&f(n)?r.a.createElement(c.c,{contextId:e,eventId:t,field:"auditd.summary.actor.primary",isDraggable:i,value:a,iconType:"user",isAggregatable:!0,fieldType:"keyword"}):f(a)&&!f(n)||a===n?r.a.createElement(c.c,{contextId:e,eventId:t,field:"auditd.summary.actor.secondary",isDraggable:i,value:n,iconType:"user",isAggregatable:!0,fieldType:"keyword"}):r.a.createElement(l.EuiFlexGroup,{gutterSize:"none"},r.a.createElement(p.c,{grow:!1,component:"span"},r.a.createElement(c.c,{contextId:e,eventId:t,field:"auditd.summary.actor.primary",isDraggable:i,value:a,iconType:"user",isAggregatable:!0,fieldType:"keyword"})),r.a.createElement(p.c,{grow:!1,component:"span"},u.i),r.a.createElement(p.c,{grow:!1,component:"span"},r.a.createElement(c.c,{contextId:e,eventId:t,field:"auditd.summary.actor.secondary",isDraggable:i,value:n,iconType:"user",isAggregatable:!0,fieldType:"keyword"})))));y.displayName="PrimarySecondary";const h=r.a.memo((({contextId:e,eventId:t,userName:a,primary:n,secondary:i,isDraggable:s})=>f(a)&&f(n)&&f(i)?null:f(a)||f(n)||f(i)||a!==n||a!==i?!f(a)&&f(n)&&f(i)?r.a.createElement(c.c,{contextId:e,eventId:t,field:"user.name",isDraggable:s,value:a,iconType:"user",isAggregatable:!0,fieldType:"keyword"}):r.a.createElement(y,{contextId:e,eventId:t,isDraggable:s,primary:n,secondary:i}):r.a.createElement(c.c,{contextId:e,eventId:t,field:"user.name",isDraggable:s,value:a,iconType:"user",isAggregatable:!0,fieldType:"keyword"})));h.displayName="PrimarySecondaryUserInfo";const v=r.a.memo((({eventId:e,contextId:t,hostName:a,userName:n,primary:i,secondary:s,workingDirectory:o,session:l,isDraggable:d})=>r.a.createElement(r.a.Fragment,null,r.a.createElement(p.c,{grow:!1,component:"span"},u.Vb),r.a.createElement(p.c,{grow:!1,component:"span"},r.a.createElement(c.c,{contextId:t,eventId:e,field:"auditd.session",value:l,iconType:"number",isDraggable:d,isAggregatable:!0,fieldType:"keyword"})),r.a.createElement(p.c,{grow:!1,component:"span"},r.a.createElement(h,{contextId:t,eventId:e,userName:n,primary:i,secondary:s,isDraggable:d})),null!=a&&r.a.createElement(p.c,{grow:!1,component:"span"},"@"),r.a.createElement(g.a,{contextId:t,eventId:e,workingDirectory:o,hostName:a,isDraggable:d}))));v.displayName="SessionUserHostWorkingDir";const E=r.a.memo((({id:e,contextId:t,hostName:a,userName:n,primary:i,processName:s,processPid:o,processExecutable:d,processTitle:g,secondary:f,workingDirectory:y,args:h,result:E,session:x,text:j,isDraggable:S})=>r.a.createElement(l.EuiFlexGroup,{alignItems:"center",justifyContent:"center",gutterSize:"none",wrap:!0},r.a.createElement(v,{eventId:e,contextId:t,hostName:a,userName:n,primary:i,secondary:f,workingDirectory:y,session:x,isDraggable:S}),null!=d&&r.a.createElement(p.c,{grow:!1,component:"span"},j),r.a.createElement(p.c,{grow:!1,component:"span"},r.a.createElement(m.a,{contextId:t,endgamePid:void 0,endgameProcessName:void 0,eventId:e,processPid:o,processName:s,processExecutable:d,isDraggable:S})),r.a.createElement(b.a,{eventId:e,args:h,contextId:t,isDraggable:S,processTitle:g}),null!=E&&r.a.createElement(p.c,{grow:!1,component:"span"},u.pc),r.a.createElement(p.c,{grow:!1,component:"span"},r.a.createElement(c.c,{contextId:t,eventId:e,field:"auditd.result",isDraggable:S,queryValue:E,value:E,isAggregatable:!0,fieldType:"keyword"})))));E.displayName="AuditdGenericLine";const x=r.a.memo((({data:e,contextId:t,isDraggable:a,text:i,timelineId:s})=>{const o=e._id,c=Object(n.get)("auditd.session[0]",e),u=Object(n.get)("host.name[0]",e),m=Object(n.get)("user.name[0]",e),b=Object(n.get)("auditd.result[0]",e),g=Object(n.get)("process.pid[0]",e),f=Object(n.get)("process.name[0]",e),y=Object(n.get)("process.executable[0]",e),h=Object(n.get)("process.title[0]",e),v=Object(n.get)("process.working_directory[0]",e),x=Object(n.get)("auditd.summary.actor.primary[0]",e),j=Object(n.get)("auditd.summary.actor.secondary[0]",e),S=Object(n.get)("process.args",e);return null!=e.process?r.a.createElement(p.b,null,r.a.createElement(E,{id:o,contextId:t,text:i,hostName:u,userName:m,processName:f,processPid:g,processExecutable:y,processTitle:h,workingDirectory:v,args:S,session:c,primary:x,result:b,secondary:j,isDraggable:a}),r.a.createElement(l.EuiSpacer,{size:"s"}),r.a.createElement(d.a,{data:e,isDraggable:a,timelineId:s})):null}));x.displayName="AuditdGenericDetails";const j=r.a.memo((({id:e,contextId:t,hostName:a,userName:n,result:i,primary:s,secondary:o,filePath:d,processName:g,processPid:f,processExecutable:y,processTitle:h,workingDirectory:E,args:x,session:j,text:S,fileIcon:k,isDraggable:O})=>r.a.createElement(l.EuiFlexGroup,{alignItems:"center",justifyContent:"center",gutterSize:"none",wrap:!0},r.a.createElement(v,{eventId:e,contextId:t,hostName:a,userName:n,primary:s,secondary:o,workingDirectory:E,session:j,isDraggable:O}),(null!=d||null!=y)&&r.a.createElement(p.c,{grow:!1,component:"span"},S),r.a.createElement(p.c,{grow:!1,component:"span"},r.a.createElement(c.c,{contextId:t,eventId:e,field:"file.path",isDraggable:O,value:d,iconType:k})),null!=y&&r.a.createElement(p.c,{grow:!1,component:"span"},u.kc),r.a.createElement(p.c,{grow:!1,component:"span"},r.a.createElement(m.a,{contextId:t,endgamePid:void 0,endgameProcessName:void 0,eventId:e,isDraggable:O,processPid:f,processName:g,processExecutable:y})),r.a.createElement(b.a,{eventId:e,args:x,contextId:t,isDraggable:O,processTitle:h}),null!=i&&r.a.createElement(p.c,{grow:!1,component:"span"},u.pc),r.a.createElement(p.c,{grow:!1,component:"span"},r.a.createElement(c.c,{contextId:t,eventId:e,field:"auditd.result",isDraggable:O,queryValue:i,value:i})))));j.displayName="AuditdGenericFileLine";const S=r.a.memo((({data:e,contextId:t,text:a,fileIcon:i="document",timelineId:s,isDraggable:o})=>{const c=e._id,u=Object(n.get)("auditd.session[0]",e),m=Object(n.get)("host.name[0]",e),b=Object(n.get)("user.name[0]",e),g=Object(n.get)("auditd.result[0]",e),f=Object(n.get)("process.pid[0]",e),y=Object(n.get)("process.name[0]",e),h=Object(n.get)("process.executable[0]",e),v=Object(n.get)("process.title[0]",e),E=Object(n.get)("process.working_directory[0]",e),x=Object(n.get)("file.path[0]",e),S=Object(n.get)("auditd.summary.actor.primary[0]",e),k=Object(n.get)("auditd.summary.actor.secondary[0]",e),O=Object(n.get)("process.args",e);return null!=e.process?r.a.createElement(p.b,null,r.a.createElement(j,{id:c,contextId:t,text:a,hostName:m,userName:b,filePath:x,processName:y,processPid:f,processExecutable:h,processTitle:v,workingDirectory:E,args:O,session:u,primary:S,secondary:k,fileIcon:i,result:g,isDraggable:o}),r.a.createElement(l.EuiSpacer,{size:"s"}),r.a.createElement(d.a,{data:e,isDraggable:o,timelineId:s})):null}));S.displayName="AuditdGenericFileDetails";const k=({actionName:e,text:t})=>({id:s.d.auditd,isInstance:t=>{const a=Object(n.get)("event.module[0]",t),i=Object(n.get)("event.action[0]",t);return null!=a&&"auditd"===a.toLowerCase()&&null!=i&&i.toLowerCase()===e},renderRow:({data:a,isDraggable:n,scopeId:i})=>r.a.createElement(o.a,null,r.a.createElement(x,{data:a,isDraggable:n,contextId:`${e}-${i}`,text:t,timelineId:i}))}),O=({actionName:e,text:t,fileIcon:a="document"})=>({id:s.d.auditd_file,isInstance:t=>{const a=Object(n.get)("event.module[0]",t),i=Object(n.get)("event.action[0]",t);return null!=a&&"auditd"===a.toLowerCase()&&null!=i&&i.toLowerCase()===e},renderRow:({data:n,isDraggable:i,scopeId:s})=>r.a.createElement(o.a,null,r.a.createElement(S,{contextId:`${e}-${s}`,data:n,fileIcon:a,isDraggable:i,text:t,timelineId:s}))}),w=k({actionName:"was-authorized",text:u.oc}),T=k({actionName:"started-session",text:u.Yb}),I=k({actionName:"logged-in",text:u.m}),C=k({actionName:"login",text:u.m}),M=k({actionName:"executed",text:u.gb}),_=k({actionName:"ended-session",text:u.eb}),F=k({actionName:"acquired-credentials",text:u.e}),A=k({actionName:"disposed-credentials",text:u.db}),D=k({actionName:"connected-to",text:u.T}),N=O({actionName:"opened-file",text:u.Db}),P=k({actionName:"changed-file-attributes-of",text:u.y}),R=O({actionName:"changed-file-permissions-of",text:u.A}),L=O({actionName:"changed-file-ownership-of",text:u.z}),B=k({actionName:"loaded-kernel-module",text:u.ob}),q=k({actionName:"unloaded-kernel-module",text:u.gc}),z=O({actionName:"created-directory",text:u.V,fileIcon:"folderOpen"}),$=O({actionName:"mounted",text:u.Bb}),V=O({actionName:"renamed",text:u.Ob}),U=O({actionName:"checked-metadata-of",text:u.S}),H=O({actionName:"checked-filesystem-metadata-of",text:u.Q}),G=O({actionName:"symlinked",text:u.dc}),Q=O({actionName:"unmounted",text:u.ic}),W=O({actionName:"deleted",text:u.Z}),K=O({actionName:"changed-timestamp-of",text:u.N}),Y=k({actionName:"listen-for-connections",text:u.mb}),J=k({actionName:"bound-socket",text:u.t}),X=k({actionName:"received-from",text:u.Hb}),Z=k({actionName:"sent-to",text:u.Ub}),ee=k({actionName:"killed-pid",text:u.lb}),te=k({actionName:"changed-identity-of",text:u.D}),ae=k({actionName:"changed-system-time",text:u.M}),ne=k({actionName:"make-device",text:u.ub}),ie=k({actionName:"changed-system-name",text:u.L}),re=k({actionName:"allocated-memory",text:u.h}),se=k({actionName:"adjusted-scheduling-policy-of",text:u.Rb}),oe=k({actionName:"added-user-account",text:u.g}),le=k({actionName:"caused-mac-policy-error",text:u.u}),ce=k({actionName:"loaded-firewall-rule-to",text:u.nb}),ue=k({actionName:"changed-promiscuous-mode-on-device",text:u.H}),de=k({actionName:"locked-account",text:u.rb}),pe=k({actionName:"unlocked-account",text:u.hc}),me=k({actionName:"added-group-account-to",text:u.f}),be=k({actionName:"crashed-program",text:u.U}),ge=k({actionName:"attempted-execution-of-forbidden-program",text:u.hb}),fe=k({actionName:"used-suspcious-link",text:u.jc}),ye=k({actionName:"used-suspicious-link",text:u.jc}),he=k({actionName:"failed-log-in-too-many-times-to",text:u.ib}),ve=k({actionName:"failed-login-too-many-times-to",text:u.ib}),Ee=k({actionName:"attempted-log-in-from-unusual-place-to",text:u.o}),xe=k({actionName:"attempted-login-from-unusual-place-to",text:u.o}),je=k({actionName:"opened-too-many-sessions-to",text:u.Eb}),Se=k({actionName:"attempted-log-in-during-unusual-hour-to",text:u.n}),ke=k({actionName:"attempted-login-during-unusual-hour-to",text:u.n}),Oe=k({actionName:"tested-file-system-integrity-of",text:u.ec}),we=k({actionName:"violated-selinux-policy",text:u.nc}),Te=k({actionName:"violated-apparmor-policy",text:u.lc}),Ie=k({actionName:"changed-group",text:u.B}),Ce=k({actionName:"changed-user-id",text:u.P}),Me=k({actionName:"changed-auditd-configuration",text:u.v}),_e=[M,I,C,w,F,_,A,T,D,N,P,R,L,B,q,z,$,V,U,H,G,Q,W,K,Y,J,X,Z,ee,te,ae,ne,ie,re,se,oe,me,ge,le,ue,be,ce,de,fe,ye,pe,he,ve,xe,je,Ee,Se,ke,Oe,we,Te,Ie,Ce,k({actionName:"changed-audit-configuration",text:u.v}),k({actionName:"refreshed-credentials",text:u.Jb}),k({actionName:"negotiated-crypto-key",text:u.Cb}),k({actionName:"crypto-officer-logged-in",text:u.X}),k({actionName:"crypto-officer-login",text:u.X}),k({actionName:"crypto-officer-logged-out",text:u.Y}),k({actionName:"crypto-officer-logout",text:u.Y}),k({actionName:"started-crypto-session",text:u.ac}),k({actionName:"access-result",text:u.d}),k({actionName:"aborted-auditd-startup",text:u.a}),k({actionName:"aborted-audit-startup",text:u.a}),k({actionName:"remote-audit-connected",text:u.Lb}),k({actionName:"remote-audit-disconnected",text:u.Mb}),k({actionName:"shutdown-audit",text:u.Wb}),k({actionName:"audit-error",text:u.p}),k({actionName:"reconfigured-auditd",text:u.Ib}),k({actionName:"reconfigured-audit",text:u.Ib}),k({actionName:"resumed-audit-logging",text:u.Pb}),k({actionName:"rotated-audit-logs",text:u.Qb}),k({actionName:"started-audit",text:u.Zb}),k({actionName:"deleted-group-account-from",text:u.ab}),k({actionName:"deleted-user-account",text:u.bb}),k({actionName:"changed-audit-feature",text:u.w}),k({actionName:"relabeled-filesystem",text:u.Kb}),k({actionName:"authenticated-to-group",text:u.q}),k({actionName:"changed-group-password",text:u.C}),k({actionName:"modified-group-account",text:u.xb}),k({actionName:"initialized-audit-subsystem",text:u.jb}),k({actionName:"modified-level-of",text:u.yb}),k({actionName:"overrode-label-of",text:u.Fb}),k({actionName:"changed-login-id-to",text:u.E}),k({actionName:"mac-permission",text:u.tb}),k({actionName:"changed-selinux-boolean",text:u.J}),k({actionName:"loaded-selinux-policy",text:u.qb}),k({actionName:"changed-selinux-enforcement",text:u.K}),k({actionName:"assigned-user-role-to",text:u.j}),k({actionName:"modified-role",text:u.zb}),k({actionName:"removed-use-role-from",text:u.Nb}),k({actionName:"removed-user-role-from",text:u.Nb}),Me,k({actionName:"violated-seccomp-policy",text:u.mc}),k({actionName:"started-service",text:u.bc}),k({actionName:"stopped-service",text:u.cc}),k({actionName:"booted-system",text:u.s}),k({actionName:"changed-to-runlevel",text:u.O}),k({actionName:"shutdown-system",text:u.Xb}),k({actionName:"sent-test",text:u.Tb}),k({actionName:"unknown",text:u.fc}),k({actionName:"sent-message",text:u.Sb}),k({actionName:"access-permission",text:u.c}),k({actionName:"authenticated",text:u.r}),k({actionName:"changed-password",text:u.G}),k({actionName:"ran-command",text:u.Gb}),k({actionName:"error",text:u.fb}),k({actionName:"logged-out",text:u.sb}),k({actionName:"logout",text:u.sb}),k({actionName:"changed-mac-configuration",text:u.F}),k({actionName:"loaded-mac-policy",text:u.pb}),k({actionName:"modified-user-account",text:u.Ab}),k({actionName:"changed-role-to",text:u.I}),k({actionName:"access-error",text:u.b}),k({actionName:"changed-configuration",text:u.x}),k({actionName:"issued-vm-control",text:u.kb}),k({actionName:"created-vm-image",text:u.W}),k({actionName:"deleted-vm-image",text:u.cb}),k({actionName:"checked-integrity-of",text:u.R}),k({actionName:"assigned-vm-id",text:u.k}),k({actionName:"migrated-vm-from",text:u.vb}),k({actionName:"migrated-vm-to",text:u.wb}),k({actionName:"assigned-vm-resource",text:u.l})]},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=`${a(4).Cb}/fleet/integrations/installed`},function(e,t,a){"use strict";a.d(t,"a",(function(){return y}));var n=a(2),i=a.n(n),r=a(40),s=a(41),o=a.n(s),l=a(5);const c=l.i18n.translate("xpack.securitySolution.andOrBadge.and",{defaultMessage:"AND"}),u=l.i18n.translate("xpack.securitySolution.andOrBadge.or",{defaultMessage:"OR"}),d=o()(r.EuiBadge).withConfig({displayName:"RoundBadge",componentId:"sc-15mz0pi-0"})(["align-items:center;border-radius:100%;display:inline-flex;font-size:9px;height:34px;justify-content:center;margin:0 5px 0 5px;padding:7px 6px 4px 6px;user-select:none;width:34px;.euiBadge__content{position:relative;top:-1px;}.euiBadge__text{text-overflow:clip;}"]);d.displayName="RoundBadge";const p=({type:e})=>i.a.createElement(d,{"data-test-subj":"and-or-badge",color:"hollow"},"and"===e?c:u);p.displayName="RoundedBadge";const m=Object(s.css)(["background:",";position:relative;width:2px;&:after{background:",";content:'';height:8px;right:-4px;position:absolute;width:10px;clip-path:circle();}"],(({theme:e})=>e.eui.euiColorLightShade),(({theme:e})=>e.eui.euiColorLightShade)),b=o()(r.EuiFlexItem).withConfig({displayName:"TopAntenna",componentId:"sc-1s6c9rb-0"})([""," &:after{top:0;}"],m),g=o()(r.EuiFlexItem).withConfig({displayName:"BottomAntenna",componentId:"sc-1s6c9rb-1"})([""," &:after{bottom:0;}"],m),f=({type:e})=>i.a.createElement(r.EuiFlexGroup,{className:"andBadgeContainer",gutterSize:"none",direction:"column",alignItems:"center"},i.a.createElement(b,{"data-test-subj":"andOrBadgeBarTop",grow:1}),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(p,{type:e})),i.a.createElement(g,{"data-test-subj":"andOrBadgeBarBottom",grow:1}));f.displayName="RoundedBadgeAntenna";const y=i.a.memo((({type:e,includeAntennas:t=!1})=>t?i.a.createElement(f,{type:e}):i.a.createElement(p,{type:e})));y.displayName="AndOrBadge"},function(e,t,a){"use strict";a.d(t,"d",(function(){return p})),a.d(t,"c",(function(){return m})),a.d(t,"b",(function(){return b})),a.d(t,"a",(function(){return f}));var n=a(55),i=a.n(n),r=a(338),s=a(230),o=a(47);const l=Object(o.v4)();var c,u,d=a(918);const p=(e,t)=>a=>`${d.g}: ${i()(a).format(e)} ${t?d.f(a):d.e(a)}`,m=[{text:"event.action",value:"event.action"},{text:"event.dataset",value:"event.dataset"},{text:"event.module",value:"event.module"}],b={defaultStackByOption:null!==(c=m.find((e=>"event.action"===e.text)))&&void 0!==c?c:m[0],errorMessage:d.c,histogramType:r.j.events,stackByOptions:m,subtitle:void 0,title:d.d,getLensAttributes:(e="event.action",t={})=>{var a;return{title:"Events",description:"",visualizationType:"lnsXY",state:{visualization:{title:"Empty XY chart",legend:{isVisible:!0,position:"right",legendSize:"xlarge"},valueLabels:"hide",preferredSeriesType:"bar_stacked",layers:[{layerId:l,accessors:["e09e0380-0740-4105-becc-0a4ca12e3944"],position:"top",seriesType:"bar_stacked",showGridlines:!1,layerType:"data",xAccessor:"aac9d7d0-13a3-480a-892b-08207a787926",splitAccessor:"34919782-4546-43a5-b668-06ac934d3acd"}],yRightExtent:{mode:"full"},yLeftExtent:{mode:"full"},axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},valuesInLegend:!0},query:{query:"",language:"kuery"},filters:null!==(a=t.filters)&&void 0!==a?a:[],datasourceStates:{formBased:{layers:{[l]:{columns:{"aac9d7d0-13a3-480a-892b-08207a787926":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto"}},"e09e0380-0740-4105-becc-0a4ca12e3944":{label:"Count of records",dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___"},"34919782-4546-43a5-b668-06ac934d3acd":{label:`Top values of ${e}`,dataType:"string",operationType:"terms",scale:"ordinal",sourceField:`${e}`,isBucketed:!0,params:{size:10,orderBy:{type:"column",columnId:"e09e0380-0740-4105-becc-0a4ca12e3944"},orderDirection:"desc",otherBucket:!0,missingBucket:!1,parentFormat:{id:"terms"}}}},columnOrder:["34919782-4546-43a5-b668-06ac934d3acd","aac9d7d0-13a3-480a-892b-08207a787926","e09e0380-0740-4105-becc-0a4ca12e3944"],incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:`indexpattern-datasource-layer-${l}`}]}}},g=[{text:"event.category",value:"event.category"},{text:"event.module",value:"event.module"}],f={defaultStackByOption:null!==(u=g.find((e=>"event.module"===e.text)))&&void 0!==u?u:g[0],errorMessage:d.b,histogramType:r.j.alerts,stackByOptions:g,subtitle:void 0,title:d.a,getLensAttributes:(e="event.module")=>({title:"External alerts",description:"",visualizationType:"lnsXY",state:{visualization:{title:"Empty XY chart",legend:{isVisible:!0,position:"right",legendSize:"xlarge"},valueLabels:"hide",preferredSeriesType:"bar_stacked",layers:[{layerId:"a3c54471-615f-4ff9-9fda-69b5b2ea3eef",accessors:["0a923af2-c880-4aa3-aa93-a0b9c2801f6d"],position:"top",seriesType:"bar_stacked",showGridlines:!1,layerType:"data",xAccessor:"37bdf546-3c11-4b08-8c5d-e37debc44f1d",splitAccessor:"42334c6e-98d9-47a2-b4cb-a445abb44c93"}],yRightExtent:{mode:"full"},yLeftExtent:{mode:"full"},axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},valuesInLegend:!0},query:{query:"",language:"kuery"},filters:[{meta:{index:"a04472fc-94a3-4b8d-ae05-9d30ea8fbd6a",alias:null,negate:!1,disabled:!1,type:"phrase",key:"event.kind",params:{query:"alert"}},query:{match_phrase:{"event.kind":"alert"}},$state:{store:"appState"}}],datasourceStates:{formBased:{layers:{"a3c54471-615f-4ff9-9fda-69b5b2ea3eef":{columns:{"37bdf546-3c11-4b08-8c5d-e37debc44f1d":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto"}},"0a923af2-c880-4aa3-aa93-a0b9c2801f6d":{label:s.f,dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___"},"42334c6e-98d9-47a2-b4cb-a445abb44c93":{label:Object(s.o)(`${e}`),dataType:"string",operationType:"terms",scale:"ordinal",sourceField:`${e}`,isBucketed:!0,params:{size:10,orderBy:{type:"column",columnId:"0a923af2-c880-4aa3-aa93-a0b9c2801f6d"},orderDirection:"desc",otherBucket:!0,missingBucket:!1,parentFormat:{id:"terms"}}}},columnOrder:["42334c6e-98d9-47a2-b4cb-a445abb44c93","37bdf546-3c11-4b08-8c5d-e37debc44f1d","0a923af2-c880-4aa3-aa93-a0b9c2801f6d"],incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-a3c54471-615f-4ff9-9fda-69b5b2ea3eef"},{type:"index-pattern",name:"723c4653-681b-4105-956e-abef287bf025",id:"{dataViewId}"},{type:"index-pattern",name:"a04472fc-94a3-4b8d-ae05-9d30ea8fbd6a",id:"{dataViewId}"}]})}},function(e,t,a){"use strict";a.d(t,"g",(function(){return s})),a.d(t,"b",(function(){return o})),a.d(t,"c",(function(){return l})),a.d(t,"a",(function(){return c})),a.d(t,"d",(function(){return m})),a.d(t,"e",(function(){return b})),a.d(t,"i",(function(){return g})),a.d(t,"h",(function(){return f})),a.d(t,"f",(function(){return y}));var n=a(156),i=a(214),r=a(143);const s=(e,t,a)=>{const{pagination:n,search:i,filters:r}=a||{};let s=[],o=[];return Array.isArray(e)&&e.length?(s=e.map((e=>e.list_id)),o=e.map((e=>e.namespace_type))):t&&(s=[t.list_id],o=[t.namespace_type]),{listIds:s,namespaceTypes:o,pagination:n,search:i,filters:r}},o=async({namespaceTypes:e,listIds:t,http:a,pagination:r,search:s})=>{try{const o=new AbortController,{pageIndex:l,pageSize:c,totalItemCount:u}=r||{},{page:d,per_page:p,total:m,data:b}=await Object(n.m)({filter:void 0,http:a,listIds:null!=t?t:[],namespaceTypes:null!=e?e:[],search:s,pagination:{perPage:c,page:(l||0)+1,total:u},signal:o.signal});return{data:b.map((e=>Object(i.b)(e))),pagination:{pageIndex:d-1,pageSize:p,totalItemCount:m}}}catch(e){throw new Error(e)}},l=async e=>{try{const t=new AbortController,{references:a}=await Object(r.l)({lists:e.map((e=>({id:e.id,listId:e.list_id,namespaceType:e.namespace_type}))),signal:t.signal});return a.reduce(((e,t)=>({...e,...t})),{})}catch(e){throw new Error(e)}},c=async({id:e,namespaceType:t,http:a})=>{try{const i=new AbortController;await Object(n.e)({http:a,id:e,namespaceType:t,signal:i.signal})}catch(e){throw new Error(e)}};var u=a(210),d=a(74),p=a(226);const m=async({id:e,http:t})=>{try{const a=new AbortController,i=Object(u.h)({filters:{list_id:e},namespaceTypes:["single","agnostic"],hideLists:p.a}),r=["single","agnostic"].join(),{data:s}=await Object(n.l)({filters:i,http:t,signal:a.signal,namespaceTypes:r,pagination:{}});return a.abort(),s&&s.length?s[0]:null}catch(e){throw new Error(e)}},b=async e=>{try{const t=new AbortController,{data:a}=await Object(r.j)({signal:t.signal,pagination:{page:1,perPage:1e4}});return t.abort(),a.reduce(((t,a,n)=>{var i;return(null===(i=a.exceptions_list)||void 0===i?void 0:i.find((t=>t.list_id===e)))&&t.push(a),t}),[])}catch(e){throw new Error(e)}},g=async({list:e,http:t})=>{try{const a=new AbortController;await Object(n.u)({http:t,list:e,signal:a.signal}),a.abort()}catch(e){throw new Error(e)}},f=async({rules:e,listId:t})=>{try{if(!e.length)return;const a=new AbortController;await Object(d.asyncForEach)(e,(async e=>{var n;const i=(null!==(n=e.exceptions_list)&&void 0!==n?n:[]).filter((({list_id:e})=>e!==t));await Object(r.p)({ruleProperties:{rule_id:e.rule_id,exceptions_list:i},signal:a.signal})}))}catch(e){throw new Error(e)}},y=async({rules:e,listId:t,id:a,listType:n,listNamespaceType:i})=>{try{if(!e.length)return;const s=new AbortController;await Object(d.asyncForEach)(e,(async e=>{var o;const l={list_id:t,id:a,type:n,namespace_type:i},c=[...null!==(o=e.exceptions_list)&&void 0!==o?o:[],l];await Object(r.p)({ruleProperties:{rule_id:e.rule_id,exceptions_list:c},signal:s.signal})}))}catch(e){throw new Error(e)}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return p}));var n=a(680),i=a(476),r=a(220),s=a(795),o=a(137),l=a(155),c=a(914),u=a(640);const d={[l.e]:{id:l.e,isDefault:!0,messages:[],apiConfig:{}},[s.a]:{id:s.a,isDefault:!0,messages:[],apiConfig:{}},[o.yb]:{id:o.yb,isDefault:!0,messages:[],apiConfig:{}},[l.i]:{id:l.i,isDefault:!0,messages:[],apiConfig:{}},[u.a]:{excludeFromLastConversationStorage:!0,id:u.a,isDefault:!0,messages:[],apiConfig:{}},[r.h]:{id:r.h,isDefault:!0,theme:{title:r.e,titleIcon:"logoSecurity",assistant:{name:c.f,icon:"logoSecurity"},system:{icon:"logoElastic"},user:{}},messages:[],apiConfig:{}}},p=()=>{const[e,t]=Object(n.a)({defaultValue:d,key:i.a,isInvalidDefault:e=>!e});return{conversations:e,setConversations:t}}},function(e,t,a){"use strict";a.d(t,"b",(function(){return m})),a.d(t,"c",(function(){return b})),a.d(t,"a",(function(){return f}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(121),c=a(123),u=a(5);const d=u.i18n.translate("xpack.securitySolution.certificate.fingerprint.clientCertLabel",{defaultMessage:"client cert"}),p=u.i18n.translate("xpack.securitySolution.certificate.fingerprint.serverCertLabel",{defaultMessage:"server cert"}),m="tls.client_certificate.fingerprint.sha1",b="tls.server_certificate.fingerprint.sha1",g=o.a.span.withConfig({displayName:"FingerprintLabel",componentId:"sc-1isap0l-0"})(["margin-right:5px;"]);g.displayName="FingerprintLabel";const f=r.a.memo((({eventId:e,certificateType:t,contextId:a,fieldName:i,isDraggable:s,value:o})=>r.a.createElement(l.c,{contextId:a,"data-test-subj":`${t}-certificate-fingerprint`,eventId:e,field:i,iconType:"snowflake",isDraggable:s,tooltipContent:r.a.createElement(n.EuiText,{size:"xs"},r.a.createElement("span",null,i)),value:o,isAggregatable:!0,fieldType:"keyword"},r.a.createElement(g,null,"client"===t?d:p),r.a.createElement(c.b,{certificateFingerprint:o||""}))));f.displayName="CertificateFingerprint"},function(e,t,a){"use strict";a.d(t,"a",(function(){return u})),a.d(t,"b",(function(){return p}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(121),l=a(123);const c=a(5).i18n.translate("xpack.securitySolution.ja3.fingerprint.ja3.fingerprintLabel",{defaultMessage:"ja3"}),u="tls.fingerprints.ja3.hash",d=s.a.span.withConfig({displayName:"Ja3FingerprintLabel",componentId:"sc-94sjip-0"})(["margin-right:5px;"]);d.displayName="Ja3FingerprintLabel";const p=i.a.memo((({contextId:e,eventId:t,fieldName:a,isDraggable:n,value:r})=>i.a.createElement(o.c,{contextId:e,"data-test-subj":"ja3-hash",eventId:t,field:a,iconType:"snowflake",isDraggable:n,value:r,isAggregatable:!0,fieldType:"keyword"},i.a.createElement(d,null,c),i.a.createElement(l.e,{"data-test-subj":"ja3-hash-link",ja3Fingerprint:r||""}))));p.displayName="Ja3Fingerprint"},function(e,t,a){"use strict";a.d(t,"b",(function(){return s})),a.d(t,"a",(function(){return o}));var n=a(2),i=a(160),r=a(20);const s=e=>{const t=o();return Object(n.useMemo)((()=>t(e)),[t,e])},o=()=>{const e=Object(i.a)();return Object(n.useCallback)((t=>((e,t)=>Object(r.d)(e)&&t.length>0?`?${t}`:"")(t,e)),[e])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return b}));var n=a(2),i=a(4),r=a(102);const s=async(e,t)=>r.b.get().http.fetch("/internal/ml/results/anomalies_table_data",{method:"POST",version:"1",body:JSON.stringify(e),asSystemRequest:!0,signal:t});var o=a(1080),l=a(108),c=a(533),u=a(162),d=a(231);const p=e=>null==e?"":e.reduce(((e,t)=>`${e}${t.fieldName}:${t.fieldValue}`),""),m=(e,t)=>-1!==t?t:null==e?50:e<0?0:e>100?100:Math.floor(e),b=({criteriaFields:e=[],influencers:t=[],startDate:a,endDate:b,threshold:g=-1,skip:f=!1,filterQuery:y,jobIds:h,aggregationInterval:v})=>{const E=Object(u.a)(),x=Object(d.a)(E),{addError:j}=Object(l.a)(),S=Object(r.m)(),[k]=Object(r.p)(i.x),O=Object(n.useMemo)((()=>new Date(a).getTime()),[a]),w=Object(n.useMemo)((()=>new Date(b).getTime()),[b]),{fetch:T,data:I=null,isLoading:C,error:M}=Object(c.b)(c.a.ANOMALIES_TABLE,s,{disabled:f});return Object(n.useEffect)((()=>{M&&j(M,{title:o.a})}),[M,j]),Object(n.useEffect)((()=>{x&&h.length>0&&T({jobIds:h,criteriaFields:e,influencersFilterQuery:y,aggregationInterval:v,threshold:m(k,g),earliestMs:O,latestMs:w,influencers:t,dateFormatTz:S,maxRecords:500,maxExamples:10})}),[p(t),p(e),O,w,x,v,h.sort().join()]),[C,I]}},function(e,t,a){"use strict";a.d(t,"a",(function(){return f}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(40),l=a(5);const c=l.i18n.translate("xpack.securitySolution.rule_exceptions.itemComments.unknownAvatarName",{defaultMessage:"Uknown"}),u=l.i18n.translate("xpack.securitySolution.rule_exceptions.itemComments.addCommentPlaceholder",{defaultMessage:"Add a new comment..."});var d=a(102),p=a(281);const m="exceptionCommentAccordionButton",b=s()(o.EuiAvatar).withConfig({displayName:"MyAvatar",componentId:"sc-ggp4j5-0"})(["",""],(({theme:e})=>Object(r.css)(["margin-right:",";"],e.eui.euiSizeS))),g=s()(o.EuiAccordion).withConfig({displayName:"CommentAccordion",componentId:"sc-ggp4j5-1"})(["",""],(({theme:e})=>Object(r.css)([".","{color:",";padding:"," 0;}"],m,e.eui.euiColorPrimary,e.eui.euiSizeM))),f=Object(n.memo)((function({exceptionItemComments:e,newCommentValue:t,accordionTitle:a,initialIsOpen:r=!1,newCommentOnChange:s}){const[f,y]=Object(n.useState)(!1),h=Object(d.f)(),v=null==h?void 0:h.fullName,E=null==h?void 0:h.username,x=null==h?void 0:h.email,j=Object(n.useMemo)((()=>v&&v.length>0?v:x&&x.length>0?x:E&&E.length>0?E:c),[v,x,E]),S=Object(n.useCallback)((e=>{s(e.target.value)}),[s]),k=Object(n.useCallback)((e=>{y(e)}),[]),O=Object(n.useMemo)((()=>{return e&&e.length>0?i.a.createElement(o.EuiText,{size:"s","data-test-subj":"ExceptionItemCommentsAccordionButton"},f?(e=>l.i18n.translate("xpack.securitySolution.rule_exceptions.itemComments.hideCommentsLabel",{values:{comments:e},defaultMessage:"Hide ({comments}) {comments, plural, =1 {Comment} other {Comments}}"}))(e.length):(t=e.length,l.i18n.translate("xpack.securitySolution.rule_exceptions.itemComments.showCommentsLabel",{values:{comments:t},defaultMessage:"Show ({comments}) {comments, plural, =1 {Comment} other {Comments}}"}))):null;var t}),[e,f]),w=Object(n.useMemo)((()=>e&&e.length>0?Object(p.j)(e):[]),[e]);return i.a.createElement("div",null,i.a.createElement(g,{initialIsOpen:r&&!!t,id:"add-exception-comments-accordion",buttonClassName:m,buttonContent:null!=a?a:O,"data-test-subj":"exceptionItemCommentsAccordion",onToggle:e=>k(e)},i.a.createElement(o.EuiCommentList,{comments:w}),i.a.createElement(o.EuiFlexGroup,{gutterSize:"none"},i.a.createElement(o.EuiFlexItem,{grow:!1},i.a.createElement(b,{name:j,size:"l","data-test-subj":"exceptionItemCommentAvatar"})),i.a.createElement(o.EuiFlexItem,{grow:1},i.a.createElement(o.EuiTextArea,{placeholder:u,"aria-label":"Comment Input",value:t,onChange:S,fullWidth:!0,"data-test-subj":"newExceptionItemCommentTextArea"})))))}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return S})),a.d(t,"b",(function(){return k}));var n=a(2),i=a(4),r=a(172),s=a(131),o=a(201),l=a(18),c=a(265),u=a(46),d=a(143),p=a(332),m=a(353),b=a(397),g=a(650),f=a(856),y=a(857),h=a(401);const v=["POST",i.eb];var E=a(591),x=a(859),j=a(860);const S=(e,t)=>{t(i.l,{deepLinkId:s.a.rules,path:Object(o.b)(null!=e?e:"")})},k=e=>{const{mutateAsync:t}=(e=>{const t=Object(p.b)(),a=Object(m.b)(),n=Object(b.b)(),i=Object(g.b)(),s=Object(y.b)(),o=Object(f.b)(),l=Object(h.b)(),c=Object(p.c)();return Object(u.useMutation)((e=>Object(d.q)(e)),{...e,mutationKey:v,onSettled:(...e)=>{var u,d,p,m,b,g;const[f,y,{bulkAction:{type:h}}]=e,v=null!==(u=null==f||null===(d=f.attributes)||void 0===d||null===(p=d.results)||void 0===p?void 0:p.updated)&&void 0!==u?u:null==y||null===(m=y.body)||void 0===m||null===(b=m.attributes)||void 0===b||null===(g=b.results)||void 0===g?void 0:g.updated;switch(h){case r.b.enable:case r.b.disable:a(),l(),v?c(v):t();break;case r.b.delete:t(),a(),n(),i(),s(),o(),l();break;case r.b.duplicate:t(),n(),l();break;case r.b.edit:v?c(v):t(),a(),n(),l()}}})})(),a=Object(x.a)(),i=Object(E.a)(),s=Object(j.a)(),o=Object(c.c)(),S=null==o?void 0:o.actions.setLoadingRules;return{executeBulkAction:Object(n.useCallback)((async n=>{try{var o;null==S||S({ids:null!==(o=n.ids)&&void 0!==o?o:s(n.type),action:n.type});const i=await t({bulkAction:n});return function(e,t){e!==r.b.disable&&e!==r.b.enable||(t.attributes.results.updated.some((e=>e.immutable))&&Object(l.h)(l.a.COUNT,e===r.b.enable?l.c.SIEM_RULE_ENABLED:l.c.SIEM_RULE_DISABLED),t.attributes.results.updated.some((e=>!e.immutable))&&Object(l.h)(l.a.COUNT,e===r.b.disable?l.c.CUSTOM_RULE_DISABLED:l.c.CUSTOM_RULE_ENABLED))}(n.type,i),null!=e&&e.suppressSuccessToast||a({actionType:n.type,summary:i.attributes.summary,editPayload:n.type===r.b.edit?n.editPayload:void 0}),i}catch(e){i({actionType:n.type,error:e})}finally{null==S||S({ids:[],action:null})}}),[null==e?void 0:e.suppressSuccessToast,s,S,t,a,i])}}},function(e,t,a){var n=a(614),i=a(615),r=i?function(e,t){return i.set(e,t),e}:n;e.exports=r},function(e,t,a){e.exports=a(33)(1650)},function(e,t,a){var n=a(976),i=n&&new n;e.exports=i},function(e,t,a){e.exports=a(33)(3673)},function(e,t,a){var n=a(618),i=a(619),r=a(979),s=a(341),o=a(620),l=a(626),c=a(995),u=a(443),d=a(342);e.exports=function e(t,a,p,m,b,g,f,y,h,v){var E=128&a,x=1&a,j=2&a,S=24&a,k=512&a,O=j?void 0:s(t);return function w(){for(var T=arguments.length,I=Array(T),C=T;C--;)I[C]=arguments[C];if(S)var M=l(w),_=r(I,M);if(m&&(I=n(I,m,b,S)),g&&(I=i(I,g,f,S)),T-=_,S&&T<v){var F=u(I,M);return o(t,a,e,w.placeholder,p,I,F,y,h,v-T)}var A=x?p:this,D=j?A[t]:t;return T=I.length,y?I=c(I,y):k&&T>1&&I.reverse(),E&&h<T&&(I.length=h),this&&this!==d&&this instanceof w&&(D=O||s(D)),D.apply(A,I)}}},function(e,t){var a=Math.max;e.exports=function(e,t,n,i){for(var r=-1,s=e.length,o=n.length,l=-1,c=t.length,u=a(s-o,0),d=Array(c+u),p=!i;++l<c;)d[l]=t[l];for(;++r<o;)(p||r<s)&&(d[n[r]]=e[r]);for(;u--;)d[l++]=e[r++];return d}},function(e,t){var a=Math.max;e.exports=function(e,t,n,i){for(var r=-1,s=e.length,o=-1,l=n.length,c=-1,u=t.length,d=a(s-l,0),p=Array(d+u),m=!i;++r<d;)p[r]=e[r];for(var b=r;++c<u;)p[b+c]=t[c];for(;++o<l;)(m||r<s)&&(p[b+n[o]]=e[r++]);return p}},function(e,t,a){var n=a(980),i=a(623),r=a(624);e.exports=function(e,t,a,s,o,l,c,u,d,p){var m=8&t;t|=m?32:64,4&(t&=~(m?64:32))||(t&=-4);var b=[e,t,o,m?l:void 0,m?c:void 0,m?void 0:l,m?void 0:c,u,d,p],g=a.apply(void 0,b);return n(e)&&i(g,b),g.placeholder=s,r(g,e,t)}},function(e,t,a){var n=a(615),i=a(667),r=n?function(e){return n.get(e)}:i;e.exports=r},function(e,t,a){var n=a(436),i=a(439);function r(e,t){this.__wrapped__=e,this.__actions__=[],this.__chain__=!!t,this.__index__=0,this.__values__=void 0}r.prototype=n(i.prototype),r.prototype.constructor=r,e.exports=r},function(e,t,a){var n=a(613),i=a(985)(n);e.exports=i},function(e,t,a){var n=a(986),i=a(987),r=a(988),s=a(989);e.exports=function(e,t,a){var o=t+"";return r(e,i(o,s(n(o),a)))}},function(e,t,a){e.exports=a(33)(3641)},function(e,t){e.exports=function(e){return e.placeholder}},function(e,t,a){e.exports=a(33)(3629)},function(e,t,a){e.exports=a(33)(3640)},function(e,t,a){e.exports=a(33)(938)},function(e,t,a){e.exports=a(33)(3303)},function(e,t,a){var n=a(437);e.exports=function(e){return e==e&&!n(e)}},function(e,t){e.exports=function(e,t){return function(a){return null!=a&&a[e]===t&&(void 0!==t||e in Object(a))}}},function(e,t,a){e.exports=a(33)(1234)},function(e,t,a){e.exports=a(33)(3635)},function(e,t,a){var n=a(1029),i=a(633),r=a(629),s=a(442),o=a(437),l=a(288);e.exports=function(e,t,a,c){if(!o(e))return e;for(var u=-1,d=(t=i(t,e)).length,p=d-1,m=e;null!=m&&++u<d;){var b=l(t[u]),g=a;if("prototype"==b&&r(m))throw new Error("Illegal access of function prototype");if(u!=p){var f=hasOwnProperty.call(m,b)?m[b]:void 0;void 0===(g=c?c(f,b,m):void 0)&&(g=o(f)?f:s(t[u+1])?[]:{})}n(m,b,g),m=m[b]}return e}},function(e,t,a){"use strict";var n=a(189);a.d(t,"b",(function(){return n.d})),a.d(t,"a",(function(){return n.c})),a.d(t,"c",(function(){return n.e}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(40),i=a(109),r=a(2),s=a.n(r),o=a(41);const l=a.n(o)()(n.EuiPopover).withConfig({displayName:"WithHoverActionsPopover",componentId:"sc-1w6un7x-0"})([".euiPopover__anchor{width:100%;}"]),c=s.a.memo((({alwaysShow:e=!1,closePopOverTrigger:t,hoverContent:a,onCloseRequested:n,render:o})=>{const[c,u]=Object(r.useState)(null!=a&&e),[d,p]=Object(r.useState)(!1),[,m]=Object(r.useState)(void 0),b=Object(r.useRef)(null),g=Object(r.useCallback)((()=>{m((e=>{clearTimeout(e)})),p(!1),null!=n&&setTimeout((()=>{n()}))}),[n]),f=Object(r.useCallback)((()=>{m(Number(setTimeout((()=>{document.body.classList.contains(i.d)||p(!0)}),100)))}),[m,p]),y=Object(r.useCallback)((()=>{e||g()}),[e,g]),h=Object(r.useCallback)((e=>{c&&"Escape"===e.key&&y()}),[c,y]),v=Object(r.useMemo)((()=>s.a.createElement("div",{"data-test-subj":"withHoverActionsButton",onMouseEnter:f},o(d))),[f,o,d]);return Object(r.useEffect)((()=>{u(null!=a&&(d||e))}),[a,d,e]),Object(r.useEffect)((()=>{p(!1)}),[t]),Object(r.useEffect)((()=>{var e;c&&(null==b||null===(e=b.current)||void 0===e||e.positionPopoverFluid())}),[a,c]),s.a.createElement("div",{className:e?i.c:"",onMouseLeave:y},s.a.createElement(l,{ref:b,anchorPosition:"downCenter",button:v,closePopover:g,hasArrow:!1,isOpen:c,ownFocus:!1,panelPaddingSize:"none",panelClassName:"withHoverActions__popover",repositionOnScroll:!0},c?s.a.createElement("div",{onKeyDown:h},a):null))}));c.displayName="WithHoverActions"},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(148);const l=s.a.div.withConfig({displayName:"ProviderContainerComponent",componentId:"sc-11ewwh0-0"})([""," ",""],(({isDragging:e})=>!e&&Object(r.css)(["&{border-radius:2px;padding:0 4px 0 8px;position:relative;z-index:"," !important;&::before{background-image:linear-gradient( 135deg,"," 25%,transparent 25% ),linear-gradient( -135deg,"," 25%,transparent 25% ),linear-gradient( 135deg,transparent 75%,"," 75% ),linear-gradient( -135deg,transparent 75%,"," 75% );background-position:0 0,1px 0,1px -1px,0px 1px;background-size:2px 2px;bottom:2px;content:'';display:block;left:2px;position:absolute;top:2px;width:4px;}}&:hover{&,& .euiBadge,& .euiBadge__text{cursor:move;cursor:grab;}}.",":hover &,tr:hover &{&::before{background-image:linear-gradient( 135deg,"," 25%,transparent 25% ),linear-gradient( -135deg,"," 25%,transparent 25% ),linear-gradient( 135deg,transparent 75%,"," 75% ),linear-gradient( -135deg,transparent 75%,"," 75% );}}&:hover,&:focus,.",":hover &:hover,.",":focus &:focus,tr:hover &:hover,tr:hover &:focus{background-color:",";&,& a,& a:hover{color:",";}&::before{background-image:linear-gradient( 135deg,"," 25%,transparent 25% ),linear-gradient( -135deg,"," 25%,transparent 25% ),linear-gradient( 135deg,transparent 75%,"," 75% ),linear-gradient( -135deg,transparent 75%,"," 75% );}}"],(({theme:e})=>e.eui.euiZLevel0),(({theme:e})=>e.eui.euiColorMediumShade),(({theme:e})=>e.eui.euiColorMediumShade),(({theme:e})=>e.eui.euiColorMediumShade),(({theme:e})=>e.eui.euiColorMediumShade),o.f,(({theme:e})=>e.eui.euiColorDarkShade),(({theme:e})=>e.eui.euiColorDarkShade),(({theme:e})=>e.eui.euiColorDarkShade),(({theme:e})=>e.eui.euiColorDarkShade),o.f,o.f,(({theme:e})=>e.eui.euiColorPrimary),(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiColorEmptyShade),(({theme:e})=>e.eui.euiColorEmptyShade))),(({isDragging:e})=>e&&Object(r.css)(["&{z-index:9999 !important;}"])));l.displayName="ProviderContainerComponent";const c=i.a.memo(l);c.displayName="ProviderContainer"},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(2);const i=e=>{const[t,a]=Object(n.useState)(null),i=Object(n.useRef)(null);return Object(n.useEffect)((()=>{var e,t,n,r,s,o,l,c,u;null!=(null===(e=i.current)||void 0===e?void 0:e.clientHeight)&&((null!==(t=null==i||null===(n=i.current)||void 0===n?void 0:n.scrollHeight)&&void 0!==t?t:0)>(null!==(r=null==i||null===(s=i.current)||void 0===s?void 0:s.clientHeight)&&void 0!==r?r:0)&&a(!0),(null!==(o=null===(l=i.current)||void 0===l?void 0:l.scrollHeight)&&void 0!==o?o:0)<=(null!==(c=null==i||null===(u=i.current)||void 0===u?void 0:u.clientHeight)&&void 0!==c?c:0)&&a(!1))}),[i,e]),[t,i]}},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=a(5).i18n.translate("xpack.securitySolution.assistant.conversations.timelineConversationTitle",{defaultMessage:"Timeline"})},function(e,t,a){"use strict";a.d(t,"c",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"d",(function(){return s})),a.d(t,"a",(function(){return o}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.topN.closeButtonLabel",{defaultMessage:"Close"}),r=n.i18n.translate("xpack.securitySolution.topN.allEventsSelectLabel",{defaultMessage:"Alerts and events"}),s=n.i18n.translate("xpack.securitySolution.topN.rawEventsSelectLabel",{defaultMessage:"Raw events"}),o=n.i18n.translate("xpack.securitySolution.topN.alertEventsSelectLabel",{defaultMessage:"Detection alerts"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return p}));var n=a(2),i=a(4),r=a(562),s=a(116),o=a(105),l=a(122),c=a(110),u=a(175),d=a(211);const p=({applyGlobalQueriesAndFilters:e=!0,extraOptions:t,getLensAttributes:a,lensAttributes:p,scopeId:m=c.SourcererScopeName.default,stackByField:b,title:g})=>{var f,y;const{selectedPatterns:h,dataViewId:v,indicesExist:E}=Object(s.d)(m),x=Object(n.useMemo)((()=>l.d.globalQuerySelector()),[]),j=Object(n.useMemo)((()=>l.d.globalFiltersQuerySelector()),[]),S=Object(o.a)(x),k=Object(o.a)(j),[{detailName:O,pageName:w,tabName:T}]=Object(u.a)(),I=Object(n.useMemo)((()=>T===r.a.events?w===i.wc.network?d.h:Object(d.b)(w):[]),[w,T]),C=Object(n.useMemo)((()=>[i.wc.hosts,i.wc.users].indexOf(w)>=0&&null!=O?Object(d.c)(w,O):i.wc.network===w?Object(d.e)(O):[]),[O,w]),M=Object(n.useMemo)((()=>null!=p?p:a&&b&&a(b,t)),[t,a,p,b]),_=Object.values(null!==(f=null==M||null===(y=M.state)||void 0===y?void 0:y.adHocDataViews)&&void 0!==f?f:{}).length>0,F=Object(n.useMemo)((()=>{var t;if(null==p&&(null==a||null==b||0===(null==b?void 0:b.length)))return null;const n=_?[]:Object(d.d)(h);return{...M,...null!=g?{title:g}:{},state:{...M.state,...e?{query:S}:{},filters:[...M.state.filters,...C,...I,...n,...e?k:[]]},references:null==M||null===(t=M.references)||void 0===t?void 0:t.map((e=>({...e,id:v})))}}),[e,M,v,k,a,_,p,C,S,h,b,I,g]);return _||!_&&E?F:null}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(63),r=a(102),s=a(230);const o=({onAddToCaseClicked:e,lensAttributes:t,timeRange:a})=>{const o=Object(r.h)(),{cases:l}=Object(r.j)().services,c=Object(n.useMemo)((()=>[{persistableStateAttachmentState:{attributes:t,timeRange:a},persistableStateAttachmentTypeId:i.LENS_ATTACHMENT_TYPE,type:i.AttachmentType.persistableState}]),[t,a]),u=l.hooks.useCasesAddToExistingCaseModal({onClose:e,successToaster:{title:s.a}});return{onAddToExistingCaseClicked:Object(n.useCallback)((()=>{e&&e(),u.open({getAttachments:()=>c})}),[c,e,u]),disabled:null==t||null==a||!o.create||!o.read}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(63),r=a(102),s=a(230);const o=({onClick:e,timeRange:t,lensAttributes:a})=>{const o=Object(r.h)(),{cases:l}=Object(r.j)().services,c=Object(n.useMemo)((()=>[{persistableStateAttachmentState:{attributes:a,timeRange:t},persistableStateAttachmentTypeId:i.LENS_ATTACHMENT_TYPE,type:i.AttachmentType.persistableState}]),[a,t]),u=l.hooks.useCasesAddToNewCaseFlyout({toastContent:s.a});return{onAddToNewCaseClicked:Object(n.useCallback)((()=>{e&&e(),u.open({attachments:c})}),[c,u,e]),disabled:null==a||null==t||!o.create||!o.read}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a.n(n),r=a(40),s=a(41);const o=a.n(s)()(r.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-1tb0fg5-0"})(["flex:1;"]),l=()=>i.a.createElement(o,{alignItems:"center",justifyContent:"center",gutterSize:"none"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiLoadingSpinner,{size:"xl"}))),c=i.a.memo(l)},function(e,t,a){"use strict";a.d(t,"a",(function(){return d})),a.d(t,"b",(function(){return m}));var n=a(40),i=a(41),r=a.n(i),s=a(2),o=a.n(s),l=a(521),c=a(391),u=a(483);const d=r()(n.EuiPanel).withConfig({displayName:"KpiPanel",componentId:"sc-12zc7xr-0"})(["display:flex;flex-direction:column;position:relative;overflow-x:hidden;overflow-y:",";@media only screen and (min-width:","){","}",""],(({$overflowY:e})=>null!=e?e:"hidden"),(e=>e.theme.eui.euiBreakpoints.m),(({height:e,$toggleStatus:t})=>t&&`\n      height: ${null!=e?e:l.d}px;\n  `),(({$toggleStatus:e})=>e&&`\n    height: ${l.c}px;\n  `)),p=r.a.div.withConfig({displayName:"StackByComboBoxWrapper",componentId:"sc-12zc7xr-1"})(["max-width:400px;width:","px;"],(({width:e})=>e)),m=o.a.forwardRef((({"aria-label":e=u.c,"data-test-subj":t,isDisabled:a=!1,onSelect:i,prepend:r=u.d,selected:l,inputRef:d,width:m=400,dropDownoptions:b,useLensCompatibleFields:g},f)=>{const y=Object(s.useCallback)((e=>{e&&e.length>0?i(e[0].value):i("")}),[i]),h=Object(s.useMemo)((()=>[{label:l,value:l}]),[l]),v=Object(c.b)(g),E=Object(s.useMemo)((()=>({asPlainText:!0})),[]);return o.a.createElement(p,{width:m},o.a.createElement(n.EuiComboBox,{"data-test-subj":t,"aria-label":e,inputRef:d,isDisabled:a,placeholder:u.e,prepend:r,ref:f,singleSelection:E,isClearable:!1,sortMatchesBy:"startsWith",options:null!=b?b:v,selectedOptions:h,compressed:!0,onChange:y}))}));m.displayName="StackByComboBox"},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=e=>null==e?[]:null!=e.host&&null!=e.host.name?[{fieldName:"host.name",fieldValue:e.host.name[0]}]:[]},,function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(41),i=a.n(n),r=a(40);const s=i()(r.EuiInMemoryTable).withConfig({displayName:"BasicTable",componentId:"sc-1ir53m2-0"})(["tbody{th,td{vertical-align:top;}.euiTableCellContent{display:block;}}"]);s.displayName="BasicTable"},,function(e,t,a){"use strict";a.d(t,"c",(function(){return i})),a.d(t,"v",(function(){return r})),a.d(t,"h",(function(){return s})),a.d(t,"l",(function(){return o})),a.d(t,"i",(function(){return l})),a.d(t,"k",(function(){return c})),a.d(t,"q",(function(){return u})),a.d(t,"p",(function(){return d})),a.d(t,"g",(function(){return p})),a.d(t,"e",(function(){return m})),a.d(t,"u",(function(){return b})),a.d(t,"C",(function(){return g})),a.d(t,"s",(function(){return f})),a.d(t,"y",(function(){return y})),a.d(t,"z",(function(){return h})),a.d(t,"a",(function(){return v})),a.d(t,"n",(function(){return E})),a.d(t,"b",(function(){return x})),a.d(t,"A",(function(){return j})),a.d(t,"j",(function(){return S})),a.d(t,"w",(function(){return k})),a.d(t,"B",(function(){return O})),a.d(t,"m",(function(){return w})),a.d(t,"r",(function(){return T})),a.d(t,"o",(function(){return I})),a.d(t,"t",(function(){return C})),a.d(t,"d",(function(){return M})),a.d(t,"x",(function(){return _})),a.d(t,"f",(function(){return F}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.assistant.title",{defaultMessage:"Elastic AI Assistant"}),r=n.i18n.translate("xpack.securitySolution.navigation.overview",{defaultMessage:"Overview"}),s=n.i18n.translate("xpack.securitySolution.navigation.ecsDataQualityDashboard",{defaultMessage:"Data Quality"}),o=n.i18n.translate("xpack.securitySolution.navigation.entityRiskScore",{defaultMessage:"Entity Risk Score"}),l=n.i18n.translate("xpack.securitySolution.navigation.detectionResponse",{defaultMessage:"Detection & Response"}),c=n.i18n.translate("xpack.securitySolution.navigation.entityAnalytics",{defaultMessage:"Entity Analytics"}),u=n.i18n.translate("xpack.securitySolution.navigation.hosts",{defaultMessage:"Hosts"}),d=n.i18n.translate("xpack.securitySolution.navigation.gettingStarted",{defaultMessage:"Get started"}),p=n.i18n.translate("xpack.securitySolution.navigation.dashboards",{defaultMessage:"Dashboards"}),m=n.i18n.translate("xpack.securitySolution.navigation.coverageOverviewDashboard",{defaultMessage:"MITRE ATT&CK® Coverage"}),b=n.i18n.translate("xpack.securitySolution.navigation.network",{defaultMessage:"Network"}),g=n.i18n.translate("xpack.securitySolution.navigation.users",{defaultMessage:"Users"}),f=n.i18n.translate("xpack.securitySolution.navigation.kubernetes",{defaultMessage:"Kubernetes"}),y=n.i18n.translate("xpack.securitySolution.navigation.rules",{defaultMessage:"Rules"}),h=n.i18n.translate("xpack.securitySolution.navigation.detectionRules",{defaultMessage:"Detection rules (SIEM)"}),v=n.i18n.translate("xpack.securitySolution.navigation.addRules",{defaultMessage:"Add Rules"}),E=n.i18n.translate("xpack.securitySolution.navigation.exceptions",{defaultMessage:"Shared exception lists"}),x=n.i18n.translate("xpack.securitySolution.navigation.alerts",{defaultMessage:"Alerts"}),j=n.i18n.translate("xpack.securitySolution.navigation.timelines",{defaultMessage:"Timelines"}),S=(n.i18n.translate("xpack.securitySolution.navigation.case",{defaultMessage:"Cases"}),n.i18n.translate("xpack.securitySolution.navigation.administration",{defaultMessage:"Administration"}),n.i18n.translate("xpack.securitySolution.search.administration.endpoints",{defaultMessage:"Endpoints"})),k=n.i18n.translate("xpack.securitySolution.navigation.administration.policies",{defaultMessage:"Policies"}),O=n.i18n.translate("xpack.securitySolution.search.administration.trustedApps",{defaultMessage:"Trusted applications"}),w=n.i18n.translate("xpack.securitySolution.search.administration.eventFilters",{defaultMessage:"Event filters"}),T=n.i18n.translate("xpack.securitySolution.search.administration.hostIsolationExceptions",{defaultMessage:"Host isolation exceptions"}),I=(n.i18n.translate("xpack.securitySolution.navigation.detect",{defaultMessage:"Detect"}),n.i18n.translate("xpack.securitySolution.navigation.findings",{defaultMessage:"Findings"}),n.i18n.translate("xpack.securitySolution.navigation.explore",{defaultMessage:"Explore"})),C=n.i18n.translate("xpack.securitySolution.navigation.manage",{defaultMessage:"Manage"}),M=n.i18n.translate("xpack.securitySolution.navigation.blocklist",{defaultMessage:"Blocklist"}),_=n.i18n.translate("xpack.securitySolution.navigation.responseActionsHistory",{defaultMessage:"Response actions history"}),F=n.i18n.translate("xpack.securitySolution.navigation.newRuleTitle",{defaultMessage:"Create new rule"});n.i18n.translate("xpack.securitySolution.navigation.threatIntelligence",{defaultMessage:"Intelligence"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return Zt}));var n=a(2),i=a.n(n),r=a(40),s=a(103),o=a(41),l=a.n(o),c=a(142),u=a(529),d=a(115),p=a(730),m=a(111),b=a(105),g=a(178),f=a(102),y=a(422),h=a(170),v=a(106),E=a(12),x=a(133),j=a(42);const S={process:{hash:{md5:["177afc1eb0be88eb9983fb74111260c4"],sha256:["3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb"],sha1:["f573b85e9beb32121f1949217947b2adc6749e3d"]},entity_id:["MWQxNWNmOWUtM2RjNy01Yjk3LWY1ODYtNzQzZjdjMjUxOGIyLTY5MjAtMTMyNDg5OTk2OTAuNDgzMzA3NzAw"],executable:["C:\\Users\\sean\\Downloads\\3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb.exe"],name:["C:\\Users\\sean\\Downloads\\3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb.exe"],pid:[6920],args:["C:\\Users\\sean\\Downloads\\3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb.exe"]},host:{os:{full:["Windows Server 2019 Datacenter 1809 (10.0.17763.1518)"],name:["Windows"],version:["1809 (10.0.17763.1518)"],platform:["windows"],family:["windows"],kernel:["1809 (10.0.17763.1518)"]},mac:["aa:bb:cc:dd:ee:ff"],architecture:["x86_64"],ip:["10.1.2.3"],id:["d8ad572e-d224-4044-a57d-f5a84c0dfe5d"],name:["win2019-endpoint-1"]},file:{mtime:["2020-11-04T21:40:51.494Z"],path:["C:\\Users\\sean\\Downloads\\3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb.exe"],owner:["sean"],hash:{md5:["177afc1eb0be88eb9983fb74111260c4"],sha256:["3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb"],sha1:["f573b85e9beb32121f1949217947b2adc6749e3d"]},name:["3be13acde2f4dcded4fd8d518a513bfc9882407a6e384ffb17d12710db7d76fb.exe"],extension:["exe"],size:[1604112]},event:{category:["malware","intrusion_detection","process"],outcome:["success"],severity:[73],code:["malicious_file"],action:["execution"],id:["LsuMZVr+sdhvehVM++++Gp2Y"],kind:["alert"],created:["2020-11-04T21:41:30.533Z"],module:["endpoint"],type:["info","start","denied"],dataset:["endpoint.alerts"]},agent:{type:["endpoint"]},timestamp:"2020-11-04T21:41:30.533Z",message:["Malware Prevention Alert"],_id:"0dA2lXUBn9bLIbfPkY7d"};var k=a(206),O=a(203),w=a(152);const T=()=>{const e=Object(k.c)({eventAction:"execution",eventCategory:"process",eventType:"denied",skipRedundantFileDetails:!0,text:O.S});return i.a.createElement(i.a.Fragment,null,e.renderRow({data:S,isDraggable:!1,scopeId:w.a}))},I=i.a.memo(T),C=[{_id:"1",data:[{field:"@timestamp",value:["2018-11-05T19:03:25.937Z"]},{field:"event.severity",value:["3"]},{field:"event.category",value:["Access"]},{field:"event.action",value:["Action"]},{field:"host.name",value:["apache"]},{field:"source.ip",value:["192.168.0.1"]},{field:"destination.ip",value:["192.168.0.3"]},{field:"destination.bytes",value:["123456"]},{field:"user.name",value:["john.dee"]}],ecs:{_id:"1",timestamp:"2018-11-05T19:03:25.937Z",host:{name:["apache"],ip:["192.168.0.1"]},event:{id:["1"],action:["Action"],category:["Access"],module:["nginx"],severity:[3]},source:{ip:["192.168.0.1"],port:[80]},destination:{ip:["192.168.0.3"],port:[6343]},user:{id:["1"],name:["john.dee"]},geo:{region_name:["xx"],country_iso_code:["xx"]}}},{_id:"3",data:[{field:"@timestamp",value:["2018-11-07T19:03:25.937Z"]},{field:"event.severity",value:["1"]},{field:"event.category",value:["Access"]},{field:"host.name",value:["nginx"]},{field:"source.ip",value:["192.168.0.3"]},{field:"destination.ip",value:["192.168.0.3"]},{field:"destination.bytes",value:["123456"]},{field:"user.name",value:["evan.davis"]}],ecs:{_id:"3",timestamp:"2018-11-07T19:03:25.937Z",host:{name:["nginx"],ip:["192.168.0.1"]},event:{id:["3"],category:["Access"],type:["HTTP Request"],module:["nginx"],severity:[1]},source:{ip:["192.168.0.3"],port:[443]},destination:{ip:["192.168.0.3"],port:[6343]},user:{id:["3"],name:["evan.davis"]},geo:{region_name:["xx"],country_iso_code:["xx"]}}},{_id:"4",data:[{field:"@timestamp",value:["2018-11-08T19:03:25.937Z"]},{field:"event.severity",value:["1"]},{field:"event.category",value:["Attempted Administrator Privilege Gain"]},{field:"host.name",value:["suricata"]},{field:"source.ip",value:["192.168.0.3"]},{field:"destination.ip",value:["192.168.0.3"]},{field:"destination.bytes",value:["123456"]},{field:"user.name",value:["jenny.jones"]}],ecs:{_id:"4",timestamp:"2018-11-08T19:03:25.937Z",host:{name:["suricata"],ip:["192.168.0.1"]},event:{id:["4"],category:["Attempted Administrator Privilege Gain"],type:["Alert"],module:["suricata"],severity:[1]},source:{ip:["192.168.0.3"],port:[53]},destination:{ip:["192.168.0.3"],port:[6343]},suricata:{eve:{flow_id:[4],proto:[""],alert:{signature:["ET EXPLOIT NETGEAR WNR2000v5 hidden_lang_avi Stack Overflow (CVE-2016-10174)"],signature_id:[4]}}},user:{id:["4"],name:["jenny.jones"]},geo:{region_name:["xx"],country_iso_code:["xx"]}}},{_id:"5",data:[{field:"@timestamp",value:["2018-11-09T19:03:25.937Z"]},{field:"event.severity",value:["3"]},{field:"event.category",value:["Access"]},{field:"host.name",value:["joe.computer"]},{field:"source.ip",value:["192.168.0.3"]},{field:"destination.ip",value:["192.168.0.3"]},{field:"destination.bytes",value:["123456"]},{field:"user.name",value:["becky.davis"]}],ecs:{_id:"5",timestamp:"2018-11-09T19:03:25.937Z",host:{name:["joe.computer"],ip:["192.168.0.1"]},event:{id:["5"],category:["Access"],type:["HTTP Request"],module:["nginx"],severity:[3]},source:{ip:["192.168.0.3"],port:[80]},destination:{ip:["192.168.0.3"],port:[6343]},user:{id:["5"],name:["becky.davis"]},geo:{region_name:["xx"],country_iso_code:["xx"]}}},{_id:"6",data:[{field:"@timestamp",value:["2018-11-10T19:03:25.937Z"]},{field:"event.severity",value:["3"]},{field:"event.category",value:["Access"]},{field:"host.name",value:["braden.davis"]},{field:"source.ip",value:["192.168.0.6"]},{field:"destination.ip",value:["192.168.0.3"]},{field:"destination.bytes",value:["123456"]}],ecs:{_id:"6",timestamp:"2018-11-10T19:03:25.937Z",host:{name:["braden.davis"],ip:["192.168.0.1"]},event:{id:["6"],category:["Access"],type:["HTTP Request"],module:["nginx"],severity:[3]},source:{ip:["192.168.0.6"],port:[80]},destination:{ip:["192.168.0.3"],port:[6343]},geo:{region_name:["xx"],country_iso_code:["xx"]}}},{_id:"8",data:[{field:"@timestamp",value:["2018-11-12T19:03:25.937Z"]},{field:"event.severity",value:["2"]},{field:"event.category",value:["Web Application Attack"]},{field:"host.name",value:["joe.computer"]},{field:"source.ip",value:["192.168.0.8"]},{field:"destination.ip",value:["192.168.0.3"]},{field:"destination.bytes",value:["123456"]},{field:"user.name",value:["jone.doe"]}],ecs:{_id:"8",timestamp:"2018-11-12T19:03:25.937Z",host:{name:["joe.computer"],ip:["192.168.0.1"]},event:{id:["8"],category:["Web Application Attack"],type:["Alert"],module:["suricata"],severity:[2]},suricata:{eve:{flow_id:[8],proto:[""],alert:{signature:["ET WEB_SERVER Possible CVE-2014-6271 Attempt in HTTP Cookie"],signature_id:[8]}}},source:{ip:["192.168.0.8"],port:[80]},destination:{ip:["192.168.0.3"],port:[6343]},user:{id:["8"],name:["jone.doe"]},geo:{region_name:["xx"],country_iso_code:["xx"]}}},{_id:"7",data:[{field:"@timestamp",value:["2018-11-11T19:03:25.937Z"]},{field:"event.severity",value:["3"]},{field:"event.category",value:["Access"]},{field:"host.name",value:["joe.computer"]},{field:"source.ip",value:["192.168.0.7"]},{field:"destination.ip",value:["192.168.0.3"]},{field:"destination.bytes",value:["123456"]},{field:"user.name",value:["jone.doe"]}],ecs:{_id:"7",timestamp:"2018-11-11T19:03:25.937Z",host:{name:["joe.computer"],ip:["192.168.0.1"]},event:{id:["7"],category:["Access"],type:["HTTP Request"],module:["apache"],severity:[3]},source:{ip:["192.168.0.7"],port:[80]},destination:{ip:["192.168.0.3"],port:[6343]},user:{id:["7"],name:["jone.doe"]},geo:{region_name:["xx"],country_iso_code:["xx"]}}},{_id:"9",data:[{field:"@timestamp",value:["2018-11-13T19:03:25.937Z"]},{field:"event.severity",value:["3"]},{field:"event.category",value:["Access"]},{field:"host.name",value:["joe.computer"]},{field:"source.ip",value:["192.168.0.9"]},{field:"destination.ip",value:["192.168.0.3"]},{field:"destination.bytes",value:["123456"]},{field:"user.name",value:["jone.doe"]}],ecs:{_id:"9",timestamp:"2018-11-13T19:03:25.937Z",host:{name:["joe.computer"],ip:["192.168.0.1"]},event:{id:["9"],category:["Access"],type:["HTTP Request"],module:["nginx"],severity:[3]},source:{ip:["192.168.0.9"],port:[80]},destination:{ip:["192.168.0.3"],port:[6343]},user:{id:["9"],name:["jone.doe"]},geo:{region_name:["xx"],country_iso_code:["xx"]}}},{_id:"10",data:[{field:"@timestamp",value:["2018-11-14T19:03:25.937Z"]},{field:"event.severity",value:["3"]},{field:"event.category",value:["Access"]},{field:"host.name",value:["joe.computer"]},{field:"source.ip",value:["192.168.0.10"]},{field:"destination.ip",value:["192.168.0.3"]},{field:"destination.bytes",value:["123456"]},{field:"user.name",value:["jone.doe"]}],ecs:{_id:"10",timestamp:"2018-11-14T19:03:25.937Z",host:{name:["joe.computer"],ip:["192.168.0.1"]},event:{id:["10"],category:["Access"],type:["HTTP Request"],module:["nginx"],severity:[3]},source:{ip:["192.168.0.10"],port:[80]},destination:{ip:["192.168.0.3"],port:[6343]},user:{id:["10"],name:["jone.doe"]},geo:{region_name:["xx"],country_iso_code:["xx"]}}},{_id:"11",data:[{field:"@timestamp",value:["2018-11-15T19:03:25.937Z"]},{field:"event.severity",value:["3"]},{field:"event.category",value:["Access"]},{field:"host.name",value:["joe.computer"]},{field:"source.ip",value:["192.168.0.11"]},{field:"destination.ip",value:["192.168.0.3"]},{field:"destination.bytes",value:["123456"]},{field:"user.name",value:["jone.doe"]}],ecs:{_id:"11",timestamp:"2018-11-15T19:03:25.937Z",host:{name:["joe.computer"],ip:["192.168.0.1"]},event:{id:["11"],category:["Access"],type:["HTTP Request"],module:["nginx"],severity:[3]},source:{ip:["192.168.0.11"],port:[80]},destination:{ip:["192.168.0.3"],port:[6343]},user:{id:["11"],name:["jone.doe"]},geo:{region_name:["xx"],country_iso_code:["xx"]}}},{_id:"12",data:[{field:"@timestamp",value:["2018-11-16T19:03:25.937Z"]},{field:"event.severity",value:["3"]},{field:"event.category",value:["Access"]},{field:"host.name",value:["joe.computer"]},{field:"source.ip",value:["192.168.0.12"]},{field:"destination.ip",value:["192.168.0.3"]},{field:"destination.bytes",value:["123456"]},{field:"user.name",value:["jone.doe"]}],ecs:{_id:"12",timestamp:"2018-11-16T19:03:25.937Z",host:{name:["joe.computer"],ip:["192.168.0.1"]},event:{id:["12"],category:["Access"],type:["HTTP Request"],module:["nginx"],severity:[3]},source:{ip:["192.168.0.12"],port:[80]},destination:{ip:["192.168.0.3"],port:[6343]},user:{id:["12"],name:["jone.doe"]},geo:{region_name:["xx"],country_iso_code:["xx"]}}},{_id:"2",data:[{field:"@timestamp",value:["2018-11-06T19:03:25.937Z"]},{field:"event.severity",value:["3"]},{field:"event.category",value:["Authentication"]},{field:"host.name",value:["joe.computer"]},{field:"source.ip",value:["192.168.0.2"]},{field:"destination.ip",value:["192.168.0.3"]},{field:"destination.bytes",value:["123456"]},{field:"user.name",value:["joe.bob"]}],ecs:{_id:"2",timestamp:"2018-11-06T19:03:25.937Z",host:{name:["joe.computer"],ip:["192.168.0.1"]},event:{id:["2"],category:["Authentication"],type:["Authentication Success"],module:["authlog"],severity:[3]},source:{ip:["192.168.0.2"],port:[80]},destination:{ip:["192.168.0.3"],port:[6343]},user:{id:["1"],name:["joe.bob"]},geo:{region_name:["xx"],country_iso_code:["xx"]}}},{_id:"13",data:[{field:"@timestamp",value:["2018-13-12T19:03:25.937Z"]},{field:"event.severity",value:["1"]},{field:"event.category",value:["Web Application Attack"]},{field:"host.name",value:["joe.computer"]},{field:"source.ip",value:["192.168.0.8"]},{field:"destination.ip",value:["192.168.0.3"]},{field:"destination.bytes",value:["123456"]}],ecs:{_id:"13",timestamp:"2018-12-12T19:03:25.937Z",host:{name:["joe.computer"],ip:["192.168.0.1"]},event:{id:["13"],category:["Web Application Attack"],type:["Alert"],module:["suricata"],severity:[1]},suricata:{eve:{flow_id:[13],proto:[""],alert:{signature:["ET WEB_SERVER Possible Attempt in HTTP Cookie"],signature_id:[13]}}},source:{ip:["192.168.0.8"],port:[80]},destination:{ip:["192.168.0.3"],port:[6343]},geo:{region_name:["xx"],country_iso_code:["xx"]}}},{_id:"14",data:[{field:"@timestamp",value:["2019-03-07T05:06:51.000Z"]},{field:"host.name",value:["zeek-franfurt"]},{field:"source.ip",value:["192.168.26.101"]},{field:"destination.ip",value:["192.168.238.205"]}],ecs:{_id:"14",timestamp:"2019-03-07T05:06:51.000Z",event:{module:["zeek"],dataset:["zeek.connection"]},host:{id:["37c81253e0fc4c46839c19b981be5177"],name:["zeek-franfurt"],ip:["207.154.238.205","10.19.0.5","fe80::d82b:9aff:fe0d:1e12"]},source:{ip:["185.176.26.101"],port:[44059]},destination:{ip:["207.154.238.205"],port:[11568]},geo:{region_name:["New York"],country_iso_code:["US"]},network:{transport:["tcp"]},zeek:{session_id:["C8DRTq362Fios6hw16"],connection:{local_resp:[!1],local_orig:[!1],missed_bytes:[0],state:["REJ"],history:["Sr"]}}}},{_id:"15",data:[{field:"@timestamp",value:["2019-03-07T00:51:28.000Z"]},{field:"host.name",value:["suricata-zeek-singapore"]},{field:"source.ip",value:["192.168.35.240"]},{field:"destination.ip",value:["192.168.67.3"]}],ecs:{_id:"15",timestamp:"2019-03-07T00:51:28.000Z",event:{module:["zeek"],dataset:["zeek.dns"]},host:{id:["af3fddf15f1d47979ce817ba0df10c6e"],name:["suricata-zeek-singapore"],ip:["206.189.35.240","10.15.0.5","fe80::98c7:eff:fe29:4455"]},source:{ip:["206.189.35.240"],port:[57475]},destination:{ip:["67.207.67.3"],port:[53]},geo:{region_name:["New York"],country_iso_code:["US"]},network:{transport:["udp"]},zeek:{session_id:["CyIrMA1L1JtLqdIuol"],dns:{AA:[!1],RD:[!1],trans_id:[65252],RA:[!1],TC:[!1]}}}},{_id:"16",data:[{field:"@timestamp",value:["2019-03-05T07:00:20.000Z"]},{field:"host.name",value:["suricata-zeek-singapore"]},{field:"source.ip",value:["192.168.35.240"]},{field:"destination.ip",value:["192.168.164.26"]}],ecs:{_id:"16",timestamp:"2019-03-05T07:00:20.000Z",event:{module:["zeek"],dataset:["zeek.http"]},host:{id:["af3fddf15f1d47979ce817ba0df10c6e"],name:["suricata-zeek-singapore"],ip:["206.189.35.240","10.15.0.5","fe80::98c7:eff:fe29:4455"]},source:{ip:["206.189.35.240"],port:[36220]},destination:{ip:["192.241.164.26"],port:[80]},geo:{region_name:["New York"],country_iso_code:["US"]},http:{version:["1.1"],request:{body:{bytes:[0]}},response:{status_code:[302],body:{bytes:[154]}}},zeek:{session_id:["CZLkpC22NquQJOpkwe"],http:{resp_mime_types:["text/html"],trans_depth:["3"],status_msg:["Moved Temporarily"],resp_fuids:["FzeujEPP7GTHmYPsc"],tags:[]}}}},{_id:"17",data:[{field:"@timestamp",value:["2019-02-28T22:36:28.000Z"]},{field:"host.name",value:["zeek-franfurt"]},{field:"source.ip",value:["192.168.77.171"]}],ecs:{_id:"17",timestamp:"2019-02-28T22:36:28.000Z",event:{module:["zeek"],dataset:["zeek.notice"]},host:{id:["37c81253e0fc4c46839c19b981be5177"],name:["zeek-franfurt"],ip:["207.154.238.205","10.19.0.5","fe80::d82b:9aff:fe0d:1e12"]},source:{ip:["8.42.77.171"]},zeek:{notice:{suppress_for:[3600],msg:["8.42.77.171 scanned at least 15 unique ports of host 207.154.238.205 in 0m0s"],note:["Scan::Port_Scan"],sub:["remote"],dst:["207.154.238.205"],dropped:[!1],peer_descr:["bro"]}}}},{_id:"18",data:[{field:"@timestamp",value:["2019-02-22T21:12:13.000Z"]},{field:"host.name",value:["zeek-sensor-amsterdam"]},{field:"source.ip",value:["192.168.66.184"]},{field:"destination.ip",value:["192.168.95.15"]}],ecs:{_id:"18",timestamp:"2019-02-22T21:12:13.000Z",event:{module:["zeek"],dataset:["zeek.ssl"]},host:{id:["2ce8b1e7d69e4a1d9c6bcddc473da9d9"],name:["zeek-sensor-amsterdam"]},source:{ip:["188.166.66.184"],port:[34514]},destination:{ip:["91.189.95.15"],port:[443]},geo:{region_name:["England"],country_iso_code:["GB"]},zeek:{session_id:["CmTxzt2OVXZLkGDaRe"],ssl:{cipher:["TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"],established:[!1],resumed:[!1],version:["TLSv12"]}}}},{_id:"19",data:[{field:"@timestamp",value:["2019-03-03T04:26:38.000Z"]},{field:"host.name",value:["suricata-zeek-singapore"]}],ecs:{_id:"19",timestamp:"2019-03-03T04:26:38.000Z",event:{module:["zeek"],dataset:["zeek.files"]},host:{id:["af3fddf15f1d47979ce817ba0df10c6e"],name:["suricata-zeek-singapore"],ip:["206.189.35.240","10.15.0.5","fe80::98c7:eff:fe29:4455"]},zeek:{session_id:["Cu0n232QMyvNtzb75j"],files:{session_ids:["Cu0n232QMyvNtzb75j"],timedout:[!1],local_orig:[!1],tx_host:["5.101.111.50"],source:["HTTP"],is_orig:[!1],overflow_bytes:[0],sha1:["fa5195a5dfacc9d1c68d43600f0e0262cad14dde"],duration:[0],depth:[0],analyzers:["MD5","SHA1"],mime_type:["text/plain"],rx_host:["206.189.35.240"],total_bytes:[88722],fuid:["FePz1uVEVCZ3I0FQi"],seen_bytes:[1198],missing_bytes:[0],md5:["f7653f1951693021daa9e6be61226e32"]}}}},{_id:"20",data:[{field:"@timestamp",value:["2019-03-13T05:42:11.815Z"]},{field:"event.category",value:["audit-rule"]},{field:"host.name",value:["zeek-sanfran"]},{field:"process.args",value:["gpgconf","--list-dirs","agent-socket"]}],ecs:{_id:"20",timestamp:"2019-03-13T05:42:11.815Z",event:{action:["executed"],module:["auditd"],category:["audit-rule"]},host:{id:["f896741c3b3b44bdb8e351a4ab6d2d7c"],name:["zeek-sanfran"],ip:["134.209.63.134","10.46.0.5","fe80::a0d9:16ff:fecf:e70b"]},user:{name:["alice"]},process:{pid:[5402],name:["gpgconf"],ppid:[5401],args:["gpgconf","--list-dirs","agent-socket"],executable:["/usr/bin/gpgconf"],title:["gpgconf --list-dirs agent-socket"],working_directory:["/"]}}},{_id:"21",data:[{field:"@timestamp",value:["2019-03-14T22:30:25.527Z"]},{field:"event.category",value:["user-login"]},{field:"host.name",value:["zeek-london"]},{field:"source.ip",value:["192.168.77.171"]},{field:"user.name",value:["root"]}],ecs:{_id:"21",timestamp:"2019-03-14T22:30:25.527Z",event:{action:["logged-in"],module:["auditd"],category:["user-login"]},auditd:{result:["success"],session:["14"],data:{terminal:["/dev/pts/0"],op:["login"]},summary:{actor:{primary:["alice"],secondary:["alice"]},object:{primary:["/dev/pts/0"],secondary:["8.42.77.171"],type:["user-session"]},how:["/usr/sbin/sshd"]}},host:{id:["7c21f5ed03b04d0299569d221fe18bbc"],name:["zeek-london"],ip:["46.101.3.136","10.16.0.5","fe80::4066:42ff:fe19:b3b9"]},source:{ip:["8.42.77.171"]},user:{name:["root"]},process:{pid:[17471],executable:["/usr/sbin/sshd"]}}},{_id:"22",data:[{field:"@timestamp",value:["2019-03-13T03:35:21.614Z"]},{field:"event.category",value:["user-login"]},{field:"host.name",value:["suricata-bangalore"]},{field:"user.name",value:["root"]}],ecs:{_id:"22",timestamp:"2019-03-13T03:35:21.614Z",event:{action:["disposed-credentials"],module:["auditd"],category:["user-login"]},auditd:{result:["success"],session:["340"],data:{acct:["alice"],terminal:["ssh"],op:["PAM:setcred"]},summary:{actor:{primary:["alice"],secondary:["alice"]},object:{primary:["ssh"],secondary:["8.42.77.171"],type:["user-session"]},how:["/usr/sbin/sshd"]}},host:{id:["0a63559c1acf4c419d979c4b4d8b83ff"],name:["suricata-bangalore"],ip:["139.59.11.147","10.47.0.5","fe80::ec0b:1bff:fe29:80bd"]},user:{name:["root"]},process:{pid:[21202],executable:["/usr/sbin/sshd"]}}},{_id:"23",data:[{field:"@timestamp",value:["2019-03-13T03:35:21.614Z"]},{field:"event.category",value:["user-login"]},{field:"host.name",value:["suricata-bangalore"]},{field:"user.name",value:["root"]}],ecs:{_id:"23",timestamp:"2019-03-13T03:35:21.614Z",event:{action:["ended-session"],module:["auditd"],category:["user-login"]},auditd:{result:["success"],session:["340"],data:{acct:["alice"],terminal:["ssh"],op:["PAM:session_close"]},summary:{actor:{primary:["alice"],secondary:["alice"]},object:{primary:["ssh"],secondary:["8.42.77.171"],type:["user-session"]},how:["/usr/sbin/sshd"]}},host:{id:["0a63559c1acf4c419d979c4b4d8b83ff"],name:["suricata-bangalore"],ip:["139.59.11.147","10.47.0.5","fe80::ec0b:1bff:fe29:80bd"]},user:{name:["root"]},process:{pid:[21202],executable:["/usr/sbin/sshd"]}}},{_id:"24",data:[{field:"@timestamp",value:["2019-03-18T23:17:01.645Z"]},{field:"event.category",value:["user-login"]},{field:"host.name",value:["zeek-london"]},{field:"user.name",value:["root"]}],ecs:{_id:"24",timestamp:"2019-03-18T23:17:01.645Z",event:{action:["acquired-credentials"],module:["auditd"],category:["user-login"]},auditd:{result:["success"],session:["unset"],data:{acct:["root"],terminal:["cron"],op:["PAM:setcred"]},summary:{actor:{primary:["unset"],secondary:["root"]},object:{primary:["cron"],type:["user-session"]},how:["/usr/sbin/cron"]}},host:{id:["7c21f5ed03b04d0299569d221fe18bbc"],name:["zeek-london"],ip:["46.101.3.136","10.16.0.5","fe80::4066:42ff:fe19:b3b9"]},user:{name:["root"]},process:{pid:[9592],executable:["/usr/sbin/cron"]}}},{_id:"25",data:[{field:"@timestamp",value:["2019-03-19T01:17:01.336Z"]},{field:"event.category",value:["user-login"]},{field:"host.name",value:["siem-kibana"]},{field:"user.name",value:["root"]}],ecs:{_id:"25",timestamp:"2019-03-19T01:17:01.336Z",event:{action:["started-session"],module:["auditd"],category:["user-login"]},auditd:{result:["success"],session:["2908"],data:{acct:["root"],terminal:["cron"],op:["PAM:session_open"]},summary:{actor:{primary:["root"],secondary:["root"]},object:{primary:["cron"],type:["user-session"]},how:["/usr/sbin/cron"]}},host:{id:["aa7ca589f1b8220002f2fc61c64cfbf1"],name:["siem-kibana"]},user:{name:["root"]},process:{pid:[725],executable:["/usr/sbin/cron"]}}},{_id:"26",data:[{field:"@timestamp",value:["2019-03-13T03:34:08.890Z"]},{field:"event.category",value:["user-login"]},{field:"host.name",value:["suricata-bangalore"]},{field:"user.name",value:["alice"]}],ecs:{_id:"26",timestamp:"2019-03-13T03:34:08.890Z",event:{action:["was-authorized"],module:["auditd"],category:["user-login"]},auditd:{result:["success"],session:["338"],data:{terminal:["/dev/pts/0"]},summary:{actor:{primary:["root"],secondary:["alice"]},object:{primary:["/dev/pts/0"],type:["user-session"]},how:["/sbin/pam_tally2"]}},host:{id:["0a63559c1acf4c419d979c4b4d8b83ff"],name:["suricata-bangalore"],ip:["139.59.11.147","10.47.0.5","fe80::ec0b:1bff:fe29:80bd"]},user:{name:["alice"]},process:{pid:[21170],executable:["/sbin/pam_tally2"]}}},{_id:"27",data:[{field:"@timestamp",value:["2019-03-22T19:13:11.026Z"]},{field:"event.action",value:["connected-to"]},{field:"event.category",value:["audit-rule"]},{field:"host.name",value:["zeek-london"]},{field:"destination.ip",value:["192.168.216.34"]},{field:"user.name",value:["alice"]}],ecs:{_id:"27",timestamp:"2019-03-22T19:13:11.026Z",event:{action:["connected-to"],module:["auditd"],category:["audit-rule"]},auditd:{result:["success"],session:["246"],summary:{actor:{primary:["alice"],secondary:["alice"]},object:{primary:["192.168.216.34"],secondary:["80"],type:["socket"]},how:["/usr/bin/wget"]}},host:{id:["7c21f5ed03b04d0299569d221fe18bbc"],name:["zeek-london"],ip:["46.101.3.136","10.16.0.5","fe80::4066:42ff:fe19:b3b9"]},destination:{ip:["192.168.216.34"],port:[80]},user:{name:["alice"]},process:{pid:[1490],name:["wget"],ppid:[1476],executable:["/usr/bin/wget"],title:["wget www.example.com"]}}},{_id:"28",data:[{field:"@timestamp",value:["2019-03-26T22:12:18.609Z"]},{field:"event.action",value:["opened-file"]},{field:"event.category",value:["audit-rule"]},{field:"host.name",value:["zeek-london"]},{field:"user.name",value:["root"]}],ecs:{_id:"28",timestamp:"2019-03-26T22:12:18.609Z",event:{action:["opened-file"],module:["auditd"],category:["audit-rule"]},auditd:{result:["success"],session:["242"],summary:{actor:{primary:["unset"],secondary:["root"]},object:{primary:["/proc/15990/attr/current"],type:["file"]},how:["/lib/systemd/systemd-journald"]}},file:{path:["/proc/15990/attr/current"],device:["00:00"],inode:["27672309"],uid:["0"],owner:["root"],gid:["0"],group:["root"],mode:["0666"]},host:{id:["7c21f5ed03b04d0299569d221fe18bbc"],name:["zeek-london"],ip:["46.101.3.136","10.16.0.5","fe80::4066:42ff:fe19:b3b9"]},user:{name:["root"]},process:{pid:[27244],name:["systemd-journal"],ppid:[1],executable:["/lib/systemd/systemd-journald"],title:["/lib/systemd/systemd-journald"],working_directory:["/"]}}},{_id:"29",data:[{field:"@timestamp",value:["2019-04-08T21:18:57.000Z"]},{field:"event.action",value:["user_login"]},{field:"event.category",value:null},{field:"host.name",value:["zeek-london"]},{field:"user.name",value:["Braden"]}],ecs:{_id:"29",event:{action:["user_login"],dataset:["login"],kind:["event"],module:["system"],outcome:["failure"]},host:{id:["7c21f5ed03b04d0299569d221fe18bbc"],name:["zeek-london"],ip:["46.101.3.136","10.16.0.5","fe80::4066:42ff:fe19:b3b9"]},source:{ip:["128.199.212.120"]},user:{name:["Braden"]},process:{pid:[6278]}}},{_id:"30",data:[{field:"@timestamp",value:["2019-04-08T22:27:14.814Z"]},{field:"event.action",value:["process_started"]},{field:"event.category",value:null},{field:"host.name",value:["zeek-london"]},{field:"user.name",value:["Evan"]}],ecs:{_id:"30",event:{action:["process_started"],dataset:["login"],kind:["event"],module:["system"],outcome:["failure"]},host:{id:["7c21f5ed03b04d0299569d221fe18bbc"],name:["zeek-london"],ip:["46.101.3.136","10.16.0.5","fe80::4066:42ff:fe19:b3b9"]},source:{ip:["128.199.212.120"]},user:{name:["Evan"]},process:{pid:[6278]}}},{_id:"31",data:[{field:"@timestamp",value:["2018-11-05T19:03:25.937Z"]},{field:"message",value:["I am a log file message"]},{field:"event.severity",value:["3"]},{field:"event.category",value:["Access"]},{field:"event.action",value:["Action"]},{field:"host.name",value:["apache"]},{field:"source.ip",value:["192.168.0.1"]},{field:"destination.ip",value:["192.168.0.3"]},{field:"destination.bytes",value:["123456"]},{field:"user.name",value:["john.dee"]}],ecs:{_id:"1",timestamp:"2018-11-05T19:03:25.937Z",host:{name:["apache"],ip:["192.168.0.1"]},event:{id:["1"],action:["Action"],category:["Access"],module:["nginx"],severity:[3]},message:["I am a log file message"],source:{ip:["192.168.0.1"],port:[80]},destination:{ip:["192.168.0.3"],port:[6343]},user:{id:["1"],name:["john.dee"]},geo:{region_name:["xx"],country_iso_code:["xx"]}}},{_id:"32",data:[],ecs:{_id:"BuBP4W0BOpWiDweSoYSg",timestamp:"2019-10-18T23:59:15.091Z",threat:{enrichments:[{indicator:{provider:["indicator_provider"],reference:["https://example.com"]},matched:{atomic:["192.168.1.1"],field:["source.ip"],type:["ip"]},feed:{name:["feed_name"]}}]}}}];var M=a(601),_=a(276);const F=()=>{const e=Object(M.b)({actionName:"connected-to",text:_.T});return i.a.createElement(i.a.Fragment,null,e.renderRow({data:C[26].ecs,isDraggable:!1,scopeId:w.a}))},A=i.a.memo(F),D=()=>{const e=Object(M.c)({actionName:"opened-file",text:`${_.Db} ${_.kc}`});return i.a.createElement(i.a.Fragment,null,e.renderRow({data:C[27].ecs,isDraggable:!1,scopeId:w.a}))},N=i.a.memo(D),P={file:{path:["C:\\Windows\\System32\\bcrypt.dll"],hash:{md5:["00439016776de367bad087d739a03797"],sha1:["2c4ba5c1482987d50a182bad915f52cd6611ee63"],sha256:["e70f5d8f87aab14e3160227d38387889befbe37fa4f8f5adc59eff52804b35fd"]},name:["bcrypt.dll"]},host:{os:{full:["Windows Server 2019 Datacenter 1809 (10.0.17763.1697)"],name:["Windows"],version:["1809 (10.0.17763.1697)"],family:["windows"],kernel:["1809 (10.0.17763.1697)"],platform:["windows"]},mac:["aa:bb:cc:dd:ee:ff"],name:["win2019-endpoint-1"],architecture:["x86_64"],ip:["10.1.2.3"],id:["d8ad572e-d224-4044-a57d-f5a84c0dfe5d"]},event:{category:["library"],kind:["event"],created:["2021-02-05T21:27:23.921Z"],module:["endpoint"],action:["load"],type:["start"],id:["LzzWB9jjGmCwGMvk++++Da5H"],dataset:["endpoint.events.library"]},process:{name:["sshd.exe"],pid:[9644],entity_id:["MWQxNWNmOWUtM2RjNy01Yjk3LWY1ODYtNzQzZjdjMjUxOGIyLTk2NDQtMTMyNTcwMzQwNDEuNzgyMTczODAw"],executable:["C:\\Program Files\\OpenSSH-Win64\\sshd.exe"]},agent:{type:["endpoint"]},user:{name:["SYSTEM"],domain:["NT AUTHORITY"]},message:["Endpoint DLL load event"],timestamp:"2021-02-05T21:27:23.921Z",_id:"IAUYdHcBGrBB52F2zo8Q"},R=()=>{const e=Object(k.d)({actionName:"load",text:O.q});return i.a.createElement(i.a.Fragment,null,e.renderRow({data:P,isDraggable:!1,scopeId:w.a}))},L=i.a.memo(R);var B=a(1394),q=a(820);const z=()=>i.a.createElement(i.a.Fragment,null,q.a.renderRow({data:{destination:{bytes:[40],geo:{city_name:["New York"],continent_name:["North America"],country_iso_code:["US"],country_name:["United States"],region_name:["New York"]},ip:["10.1.2.3"],packets:[1],port:[80]},event:{action:["network_flow"],category:["network_traffic"],duration:[B.a],end:["2018-11-12T19:03:25.936Z"],start:["2018-11-12T19:03:25.836Z"]},_id:"abcd",network:{bytes:[100],community_id:["we.live.in.a"],direction:["outgoing"],packets:[3],protocol:["http"],transport:["tcp"]},process:{name:["rat"]},source:{bytes:[60],geo:{city_name:["Atlanta"],continent_name:["North America"],country_iso_code:["US"],country_name:["United States"],region_name:["Georgia"]},ip:["192.168.1.2"],packets:[2],port:[9987]},timestamp:"2018-11-12T19:03:25.936Z",tls:{client_certificate:{fingerprint:{sha1:["tls.client_certificate.fingerprint.sha1-value"]}},fingerprints:{ja3:{hash:["tls.fingerprints.ja3.hash-value"]}},server_certificate:{fingerprint:{sha1:["tls.server_certificate.fingerprint.sha1-value"]}}},user:{name:["first.last"]}},isDraggable:!1,scopeId:w.a})),$=i.a.memo(z),V={host:{os:{full:["Windows Server 2019 Datacenter 1809 (10.0.17763.1697)"],name:["Windows"],version:["1809 (10.0.17763.1697)"],family:["windows"],kernel:["1809 (10.0.17763.1697)"],platform:["windows"]},mac:["aa:bb:cc:dd:ee:ff"],name:["win2019-endpoint-1"],architecture:["x86_64"],ip:["10.1.2.3"],id:["d8ad572e-d224-4044-a57d-f5a84c0dfe5d"]},event:{category:["registry"],kind:["event"],created:["2021-02-04T13:44:31.559Z"],module:["endpoint"],action:["modification"],type:["change"],id:["LzzWB9jjGmCwGMvk++++CbOn"],dataset:["endpoint.events.registry"]},process:{name:["GoogleUpdate.exe"],pid:[7408],entity_id:["MWQxNWNmOWUtM2RjNy01Yjk3LWY1ODYtNzQzZjdjMjUxOGIyLTc0MDgtMTMyNTY5MTk4NDguODY4NTI0ODAw"],executable:["C:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe"]},registry:{hive:["HKLM"],key:["SOFTWARE\\WOW6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\CurrentState"],path:["HKLM\\SOFTWARE\\WOW6432Node\\Google\\Update\\ClientState\\{430FD4D0-B729-4F61-AA34-91526481799D}\\CurrentState\\StateValue"],value:["StateValue"]},agent:{type:["endpoint"]},user:{name:["SYSTEM"],domain:["NT AUTHORITY"]},message:["Endpoint registry event"],timestamp:"2021-02-04T13:44:31.559Z",_id:"4cxLbXcBGrBB52F2uOfF"},U=()=>{const e=Object(k.e)({actionName:"modification",text:O.u});return i.a.createElement(i.a.Fragment,null,e.renderRow({data:V,isDraggable:!1,scopeId:w.a}))},H=i.a.memo(U);var G=a(871);const Q=()=>i.a.createElement(i.a.Fragment,null,G.a.renderRow({data:C[2].ecs,isDraggable:!1,scopeId:w.a})),W=i.a.memo(Q),K={_id:"2MjPcG0BOpWiDweSoutC",user:{id:["S-1-5-21-3573271228-3407584681-1597858646-1002"],domain:["Anvi-Acer"],name:["Arun"]},host:{os:{platform:["windows"],name:["Windows"],version:["6.1"]},ip:["10.178.85.222"],name:["HD-obe-8bf77f54"]},event:{module:["endgame"],dataset:["esensor"],action:["termination_event"],category:["process"],kind:["event"]},timestamp:"1569555712000",process:{hash:{md5:["bd4401441a21bf1abce6404f4231db4d"],sha1:["797255e72d5ed5c058d4785950eba7abaa057653"],sha256:["87976f3430cc99bc939e0694247c0759961a49832b87218f4313d6fc0bc3a776"]},pid:[442384],ppid:[8],name:["RuntimeBroker.exe"],executable:["C:\\Windows\\System32\\RuntimeBroker.exe"]},endgame:{pid:[442384],process_name:["RuntimeBroker.exe"],exit_code:[0]}},Y=()=>{const e=Object(k.h)({actionName:"termination_event",text:O.H});return i.a.createElement(i.a.Fragment,null,e.renderRow({data:K,isDraggable:!1,scopeId:w.a}))},J=i.a.memo(Y),X={_id:"S8jPcG0BOpWiDweSou3g",user:{id:["S-1-5-18"],domain:["NT AUTHORITY"],name:["SYSTEM"]},host:{os:{platform:["windows"],name:["Windows"],version:["6.1"]},ip:["10.178.85.222"],name:["HD-obe-8bf77f54"]},event:{module:["endgame"],dataset:["esensor"],action:["request_event"],category:["network"],kind:["event"]},message:["DNS query is completed for the name %1, type %2, query options %3 with status %4 Results %5 "],timestamp:"1569555712000",dns:{question:{name:["update.googleapis.com"],type:["A"]},resolved_ip:["10.100.197.67"]},network:{protocol:["dns"]},process:{pid:[443192],name:["GoogleUpdate.exe"],executable:["C:\\Program Files (x86)\\Google\\Update\\GoogleUpdate.exe"]},winlog:{event_id:[3008]},endgame:{process_name:["GoogleUpdate.exe"],pid:[443192]}},Z=()=>{const e=Object(k.a)();return i.a.createElement(i.a.Fragment,null,e.renderRow({data:X,isDraggable:!1,scopeId:w.a}))},ee=i.a.memo(Z),te={_id:"BcjPcG0BOpWiDweSou3g",user:{id:["S-1-5-21-3573271228-3407584681-1597858646-1002"],domain:["Anvi-Acer"],name:["Arun"]},host:{os:{platform:["windows"],name:["Windows"],version:["6.1"]},ip:["10.178.85.222"],name:["HD-obe-8bf77f54"]},event:{module:["endgame"],dataset:["esensor"],action:["creation_event"],category:["process"],type:["process_start"],kind:["event"]},timestamp:"1569555712000",process:{hash:{md5:["62d06d7235b37895b68de56687895743"],sha1:["12563599116157778a22600d2a163d8112aed845"],sha256:["d4c97ed46046893141652e2ec0056a698f6445109949d7fcabbce331146889ee"]},pid:[441684],ppid:[8],name:["Microsoft.Photos.exe"],executable:["C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\\Microsoft.Photos.exe"],args:["C:\\Program Files\\WindowsApps\\Microsoft.Windows.Photos_2018.18091.17210.0_x64__8wekyb3d8bbwe\\Microsoft.Photos.exe","-ServerName:App.AppXzst44mncqdg84v7sv6p7yznqwssy6f7f.mca"]},endgame:{process_name:["Microsoft.Photos.exe"],pid:[441684],parent_process_name:["svchost.exe"]}},ae=()=>{const e=Object(k.b)({actionName:"creation_event",text:O.A});return i.a.createElement(i.a.Fragment,null,e.renderRow({data:te,isDraggable:!1,scopeId:w.a}))},ne=i.a.memo(ae),ie={_id:"98jPcG0BOpWiDweSouzg",user:{id:["S-1-5-21-3573271228-3407584681-1597858646-1002"],domain:["Anvi-Acer"],name:["Arun"]},host:{os:{platform:["windows"],name:["Windows"],version:["6.1"]},ip:["10.178.85.222"],name:["HD-obe-8bf77f54"]},event:{module:["endgame"],dataset:["esensor"],action:["file_create_event"],category:["file"],kind:["event"]},timestamp:"1569555712000",endgame:{process_name:["chrome.exe"],pid:[11620],file_path:["C:\\Users\\Arun\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\63d78c21-e593-4484-b7a9-db33cd522ddc.tmp"]}},re={_id:"OMjPcG0BOpWiDweSeuW9",user:{id:["S-1-5-18"],domain:["NT AUTHORITY"],name:["SYSTEM"]},host:{os:{platform:["windows"],name:["Windows"],version:["10.0"]},ip:["10.134.159.150"],name:["HD-v1s-d2118419"]},event:{module:["endgame"],dataset:["esensor"],action:["file_delete_event"],category:["file"],kind:["event"]},timestamp:"1569555704000",endgame:{pid:[1084],file_name:["tmp000002f6"],file_path:["C:\\Windows\\TEMP\\tmp00000404\\tmp000002f6"],process_name:["AmSvc.exe"]}},se=()=>{const e=Object(k.g)({actionName:"file_delete_event",text:O.f});return i.a.createElement(i.a.Fragment,null,e.renderRow({data:re,isDraggable:!1,scopeId:w.a}))},oe=i.a.memo(se),le=()=>{const e=Object(k.f)({actionName:"file_create_event",text:O.e});return i.a.createElement(i.a.Fragment,null,e.renderRow({data:ie,isDraggable:!1,scopeId:w.a}))},ce=i.a.memo(le),ue={_id:"QsjPcG0BOpWiDweSeuRE",user:{id:["S-1-5-18"],domain:["NT AUTHORITY"],name:["SYSTEM"]},host:{os:{platform:["windows"],name:["Windows"],version:["10.0"]},ip:["10.134.159.150"],name:["HD-v1s-d2118419"]},event:{module:["endgame"],dataset:["esensor"],action:["user_logon"],category:["authentication"],type:["authentication_success"],kind:["event"]},message:["An account was successfully logged on.\r\n\r\nSubject:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tWIN-Q3DOP1UKA81$\r\n\tAccount Domain:\t\tWORKGROUP\r\n\tLogon ID:\t\t0x3e7\r\n\r\nLogon Type:\t\t\t5\r\n\r\nNew Logon:\r\n\tSecurity ID:\t\tS-1-5-18\r\n\tAccount Name:\t\tSYSTEM\r\n\tAccount Domain:\t\tNT AUTHORITY\r\n\tLogon ID:\t\t0x3e7\r\n\tLogon GUID:\t\t{00000000-0000-0000-0000-000000000000}\r\n\r\nProcess Information:\r\n\tProcess ID:\t\t0x1b0\r\n\tProcess Name:\t\tC:\\Windows\\System32\\services.exe\r\n\r\nNetwork Information:\r\n\tWorkstation Name:\t\r\n\tSource Network Address:\t-\r\n\tSource Port:\t\t-\r\n\r\nDetailed Authentication Information:\r\n\tLogon Process:\t\tAdvapi  \r\n\tAuthentication Package:\tNegotiate\r\n\tTransited Services:\t-\r\n\tPackage Name (NTLM only):\t-\r\n\tKey Length:\t\t0\r\n\r\nThis event is generated when a logon session is created. It is generated on the computer that was accessed.\r\n\r\nThe subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.\r\n\r\nThe logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).\r\n\r\nThe New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.\r\n\r\nThe network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.\r\n\r\nThe authentication information fields provide detailed information about this specific logon request.\r\n\t- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.\r\n\t- Transited services indicate which intermediate services have participated in this logon request.\r\n\t- Package name indicates which sub-protocol was used among the NTLM protocols.\r\n\t- Key length indicates the length of the generated session key. This will be 0 if no session key was requested."],timestamp:"1569555704000",process:{pid:[432],name:["C:\\Windows\\System32\\services.exe"],executable:["C:\\Windows\\System32\\services.exe"]},winlog:{event_id:[4624]},endgame:{target_logon_id:["0x3e7"],pid:[432],process_name:["C:\\Windows\\System32\\services.exe"],logon_type:[5],subject_user_name:["WIN-Q3DOP1UKA81$"],subject_logon_id:["0x3e7"],target_user_name:["SYSTEM"],target_domain_name:["NT AUTHORITY"]}},de=()=>{const e=Object(k.i)({actionName:"user_logon"});return i.a.createElement(i.a.Fragment,null,e.renderRow({data:ue,isDraggable:!1,scopeId:w.a}))},pe=i.a.memo(de),me={_id:"LsjPcG0BOpWiDweSCNfu",user:{id:["S-1-5-18"],domain:["NT AUTHORITY"],name:["SYSTEM"]},host:{os:{platform:["windows"],name:["Windows"],version:["10.0"]},ip:["10.43.255.177"],name:["HD-gqf-0af7b4fe"]},event:{module:["endgame"],dataset:["esensor"],action:["ipv4_connection_accept_event"],category:["network"],kind:["event"]},timestamp:"1569555676000",network:{community_id:["1:network-community_id"],transport:["tcp"]},process:{pid:[1084],name:["AmSvc.exe"],executable:["C:\\Program Files\\Cybereason ActiveProbe\\AmSvc.exe"]},source:{ip:["127.0.0.1"],port:[49306]},destination:{port:[49305],ip:["127.0.0.1"]},endgame:{pid:[1084]}},be=()=>{const e=Object(k.j)({actionName:"ipv4_connection_accept_event",text:O.b});return i.a.createElement(i.a.Fragment,null,e.renderRow({data:me,isDraggable:!1,scopeId:w.a}))},ge=i.a.memo(be);var fe=a(870);const ye=()=>i.a.createElement(i.a.Fragment,null,fe.a.renderRow({data:C[31].ecs,isDraggable:!1,scopeId:w.a})),he=i.a.memo(ye);var ve=a(873);const Ee=()=>i.a.createElement(i.a.Fragment,null,ve.a.renderRow({data:C[13].ecs,isDraggable:!1,scopeId:w.a})),xe=i.a.memo(Ee);var je=a(5);const Se=je.i18n.translate("xpack.securitySolution.eventRenderers.alertName",{defaultMessage:"Alert"}),ke=je.i18n.translate("xpack.securitySolution.eventRenderers.alertsName",{defaultMessage:"Alerts"}),Oe=je.i18n.translate("xpack.securitySolution.eventRenderers.alertsDescription",{defaultMessage:"Alerts are displayed when malware or ransomware is prevented and detected"}),we=je.i18n.translate("xpack.securitySolution.eventRenderers.auditdName",{defaultMessage:"Auditd"}),Te=je.i18n.translate("xpack.securitySolution.eventRenderers.auditdDescriptionPart1",{defaultMessage:"audit events convey security-relevant logs from the Linux Audit Framework."}),Ie=je.i18n.translate("xpack.securitySolution.eventRenderers.auditdFileName",{defaultMessage:"Auditd File"}),Ce=je.i18n.translate("xpack.securitySolution.eventRenderers.auditdFileDescriptionPart1",{defaultMessage:"File events show users (and system accounts) performing CRUD operations on files via specific processes."}),Me=je.i18n.translate("xpack.securitySolution.eventRenderers.authenticationName",{defaultMessage:"Authentication"}),_e=je.i18n.translate("xpack.securitySolution.eventRenderers.authenticationDescriptionPart1",{defaultMessage:"Authentication events show users (and system accounts) successfully or unsuccessfully logging into hosts."}),Fe=je.i18n.translate("xpack.securitySolution.eventRenderers.authenticationDescriptionPart2",{defaultMessage:"Some authentication events may include additional details when users authenticate on behalf of other users."}),Ae=je.i18n.translate("xpack.securitySolution.eventRenderers.dnsName",{defaultMessage:"Domain Name System (DNS)"}),De=je.i18n.translate("xpack.securitySolution.eventRenderers.dnsDescriptionPart1",{defaultMessage:"Domain Name System (DNS) events show users (and system accounts) making requests via specific processes to translate from host names to IP addresses."}),Ne=je.i18n.translate("xpack.securitySolution.eventRenderers.fileName",{defaultMessage:"File"}),Pe=je.i18n.translate("xpack.securitySolution.eventRenderers.fileDescriptionPart1",{defaultMessage:"File events show users (and system accounts) performing CRUD operations on files via specific processes."}),Re=je.i18n.translate("xpack.securitySolution.eventRenderers.fimName",{defaultMessage:"File Integrity Module (FIM)"}),Le=je.i18n.translate("xpack.securitySolution.eventRenderers.fimDescriptionPart1",{defaultMessage:"File Integrity Module (FIM) events show users (and system accounts) performing CRUD operations on files via specific processes."}),Be=je.i18n.translate("xpack.securitySolution.eventRenderers.flowName",{defaultMessage:"Flow"}),qe=je.i18n.translate("xpack.securitySolution.eventRenderers.flowDescriptionPart1",{defaultMessage:"The Flow renderer visualizes the flow of data between a source and destination. It's applicable to many types of events."}),ze=je.i18n.translate("xpack.securitySolution.eventRenderers.flowDescriptionPart2",{defaultMessage:"The hosts, ports, protocol, direction, duration, amount transferred, process, geographic location, and other details are visualized when available."}),$e=je.i18n.translate("xpack.securitySolution.eventRenderers.libraryName",{defaultMessage:"Library"}),Ve=je.i18n.translate("xpack.securitySolution.eventRenderers.libraryDescription",{defaultMessage:"Library events display a Dynamically Linked Library (DLL) being loaded by a process"}),Ue=je.i18n.translate("xpack.securitySolution.eventRenderers.processName",{defaultMessage:"Process"}),He=je.i18n.translate("xpack.securitySolution.eventRenderers.processDescriptionPart1",{defaultMessage:"Process events show users (and system accounts) starting and stopping processes."}),Ge=je.i18n.translate("xpack.securitySolution.eventRenderers.processDescriptionPart2",{defaultMessage:"Details including the command line arguments, parent process, and if applicable, file hashes are displayed when available."}),Qe=je.i18n.translate("xpack.securitySolution.eventRenderers.registryName",{defaultMessage:"Registry"}),We=je.i18n.translate("xpack.securitySolution.eventRenderers.registryDescription",{defaultMessage:"Registry events show updates to the Windows Registry"}),Ke=je.i18n.translate("xpack.securitySolution.eventRenderers.socketName",{defaultMessage:"Socket (Network)"}),Ye=je.i18n.translate("xpack.securitySolution.eventRenderers.socketDescriptionPart1",{defaultMessage:"Socket (Network) events show processes listening, accepting, and closing connections."}),Je=je.i18n.translate("xpack.securitySolution.eventRenderers.socketDescriptionPart2",{defaultMessage:"Details including the protocol, ports, and a community ID for correlating all network events related to a single flow are displayed when available."}),Xe=je.i18n.translate("xpack.securitySolution.eventRenderers.suricataName",{defaultMessage:"Suricata"}),Ze=je.i18n.translate("xpack.securitySolution.eventRenderers.suricataDescriptionPart1",{defaultMessage:"Summarizes"}),et=je.i18n.translate("xpack.securitySolution.eventRenderers.suricataDescriptionPart2",{defaultMessage:"intrusion detection (IDS), inline intrusion prevention (IPS), and network security monitoring (NSM) events"}),tt=je.i18n.translate("xpack.securitySolution.eventRenderers.systemName",{defaultMessage:"System"}),at=je.i18n.translate("xpack.securitySolution.eventRenderers.systemDescriptionPart1",{defaultMessage:"The Auditbeat"}),nt=je.i18n.translate("xpack.securitySolution.eventRenderers.systemDescriptionPart2",{defaultMessage:"module collects various security related information about a system."}),it=je.i18n.translate("xpack.securitySolution.eventRenderers.systemDescriptionPart3",{defaultMessage:"All datasets send both periodic state information (e.g. all currently running processes) and real-time changes (e.g. when a new process starts or stops)."}),rt=je.i18n.translate("xpack.securitySolution.eventRenderers.threatMatchName",{defaultMessage:"Threat Indicator Match"}),st=je.i18n.translate("xpack.securitySolution.eventRenderers.threatMatchDescription",{defaultMessage:"Summarizes events that matched threat indicators"}),ot=je.i18n.translate("xpack.securitySolution.eventRenderers.zeekName",{defaultMessage:"Zeek (formerly Bro)"}),lt=je.i18n.translate("xpack.securitySolution.eventRenderers.zeekDescriptionPart1",{defaultMessage:"Summarizes events from the"}),ct=je.i18n.translate("xpack.securitySolution.eventRenderers.zeekDescriptionPart2",{defaultMessage:"Network Security Monitoring (NSM) tool"}),ut={[v.d.alert]:Se,[v.d.alerts]:ke,[v.d.auditd]:we,[v.d.auditd_file]:Ie,[v.d.library]:$e,[v.d.system_security_event]:Me,[v.d.system_dns]:Ae,[v.d.netflow]:Be,[v.d.system]:tt,[v.d.system_endgame_process]:Ue,[v.d.registry]:Qe,[v.d.system_fim]:Re,[v.d.system_file]:Ne,[v.d.system_socket]:Ke,[v.d.suricata]:"Suricata",[v.d.threat_match]:rt,[v.d.zeek]:ot,[v.d.plain]:""},dt=({children:e,url:t})=>i.a.createElement(r.EuiLink,{href:t,target:"_blank",rel:"noopener nofollow noreferrer","data-test-subj":"externalLink"},e),pt=[{id:v.d.alerts,name:ut[v.d.alerts],description:Oe,example:I,searchableDescription:Oe},{id:v.d.auditd,name:ut[v.d.auditd],description:i.a.createElement("span",null,i.a.createElement(dt,{url:"https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-auditd.html"},we)," ",Te),example:A,searchableDescription:`${we} ${Te}`},{id:v.d.auditd_file,name:ut[v.d.auditd_file],description:i.a.createElement("span",null,i.a.createElement(dt,{url:"https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-auditd.html"},we)," ",Ce),example:N,searchableDescription:`${Ie} ${Ce}`},{id:v.d.library,name:ut[v.d.library],description:Ve,example:L,searchableDescription:Ve},{id:v.d.system_security_event,name:ut[v.d.system_security_event],description:i.a.createElement("div",null,i.a.createElement("p",null,_e),i.a.createElement("br",null),i.a.createElement("p",null,Fe)),example:pe,searchableDescription:`${_e} ${Fe}`},{id:v.d.system_dns,name:ut[v.d.system_dns],description:De,example:ee,searchableDescription:De},{id:v.d.netflow,name:ut[v.d.netflow],description:i.a.createElement("div",null,i.a.createElement("p",null,qe),i.a.createElement("br",null),i.a.createElement("p",null,ze)),example:$,searchableDescription:`${qe} ${ze}`},{id:v.d.system,name:ut[v.d.system],description:i.a.createElement("div",null,i.a.createElement("p",null,at," ",i.a.createElement(dt,{url:"https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-system.html"},tt)," ",nt),i.a.createElement("br",null),i.a.createElement("p",null,it)),example:J,searchableDescription:`${at} ${tt} ${nt} ${it}`},{id:v.d.system_endgame_process,name:ut[v.d.system_endgame_process],description:i.a.createElement("div",null,i.a.createElement("p",null,He),i.a.createElement("br",null),i.a.createElement("p",null,Ge)),example:ne,searchableDescription:`${He} ${Ge}`},{id:v.d.registry,name:ut[v.d.registry],description:We,example:H,searchableDescription:We},{id:v.d.system_fim,name:ut[v.d.system_fim],description:Le,example:ce,searchableDescription:Le},{id:v.d.system_file,name:ut[v.d.system_file],description:Pe,example:oe,searchableDescription:Pe},{id:v.d.system_socket,name:ut[v.d.system_socket],description:i.a.createElement("div",null,i.a.createElement("p",null,Ye),i.a.createElement("br",null),i.a.createElement("p",null,Je)),example:ge,searchableDescription:`${Ye} ${Je}`},{id:v.d.suricata,name:ut[v.d.suricata],description:i.a.createElement("p",null,Ze," ",i.a.createElement(dt,{url:"https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-suricata.html"},Xe)," ",et),example:W,searchableDescription:`${Ze} ${Xe} ${et}`},{id:v.d.threat_match,name:ut[v.d.threat_match],description:st,example:he,searchableDescription:`${rt} ${st}`},{id:v.d.zeek,name:ut[v.d.zeek],description:i.a.createElement("p",null,lt," ",i.a.createElement(dt,{url:"https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-zeek.html"},ot)," ",ct),example:xe,searchableDescription:`${lt} ${ot} ${ct}`}],mt=l()(r.EuiInMemoryTable).withConfig({displayName:"StyledEuiInMemoryTable",componentId:"sc-ietqpj-0"})([".euiTable{tr > *:last-child{display:none;}.euiTableHeaderCellCheckbox > .euiTableCellContent{display:none;}}"]),bt=l()(r.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItem",componentId:"sc-ietqpj-1"})(["overflow:auto;> div{padding:0;> div{margin:0;}}"]),gt=e=>{if(e)return i.a.createElement(bt,{grow:1},i.a.createElement(e,null))},ft={box:{incremental:!0,schema:!0}},yt=()=>i.a.createElement(i.a.Fragment,null),ht={sort:{field:"name",direction:"asc"}},vt=l.a.button.withConfig({displayName:"StyledNameButton",componentId:"sc-ietqpj-2"})(["text-align:left;"]),Et=({excludedRowRendererIds:e=[],setExcludedRowRendererIds:t})=>{const a=Object(n.useCallback)((a=>()=>{const n=Object(j.xor)([a.id],e);t(n)}),[e,t]),s=Object(n.useCallback)(((e,t)=>i.a.createElement(vt,{className:"kbn-resetFocusState",onClick:a(t)},e)),[a]),o=Object(n.useCallback)(((t,n)=>i.a.createElement(r.EuiCheckbox,{id:n.id,onChange:a(n),checked:!e.includes(n.id)})),[e,a]),l=Object(n.useMemo)((()=>[{field:"id",name:"",sortable:!1,width:"32px",render:o},{field:"name",name:"Name",sortable:!0,width:"10%",render:s},{field:"description",name:"Description",width:"25%",render:e=>e},{field:"example",name:"Example",width:"65%",render:gt},{field:"searchableDescription",name:"Searchable Description",sortable:!1,width:"0px",render:yt}]),[o,s]);return i.a.createElement(mt,{items:pt,itemId:"id",columns:l,search:ft,sorting:ht,isSelectable:!0})};Et.displayName="RowRenderersBrowserComponent";const xt=i.a.memo(Et);xt.displayName="RowRenderersBrowser";const jt=je.i18n.translate("xpack.securitySolution.customizeEventRenderers.eventRenderersTitle",{defaultMessage:"Event Renderers"}),St=je.i18n.translate("xpack.securitySolution.customizeEventRenderers.customizeEventRenderersTitle",{defaultMessage:"Customize Event Renderers"}),kt=je.i18n.translate("xpack.securitySolution.customizeEventRenderers.customizeEventRenderersDescription",{defaultMessage:"Event Renderers automatically convey the most relevant details in an event to reveal its story"}),Ot=je.i18n.translate("xpack.securitySolution.customizeEventRenderers.enableAllRenderersButtonLabel",{defaultMessage:"Enable all"}),wt=je.i18n.translate("xpack.securitySolution.customizeEventRenderers.disableAllRenderersButtonLabel",{defaultMessage:"Disable all"}),Tt=l()(r.EuiModal).withConfig({displayName:"StyledEuiModal",componentId:"sc-m3n5c2-0"})([""," max-width:95vw;min-height:90vh;> .euiModal__flex{max-height:90vh;}"],(({theme:e})=>`margin-top: ${e.eui.euiSizeXXL};`)),It=l()(r.EuiModalBody).withConfig({displayName:"StyledEuiModalBody",componentId:"sc-m3n5c2-1"})([".euiModalBody__overflow{display:flex;align-items:stretch;overflow:hidden;> div{display:flex;flex-direction:column;flex:1;> div:first-child{flex:0;}.euiBasicTable{flex:1;overflow:auto;}}}"]),Ct=({timelineId:e})=>{const t=Object(s.useDispatch)(),a=Object(n.useMemo)((()=>m.b.getTimelineByIdSelector()),[]),o=Object(b.a)((t=>{var n;return(null!==(n=a(t,e))&&void 0!==n?n:x.b).excludedRowRendererIds})),[l,c]=Object(n.useState)(!1),u=Object(n.useCallback)((a=>t(Object(E.setExcludedRowRendererIds)({id:e,excludedRowRendererIds:a}))),[t,e]),d=Object(n.useCallback)((()=>c(!l)),[l]),p=Object(n.useCallback)((()=>c(!1)),[]),g=Object(n.useCallback)((()=>{u(Object.values(v.d))}),[u]),f=Object(n.useCallback)((()=>{u([])}),[u]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiToolTip,{content:St},i.a.createElement(r.EuiButtonIcon,{"aria-label":St,"data-test-subj":"show-row-renderers-gear",iconType:"gear",onClick:d},jt)),l&&i.a.createElement(Tt,{onClose:p,"data-test-subj":"row-renderers-modal"},i.a.createElement(r.EuiModalHeader,null,i.a.createElement(r.EuiFlexGroup,{alignItems:"center",justifyContent:"spaceBetween",direction:"row",gutterSize:"none"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiModalHeaderTitle,null,St),i.a.createElement(r.EuiText,{size:"s"},kt)),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiFlexGroup,null,i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonEmpty,{size:"s","data-test-subj":"disable-all",onClick:g},wt)),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButton,{fill:!0,size:"s","data-test-subj":"enable-all",onClick:f},Ot)))))),i.a.createElement(It,null,i.a.createElement(xt,{excludedRowRendererIds:o,setExcludedRowRendererIds:u}))))},Mt=i.a.memo(Ct);var _t=a(497),Ft=a(4),At=a(804);const Dt=je.i18n.translate("xpack.securitySolution.timeline.eventsSelect.actions.pinSelected",{defaultMessage:"Pin selected"}),Nt=je.i18n.translate("xpack.securitySolution.timeline.eventsSelect.actions.selectAll",{defaultMessage:"All"}),Pt=je.i18n.translate("xpack.securitySolution.timeline.eventsSelect.actions.selectNone",{defaultMessage:"None"}),Rt=je.i18n.translate("xpack.securitySolution.timeline.eventsSelect.actions.selectPinned",{defaultMessage:"Pinned"}),Lt=je.i18n.translate("xpack.securitySolution.timeline.eventsSelect.actions.selectUnpinned",{defaultMessage:"Unpinned"}),Bt=je.i18n.translate("xpack.securitySolution.timeline.eventsSelect.actions.unpinSelected",{defaultMessage:"Unpin selected"}),qt=l.a.div.withConfig({displayName:"InputDisplay",componentId:"sc-oi2e53-0"})(["width:5px;"]);qt.displayName="InputDisplay";const zt=l.a.div.withConfig({displayName:"PinIconContainer",componentId:"sc-oi2e53-1"})(["margin-right:5px;"]);zt.displayName="PinIconContainer";const $t=l.a.div.withConfig({displayName:"PinActionItem",componentId:"sc-oi2e53-2"})(["display:flex;flex-direction:row;"]);$t.displayName="PinActionItem";const Vt=i.a.memo((({text:e})=>i.a.createElement(r.EuiText,{size:"s",color:"subdued"},e)));Vt.displayName="DropdownDisplay";const Ut=Object(o.createGlobalStyle)([".eventsSelectItem{width:100% !important;.euiContextMenu__icon{display:none !important;}}.eventsSelectDropdown{width:","px;}"],60),Ht=l.a.div.withConfig({displayName:"CheckboxContainer",componentId:"sc-1giocnz-0"})(["position:relative;"]);Ht.displayName="CheckboxContainer";const Gt=l.a.div.withConfig({displayName:"PositionedCheckbox",componentId:"sc-1giocnz-1"})(["left:7px;position:absolute;top:-28px;"]);Gt.displayName="PositionedCheckbox";const Qt=i.a.memo((({checkState:e,timelineId:t})=>i.a.createElement("div",{"data-test-subj":"events-select"},i.a.createElement(r.EuiSuperSelect,{className:"eventsSelectDropdown","data-test-subj":"events-select-dropdown",itemClassName:"eventsSelectItem",onChange:j.noop,options:[{inputDisplay:i.a.createElement(qt,null),disabled:!0,dropdownDisplay:i.a.createElement(Vt,{text:Nt}),value:"select-all"},{inputDisplay:i.a.createElement(qt,null),disabled:!0,dropdownDisplay:i.a.createElement(Vt,{text:Pt}),value:"select-none"},{inputDisplay:i.a.createElement(qt,null),disabled:!0,dropdownDisplay:i.a.createElement(Vt,{text:Rt}),value:"select-pinned"},{inputDisplay:i.a.createElement(qt,null),disabled:!0,dropdownDisplay:i.a.createElement(Vt,{text:Lt}),value:"select-unpinned"},{inputDisplay:i.a.createElement(qt,null),disabled:!0,dropdownDisplay:i.a.createElement($t,null,i.a.createElement(zt,null,i.a.createElement(At.a,{allowUnpinning:!0,isAlert:!1,pinned:!0})),i.a.createElement(Vt,{text:Dt})),value:"pin-selected"},{inputDisplay:i.a.createElement(qt,null),disabled:!0,dropdownDisplay:i.a.createElement($t,null,i.a.createElement(zt,null,i.a.createElement(At.a,{allowUnpinning:!0,isAlert:!1,pinned:!1})),i.a.createElement(Vt,{text:Bt})),value:"unpin-selected"}]}),i.a.createElement(Ht,{"data-test-subj":"timeline-events-select-checkbox-container"},i.a.createElement(Gt,{"data-test-subj":"timeline-events-select-positioned-checkbox"},i.a.createElement(r.EuiCheckbox,{checked:"checked"===e,"data-test-subj":"events-select-checkbox",disabled:!0,id:`timeline-${t}-events-select`,indeterminate:"indeterminate"===e,onChange:j.noop}))),i.a.createElement(Ut,null))));Qt.displayName="EventsSelect";var Wt=a(564);const Kt=l.a.div.withConfig({displayName:"SortingColumnsContainer",componentId:"sc-1ls1217-0"})(["button{color:",";}.euiPopover .euiButtonEmpty{padding:0;.euiButtonEmpty__text{display:none;}}"],(({theme:e})=>e.eui.euiColorPrimary)),Yt=l.a.div.withConfig({displayName:"FieldBrowserContainer",componentId:"sc-1ls1217-1"})([".euiToolTipAnchor{.euiButtonContent{padding:",";}button{color:",";}.euiButtonContent__icon{width:16px;height:16px;}.euiButtonEmpty__text{display:none;}}"],(({theme:e})=>`0 ${e.eui.euiSizeXS}`),(({theme:e})=>e.eui.euiColorPrimary)),Jt=l.a.div.withConfig({displayName:"ActionsContainer",componentId:"sc-1ls1217-2"})(["align-items:center;display:flex;"]),Xt=({width:e,browserFields:t,columnHeaders:a,isEventViewer:o=!1,isSelectAllChecked:l,onSelectAll:v,showEventsSelect:E,showSelectAllCheckbox:x,sort:j,tabType:S,timelineId:k,fieldBrowserOptions:O})=>{const{triggersActionsUi:w}=Object(f.j)().services,{globalFullScreen:T,setGlobalFullScreen:I}=Object(g.a)(),{timelineFullScreen:C,setTimelineFullScreen:M}=Object(g.c)(),_=Object(s.useDispatch)(),F=Object(n.useMemo)((()=>m.b.getTimelineByIdSelector()),[]),{defaultColumns:A}=Object(b.a)((e=>F(e,k))),D=Object(n.useCallback)((()=>{k===c.f.active?M(!C):I(!T)}),[k,M,C,I,T]),N=Object(n.useMemo)((()=>Object(u.b)({globalFullScreen:T,isActiveTimelines:Object(d.isActiveTimeline)(k),timelineFullScreen:C})),[T,C,k]),P=Object(n.useCallback)((e=>{v({isSelected:e.currentTarget.checked})}),[v]),R=Object(n.useCallback)((e=>_(m.a.updateSort({id:k,sort:e.map((({id:e,direction:t})=>{var n,i;const r=a.find((t=>t.id===e)),s=null!==(n=null==r?void 0:r.type)&&void 0!==n?n:"",o=null!==(i=null==r?void 0:r.esTypes)&&void 0!==i?i:[];return{columnId:e,columnType:s,esTypes:o,sortDirection:t}}))}))),[a,_,k]),L=Object(n.useMemo)((()=>{var e;return{onSort:R,columns:null!==(e=null==j?void 0:j.map((({columnId:e,sortDirection:t})=>({id:e,direction:t}))))&&void 0!==e?e:[]}}),[R,j]),B=Object(n.useMemo)((()=>{var e;return null!==(e=null==a?void 0:a.reduce(((e,t)=>{var a;return{...e,[t.id]:null!==(a=t.displayAsText)&&void 0!==a?a:t.id}}),{}))&&void 0!==e?e:{}}),[a]),q=Object(n.useMemo)((()=>{var e;return null!==(e=null==a?void 0:a.map((({aggregatable:e,displayAsText:t,id:a,type:n})=>({id:a,isSortable:e,displayAsText:t,schema:n}))))&&void 0!==e?e:[]}),[a]),z=Object(n.useCallback)((()=>{_(m.a.updateColumns({id:k,columns:A}))}),[A,_,k]),$=Object(n.useCallback)((e=>{a.some((({id:t})=>t===e))?_(m.a.removeColumn({columnId:e,id:k})):_(m.a.upsertColumn({column:Object(p.a)(e,A),id:k,index:1}))}),[a,_,k,A]),V=Object(r.useDataGridColumnSorting)(q,L,{},[],B);return i.a.createElement(Jt,null,x&&i.a.createElement(h.o,{role:"checkbox"},i.a.createElement(h.p,{textAlign:"center",width:y.b},i.a.createElement(r.EuiCheckbox,{"data-test-subj":"select-all-events",id:"select-all-events",checked:l,onChange:P}))),i.a.createElement(h.o,{role:"button"},i.a.createElement(Yt,null,w.getFieldBrowser({browserFields:t,columnIds:a.map((({id:e})=>e)),onResetColumns:z,onToggleColumn:$,options:O}))),i.a.createElement(h.o,{role:"button"},i.a.createElement(Mt,{"data-test-subj":"row-renderers-browser",timelineId:k})),i.a.createElement(h.o,{role:"button"},i.a.createElement(h.p,{textAlign:"center",width:y.b},i.a.createElement(r.EuiToolTip,{content:N?_t.a:Wt.e},i.a.createElement(r.EuiButtonIcon,{"aria-label":Object(u.b)({globalFullScreen:T,isActiveTimelines:Object(d.isActiveTimeline)(k),timelineFullScreen:C})?_t.a:Wt.e,className:N?Ft.yb:"",color:N?"ghost":"primary","data-test-subj":Object(d.isActiveTimeline)(k)?"full-screen-active":"full-screen",iconType:"fullScreen",onClick:D})))),S!==c.g.eql&&i.a.createElement(h.o,{role:"button","data-test-subj":"timeline-sorting-fields"},i.a.createElement(h.p,{textAlign:"center",width:y.b},i.a.createElement(r.EuiToolTip,{content:Wt.l},i.a.createElement(Kt,null,V)))),E&&i.a.createElement(h.o,{role:"button"},i.a.createElement(h.p,{textAlign:"center",width:y.b},i.a.createElement(Qt,{checkState:"unchecked",timelineId:k}))))};Xt.displayName="HeaderActionsComponent";const Zt=i.a.memo(Xt)},function(e,t,a){"use strict";a.d(t,"a",(function(){return Te})),a.d(t,"b",(function(){return Me})),a.d(t,"c",(function(){return Pe})),a.d(t,"e",(function(){return Ee})),a.d(t,"d",(function(){return Ne})),a.d(t,"f",(function(){return Re.a}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(40),l=a(41),c=a.n(l),u=a(5);const d=u.i18n.translate("xpack.securitySolution.artifactCard.lastUpdated",{defaultMessage:"Last updated"}),p=u.i18n.translate("xpack.securitySolution.artifactCard.created",{defaultMessage:"Created"}),m=u.i18n.translate("xpack.securitySolution.artifactCard.lastUpdatedBy",{defaultMessage:"Updated by"}),b=u.i18n.translate("xpack.securitySolution.artifactCard.createdBy",{defaultMessage:"Created by"}),g=u.i18n.translate("xpack.securitySolution.artifactCard.globalEffectScope",{defaultMessage:"Applied globally"}),f=(e=0)=>u.i18n.translate("xpack.securitySolution.artifactCard.policyEffectScope",{defaultMessage:"Applied to {count} {count, plural, one {policy} other {policies}}",values:{count:e}}),y=(e=0)=>u.i18n.translate("xpack.securitySolution.artifactCard.policyEffectScope.title",{defaultMessage:"Applied to the following {count, plural, one {policy} other {policies}}",values:{count:e}}),h=u.i18n.translate("xpack.securitySolution.artifactCard.conditions.matchOperator",{defaultMessage:"IS"}),v=u.i18n.translate("xpack.securitySolution.artifactCard.conditions.matchOperator.not",{defaultMessage:"IS NOT"}),E=u.i18n.translate("xpack.securitySolution.artifactCard.conditions.wildcardMatchesOperator",{defaultMessage:"MATCHES"}),x=u.i18n.translate("xpack.securitySolution.artifactCard.conditions.nestedOperator",{defaultMessage:"has"}),j=u.i18n.translate("xpack.securitySolution.artifactCard.conditions.matchAnyOperator",{defaultMessage:"is one of"}),S=u.i18n.translate("xpack.securitySolution.artifactCard.conditions.matchAnyOperator.not",{defaultMessage:"is not one of"}),k=u.i18n.translate("xpack.securitySolution.artifactCard.conditions.existsOperator",{defaultMessage:"exists"}),O=u.i18n.translate("xpack.securitySolution.artifactCard.conditions.listOperator",{defaultMessage:"included in"}),w=u.i18n.translate("xpack.securitySolution.artifactCard.conditions.os",{defaultMessage:"OS"}),T=u.i18n.translate("xpack.securitySolution.artifactCard.conditions.and",{defaultMessage:"AND"}),I=u.i18n.translate("xpack.securitySolution.artifactCard.conditions.windows",{defaultMessage:"Windows"}),C=u.i18n.translate("xpack.securitySolution.artifactCard.conditions.linux",{defaultMessage:"Linux"}),M=u.i18n.translate("xpack.securitySolution.artifactCard.conditions.macos",{defaultMessage:"Mac"}),_=u.i18n.translate("xpack.securitySolution.artifactExpandableCard.expand",{defaultMessage:"Expand"}),F=u.i18n.translate("xpack.securitySolution.artifactExpandableCard.collpase",{defaultMessage:"Collapse"}),A=u.i18n.translate("xpack.securitySolution.artifactMinifiedCard.descriptionLabel",{defaultMessage:"Description"});var D=a(132),N=a(53),P=a.n(N),R=a(117);const L=Object(r.memo)((({bold:e,truncate:t,size:a="s",withTooltip:n=!1,"data-test-subj":i,children:l})=>{const c=Object(r.useMemo)((()=>P()({"eui-textTruncate":t,"eui-textBreakWord":!0})),[t]),u=Object(r.useMemo)((()=>e?s.a.createElement("strong",null,l):l),[e,l]);return s.a.createElement(o.EuiText,{className:c,size:a,"data-test-subj":i},n&&"string"==typeof l&&l.length>0&&l!==Object(R.e)()?s.a.createElement(o.EuiToolTip,{anchorClassName:c,content:l,position:"top"},s.a.createElement(s.a.Fragment,null,u)):u)}));L.displayName="TextValueDisplay";var B=a(107);const q=c()(o.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItem",componentId:"sc-1dvdnzg-0"})(["padding-top:2px;"]),z=Object(r.memo)((({date:e,type:t,"data-test-subj":a})=>{const n=Object(B.a)(a);return s.a.createElement(o.EuiFlexGroup,{responsive:!1,alignItems:"flexStart",gutterSize:"m","data-test-subj":a},s.a.createElement(q,{grow:!1},s.a.createElement(o.EuiIcon,{type:"calendar"})),s.a.createElement(o.EuiFlexItem,{grow:!0},s.a.createElement(o.EuiFlexGroup,{responsive:!1,direction:"column",alignItems:"flexStart",gutterSize:"xs"},s.a.createElement(o.EuiFlexItem,{className:"eui-textTruncate","data-test-subj":n("label")},s.a.createElement(L,null,"update"===t?d:p)),s.a.createElement(o.EuiFlexItem,{className:"eui-textTruncate","data-test-subj":n("value")},s.a.createElement(L,{bold:!0},s.a.createElement(D.b,{value:e,dateFormat:"M/D/YYYY"}))))))}));z.displayName="DateField";var $=a(47),V=a(502);const U=Object(r.memo)((({items:e,button:t,panelPaddingSize:a,anchorPosition:n,maxWidth:l="32ch",maxHeight:c="255px",fixedWidth:u=!1,title:d,loading:p=!1,hoverInfo:m,isNavigationDisabled:b=!1,...g})=>{const f=Object(B.a)(g["data-test-subj"]),[y,h]=Object(r.useState)(!1),v=Object(r.useCallback)((()=>h(!1)),[h]),E=Object(r.useCallback)((()=>h(!y)),[y]),x=Object(r.useMemo)((()=>({"data-test-subj":f("popoverPanel")})),[f]),j=Object(r.useMemo)((()=>e.map(((e,t)=>{var a,n;return p?s.a.createElement(o.EuiSkeletonText,{lines:1,key:Object($.v4)(),"data-test-subj":null!==(n=e["data-test-subj"])&&void 0!==n?n:f(`item-loading-${t}`)}):s.a.createElement(V.a,i()({},e,{isNavigationDisabled:b,key:Object($.v4)(),"data-test-subj":null!==(a=e["data-test-subj"])&&void 0!==a?a:f(`item-${t}`),textTruncate:Boolean(l)||e.textTruncate,hoverInfo:m,onClick:t=>{if(v(),e.onClick)return e.onClick(t)}}))}))),[e,p,b,f,l,m,v]),S=Object(r.useMemo)((()=>{const e={className:"eui-yScroll",style:{}};return l&&!u&&(e.style.maxWidth=l),c&&(e.style.maxHeight=c),u&&(e.style.width=null!=l?l:"32ch"),e}),[l,u,c]);return s.a.createElement(o.EuiPopover,i()({},g,{anchorPosition:n,panelPaddingSize:a,panelProps:x,button:s.a.createElement("div",{className:"eui-displayInlineBlock","data-test-subj":f("triggerButtonWrapper"),onClick:E},t),isOpen:y,closePopover:v}),d?s.a.createElement(o.EuiPopoverTitle,{paddingSize:"m"},d):null,s.a.createElement(o.EuiContextMenuPanel,i()({},S,{items:j})))}));U.displayName="ContextMenuWithRouterSupport";const H=Object(r.memo)((({items:e,"data-test-subj":t,icon:a="boxesHorizontal"})=>{const n=Object(B.a)(t),[l,c]=Object(r.useState)(!1),d=Object(r.useCallback)((()=>c(!1)),[c]),p=Object(r.useCallback)((()=>c(!l)),[l]),m=Object(r.useMemo)((()=>({"data-test-subj":n("popoverPanel")})),[n]),b=Object(r.useMemo)((()=>e.map((e=>s.a.createElement(V.a,i()({},e,{key:Object($.v4)(),onClick:t=>{if(d(),e.onClick)return e.onClick(t)}}))))),[d,e]);return s.a.createElement(o.EuiPopover,{anchorPosition:"downRight",panelPaddingSize:"none",panelProps:m,"data-test-subj":t,button:s.a.createElement(o.EuiButtonIcon,{"data-test-subj":n("button"),iconType:a,onClick:p,"aria-label":u.i18n.translate("xpack.securitySolution.actionsContextMenu.label",{defaultMessage:"Open"})}),isOpen:l,closePopover:d},s.a.createElement(o.EuiContextMenuPanel,{items:b,"data-test-subj":n("contextMenuPanel")}))}));H.displayName="ActionsContextMenu";const G=Object(r.memo)((({actions:e,"data-test-subj":t})=>e&&e.length>0?s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(H,{items:e,icon:"boxesHorizontal","data-test-subj":t})):null));G.displayName="CardActionsFlexItem";const Q=c()(o.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItemSmallBottomMargin",componentId:"sc-1orjmip-0"})(["margin-bottom:4px !important;"]),W=Object(r.memo)((({name:e,createdDate:t,updatedDate:a,actions:n,"data-test-subj":i})=>{const r=Object(B.a)(i);return s.a.createElement(o.EuiFlexGroup,{responsive:!1,alignItems:"flexStart","data-test-subj":i},s.a.createElement(Q,{grow:!0},s.a.createElement(o.EuiFlexGroup,{alignItems:"flexStart"},s.a.createElement(o.EuiFlexItem,{grow:!0},s.a.createElement(o.EuiTitle,{size:"s"},s.a.createElement("h3",{"data-test-subj":r("title")},e))),s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiFlexGroup,{responsive:!1,gutterSize:"xl"},s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(z,{date:a,type:"update","data-test-subj":r("updated")})),s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(z,{date:t,type:"create","data-test-subj":r("created")})))))),s.a.createElement(G,{actions:n,"data-test-subj":r("actions")}))}));W.displayName="CardHeader";const K=c()(o.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItem",componentId:"sc-1oz5dfu-0"})(["margin:6px;"]),Y=Object(r.memo)((({createdBy:e,updatedBy:t,"data-test-subj":a})=>{const n=Object(B.a)(a);return s.a.createElement(o.EuiFlexGroup,{alignItems:"center",gutterSize:"l",responsive:!1,"data-test-subj":a},s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(J,{label:b,value:e,"data-test-subj":n("createdBy")})),s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(J,{label:m,value:t,"data-test-subj":n("updatedBy")})))}));Y.displayName="TouchedByUsers";const J=Object(r.memo)((({label:e,value:t,"data-test-subj":a})=>{const n=Object(B.a)(a);return s.a.createElement(o.EuiFlexGroup,{alignItems:"center",gutterSize:"m",wrap:!1,responsive:!1,"data-test-subj":a},s.a.createElement(K,{grow:!1},s.a.createElement(o.EuiBadge,{"data-test-subj":n("label")},e)),s.a.createElement(K,{grow:!1},s.a.createElement(o.EuiFlexGroup,{responsive:!1,gutterSize:"s",alignItems:"center",wrap:!1},s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiAvatar,{name:t,size:"s","data-test-subj":n("avatar")})),s.a.createElement(o.EuiFlexItem,{grow:!1,className:"eui-textTruncate","data-test-subj":n("value")},s.a.createElement(L,null,t)))))}));J.displayName="UserName";var X=a(44),Z=a(126);const ee=c()("div").withConfig({displayName:"StyledWithContextMenuShiftedWrapper",componentId:"sc-d4sgp-0"})(["margin-left:-10px;"]),te=c()(o.EuiButtonEmpty).withConfig({displayName:"StyledEuiButtonEmpty",componentId:"sc-d4sgp-1"})(["height:10px !important;"]),ae=Object(r.memo)((({policies:e,loadingPoliciesList:t=!1,"data-test-subj":a})=>{const n=Object(B.a)(a),{canReadPolicyManagement:i}=Object(Z.a)().endpointPrivileges,[l,c]=Object(r.useMemo)((()=>e?["partial",f(e.length)]:["globe",g]),[e]),u=s.a.createElement(o.EuiFlexGroup,{responsive:!1,wrap:!1,alignItems:"center",gutterSize:"s","data-test-subj":a},s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiIcon,{type:l,size:"s"})),s.a.createElement(o.EuiFlexItem,{grow:!1,"data-test-subj":n("value")},s.a.createElement(L,{size:"xs"},c)));return e&&e.length?s.a.createElement(ee,null,s.a.createElement(ne,{policies:e,loadingPoliciesList:t,canReadPolicies:i,"data-test-subj":n("popupMenu")},u)):u}));ae.displayName="EffectScope";const ne=Object(r.memo)((({policies:e,loadingPoliciesList:t=!1,canReadPolicies:a,children:n,"data-test-subj":i})=>{const l=Object(B.a)(i),c=Object(r.useMemo)((()=>a?s.a.createElement(te,{flush:"right",size:"s",iconSide:"right",iconType:"popout"},s.a.createElement(X.FormattedMessage,{id:"xpack.securitySolution.contextMenuItemByRouter.viewDetails",defaultMessage:"View details"})):void 0),[a]);return s.a.createElement(U,{maxHeight:"235px",fixedWidth:!0,panelPaddingSize:"none",items:e,anchorPosition:e.length>1?"rightCenter":"rightUp","data-test-subj":i,loading:t,hoverInfo:c,button:s.a.createElement(o.EuiButtonEmpty,{size:"xs","data-test-subj":l("button")},n),title:y(e.length),isNavigationDisabled:!a})}));ne.displayName="WithContextMenu";const ie=Object(r.memo)((({createdBy:e,updatedBy:t,policies:a,loadingPoliciesList:n=!1,"data-test-subj":i})=>{const r=Object(B.a)(i);return s.a.createElement(o.EuiFlexGroup,{alignItems:"center",responsive:!0,"data-test-subj":i},s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(Y,{createdBy:e,updatedBy:t,"data-test-subj":r("touchedBy")})),s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(ae,{policies:a,loadingPoliciesList:n,"data-test-subj":r("effectScope")})))}));ie.displayName="CardSubHeader";var re=a(120);const se=Object.freeze({linux:C,mac:M,macos:M,windows:I}),oe=Object.freeze({[re.d.NESTED]:x,[re.d.MATCH_ANY]:j,[re.d.MATCH]:h,[re.d.WILDCARD]:E,[re.d.EXISTS]:k,[re.d.LIST]:O}),le=Object.freeze({[re.d.MATCH_ANY]:S,[re.d.MATCH]:v}),ce=c()(o.EuiFlexGroup).withConfig({displayName:"EuiFlexGroupNested",componentId:"sc-1oxtqy5-0"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeXL)),ue=c()(o.EuiFlexItem).withConfig({displayName:"EuiFlexItemNested",componentId:"sc-1oxtqy5-1"})(["margin-bottom:6px !important;margin-top:6px !important;"]),de=c()("span").withConfig({displayName:"StyledCondition",componentId:"sc-1oxtqy5-2"})(["margin-right:6px;"]),pe=Object(r.memo)((({os:e,entries:t,"data-test-subj":a})=>{const n=Object(B.a)(a),i=Object(r.useMemo)((()=>e.map((e=>{var t;return null!==(t=se[e])&&void 0!==t?t:e})).join(", ")),[e]),l=(e,t)=>"match_any"===e&&Array.isArray(t)?t.map((e=>s.a.createElement(o.EuiBadge,{color:"hollow"},e))):t,c=(e,t)=>{var a,n;return"nested"===e?"":"included"===t?null!==(a=oe[e])&&void 0!==a?a:e:null!==(n=le[e])&&void 0!==n?n:e},u=Object(r.useCallback)(((e,t)=>{if("nested"===e&&t.length)return t.map((({field:e,type:t,value:a,operator:i})=>s.a.createElement(ce,{"data-test-subj":n("nestedCondition"),key:e+t+a,direction:"row",alignItems:"center",gutterSize:"m",responsive:!1},s.a.createElement(ue,{grow:!1},s.a.createElement(o.EuiToken,{iconType:"tokenNested",size:"s"})),s.a.createElement(ue,{grow:!1},s.a.createElement(o.EuiExpression,{description:"",value:e,color:"subdued"})),s.a.createElement(ue,{grow:!1},s.a.createElement(o.EuiExpression,{description:c(t,i),value:l(t,a)})))))}),[n]);return s.a.createElement("div",{"data-test-subj":a},s.a.createElement("div",{"data-test-subj":n("os")},s.a.createElement("strong",null,s.a.createElement(o.EuiExpression,{description:"",value:w}),s.a.createElement(o.EuiExpression,{description:h,value:i}))),t.map((({field:e,type:t,value:a,operator:i,entries:r=[]})=>s.a.createElement("div",{"data-test-subj":n("condition"),key:e+t+a},s.a.createElement("div",{className:"eui-xScroll"},s.a.createElement(o.EuiExpression,{description:s.a.createElement(de,null,T),value:e,color:"subdued"}),s.a.createElement(o.EuiExpression,{description:c(t,i),value:l(t,a)})),u(t,r)))))}));pe.displayName="CriteriaConditions";const me=e=>"effectScope"in e;var be=a(226);const ge=e=>(e=>{const t=e.filter((e=>e.startsWith(be.b)));return t.some((e=>e===`${be.b}all`))?{type:"global"}:{type:"policy",policies:t.map((e=>e.substr(be.b.length)))}})(e.tags),fe=e=>Object(r.useMemo)((()=>(e=>{var t;const a=e,{name:n,created_by:i,created_at:r,updated_at:s,updated_by:o,description:l="",entries:c}=a;return{name:n,created_by:i,created_at:r,updated_at:s,updated_by:o,description:l,comments:me(a)?[]:a.comments,entries:c,os:me(a)?[a.os]:null!==(t=a.os_types)&&void 0!==t?t:[],effectScope:me(a)?a.effectScope:ge(a)}})(e)),[e]),ye=c()(o.EuiPanel).withConfig({displayName:"EuiPanelStyled",componentId:"sc-1qnczpg-0"})(["&.artifactEntryCard + &.artifactEntryCard{margin-top:",";}"],(({theme:e})=>e.eui.euiSizeL)),he=Object(r.memo)((({className:e,...t})=>s.a.createElement(ye,i()({},t,{hasBorder:!0,paddingSize:"none",className:`artifactEntryCard ${null!=e?e:""}`}))));he.displayName="CardContainerPanel";const ve=c()(o.EuiPanel).withConfig({displayName:"StyledEuiPanel",componentId:"sc-1aw8s5s-0"})(["padding:32px;&.top-section{padding-bottom:24px;}&.bottom-section{padding-top:24px;}&.artifact-entry-collapsible-card{padding:24px !important;}"]),Ee=Object(r.memo)((e=>s.a.createElement(ve,i()({},e,{hasBorder:!1,hasShadow:!1,paddingSize:"l"}))));Ee.displayName="CardSectionPanel";var xe=a(42),je=a(458);const Se=c()(o.EuiAvatar).withConfig({displayName:"CustomEuiAvatar",componentId:"sc-3lb0zi-0"})(["background-color:"," !important;"],(({theme:e})=>e.eui.euiColorLightShade)),ke=Object(r.memo)((({comments:e,"data-test-subj":t})=>{const a=Object(B.a)(t),[n,i]=Object(r.useState)(!1),l=Object(r.useCallback)((()=>{i(!n)}),[i,n]),c=Object(r.useMemo)((()=>(e=>e.map((e=>({username:e.created_by,timestamp:s.a.createElement(D.b,{value:e.created_at,dateFormat:"MMM D, YYYY"}),event:je.b,timelineAvatar:s.a.createElement(Se,{size:"s",name:e.created_by}),children:s.a.createElement(o.EuiText,{size:"s"},e.comment)}))))(e)),[e]),d=Object(r.useMemo)((()=>n?((e=0)=>u.i18n.translate("xpack.securitySolution.artifactCard.comments.label.hide",{defaultMessage:"Hide comments ({count})",values:{count:e}}))(e.length):((e=0)=>u.i18n.translate("xpack.securitySolution.artifactCard.comments.label.show",{defaultMessage:"Show comments ({count})",values:{count:e}}))(e.length)),[e.length,n]);return Object(xe.isEmpty)(e)?null:s.a.createElement("div",{"data-test-subj":t},s.a.createElement(o.EuiSpacer,{size:"s"}),s.a.createElement(o.EuiButtonEmpty,{onClick:l,flush:"left",size:"xs","data-test-subj":a("label")},d),s.a.createElement(o.EuiAccordion,{id:"1",arrowDisplay:"none",forceState:n?"open":"closed"},s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(o.EuiCommentList,{comments:c,"data-test-subj":a("list")})))}));ke.displayName="CardComments";const Oe=(e,t)=>Object(r.useMemo)((()=>"policy"===e.effectScope.type?null==e?void 0:e.effectScope.policies.map((e=>t&&t[e]?t[e]:{children:e})):void 0),[e.effectScope,t]),we=Object(r.memo)((({truncate:e,children:t,"data-test-subj":a,withTooltip:n})=>s.a.createElement(L,{size:"m",truncate:e,"data-test-subj":a,withTooltip:n},t||Object(R.e)())));we.displayName="ArtifactDescription";const Te=Object(r.memo)((({item:e,policies:t,loadingPoliciesList:a=!1,actions:n,hideDescription:r=!1,hideComments:l=!1,"data-test-subj":c,...u})=>{const d=fe(e),p=Object(B.a)(c),m=Oe(d,t);return s.a.createElement(he,i()({},u,{"data-test-subj":c}),s.a.createElement(Ee,{className:"top-section"},s.a.createElement(W,{name:d.name,createdDate:d.created_at,updatedDate:d.updated_at,actions:n,"data-test-subj":p("header")}),s.a.createElement(ie,{createdBy:d.created_by,updatedBy:d.updated_by,policies:m,loadingPoliciesList:a,"data-test-subj":p("subHeader")}),!r&&s.a.createElement(s.a.Fragment,null,s.a.createElement(o.EuiSpacer,{size:"l"}),s.a.createElement(we,{"data-test-subj":p("description")},d.description)),l?null:s.a.createElement(s.a.Fragment,null,r&&s.a.createElement(o.EuiSpacer,{size:"l"}),s.a.createElement(ke,{comments:d.comments,"data-test-subj":p("comments")}))),s.a.createElement(o.EuiHorizontalRule,{margin:"none"}),s.a.createElement(Ee,{className:"bottom-section"},s.a.createElement(pe,{os:d.os,entries:d.entries,"data-test-subj":p("criteriaConditions")})))}));Te.displayName="ArtifactEntryCard";const Ie=c()(o.EuiSplitPanel.Outer).withConfig({displayName:"CardContainerPanel",componentId:"sc-lh5b0s-0"})(["&.artifactEntryCardMinified + &.artifactEntryCardMinified{margin-top:",";}"],(({theme:e})=>e.eui.euiSizeL)),Ce=c()(o.EuiSplitPanel.Inner).withConfig({displayName:"CustomSplitInnerPanel",componentId:"sc-lh5b0s-1"})(["background-color:"," !important;"],(({theme:e})=>e.eui.euiColorLightestShade)),Me=Object(r.memo)((({item:e,isSelected:t=!1,onToggleSelectedArtifact:a,"data-test-subj":n,...l})=>{var c;const u=fe(e),d=Object(B.a)(n),[p,m]=Object(r.useState)("closed"),b=Object(r.useCallback)((()=>{m((e=>"closed"===e?"open":"closed"))}),[]),g=Object(r.useCallback)((()=>"open"===p?"Hide details":"Show details"),[p]),f=Object(r.useMemo)((()=>s.a.createElement(Ce,null,s.a.createElement(o.EuiFlexGroup,{alignItems:"center",gutterSize:"s"},s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiCheckbox,{id:u.name,"data-test-subj":`${u.name}_checkbox`,checked:t,onChange:()=>a(!t)})),s.a.createElement(o.EuiFlexItem,null,s.a.createElement(o.EuiTitle,{size:"xxs"},s.a.createElement("h5",{"data-test-subj":d("title")},u.name)))))),[u.name,d,t,a]);return s.a.createElement(Ie,i()({},l,{"data-test-subj":n,className:`${null!==(c=l.className)&&void 0!==c?c:""}  artifactEntryCardMinified`,id:u.name,hasShadow:!1,hasBorder:!0}),f,s.a.createElement(o.EuiSplitPanel.Inner,{paddingSize:"s"},s.a.createElement(o.EuiPanel,{hasBorder:!1,hasShadow:!1,paddingSize:"s"},s.a.createElement(o.EuiTitle,{size:"xxs"},s.a.createElement("h5",{"data-test-subj":d("descriptionTitle")},A)),s.a.createElement(we,{"data-test-subj":d("description")},u.description)),s.a.createElement(o.EuiPanel,{hasBorder:!1,hasShadow:!1,paddingSize:"s"},s.a.createElement(o.EuiButtonEmpty,{"data-test-subj":d("collapse"),color:"primary",size:"s",flush:"left",iconType:"open"===p?"arrowUp":"arrowDown",iconSide:"right",iconSize:"m",onClick:b,style:{fontWeight:400}},g()),s.a.createElement(o.EuiAccordion,{id:"showDetails",arrowDisplay:"none",forceState:p},s.a.createElement(pe,{os:u.os,entries:u.entries,"data-test-subj":d("criteriaConditions")})))))}));Me.displayName="ArtifactEntryCardMinified";const _e=Object(r.memo)((({expanded:e,onClick:t,"data-test-subj":a})=>s.a.createElement(o.EuiButtonIcon,{iconType:e?"arrowUp":"arrowDown",onClick:t,"data-test-subj":a,"aria-label":e?F:_})));_e.displayName="CardExpandButton";const Fe=Object(r.memo)((({artifact:e,onExpandCollapse:t,policies:a,actions:n,expanded:i=!1,"data-test-subj":o})=>{const l=Object(B.a)(o),c=Oe(e,a),u=Object(r.useCallback)((()=>{t()}),[t]);return s.a.createElement(Ne,{"data-test-subj":o,expanded:i,expandToggle:s.a.createElement(_e,{expanded:i,onClick:u,"data-test-subj":l("expandCollapse")}),name:s.a.createElement(L,{bold:!0,truncate:!i,withTooltip:!i},e.name),description:s.a.createElement(we,{truncate:!i,withTooltip:!i},e.description),effectScope:s.a.createElement(ae,{policies:c,"data-test-subj":l("effectScope")}),actionMenu:s.a.createElement(G,{actions:n,"data-test-subj":l("actions")})})}));Fe.displayName="CardCompressedHeader";const Ae=c.a.div.withConfig({displayName:"ButtonIconPlaceHolder",componentId:"sc-j6qhqr-0"})(["display:inline-block;width:",";height:",";"],(({theme:e})=>e.eui.euiSizeL),(({theme:e})=>e.eui.euiSizeL)),De=c()(o.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-j6qhqr-1"})(["&.flushTop,.flushTop{padding-top:0;margin-top:0;}"]),Ne=Object(r.memo)((({expanded:e,name:t,expandToggle:a,effectScope:n,actionMenu:i,description:l,"data-test-subj":c,flushTop:u})=>{const d=Object(B.a)(c),p=(e=>Object(r.useMemo)((()=>P()({"eui-textTruncate":!e})),[e]))(e),m=u?" flushTop":"";return s.a.createElement(De,{responsive:!1,alignItems:"center","data-test-subj":c,className:m},s.a.createElement(o.EuiFlexItem,{grow:!1,className:m,"data-test-subj":d("expandCollapseHolder")},a),s.a.createElement(o.EuiFlexItem,{className:p+m},s.a.createElement(o.EuiFlexGroup,{alignItems:"center",className:m},s.a.createElement(o.EuiFlexItem,{grow:2,className:p+m,"data-test-subj":d("titleHolder")},t),s.a.createElement(o.EuiFlexItem,{grow:3,className:p+m,"data-test-subj":d("descriptionHolder")},l),s.a.createElement(o.EuiFlexItem,{grow:1,"data-test-subj":d("effectScopeHolder"),className:m},n))),!0===i?s.a.createElement(o.EuiFlexItem,{grow:!1,"data-test-subj":d("cardActionsPlaceholder"),className:m},s.a.createElement(Ae,null)):i)}));Ne.displayName="CardCompressedHeaderLayout";const Pe=Object(r.memo)((({item:e,onExpandCollapse:t,policies:a,actions:n,expanded:r=!1,"data-test-subj":l,...c})=>{const u=fe(e),d=Object(B.a)(l);return s.a.createElement(he,i()({},c,{"data-test-subj":l}),s.a.createElement(Ee,{className:"artifact-entry-collapsible-card"},s.a.createElement(Fe,{artifact:u,actions:n,policies:a,expanded:r,onExpandCollapse:t,"data-test-subj":d("header")})),r&&s.a.createElement(s.a.Fragment,null,s.a.createElement(o.EuiHorizontalRule,{margin:"xs"}),s.a.createElement(Ee,null,s.a.createElement(pe,{os:u.os,entries:u.entries,"data-test-subj":d("criteriaConditions")}))))}));Pe.displayName="ArtifactEntryCollapsibleCard";var Re=a(731)},function(e,t,a){"use strict";a.d(t,"a",(function(){return Ie})),a.d(t,"c",(function(){return Ce})),a.d(t,"b",(function(){return Me})),a.d(t,"d",(function(){return _e}));var n=a(40),i=a(942),r=a(450),s=a(2),o=a.n(s),l=a(8),c=a(44),u=a(5),d=a(104),p=a.n(d);const m=({euiFieldProps:e})=>{const{field:{onChange:t,value:a,name:i},fieldState:{error:l}}=Object(r.useController)({name:"label",defaultValue:""}),c=Object(s.useMemo)((()=>!(null==l||!l.message)),[null==l?void 0:l.message]);return o.a.createElement(n.EuiFormRow,{label:u.i18n.translate("xpack.securitySolution.markdown.osquery.labelFieldText",{defaultMessage:"Label"}),error:null==l?void 0:l.message,isInvalid:c,fullWidth:!0},o.a.createElement(n.EuiFieldText,p()({isInvalid:c,onChange:t,value:a,name:i,fullWidth:!0,"data-test-subj":"input"},e)))},b=o.a.memo(m),g=u.i18n.translate("xpack.securitySolution.markdown.osquery.permissionDenied",{defaultMessage:"Permission denied"}),f=()=>o.a.createElement(n.EuiEmptyPrompt,{iconType:"logoOsquery",title:o.a.createElement("h2",null,g),titleSize:"xs",body:o.a.createElement("p",null,o.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.missingPrivileges",defaultMessage:"To access this page, ask your administrator for {osquery} Kibana privileges.",values:{osquery:o.a.createElement(n.EuiCode,null,"osquery")}}))});var y=a(102);const h=({node:e,onSave:t,onCancel:a})=>{var i,d,p;const m=null!=e,{osquery:g,application:{capabilities:{osquery:h}}}=Object(y.j)().services,v=Object(r.useForm)({defaultValues:{label:null==e||null===(i=e.configuration)||void 0===i?void 0:i.label,query:null==e||null===(d=e.configuration)||void 0===d?void 0:d.query,ecs_mapping:null==e||null===(p=e.configuration)||void 0===p?void 0:p.ecs_mapping}}),E=Object(s.useCallback)((e=>{t(`!{osquery${JSON.stringify(Object(l.pickBy)({query:e.query,label:e.label,ecs_mapping:e.ecs_mapping},(e=>!Object(l.isEmpty)(e))))}}`,{block:!0})}),[t]),x=Object(s.useMemo)((()=>!(h.runSavedQueries&&h.readSavedQueries||h.writeLiveQueries)),[h.readSavedQueries,h.runSavedQueries,h.writeLiveQueries]),j=Object(s.useMemo)((()=>{if(null!=g&&g.LiveQueryField){const{LiveQueryField:e}=g;return o.a.createElement(r.FormProvider,v,o.a.createElement(b,null),o.a.createElement(n.EuiSpacer,{size:"m"}),o.a.createElement(e,{formMethods:v}))}return null}),[v,g]);return x?o.a.createElement(f,null):o.a.createElement(o.a.Fragment,null,o.a.createElement(n.EuiModalHeader,null,o.a.createElement(n.EuiModalHeaderTitle,null,o.a.createElement("h1",null,m?o.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.editModalTitle",defaultMessage:"Edit query"}):o.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.addModalTitle",defaultMessage:"Add query"})))),o.a.createElement(n.EuiModalBody,null,o.a.createElement(o.a.Fragment,null,j)),o.a.createElement(n.EuiModalFooter,null,o.a.createElement(n.EuiButtonEmpty,{onClick:a},u.i18n.translate("xpack.securitySolution.markdown.osquery.modalCancelButtonLabel",{defaultMessage:"Cancel"})),o.a.createElement(n.EuiButton,{onClick:v.handleSubmit(E),fill:!0},m?o.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.addModalConfirmButtonLabel",defaultMessage:"Add query"}):o.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.markdown.osquery.editModalConfirmButtonLabel",defaultMessage:"Save changes"}))))},v=o.a.memo(h),E={name:"osquery",button:{label:"Osquery",iconType:"logoOsquery"},helpText:o.a.createElement("div",null,o.a.createElement(n.EuiCodeBlock,{language:"md",fontSize:"l",paddingSize:"s",isCopyable:!0},"!{osquery{options}}"),o.a.createElement(n.EuiSpacer,{size:"s"})),editor:v};var x=a(480),j=a(41),S=a.n(j),k=a(402),O=a(255),w=a(1037),T=a.n(w),I=a(511);const C=S()(n.EuiButton).withConfig({displayName:"StyledEuiButton",componentId:"sc-14wavsd-0"})(["> span > img{margin-block-end:0;}"]);var M=a(50),_=a.n(M),F=a(55),A=a.n(F),D=(a(21),a(83)),N=a(49),P=a(108),R=a(51),L=a(118),B=a(161),q=a(660),z=a(116),$=a(110),V=a(106),U=a(150);const H=e=>e===N.FILTERS.EXISTS?U.b:e===N.FILTERS.PHRASES?U.c:U.d,G={$state:{store:N.FilterStateStore.APP_STATE},meta:{disabled:!1,negate:!1,alias:null,index:void 0}},Q={and:[],enabled:!0,id:"",name:"",excluded:!1,kqlQuery:"",type:V.a.default,queryMatch:{field:"",value:"",operator:U.b}},W=e=>{const t={...G,meta:{...G.meta,negate:e.excluded,type:e.queryType}};if(e.queryType===N.FILTERS.EXISTS)return{...t,meta:{...t.meta,params:void 0,value:"exists"},query:{exists:{field:e.field}}};if(e.queryType===N.FILTERS.PHRASES){var a;let n=JSON.parse(String(e.value));return"number"===e.valueType?n=n.map(Number):"boolean"===e.valueType&&(n=n.map(Boolean)),{...t,meta:{...t.meta},query:{bool:{minimum_should_match:1,should:null===(a=n)||void 0===a?void 0:a.map((t=>({match_phrase:{[e.field]:t}})))}}}}var n;if(e.queryType===N.FILTERS.PHRASE)return{...t,meta:{...t.meta,params:{query:e.value},value:void 0},query:{match_phrase:{[e.field]:null!==(n=e.value)&&void 0!==n?n:""}}};if(e.queryType===N.FILTERS.RANGE){let a,n;try{const t=JSON.parse(String(e.value));a=t.gte,n=t.lt}catch{a="",n=""}const i={gte:a,lt:n};return{...t,meta:{...t.meta,params:i},query:{range:{[e.field]:i}}}}return t},K=({providers:e,alertData:t})=>{const a=Object(s.useMemo)((()=>e.some((e=>e.some((e=>"range"===e.queryType))))),[e]);return{dataProviders:Object(s.useMemo)((()=>a?[]:((e,t)=>e.map((e=>e.reduce(((e,a,n)=>{const{field:i,value:r,excluded:s,queryType:o}=a,{result:c,matchedBrackets:u}=((e,t)=>{if("number"==typeof e||"boolean"==typeof e)return{result:e,skipped:!0,matchedBrackets:null};const a=/\{{([^}]+)\}}/g,n=e.match(new RegExp(a));let i=e;n&&t&&Object(l.each)(n,(e=>{const a=e.replace(/{{|}}/g,"").trim();if(i.includes(e)){const n=t.find((({field:e})=>e===a));if(n&&n.values){const{values:[t]}=n;i=i.replace(e,t)}}}));const r=new RegExp(a).test(i);return{result:i,skipped:r,matchedBrackets:n}})(r,t),d=!t&&u;if(0===n)return{and:[],enabled:!0,id:JSON.stringify(i+r),name:i,excluded:s,kqlQuery:"",type:d?V.a.template:V.a.default,queryMatch:{field:i,value:c,operator:H(o)}};{const t={enabled:!0,id:JSON.stringify(i+r),name:i,excluded:s,kqlQuery:"",type:d?V.a.template:V.a.default,queryMatch:{field:i,value:c,operator:H(o)}};e.and.push(t)}return e}),Q))))(e,t)),[t,e,a]),filters:Object(s.useMemo)((()=>a?((e,t)=>{const a=[];for(let t=0;t<e.length;t++){const n=e[t];if(n.length>1){const e=n.map((e=>W(e))),t={$state:{store:N.FilterStateStore.APP_STATE},meta:{type:N.FILTERS.COMBINED,relation:N.BooleanRelation.AND,params:e,index:void 0,disabled:!1,negate:!1}};a.push(t)}else{const e=n[0],t=W(e);a.push(t)}}return a})(e):[]),[a,e,t])}};var Y=a(271),J=a(286),X=a(4);const Z=e=>{var t,a,n,i,r,s;const o=null!==(t=null===(a=e.meta)||void 0===a?void 0:a.key)&&void 0!==t?t:"",l={field:o,excluded:null!==(n=null===(i=e.meta)||void 0===i?void 0:i.negate)&&void 0!==n&&n,queryType:null!==(r=null===(s=e.meta)||void 0===s?void 0:s.type)&&void 0!==r?r:N.FILTERS.PHRASE};if(Object(N.isRangeFilter)(e)){var c;const{gte:t,lt:a}=e.query.range[o],n=JSON.stringify({gte:t,lt:a});return{...l,value:n,queryType:null!==(c=e.meta.type)&&void 0!==c?c:N.FILTERS.RANGE}}if(Object(N.isPhrasesFilter)(e)){var u,d,p,m;const t=typeof(null===(u=e.meta)||void 0===u?void 0:u.params[0]);return{...l,value:JSON.stringify(null!==(d=null===(p=e.meta)||void 0===p?void 0:p.params)&&void 0!==d?d:[]),valueType:t,queryType:null!==(m=e.meta.type)&&void 0!==m?m:N.FILTERS.PHRASES}}var b;if(Object(N.isExistsFilter)(e))return{...l,value:"",queryType:null!==(b=e.meta.type)&&void 0!==b?b:N.FILTERS.EXISTS};if(Object(N.isPhraseFilter)(e)){var g,f,y,h,v,E;const t=typeof(null===(g=e.meta)||void 0===g||null===(f=g.params)||void 0===f?void 0:f.query);return{...l,value:null!==(y=null===(h=e.meta)||void 0===h||null===(v=h.params)||void 0===v?void 0:v.query)&&void 0!==y?y:"",valueType:t,queryType:null!==(E=e.meta.type)&&void 0!==E?E:N.FILTERS.PHRASE}}return{...l,value:"",queryType:N.FILTERS.PHRASE}},ee=e=>e.map((e=>Z(e))),te=e=>!1===e.some(N.isCombinedFilter)?[ee(e)]:e.reduce(((e,t)=>{if(Object(N.isCombinedFilter)(t)){const a=t.meta.params;if(t.meta.relation===N.BooleanRelation.OR){const t=a.map((e=>{const t=te([e]);return Object(l.flatten)(t)}));return[...e,...t]}{const t=te(a);return[...e,...t]}}return[...e,[Z(t)]]}),[]);var ae=a(17),ne=a(62),ie=a.n(ne),re=a(678),se=a.n(re),oe=a(374);function le(e,t,a){var n;if(void 0===t||"undefined"===a)return!1;switch(e.type){case"date":const a="string"==typeof t?ie.a.parse(t):null;return Boolean("string"==typeof t&&a&&a.isValid());case"ip":if("string"==typeof t||"number"==typeof t)try{return Boolean(new R.IpAddress(t))}catch(e){return!1}return!1;case"string":return"string"==typeof t&&null!==(n=e.esTypes)&&void 0!==n&&n.includes(oe.a.VERSION)?Boolean(se()(t)):"string"==typeof t&&t.trim().length>0;case"boolean":return"boolean"==typeof t;case"number":return"number"==typeof t||"string"==typeof t&&!isNaN(parseFloat(t));default:return!0}}const ce=u.i18n.translate("xpack.securitySolution.markdown.insight.label",{defaultMessage:"Label"}),ue=u.i18n.translate("xpack.securitySolution.markdown.insight.title",{defaultMessage:"Investigate"}),de=u.i18n.translate("xpack.securitySolution.markdown.insight.labelText",{defaultMessage:"Label on the query button."}),pe=u.i18n.translate("xpack.securitySolution.markdown.insight.description",{defaultMessage:"Description"}),me=u.i18n.translate("xpack.securitySolution.markdown.insight.descriptionText",{defaultMessage:"Additional description of the query."}),be=u.i18n.translate("xpack.securitySolution.markdown.insight.formDescription",{defaultMessage:"Create a query to investigate an alert in Timeline, using a clickable query button in the investigation guide. The button also displays a count of matching documents."}),ge=u.i18n.translate("xpack.securitySolution.markdown.insight.filterBuilder",{defaultMessage:"Filters"}),fe=u.i18n.translate("xpack.securitySolution.markdown.insight.filterBuilderText",{defaultMessage:"Create filters to populate the Timeline query builder. To use a value from the alert document, enter the field name in double braces {example} as a custom option in the value field.",values:{example:"{{kibana.alert.example}}"}}),ye=u.i18n.translate("xpack.securitySolution.markdown.insight.relativeTimerange",{defaultMessage:"Relative time range"}),he=u.i18n.translate("xpack.securitySolution.markdown.insight.relativeTimerangeText",{defaultMessage:"Select a time range to limit the query, relative to the alert's creation time (optional)."}),ve=u.i18n.translate("xpack.securitySolution.markdown.insight.modalCancelButtonLabel",{defaultMessage:"Cancel"}),Ee=u.i18n.translate("xpack.securitySolution.markdownEditor.plugins.insightProviderError",{defaultMessage:"Unable to parse insight provider configuration"}),xe="!{investigate",je=({label:e,description:t,providers:a,relativeFrom:i,relativeTo:r})=>{const{addError:l}=Object(P.a)();let c=[];try{void 0!==a&&(c=JSON.parse(a))}catch(e){l(e,{title:Ee})}const{data:u,timestamp:d}=Object(s.useContext)(k.a),{dataProviders:p,filters:m}=K({providers:c,alertData:u}),b=Object(s.useMemo)((()=>{if(i&&r){const e=d?_()(d):_()();return{kind:"absolute",from:Object(J.e)(i,J.a,!1,_.a,e.toDate()).toISOString(),to:Object(J.e)(r,J.b,!0,_.a,e.toDate()).toISOString()}}return null}),[i,r,d]),{totalCount:g,isQueryLoading:f,oldestTimestamp:h,hasError:v}=(({dataProviders:e,filters:t,relativeTimerange:a})=>{const{uiSettings:n}=Object(y.j)().services,i=Object(s.useMemo)((()=>Object(R.getEsQueryConfig)(n)),[n]),{browserFields:r,selectedPatterns:o,indexPattern:l,dataViewId:c}=Object(z.d)($.SourcererScopeName.timeline),[u,d]=Object(s.useState)(!1),p=Object(s.useMemo)((()=>{try{if(!1===u)return Object(B.d)({config:i,dataProviders:e,indexPattern:l,browserFields:r,filters:t,kqlQuery:{query:"",language:"kuery"},kqlMode:"filter"})}catch(e){return d(!0),null}}),[r,e,i,u,l,t]),[m,{events:b,totalCount:g}]=Object(q.a)({dataViewId:c,fields:["*"],filterQuery:null==p?void 0:p.filterQuery,id:L.c.active,indexNames:o,language:"kuery",limit:1,runtimeMappings:{},...a?{startDate:null==a?void 0:a.from,endDate:null==a?void 0:a.to}:{}}),[f]=b,h=f&&f.data&&f.data.find((e=>"@timestamp"===e.field));return{isQueryLoading:m,totalCount:g,oldestTimestamp:h&&h.value&&h.value[0],hasError:u}})({dataProviders:p,filters:m,relativeTimerange:b}),E=Object(s.useMemo)((()=>{if(b)return b;if(null!=h)return{kind:"absolute",from:h,to:(new Date).toISOString()};{const{to:e,from:t,fromStr:a,toStr:n}=Object(J.d)();return{kind:"relative",to:e,from:t,fromStr:a,toStr:n}}}),[h,b]);return f?o.a.createElement(n.EuiLoadingSpinner,null):o.a.createElement(o.a.Fragment,null,o.a.createElement(Y.a,{asEmptyButton:!1,isDisabled:v,dataProviders:p,filters:m,timeRange:E,keepDataView:!0,"data-test-subj":"insight-investigate-in-timeline-button"},o.a.createElement(n.EuiIcon,{type:"timeline"}),` ${e} (${A()(g).format("0,0.[000]a")})`),o.a.createElement("div",null,t))},Se=({node:e,onSave:t,onCancel:a})=>{const i=null!=e,{sourcererDataView:u,indexPattern:d}=Object(z.d)($.SourcererScopeName.default),{unifiedSearch:{ui:{FiltersBuilderLazy:m}},uiSettings:b,fieldFormats:g}=Object(y.j)().services,f=Object(s.useMemo)((()=>null!=u?new D.DataView({spec:u,fieldFormats:g}):null),[u,g]),[h,v]=Object(s.useState)([[]]),E=Object(s.useMemo)((()=>[{value:"0",text:""},...b.get(X.V).map((({display:e},t)=>({value:String(t),text:e})))]),[b]),x=Object(r.useForm)({defaultValues:{label:null==e?void 0:e.label,description:null==e?void 0:e.description,relativeTimerange:(null==e?void 0:e.relativeTimerange)||"0"},shouldUnregister:!0}),j=Object(r.useController)({name:"label",control:x.control}),S=Object(r.useController)({name:"description",control:x.control}),k=Object(r.useController)({name:"relativeTimerange",control:x.control}),O=Object(s.useCallback)((e=>{const t=E.find((t=>t.value===e));if(t&&"0"!==t.value){const e=Number(t.value),a=b.get(X.V);return{relativeFrom:a[e].from,relativeTo:a[e].to}}return{}}),[E,b]),w=Object(s.useCallback)((()=>{t(`${xe}${JSON.stringify(Object(l.pickBy)({label:j.field.value,description:S.field.value,providers:h,...O(k.field.value)},(e=>!Object(l.isEmpty)(e))))}}`,{block:!0})}),[t,h,j.field.value,S.field.value,k.field.value,O]),T=Object(s.useCallback)((e=>{v(te(e))}),[]),I=Object(s.useCallback)((e=>{k.field.onChange(e.target.value)}),[k.field]),C=Object(s.useMemo)((()=>{var e;const t=null!==(e=j.field.value)&&void 0!==e?e:"",a=h.flat();return""===t.trim()||0===a.length||a.some((e=>!function(e,t){if(!t||!e.field)return!1;switch(e.queryType){case"phrase":return le(t,e.value,e.valueType);case"phrases":const a="string"==typeof e.value?JSON.parse(`${e.value}`):null;return!(!Array.isArray(a)||!a.length)&&a.every((a=>le(t,a,e.valueType)));case"range":const n=JSON.parse("string"==typeof e.value?e.value:"");return"object"==typeof n&&(!n.gte||le(t,n.gte,e.valueType))&&(!n.lt||le(t,n.lt,e.valueType));case"exists":return!0;default:throw new Error(`Unknown operator type: ${e.queryType}`)}}(e,null==f?void 0:f.getFieldByName(e.field))))}),[j.field.value,h,f]),M=Object(s.useMemo)((()=>{const e=d&&d.getName?d.getName():"*";return[{$state:{store:N.FilterStateStore.APP_STATE},meta:{disabled:!1,negate:!1,alias:null,index:e}}]}),[d]),_=Object(ae.b)().isAtLeast("platinum");return o.a.createElement(o.a.Fragment,null,o.a.createElement(we,null,o.a.createElement(n.EuiModalHeaderTitle,null,o.a.createElement(n.EuiFlexGroup,{gutterSize:"s"},o.a.createElement(n.EuiFlexItem,null,i?o.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.markdown.insight.editModalTitle",defaultMessage:"Edit investigation query"}):o.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.markdown.insight.addModalTitle",defaultMessage:"Add investigation query"}))))),!1===_&&o.a.createElement(n.EuiCallOut,{title:"To add suggested queries to an investigation guide, please upgrade to platinum",iconType:"timeline"}),o.a.createElement(n.EuiModalBody,null,o.a.createElement(r.FormProvider,x,o.a.createElement(n.EuiForm,{fullWidth:!0},o.a.createElement(n.EuiFormRow,{label:be,fullWidth:!0},o.a.createElement(o.a.Fragment,null)),o.a.createElement(n.EuiFormRow,{label:ce,helpText:de,isInvalid:void 0!==j.field.value&&0===j.field.value.trim().length,fullWidth:!0},o.a.createElement(n.EuiFieldText,p()({},x.register("label"),{ref:null,name:"label",onChange:j.field.onChange}))),o.a.createElement(n.EuiFormRow,{label:pe,helpText:me,fullWidth:!0},o.a.createElement(n.EuiFieldText,p()({},x.register("description"),{ref:null,name:"description",onChange:S.field.onChange}))),o.a.createElement(n.EuiFormRow,{label:ge,helpText:fe,fullWidth:!0},f?o.a.createElement(m,{filters:M,onChange:T,dataView:f,maxDepth:1}):o.a.createElement(o.a.Fragment,null)),o.a.createElement(n.EuiFormRow,{label:ye,helpText:he,fullWidth:!0},o.a.createElement(n.EuiSelect,p()({},x.register("relativeTimerange"),{ref:null,onChange:I,options:E})))))),o.a.createElement(n.EuiModalFooter,null,o.a.createElement(n.EuiButtonEmpty,{onClick:a},ve),o.a.createElement(n.EuiButton,{onClick:x.handleSubmit(w),fill:!0,disabled:C},i?o.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.markdown.insight.addModalConfirmButtonLabel",defaultMessage:"Add query"}):o.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.markdown.insight.editModalConfirmButtonLabel",defaultMessage:"Save changes"}))))},ke=o.a.memo(Se),Oe=`${xe}{\n  "label": "Test action",\n  "description": "Click to investigate",\n  "providers": [\n    [\n      {"field": "event.id", "value": "{{kibana.alert.original_event.id}}", "queryType": "phrase", "excluded": "false"}\n    ],\n    [\n      {"field": "event.action", "value": "", "queryType": "exists", "excluded": "false"},\n      {"field": "process.pid", "value": "{{process.pid}}", "queryType": "phrase", "excluded":"false"}\n    ]\n  ]\n}}`;var we=S()(n.EuiModalHeader).withConfig({displayName:"_StyledEuiModalHeader",componentId:"sc-1kbgjgu-0"})(["min-width:700px;"]);const{uiPlugins:Te,parsingPlugins:Ie,processingPlugins:Ce}={uiPlugins:Object(n.getDefaultEuiMarkdownUiPlugins)(),parsingPlugins:Object(n.getDefaultEuiMarkdownParsingPlugins)(),processingPlugins:Object(n.getDefaultEuiMarkdownProcessingPlugins)()},Me=[xe],_e=({insightsUpsellingMessage:e})=>{const t=Te.map((e=>e.name)),a=(({insightsUpsellingMessage:e})=>({name:"insights",button:{label:null!=e?e:ue,iconType:"timelineWithArrow",isDisabled:!!e},helpText:o.a.createElement("div",null,o.a.createElement(n.EuiCodeBlock,{language:"md",fontSize:"l",paddingSize:"s",isCopyable:!0},Oe),o.a.createElement(n.EuiSpacer,{size:"s"})),editor:ke}))({insightsUpsellingMessage:e});if(!1===t.includes(a.name))Te.push(i.b),Te.push(E),Te.push(a);else{const e=Te.findIndex((e=>e.name===a.name));Te[e]=a}return Te};Ie.push((function(){const e=this.Parser,t=e.prototype.inlineTokenizers,a=e.prototype.inlineMethods,n=function(e,t,a){if(!1===t.startsWith(xe))return!1;const n=t[xe.length];if("{"!==n&&"}"!==n)return!1;if(a)return!0;let i={};if("{"===n){let a="",n=0;for(let e=xe.length;e<t.length;e++){const i=t[e];if("{"===i)n++,a+=i;else if("}"===i){if(n--,-1===n)break;a+=i}else a+=i}try{return i=JSON.parse(a),e(t)({type:"insight",...i,providers:JSON.stringify(i.providers)})}catch(t){const a=e.now();this.file.fail((e=>u.i18n.translate("xpack.securitySolution.markdownEditor.plugins.insightConfigError",{values:{err:e},defaultMessage:"Unable to parse insight JSON configuration: {err}"}))(t),{line:a.line,column:a.column+xe.length})}}return!1};n.locator=(e,t)=>e.indexOf(xe,t),t.insight=n,a.splice(a.indexOf("text"),0,"insight")})),Ie.push(i.a),Ie.push(x.a),Ce[1][1].components.insight=({label:e,description:t,providers:a,relativeFrom:i,relativeTo:r})=>!1===Object(ae.b)().isPlatinumPlus()?o.a.createElement(o.a.Fragment,null,o.a.createElement(n.EuiButton,{isDisabled:!0,iconSide:"left",iconType:"timeline","data-test-subj":"insight-investigate-in-timeline-button"},`${e}`),o.a.createElement("div",null,t)):o.a.createElement(je,{label:e,description:t,providers:a,relativeFrom:i,relativeTo:r}),Ce[1][1].components.timeline=i.c,Ce[1][1].components.osquery=({configuration:e})=>{var t;const[a,n]=Object(s.useState)(!1),{agentId:i,alertId:r,data:c}=Object(s.useContext)(k.a),d=Object(s.useCallback)((()=>n(!0)),[n]),p=Object(s.useCallback)((()=>n(!1)),[n]),m=Object(s.useMemo)((()=>{const e=Object(l.reduce)(c,((e,t)=>{var a;return{...e,[t.field]:null==t||null===(a=t.values)||void 0===a?void 0:a[0]}}),{});return Object(O.a)(e)}),[c]);return o.a.createElement(o.a.Fragment,null,o.a.createElement(C,{iconType:T.a,onClick:d},null!==(t=e.label)&&void 0!==t?t:u.i18n.translate("xpack.securitySolution.markdown.osquery.runOsqueryButtonLabel",{defaultMessage:"Run Osquery"})),a&&o.a.createElement(I.a,{defaultValues:{...r?{alertIds:[r]}:{},query:e.query,ecs_mapping:e.ecs_mapping,queryField:!1},agentId:i,onClose:p,ecsData:m}))}},function(e,t,a){"use strict";a.d(t,"b",(function(){return k})),a.d(t,"a",(function(){return O})),a.d(t,"c",(function(){return w}));var n=a(42),i=a(129);let r,s;var o,l;!function(e){e.MALICIOUS_FILE="malicious_file",e.RANSOMWARE="ransomware",e.MEMORY_SIGNATURE="memory_signature",e.SHELLCODE_THREAD="shellcode_thread",e.BEHAVIOR="behavior"}(r||(r={})),function(e){e.PROCESS="process",e.FILE="file",e.NETWORK="network",e.REGISTRY="registry",e.MALWARE="malware"}(s||(s={})),o="host",l={"os.platform":"os.platform","os.name":"os.name","os.full":"os.full","os.family":"os.family","os.version":"os.version","os.kernel":"os.kernel"},Object.entries(l).reduce(((e,[t,a])=>(e[`${o}.${t}`]=`${o}.${a}`,e)),{});var c=a(155),u=a(135),d=a(563),p=a(188),m=a(217),b=a(319);const g=`${d.h}.terms.field`,f=`${d.h}.terms.value`,y=`${d.h}.cardinality.field`,h=`${d.h}.cardinality.value`,v=`${d.h}.count`,E=[{id:"host.name"},{id:"agent.id",overrideField:p.a,label:c.b},{id:"user.name"},{id:"rule.name"},{id:"cloud.provider"},{id:"cloud.region"},{id:"cloud.provider"},{id:"cloud.region"},{id:"orchestrator.cluster.id"},{id:"orchestrator.cluster.name"},{id:"container.image.name"},{id:"container.image.tag"},{id:"orchestrator.namespace"},{id:"orchestrator.resource.parent.type"},{id:"orchestrator.resource.type"},{id:"process.executable"},{id:"file.path"},{id:i.O,label:c.z}];function x({primaryEventCategory:e,allEventCategories:t}){switch(e){case s.PROCESS:return[{id:"process.name"},{id:"process.parent.name"},{id:"process.args"}];case s.FILE:return[{id:"file.name"},{id:"file.hash.sha256"},{id:"file.directory"},{id:"process.name"}];case s.NETWORK:return[{id:"destination.address"},{id:"destination.port"},{id:"source.address"},{id:"source.port"},{id:"dns.question.name"},{id:"process.name"}];case s.REGISTRY:return[{id:"registry.key"},{id:"registry.value"},{id:"process.name"}];case s.MALWARE:return x({primaryEventCategory:s.FILE,allEventCategories:t});default:let e=[];return null!=t&&t.includes(s.FILE)&&(e=e.concat(x({primaryEventCategory:s.FILE}))),null!=t&&t.includes(s.PROCESS)&&(e=e.concat(x({primaryEventCategory:s.PROCESS}))),e}}function j(e,t){switch(e){case r.BEHAVIOR:return[{id:"rule.description",label:u.q},...x({...t,primaryEventCategory:void 0})];case r.SHELLCODE_THREAD:return[{id:"Target.process.executable"},{id:"Memory_protection.unique_key_v1"}];case r.RANSOMWARE:return[{id:"Ransomware.feature"},{id:"process.hash.sha256"},...x({...t,primaryEventCategory:void 0})];case r.MEMORY_SIGNATURE:return x({...t,primaryEventCategory:void 0});case r.MALICIOUS_FILE:return[{id:"file.Ext.quarantine_path",overrideField:p.j,label:c.x}];default:return[]}}function S(e){switch(e){case"threshold":return[{id:v,label:u.u},{id:g,overrideField:f,label:u.v},{id:y,label:u.t}];case"machine_learning":return[{id:`${i.G}.machine_learning_job_id`,legacyId:"signal.rule.machine_learning_job_id"},{id:`${i.G}.anomaly_threshold`,legacyId:"signal.rule.anomaly_threshold"}];case"threat_match":return[{id:`${i.G}.threat_index`,legacyId:"signal.rule.threat_index"},{id:`${i.G}.threat_query`,legacyId:"signal.rule.threat_query"}];case"new_terms":return[{id:d.c,label:u.m},{id:d.b,label:u.l}];default:return[]}}function k({eventCategories:e,eventCode:t,eventRuleType:a,highlightedFieldsOverride:i}){const r=[...(s=i,s.map((e=>({id:e})))),...E,...x(e),...j(t,e),...S(a)];var s;return Object(n.uniqBy)("id",r)}function O(e){const t=Object(n.find)({category:"event",field:"event.category"},e);let a,i;return Array.isArray(null==t?void 0:t.originalValue)?(a=null==t?void 0:t.originalValue[0],i=null==t?void 0:t.originalValue):(a=null==t?void 0:t.originalValue,a&&(i=[a])),{primaryEventCategory:a,allEventCategories:i}}const w=({data:e,browserFields:t,scopeId:a,eventId:r,isDraggable:s=!1,isReadOnly:o=!1,investigationFields:l})=>{var c,d;const p=O(e),v=Object(n.find)({category:"event",field:"event.code"},e),x=Array.isArray(null==v?void 0:v.originalValue)?null==v||null===(c=v.originalValue)||void 0===c?void 0:c[0]:null==v?void 0:v.originalValue,j=Object(n.find)({category:"kibana",field:i.O},e),S=k({eventCategories:p,eventCode:x,eventRuleType:Array.isArray(null==j?void 0:j.originalValue)?null==j||null===(d=j.originalValue)||void 0===d?void 0:d[0]:null==j?void 0:j.originalValue,highlightedFieldsOverride:null!=l?l:[]});return null!=e?S.reduce(((i,l)=>{var c;const d=e.find((e=>e.field===l.id||l.legacyId&&e.field===l.legacyId));if(!d||Object(n.isEmpty)(d.values))return i;d.field===l.legacyId&&(l.id=l.legacyId);const p=null!=l.linkField&&e.find((e=>e.field===l.linkField)),v={...Object(m.b)({item:d,linkValueField:p||void 0,contextId:a,scopeId:a,browserFields:t,eventId:r,field:l}),isDraggable:s,isReadOnly:o};if("agent.id"===l.id&&!Object(b.b)({data:e}))return i;if(l.id===g){const t=function({values:e},t,a){const n=t.find((e=>e.field===f)),i=n&&n.values;if(Array.isArray(e)&&e.length>0&&Array.isArray(i)&&e.length===i.length)return e.map(((e,t)=>({title:e,description:{...a,values:[i[t]]}}))).filter((e=>!E.map((e=>e.id)).includes(e.title)))}(d,e,v);return t?[...i,...t]:i}if(l.id===y){const t=function({values:e},t,a){const n=t.find((e=>e.field===h)),i=n&&n.values;if(Array.isArray(e)&&1===e.length&&Array.isArray(i)&&e.length===i.length)return{title:u.t,description:{...a,values:[`count(${e[0]}) >= ${i[0]}`]}}}(d,e,v);return t?[...i,t]:i}return[...i,{title:null!==(c=l.label)&&void 0!==c?c:l.id,description:v}]}),[]):[]}},function(e,t,a){"use strict";a.d(t,"a",(function(){return ae}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(42),c=a(47),u=a(49),d=a(51),p=a(134),m=a(4),b=a(153),g=a(166),f=a(233),y=a(232),h=a(169),v=a(456),E=a(149),x=a(645),j=a(102),S=a(919),k=a(57),O=a(297),w=a(293),T=a(228),I=a(424),C=a(327);const M=r.a.memo((({chartHeight:e=174,data:t,from:a,legendItems:s,legendPosition:o=k.Position.Right,legendMinWidth:l,loading:c,showLegend:u,to:d,updateDateRange:p})=>{const{baseTheme:m,theme:b}=Object(O.i)(),g=Object(i.useMemo)((()=>["100%",e]),[e]),f=Object(i.useMemo)((()=>["y"]),[]),y=Object(i.useMemo)((()=>[e=>Object(T.a)(e.g)?e.g:C.c]),[]),h=Object(i.useMemo)((()=>Object(w.a)([a,d])),[a,d]);return r.a.createElement(r.a.Fragment,null,c&&r.a.createElement(n.EuiProgress,{"data-test-subj":"loadingPanelAlertsHistogram",size:"xs",position:"absolute",color:"accent"}),r.a.createElement(n.EuiFlexGroup,{gutterSize:"none"},r.a.createElement(n.EuiFlexItem,{grow:!0},r.a.createElement(k.Chart,{size:g},r.a.createElement(k.Settings,{legendPosition:o,onBrushEnd:p,showLegend:u&&0===s.length,showLegendExtra:u,theme:b,baseTheme:m}),r.a.createElement(k.Axis,{id:"alertsHistogramAxisX",position:k.Position.Bottom,tickFormat:h}),r.a.createElement(k.Axis,{id:"alertsHistogramAxisY",position:k.Position.Left}),r.a.createElement(k.HistogramBarSeries,{id:"alertsHistogram",xScaleType:k.ScaleType.Time,yScaleType:k.ScaleType.Linear,xAccessor:"x",yAccessors:f,splitSeriesAccessors:y,data:t}))),r.a.createElement(n.EuiFlexItem,{grow:!1},s.length>0&&r.a.createElement(I.a,{legendItems:s,height:e,minWidth:l}))))}));M.displayName="AlertsHistogram";var _=a(5);const F=_.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.headerTitle",{defaultMessage:"Trend"}),A=_.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.notAvailableTooltip",{defaultMessage:"Not available for trend view"}),D=_.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.viewAlertsButtonLabel",{defaultMessage:"View alerts"}),N=(e,t,a)=>_.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.showingAlertsTitle",{values:{totalAlertsFormatted:e,totalAlerts:t,modifier:a},defaultMessage:"Showing: {modifier}{totalAlertsFormatted} {totalAlerts, plural, =1 {alert} other {alerts}}"});var P=a(123),R=a(131),L=a(521),B=a(646),q=a(391),z=a(177),$=a(483),V=a(124);const U=Object(c.v4)(),H=(e="kibana.alert.rule.name",t)=>({title:"Alerts",description:"",visualizationType:"lnsXY",state:{visualization:{title:"Empty XY chart",legend:{isVisible:!0,position:"right",legendSize:"xlarge"},valueLabels:"hide",preferredSeriesType:"bar_stacked",layers:[{layerId:U,accessors:["e09e0380-0740-4105-becc-0a4ca12e3944"],position:"top",seriesType:"bar_stacked",showGridlines:!1,layerType:"data",xAccessor:"aac9d7d0-13a3-480a-892b-08207a787926",splitAccessor:"34919782-4546-43a5-b668-06ac934d3acd"}],yRightExtent:{mode:"full"},yLeftExtent:{mode:"full"},axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},valuesInLegend:!0},query:{query:"",language:"kuery"},filters:null!=t&&t.filters?t.filters:[],datasourceStates:{formBased:{layers:{[U]:{columns:{"aac9d7d0-13a3-480a-892b-08207a787926":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto"}},"e09e0380-0740-4105-becc-0a4ca12e3944":{label:"Count of records",dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___"},"34919782-4546-43a5-b668-06ac934d3acd":{label:`Top values of ${e}`,dataType:"string",operationType:"terms",scale:"ordinal",sourceField:e,isBucketed:!0,params:{size:1e3,orderBy:{type:"column",columnId:"e09e0380-0740-4105-becc-0a4ca12e3944"},orderDirection:"desc",otherBucket:!0,missingBucket:!1,parentFormat:{id:"terms"},secondaryFields:[]}}},columnOrder:["34919782-4546-43a5-b668-06ac934d3acd","aac9d7d0-13a3-480a-892b-08207a787926","e09e0380-0740-4105-becc-0a4ca12e3944"],incompleteColumns:{}}}}},internalReferences:[],adHocDataViews:{}},references:[{type:"index-pattern",id:"{dataViewId}",name:`indexpattern-datasource-layer-${U}`}]});var G=a(110),Q=a(403),W=a(55),K=a.n(W),Y=a(413);const J={value:0,relation:"eq"},X="detections-histogram",Z=o()(n.EuiFlexItem).withConfig({displayName:"ViewAlertsFlexItem",componentId:"sc-tvqkga-0"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeL)),ee=o()(n.EuiFlexItem).withConfig({displayName:"OptionsFlexItem",componentId:"sc-tvqkga-1"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeS)),te=[],ae=Object(i.memo)((({alignHeader:e,chartHeight:t=155,chartOptionsContextMenu:a,combinedQueries:s,comboboxRef:o,defaultStackByOption:k=L.a,extraActions:O,filters:w,headerChildren:T,inspectTitle:I,legendPosition:C="right",onFieldSelected:U,onlyField:W,paddingSize:ae="m",panelHeight:ne=L.d,query:ie,runtimeMappings:re,setComboboxInputRef:se,showCountsInLegend:oe=!1,showGroupByPlaceholder:le=!1,showLegend:ce=!0,showLinkToAlerts:ue=!1,showStackBy:de=!0,showTotalAlertsCount:pe=!1,signalIndexName:me,stackByLabel:be,stackByWidth:ge,timelineId:fe,title:ye=F,titleSize:he="m",updateDateRange:ve,hideQueryToggle:Ee=!1,isExpanded:xe,setIsExpanded:je})=>{var Se;const{to:ke,from:Oe,deleteQuery:we,setQuery:Te}=Object(p.a)(),Ie=Object(i.useMemo)((()=>`${X}-${Object(c.v4)()}`),[]),Ce=`alerts-trend-embeddable-${Ie}`,[Me,_e]=Object(i.useState)(!0),[Fe,Ae]=Object(i.useState)(!1),[De,Ne]=Object(i.useState)(J),[Pe,Re]=Object(i.useState)(null==W?k:W),Le=Object(V.a)("chartEmbeddablesEnabled"),Be=Object(V.a)("alertsPageChartsEnabled"),qe=Object(i.useCallback)((e=>{Re(e),null!=U&&U(e)}),[U]);Object(i.useEffect)((()=>{Re(null==W?k:W)}),[k,W]);const{toggleStatus:ze,setToggleStatus:$e}=Object(z.a)(X),Ve=Object(i.useCallback)((e=>{Be&&void 0!==je?je(e):$e(e)}),[$e,je,Be]),Ue=Object(i.useMemo)((()=>Be&&void 0!==je?!xe:!ze),[Be,je,xe,ze]),He=Object(i.useMemo)((()=>({from:Oe,to:ke})),[Oe,ke]),{loading:Ge,data:Qe,setQuery:We,response:Ke,request:Ye,refetch:Je}=Object(f.a)({query:Object(S.d)(Pe,Oe,ke,Object(S.a)(s),re),indexName:me,skip:Ue||Le,queryName:y.a.HISTOGRAM}),Xe=Object(j.j)(),{navigateToApp:Ze}=Xe.services.application,{formatUrl:et,search:tt}=Object(h.m)(R.a.alerts),at=(({totalAlertsObj:e,visualizationId:t,isChartEmbeddablesEnabled:a})=>{const[n]=Object(j.p)(m.O),r=Object(Y.a)({visualizationId:t}),s=Object(i.useMemo)((()=>N(K()(e.value).format(n),e.value,"gte"===e.relation?">":"lte"===e.relation?"<":"")),[e.value,e.relation,n]),o=Object(i.useMemo)((()=>{const e=null!=r?r[0].hits.total:0;return N(K()(e).format(n),e,"")}),[n,r]);return a?o:s})({totalAlertsObj:De,visualizationId:Ce,isChartEmbeddablesEnabled:Le}),nt=Object(i.useCallback)((e=>{e.preventDefault(),Ze(m.l,{deepLinkId:R.a.alerts,path:Object(h.d)(tt)})}),[Ze,tt]),it=Object(i.useMemo)((()=>Object(S.c)(Qe)),[Qe]),rt=Object(i.useMemo)((()=>{var e,t;return ce&&null!=(null==Qe||null===(e=Qe.aggregations)||void 0===e||null===(t=e.alertsByGrouping)||void 0===t?void 0:t.buckets)?Qe.aggregations.alertsByGrouping.buckets.map(((e,t)=>{var a;return{color:t<v.a.length?v.a[t]:void 0,count:oe?e.doc_count:void 0,dataProviderId:Object(b.i)(`draggable-legend-item-${Object(c.v4)()}-${Pe}-${e.key}`),field:Pe,timelineId:fe,value:null!==(a=null==e?void 0:e.key_as_string)&&void 0!==a?a:e.key}})):te}),[null==Qe||null===(Se=Qe.aggregations)||void 0===Se?void 0:Se.alertsByGrouping.buckets,Pe,oe,ce,fe]);Object(i.useEffect)((()=>{let e=!1;return e||Object(S.f)({isInitialLoading:Me,isLoadingAlerts:Ge})||_e(!1),()=>{e=!0}}),[Me,Ge,_e]),Object(q.a)({deleteQuery:we,loading:Ge,refetch:Je,request:Ye,response:Ke,setQuery:Te,uniqueQueryId:Ie}),Object(i.useEffect)((()=>{var e;Ne(null!==(e=null==Qe?void 0:Qe.hits.total)&&void 0!==e?e:{value:0,relation:"eq"})}),[Qe]),Object(i.useEffect)((()=>{try{let t=null;var e;t=null!=s?Object(S.e)(s):Object(u.buildEsQuery)(void 0,null!=ie?[ie]:[],null!==(e=null==w?void 0:w.filter((e=>!1===e.meta.disabled)))&&void 0!==e?e:[],{...Object(d.getEsQueryConfig)(Xe.services.uiSettings),dateFormatTZ:void 0}),Ae(!1),We(Object(S.d)(Pe,Oe,ke,Object(l.isEmpty)(t)?[]:[t],re))}catch(e){Ae(!0),We(Object(S.d)(Pe,Oe,ke,[],re))}}),[Pe,Oe,ke,ie,w,s,re]);const st=Object(i.useMemo)((()=>{if(ue)return r.a.createElement(Z,{grow:!1},r.a.createElement(P.g,{"data-test-subj":"alerts-histogram-panel-go-to-alerts-page",onClick:nt,href:et(Object(h.d)())},D))}),[ue,nt,et]),ot=Object(i.useMemo)((()=>{return null==W?ye:(e=W,_.i18n.translate("xpack.securitySolution.detectionEngine.alerts.histogram.topNLabel",{values:{fieldName:e},defaultMessage:"Top {fieldName}"}));var e}),[W,ye]),lt=Object(i.useMemo)((()=>Be&&void 0!==xe?xe:ze),[Be,xe,ze]);return r.a.createElement(E.c,{show:!Me&&lt},r.a.createElement(B.a,{height:ne,hasBorder:!0,paddingSize:ae,"data-test-subj":"alerts-histogram-panel",$toggleStatus:lt},r.a.createElement(g.a,{alignHeader:e,id:Ie,inspectTitle:I,outerDirection:"column",title:ot,titleSize:he,toggleStatus:lt,toggleQuery:Ee?void 0:Ve,showInspectButton:!Le&&null==a,subtitle:!Me&&pe&&at,isInspectDisabled:Fe},r.a.createElement(n.EuiFlexGroup,{alignItems:"flexStart","data-test-subj":"panelFlexGroup",gutterSize:"none"},r.a.createElement(n.EuiFlexItem,{grow:!1},de&&r.a.createElement(r.a.Fragment,null,r.a.createElement(B.b,{"data-test-subj":"stackByComboBox",inputRef:se,onSelect:qe,prepend:be,ref:o,selected:Pe,useLensCompatibleFields:Le,width:ge}),le&&r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiSpacer,{"data-test-subj":"placeholderSpacer",size:"s"}),r.a.createElement(n.EuiToolTip,{"data-test-subj":"placeholderTooltip",content:A},r.a.createElement(B.b,{"data-test-subj":"stackByPlaceholder",isDisabled:!0,onSelect:l.noop,prepend:$.b,selected:"",useLensCompatibleFields:Le,width:ge})))),null!=T&&T),null!=a&&!Le&&r.a.createElement(ee,{grow:!1},a(Ie)),st)),lt?Le?r.a.createElement(Q.a,{"data-test-subj":"embeddable-matrix-histogram",extraActions:O,extraOptions:{filters:w},getLensAttributes:H,height:null!=t?t:155,id:Ce,inspectTitle:null!=I?I:ye,scopeId:G.SourcererScopeName.detections,stackByField:Pe,timerange:He}):Me?r.a.createElement(x.a,null):r.a.createElement(M,{chartHeight:t,data:it,from:Oe,legendItems:rt,legendPosition:C,legendMinWidth:oe?300:void 0,loading:Ge,to:ke,showLegend:ce,updateDateRange:ve}):null))}));ae.displayName="AlertsHistogramPanel"},function(e,t,a){"use strict";a.d(t,"a",(function(){return O}));var n=a(40),i=a(2),r=a.n(i),s=a(103),o=a(126),l=a(118),c=a(105),u=a(111),d=a(139),p=a(42),m=a(246),b=a.n(m),g=a(125),f=a(106),y=a(242),h=a(248),v=a(560);const E={title:{type:g.a.TEXT,validations:[{validator:g.h.emptyField("")}]},description:{type:g.a.TEXTAREA,validations:[]}};var x=a(159),j=a(196);const S=Object(g.j)({component:g.b}),k=r.a.memo((({closeSaveTimeline:e,initialFocus:t,timelineId:a,showWarning:o})=>{const{startTransaction:d}=Object(x.b)(),m=Object(i.useMemo)((()=>u.b.getTimelineByIdSelector()),[]),{isSaving:k,description:O="",status:w,title:T="",timelineType:I}=Object(c.a)((e=>Object(p.pick)(["isSaving","description","status","title","timelineType"],m(e,a)))),C=b()(k),M=Object(s.useDispatch)(),_=Object(y.a)({timelineId:l.c.active,timelineType:f.l.default}),F=Object(i.useCallback)(((e,t)=>(t&&M(u.a.updateTitleAndDescription({id:a,...e})),Promise.resolve())),[M,a]),A=Object(i.useMemo)((()=>({title:T,description:O})),[T,O]),{form:D}=Object(g.k)({id:"timelineTitleAndDescriptionForm",schema:E,onSubmit:F,options:{stripEmptyFields:!1},defaultValue:A}),{isSubmitted:N,isSubmitting:P,submit:R}=D,L=Object(i.useCallback)((()=>{d({name:j.f.SAVE}),R()}),[R,d]),B=Object(i.useCallback)((()=>{o&&_(),e()}),[e,_,o]),q=Object(i.useMemo)((()=>w===f.k.draft&&o?I===f.l.template?v.e:v.d:v.c),[o,w,I]),z=Object(i.useMemo)((()=>w===f.k.draft?I===f.l.template?v.l:v.k:I===f.l.template?v.h:v.g),[w,I]),$=Object(i.useMemo)((()=>w===f.k.draft&&o?I===f.l.template?v.l:v.k:v.j),[o,w,I]),V=Object(i.useMemo)((()=>v.p(I)),[I]),U=Object(i.useMemo)((()=>`${v.m} (${v.i})`),[]),H=Object(i.useMemo)((()=>({"aria-label":v.n,autoFocus:"title"===t,"data-test-subj":"save-timeline-title",disabled:k,spellCheck:!0,placeholder:I===f.l.template?h.k:h.l})),[t,k,I]),G=Object(i.useMemo)((()=>({"aria-label":v.m,autoFocus:"description"===t,"data-test-subj":"save-timeline-description",disabled:k,placeholder:h.f})),[t,k]);return Object(i.useEffect)((()=>{N&&!k&&C&&e()}),[N,k,C,e]),r.a.createElement(n.EuiModal,{"data-test-subj":"save-timeline-modal",maxWidth:1024,onClose:e},k&&r.a.createElement(n.EuiProgress,{size:"s",color:"primary",position:"absolute","data-test-subj":"progress-bar"}),r.a.createElement(n.EuiModalHeader,{"data-test-subj":"modal-header"},z),r.a.createElement(n.EuiModalBody,null,o&&r.a.createElement(n.EuiFlexItem,{grow:!0},r.a.createElement(n.EuiCallOut,{title:V,color:"danger",iconType:"warning","data-test-subj":"save-timeline-callout"}),r.a.createElement(n.EuiSpacer,{size:"m"})),r.a.createElement(g.c,{form:D},r.a.createElement(n.EuiFlexItem,{grow:!0},r.a.createElement(S,{path:"title",fullWidth:!0,label:v.o,euiFieldProps:H}),r.a.createElement(n.EuiSpacer,null)),r.a.createElement(n.EuiFlexItem,{grow:!0},r.a.createElement(S,{label:U,path:"description",fullWidth:!0,euiFieldProps:G}),r.a.createElement(n.EuiSpacer,null)),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiFlexGroup,{justifyContent:"flexEnd",gutterSize:"s"},r.a.createElement(n.EuiFlexItem,{grow:!1,component:"span"},r.a.createElement(n.EuiButton,{size:"s",fill:!1,onClick:B,isDisabled:k,"data-test-subj":"close-button"},q)),r.a.createElement(n.EuiFlexItem,{grow:!1,component:"span"},r.a.createElement(n.EuiButton,{size:"s",isDisabled:k||P,fill:!0,onClick:L,"data-test-subj":"save-button"},$)))))))}));k.displayName="TimelineTitleAndDescription";const O=r.a.memo((({initialFocus:e,timelineId:t,toolTip:a})=>{const p=Object(s.useDispatch)(),m=Object(i.useMemo)((()=>Object(d.createSelector)(u.b.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.showSaveModal)&&void 0!==t&&t}))),[]),b=Object(c.a)((e=>m(e,t))),[g,f]=Object(i.useState)(!1),y=Object(i.useCallback)((()=>{f(!1),b&&p(u.a.toggleModalSaveTimeline({id:l.c.active,showModalSaveTimeline:!1}))}),[p,f,b]),h=Object(i.useCallback)((()=>{f(!0)}),[f]),{kibanaSecuritySolutionsPrivileges:{crud:E}}=Object(o.a)(),x=Object(i.useMemo)((()=>E?a:v.b),[a,E]),j=Object(i.useMemo)((()=>r.a.createElement(n.EuiButtonIcon,{"aria-label":v.f,isDisabled:!E,onClick:h,iconType:"pencil","data-test-subj":"save-timeline-button-icon"})),[h,E]);return"title"===e&&b||g?r.a.createElement(r.a.Fragment,null,j,r.a.createElement(k,{closeSaveTimeline:y,initialFocus:e,timelineId:t,showWarning:"title"===e&&b})):r.a.createElement(n.EuiToolTip,{content:null!=x?x:"","data-test-subj":"save-timeline-btn-tooltip"},j)}));O.displayName="SaveTimelineButton"},function(e,t,a){"use strict";a.d(t,"b",(function(){return be})),a.d(t,"a",(function(){return he}));var n=a(42),i=a(40),r=a(2),s=a.n(r),o=a(103),l=a(41),c=a.n(l),u=a(59),d=a(111),p=a(133),m=a(190),b=a(110),g=a(941),f=a(106),y=a(105),h=a(302),v=a(148),E=a(268),x=a(104),j=a.n(x),S=(a(21),a(220)),k=a(913),O=a(124),w=a(606),T=a(309),I=a(118),C=a(519),M=a(915),_=a(5);const F=_.i18n.translate("xpack.securitySolution.timeline.tabs.queyTabTimelineTitle",{defaultMessage:"Query"}),A=_.i18n.translate("xpack.securitySolution.timeline.tabs.eqlTabTimelineTitle",{defaultMessage:"Correlation"}),D=_.i18n.translate("xpack.securitySolution.timeline.tabs.analyserTabTimelineTitle",{defaultMessage:"Analyzer"}),N=_.i18n.translate("xpack.securitySolution.timeline.tabs.notesTabTimelineTitle",{defaultMessage:"Notes"}),P=_.i18n.translate("xpack.securitySolution.timeline.tabs.pinnedTabTimelineTitle",{defaultMessage:"Pinned"}),R=_.i18n.translate("xpack.securitySolution.timeline.tabs.securityAssistantTimelineTitle",{defaultMessage:"Elastic AI Assistant"}),L=_.i18n.translate("xpack.securitySolution.timeline.tabs.discoverInTimeline",{defaultMessage:"Discover"}),B=_.i18n.translate("xpack.securitySolution.timeline.tabs.sessionTabTimelineTitle",{defaultMessage:"Session View"});var q=a(17),z=a(640);const $=c.a.div.attrs((({$isVisible:e=!1,isOverflowYScroll:t=!1})=>({style:{display:e?"flex":"none",overflow:t?"hidden scroll":"hidden"}}))).withConfig({displayName:"HideShowContainer",componentId:"sc-1ib7jds-0"})(["flex:1;"]);var V=c()($).withConfig({displayName:"_StyledHideShowContainer",componentId:"sc-1ib7jds-1"})(["overflow:hidden !important;"]);const U=(e,t=s.a.createElement(i.EuiSkeletonText,{lines:10}))=>{var a;const n=s.a.forwardRef(((a,n)=>s.a.createElement(r.Suspense,{fallback:t},s.a.createElement(e,j()({},a,{ref:n})))));return n.displayName=`${null!==(a=e.displayName)&&void 0!==a?a:"Tab"}WithSuspense`,n},H=c.a.div.withConfig({displayName:"AssistantTabContainer",componentId:"sc-1ib7jds-2"})(["overflow-y:auto;width:100%;"]),G=U(Object(r.lazy)((()=>Promise.all([a.e(1),a.e(5),a.e(7),a.e(10),a.e(9),a.e(13),a.e(15),a.e(16),a.e(48)]).then(a.bind(null,1663))))),Q=U(Object(r.lazy)((()=>Promise.all([a.e(1),a.e(5),a.e(7),a.e(10),a.e(9),a.e(13),a.e(15),a.e(16),a.e(45)]).then(a.bind(null,1670))))),W=U(Object(r.lazy)((()=>Promise.all([a.e(1),a.e(5),a.e(7),a.e(10),a.e(9),a.e(13),a.e(46)]).then(a.bind(null,1649))))),K=U(Object(r.lazy)((()=>Promise.all([a.e(1),a.e(5),a.e(7),a.e(10),a.e(9),a.e(13),a.e(41)]).then(a.bind(null,1673))))),Y=U(Object(r.lazy)((()=>Promise.all([a.e(1),a.e(5),a.e(7),a.e(10),a.e(9),a.e(13),a.e(15),a.e(47)]).then(a.bind(null,1650))))),J=U(Object(r.lazy)((()=>Promise.all([a.e(1),a.e(5),a.e(7),a.e(10),a.e(9),a.e(13),a.e(49)]).then(a.bind(null,1651))))),X=U(Object(r.lazy)((()=>a.e(44).then(a.bind(null,1674))))),Z=Object(r.memo)((({isAssistantEnabled:e,renderCellValue:t,rowRenderers:a,timelineId:n,shouldRefocusPrompt:o,setConversationId:l})=>s.a.createElement(r.Suspense,{fallback:s.a.createElement(i.EuiSkeletonText,{lines:10})},s.a.createElement(H,null,s.a.createElement(S.a,{isAssistantEnabled:e,conversationId:z.a,setConversationId:l,shouldRefocusPrompt:o})))));Z.displayName="AssistantTab";const ee=Object(r.memo)((({activeTimelineTab:e,renderCellValue:t,rowRenderers:a,timelineId:n,timelineType:i,setConversationId:o,showTimeline:l})=>{const c=Object(O.a)("discoverInTimeline"),{hasAssistantPrivilege:u,isAssistantEnabled:d}=Object(T.a)(),p=Object(r.useCallback)((e=>{switch(e){case I.d.graph:return s.a.createElement(W,{timelineId:n});case I.d.notes:return s.a.createElement(K,{timelineId:n});case I.d.session:return s.a.createElement(J,{timelineId:n});default:return null}}),[n]),m=Object(r.useMemo)((()=>[I.d.graph,I.d.notes,I.d.session].includes(e)),[e]),{conversations:b}=Object(w.a)(),g=Object(r.useMemo)((()=>b[z.a].messages.length>0),[b]);return s.a.createElement(s.a.Fragment,null,s.a.createElement($,{$isVisible:I.d.query===e,"data-test-subj":`timeline-tab-content-${I.d.query}`},s.a.createElement(G,{renderCellValue:t,rowRenderers:a,timelineId:n})),s.a.createElement($,{$isVisible:I.d.pinned===e,"data-test-subj":`timeline-tab-content-${I.d.pinned}`},s.a.createElement(Y,{renderCellValue:t,rowRenderers:a,timelineId:n})),i===f.l.default&&s.a.createElement($,{$isVisible:I.d.eql===e,"data-test-subj":`timeline-tab-content-${I.d.eql}`},s.a.createElement(Q,{renderCellValue:t,rowRenderers:a,timelineId:n})),s.a.createElement($,{$isVisible:m,isOverflowYScroll:e===I.d.session,"data-test-subj":`timeline-tab-content-${I.d.graph}-${I.d.notes}`},m&&p(e)),u&&s.a.createElement(V,{$isVisible:e===I.d.securityAssistant,isOverflowYScroll:e===I.d.securityAssistant,"data-test-subj":"timeline-tab-content-security-assistant"},(e===I.d.securityAssistant||g)&&s.a.createElement(Z,{isAssistantEnabled:d,renderCellValue:t,rowRenderers:a,timelineId:n,setConversationId:o,shouldRefocusPrompt:l&&e===I.d.securityAssistant})),c&&s.a.createElement($,{$isVisible:I.d.discover===e,"data-test-subj":`timeline-tab-content-${I.d.discover}`},s.a.createElement(X,null)))}));ee.displayName="ActiveTimelineTab";const te=c()(i.EuiBadge).withConfig({displayName:"CountBadge",componentId:"sc-1ib7jds-3"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeS)),ae=c()(i.EuiTab).withConfig({displayName:"StyledEuiTab",componentId:"sc-1ib7jds-4"})([".euiTab__content{display:flex;flex-direction:row;white-space:pre;}:focus{text-decoration:none;> span > span{text-decoration:underline;}}"]),ne=({renderCellValue:e,rowRenderers:t,timelineId:a,timelineFullScreen:l,timelineType:c,graphEventId:u,sessionViewConfig:p,timelineDescription:m})=>{const b=Object(O.a)("discoverInTimeline"),{hasAssistantPrivilege:g}=Object(T.a)(),h=Object(o.useDispatch)(),v=Object(r.useMemo)((()=>Object(M.a)()),[]),E=Object(r.useMemo)((()=>Object(M.g)()),[]),x=Object(r.useMemo)((()=>Object(M.e)()),[]),j=Object(r.useMemo)((()=>Object(M.d)()),[]),S=Object(r.useMemo)((()=>Object(M.c)()),[]),w=Object(r.useMemo)((()=>Object(M.b)()),[]),_=Object(y.b)((e=>v(e,a))),$=Object(y.b)((e=>E(e,a))),V=Object(y.b)((e=>x(e,a))),U=Object(y.a)((e=>S(e,a))),H=Object(y.a)((e=>w(e,a))),G=Object(y.a)((e=>j(e))),Q=Object(q.b)().isEnterprise(),[W,K]=Object(r.useState)(z.a),{reportAssistantInvoked:Y}=Object(k.a)(),J=Object(r.useMemo)((()=>{const e=Object.values(H).reduce(((e,t)=>[...e,...t]),[]);return[...U,...e]}),[U,H]),X=Object(r.useMemo)((()=>G.filter((e=>J.includes(e.id))).length+(Object(n.isEmpty)(m)?0:1)),[G,J,m]),Z=Object(r.useCallback)((e=>{h(d.a.setActiveTabTimeline({id:a,activeTab:e}))}),[h,a]),ne=Object(r.useCallback)((()=>{Z(I.d.query)}),[Z]),ie=Object(r.useCallback)((()=>{Z(I.d.eql)}),[Z]),re=Object(r.useCallback)((()=>{Z(I.d.graph)}),[Z]),se=Object(r.useCallback)((()=>{Z(I.d.notes)}),[Z]),oe=Object(r.useCallback)((()=>{Z(I.d.pinned)}),[Z]),le=Object(r.useCallback)((()=>{Z(I.d.session)}),[Z]),ce=Object(r.useCallback)((()=>{Z(I.d.securityAssistant),_!==I.d.securityAssistant&&Y({conversationId:W,invokedBy:z.a})}),[_,W,Y,Z]),ue=Object(r.useCallback)((()=>{Z(I.d.discover)}),[Z]);return Object(r.useEffect)((()=>{u||_!==I.d.graph||ne()}),[_,u,ne]),s.a.createElement(s.a.Fragment,null,!l&&s.a.createElement(i.EuiTabs,null,s.a.createElement(ae,{"data-test-subj":`timelineTabs-${I.d.query}`,onClick:ne,isSelected:_===I.d.query,disabled:!1,key:I.d.query},s.a.createElement("span",null,F),$&&s.a.createElement(C.b,null)),c===f.l.default&&s.a.createElement(ae,{"data-test-subj":`timelineTabs-${I.d.eql}`,onClick:ie,isSelected:_===I.d.eql,disabled:!1,key:I.d.eql},s.a.createElement("span",null,A),$&&s.a.createElement(C.a,null)),s.a.createElement(i.EuiTab,{"data-test-subj":`timelineTabs-${I.d.graph}`,onClick:re,isSelected:_===I.d.graph,disabled:!u,key:I.d.graph},D),Q&&s.a.createElement(i.EuiTab,{"data-test-subj":`timelineTabs-${I.d.session}`,onClick:le,isSelected:_===I.d.session,disabled:null===p,key:I.d.session},B),s.a.createElement(ae,{"data-test-subj":`timelineTabs-${I.d.notes}`,onClick:se,isSelected:_===I.d.notes,disabled:c===f.l.template,key:I.d.notes},s.a.createElement("span",null,N),$&&X>0&&c===f.l.default&&s.a.createElement("div",null,s.a.createElement(te,null,X))),s.a.createElement(ae,{"data-test-subj":`timelineTabs-${I.d.pinned}`,onClick:oe,disabled:c===f.l.template,isSelected:_===I.d.pinned,key:I.d.pinned},s.a.createElement("span",null,P),$&&V>0&&c===f.l.default&&s.a.createElement("div",null,s.a.createElement(te,null,V))),g&&s.a.createElement(ae,{"data-test-subj":`timelineTabs-${I.d.securityAssistant}`,onClick:ce,disabled:c===f.l.template,isSelected:_===I.d.securityAssistant,key:I.d.securityAssistant},s.a.createElement("span",null,R)),b&&s.a.createElement(ae,{"data-test-subj":`timelineTabs-${I.d.discover}`,onClick:ue,isSelected:_===I.d.discover,disabled:!1,key:I.d.discover},s.a.createElement("span",null,L))),s.a.createElement(ee,{activeTimelineTab:_,renderCellValue:e,rowRenderers:t,timelineId:a,timelineType:c,timelineDescription:m,setConversationId:K,showTimeline:$}))},ie=Object(r.memo)(ne);var re=a(170),se=a(178),oe=a(722),le=a(45),ce=a(56),ue=a(102),de=a(221),pe=a(122);const me=c.a.div.withConfig({displayName:"TimelineTemplateBadge",componentId:"sc-4r2lej-0"})(["background:",";color:#fff;padding:10px 15px;font-size:0.8em;"],(({theme:e})=>e.eui.euiColorVis3_behindText)),be=Object(r.createContext)({timelineId:null}),ge=({timelineId:e})=>{const t=Object(r.useMemo)((()=>d.b.getTimelineByIdSelector()),[]);return Object(y.b)((a=>{var n;return(null!==(n=t(a,e))&&void 0!==n?n:p.b).isSaving}))?s.a.createElement(i.EuiProgress,{size:"s",color:"primary",position:"absolute"}):null},fe=s.a.memo(ge),ye=({renderCellValue:e,rowRenderers:t,timelineId:a})=>{const l=Object(o.useDispatch)(),c=Object(r.useRef)(null),x=Object(r.useMemo)((()=>d.b.getTimelineByIdSelector()),[]),j=Object(r.useMemo)((()=>pe.e.scopeIdSelector()),[]),{selectedPatterns:S,selectedDataViewId:k}=Object(y.a)((e=>j(e,b.SourcererScopeName.timeline))),{dataViewId:O,indexNames:w,graphEventId:T,savedObjectId:C,timelineType:M,description:_,sessionViewConfig:F,initialized:A}=Object(y.a)((e=>{var t;return Object(n.pick)(["indexNames","dataViewId","graphEventId","savedObjectId","timelineType","description","sessionViewConfig","initialized"],null!==(t=x(e,a))&&void 0!==t?t:p.b)})),{timelineFullScreen:D}=Object(se.c)();Object(r.useEffect)((()=>{C||A||l(d.a.createTimeline({id:a,columns:m.b,dataViewId:k,indexNames:S,expandedDetail:h.a.getExpandedDetail(),show:!1}))}),[]);const N=Object(r.useCallback)((()=>{!C||null==k||null===O&&0===w.length||O===k&&w.sort().join()===S.sort().join()||l(d.a.updateDataView({dataViewId:k,id:a,indexNames:S}))}),[l,C,k,O,S,w,a]);Object(r.useEffect)((()=>{N()}),[k,S]);const P=Object(r.useCallback)((()=>{var e;const t=null===(e=c.current)||void 0===e?void 0:e.querySelector(oe.a);var a,n;null!=t?t.focus():null===(a=c.current)||void 0===a||null===(n=a.querySelector(".globalFilterBar__addButton"))||void 0===n||n.focus()}),[c]),R=Object(r.useCallback)((()=>{var e,t;null===(e=c.current)||void 0===e||null===(t=e.querySelector(`.${v.d}`))||void 0===t||t.focus()}),[c]),L=Object(r.useCallback)((e=>{Object(u.isTab)(e)&&Object(v.l)({containerElement:c.current,keyboardEvent:e,onSkipFocusBeforeEventsTable:P,onSkipFocusAfterEventsTable:R})}),[c,P,R]),B=Object(r.useMemo)((()=>({timelineId:a})),[a]),q=(()=>{const{search:e,pathname:t}=Object(le.useLocation)(),{spaces:a}=Object(ue.j)().services,n=Object(r.useMemo)((()=>d.b.getTimelineByIdSelector()),[]),{resolveTimelineConfig:o,savedObjectId:l,show:c,graphEventId:u,activeTab:m}=Object(y.a)((e=>{var t;return null!==(t=n(e,I.c.active))&&void 0!==t?t:p.b})),b=Object(r.useCallback)((()=>{var n,r,d;const p=new URLSearchParams(e),b=null!==(n=p.get(de.a.timeline))&&void 0!==n?n:void 0,g={id:null!=l?l:"",isOpen:!!c,activeTab:m,graphEventId:u},f=null!==(r=Object(ce.safeDecode)(null!=b?b:""))&&void 0!==r?r:g,y=null==f?void 0:f.id;if(!a||"conflict"!==(null==o?void 0:o.outcome)||null==(null==o?void 0:o.alias_target_id)||null==y)return null;const h=null!==(d=null==o?void 0:o.alias_target_id)&&void 0!==d?d:"",v={...f,id:h},E=Object(ce.encode)(v);p.set(de.a.timeline,E);const x=`${t}?${p.toString()}${window.location.hash}`;return s.a.createElement(s.a.Fragment,null,a.ui.components.getLegacyUrlConflict({objectNoun:de.a.timeline,currentObjectId:y,otherObjectId:h,otherObjectPath:x}),s.a.createElement(i.EuiSpacer,null))}),[m,u,t,null==o?void 0:o.alias_target_id,null==o?void 0:o.outcome,l,e,c,a]);return Object(r.useMemo)((()=>b()),[b])})();return s.a.createElement(be.Provider,{value:B},s.a.createElement(re.B,{"data-test-subj":"timeline","data-timeline-id":a,onKeyDown:L,ref:c},s.a.createElement(fe,{timelineId:a}),M===f.l.template&&s.a.createElement(me,null,E.f),q,s.a.createElement(re.y,{$isVisible:!D,"data-test-subj":"timeline-hide-show-container"},s.a.createElement(g.b,{timelineId:a}),s.a.createElement(g.a,{timelineId:a})),s.a.createElement(ie,{graphEventId:T,sessionViewConfig:F,renderCellValue:e,rowRenderers:t,timelineId:a,timelineType:M,timelineDescription:_,timelineFullScreen:D})))};ye.displayName="StatefulTimelineComponent";const he=s.a.memo(ye)},function(e,t,a){"use strict";a.d(t,"a",(function(){return M}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(40),l=a(103),c=a(42);const u=a(5).i18n.translate("xpack.securitySolution.components.histogram.stackByOptions.stackByLabel",{defaultMessage:"Stack by"});var d=a(166),p=a(520),m=a(456),b=a(959),g=a(151),f=a(114),y=a(311),h=a(390),v=a(177),E=a(124),x=a(211),j=a(403),S=a(726),k=a(645);const O=({isInitialLoading:e,barChart:t,configs:a,stackByField:n,scopeId:r})=>e?i.a.createElement(k.a,null):i.a.createElement(S.a,{barChart:t,configs:a,stackByField:n,scopeId:r}),w=i.a.memo(O);O.displayName="MatrixHistogramChartContentComponent";var T=a(413);const I=s()(p.a).withConfig({displayName:"HistogramPanel",componentId:"sc-cnfih-0"})(["display:flex;flex-direction:column;",""],(({height:e})=>null!=e?`min-height: ${e}px;`:"")),C=({chartHeight:e,defaultStackByOption:t,endDate:a,errorMessage:r,filterQuery:s,getLensAttributes:p,headerChildren:S,histogramType:k,hideHistogramIfEmpty:O=!1,id:C,indexNames:M,runtimeMappings:_,isPtrIncluded:F,legendPosition:A,lensAttributes:D,mapping:N,onError:P,paddingSize:R="m",panelHeight:L=300,setAbsoluteRangeDatePickerTarget:B=f.a.global,setQuery:q,showInspectButton:z=!1,showLegend:$,showSpacer:V=!0,stackByOptions:U,startDate:H,subtitle:G,scopeId:Q,sourcererScopeId:W,title:K,titleSize:Y,yTickFormatter:J,skip:X,hideQueryToggle:Z=!1,applyGlobalQueriesAndFilters:ee=!0})=>{const te=`${C}-embeddable`,ae=Object(l.useDispatch)(),ne=Object(n.useCallback)((({x:e})=>{if(!e)return;const[t,a]=e;ae(Object(g.setAbsoluteRangeDatePicker)({id:B,from:new Date(t).toISOString(),to:new Date(a).toISOString()}))}),[ae,B]),ie=Object(n.useMemo)((()=>Object(m.b)({chartHeight:e,from:H,legendPosition:A,to:a,onBrushEnd:ne,yTickFormatter:J,showLegend:$})),[e,H,A,a,ne,J,$]),[re,se]=Object(n.useState)(!0),[oe,le]=Object(n.useState)(t);Object(n.useEffect)((()=>{le(t)}),[t]);const ce=Object(n.useCallback)((e=>{var a;le(null!==(a=U.find((t=>t.value===e.target.value)))&&void 0!==a?a:t)}),[t,U]),{toggleStatus:ue,setToggleStatus:de}=Object(v.a)(C),[pe,me]=Object(n.useState)(X||!ue);Object(n.useEffect)((()=>{me(X||!ue)}),[X,ue]);const be=Object(n.useCallback)((e=>{de(e),me(!e)}),[me,de]),ge=Object(E.a)("chartEmbeddablesEnabled"),fe={endDate:a,errorMessage:r,filterQuery:s,histogramType:k,indexNames:M,onError:P,startDate:H,stackByField:oe.value,runtimeMappings:_,isPtrIncluded:F,skip:pe||ge},[ye,{data:he,inspect:ve,totalCount:Ee,refetch:xe}]=Object(b.a)(fe),je=Object(n.useMemo)((()=>null!=K&&"function"==typeof K?K(oe):K),[K,oe]),Se=Object(T.a)({visualizationId:te}),ke=Object(n.useMemo)((()=>{if(re)return null;if("function"==typeof G){if(ge){if(!Se||(e=Se[0],!Object.values(null!==(t=e.aggregations)&&void 0!==t?t:{}).some((({buckets:e})=>e.length>0))))return G(0);const a=Se[0].hits.total;return a>=0?G(a):null}return Ee>=0?G(Ee):null}var e,t;return G}),[ge,re,G,Ee,Se]),Oe=Object(n.useMemo)((()=>!!(Ee<=0&&O)),[Ee,O]),we=Object(n.useMemo)((()=>Object(m.c)(he,N)),[he,N]);Object(n.useEffect)((()=>{ye||re||q({id:C,inspect:ve,loading:ye,refetch:xe}),re&&we&&he&&se(!1)}),[we,he,C,ve,ge,re,ye,xe,se,q]);const Te=Object(n.useMemo)((()=>({from:H,to:a})),[H,a]),Ie=Object(n.useMemo)((()=>({dnsIsPtrIncluded:null!=F&&F,filters:s?[{query:Object(c.isString)(s)?JSON.parse(s):s,meta:{}}]:void 0})),[F,s]);return Oe?null:i.a.createElement(i.a.Fragment,null,i.a.createElement(y.a,{show:!re,targetClassNames:[x.a]},i.a.createElement(I,{"data-test-subj":`${C}Panel`,height:ue?L:void 0,paddingSize:R},ye&&!re&&i.a.createElement(o.EuiProgress,{"data-test-subj":"initialLoadingPanelMatrixOverTime",size:"xs",position:"absolute",color:"accent"}),i.a.createElement(d.a,{id:C,height:ue?void 0:0,title:je,titleSize:Y,toggleStatus:ue,toggleQuery:Z?void 0:be,subtitle:ke,inspectMultiple:!0,showInspectButton:z&&!ge,isInspectDisabled:void 0===s},i.a.createElement(o.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},(p||D)&&Te&&!ge&&i.a.createElement(o.EuiFlexItem,{grow:!1},i.a.createElement(h.a,{className:"histogram-viz-actions",extraOptions:Ie,getLensAttributes:p,isInspectButtonDisabled:void 0===s,lensAttributes:D,queryId:C,stackByField:oe.value,timerange:Te,title:K})),i.a.createElement(o.EuiFlexItem,{grow:!1},U.length>1&&i.a.createElement(o.EuiSelect,{onChange:ce,options:U,prepend:u,value:null==oe?void 0:oe.value})),i.a.createElement(o.EuiFlexItem,{grow:!1},S))),ue?ge?i.a.createElement(j.a,{scopeId:W,applyGlobalQueriesAndFilters:ee,"data-test-subj":"embeddable-matrix-histogram",extraOptions:Ie,getLensAttributes:p,height:null!=e?e:150,id:te,inspectTitle:K,lensAttributes:D,stackByField:oe.value,timerange:Te}):i.a.createElement(w,{isInitialLoading:re,barChart:we,configs:ie,stackByField:oe.value,scopeId:Q}):null)),V&&i.a.createElement(o.EuiSpacer,{"data-test-subj":"spacer",size:"l"}))},M=i.a.memo(C)},function(e,t,a){"use strict";a.d(t,"b",(function(){return w})),a.d(t,"a",(function(){return T}));var n=a(130),i=a.n(n),r=a(42),s=a(2),o=a(103),l=a(3),c=a(51),u=a(102),d=a(216),p=a(111),m=a(518),b=a(115),g=a(113);const f=a(5).i18n.translate("xpack.securitySolution.timelineEvents.errorSearchDescription",{defaultMessage:"An error has occurred on timeline events search"});var y=a(118),h=a(175),v=a(302),E=a(108),x=a(303),j=a(4);const S="timelineEventsQuery",k=[{field:"@timestamp",direction:g.b.asc,type:"date",esTypes:["date"]}],O=e=>({...Object(r.isEmpty)(null==e?void 0:e.eventCategoryField)?{}:{eventCategoryField:null==e?void 0:e.eventCategoryField},...Object(r.isEmpty)(null==e?void 0:e.size)?{}:{size:null==e?void 0:e.size},...Object(r.isEmpty)(null==e?void 0:e.tiebreakerField)?{}:{tiebreakerField:null==e?void 0:e.tiebreakerField},...Object(r.isEmpty)(null==e?void 0:e.timestampField)?{}:{timestampField:null==e?void 0:e.timestampField}}),w=({dataViewId:e,endDate:t,eqlOptions:a,id:n=S,indexNames:w,fields:T,filterQuery:I,runtimeMappings:C,startDate:M,language:_="kuery",limit:F,sort:A=k,skip:D=!1,timerangeKind:N})=>{const[{pageName:P}]=Object(h.a)(),R=Object(o.useDispatch)(),{data:L}=Object(u.j)().services,B=Object(s.useRef)(r.noop),q=Object(s.useRef)(new AbortController),z=Object(s.useRef)(new l.Subscription),[$,V]=Object(s.useState)(!1),[U,H]=Object(s.useState)(n===y.c.active?v.a.getActivePage():0),[G,Q]=Object(s.useState)(null),W=Object(s.useRef)(null),{startTracking:K}=Object(x.a)(),Y=Object(s.useCallback)((()=>{null!=n&&m.a.some((e=>e===n))&&(R(p.a.clearEventsLoading({id:n})),R(p.a.clearEventsDeleted({id:n})))}),[R,n]),J=Object(s.useCallback)((e=>{Y(),n===y.c.active&&(v.a.setExpandedDetail({}),v.a.setActivePage(e)),H(e)}),[Y,n]),X=Object(s.useCallback)((()=>{null!=B.current&&B.current(),J(0)}),[J]),Z=Object(s.useCallback)((e=>{R(p.a.setTimelineUpdatedAt({id:n,updated:e}))}),[R,n]),[ee,te]=Object(s.useState)({id:n,inspect:{dsl:[],response:[]},refetch:X,totalCount:-1,pageInfo:{activePage:0,querySize:0},events:[],loadPage:J,updatedAt:0}),{addWarning:ae}=Object(E.a)(),ne=Object(s.useCallback)((async(t,a)=>{if(null==t||""===P||D)return;const i=async()=>{W.current=t,q.current=new AbortController,V(!0);const{endTracking:i}=K({name:`${j.l} timeline events search`});z.current=L.search.search(t,{strategy:"eql"===t.language?"timelineEqlSearchStrategy":"timelineSearchStrategy",abortSignal:q.current.signal,indexPattern:{id:e}}).subscribe({next:e=>{Object(c.isCompleteResponse)(e)?(i("success"),V(!1),te((i=>{const r={...i,events:(s=e.edges,s.map((e=>e.node))),inspect:Object(b.getInspectResponse)(e,i.inspect),pageInfo:e.pageInfo,totalCount:e.totalCount,updatedAt:Date.now()};var s;return Z(r.updatedAt),n===y.c.active&&(v.a.setExpandedDetail({}),v.a.setPageName(P),"eql"===t.language?(v.a.setEqlRequest(t),v.a.setEqlResponse(r)):(v.a.setRequest(t),v.a.setResponse(r))),a&&a(r),r})),z.current.unsubscribe()):Object(c.isErrorResponse)(e)&&(i("invalid"),V(!1),ae(f),z.current.unsubscribe())},error:e=>{i(q.current.signal.aborted?"aborted":"error"),V(!1),L.search.showError(e),z.current.unsubscribe()}})};if(n===y.c.active&&""!==v.a.getPageName()&&P!==v.a.getPageName()){if(v.a.setPageName(P),q.current.abort(),V(!1),"eql"===t.language?(W.current=v.a.getEqlRequest(),B.current=i.bind(null,v.a.getEqlRequest())):(W.current=v.a.getRequest(),B.current=i.bind(null,v.a.getRequest())),te((e=>{const a="eql"===t.language?v.a.getEqlResponse():v.a.getResponse();return null!=a?{...a,refetch:X,loadPage:J}:e})),"eql"!==t.language&&null!=v.a.getResponse())return;if("eql"===t.language&&null!=v.a.getEqlResponse())return}z.current.unsubscribe(),q.current.abort(),await i(),B.current=i}),[P,D,n,K,L.search,e,Z,ae,X,J]);Object(s.useEffect)((()=>{0!==w.length&&Q((e=>{var r,s,o,l,c,u;const p=e,m={defaultIndex:null!==(r=null==e?void 0:e.defaultIndex)&&void 0!==r?r:[],filterQuery:null!==(s=null==e?void 0:e.filterQuery)&&void 0!==s?s:"",querySize:null!==(o=null==e?void 0:e.pagination.querySize)&&void 0!==o?o:0,sort:null!==(l=null==e?void 0:e.sort)&&void 0!==l?l:k,timerange:null!==(c=null==e?void 0:e.timerange)&&void 0!==c?c:{},runtimeMappings:null!==(u=null==e?void 0:e.runtimeMappings)&&void 0!==u?u:{},...O(p)},b=M&&t?{timerange:{interval:"12h",from:M,to:t}}:{},f={defaultIndex:w,filterQuery:Object(d.a)(I),querySize:F,sort:A,runtimeMappings:C,...b,...O(a)},h=i()(m,f)?U:0,E={defaultIndex:w,factoryQueryType:g.A.all,fieldRequested:T,fields:T,filterQuery:Object(d.a)(I),pagination:{activePage:h,querySize:F},language:_,runtimeMappings:C,sort:A,...b,...a||{}};return U!==h&&(H(h),n===y.c.active&&v.a.setActivePage(h)),i()(e,E)?e:E}))}),[R,w,U,t,a,I,n,_,F,M,A,T,C]);const ie=Object(s.useCallback)((async e=>{n===y.c.active&&"absolute"!==N&&i()(W.current,G)||await ne(G,e)}),[n,G,ne,N]);return Object(s.useEffect)((()=>{Object(r.isEmpty)(I)&&te({id:n,inspect:{dsl:[],response:[]},refetch:X,totalCount:-1,pageInfo:{activePage:0,querySize:0},events:[],loadPage:J,updatedAt:0})}),[I,n,X,J]),[$,ee,ie]},T=({dataViewId:e,endDate:t,eqlOptions:a,id:n=S,indexNames:i,fields:r,filterQuery:o,runtimeMappings:l,startDate:c,language:u="kuery",limit:d,sort:p=k,skip:m=!1,timerangeKind:b})=>{const[g,f,y]=w({dataViewId:e,endDate:t,eqlOptions:a,id:n,indexNames:i,fields:r,filterQuery:o,runtimeMappings:l,startDate:c,language:u,limit:d,sort:p,skip:m,timerangeKind:b});return Object(s.useEffect)((()=>{y&&y()}),[y]),[g,f]}},function(e,t,a){"use strict";a.d(t,"a",(function(){return y}));var n=a(40),i=a(42),r=a(2),s=a.n(r),o=a(45),l=a(130),c=a.n(l),u=a(102),d=a(18),p=a(19),m=a(175);const b=({disabled:e,hrefWithSearch:t,id:a,name:i,isSelected:o,isBeta:l,betaOptions:c})=>{var m;const{getAppUrl:b,navigateTo:g}=Object(u.l)(),f=Object(r.useCallback)((e=>{e.preventDefault(),g({path:t,restoreScroll:!0}),Object(d.h)(d.a.CLICK,`${d.c.TAB_CLICKED}${a}`)}),[g,t,a]),y=b({path:t});return s.a.createElement(n.EuiTab,{"data-href":y,"data-test-subj":`navigation-${a}`,disabled:e,isSelected:o,href:y,onClick:f,append:l&&s.a.createElement(n.EuiBadge,{color:"#E0E5EE"},null!==(m=null==c?void 0:c.text)&&void 0!==m?m:p.a)},i)},g=s.a.memo(b),f=({navTabs:e})=>{const[{tabName:t}]=Object(m.a)(),a=Object(r.useCallback)((()=>Object(i.getOr)("","id",Object.values(e).find((e=>t===e.id)))),[t,e]),[l,c]=Object(r.useState)(a());Object(r.useEffect)((()=>{const e=a();e!==l&&c(e)}),[t,e,a,l]);const{search:u}=Object(o.useLocation)(),d=Object(r.useMemo)((()=>Object.values(e).map((e=>{const t=l===e.id;return s.a.createElement(g,{key:`navigation-${e.id}`,id:e.id,hrefWithSearch:e.href+u,name:e.name,disabled:e.disabled,isSelected:t,isBeta:e.isBeta,betaOptions:e.betaOptions})}))),[e,l,u]);return s.a.createElement(n.EuiTabs,null,d)};f.displayName="TabNavigationComponent";const y=s.a.memo(f,((e,t)=>c()(e.navTabs,t.navTabs)));y.displayName="TabNavigation"},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(102),r=a(109),s=a(59);const o=({closePopover:e,draggableId:t,fieldName:a,keyboardHandlerRef:o,openPopover:l})=>{const{timelines:c}=Object(i.j)().services,u=c.getUseAddToTimeline(),{beginDrag:d,cancelDrag:p,dragToLocation:m,endDrag:b,hasDraggableLock:g}=u({draggableId:t,fieldName:a}),[f,y]=Object(n.useState)(null),h=Object(n.useCallback)((()=>{y((e=>e?(p(e),null):null))}),[p]),v=Object(n.useCallback)((a=>{const n=document.querySelector(`[data-rbd-drag-handle-draggable-id="${t}"]`);var i;n&&((g()||!g()&&" "===a.key)&&(a.preventDefault(),a.stopPropagation()),(({beginDrag:e,cancelDragActions:t,closePopover:a,draggableElement:n,dragActions:i,dragToLocation:o,endDrag:l,keyboardEvent:c,openPopover:u,setDragActions:d})=>{let p=null;switch(c.key){case" ":i?(l(i),d(null)):(null!=a&&a(),d(e()));break;case"Escape":t();break;case"Tab":(e=>{const t=e.querySelectorAll("a, button");t.forEach((e=>{e.setAttribute("tabindex","-1")})),setTimeout((()=>{t.forEach((e=>{e.setAttribute("tabindex","0")}))}),0)})(n);break;case"ArrowUp":p=n.getBoundingClientRect(),o({dragActions:i,position:{x:p.x,y:p.y-r.f}});break;case"ArrowDown":p=n.getBoundingClientRect(),o({dragActions:i,position:{x:p.x,y:p.y+r.f}});break;case"ArrowLeft":p=n.getBoundingClientRect(),o({dragActions:i,position:{x:p.x-r.f,y:p.y}});break;case"ArrowRight":p=n.getBoundingClientRect(),o({dragActions:i,position:{x:p.x+r.f,y:p.y}});break;case"Enter":Object(s.stopPropagationAndPreventDefault)(c),i||null==u||u()}})({beginDrag:d,cancelDragActions:h,closePopover:e,dragActions:f,draggableElement:n,dragToLocation:m,endDrag:b,keyboardEvent:a,openPopover:l,setDragActions:y}),null===(i=o.current)||void 0===i||i.focus())}),[d,h,e,f,t,m,b,g,o,l,y]);return Object(n.useMemo)((()=>({onBlur:h,onKeyDown:v})),[h,v])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return l})),a.d(t,"b",(function(){return c}));var n=a(2),i=a(419),r=a(5);r.i18n.translate("xpack.securitySolution.overviewHost.errorSearchDescription",{defaultMessage:"An error has occurred on host overview search"});const s=r.i18n.translate("xpack.securitySolution.overviewHost.failSearchDescription",{defaultMessage:"Failed to run search on host overview"});var o=a(194);const l="hostsDetailsQuery",c=({endDate:e,hostName:t,indexNames:a,id:r=l,skip:c=!1,startDate:u})=>{const{loading:d,result:p,search:m,refetch:b,inspect:g}=Object(o.a)({factoryQueryType:i.d.details,initialResult:{hostDetails:{}},errorMessage:s,abort:c}),f=Object(n.useMemo)((()=>({endDate:e,hostDetails:p.hostDetails,id:r,inspect:g,isInspected:!1,refetch:b,startDate:u})),[e,p.hostDetails,r,g,b,u]),y=Object(n.useMemo)((()=>({defaultIndex:a,factoryQueryType:i.d.details,hostName:t,timerange:{interval:"12h",from:u,to:e}})),[e,t,a,u]);return Object(n.useEffect)((()=>{c||m(y)}),[y,m,c]),[d,f]}},function(e,t,a){"use strict";a.d(t,"d",(function(){return o})),a.d(t,"b",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"a",(function(){return u}));var n=a(2),i=a.n(n),r=a(895),s=a(854);const o=()=>i.a.createElement(r.a,{docPath:s.h,linkText:s.i}),l=()=>i.a.createElement(r.a,{docPath:s.d,linkText:s.e}),c=()=>i.a.createElement(r.a,{docPath:s.f,linkText:s.g}),u=()=>i.a.createElement(r.a,{docPath:s.b,linkText:s.c})},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(340),i=a(377);const r=async(e,t,a=!1)=>{var r,s;const o=await t.get(e,!0,a),l=o.toSpec(),c=Object(n.a)(o.getIndexPattern().split(",")),u=await t.getExistingIndices(c);return{loading:!1,id:null!==(r=l.id)&&void 0!==r?r:"",title:o.getIndexPattern(),indexFields:o.fields,fields:l.fields,patternList:u,dataView:l,browserFields:Object(i.a)(null!==(s=l.id)&&void 0!==s?s:"",l.fields).browserFields,runtimeMappings:l.runtimeFieldMap}}},,function(e,t){e.exports=function(){}},function(e,t,a){"use strict";let n;a.d(t,"a",(function(){return n})),a(270).NetworkType.details,function(e){e.anomalies="anomalies",e.flows="flows",e.tls="tls",e.http="http",e.events="events",e.users="users"}(n||(n={}))},function(e,t,a){"use strict";a.d(t,"c",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"b",(function(){return s}));var n=a(195);const i=(e,t)=>`/name/${e}${Object(n.a)(t)}`,r=(e,t,a)=>`/name/${e}/${t}${Object(n.a)(a)}`,s=(e,t)=>`/${e}${Object(n.a)(t)}`},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.dragAndDrop.copyToClipboardTooltip",{defaultMessage:"Copy to Clipboard"}),r=n.i18n.translate("xpack.securitySolution.dragAndDrop.draggableKeyboardInstructionsNotDraggingScreenReaderOnly",{defaultMessage:"Press enter for options, or press space to begin dragging."});n.i18n.translate("xpack.securitySolution.dragAndDrop.fieldLabel",{defaultMessage:"Field"}),n.i18n.translate("xpack.securitySolution.dragAndDrop.closeButtonLabel",{defaultMessage:"Close"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(40),i=a(2),r=a.n(i),s=a(140),o=a(939);const l=r.a.memo((({hideActions:e=[],modalTitle:t,onClose:a,onOpen:i})=>r.a.createElement(n.EuiModal,{"data-test-subj":"open-timeline-modal",maxWidth:1100,onClose:a},r.a.createElement(o.a,{closeModalTimeline:a,hideActions:e,isModal:!0,defaultPageSize:10,onOpenTimeline:i,title:null!=t?t:s.H}))));l.displayName="OpenTimelineModal"},function(e,t,a){"use strict";a.d(t,"b",(function(){return y})),a.d(t,"a",(function(){return h})),a.d(t,"c",(function(){return v}));var n=a(42),i=a(2),r=a(103),s=a(5),o=a(161),l=a(12),c=a(108),u=a(116),d=a(158),p=a(164),m=a(254),b=a(148),g=a(909),f=a(110);const y="createRuleFromTimeline",h="createRuleFromEql",v=e=>{const t=Object(r.useDispatch)(),{addError:a}=Object(c.a)(),{browserFields:v,dataViewId:E,selectedPatterns:x}=Object(u.d)(f.SourcererScopeName.timeline),j=Object(i.useRef)(!1),[S,k]=Object(i.useState)(null),[O,w]=Object(i.useState)(!1),T=Object(i.useCallback)((e=>{w(!0),k(e),e.dataViewId===E||Object(n.isEmpty)(e.indexNames)||t(d.a.setSelectedDataView({id:f.SourcererScopeName.timeline,selectedDataViewId:e.dataViewId,selectedPatterns:e.indexNames}))}),[E,t]),[I]=Object(i.useState)({dataViewId:E,selectedPatterns:x}),C=Object(i.useMemo)((()=>null==S||Object(n.isEmpty)(v)||null!==S.dataViewId&&null!==E&&E!==S.dataViewId?null:v),[v,E,S]),M=Object(m.e)(y),_=Object(i.useMemo)(M,[M]),F=Object(m.e)(h),A=Object(i.useMemo)(F,[F]),D=Object(i.useCallback)((()=>{if(null!=S&&null!=C){try{const t=()=>{var e,t,a,n,i,r,s;return{dataProviders:null!=S.dataProviders&&S.dataProviders.length>0?Object(o.f)(Object(b.g)(S.dataProviders,C),{fields:[],title:x.join(",")}):"",query:{query:null!==(e=null===(t=S.kqlQuery.filterQuery)||void 0===t||null===(a=t.kuery)||void 0===a?void 0:a.expression)&&void 0!==e?e:"",language:null!==(n=null===(i=S.kqlQuery.filterQuery)||void 0===i||null===(r=i.kuery)||void 0===r?void 0:r.kind)&&void 0!==n?n:"kuery"},filters:null!==(s=S.filters)&&void 0!==s?s:[],eqlOptions:{}}},a=()=>{var e;return{dataProviders:"",query:{query:null!==(e=S.eqlOptions.query)&&void 0!==e?e:"",language:"eql"},filters:[],eqlOptions:{eqlOptions:S.eqlOptions}}},n=j.current?a():t();w(!1),e({index:x,queryBar:{filters:""!==n.dataProviders?[...n.filters,Object(g.b)(n.dataProviders)]:n.filters,query:n.query,saved_id:null},...n.eqlOptions})}catch(e){w(!1),a(e,{toastMessage:s.i18n.translate("xpack.securitySolution.ruleFromTimeline.error.toastMessage",{defaultMessage:"Failed to create rule from timeline with id: {id}",values:{id:S.id}}),title:s.i18n.translate("xpack.securitySolution.ruleFromTimeline.error.title",{defaultMessage:"Failed to import rule from timeline"})})}j.current=!1,I.dataViewId!==E&&t(d.a.setSelectedDataView({id:f.SourcererScopeName.timeline,selectedDataViewId:I.dataViewId,selectedPatterns:I.selectedPatterns}))}}),[a,E,t,I.dataViewId,I.selectedPatterns,C,x,S,e]);Object(i.useEffect)((()=>{null!=C&&D()}),[D,C]);const N=Object(i.useCallback)((e=>{null!=S&&e===S.id||Object(p.h)({timelineId:e,onOpenTimeline:T,updateIsLoading:({id:e,isLoading:a})=>t(Object(l.updateIsLoading)({id:e,isLoading:a})),updateTimeline:Object(p.b)(t)})}),[t,T,S]),[P,R]=Object(i.useState)(!1);return Object(i.useEffect)((()=>{if(!P){let e=null;null!=_?e=_:null!=A&&(e=A,j.current=!0),null!=e&&(R(!0),N(e),w(!0))}}),[N,_,A,P]),{loading:O,onOpenTimeline:T}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(2),i=a.n(n),r=a(130),s=a.n(r),o=a(13),l=a(72),c=a(14);const u=Object(n.memo)((({dateRangeFrom:e,dateRangeTo:t,hideSavedQuery:a=!1,indexPattern:r,isLoading:u=!1,isRefreshPaused:d,filterQuery:p,filterManager:m,filters:b,onChangedQuery:g,onSubmitQuery:f,refreshInterval:y,savedQuery:h,onSavedQuery:v,dataTestSubj:E,displayStyle:x,isDisabled:j})=>{const S=Object(n.useCallback)((e=>{null==e.query||s()(e.query,p)||f(e.query)}),[p,f]),k=Object(n.useCallback)((e=>{g&&null!=e.query&&!s()(e.query,p)&&g(e.query)}),[p,g]),O=Object(n.useCallback)((e=>{const{query:t,filters:a,timefilter:n}=e.attributes;f(t,n),m.setFilters(a||[]),v(e)}),[m,f,v]),w=Object(n.useCallback)((()=>{null!=h&&(f({query:"",language:h.attributes.query.language}),m.setFilters([]),v(void 0))}),[m,f,v,h]),T=Object(n.useCallback)((e=>{m.setFilters(e)}),[m]),I=Object(n.useMemo)((()=>[r]),[r]),C=Object(n.useMemo)((()=>new o.TimeHistory(new c.Storage(localStorage))),[]);return i.a.createElement(l.SearchBar,{showSubmitButton:!1,dateRangeFrom:e,dateRangeTo:t,filters:b,indexPatterns:I,isLoading:u,isRefreshPaused:d,query:p,onClearSavedQuery:w,onFiltersUpdated:T,onQueryChange:k,onQuerySubmit:S,onSaved:v,onSavedQueryUpdated:O,refreshInterval:y,showAutoRefreshOnly:!1,showFilterBar:!a,showDatePicker:!1,showQueryInput:!0,showSaveQuery:!0,timeHistory:C,dataTestSubj:E,savedQuery:h,displayStyle:x,isDisabled:j})}));u.displayName="QueryBar"},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(40),i=a(2),r=a.n(i),s=a(41);const o=a.n(s)()((({iconSide:e,children:t,...a})=>r.a.createElement(n.EuiLink,a,t))).withConfig({displayName:"Link",componentId:"sc-z5mbxm-0"})(["",""],(({iconSide:e,theme:t})=>Object(s.css)(["align-items:center;display:inline-flex;vertical-align:top;white-space:nowrap;"," ",""],"left"===e&&Object(s.css)([".euiIcon{margin-right:",";}"],t.eui.euiSizeXS),"right"===e&&Object(s.css)(["flex-direction:row-reverse;.euiIcon{margin-left:",";}"],t.eui.euiSizeXS))));o.displayName="Link";const l=r.a.memo((({ariaLabel:e,children:t,color:a,dataTestSubj:s,disabled:l,href:c,iconSide:u="left",iconSize:d="s",iconType:p,onClick:m})=>{const b=Object(i.useCallback)((e=>"object"==typeof e&&null!=e&&"props"in e&&e.props&&e.props.children?b(e.props.children):null!=e&&Object.keys(e).length>0?e:""),[]),g=Object(i.useMemo)((()=>e||b(t)),[e,t,b]);return r.a.createElement(o,{className:"siemLinkIcon",color:a,"data-test-subj":s,disabled:l,href:c,iconSide:u,onClick:m,"aria-label":g},r.a.createElement(n.EuiIcon,{size:d,type:p}),r.a.createElement("span",{className:"siemLinkIcon__label"},t))}));l.displayName="LinkIcon"},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=(e,t)=>{const a=window.URL.createObjectURL(e),n=document.createElement("a");n.href=a,n.download=t,n.click(),window.URL.revokeObjectURL(a),n.remove()}},function(e,t,a){"use strict";a.d(t,"a",(function(){return v}));var n=a(40),i=a(42),r=a(2),s=a.n(r),o=a(41),l=a.n(o),c=a(106),u=a(479),d=a(164),p=a(140),m=a(117),b=a(268),g=a(113);const f=l()(n.EuiFlexItem).withConfig({displayName:"TimelineContentItem",componentId:"sc-t3gz96-0"})(["max-width:calc(100% - 56px);"]),y=l()(n.EuiFilterButton).withConfig({displayName:"StyledEuiFilterButton",componentId:"sc-t3gz96-1"})(["border-top:0;border-bottom:0;"]),h=({hideUntitled:e=!1,getSelectableOptions:t,onClosePopover:a,onTimelineChange:o,timelineType:l,placeholder:h})=>{const[v,E]=Object(r.useState)(50),[x,j]=Object(r.useState)(0),[S,k]=Object(r.useState)(""),[O,w]=Object(r.useState)(!1),{fetchAllTimeline:T,timelines:I,loading:C,totalCount:M}=Object(u.b)(),_=Object(r.useRef)(null),F=Object(r.useRef)(null),A=Object(r.useMemo)((()=>Object(i.debounce)(500,k)),[]),D=Object(r.useCallback)((e=>{A(e)}),[A]),N=Object(r.useCallback)((()=>{w(!O)}),[O]),P=Object(r.useCallback)(((e,t,a)=>{if(e<t&&_.current&&F.current){const e=_.current.clientHeight,t=F.current.clientHeight;a>10&&t-a<1.2*e&&t>x&&(j(t),E(v+50))}}),[x,v]),R=Object(r.useCallback)(((e,t)=>{const a=Object(d.f)({...e,title:e.timelineTitle})?p.ab:e.timelineTitle,r=null!=e.description&&e.description.trim().length>0?e.description:null;return s.a.createElement(n.EuiFlexGroup,{gutterSize:"s",justifyContent:"spaceBetween",alignItems:"center",responsive:!1},s.a.createElement(n.EuiFlexItem,{grow:!1},s.a.createElement(n.EuiIcon,{type:"on"===e.checked?"check":"empty",color:"primary"})),s.a.createElement(f,{grow:!0},s.a.createElement(n.EuiFlexGroup,{gutterSize:"none",direction:"column",responsive:!1},s.a.createElement(n.EuiFlexItem,{"data-test-subj":"timeline"},s.a.createElement(n.EuiToolTip,{content:a,anchorClassName:"eui-textTruncate eui-alignMiddle"},s.a.createElement(n.EuiHighlight,{search:t},a))),s.a.createElement(n.EuiFlexItem,null,s.a.createElement(n.EuiToolTip,{content:r,anchorClassName:"eui-textTruncate eui-alignMiddle"},s.a.createElement(n.EuiTextColor,{color:"subdued",component:"span"},s.a.createElement("small",null,null!=r?r:Object(m.d)())))))),s.a.createElement(n.EuiFlexItem,{grow:!1},s.a.createElement(n.EuiIcon,{type:null!=e.favorite&&Object(i.isEmpty)(e.favorite)?"starEmpty":"starFilled"})))}),[]),L=Object(r.useCallback)((e=>{const t=e.filter((e=>"on"===e.checked));var n;null!=t&&t.length>0&&o(Object(i.isEmpty)(t[0].timelineTitle)?p.ab:t[0].timelineTitle,"-1"===t[0].id?null:t[0].id,null!==(n=t[0].graphEventId)&&void 0!==n?n:""),a()}),[a,o]),B=Object(r.useCallback)(((e,t)=>s.a.createElement(s.a.Fragment,null,t,e)),[]),q=Object(r.useMemo)((()=>({"data-test-subj":"timeline-super-select-search-box",placeholder:null!=h?h:b.e(l),onSearch:D,incremental:!1,append:s.a.createElement(y,{"data-test-subj":"only-favorites-toggle",hasActiveFilters:O,onClick:N},p.D)})),[N,D,O,l,h]),z=Object(r.useMemo)((()=>({rowHeight:50,showIcons:!1,windowProps:{onScroll:({scrollOffset:t})=>P((null!=I?I:[]).filter((t=>!e||""!==t.title)).length,M,t),outerRef:_,innerRef:F}})),[P,e,M,I]);return Object(r.useEffect)((()=>{T({pageInfo:{pageIndex:1,pageSize:v},search:S,sort:{sortField:c.f.updated,sortOrder:g.b.desc},onlyUserFavorite:O,status:null,timelineType:l})}),[T,O,v,S,l]),s.a.createElement(n.EuiSelectable,{"data-test-subj":"selectable-input",height:260,isLoading:C&&null==I,listProps:z,renderOption:R,onChange:L,searchable:!0,searchProps:q,singleSelection:!0,options:($=t({timelines:null!=I?I:[],onlyFavorites:O,searchTimelineValue:S,timelineType:l}),$.map((({title:e,...t})=>({...t,title:void 0,timelineTitle:e}))))},B);var $},v=Object(r.memo)(h)},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=a(5).i18n.translate("xpack.securitySolution.alertsView.osqueryAlertTitle",{defaultMessage:"Run Osquery"})},function(e,t,a){const n=a(292);e.exports=(e,t)=>{const a=n(e,t);return a?a.version:null}},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(2),i=a.n(n),r=a(41);const s=a.n(r).a.div.withConfig({displayName:"Wrapper",componentId:"sc-4ssvqk-0"})(["",""],(({theme:e})=>Object(r.css)([".siemSubtitle__item{color:",";font-size:",";line-height:",";@media only screen and (min-width:","){display:inline-block;margin-right:",";&:last-child{margin-right:0;}}}"],e.eui.euiTextSubduedColor,e.eui.euiFontSizeXS,e.eui.euiLineHeight,e.eui.euiBreakpoints.s,e.eui.euiSize)));s.displayName="Wrapper";const o=i.a.memo((({children:e,dataTestSubj:t="header-panel-subtitle"})=>"string"==typeof e?i.a.createElement("p",{className:"siemSubtitle__item siemSubtitle__item--text","data-test-subj":t},e):i.a.createElement("div",{className:"siemSubtitle__item siemSubtitle__item--node","data-test-subj":t},e)));o.displayName="SubtitleItem";const l=i.a.memo((({items:e})=>i.a.createElement(s,{className:"siemSubtitle"},Array.isArray(e)?e.map(((e,t)=>i.a.createElement(o,{key:t},e))):i.a.createElement(o,null,e))));l.displayName="Subtitle"},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(2),i=a(4),r=a(102);const s=({defaultValue:e,key:t,plugin:a=i.i,isInvalidDefault:s})=>{const{storage:o}=Object(r.j)().services,[l,c]=Object(n.useState)(!1),[u,d]=Object(n.useState)(e),p=Object(n.useCallback)((()=>{const n=o.get(`${a}.${t}`),i=typeof n!=typeof e,r=null!=s&&s(n);d(i||r?e:n)}),[e,s,t,a,o]),m=Object(n.useCallback)((e=>{if("function"==typeof e){const n=e;d((e=>{const i=n(e);return o.set(`${a}.${t}`,i),i}))}else o.set(`${a}.${t}`,e),d(e)}),[t,a,o]);return Object(n.useEffect)((()=>{l||(p(),c(!0))}),[l,p]),[u,m,c]}},function(e,t,a){"use strict";a.d(t,"c",(function(){return i})),a.d(t,"d",(function(){return r})),a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return o}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.eventsViewer.showingLabel",{defaultMessage:"Showing"}),r=(n.i18n.translate("xpack.securitySolution.eventsViewer.eventsLabel",{defaultMessage:"Events"}),e=>n.i18n.translate("xpack.securitySolution.eventsViewer.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {event} other {events}}"})),s=n.i18n.translate("xpack.securitySolution.eventsViewer.actionsColumnLabel",{defaultMessage:"Actions"}),o=n.i18n.translate("xpack.securitySolution.eventsViewer.timelineEvents.errorSearchDescription",{defaultMessage:"An error has occurred on timeline events search"})},function(e,t,a){"use strict";a.d(t,"c",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"b",(function(){return s}));var n=a(5);const i=e=>n.i18n.translate("xpack.securitySolution.configurations.suppressedAlerts",{defaultMessage:"Alert has {numAlertsSuppressed} suppressed alerts",values:{numAlertsSuppressed:e}}),r=180,s=190},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(42);const i=e=>{const t=Object(n.get)(["agent","type",0],e),a=Object(n.get)(["process","entity_id"],e),i=Object(n.get)(["process","entity_id",0],e),r=Object(n.get)(["event","module",0],e),s=Object(n.get)(["event","dataset"],e),o=Array.isArray(s)&&s.some((e=>e.includes("windows.sysmon"))),l="endpoint"===t||"winlogbeat"===t&&"sysmon"===r||o,c=null!=a&&1===a.length&&""!==i;return l&&c}},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(46),i=a(102),r=a(498);function s({documentId:e,isActiveTimeline:t,indices:a}){const s=Object(i.i)(),{selectedPatterns:o}=Object(r.a)(t),l=[...new Set(o.concat(a))],{loading:c,id:u,schema:d}=function({documentId:e,indices:t}){const a=Object(i.i)(),r=Object(n.useQuery)(["getAlertPrevalenceSchema",e],(()=>a.get("/api/endpoint/resolver/entity",{query:{_id:e,indices:t}})));if(r.isLoading)return{loading:!0,error:!1,id:null,schema:null};if(r.data&&r.data.length>0){const{data:[{schema:e,id:t}]}=r;return{loading:!1,error:!1,id:t,schema:e}}return{loading:!1,error:!0,id:null,schema:null}}({documentId:e,indices:l}),p=Object(n.useQuery)(["getAlertPrevalenceFromProcessTree",u],(()=>s.post("/api/endpoint/resolver/tree",{body:JSON.stringify({schema:d,ancestors:200,descendants:500,indexPatterns:l,nodes:[u],includeHits:!0})})),{enabled:null!==d&&null!==u});return p.isLoading||c?{loading:!0,error:!1,alertIds:void 0,statsNodes:void 0}:p.data?{loading:!1,error:!1,alertIds:p.data.alertIds,statsNodes:p.data.statsNodes}:{loading:!1,error:!0,alertIds:void 0,statsNodes:void 0}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return m}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(44),l=a(40),c=a(41),u=a.n(c),d=a(488);const p=u()(l.EuiButtonEmpty).withConfig({displayName:"EuiButtonEmptyStyled",componentId:"sc-1h0vyjj-0"})(["margin-bottom:",";.euiIcon{width:",";height:",";}.text{font-size:",";margin-inline-start:",";}"],(({theme:e})=>e.eui.euiSizeS),(({theme:e})=>e.eui.euiSizeM),(({theme:e})=>e.eui.euiSizeM),(({theme:e})=>e.eui.euiFontSizeXS),(({theme:e})=>e.eui.euiSizeXS)),m=Object(r.memo)((({backButtonLabel:e,backButtonUrl:t,onBackButtonNavigateTo:a,...n})=>{const r=Object(d.a)(...a);return s.a.createElement(p,i()({"data-test-subj":"backToOrigin"},n,{flush:"left",size:"xs",iconType:"arrowLeft",href:t,onClick:r,textProps:{className:"text"}}),e||s.a.createElement(o.FormattedMessage,{id:"xpack.securitySolution.list.backButton",defaultMessage:"Back"}))}));m.displayName="BackToExternalAppButton"},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(184);const i=(e,t)=>e===n.UsersType.details&&null!=t?[{fieldName:"user.name",fieldValue:t}]:[]},function(e,t,a){"use strict";let n;a.d(t,"a",(function(){return n})),function(e){e.withExceptions="withExceptions",e.withExceptionsExcludeExpiredExceptions="withExceptionsExcludeExpiredExceptions",e.withoutExceptions="withoutExceptions"}(n||(n={}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"e",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"b",(function(){return s})),a.d(t,"d",(function(){return l}));const n=e=>e.sort(((e,t)=>e.toLowerCase().localeCompare(t.toLowerCase()))),i=({query:e,searchValue:t,filterOptions:a,defaultSearchTerm:n})=>{const i=null==e?void 0:e.ast.getFieldClauses();return null!=i&&i.length>0?i.reduce(((e,{field:t,value:a})=>(e[t]=`${a}`,e)),a):{[n]:t}},r=async e=>{const t=(await e.text()).split("\n").filter(Boolean).slice(-1)[0];return JSON.parse(t)},s=async e=>{const t=await r(e);return{skipped:0,succeeded:t.exported_rules_count,failed:t.missing_rules_count,total:t.exported_rules_count+t.missing_rules_count}},o={low:0,medium:1,high:2,critical:3},l=e=>{var t;return null!==(t=o[e])&&void 0!==t?t:-1}},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));class BadRequestError extends Error{}a(760),a(761);var n=a(1137),i=a.n(n),r=a(340),s=a(4),o=a(665);const l=async({body:e,dataViewService:t,dataViewId:a})=>{if(null===a)return;let n=await t.getIdsWithTitle();const l=n.find((e=>e.id===a)),{patternList:c}=e,u=Object(r.a)(c).join();let d;if(void 0===l)try{d=await t.createAndSave({allowNoIndex:!0,id:a,title:u,timeFieldName:s.W},!0)}catch(e){const n=(e=>i.a.isBoom(e)?{message:e.output.payload.message,statusCode:e.output.statusCode}:null!=e.statusCode?null!=e.body&&null!=e.body.error?{statusCode:e.statusCode,message:`${e.body.error.type}: ${e.body.error.reason}`}:{statusCode:e.statusCode,message:e.message}:e instanceof BadRequestError?{message:e.message,statusCode:400}:{message:null!=e.message?e.message:"(unknown error message)",statusCode:500})(e);if("DuplicateDataViewError"!==e.name&&409!==n.statusCode)throw n;d=await t.get(a)}else{const e=l?Object(r.a)(l.title.split(",")).join():"";d=await t.get(a),u!==e&&(d.title=u,await t.updateSavedObject(d))}if(n.some((e=>e.id===a)))n=n.map((e=>e.id===a?{...e,title:u}:e));else if(null!==d){var p,m;n.push({id:null!==(p=d.id)&&void 0!==p?p:a,title:null===(m=d)||void 0===m?void 0:m.title})}const b=await Object(o.a)(a,t);return{defaultDataView:b,kibanaDataViews:n.map((e=>e.id===a?b:{id:e.id,patternList:e.title.split(","),title:e.title}))}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return Xt}));var n=a(2),i=a.n(n),r=a(103),s=a(40),o=a(119),l=a(115),c=a(111),u=a(133),d=a(118),p=a(105),m=a(220),b=a(130),g=a.n(b),f=a(309),y=a(476),h=a(568),v=a(348),E=a(573),x=a(867),j=a(186),S=a(266),k=a(399),O=a(748),w=a(155),T=a(1063);const I=()=>({promptContextId:void 0}),C=({browserFields:e,entityType:t="events",expandedEvent:a,handleOnEventClosed:r,isDraggable:o,isFlyoutView:l,runtimeMappings:c,tabType:u,scopeId:d,isReadOnly:p})=>{var b,g;const{hasAssistantPrivilege:C}=Object(f.a)(),M=C?m.j:I,_=Object(S.a)(),{indexName:F}=a,A=null!==(b=Object(j.a)(F,_))&&void 0!==b?b:F,[D,N,P,R,L]=Object(v.a)({entityType:t,indexName:null!=A?A:"",eventId:null!==(g=a.eventId)&&void 0!==g?g:"",runtimeMappings:c,skip:!a.eventId}),{isolateAction:B,isHostIsolationPanelOpen:q,isIsolateActionSuccessBannerVisible:z,handleIsolationActionSuccess:$,showAlertDetails:V,showHostIsolationPanel:U}=Object(E.a)(),{alertId:H,isAlert:G,hostName:Q,ruleName:W,timestamp:K}=Object(j.b)(N),Y=Object(n.useMemo)((()=>l?w.A:w.D),[l]),J=Object(n.useCallback)((async()=>Object(y.d)(null!=N?N:[])),[N]),{promptContextId:X}=M(G?"alert":"event",G?w.e:w.i,G?Object(w.d)(Y):Object(w.h)(Y),J,null,G?T.a[T.b].suggestedUserPrompt:T.a[T.d].suggestedUserPrompt,G?w.f:w.j),Z=Object(n.useMemo)((()=>l||q?i.a.createElement(x.c,{eventId:a.eventId,eventIndex:A,isHostIsolationPanelOpen:q,isAlert:G,isolateAction:B,loading:D,ruleName:W,showAlertDetails:V,timestamp:K,promptContextId:X}):i.a.createElement(h.b,{eventId:a.eventId,eventIndex:A,isAlert:G,loading:D,ruleName:W,timestamp:K,handleOnEventClosed:r,promptContextId:X})),[l,q,a.eventId,A,G,B,D,W,V,K,r,X]),ee=Object(n.useMemo)((()=>l?i.a.createElement(x.a,{alertId:H,browserFields:e,detailsData:N,detailsEcsData:R,event:a,hostName:Q,handleIsolationActionSuccess:$,handleOnEventClosed:r,isAlert:G,isDraggable:o,isolateAction:B,isIsolateActionSuccessBannerVisible:z,isHostIsolationPanelOpen:q,loading:D,rawEventData:P,showAlertDetails:V,scopeId:d,isReadOnly:p}):q?i.a.createElement(i.a.Fragment,null,z&&i.a.createElement(k.c,{hostName:Q,alertId:H,isolateAction:B}),i.a.createElement(s.EuiFlyoutBody,null,i.a.createElement(O.a,{details:N,cancelCallback:V,successCallback:$,isolateAction:B}))):i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(h.a,{browserFields:e,detailsData:N,detailsEcsData:R,event:a,isAlert:G,isDraggable:o,loading:D,rawEventData:P,scopeId:d,timelineTabType:u,handleOnEventClosed:r}))),[H,e,N,R,a,$,r,Q,G,o,l,q,z,p,B,D,P,V,u,d]);return null!=a&&a.eventId?i.a.createElement(i.a.Fragment,null,Z,ee,i.a.createElement(x.b,{detailsData:N,detailsEcsData:R,refetchFlyoutData:L,handleOnEventClosed:r,isHostIsolationPanelOpen:q,isReadOnly:p,loadingEventDetails:D,onAddIsolationStatusClick:U,scopeId:d})):null},M=i.a.memo(C,((e,t)=>g()(e.browserFields,t.browserFields)&&g()(e.expandedEvent,t.expandedEvent)&&e.scopeId===t.scopeId&&e.isDraggable===t.isDraggable));var _=a(5),F=a(41),A=a.n(F),D=a(114),N=a(123),P=a(134),R=a(116),L=a(879),B=a(151),q=a(367),z=a(647),$=a(298),V=a(663);const U=A.a.h4.withConfig({displayName:"StyledTitle",componentId:"sc-1xbsnt9-0"})(["word-break:break-all;word-wrap:break-word;white-space:pre-wrap;"]),H=({hostName:e})=>i.a.createElement(s.EuiTitle,{size:"s"},i.a.createElement(U,null,_.i18n.translate("xpack.securitySolution.timeline.sidePanel.hostDetails.title",{defaultMessage:"Host details"}),`: ${e}`)),G=({hostName:e})=>i.a.createElement(N.d,{hostName:e,isButton:!0},_.i18n.translate("xpack.securitySolution.timeline.sidePanel.hostDetails.hostDetailsPageLink",{defaultMessage:"View details page"})),Q=({contextID:e,scopeId:t,hostName:a,isDraggable:s=!1})=>{const{to:o,from:c,isInitializing:u}=Object(P.a)(),{selectedPatterns:d}=Object(R.d)(),p=Object(r.useDispatch)(),[m,{hostDetails:b}]=Object(V.b)({endDate:o,hostName:a,indexNames:d,startDate:c}),g=Object(n.useCallback)(((e,t)=>{const a=Object($.a)(e,t);p(Object(B.setAbsoluteRangeDatePicker)({id:D.a.global,from:a.from,to:a.to}))}),[p]);return i.a.createElement(q.a,{criteriaFields:Object(z.a)(b),startDate:c,endDate:o,skip:u},(({isLoadingAnomaliesData:n,anomaliesData:r,jobNameById:u})=>i.a.createElement(L.a,{contextID:e,sourcererScopeId:Object(l.getSourcererScopeId)(t),id:V.a,isInDetailsSidePanel:!0,data:b,anomaliesData:r,isDraggable:s,isLoadingAnomaliesData:n,indexNames:d,loading:m,startDate:c,endDate:o,narrowDateRange:g,hostName:a,jobNameById:u})))},W=A()(s.EuiFlyoutBody).withConfig({displayName:"StyledEuiFlyoutBody",componentId:"sc-1i9mt5q-0"})([".euiFlyoutBody__overflow{display:flex;flex:1;overflow:hidden;.euiFlyoutBody__overflowContent{flex:1;overflow-x:hidden;overflow-y:scroll;margin-bottom:64px;padding:",";}}"],(({theme:e})=>`${e.eui.euiSizeXS} ${e.eui.euiSizeM} 0px`)),K=A()(s.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-1i9mt5q-1"})(["flex:1 0 auto;"]),Y=A()(s.EuiFlexItem).withConfig({displayName:"StyledEuiFlexButtonWrapper",componentId:"sc-1i9mt5q-2"})(["align-self:flex-start;flex:1 0 auto;"]),J=A.a.div.withConfig({displayName:"StyledPanelContent",componentId:"sc-1i9mt5q-3"})(["display:block;height:100%;overflow-y:scroll;overflow-x:hidden;"]),X=i.a.memo((({contextID:e,scopeId:t,expandedHost:a,handleOnHostClosed:n,isDraggable:r,isFlyoutView:o})=>{const{hostName:l}=a;return l?o?i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiFlyoutHeader,{hasBorder:!0},i.a.createElement(H,{hostName:l})),i.a.createElement(W,null,i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(G,{hostName:l}),i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(Q,{contextID:e,scopeId:t,hostName:l}))):i.a.createElement(i.a.Fragment,null,i.a.createElement(K,{justifyContent:"spaceBetween",wrap:!1},i.a.createElement(s.EuiFlexItem,{grow:!1},i.a.createElement(H,{hostName:l})),i.a.createElement(s.EuiFlexItem,{grow:!1},i.a.createElement(s.EuiButtonIcon,{iconType:"cross","aria-label":_.i18n.translate("xpack.securitySolution.timeline.sidePanel.hostDetails.close",{defaultMessage:"close"}),onClick:n}))),i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(Y,{grow:!1},i.a.createElement(G,{hostName:l})),i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(J,null,i.a.createElement(Q,{contextID:e,scopeId:t,hostName:l,isDraggable:r}))):null}));var Z=a(51),ee=a(273),te=a(1098),ae=a(1099),ne=a(102),ie=a(161),re=a(122),se=a(1130),oe=a(280),le=a(610),ce=a(385),ue=a(416);const de=A.a.h4.withConfig({displayName:"StyledTitle",componentId:"sc-1jm2ava-0"})(["word-break:break-all;word-wrap:break-word;white-space:pre-wrap;"]),pe=({ip:e})=>i.a.createElement(s.EuiTitle,{size:"s"},i.a.createElement(de,null,_.i18n.translate("xpack.securitySolution.timeline.sidePanel.networkDetails.title",{defaultMessage:"Network details"}),`: ${e}`)),me=({expandedNetwork:{ip:e,flowTarget:t}})=>i.a.createElement(N.h,{ip:e,flowTarget:t,isButton:!0},_.i18n.translate("xpack.securitySolution.timeline.sidePanel.networkDetails.networkDetailsPageLink",{defaultMessage:"View details page"})),be=({contextID:e,expandedNetwork:t,isDraggable:a})=>{const{ip:s,flowTarget:o}=t,l=Object(r.useDispatch)(),{to:c,from:u,isInitializing:d}=Object(P.a)(),m=Object(n.useMemo)((()=>re.d.globalQuerySelector()),[]),b=Object(n.useMemo)((()=>re.d.globalFiltersQuerySelector()),[]),g=Object(p.a)(m),f=Object(p.a)(b),y=oe.c.NetworkType.details,h=Object(n.useCallback)(((e,t)=>{const a=Object($.a)(e,t);l(Object(B.setAbsoluteRangeDatePicker)({id:D.a.global,from:a.from,to:a.to}))}),[l]),{services:{uiSettings:v}}=Object(ne.j)(),{indicesExist:E,indexPattern:x,selectedPatterns:j}=Object(R.d)(),[S,k]=Object(ie.i)({config:Object(Z.getEsQueryConfig)(v),indexPattern:x,queries:[g],filters:f}),[O,{id:w,networkDetails:T}]=Object(se.b)({skip:d||void 0===S,filterQuery:S,indexNames:j,ip:s});Object(ee.a)({id:w,filterQuery:S,kqlError:k,query:g,startDate:u,endDate:c});const{jobNameById:I}=Object(ce.a)(),C=Object(n.useMemo)((()=>Object.keys(I)),[I]),[M,_]=Object(le.a)({criteriaFields:Object(ae.a)(s,o),startDate:u,endDate:c,skip:d,jobIds:C,aggregationInterval:"auto"});return E?i.a.createElement(te.a,{contextID:e,id:w,ip:s,data:T,anomaliesData:_,loading:O,isInDetailsSidePanel:!0,isLoadingAnomaliesData:M,isDraggable:a,type:y,flowTarget:o,startDate:u,endDate:c,narrowDateRange:h,indexPatterns:j,jobNameById:I}):i.a.createElement(ue.a,null)},ge=A()(s.EuiFlyoutBody).withConfig({displayName:"StyledEuiFlyoutBody",componentId:"sc-1tify25-0"})([".euiFlyoutBody__overflow{display:flex;flex:1;overflow-x:hidden;overflow-y:scroll;.euiFlyoutBody__overflowContent{flex:1;overflow-x:hidden;overflow-y:scroll;padding:",";}}"],(({theme:e})=>`${e.eui.euiSizeXS} ${e.eui.euiSizeM} 64px`)),fe=A()(s.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-1tify25-1"})(["flex:1 0 auto;"]),ye=A()(s.EuiFlexItem).withConfig({displayName:"StyledEuiFlexButtonWrapper",componentId:"sc-1tify25-2"})(["align-self:flex-start;flex:1 0 auto;"]),he=A.a.div.withConfig({displayName:"StyledPanelContent",componentId:"sc-1tify25-3"})(["display:block;height:100%;overflow-y:scroll;overflow-x:hidden;"]),ve=i.a.memo((({contextID:e,expandedNetwork:t,handleOnNetworkClosed:a,isFlyoutView:n,isDraggable:r})=>{const{ip:o}=t;return n?i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiFlyoutHeader,{hasBorder:!0},i.a.createElement(pe,{ip:o})),i.a.createElement(ge,null,i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(me,{expandedNetwork:t}),i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(be,{contextID:e,expandedNetwork:t}))):i.a.createElement(i.a.Fragment,null,i.a.createElement(fe,{justifyContent:"spaceBetween",wrap:!1},i.a.createElement(s.EuiFlexItem,{grow:!1},i.a.createElement(pe,{ip:o})),i.a.createElement(s.EuiFlexItem,{grow:!1},i.a.createElement(s.EuiButtonIcon,{iconType:"cross","aria-label":_.i18n.translate("xpack.securitySolution.timeline.sidePanel.networkDetails.close",{defaultMessage:"close"}),onClick:a}))),i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(ye,{grow:!1},i.a.createElement(me,{expandedNetwork:t})),i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(he,null,i.a.createElement(be,{contextID:e,expandedNetwork:t,isDraggable:r})))}));var Ee=a(21),xe=a(797),je=a(386),Se=a(686),ke=a(184);const Oe=A.a.h4.withConfig({displayName:"StyledTitle",componentId:"sc-19b6yfb-0"})(["word-break:break-all;word-wrap:break-word;white-space:pre-wrap;"]),we=({userName:e})=>i.a.createElement(s.EuiTitle,{size:"s"},i.a.createElement(Oe,null,_.i18n.translate("xpack.securitySolution.timeline.sidePanel.userDetails.title",{defaultMessage:"User details"}),`: ${e}`)),Te=({userName:e})=>i.a.createElement(N.m,{userName:e,isButton:!0},_.i18n.translate("xpack.securitySolution.timeline.sidePanel.networkDetails.userDetails",{defaultMessage:"View details page"})),Ie=({contextID:e,scopeId:t,userName:a,isDraggable:s})=>{const{to:o,from:c,isInitializing:u}=Object(P.a)(),{selectedPatterns:d}=Object(R.d)(),p=Object(r.useDispatch)(),[m,{userDetails:b}]=Object(je.b)({endDate:o,startDate:c,userName:a,indexNames:d,skip:u}),g=Object(n.useCallback)(((e,t)=>{const a=Object($.a)(e,t);p(Object(B.setAbsoluteRangeDatePicker)({id:D.a.global,from:a.from,to:a.to}))}),[p]);return i.a.createElement(q.a,{criteriaFields:Object(Se.a)(ke.UsersType.details,a),startDate:c,endDate:o,skip:u},(({isLoadingAnomaliesData:n,anomaliesData:r,jobNameById:u})=>i.a.createElement(xe.a,{userName:a,isInDetailsSidePanel:!0,data:b,loading:m,contextID:e,sourcererScopeId:Object(l.getSourcererScopeId)(t),isDraggable:s,id:"usersDetailsQuery",anomaliesData:r,isLoadingAnomaliesData:n,startDate:c,endDate:o,narrowDateRange:g,indexPatterns:d,jobNameById:u})))},Ce=A()(s.EuiFlyoutBody).withConfig({displayName:"StyledEuiFlyoutBody",componentId:"sc-iwngk-0"})([".euiFlyoutBody__overflow{display:flex;flex:1;overflow-x:hidden;overflow-y:scroll;.euiFlyoutBody__overflowContent{flex:1;overflow-x:hidden;overflow-y:scroll;padding:",";}}"],(({theme:e})=>`${e.eui.euiSizeXS} ${e.eui.euiSizeM} 64px`)),Me=({contextID:e,scopeId:t,userName:a})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiFlyoutHeader,{hasBorder:!0},i.a.createElement(we,{userName:a})),i.a.createElement(Ce,null,i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(Te,{userName:a}),i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(Ie,{contextID:e,scopeId:t,userName:a}))),_e=A()(s.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-190swzt-0"})(["flex:1 0 auto;"]),Fe=A()(s.EuiFlexItem).withConfig({displayName:"StyledEuiFlexButtonWrapper",componentId:"sc-190swzt-1"})(["align-self:flex-start;flex:1 0 auto;"]),Ae=A.a.div.withConfig({displayName:"StyledPanelContent",componentId:"sc-190swzt-2"})(["display:block;height:100%;overflow-y:scroll;overflow-x:hidden;"]),De=({contextID:e,scopeId:t,userName:a,isDraggable:n,handleOnClose:r})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(_e,{justifyContent:"spaceBetween",wrap:!1},i.a.createElement(s.EuiFlexItem,{grow:!1},i.a.createElement(we,{userName:a})),i.a.createElement(s.EuiFlexItem,{grow:!1},i.a.createElement(s.EuiButtonIcon,{iconType:"cross","aria-label":_.i18n.translate("xpack.securitySolution.timeline.sidePanel.networkDetails.close",{defaultMessage:"close"}),onClick:r}))),i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(Fe,{grow:!1},i.a.createElement(Te,{userName:a})),i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(Ae,null,i.a.createElement(Ie,{contextID:e,scopeId:t,userName:a,isDraggable:n})));var Ne=a(8);const Pe=_.i18n.translate("xpack.securitySolution.timeline.userDetails.observedBadge",{defaultMessage:"OBSERVED"}),Re=_.i18n.translate("xpack.securitySolution.timeline.userDetails.managedBadge",{defaultMessage:"MANAGED"}),Le=_.i18n.translate("xpack.securitySolution.timeline.userDetails.userLabel",{defaultMessage:"User"}),Be=_.i18n.translate("xpack.securitySolution.timeline.userDetails.failManagedUserDescription",{defaultMessage:"Failed to run search on user managed data"}),qe=_.i18n.translate("xpack.securitySolution.timeline.userDetails.managedDataTitle",{defaultMessage:"Managed data"}),ze=_.i18n.translate("xpack.securitySolution.timeline.userDetails.observedDataTitle",{defaultMessage:"Observed data"}),$e=_.i18n.translate("xpack.securitySolution.timeline.userDetails.hideObservedDataButton",{defaultMessage:"Hide observed data"}),Ve=_.i18n.translate("xpack.securitySolution.timeline.userDetails.showObservedDataButton",{defaultMessage:"Show observed data"}),Ue=_.i18n.translate("xpack.securitySolution.timeline.userDetails.hideManagedDataButton",{defaultMessage:"Hide Azure AD data"}),He=_.i18n.translate("xpack.securitySolution.timeline.userDetails.showManagedDataButton",{defaultMessage:"Show Azure AD data"}),Ge=_.i18n.translate("xpack.securitySolution.timeline.userDetails.riskScoreLabel",{defaultMessage:"Risk score"}),Qe=_.i18n.translate("xpack.securitySolution.timeline.userDetails.valuesColumnTitle",{defaultMessage:"Values"}),We=_.i18n.translate("xpack.securitySolution.timeline.userDetails.fieldColumnTitle",{defaultMessage:"Field"}),Ke=_.i18n.translate("xpack.securitySolution.timeline.userDetails.userIdLabel",{defaultMessage:"User ID"}),Ye=_.i18n.translate("xpack.securitySolution.timeline.userDetails.maxAnomalyScoreByJobLabel",{defaultMessage:"Max anomaly score by job"}),Je=_.i18n.translate("xpack.securitySolution.timeline.userDetails.firstSeenLabel",{defaultMessage:"First seen"}),Xe=_.i18n.translate("xpack.securitySolution.timeline.userDetails.lastSeenLabel",{defaultMessage:"Last seen"}),Ze=_.i18n.translate("xpack.securitySolution.timeline.userDetails.hostOsNameLabel",{defaultMessage:"Operating system"}),et=_.i18n.translate("xpack.securitySolution.timeline.userDetails.familyLabel",{defaultMessage:"Family"}),tt=_.i18n.translate("xpack.securitySolution.timeline.userDetails.ipAddressesLabel",{defaultMessage:"IP addresses"}),at=_.i18n.translate("xpack.securitySolution.timeline.userDetails.fullNameLabel",{defaultMessage:"Full name"}),nt=_.i18n.translate("xpack.securitySolution.timeline.userDetails.firstNameLabel",{defaultMessage:"First name"}),it=_.i18n.translate("xpack.securitySolution.timeline.userDetails.lastNameLabel",{defaultMessage:"Last name"}),rt=_.i18n.translate("xpack.securitySolution.timeline.userDetails.phoneLabel",{defaultMessage:"Phone"}),st=_.i18n.translate("xpack.securitySolution.timeline.userDetails.noActiveIntegrationTitle",{defaultMessage:"You don’t have any active integrations"}),ot=_.i18n.translate("xpack.securitySolution.timeline.userDetails.noActiveIntegrationText",{defaultMessage:"External integrations can provide additional metadata and help you manage users."}),lt=_.i18n.translate("xpack.securitySolution.timeline.userDetails.addExternalIntegrationButton",{defaultMessage:"Add external integrations"}),ct=_.i18n.translate("xpack.securitySolution.timeline.userDetails.noAzureDataTitle",{defaultMessage:"No metadata found for this user"}),ut=_.i18n.translate("xpack.securitySolution.timeline.userDetails.noAzureDataText",{defaultMessage:"If you expected to see metadata for this user, make sure you have configured your integrations properly."}),dt=(_.i18n.translate("xpack.securitySolution.timeline.userDetails.closeButton",{defaultMessage:"close"}),_.i18n.translate("xpack.securitySolution.timeline.userDetails.observedUserInspectTitle",{defaultMessage:"Observed user"})),pt=_.i18n.translate("xpack.securitySolution.timeline.userDetails.managedUserInspectTitle",{defaultMessage:"Managed user"});var mt=a(113),bt=a(284),gt=a(194),ft=a(886),yt=a(872);const ht=["logs-entityanalytics_azure.users-*"],vt="entityanalytics_azure",Et=`/detail/${vt}/overview`,xt="managedUserDetailsQuery";var jt=a(218),St=a(132),kt=a(117),Ot=a(212);const wt=({riskScoreState:e})=>{const{euiTheme:t}=Object(s.useEuiTheme)(),{fontSize:a}=Object(s.useEuiFontSize)("xs"),{data:n,isAuthorized:r}=e,o=n&&n.length>0?n[0]:void 0;return r?i.a.createElement(s.EuiFlexGroup,{alignItems:"center",gutterSize:"none",responsive:!1,"data-test-subj":"user-details-risk-score"},i.a.createElement(s.EuiFlexItem,{grow:!1},i.a.createElement(Tt,{$_css:t.font.weight.bold,$_css2:a,$_css3:t.size.xs},Ge,": ")),o?i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiFlexItem,{grow:!1},Math.round(o.user.risk.calculated_score_norm)),i.a.createElement(s.EuiFlexItem,{grow:!1},i.a.createElement(Ot.b,{severity:mt.y.high,hideBackgroundColor:!0}))):Object(kt.d)()):null};var Tt=A()("span").withConfig({displayName:"_StyledSpan",componentId:"sc-18knn5l-0"})(["font-weight:",";font-size:",";margin-right:",";"],(e=>e.$_css),(e=>e.$_css2),(e=>e.$_css3)),It=a(44),Ct=a(649),Mt=a(42),_t=a(48),Ft=a(224),At=a(473);const Dt={name:We,field:"label",render:e=>i.a.createElement(Pt,{$_css:_t.euiLightVars.euiFontWeightMedium,$_css2:_t.euiLightVars.euiTitleColor},e)},Nt=({anomalies:e})=>{const{to:t,from:a}=Object(P.a)(),s=Object(r.useDispatch)(),o=Object(n.useCallback)(((e,t)=>{const a=Object($.a)(e,t);s(Object(B.setAbsoluteRangeDatePicker)({id:D.a.global,from:a.from,to:a.to}))}),[s]);return i.a.createElement(At.a,{anomalies:e.anomalies,startDate:a,endDate:t,isLoading:e.isLoading,narrowDateRange:o,jobNameById:e.jobNameById})};var Pt=A()("span").withConfig({displayName:"_StyledSpan",componentId:"sc-1eh5srw-0"})(["font-weight:",";color:",";"],(e=>e.$_css),(e=>e.$_css2)),Rt=a(149);const Lt=({observedUser:e,contextID:t,scopeId:a,isDraggable:r})=>{const{euiTheme:o}=Object(s.useEuiTheme)(),c=(u=e,Object(n.useMemo)((()=>{var e,t,a,n,i,r,s;return u.details?[{label:Ke,values:null===(e=u.details.user)||void 0===e?void 0:e.id,field:"user.id"},{label:"Domain",values:null===(t=u.details.user)||void 0===t?void 0:t.domain,field:"user.domain"},{label:Ye,field:"anomalies",values:u.anomalies},{label:Je,values:u.firstSeen.date?[u.firstSeen.date]:void 0,field:"@timestamp"},{label:Xe,values:u.lastSeen.date?[u.lastSeen.date]:void 0,field:"@timestamp"},{label:Ze,values:null===(a=u.details.host)||void 0===a||null===(n=a.os)||void 0===n?void 0:n.name,field:"host.os.name"},{label:et,values:null===(i=u.details.host)||void 0===i||null===(r=i.os)||void 0===r?void 0:r.family,field:"host.os.family"},{label:tt,values:null===(s=u.details.host)||void 0===s?void 0:s.ip,field:"host.ip"}]:[]}),[u.details,u.anomalies,u.firstSeen,u.lastSeen]));var u;const[d,p]=Object(n.useState)(!1),m=Object(n.useCallback)((()=>{p((e=>!e))}),[p]),b=Object(n.useMemo)((()=>((e,t,a)=>[Dt,{name:Qe,field:"values",render:(n,{field:r})=>function(e,t){return"anomalies"===e}(r)&&n?i.a.createElement(Nt,{anomalies:n}):"@timestamp"===r?i.a.createElement(St.b,{value:Object(Mt.head)(n)}):i.a.createElement(Ft.a,{rowItems:n,attrName:r,idPrefix:e?`observedUser-${e}`:"observedUser",isDraggable:a,sourcererScopeId:Object(l.getSourcererScopeId)(t)})}])(t,a,r)),[t,a,r]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiTitle,{size:"s"},i.a.createElement("h5",null,ze)),i.a.createElement(s.EuiSpacer,{size:"l"}),i.a.createElement(Rt.c,null,i.a.createElement(qt,{isLoading:e.isLoading,id:"observedUser-data","data-test-subj":"observedUser-data",forceState:d?"open":"closed",buttonProps:{"data-test-subj":"observedUser-accordion-button",css:Ee.css`
              color: ${o.colors.primary};
            `},buttonContent:d?$e:Ve,onToggle:m,extraAction:i.a.createElement(i.a.Fragment,null,i.a.createElement(Bt,{$_css:o.size.s},i.a.createElement(Rt.b,{queryId:je.a,title:dt})),e.lastSeen.date&&i.a.createElement(It.FormattedMessage,{id:"xpack.securitySolution.timeline.userDetails.observedUserUpdatedTime",defaultMessage:"Updated {time}",values:{time:i.a.createElement(St.b,{value:e.lastSeen.date,dateFormat:"MMM D, YYYY",relativeThresholdInHrs:168})}}))},i.a.createElement(s.EuiPanel,{color:"subdued"},i.a.createElement(Ct.a,{loading:e.isLoading||e.firstSeen.isLoading||e.lastSeen.isLoading||e.anomalies.isLoading,"data-test-subj":"observedUser-table",columns:b,items:c})))))};var Bt=A()("span").withConfig({displayName:"_StyledSpan",componentId:"sc-czrrgy-0"})(["margin-right:",";"],(e=>e.$_css)),qt=A()(s.EuiAccordion).withConfig({displayName:"_StyledEuiAccordion",componentId:"sc-czrrgy-1"})([".euiAccordion__optionalAction{margin-left:auto;}"]);const zt=({managedUser:e,contextID:t,scopeId:a,isDraggable:r})=>{const{euiTheme:o}=Object(s.useEuiTheme)(),c=(u=e.details,Object(n.useMemo)((()=>{var e;return u?[{label:Ke,value:u.user.id,field:"user.id"},{label:at,value:u.user.full_name,field:"user.full_name"},{label:nt,value:u.user.first_name},{label:it,value:u.user.last_name},{label:rt,value:null===(e=u.user.phone)||void 0===e?void 0:e.join(", ")}]:null}),[u]));var u;const[d,p]=Object(n.useState)(!1),m=Object(n.useCallback)((()=>{p((e=>!e))}),[p]),b=Object(n.useMemo)((()=>((e,t,a)=>[Dt,{name:Qe,field:"value",render:(n,{field:r})=>r&&n?i.a.createElement(Ft.a,{rowItems:[n],attrName:r,idPrefix:e?`managedUser-${e}`:"managedUser",isDraggable:a,sourcererScopeId:Object(l.getSourcererScopeId)(t)}):Object(kt.a)(n)}])(t,a,r)),[r,t,a]),{getAppUrl:g}=Object(ne.c)(),f=Object(n.useMemo)((()=>g({appId:"integrations",path:Et})),[g]);return e.isLoading||e.isIntegrationEnabled?i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiTitle,{size:"s"},i.a.createElement("h5",null,qe)),i.a.createElement(s.EuiSpacer,{size:"l"}),i.a.createElement(Rt.c,null,i.a.createElement(Vt,{isLoading:e.isLoading,id:"managedUser-data","data-test-subj":"managedUser-data",forceState:d?"open":"closed",buttonProps:{"data-test-subj":"managedUser-accordion-button",css:Ee.css`
              color: ${o.colors.primary};
            `},buttonContent:d?Ue:He,onToggle:m,extraAction:i.a.createElement(i.a.Fragment,null,i.a.createElement($t,{$_css:o.size.s},i.a.createElement(Rt.b,{queryId:xt,title:pt})),e.lastSeen.date&&i.a.createElement(It.FormattedMessage,{id:"xpack.securitySolution.timeline.userDetails.updatedTime",defaultMessage:"Updated {time}",values:{time:i.a.createElement(St.b,{value:e.lastSeen.date,dateFormat:"MMM D, YYYY",relativeThresholdInHrs:168})}}))},i.a.createElement(s.EuiPanel,{color:"subdued"},c||e.isLoading?i.a.createElement(Ct.a,{loading:e.isLoading,"data-test-subj":"managedUser-table",columns:b,items:null!=c?c:[]}):i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiCallOut,{"data-test-subj":"managedUser-no-data",title:ct,color:"warning",iconType:"help"},i.a.createElement("p",null,ut))))))):i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiTitle,{size:"s"},i.a.createElement("h5",null,qe)),i.a.createElement(s.EuiSpacer,{size:"l"}),i.a.createElement(s.EuiPanel,{"data-test-subj":"managedUser-integration-disable-callout"},i.a.createElement(s.EuiEmptyPrompt,{title:i.a.createElement("h2",null,st),body:i.a.createElement("p",null,ot),actions:i.a.createElement(s.EuiButton,{fill:!0,href:f},lt)})))};var $t=A()("span").withConfig({displayName:"_StyledSpan",componentId:"sc-nbm1eh-0"})(["margin-right:",";"],(e=>e.$_css)),Vt=A()(s.EuiAccordion).withConfig({displayName:"_StyledEuiAccordion",componentId:"sc-nbm1eh-1"})([".euiAccordion__optionalAction{margin-left:auto;}"]);const Ut=({userName:e,observedUser:t,managedUser:a,riskScoreState:r,contextID:o,scopeId:l,isDraggable:c})=>{const{euiTheme:u}=Object(s.useEuiTheme)(),{fontSize:d}=Object(s.useEuiFontSize)("xl"),p=Object(n.useMemo)((()=>Object(Ne.max)([t.lastSeen,a.lastSeen].map((e=>e.date&&new Date(e.date))))),[a.lastSeen,t.lastSeen]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiFlexGroup,{gutterSize:"m",alignItems:"center",responsive:!1,"data-test-subj":"user-details-content-header"},i.a.createElement(s.EuiFlexItem,{grow:!1},i.a.createElement(s.EuiIcon,{type:"user",size:"m"})),i.a.createElement(s.EuiFlexItem,{grow:!1},Le),i.a.createElement(s.EuiFlexItem,{grow:!1},t.lastSeen.date&&i.a.createElement(s.EuiBadge,{"data-test-subj":"user-details-content-observed-badge",color:"hollow"},Pe)),i.a.createElement(s.EuiFlexItem,{grow:!1},a.lastSeen.date&&i.a.createElement(s.EuiBadge,{"data-test-subj":"user-details-content-managed-badge",color:"hollow"},Re))),i.a.createElement(s.EuiSpacer,{size:"m"}),t.lastSeen.isLoading||a.lastSeen.isLoading?i.a.createElement(s.EuiProgress,{size:"xs",color:"accent"}):i.a.createElement(s.EuiHorizontalRule,{margin:"none"}),i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(N.m,{userName:e},i.a.createElement(Gt,{$_css:d,$_css2:u.font.weight.bold,$_css3:Object(s.euiTextBreakWord)()},e)),i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(s.EuiText,{size:"xs","data-test-subj":"user-details-content-lastSeen"},Xe,": ",p&&i.a.createElement(St.c,{value:p})),i.a.createElement(s.EuiHorizontalRule,{margin:"xs"}),i.a.createElement(wt,{riskScoreState:r}),i.a.createElement(s.EuiHorizontalRule,{margin:"xs"}),i.a.createElement(s.EuiSpacer,{size:"xxl"}),i.a.createElement(Lt,{observedUser:t,contextID:o,scopeId:l,isDraggable:c}),i.a.createElement(s.EuiSpacer,null),i.a.createElement(zt,{managedUser:a,contextID:o,scopeId:l,isDraggable:c}))},Ht=({userName:e,contextID:t,scopeId:a,isDraggable:r=!1})=>{const{to:s,from:o,isInitializing:l}=Object(P.a)(),c=Object(bt.c)({riskEntity:mt.w.user}),u=(e=>{const{selectedPatterns:t}=Object(R.d)(),{to:a,from:i,isInitializing:r,deleteQuery:s,setQuery:o}=Object(P.a)(),[l,{userDetails:c,inspect:u,refetch:d,id:p}]=Object(je.b)({endDate:a,startDate:i,userName:e,indexNames:t,skip:r});Object(jt.b)({deleteQuery:s,inspect:u,refetch:d,setQuery:o,queryId:p,loading:l});const[m,{firstSeen:b}]=Object(ft.a)({field:"user.name",value:e,defaultIndex:t,order:mt.b.asc,filterQuery:mt.m}),[g,{lastSeen:f}]=Object(ft.a)({field:"user.name",value:e,defaultIndex:t,order:mt.b.desc,filterQuery:mt.m});return Object(n.useMemo)((()=>({details:c,isLoading:l,firstSeen:{date:b,isLoading:m},lastSeen:{date:f,isLoading:g}})),[b,f,m,g,l,c])})(e),d=(e=>{const{to:t,from:a,isInitializing:i,deleteQuery:r,setQuery:s}=Object(P.a)(),{loading:o,result:{userDetails:l},search:c,refetch:u,inspect:d}=Object(gt.a)({factoryQueryType:mt.B.managedDetails,initialResult:{},errorMessage:Be});Object(n.useEffect)((()=>{i||c({defaultIndex:ht,factoryQueryType:mt.B.managedDetails,userName:e})}),[a,c,t,e,i]);const{data:p,isLoading:m}=Object(yt.a)({packages:[vt]});Object(jt.b)({deleteQuery:r,inspect:d,refetch:u,setQuery:s,queryId:xt,loading:o});const b=Object(n.useMemo)((()=>!(null==p||!p.some((({package_name:e,is_enabled:t})=>e===vt&&t)))),[p]),[g,{firstSeen:f}]=Object(ft.a)({field:"user.name",value:e,defaultIndex:ht,order:mt.b.asc}),[y,{lastSeen:h}]=Object(ft.a)({field:"user.name",value:e,defaultIndex:ht,order:mt.b.desc});return Object(n.useMemo)((()=>({details:l,isLoading:o||m,isIntegrationEnabled:b,firstSeen:{date:f,isLoading:g},lastSeen:{date:h,isLoading:y}})),[f,b,m,h,g,y,o,l])})(e);return i.a.createElement(q.a,{criteriaFields:Object(Se.a)(ke.UsersType.details,e),startDate:o,endDate:s,skip:l},(({isLoadingAnomaliesData:n,anomaliesData:s,jobNameById:o})=>i.a.createElement(Ut,{userName:e,managedUser:d,observedUser:{...u,anomalies:{isLoading:n,anomalies:s,jobNameById:o}},riskScoreState:c,contextID:t,scopeId:a,isDraggable:r})))};var Gt=A()("span").withConfig({displayName:"_StyledSpan",componentId:"sc-1yxtora-0"})(["font-size:",";font-weight:",";",""],(e=>e.$_css),(e=>e.$_css2),(e=>e.$_css3));const Qt=_.i18n.translate("xpack.securitySolution.timeline.userDetails.closeButton",{defaultMessage:"close"}),Wt=({contextID:e,scopeId:t,userName:a,handleOnClose:n,isFlyoutView:r,isDraggable:o,isNewUserDetailsFlyoutEnable:l})=>l?r?i.a.createElement(s.EuiFlyoutBody,null,i.a.createElement(Ht,{userName:a,contextID:e,scopeId:t,isDraggable:o})):i.a.createElement("div",{className:"eui-yScroll"},i.a.createElement(s.EuiSpacer,{size:"m"}),i.a.createElement(Yt,{iconType:"cross","aria-label":Qt,onClick:n}),i.a.createElement(Ht,{userName:a,contextID:e,scopeId:t,isDraggable:o})):r?i.a.createElement(Me,{userName:a,contextID:e,scopeId:t}):i.a.createElement(De,{userName:a,contextID:e,isDraggable:o,handleOnClose:n,scopeId:t}),Kt=i.a.memo(Wt);var Yt=A()(s.EuiButtonIcon).withConfig({displayName:"_StyledEuiButtonIcon",componentId:"sc-uienxr-0"})(["float:right;"]),Jt=a(124);const Xt=i.a.memo((({browserFields:e,entityType:t,handleOnPanelClosed:a,isFlyoutView:m,runtimeMappings:b,tabType:g,scopeId:f,isReadOnly:y})=>{var h,v,E,x;const j=Object(r.useDispatch)(),S=Object(Jt.a)("newUserDetailsFlyout"),k=Object(n.useMemo)((()=>Object(l.isTimelineScope)(f)?c.b.getTimelineByIdSelector():Object(l.isInTableScope)(f)?o.j.getTableByIdSelector():void 0),[f]),O=Object(p.a)((e=>{var t,a;return null===(t=null!==(a=k&&k(e,f))&&void 0!==a?a:u.b)||void 0===t?void 0:t.expandedDetail}));Object(n.useEffect)((()=>()=>{j(o.h.toggleDetailPanel({id:f}))}),[j,f]);const w=Object(n.useCallback)((()=>{const e=Object(l.getScopedActions)(f);e&&j(e.toggleDetailPanel({id:f}))}),[j,f]),T=null!=g?g:d.d.query,I=Object(n.useCallback)((()=>{a?a():w()}),[w,a]);if(!O)return null;const C=O[T];if(null==C||!C.panelView)return null;let _=null,F="s",A=f;const D=`${f}-${T}`,N=f===d.c.active&&T===d.d.query;return"eventDetail"===(null==C?void 0:C.panelView)&&null!=C&&null!==(h=C.params)&&void 0!==h&&h.eventId&&(F="m",A=C.params.eventId,_=i.a.createElement(M,{browserFields:e,entityType:t,expandedEvent:null==C?void 0:C.params,handleOnEventClosed:I,isDraggable:N,isFlyoutView:m,runtimeMappings:b,tabType:T,scopeId:f,isReadOnly:y})),"hostDetail"===(null==C?void 0:C.panelView)&&null!=C&&null!==(v=C.params)&&void 0!==v&&v.hostName&&(A=C.params.hostName,_=i.a.createElement(X,{contextID:D,expandedHost:null==C?void 0:C.params,handleOnHostClosed:I,isDraggable:N,isFlyoutView:m,scopeId:f})),"userDetail"===(null==C?void 0:C.panelView)&&null!=C&&null!==(E=C.params)&&void 0!==E&&E.userName&&(A=C.params.userName,S&&(F="m"),_=i.a.createElement(Kt,{contextID:D,userName:C.params.userName,handleOnClose:I,isDraggable:N,isFlyoutView:m,isNewUserDetailsFlyoutEnable:S,scopeId:f})),"networkDetail"===(null==C?void 0:C.panelView)&&null!=C&&null!==(x=C.params)&&void 0!==x&&x.ip&&(A=C.params.ip,_=i.a.createElement(ve,{contextID:D,expandedNetwork:null==C?void 0:C.params,handleOnNetworkClosed:I,isDraggable:N,isFlyoutView:m})),m?i.a.createElement(s.EuiFlyout,{"data-test-subj":"timeline:details-panel:flyout",size:F,onClose:I,ownFocus:!1,key:A},_):_}));Xt.displayName="DetailsPanel"},function(e,t,a){"use strict";a.d(t,"d",(function(){return g.d})),a.d(t,"a",(function(){return g.a})),a.d(t,"f",(function(){return g.f})),a.d(t,"c",(function(){return g.c})),a.d(t,"e",(function(){return g.e})),a.d(t,"b",(function(){return g.b}));var n=a(43),i=a(112);n.exact(n.type({rules_custom_installed:i.n,rules_installed:i.n,rules_not_installed:i.n,rules_not_updated:i.n,timelines_installed:i.n,timelines_not_installed:i.n,timelines_not_updated:i.n})),n.exact(n.type({rules_installed:i.n,rules_updated:i.n,timelines_installed:i.n,timelines_updated:i.n}));const r=n.exact(n.type({rule_id:n.string,version:n.number})),s=n.exact(n.type({mode:n.literal("SPECIFIC_RULES"),rules:n.array(r)})),o=n.exact(n.type({mode:n.literal("ALL_RULES")}));let l,c;n.union([o,s]),function(e){e.ALREADY_INSTALLED="ALREADY_INSTALLED"}(l||(l={})),function(e){e.BASE="BASE",e.CURRENT="CURRENT",e.TARGET="TARGET"}(c||(c={}));const u=Object(i.u)("PickVersionValues",c),d=n.exact(n.intersection([n.type({rule_id:n.string,revision:n.number,version:n.number}),n.partial({pick_version:u})])),p=n.exact(n.intersection([n.type({mode:n.literal("SPECIFIC_RULES"),rules:n.array(d)}),n.partial({pick_version:u})])),m=n.exact(n.intersection([n.type({mode:n.literal("ALL_RULES")}),n.partial({pick_version:u})]));let b;n.union([m,p]),function(e){e.RULE_UP_TO_DATE="RULE_UP_TO_DATE"}(b||(b={}));var g=a(494),f=a(128);const y=e=>n.intersection([n.exact(n.type(e.required)),n.exact(n.type(Object(f.cb)(e.optional)))]);let h;!function(e){e.index_patterns="index_patterns",e.data_view="data_view"}(h||(h={}));const v=n.exact(n.type({type:n.literal(h.index_patterns),index_patterns:f.i})),E=n.exact(n.type({type:n.literal(h.data_view),data_view_id:f.d})),x=n.union([v,E]);let j;!function(e){e.inline_query="inline_query",e.saved_query="saved_query"}(j||(j={}));const S=n.exact(n.type({type:n.literal(j.inline_query),query:f.B,language:f.k,filters:f.u})),k=n.exact(n.type({type:n.literal(j.saved_query),saved_query_id:f.fb})),O=n.union([S,k]),w=n.exact(n.type({query:f.B,language:n.literal("eql"),filters:f.u})),T=n.exact(n.type({interval:Object(i.q)({allowedUnits:["s","m","h"]}),lookback:Object(i.q)({allowedUnits:["s","m","h"]})})),I=n.exact(n.type({field_name:f.y})),C=n.exact(n.type({field_name:f.R,fallback_disabled:f.S})),M=n.exact(n.type({timeline_id:f.O,timeline_title:f.P})),_=n.exact(n.type({type:f.c}));var F=a(193);const A=y({required:{rule_id:f.E,version:f.H,meta:f.w,name:f.x,tags:f.F,description:f.s,severity:F.p,severity_mapping:F.q,risk_score:F.d,risk_score_mapping:F.e,references:f.C,false_positives:f.t,threat:f.L,note:f.j,setup:f.I,related_integrations:f.o,required_fields:f.p,author:f.q,license:f.v,rule_schedule:T,actions:F.g,throttle:F.l,exceptions_list:f.g,max_signals:f.l},optional:{rule_name_override:I,timestamp_override:C,timeline_template:M,building_block:_}}),D=y({required:{type:n.literal("query"),kql_query:O},optional:{data_source:x,alert_suppression:f.a}}),N=y({required:{type:n.literal("saved_query"),kql_query:O},optional:{data_source:x,alert_suppression:f.a}}),P=y({required:{type:n.literal("eql"),eql_query:w},optional:{data_source:x,event_category_override:f.f,timestamp_field:f.Q,tiebreaker_field:f.N}}),R=y({required:{type:n.literal("threat_match"),kql_query:O,threat_query:S,threat_index:F.y,threat_mapping:F.B},optional:{data_source:x,threat_indicator_path:F.z,concurrent_searches:F.r,items_per_search:F.s}}),L=y({required:{type:n.literal("threshold"),kql_query:O,threshold:f.M},optional:{data_source:x}}),B=y({required:{type:n.literal("machine_learning"),machine_learning_job_id:F.t,anomaly_threshold:f.W},optional:{}}),q=y({required:{type:n.literal("new_terms"),kql_query:S,new_terms_fields:f.m,history_window_start:f.h},optional:{data_source:x}});let z,$;n.intersection([A,n.union([D,N,P,R,L,B,q])]),a(8),Symbol("MissingVersion"),function(e){e.StockValueNoUpdate="BASE=A, CURRENT=A, TARGET=A",e.StockValueCanUpdate="BASE=A, CURRENT=A, TARGET=B",e.CustomizedValueNoUpdate="BASE=A, CURRENT=B, TARGET=A",e.CustomizedValueSameUpdate="BASE=A, CURRENT=B, TARGET=B",e.CustomizedValueCanUpdate="BASE=A, CURRENT=B, TARGET=C"}(z||(z={})),function(e){e.Current="CURRENT",e.Target="TARGET",e.Merged="MERGED",e.Conflict="CONFLICT"}($||($={}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return d})),a.d(t,"b",(function(){return Z})),a.d(t,"d",(function(){return te})),a.d(t,"f",(function(){return D})),a.d(t,"e",(function(){return ne})),a.d(t,"g",(function(){return U})),a.d(t,"h",(function(){return se})),a.d(t,"j",(function(){return W})),a.d(t,"c",(function(){return oe})),a.d(t,"i",(function(){return de}));var n=a(2),i=a.n(n),r=a(40),s=a(5),o=a(58),l=a(4),c=a(566),u=a(198);const d=Object(n.memo)((({handleRefresh:e,http:t,handleCloseFlyout:a,addSuccess:d,addError:p})=>{const{navigateToApp:m}=Object(o.useKibana)().services.application,{start:b,...g}=Object(c.a)(),f=Object(n.useRef)(new AbortController);let y;!function(e){e.name="name",e.description="description"}(y||(y={}));const[h,v]=Object(n.useState)({name:"",description:""}),E=({target:e},t)=>{const{value:a}=e;v({...h,[t]:a})};Object(n.useEffect)((()=>{null!=g.result&&m(l.l,{deepLinkId:l.wc.exceptions,path:`/details/${g.result.list_id}`})}),[g,m]);const x=Object(n.useCallback)((()=>{var e;g.loading||""===h.name||(f.current=new AbortController,b({http:t,signal:f.current.signal,name:h.name,description:null!==(e=h.description)&&void 0!==e?e:""}))}),[g.loading,h.name,h.description,b,t]),j=Object(n.useCallback)((t=>{d({text:Object(u.ob)(h.name),title:u.ib}),e(),a()}),[d,a,e,h]),S=Object(n.useCallback)((e=>{var t;e.message.includes("AbortError")||null!=e&&null!==(t=e.body)&&void 0!==t&&t.message.includes("AbortError")||p(e,{title:s.i18n.translate("xpack.securitySolution.exceptions.createSharedExceptionListErrorTitle",{defaultMessage:"creation error"})})}),[p]);return Object(n.useEffect)((()=>{g.loading||(null!=g&&g.result?j(g.result):null!=g&&g.error&&S(null==g?void 0:g.error))}),[null==g?void 0:g.error,g.loading,g.result,S,j]),i.a.createElement(r.EuiFlyout,{ownFocus:!0,size:"s",onClose:a,"data-test-subj":"createSharedExceptionListFlyout"},i.a.createElement(r.EuiFlyoutHeader,{hasBorder:!0},i.a.createElement(r.EuiTitle,{size:"m"},i.a.createElement("h2",{"data-test-subj":"createSharedExceptionListTitle"},u.h))),i.a.createElement(r.EuiFlyoutBody,null,i.a.createElement(r.EuiText,null,u.f),i.a.createElement(r.EuiFieldText,{placeholder:u.g,value:h.name,onChange:e=>E(e,y.name),"aria-label":"Shared exception list name","data-test-subj":"createSharedExceptionListNameInput"}),i.a.createElement(r.EuiSpacer,null),i.a.createElement(r.EuiText,null,u.d),i.a.createElement(r.EuiTextArea,{placeholder:u.e,value:h.description,onChange:e=>E(e,y.description),"aria-label":"Shared exception list description","data-test-subj":"createSharedExceptionListDescriptionInput"})),i.a.createElement(r.EuiFlyoutFooter,null,i.a.createElement(r.EuiFlexGroup,{justifyContent:"spaceBetween"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonEmpty,{iconType:"cross",onClick:a,flush:"left"},u.a)),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButton,{"data-test-subj":"exception-lists-form-create-shared",onClick:x,disabled:""===h.name},u.c)))))}));d.displayName="CreateSharedListFlyout";var p=a(180),m=a(120),b=a(244),g=a(41),f=a.n(g),y=a(48),h=a(598),v=a(418);const E=f()(r.EuiFlexItem).withConfig({displayName:"StyledFlexItem",componentId:"sc-19zoulh-0"})(["border-right:1px solid #d3dae6;padding:"," "," "," 0;"],y.euiThemeVars.euiSizeXS,y.euiThemeVars.euiSizeS,y.euiThemeVars.euiSizeXS),x=f()(r.EuiText).withConfig({displayName:"TextContainer",componentId:"sc-19zoulh-1"})(["width:max-content;"]),j=Object(n.memo)((({title:e,badgeString:t})=>i.a.createElement(r.EuiFlexGroup,{alignItems:"center"},i.a.createElement(r.EuiFlexItem,null,i.a.createElement(x,{grow:!0,size:"xs"},`${e}:`)),i.a.createElement(E,null,i.a.createElement(r.EuiBadge,null,t)))));j.displayName="TitleBadge";var S=a(132),k=a(50),O=a.n(k);const w=s.i18n.translate("xpack.securitySolution.exceptions.commentEventLabel",{defaultMessage:"added a comment"}),T=(s.i18n.translate("xpack.securitySolution.exceptions.operatingSystemFullLabel",{defaultMessage:"Operating System"}),s.i18n.translate("xpack.securitySolution.exceptions.viewer.addToEndpointListLabel",{defaultMessage:"Add endpoint exception"}),s.i18n.translate("xpack.securitySolution.exceptions.viewer.addToDetectionsListLabel",{defaultMessage:"Add rule exception"}),s.i18n.translate("xpack.securitySolution.exceptions.viewer.addCommentPlaceholder",{defaultMessage:"Add a new comment..."}),s.i18n.translate("xpack.securitySolution.exceptions.viewer.addToClipboard",{defaultMessage:"Comment"}));s.i18n.translate("xpack.securitySolution.exceptions.clearExceptionsLabel",{defaultMessage:"Remove Exception List"}),s.i18n.translate("xpack.securitySolution.exceptions.fetchError",{defaultMessage:"Error fetching exception list"}),s.i18n.translate("xpack.securitySolution.exceptions.errorLabel",{defaultMessage:"Error"}),s.i18n.translate("xpack.securitySolution.exceptions.cancelLabel",{defaultMessage:"Cancel"}),s.i18n.translate("xpack.securitySolution.exceptions.modalErrorAccordionText",{defaultMessage:"Show rule reference information:"}),s.i18n.translate("xpack.securitySolution.exceptions.disassociateExceptionListError",{defaultMessage:"Failed to remove exception list"}),s.i18n.translate("xpack.securitySolution.exceptions.operatingSystemWindows",{defaultMessage:"Windows"}),s.i18n.translate("xpack.securitySolution.exceptions.operatingSystemMac",{defaultMessage:"macOS"}),s.i18n.translate("xpack.securitySolution.exceptions.operatingSystemWindowsAndMac",{defaultMessage:"Windows and macOS"}),s.i18n.translate("xpack.securitySolution.exceptions.operatingSystemLinux",{defaultMessage:"Linux"}),s.i18n.translate("xpack.securitySolution.exceptions.fetchingReferencesErrorToastTitle",{defaultMessage:"Error fetching exception references"});var I=a(880);const C=e=>e.map((e=>({username:e.created_by,timestamp:O()(e.created_at).format("on MMM Do YYYY @ HH:mm:ss"),event:w,timelineAvatar:i.a.createElement(r.EuiAvatar,{size:"l",name:e.created_by.toUpperCase()}),children:i.a.createElement(r.EuiText,{size:"s"},e.comment),actions:i.a.createElement(I.a,{"data-test-subj":"copy-to-clipboard",text:e.comment,titleSummary:T})})));var M=a(866),_=a(123),F=a(201);const A=({referenceName:e,referenceId:t,external:a,dataTestSubj:n})=>i.a.createElement(_.k,{"data-test-subj":`linkToRuleSecuritySolutionLink${null!=n?n:""}`,deepLinkId:l.wc.rules,path:Object(F.c)(t,M.b.alerts),target:a?"_blank":void 0},e);A.displayName="LinkToRuleDetailsComponent";const D=i.a.memo(A);D.displayName="LinkToRuleDetails";var N=a(44),P=a(317);const R=f.a.span.withConfig({displayName:"StyledText",componentId:"sc-1q48q07-0"})(["font-weight:bold;color:",";"],(({theme:e})=>e.eui.euiColorDarkestShade)),L=f()(r.EuiFlexGroup).withConfig({displayName:"MyUtilities",componentId:"sc-1q48q07-1"})(["height:50px;"]),B=f.a.span.withConfig({displayName:"StyledCondition",componentId:"sc-1q48q07-2"})(["display:inline-block !important;vertical-align:middle !important;line-height:1;"]),q=({dataTestSubj:e,pagination:t,lastUpdated:a,exceptionsTitle:n})=>{const{pageSize:s,totalItemCount:o}=t;return i.a.createElement(L,{alignItems:"center",justifyContent:"spaceBetween"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(P.a,null,i.a.createElement(P.d,null,i.a.createElement(P.c,null,i.a.createElement(P.e,{dataTestSubj:`${e}ShowingText`},i.a.createElement(N.FormattedMessage,{id:"xpack.securitySolution.exceptions.viewer.paginationDetails",defaultMessage:"Showing {partOne} of {partTwo}",values:{partOne:i.a.createElement(R,null,`1-${Math.min(s,o)}`),partTwo:i.a.createElement(R,null,`${o}`)}})),n&&i.a.createElement(R,{"data-test-subj":`${e}exceptionsTitle`},n))))),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiText,{size:"s","data-test-subj":`${e}LastUpdated`},i.a.createElement(N.FormattedMessage,{id:"xpack.securitySolution.exceptions.viewer.lastUpdated",defaultMessage:"Updated {updated}",values:{updated:i.a.createElement(B,null,i.a.createElement(S.b,{value:a,tooltipAnchorClassName:"eui-textTruncate"}))}}))))};q.displayName="ExceptionsUtilityComponent";const z=i.a.memo(q);z.displayName="ExceptionsUtility";var $=a(567);const V=({isReadOnly:e,exceptions:t,listType:a,lastUpdated:r,pagination:s,emptyViewerTitle:o,emptyViewerBody:l,emptyViewerButtonText:c,viewerStatus:u,ruleReferences:d,hideUtility:p=!1,onDeleteException:g,onEditExceptionItem:f,onPaginationChange:y,onCreateExceptionListItem:h})=>{const v=Object(n.useMemo)((()=>a===m.b.ENDPOINT?$.c:$.d),[a]),E=Object(n.useMemo)((()=>a===m.b.ENDPOINT?$.a:$.b),[a]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(b.c,{viewerStatus:u,listType:a,ruleReferences:d,isReadOnly:e,exceptions:t,emptyViewerTitle:o,emptyViewerBody:l,emptyViewerButtonText:c,pagination:s,lastUpdated:r,editActionLabel:v,deleteActionLabel:E,onPaginationChange:y,onEditExceptionItem:f,onDeleteException:g,getFormattedComments:C,securityLinkAnchorComponent:D,formattedDateComponent:S.a,onCreateExceptionListItem:h,exceptionsUtilityComponent:()=>p?null:i.a.createElement(z,{exceptionsTitle:$.e,pagination:s,lastUpdated:r})}))};V.displayName="ListExceptionItemsComponent";const U=i.a.memo(V);U.displayName="ListExceptionItems";var H=a(757),G=a(592),Q=a(874);const W=Object(n.memo)((({linkedRules:e,showButtonLoader:t,saveIsDisabled:a=!0,onSave:n,onCancel:s,onRuleSelectionChange:o})=>{const l=Object(r.useGeneratedHtmlId)({prefix:"complicatedFlyoutTitle"});return i.a.createElement(r.EuiFlyout,{hideCloseButton:!0,ownFocus:!0,onClose:s,"aria-labelledby":l},i.a.createElement(r.EuiFlyoutHeader,{hasBorder:!0},i.a.createElement(r.EuiTitle,{size:"m"},i.a.createElement("h2",{id:l},u.V)),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(r.EuiText,{size:"s",color:"subdued"},u.Y)),i.a.createElement(r.EuiFlyoutBody,null,i.a.createElement(Q.a,{initiallySelectedRules:e,onRuleSelectionChange:o})),i.a.createElement(r.EuiFlyoutFooter,null,i.a.createElement(r.EuiFlexGroup,{justifyContent:"spaceBetween"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonEmpty,{onClick:s,flush:"left"},u.X)),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButton,{"data-test-subj":"manageListRulesSaveButton",isLoading:t,disabled:a,onClick:n,fill:!0},u.Z)))))}));W.displayName="ManageRules";var K=a(743);const Y=p.css`
  z-index: 100;
  .euiAccordion__buttonContent {
    cursor: pointer;
    width: 100%;
  }
`,J=f()(r.EuiPanel).withConfig({displayName:"ExceptionPanel",componentId:"sc-11ogn3z-0"})(["margin:-"," "," 0 ",";"],y.euiThemeVars.euiSizeS,y.euiThemeVars.euiSizeM,y.euiThemeVars.euiSizeM),X=f()(r.EuiFlexGroup).withConfig({displayName:"ListHeaderContainer",componentId:"sc-11ogn3z-1"})(["padding:",";text-align:initial;"],y.euiThemeVars.euiSizeS),Z=Object(n.memo)((({exceptionsList:e,handleDelete:t,handleExport:a,handleDuplicate:n,readOnly:s})=>{const{linkedRules:o,showManageRulesFlyout:l,showManageButtonLoader:c,disableManageButton:d,onManageRules:p,onSaveManageRules:g,onCancelManageRules:f,onRuleSelectionChange:y}=Object(H.a)(e.list_id),{listId:E,listName:x,listType:S,createdAt:k,createdBy:O,exceptions:w,pagination:T,ruleReferences:I,toggleAccordion:C,openAccordionId:M,menuActionItems:_,listDescription:F,exceptionItemsCount:A,onEditExceptionItem:D,onDeleteException:N,onPaginationChange:P,setToggleAccordion:R,exceptionViewerStatus:L,showAddExceptionFlyout:B,showEditExceptionFlyout:q,exceptionToEdit:z,onAddExceptionClick:$,handleConfirmExceptionFlyout:V,handleCancelExceptionItemFlyout:Q,goToExceptionDetail:Z,emptyViewerTitle:ee,emptyViewerBody:te,emptyViewerButtonText:ae,handleCancelExpiredExceptionsModal:ne,handleConfirmExpiredExceptionsModal:ie,showIncludeExpiredExceptionsModal:re}=Object(G.a)({exceptionsList:e,handleExport:a,handleDelete:t,handleDuplicate:n,handleManageRules:p});return i.a.createElement(r.EuiFlexGroup,{gutterSize:"none"},i.a.createElement(r.EuiFlexItem,null,i.a.createElement(r.EuiPanel,{hasShadow:!1},i.a.createElement(r.EuiAccordion,{buttonProps:{className:Y},id:M,arrowDisplay:"none",onToggle:()=>R(!C),buttonContent:i.a.createElement(r.EuiPanel,null,i.a.createElement(X,{gutterSize:"m",alignItems:"flexStart"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonIcon,{iconType:C?"arrowDown":"arrowRight","aria-label":"Next"})),i.a.createElement(r.EuiFlexItem,null,i.a.createElement(r.EuiFlexGroup,{direction:"column",key:E,alignItems:"flexStart",gutterSize:"none"},i.a.createElement(r.EuiFlexItem,{grow:!0},i.a.createElement(r.EuiText,{size:"m"},i.a.createElement(r.EuiLink,{"data-test-subj":"exception-list-name",onClick:Z},x))),i.a.createElement(r.EuiFlexItem,{grow:!0},i.a.createElement(r.EuiText,{size:"xs"},i.a.createElement(r.EuiTextColor,{color:"subdued"},F))))),i.a.createElement(r.EuiFlexItem,null,i.a.createElement(r.EuiFlexGroup,{alignItems:"center"},i.a.createElement(r.EuiFlexItem,null,i.a.createElement(j,{title:u.i,badgeString:k})),i.a.createElement(r.EuiFlexItem,null,i.a.createElement(j,{title:u.b,badgeString:O})),i.a.createElement(r.EuiFlexItem,null,i.a.createElement(j,{title:u.l,badgeString:A})),i.a.createElement(r.EuiFlexItem,{"data-test-subj":"exceptionListCardLinkedRulesBadge"},i.a.createElement(j,{title:u.fb,badgeString:o.length.toString()})),i.a.createElement(r.EuiFlexItem,null,i.a.createElement(b.e,{disableActions:s,dataTestSubj:"sharedListOverflowCard",actions:_})))))),"data-test-subj":`exceptionsManagementListCard-${E}`},i.a.createElement(J,{hasBorder:!0},i.a.createElement(U,{isReadOnly:s,exceptions:w,listType:e.type,pagination:T,hideUtility:!0,viewerStatus:L,ruleReferences:I,onDeleteException:N,onEditExceptionItem:D,onPaginationChange:P,onCreateExceptionListItem:$,lastUpdated:null,emptyViewerTitle:ee,emptyViewerBody:te,emptyViewerButtonText:ae}))))),B?i.a.createElement(v.a,{rules:null,isBulkAction:!1,isEndpointItem:S===m.b.ENDPOINT,sharedListToAddTo:[e],onCancel:Q,onConfirm:V,"data-test-subj":"addExceptionItemFlyoutInSharedLists",showAlertCloseOptions:!1}):null,q&&z?i.a.createElement(h.a,{list:e,itemToEdit:z,showAlertCloseOptions:!0,openedFromListDetailPage:!0,onCancel:Q,onConfirm:V,"data-test-subj":"editExceptionItemFlyoutInSharedLists"}):null,l?i.a.createElement(W,{linkedRules:o,showButtonLoader:c,saveIsDisabled:d,onSave:g,onCancel:f,onRuleSelectionChange:y}):null,re?i.a.createElement(K.b,{handleCloseModal:ne,onModalConfirm:ie,action:re}):null)}));Z.displayName="ExceptionsListCard";var ee=a(594);const te=i.a.memo((({handleRefresh:e,http:t,addSuccess:a,addError:s,setDisplayImportListFlyout:o})=>{var l;const c=Object(n.useRef)(null),d=Object(r.useGeneratedHtmlId)({prefix:"filePicker"}),[p,m]=Object(n.useState)(null),[b,g]=Object(n.useState)(!1),[f,y]=Object(n.useState)(!1),[h,v]=Object(n.useState)(!1),E=Object(n.useCallback)((()=>{var e;null!==(e=c.current)&&void 0!==e&&e.fileInput&&(c.current.fileInput.value="",c.current.handleChange()),m(null),v(!1),y(!1),g(!1)}),[]),{start:x,...j}=Object(ee.a)(),S=Object(n.useRef)(new AbortController),k=Object(n.useCallback)((()=>{!j.loading&&p&&(S.current=new AbortController,Array.from(p).forEach((e=>x({file:e,http:t,signal:S.current.signal,overwrite:b,overwriteExceptions:b,asNewList:f}))))}),[f,p,t,x,j.loading,b]),O=Object(n.useCallback)((t=>{E(),a({title:u.lb}),e()}),[E,a,e]),w=Object(n.useCallback)((e=>{e.forEach((e=>{e.error.message.includes("AbortError")||s(e.error.message,{title:u.kb})}))}),[s]);Object(n.useEffect)((()=>{var e;if(!j.loading)if(null!=j&&null!==(e=j.result)&&void 0!==e&&e.success)O(null==j?void 0:j.result);else{var t,a;const e=[];var n,i;null!=j&&null!==(t=j.error)&&void 0!==t&&t.body&&e.push({error:{...null==j||null===(n=j.error)||void 0===n?void 0:n.body}}),null!=j&&null!==(a=j.result)&&void 0!==a&&a.errors&&(null==j||null===(i=j.result)||void 0===i||i.errors.forEach((t=>{t.error.message.includes("already exists")&&v(!0),e.push(t)}))),w(e)}}),[w,O,null==j?void 0:j.error,j.loading,null==j?void 0:j.result,null==j||null===(l=j.result)||void 0===l?void 0:l.errors]);const T=Object(n.useCallback)((e=>{m(null!=e?e:null)}),[]);return i.a.createElement(r.EuiFlyout,{ownFocus:!0,size:"s",onClose:()=>o(!1)},i.a.createElement(r.EuiFlyoutHeader,{hasBorder:!0},i.a.createElement(r.EuiTitle,{size:"m"},i.a.createElement("h2",null,u.R))),i.a.createElement(r.EuiFlyoutBody,null,i.a.createElement(r.EuiText,null,u.Q),i.a.createElement(r.EuiFilePicker,{id:d,multiple:!0,ref:c,initialPromptText:u.U,onChange:T,display:"large","aria-label":"Use aria labels when no actual label is in use"}),h&&i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiSpacer,null),i.a.createElement(r.EuiTextColor,{color:"danger"},u.T),i.a.createElement(r.EuiSpacer,null),i.a.createElement(r.EuiCheckbox,{id:"basicCheckboxId",label:u.S,checked:b,"data-test-subj":"importExceptionListOverwriteExistingCheckbox",onChange:e=>{g(!b),y(!1)}}),i.a.createElement(r.EuiCheckbox,{id:"createNewListCheckbox",label:u.P,"data-test-subj":"importExceptionListCreateNewCheckbox",checked:f,onChange:e=>{y(!f),g(!1)}}))),i.a.createElement(r.EuiFlyoutFooter,null,i.a.createElement(r.EuiFlexGroup,{justifyContent:"spaceBetween"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonEmpty,{"data-test-subj":"exceptionListsImportFormCloseBTN",iconType:"cross",onClick:()=>o(!1),flush:"left"},u.a)),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButton,{"data-test-subj":"exception-lists-form-import-action",onClick:k,disabled:null==p||j.loading},u.jb)))))})),ae=({linkTitle:e,listId:t,external:a,dataTestSubj:n})=>i.a.createElement(_.k,{"data-test-subj":`linkToRuleSecuritySolutionLink${null!=n?n:""}`,deepLinkId:l.wc.exceptions,path:`/details/${t}`,target:a?"_blank":void 0},e);ae.displayName="LinkToListDetailsComponent";const ne=i.a.memo(ae);ne.displayName="LinkToListDetails";var ie=a(595);const re=({list:e,isReadOnly:t,refreshExceptions:a})=>{const{listName:n,exceptions:s,listType:o,lastUpdated:l,pagination:c,emptyViewerTitle:d,emptyViewerBody:p,emptyViewerButtonText:g,viewerStatus:f,ruleReferences:y,showAddExceptionFlyout:E,showEditExceptionFlyout:x,exceptionToEdit:j,exceptionViewerStatus:S,onSearch:k,onAddExceptionClick:O,onDeleteException:w,onEditExceptionItem:T,onPaginationChange:I,handleCancelExceptionItemFlyout:C,handleConfirmExceptionFlyout:M}=Object(ie.a)(e,a);return i.a.createElement(i.a.Fragment,null,E?i.a.createElement(v.a,{rules:null,isBulkAction:!1,isEndpointItem:o===m.b.ENDPOINT,sharedListToAddTo:[e],onCancel:C,onConfirm:M,"data-test-subj":"addExceptionItemFlyoutInList",showAlertCloseOptions:!1}):f===b.i.EMPTY||f===b.i.LOADING?i.a.createElement(b.a,{isReadOnly:t,viewerStatus:f,onEmptyButtonStateClick:O,title:u.B,body:u.y(n),buttonText:u.z}):i.a.createElement(r.EuiPanel,{hasBorder:!1,hasShadow:!1},i.a.createElement(i.a.Fragment,null,x&&j&&i.a.createElement(h.a,{list:e,itemToEdit:j,showAlertCloseOptions:!0,openedFromListDetailPage:!0,onCancel:C,onConfirm:M,"data-test-subj":"editExceptionItemFlyoutInList"}),i.a.createElement(b.g,{addExceptionButtonText:o===m.b.ENDPOINT?u.x:u.w,listType:o,onSearch:k,onAddExceptionClick:O,isSearching:f===b.i.SEARCHING,isButtonFilled:!1,buttonIconType:"plusInCircle"}),i.a.createElement(U,{viewerStatus:S,listType:o,ruleReferences:y,isReadOnly:t,exceptions:s,emptyViewerTitle:d,emptyViewerBody:p,emptyViewerButtonText:g,pagination:c,lastUpdated:l,onPaginationChange:I,onEditExceptionItem:T,onDeleteException:w,onCreateExceptionListItem:O}))))};re.displayName="ListWithSearchComponent";const se=i.a.memo(re);se.displayName="ListWithSearch";const oe=({onRefresh:e,totalExceptionLists:t,setSort:a,sort:n,sortFields:s})=>{var o;const l=null==s?void 0:s.find((e=>e.field===(null==n?void 0:n.field)));return i.a.createElement(P.a,{border:!0},i.a.createElement(P.d,null,i.a.createElement(P.c,null,i.a.createElement(P.e,{dataTestSubj:"showingExceptionLists"},u.gb(t))),i.a.createElement(P.c,null,i.a.createElement(P.b,{dataTestSubj:"refreshRulesAction",iconSide:"left",iconType:"refresh",onClick:e},u.eb))),i.a.createElement(P.d,null,i.a.createElement(i.a.Fragment,null,i.a.createElement(P.c,null,n&&i.a.createElement(P.b,{dataTestSubj:"sortExceptions",iconSide:"right",iconType:"asc"===n.order?"sortUp":"sortDown",popoverPanelPaddingSize:"s",popoverContent:()=>i.a.createElement(r.EuiContextMenuPanel,{size:"s",items:null==s?void 0:s.map((e=>{const t=(null==l?void 0:l.field)===e.field;let s=e.defaultOrder;return t&&(s="asc"===n.order?"desc":"asc"),i.a.createElement(r.EuiContextMenuItem,{key:e.field,onClick:()=>null==a?void 0:a({field:e.field,order:s})},i.a.createElement(le,null,e.label," ",(null==l?void 0:l.field)===e.field&&i.a.createElement(ce,{type:"asc"===n.order?"sortUp":"sortDown"})))}))})},i.a.createElement(le,null,u.hb," ",null==s||null===(o=s.find((e=>e.field===n.field)))||void 0===o?void 0:o.label))))))},le=f()("div").withConfig({displayName:"SortMenuItem",componentId:"sc-1h5b7pp-0"})(["display:flex;align-items:center;"]),ce=f()(r.EuiIcon).withConfig({displayName:"SortIcon",componentId:"sc-1h5b7pp-1"})(["margin-left:8px;"]);oe.displayName="ExceptionsTableUtilityBar";const ue={strict:!0,fields:{created_by:{type:"string"},name:{type:"string"},type:{type:"string"},list_id:{type:"string"},tags:{type:"string"}}},de=i.a.memo((({onSearch:e})=>i.a.createElement(r.EuiSearchBar,{"data-test-subj":"exceptionsHeaderSearch","aria-label":u.m,onChange:e,box:{"data-test-subj":"exceptionsHeaderSearchInput",placeholder:u.D,incremental:!1,schema:ue}})));de.displayName="ListsSearchBar"},,function(e,t,a){"use strict";a.d(t,"c",(function(){return v})),a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return x}));var n=a(2),i=a.n(n),r=a(40),s=a(145),o=a(42);const l=a(5).i18n.translate("xpack.securitySolution.callouts.dismissButton",{defaultMessage:"Dismiss"}),c=({message:e,text:t,onClick:a=o.noop})=>{const{type:s}=e,c=s,u=null!=t?t:l,d=Object(n.useCallback)((()=>a(e)),[a,e]);return i.a.createElement(r.EuiButton,{color:c,"data-test-subj":"callout-dismiss-btn",onClick:d},u)},u=({message:e,iconType:t,dismissButtonText:a,onDismiss:n,showDismissButton:s=!0})=>{const{type:o,id:l,title:u,description:p}=e,m=null!=t?t:d(o);return i.a.createElement(r.EuiCallOut,{color:o,title:u,iconType:m,"data-test-subj":`callout-${l}`,"data-test-messages":`[${l}]`},p,s&&i.a.createElement(c,{message:e,text:a,onClick:n}))},d=e=>{switch(e){case"primary":return"iInCircle";case"success":return"cheer";case"warning":return"help";case"danger":return"warning";default:return Object(s.a)(e)}},p=Object(n.memo)(u);var m=a(788),b=a.n(m),g=a(1111);const f=(e,t)=>y(e,o.identity,(()=>t)),y=(e,t,a)=>{const n=e.map((e=>[t(e),a(e)]));return Object(o.fromPairs)(n)},h=({namespace:e,condition:t,message:a})=>{const{isVisible:s,dismiss:l}=((e,t="common")=>{const{getMessages:a,addMessage:i}=Object(g.a)(),[r,s]=b()({}),l=(e=>`kibana.securitySolution.${e}.callouts.dismissed`)(t),c=Object(n.useCallback)((()=>Object.entries(r).filter((([e,t])=>t)).map((([e,t])=>e))),[r]),u=Object(n.useCallback)((e=>{var t;return null!==(t=r[e.id])&&void 0!==t&&t}),[r]),d=Object(n.useCallback)((e=>{const{id:t,type:a}=e;s.set(t,!1),"primary"!==a&&"success"!==a||i(l,t)}),[s,i,l]),p=Object(n.useCallback)((e=>{const t=a(l),n=Object(o.difference)(e,t),i=Object(o.intersection)(e,t);s.setAll({...f(n,!0),...f(i,!1)})}),[a,l,s]);return Object(n.useEffect)((()=>{const t=e.map((e=>e.id)),a=Object.keys(r);Object(o.isEqual)(t,a)||p(t)}),[e,r,p]),{getVisibleMessageIds:c,isVisible:u,dismiss:d}})([a],e);return t&&s(a)?i.a.createElement(i.a.Fragment,null,i.a.createElement(p,{message:a,onDismiss:l}),i.a.createElement(r.EuiSpacer,{size:"l"})):null},v=Object(n.memo)(h),E=({condition:e,message:t})=>e?i.a.createElement(p,{message:t,showDismissButton:!1}):null,x=Object(n.memo)(E)},function(e,t,a){"use strict";a.d(t,"a",(function(){return f}));var n=a(2),i=a(102),r=a(109),s=a(214),o=a(5);const l=o.i18n.translate("xpack.securitySolution.containers.detectionEngine.alerts.fetchListsIndex.errorDescription",{defaultMessage:"Failed to retrieve the lists index"}),c=o.i18n.translate("xpack.securitySolution.containers.detectionEngine.alerts.createListsIndex.errorDescription",{defaultMessage:"Failed to create the lists index"});var u=a(108),d=a(126);const p=e=>{const[t]=Object.keys(e),a=e[t];return null!=a&&a.manage},m=e=>{const[t]=Object.keys(e),a=e[t];return null!=a&&a.read},b=e=>{const[t]=Object.keys(e),a=e[t];return null!=a&&(a.create||a.create_doc||a.index||a.write)},g=()=>{const[e,t]=Object(n.useState)({isAuthenticated:null,canManageIndex:null,canReadIndex:null,canWriteIndex:null}),{listPrivileges:a}=Object(d.a)();return Object(n.useEffect)((()=>{if(null!=a.result){const{is_authenticated:e,lists:{index:n},listItems:{index:i}}=a.result;t({isAuthenticated:e,canReadIndex:m(n)&&m(i),canManageIndex:p(n)&&p(i),canWriteIndex:b(n)&&b(i)})}}),[a.result]),Object(n.useEffect)((()=>{null!=a.error&&t({isAuthenticated:!1,canManageIndex:!1,canReadIndex:!1,canWriteIndex:!1})}),[a.error]),{loading:a.loading,...e}},f=()=>{const{createIndex:e,indexExists:t,loading:a,error:o}=(()=>{const[e,t]=Object(n.useState)(null),[a,o]=Object(n.useState)(null),{lists:d}=Object(i.j)().services,p=Object(i.i)(),{addError:m}=Object(u.a)(),{canReadIndex:b,canManageIndex:f,canWriteIndex:y}=g(),{loading:h,start:v,...E}=Object(s.k)(),{loading:x,start:j,...S}=Object(s.d)(),k=h||x,O=Object(n.useCallback)((()=>{d&&b&&f&&v({http:p})}),[p,d,v,b,f]),w=Object(n.useCallback)((()=>{d&&f&&y&&j({http:p})}),[j,p,d,f,y]);return Object(n.useEffect)((()=>{h||a||null!==e||O()}),[a,e,O,h]),Object(n.useEffect)((()=>{null!=E.result&&t(E.result.list_index&&E.result.list_item_index)}),[E.result]),Object(n.useEffect)((()=>{null!=S.result&&O()}),[S.result,O]),Object(n.useEffect)((()=>{const e=E.error;null!=e&&(Object(r.v)(e)&&404===e.body.status_code?t(!1):(o(e),m(e,{title:l})))}),[m,E.error]),Object(n.useEffect)((()=>{const e=S.error;null!=e&&(o(e),m(e,{title:c}))}),[m,S.error]),{createIndex:w,error:a,indexExists:e,loading:k}})(),{canManageIndex:d,canWriteIndex:p,loading:m}=g(),{lists:b}=Object(i.j)().services,f=null!=b,y=a||m,h=!1===t,v=!f||h&&(!1===d||!0===d&&null!=o);return Object(n.useEffect)((()=>{h&&d&&e()}),[d,e,h]),{canManageIndex:d,canWriteIndex:p,enabled:f,loading:y,needsConfiguration:v}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return I}));var n=a(2),i=a.n(n),r=a(1376),s=a.n(r),o=a(694),l=a(40),c=a(5),u=a(44),d=a(4);const p=({values:e})=>i.a.createElement(i.a.Fragment,null,e.map(((t,a)=>i.a.createElement(i.a.Fragment,{key:a},i.a.createElement(l.EuiCode,null,t),a<e.length-1?", ":""))));var m=a(664);const b=c.i18n.translate("xpack.securitySolution.detectionEngine.missingPrivilegesCallOut.messageTitle",{defaultMessage:"Insufficient privileges"}),g=c.i18n.translate("xpack.securitySolution.detectionEngine.missingPrivilegesCallOut.cannotEditRules",{defaultMessage:"Without that privilege you cannot create or edit detection engine rules."}),f=c.i18n.translate("xpack.securitySolution.detectionEngine.missingPrivilegesCallOut.cannotEditLists",{defaultMessage:"Without these privileges, you cannot create or edit value lists."}),y=c.i18n.translate("xpack.securitySolution.detectionEngine.missingPrivilegesCallOut.cannotEditAlerts",{defaultMessage:"Without these privileges, you cannot view or change status of alerts."}),h=({indexPrivileges:e,featurePrivileges:t=[]})=>i.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.missingPrivilegesCallOut.messageBody.messageDetail",defaultMessage:"{essence} {indexPrivileges} {featurePrivileges} Related documentation: {docs}",values:{essence:i.a.createElement("p",null,i.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.missingPrivilegesCallOut.messageBody.essenceDescription",defaultMessage:"You need the following privileges to fully access this functionality. Contact your administrator for further assistance."})),indexPrivileges:e.length>0?i.a.createElement(i.a.Fragment,null,i.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.missingPrivilegesCallOut.messageBody.indexPrivilegesTitle",defaultMessage:"Missing Elasticsearch index privileges:"}),i.a.createElement("ul",null,e.map((([e,t])=>i.a.createElement("li",{key:e},x(e,t)))))):null,featurePrivileges:t.length>0?i.a.createElement(i.a.Fragment,null,i.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.missingPrivilegesCallOut.messageBody.featurePrivilegesTitle",defaultMessage:"Missing Kibana feature privileges:"}),i.a.createElement("ul",null,t.map((([e,t])=>i.a.createElement("li",{key:e},j(e,t)))))):null,docs:i.a.createElement("ul",null,i.a.createElement("li",null,i.a.createElement(m.b,null)),i.a.createElement("li",null,i.a.createElement(m.d,null)))}}),v={[d.qc]:{all:g},[d.S]:{write:y},[d.M]:{write:f},[d.L]:{write:f}},E=(e,t)=>{var a;const n=null===(a=Object.entries(v).find((([e])=>t.startsWith(e))))||void 0===a?void 0:a[1];return e.map((e=>null==n?void 0:n[e])).filter(Boolean).join(" ")},x=(e,t)=>i.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.missingPrivilegesCallOut.messageBody.missingIndexPrivileges",defaultMessage:"Missing {privileges} privileges for the {index} index. {explanation}",values:{privileges:i.a.createElement(p,{values:t}),index:i.a.createElement(l.EuiCode,null,e),explanation:E(t,e)}}),j=(e,t)=>i.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.missingPrivilegesCallOut.messageBody.missingFeaturePrivileges",defaultMessage:"Missing {privileges} privileges for the {index} feature. {explanation}",values:{privileges:i.a.createElement(p,{values:t}),index:i.a.createElement(l.EuiCode,null,e),explanation:E(t,e)}});var S=a(181),k=a(126);const O=["read","write","view_index_metadata","maintenance"],w=e=>{const t=(e=>{const[t]=Object.keys(e);return t})(e),a=e[t],n=O.filter((e=>!a[e]));if(n.length)return[t,n]},T=()=>{const e=(()=>{const{detectionEnginePrivileges:e,listPrivileges:t}=Object(k.a)(),[{canUserCRUD:a}]=Object(S.b)();return Object(n.useMemo)((()=>{const n=[],i=[];if(null==a||null==t.result||null==e.result)return{featurePrivileges:n,indexPrivileges:i};!1===a&&n.push([d.qc,["all"]]);const r=w(t.result.listItems.index);r&&i.push(r);const s=w(t.result.lists.index);s&&i.push(s);const o=w(e.result.index);return o&&i.push(o),{featurePrivileges:n,indexPrivileges:i}}),[a,t,e])})(),t=Object(n.useMemo)((()=>e.indexPrivileges.length>0||e.featurePrivileges.length>0?{type:"primary",id:`missing-user-privileges-${s()(e)}`,title:b,description:h(e)}:null),[e]);return t&&i.a.createElement(o.c,{namespace:"detections",condition:!0,message:t})},I=Object(n.memo)(T)},,function(e,t,a){"use strict";a.d(t,"b",(function(){return f})),a.d(t,"a",(function(){return y}));var n=a(2),i=a.n(n),r=a(40),s=a(41),o=a.n(s),l=a(102),c=a(222),u=a(1033),d=a(5);const p=d.i18n.translate("xpack.securitySolution.noPermissionsTitle",{defaultMessage:"Privileges required"}),m=d.i18n.translate("xpack.securitySolution.noPrivilegesDefaultMessage",{defaultMessage:"To view this page, you must update privileges. For more information, contact your Kibana administrator."}),b=d.i18n.translate("xpack.securitySolution.goToDocumentationButton",{defaultMessage:"View documentation"}),g=o()(r.EuiFlexItem).withConfig({displayName:"SizedEuiFlexItem",componentId:"sc-156zz3c-0"})(["min-height:460px;font-size:1.1rem;"]),f=i.a.memo((({pageName:e,docLinkSelector:t})=>i.a.createElement(c.a,null,i.a.createElement(r.EuiFlexGroup,null,i.a.createElement(g,null,i.a.createElement(r.EuiPageTemplate.EmptyPrompt,null,i.a.createElement(y,{pageName:e,docLinkSelector:t})))))));f.displayName="NoPrivilegePage";const y=i.a.memo((({pageName:e,docLinkSelector:t})=>{const{docLinks:a}=Object(l.j)().services,r=Object(n.useMemo)((()=>({feature:{icon:"documents",label:b,url:t(a.links),target:"_blank"}})),[t,a.links]),s=e?(e=>d.i18n.translate("xpack.securitySolution.noPrivilegesPerPageMessage",{values:{pageName:e},defaultMessage:"To view {pageName}, you must update privileges. For more information, contact your Kibana administrator."}))(e):m;return i.a.createElement(u.a,{actions:r,message:s,"data-test-subj":"noPrivilegesPage",title:p})}));y.displayName="NoPrivileges"},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(40),i=a(2),r=a.n(i);const s=a(5).i18n.translate("xpack.securitySolution.accessibility.tooltipWithKeyboardShortcut.pressTooltipLabel",{defaultMessage:"Press"}),o=({additionalScreenReaderOnlyContext:e="",content:t,shortcut:a,showShortcut:i})=>r.a.createElement(r.a.Fragment,null,r.a.createElement("div",{"data-test-subj":"content"},t),""!==e&&r.a.createElement(n.EuiScreenReaderOnly,{"data-test-subj":"additionalScreenReaderOnlyContext"},r.a.createElement("p",null,e)),i&&r.a.createElement(n.EuiText,{color:"subdued","data-test-subj":"shortcut",size:"s",textAlign:"center"},r.a.createElement("span",null,s)," ",r.a.createElement(n.EuiBadge,{color:"hollow"},a))),l=r.a.memo(o);l.displayName="TooltipWithKeyboardShortcut"},function(e,t,a){"use strict";a.d(t,"b",(function(){return o})),a.d(t,"a",(function(){return s}));var n=a(8),i=a(493);function r(e,t){var a,n,i;return null!==(a=null===(n=e.packagePrivileges)||void 0===n||null===(i=n.endpoint)||void 0===i?void 0:i.actions[t].executePackageAction)&&void 0!==a&&a}const s=(e,t,a=[])=>{var s;const o=e.isPlatinumPlus(),l=e.isEnterprise(),c=a.includes("superuser"),u=r(t,"writeSecuritySolution"),d=r(t,"readSecuritySolution"),p=r(t,"writeEndpointList"),m=r(t,"readEndpointList"),b=r(t,"writePolicyManagement"),g=r(t,"readPolicyManagement"),f=r(t,"writeActionsLogManagement"),y=r(t,"readActionsLogManagement"),h=r(t,"writeHostIsolation"),v=r(t,"writeHostIsolationRelease"),E=r(t,"writeProcessOperations"),x=r(t,"writeTrustedApplications"),j=r(t,"readTrustedApplications"),S=r(t,"writeHostIsolationExceptions"),k=r(t,"readHostIsolationExceptions"),O=r(t,"accessHostIsolationExceptions"),w=r(t,"deleteHostIsolationExceptions"),T=r(t,"writeBlocklist"),I=r(t,"readBlocklist"),C=r(t,"writeEventFilters"),M=r(t,"readEventFilters"),_=r(t,"writeFileOperations"),F=r(t,"writeExecuteOperations"),A={canWriteSecuritySolution:u,canReadSecuritySolution:d,canAccessFleet:null!==(s=null==t?void 0:t.fleet.all)&&void 0!==s&&s,canAccessEndpointManagement:c,canCreateArtifactsByPolicy:o,canWriteEndpointList:p,canReadEndpointList:m,canWritePolicyManagement:b,canReadPolicyManagement:g,canWriteActionsLogManagement:f,canReadActionsLogManagement:y&&l,canAccessEndpointActionsLogManagement:y&&o,canIsolateHost:h&&o,canUnIsolateHost:v,canKillProcess:E&&l,canSuspendProcess:E&&l,canGetRunningProcesses:E&&l,canAccessResponseConsole:!1,canWriteExecuteOperations:F&&l,canWriteFileOperations:_&&l,canWriteTrustedApplications:x,canReadTrustedApplications:j,canWriteHostIsolationExceptions:S&&o,canAccessHostIsolationExceptions:O&&o,canReadHostIsolationExceptions:k,canDeleteHostIsolationExceptions:w,canWriteBlocklist:T,canReadBlocklist:I,canWriteEventFilters:C,canReadEventFilters:M};return A.canAccessResponseConsole=l&&Object.values(Object(n.omit)(i.g,"release")).some((e=>A[e])),A},o=()=>({canWriteSecuritySolution:!1,canReadSecuritySolution:!1,canAccessFleet:!1,canAccessEndpointActionsLogManagement:!1,canAccessEndpointManagement:!1,canCreateArtifactsByPolicy:!1,canWriteEndpointList:!1,canReadEndpointList:!1,canWritePolicyManagement:!1,canReadPolicyManagement:!1,canWriteActionsLogManagement:!1,canReadActionsLogManagement:!1,canIsolateHost:!1,canUnIsolateHost:!1,canKillProcess:!1,canSuspendProcess:!1,canGetRunningProcesses:!1,canAccessResponseConsole:!1,canWriteFileOperations:!1,canWriteExecuteOperations:!1,canWriteTrustedApplications:!1,canReadTrustedApplications:!1,canWriteHostIsolationExceptions:!1,canAccessHostIsolationExceptions:!1,canReadHostIsolationExceptions:!1,canDeleteHostIsolationExceptions:!1,canWriteBlocklist:!1,canReadBlocklist:!1,canWriteEventFilters:!1,canReadEventFilters:!1})},function(e,t,a){"use strict";a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return g}));var n=a(40),i=a(2),r=a.n(i),s=a(140);const o=r.a.memo((({onClick:e})=>r.a.createElement(n.EuiButtonEmpty,{color:"text","data-test-subj":"open-timeline-button",iconSide:"left",iconType:"folderOpen",onClick:e},s.G)));o.displayName="OpenTimelineModalButton";var l=a(671),c=a(248),u=a(412),d=a(912);const p="add-timeline-button",m=["createFrom"],b=({timelineId:e})=>{const[t,a]=Object(i.useState)(!1),[s,b]=Object(i.useState)(!1),g=Object(i.useCallback)((()=>a(!t)),[t]),f=Object(i.useCallback)((()=>a(!1)),[]),y=Object(i.useCallback)((()=>b(!1)),[]),h=Object(i.useCallback)((()=>{f(),b(!0)}),[f]),v=Object(i.useMemo)((()=>r.a.createElement(n.EuiButtonIcon,{className:p,"data-test-subj":"settings-plus-in-circle",iconType:"plusInCircle",color:"primary",size:"m",onClick:g,"aria-label":c.a})),[g]);return r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiPopover,{anchorPosition:"downRight",button:v,id:"timelineSettingsPopover",panelProps:{"data-test-subj":"timeline-addPopupPanel"},isOpen:t,closePopover:f,ownFocus:!0,repositionOnScroll:!0},r.a.createElement(n.EuiFlexGroup,{alignItems:"flexStart",direction:"column",gutterSize:"none"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(u.c,{timelineId:e,title:c.h,closeGearMenu:f})),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(d.a,{closeGearMenu:f,timelineId:e,title:c.g})),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(o,{onClick:h}))))),s?r.a.createElement(l.a,{onClose:y,hideActions:m}):null)},g=r.a.memo(b)},,function(e,t,a){"use strict";e.exports=a(968)},function(e,t,a){"use strict";let n,i;a.d(t,"b",(function(){return n})),a.d(t,"a",(function(){return i})),function(e){e.host="host",e.user="user"}(n||(n={})),function(e){e.NOT_INSTALLED="NOT_INSTALLED",e.DISABLED="DISABLED",e.ENABLED="ENABLED"}(i||(i={}))},function(e,t,a){"use strict";let n;a.d(t,"a",(function(){return n})),function(e){e.userName="user.name",e.hostName="host.name"}(n||(n={}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=(e,t)=>Object.keys(t).reduce(((e,a)=>e.replace(new RegExp(`\\{${a}\\}`,"g"),String(t[a]))),e)},function(e,t,a){"use strict";a.d(t,"h",(function(){return s})),a.d(t,"i",(function(){return l})),a.d(t,"g",(function(){return c})),a.d(t,"f",(function(){return u})),a.d(t,"j",(function(){return d})),a.d(t,"e",(function(){return p})),a.d(t,"a",(function(){return m})),a.d(t,"d",(function(){return b})),a.d(t,"b",(function(){return g})),a.d(t,"c",(function(){return f}));var n=a(42),i=a(769),r=a(114);const s=(e,t,a)=>({...a,global:{...a.global,fullScreen:e===r.a.global?t:a.global.fullScreen},timeline:{...a.timeline,fullScreen:e===r.a.timeline?t:a.timeline.fullScreen}}),o=(e,t,a)=>t!==r.a.global&&t!==r.a.timeline||a!==r.a.socTrends?t!==r.a.socTrends||a!==r.a.global&&a!==r.a.timeline?e:Object(i.a)(e):Object(i.b)(e),l=(e,t,a)=>{const i=Object(n.get)(e,a);return null!=i?{...[e,...i.linkTo].reduce(((i,r)=>({...i,[r]:{...Object(n.get)(r,a),timerange:o(t,e,r)}})),e===r.a.timeline?{...a,global:{...a.global,linkTo:[]}}:a)}:a},c=e=>e.global.linkTo.indexOf(r.a.timeline)>-1?b([r.a.global,r.a.timeline],e):m([r.a.global,r.a.timeline],e),u=e=>e.global.linkTo.indexOf(r.a.socTrends)>-1?b([r.a.global,r.a.socTrends],e):m([r.a.global,r.a.socTrends],e),d=({inputId:e,id:t,inspect:a,loading:i,refetch:r,state:s,searchSessionId:o})=>{const l=s[e].queries.findIndex((e=>e.id===t));return{...s,[e]:{...Object(n.get)(e,s),queries:l>-1?[...s[e].queries.slice(0,l),{id:t,inspect:a,isInspected:s[e].queries[l].isInspected,loading:i,refetch:r,searchSessionId:s[e].queries[l].searchSessionId,selectedInspectIndex:s[e].queries[l].selectedInspectIndex},...s[e].queries.slice(l+1)]:[...s[e].queries,{id:t,inspect:a,isInspected:!1,loading:i,refetch:r,selectedInspectIndex:0,searchSessionId:o}]}}},p=({id:e,inputId:t,isInspected:a,selectedInspectIndex:i,state:r,searchSessionId:s})=>{const o=r[t].queries.findIndex((t=>t.id===e)),l=o>-1?r[t].queries[o]:null;return{...r,[t]:{...Object(n.get)(t,r),queries:o>-1?[...r[t].queries.slice(0,o),{...l,isInspected:a,selectedInspectIndex:i,searchSessionId:s},...r[t].queries.slice(o+1)]:[...r[t].queries]}}},m=(e,t)=>{if(2!==e.length)throw new Error("Only link 2 input states at a time");if(e.includes(r.a.socTrends)&&e.includes(r.a.timeline))throw new Error("Do not link socTrends to timeline. Only link socTrends to global");if(1===Array.from(new Set(e)).length)throw new Error("Input linkTo cannot link to itself");if(e.includes(r.a.timeline)&&e.includes(r.a.global)){const e=t.timeline.linkTo.includes(r.a.socTrends)||t.global.linkTo.includes(r.a.socTrends)?[r.a.socTrends]:[];return{...t,timeline:{...t.timeline,linkTo:[...e,r.a.global]},global:{...t.global,linkTo:[...e,r.a.timeline]},...t.socTrends&&e.length?{socTrends:{...t.socTrends,linkTo:[r.a.global,r.a.timeline]}}:{}}}if(e.includes(r.a.socTrends)&&e.includes(r.a.global)){const e=t.global.linkTo.includes(r.a.timeline)?[r.a.timeline]:[];return{...t,...t.socTrends?{socTrends:{...t.socTrends,linkTo:[...e,r.a.global]}}:{},global:{...t.global,linkTo:[...e,r.a.socTrends]},...e.length?{timeline:{...t.timeline,linkTo:[r.a.global,r.a.socTrends]}}:{}}}return t},b=(e,t)=>{if(2!==e.length)throw new Error("Only remove linkTo from 2 input states at a time");if(e.includes(r.a.socTrends)&&e.includes(r.a.timeline))throw new Error("Do not remove link socTrends to timeline. Only remove link socTrends to global");if(1===Array.from(new Set(e)).length)throw new Error("Input linkTo cannot remove link to itself");if(e.includes(r.a.timeline)&&e.includes(r.a.global)){const e=t.timeline.linkTo.includes(r.a.socTrends)||t.global.linkTo.includes(r.a.socTrends)?[r.a.socTrends]:[];return{...t,timeline:{...t.timeline,linkTo:[]},global:{...t.global,linkTo:e},...t.socTrends&&e.length?{socTrends:{...t.socTrends,linkTo:[r.a.global]}}:{}}}if(e.includes(r.a.socTrends)&&e.includes(r.a.global)){const e=t.global.linkTo.includes(r.a.timeline)?[r.a.timeline]:[];return{...t,...t.socTrends?{socTrends:{...t.socTrends,linkTo:[]}}:{},global:{...t.global,linkTo:e},...e.length?{timeline:{...t.timeline,linkTo:[r.a.global]}}:{}}}return t},g=({inputId:e,id:t,state:a})=>{const i=a[e].queries.findIndex((e=>e.id===t));return{...a,[e]:{...Object(n.get)(e,a),queries:i>-1?[...a[e].queries.slice(0,i),...a[e].queries.slice(i+1)]:[...a[e].queries]}}},f=e=>"queries"in e},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(22);const i=a.n(n)()("x-pack/security_solution/groups")("UPDATE_GROUPS")},,function(e,t,a){"use strict";a.d(t,"d",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return s})),a.d(t,"c",(function(){return o})),a.d(t,"f",(function(){return l})),a.d(t,"e",(function(){return c}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.timelines.pageTitle",{defaultMessage:"Timelines"}),r=n.i18n.translate("xpack.securitySolution.timelines.allTimelines.panelTitle",{defaultMessage:"All timelines"}),s=n.i18n.translate("xpack.securitySolution.timelines.allTimelines.importTimelineTitle",{defaultMessage:"Import"}),o=n.i18n.translate("xpack.securitySolution.timelines.allTimelines.errorFetchingTimelinesTitle",{defaultMessage:"Failed to query all timelines data"}),l=n.i18n.translate("xpack.securitySolution.timelines.updateTimelineErrorTitle",{defaultMessage:"Timeline error"}),c=n.i18n.translate("xpack.securitySolution.timelines.updateTimelineErrorText",{defaultMessage:"Something went wrong"})},function(e,t,a){"use strict";a.d(t,"h",(function(){return b})),a.d(t,"b",(function(){return g})),a.d(t,"c",(function(){return f})),a.d(t,"e",(function(){return y})),a.d(t,"a",(function(){return h})),a.d(t,"i",(function(){return v})),a.d(t,"I",(function(){return E})),a.d(t,"w",(function(){return x})),a.d(t,"H",(function(){return j})),a.d(t,"d",(function(){return k})),a.d(t,"g",(function(){return O})),a.d(t,"z",(function(){return w})),a.d(t,"J",(function(){return T})),a.d(t,"x",(function(){return I})),a.d(t,"F",(function(){return C})),a.d(t,"G",(function(){return M})),a.d(t,"B",(function(){return A})),a.d(t,"C",(function(){return P})),a.d(t,"D",(function(){return B})),a.d(t,"E",(function(){return $})),a.d(t,"y",(function(){return V})),a.d(t,"A",(function(){return U})),a.d(t,"k",(function(){return Q})),a.d(t,"p",(function(){return W})),a.d(t,"s",(function(){return K})),a.d(t,"r",(function(){return Y})),a.d(t,"q",(function(){return J})),a.d(t,"v",(function(){return X})),a.d(t,"n",(function(){return Z})),a.d(t,"j",(function(){return ee})),a.d(t,"K",(function(){return te})),a.d(t,"t",(function(){return ae})),a.d(t,"u",(function(){return ne})),a.d(t,"o",(function(){return ie})),a.d(t,"l",(function(){return re})),a.d(t,"m",(function(){return se})),a.d(t,"f",(function(){return oe}));var n=a(42),i=a(47),r=a(150),s=a(118),o=a(106),l=a(387),c=a(133),u=a(286),d=a(176),p=a(302),m=a(434);const b=e=>null!==e,g=({id:e,noteId:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,noteIds:[...n.noteIds,t]}}},f=({id:e,noteId:t,eventId:a,timelineById:i})=>{const r=i[e],s=Object(n.getOr)([],`eventIdToNoteIds.${a}`,r);return{...i,[e]:{...r,eventIdToNoteIds:{...r.eventIdToNoteIds,[a]:Object(n.uniq)([...s,t])}}}},y=({id:e,resolveTimelineConfig:t,timeline:a,timelineById:n})=>{var i;return((e,t,a)=>e===s.c.active&&t.savedObjectId!==a.savedObjectId)(e,n[e],a)&&(p.a.setActivePage(0),p.a.setExpandedDetail({})),{...n,[e]:{...a,filterManager:n[e].filterManager,isLoading:n[e].isLoading,initialized:null!==(i=a.initialized)&&void 0!==i?i:n[e].initialized,resolveTimelineConfig:t,dateRange:a.status===o.k.immutable&&a.timelineType===o.l.template?{start:u.a.toISOString(),end:u.b.toISOString()}:a.dateRange}}},h=({id:e,timelineById:t,timelineType:a,dateRange:n,...r})=>{const s=t[e],{from:u,to:d}=Object(l.a)({from:"",to:""}),p=null!=n?n:{start:u,end:d},m=a===o.l.template?{templateTimelineId:Object(i.v4)(),templateTimelineVersion:1}:{};return{...t,[e]:{id:e,...s||{},...c.b,...r,dateRange:p,savedObjectId:null,version:null,isSaving:!1,isLoading:!1,timelineType:a,...m}}},v=({id:e,eventId:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,pinnedEventIds:{...n.pinnedEventIds,[t]:!0}}}},E=({id:e,show:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,show:t}}},x=({id:e,graphEventId:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,graphEventId:t,...""===t&&e===s.c.active?{activeTab:n.prevActiveTab,prevActiveTab:n.activeTab}:{}}}},j=({id:e,sessionViewConfig:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,sessionViewConfig:t}}},S=(e,t)=>e.field===t.field&&e.value===t.value&&e.operator===t.operator,k=({id:e,providers:t,timelineById:a})=>{const i=a[e];return""!==i.highlightedDropAndProviderId?((e,t,a,i)=>{if(0===t.length)return i;let r=Object(n.cloneDeep)(a.dataProviders);return t.forEach((e=>{const t=r.findIndex((e=>e.id===a.highlightedDropAndProviderId)),s=r[t],o=s.and.findIndex((t=>t.id===e.id)),{and:l,...c}=e;if(Object(n.isEqualWith)(S,s.queryMatch,c.queryMatch)||-1===o&&s.and.filter((e=>Object(n.isEqualWith)(S,e.queryMatch,c.queryMatch))).length>0)return i;r=[...r.slice(0,t),{...r[t],and:o>-1?[...s.and.slice(0,o),c,...s.and.slice(o+1)]:[...s.and,c]},...r.slice(t+1)]})),{...i,[e]:{...a,dataProviders:r}}})(e,t,i,a):((e,t,a,i)=>{if(0===t.length)return i;let r=Object(n.cloneDeep)(a.dataProviders);return t.forEach((e=>{const t=r.findIndex((t=>t.id===e.id));t>-1&&!Object(n.isEmpty)(r[t].and)&&(e.id=`${e.id}-${r.filter((t=>t.id===e.id)).length}`),r=t>-1&&Object(n.isEmpty)(r[t].and)?[...r.slice(0,t),e,...r.slice(t+1)]:[...r,e]})),{...i,[e]:{...a,dataProviders:r}}})(e,t,i,a)},O=({id:e,filterQuery:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,kqlQuery:{...n.kqlQuery,filterQuery:t}}}},w=({id:e,kqlMode:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,kqlMode:t}}},T=({description:e,id:t,title:a,timelineById:n})=>{const i=n[t];return{...n,[t]:{...i,description:e.trim(),title:a.trim()}}},I=({id:e,isFavorite:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,isFavorite:t}}},C=({id:e,providers:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,dataProviders:t}}},M=({id:e,start:t,end:a,timelineById:n})=>{const i=n[e];return{...n,[e]:{...i,dateRange:{start:t,end:a}}}},_=(e,t,a,n)=>n.dataProviders.map((n=>n.id===a?{...n,and:n.and.map((a=>a.id===e?{...a,enabled:t}:a))}:n)),F=(e,t,a)=>a.dataProviders.map((a=>a.id===t?{...a,enabled:e}:a)),A=({id:e,providerId:t,enabled:a,timelineById:n,andProviderId:i})=>{const r=n[e];return{...n,[e]:{...r,dataProviders:i?_(i,a,t,r):F(a,t,r)}}},D=(e,t,a,n)=>n.dataProviders.map((n=>n.id===a?{...n,and:n.and.map((a=>a.id===e?{...a,excluded:t}:a))}:n)),N=(e,t,a)=>a.dataProviders.map((a=>a.id===t?{...a,excluded:e}:a)),P=({id:e,providerId:t,excluded:a,timelineById:n,andProviderId:i})=>{const r=n[e];return{...n,[e]:{...r,dataProviders:i?D(i,a,t,r):N(a,t,r)}}},R=({excluded:e,field:t,operator:a,providerId:n,timeline:i,value:r})=>i.dataProviders.map((i=>i.id===n?{...i,excluded:e,queryMatch:{...i.queryMatch,field:t,displayField:t,value:r,displayValue:Object(m.d)(r),operator:a}}:i)),L=({andProviderId:e,excluded:t,field:a,operator:n,providerId:i,timeline:r,value:s})=>r.dataProviders.map((r=>r.id===i?{...r,and:r.and.map((i=>i.id===e?{...i,excluded:t,queryMatch:{...i.queryMatch,field:a,displayField:a,value:s,displayValue:Object(m.d)(s),operator:n}}:i))}:r)),B=({andProviderId:e,excluded:t,field:a,id:n,operator:i,providerId:r,timelineById:s,value:o})=>{const l=s[n];return{...s,[n]:{...l,dataProviders:e?L({andProviderId:e,excluded:t,field:a,operator:i,providerId:r,timeline:l,value:o}):R({excluded:t,field:a,operator:i,providerId:r,timeline:l,value:o})}}},q=(e,t,a,n)=>n.dataProviders.map((n=>n.id===a?{...n,and:n.and.map((a=>a.id===e?{...a,type:t,name:t===r.a.template?`${a.queryMatch.field}`:"",queryMatch:{...a.queryMatch,displayField:void 0,displayValue:void 0,value:t===r.a.template?`{${a.queryMatch.field}}`:"",operator:t===r.a.template?r.d:r.b}}:a))}:n)),z=(e,t,a)=>a.dataProviders.map((a=>a.id===t?{...a,type:e,name:e===r.a.template?`${a.queryMatch.field}`:"",queryMatch:{...a.queryMatch,displayField:void 0,displayValue:void 0,value:e===r.a.template?`{${a.queryMatch.field}}`:"",operator:e===r.a.template?r.d:r.b}}:a)),$=({andProviderId:e,id:t,providerId:a,type:n,timelineById:i})=>{const s=i[t];return s.timelineType!==o.l.template&&n===r.a.template?i:{...i,[t]:{...s,dataProviders:e?q(e,n,a,s):z(n,a,s)}}},V=({id:e,itemsPerPage:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,itemsPerPage:t}}},U=({id:e,itemsPerPageOptions:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,itemsPerPageOptions:t}}},H=(e,t,a)=>{var n,i,r,s;const o=a.dataProviders.findIndex((e=>e.id===t)),l=null===(n=a.dataProviders[o])||void 0===n?void 0:n.and.findIndex((t=>t.id===e));return[...a.dataProviders.slice(0,o),{...a.dataProviders[o],and:null!==(i=a.dataProviders[o])&&void 0!==i&&i.and?[...null===(r=a.dataProviders[o])||void 0===r?void 0:r.and.slice(0,l),...null===(s=a.dataProviders[o])||void 0===s?void 0:s.and.slice(l+1)]:[]},...a.dataProviders.slice(o+1)]},G=(e,t)=>{var a;const n=t.dataProviders.findIndex((t=>t.id===e));return[...t.dataProviders.slice(0,n),...null!==(a=t.dataProviders[n])&&void 0!==a&&a.and.length?[{...t.dataProviders[n].and.slice(0,1)[0],and:[...t.dataProviders[n].and.slice(1)]}]:[],...t.dataProviders.slice(n+1)]},Q=({id:e,providerId:t,timelineById:a,andProviderId:n})=>{const i=a[e];return{...a,[e]:{...i,dataProviders:n?H(n,t,i):G(t,i)}}},W=({id:e,eventId:t,timelineById:a})=>{const i=a[e];return{...a,[e]:{...i,pinnedEventIds:Object(n.omit)(t,i.pinnedEventIds)}}},K=({id:e,savedQueryId:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,savedQueryId:t}}},Y=({id:e,filters:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,filters:t}}},J=({id:e,excludedRowRendererIds:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,excludedRowRendererIds:t}}},X=e=>{var t;const{tabType:a,id:n,...i}=e,r=new Set(["eventDetail","hostDetail","networkDetail","userDetail"]),s=null!=a?a:"query",o={params:i.params?{...i.params}:{},panelView:i.panelView};return{[s]:r.has(null!==(t=i.panelView)&&void 0!==t?t:"")?o:{}}},Z=({id:e,eventIds:t,isLoading:a,timelineById:i})=>{const r=i[e],s=a?Object(n.union)(r.loadingEventIds,t):r.loadingEventIds.filter((e=>!t.includes(e)));return{...i,[e]:{...r,loadingEventIds:s}}},ee=({id:e,columnId:t,timelineById:a})=>{const n=a[e],i=n.columns.filter((e=>e.id!==t));return{...a,[e]:{...n,columns:i}}},te=({column:e,id:t,index:a,timelineById:n})=>{const i=n[t];if(-1!==i.columns.findIndex((t=>t.id===e.id))){const r=i.columns.filter((t=>t.id!==e.id));return r.splice(a,0,e),{...n,[t]:{...i,columns:r}}}const r=[...i.columns];return r.splice(a,0,e),{...n,[t]:{...i,columns:r}}},ae=({id:e,columns:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,columns:t}}},ne=({id:e,sort:t,timelineById:a})=>{const n=a[e];return{...a,[e]:{...n,sort:t}}},ie=({id:e,eventIds:t,isSelectAllChecked:a=!1,isSelected:i,timelineById:r})=>{const s=r[e],o=i?{...s.selectedEventIds,...t}:Object(n.omit)(Object.keys(t),s.selectedEventIds);return{...r,[e]:{...s,selectedEventIds:o,isSelectAllChecked:a}}},re=({id:e,eventIds:t,isDeleted:a,timelineById:i})=>{const r=i[e],s=a?Object(n.union)(r.deletedEventIds,t):r.deletedEventIds.filter((e=>!t.includes(e))),o=Object.fromEntries(Object.entries(r.selectedEventIds).filter((([e])=>!s.includes(e)))),l=Object.keys(o).length>0&&r.isSelectAllChecked;return{...i,[e]:{...r,deletedEventIds:s,selectedEventIds:o,isSelectAllChecked:l}}},se=({id:e,timelineById:t,timelineSettingsProps:a})=>{var i;const r=t[e];return null!=r&&r.initialized?t:{...t,[e]:{...c.b,...Object(c.a)(e),...r,...a,...!r||Object(n.isEmpty)(r.columns)&&!Object(n.isEmpty)(a.defaultColumns)?{columns:a.defaultColumns}:{},sort:null!==(i=a.sort)&&void 0!==i?i:c.b.sort,loadingEventIds:c.b.loadingEventIds,initialized:!0}}},oe=({id:e,columnId:t,delta:a,timelineById:n})=>{var i;const r=n[e],s=r.columns.findIndex((e=>e.id===t));if(-1===s)return{...n,[e]:{...r}};const o=(null!==(i=r.columns[s].initialWidth)&&void 0!==i?i:d.a)+a,l=Math.max(d.c,o),c={...r.columns[s],initialWidth:l},u=[...r.columns.slice(0,s),c,...r.columns.slice(s+1)];return{...n,[e]:{...r,columns:u}}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(42),i=a(50),r=a.n(i);const s=e=>{if(Object(n.isString)(e)&&""!==e.trim()){const t=r()(new Date(e));return t.isValid()||isNaN(+e)?t:r()(new Date(+e))}return r()(new Date(e))}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r}));var n=a(42);function i(e){return Object(n.isString)(e)?r(e):`${e}`}function r(e){return`"${function(e=""){return s(e)}(e)}"`}const s=Object(n.flow)((e=>e.replace(/["]/g,"\\$&")),(e=>e.replace(/\t/g,"\\t").replace(/\r/g,"\\r").replace(/\n/g,"\\n")))},function(e,t,a){"use strict";a.d(t,"b",(function(){return p})),a.d(t,"a",(function(){return m}));var n=a(42),i=a(119),r=a(4);a(102);const s="securityDataTable",o="timelines",l={},c=e=>e?Object.keys(e).reduce(((t,a)=>{const n=e[a];return{...t,[a]:{defaultColumns:n.defaultColumns,dataViewId:n.dataViewId,excludedRowRendererIds:n.excludedRowRendererIds,filters:n.filters,indexNames:n.indexNames,loadingEventIds:n.loadingEventIds,isSelectAllChecked:n.isSelectAllChecked,itemsPerPage:n.itemsPerPage,itemsPerPageOptions:n.itemsPerPageOptions,showCheckboxes:n.showCheckboxes,graphEventId:n.graphEventId,sessionViewConfig:n.sessionViewConfig,selectAll:n.selectAll,id:n.id,title:n.title,initialized:n.initialized,updated:n.updated,sort:n.sort,selectedEventIds:n.selectedEventIds,deletedEventIds:n.deletedEventIds,expandedDetail:n.expandedDetail,totalCount:n.totalCount||0,viewMode:r.Jc.gridView,additionalFilters:{showBuildingBlockAlerts:!1,showOnlyThreatIndicatorAlerts:!1},...Array.isArray(n.columns)?{columns:n.columns.map(u).map(d)}:{}}}}),{}):l,u=e=>({...e,...Number.isInteger(e.width)&&!Number.isInteger(e.initialWidth)?{initialWidth:e.width}:e.initialWidth?{initialWidth:e.initialWidth}:{}}),d=e=>({...e,...Object(n.isEmpty)(e.label)||null!=e.displayAsText?e.displayAsText?{displayAsText:e.displayAsText}:{}:{displayAsText:e.label}}),p=(e,t)=>{let a=e.get(s);const n=e.get(o);if(!a){if(!n)return l;a=c(n)}return((e,t)=>{const a={[i.e.alertsOnAlertsPage]:`detection-engine-alert-table-${r.e.ALERTS_PAGE}-gridView`,[i.e.alertsOnRuleDetailsPage]:`detection-engine-alert-table-${r.e.RULE_DETAILS}-gridView`};Object.keys(t).filter((t=>t in a&&!e.get(a[t]))).map((e=>({[a[e]]:{columns:t[e].columns,sort:t[e].sort.map((e=>({[e.columnId]:{order:e.sortDirection}}))),visibleColumns:t[e].columns}}))).forEach((t=>Object.keys(t).forEach((a=>{e.set(a,t[a])}))))})(e,a),(e=>{[`detection-engine-alert-table-${r.e.ALERTS_PAGE}-gridView`,`detection-engine-alert-table-${r.e.RULE_DETAILS}-gridView`].forEach((t=>{const a=e.get(t);if(a&&"visibleColumns"in a){const n=a.visibleColumns;if(n.every((e=>"string"==typeof e)))return;const i=n.map((e=>"string"==typeof e?e:e.id)).filter(Boolean);e.set(t,{...a,visibleColumns:i})}}))})(e),t.reduce(((e,t)=>{const n=a[t];return n?{...e,[t]:{...n,...null==n.sort||Array.isArray(n.sort)?{}:{sort:[n.sort]}}}:{...e}}),{})},m=(e,t,a)=>{const n=b(a),i=(e=>{let t=e.get(s);const a=e.get(o);if(!t){if(!a)return l;t=c(a)}return t})(e);e.set(s,{...i,[t]:n})},b=e=>{const{isLoading:t,loadingText:a,queryFields:n,unit:i,...r}=e;return r}},function(e,t,a){e.exports=a(33)(811)},function(e,t,a){e.exports=a(33)(1608)},function(e,t,a){e.exports=a(33)(3344)},function(e,t,a){"use strict";a.d(t,"a",(function(){return b})),a.d(t,"b",(function(){return g}));var n=a(40),i=a(50),r=a.n(i),s=a(2),o=a.n(s),l=a(41),c=a.n(l),u=a(47),d=a(551),p=a(168);d.f;const m=c.a.h3.withConfig({displayName:"TitleText",componentId:"sc-7x1zh4-0"})(["margin:0 5px;cursor:default;user-select:none;"]);m.displayName="TitleText",o.a.memo((({noteIds:e})=>o.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(n.EuiIcon,{color:"text",size:"l",type:"editorComment"})),o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(n.EuiTitle,{size:"s"},o.a.createElement(m,null,d.e))),o.a.createElement(n.EuiFlexItem,{grow:!1},o.a.createElement(p.c,{color:"hollow"},e.length))))).displayName="NotesCount";const b=({newNote:e,user:t})=>({created:r.a.utc().toDate(),id:Object(u.v4)(),lastEdit:null,note:e,saveObjectId:null,user:t,version:null}),g=({associateNote:e,newNote:t,updateNewNote:a,updateNote:n,user:i})=>{const r=b({newNote:t,user:i});n(r),e(r.id),a("")}},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n={BULK_QUERY_STATUS_UPDATE:"Data table bulkQueryStatusUpdate",BULK_STATUS_UPDATE:"Data table bulkStatusUpdate",STATUS_UPDATE:"Data table statusUpdate"}},,function(e,t,a){"use strict";a.d(t,"d",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"f",(function(){return s})),a.d(t,"e",(function(){return o})),a.d(t,"c",(function(){return l})),a.d(t,"b",(function(){return c}));var n=a(5);const i="timeline",r=n.i18n.translate("xpack.securitySolution.actions.cellValue.addToTimeline.displayName",{defaultMessage:"Add to timeline"}),s=n.i18n.translate("xpack.securitySolution.actions.cellValue.addToNewTimeline.displayName",{defaultMessage:"Investigate in timeline"}),o=e=>n.i18n.translate("xpack.securitySolution.actions.addToTimeline.addedFieldMessage",{values:{fieldOrValue:e},defaultMessage:"Added {fieldOrValue} to timeline"}),l=n.i18n.translate("xpack.securitySolution.actions.cellValue.addToTimeline.warningTitle",{defaultMessage:"Unable to add to timeline"}),c=n.i18n.translate("xpack.securitySolution.actions.cellValue.addToTimeline.warningMessage",{defaultMessage:"Filter received is empty or cannot be added to timeline"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return c})),a.d(t,"b",(function(){return p}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(497);const c="exit-full-screen",u=o()(n.EuiButton).withConfig({displayName:"StyledEuiButton",componentId:"sc-ve6et8-0"})(["margin:",";"],(({theme:e})=>e.eui.euiSizeS)),d=({fullScreen:e,setFullScreen:t})=>{const a=Object(i.useCallback)((()=>{t(!1)}),[t]),s=Object(i.useCallback)((e=>{"Escape"===e.key&&(e.preventDefault(),a())}),[a]);return e?r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiWindowEvent,{event:"keydown",handler:s}),r.a.createElement(u,{className:c,"data-test-subj":"exit-full-screen",fullWidth:!1,iconType:"fullScreen",isDisabled:!e,onClick:a},l.a)):null};d.displayName="ExitFullScreenComponent";const p=r.a.memo(d)},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(294);const c=o.a.div.withConfig({displayName:"PlaceHolder",componentId:"sc-pcodem-0"})(["padding:",";"],(e=>e.theme.eui.euiSizeS)),u=({count:e,onClick:t})=>{const a=Object(i.useCallback)((()=>t&&t()),[t]);return e?t?r.a.createElement(n.EuiLink,{onClick:a},r.a.createElement("b",null,r.a.createElement(l.a,{count:e}))):r.a.createElement("b",null,r.a.createElement(l.a,{count:e})):r.a.createElement(c,null)};u.displayName="ChartLabelComponent";const d=r.a.memo(u)},function(e,t,a){"use strict";a.d(t,"b",(function(){return y})),a.d(t,"a",(function(){return h}));var n=a(40),i=a(2),r=a.n(i),s=a(57),o=a(8),l=a(41),c=a.n(l),u=a(297),d=a(424),p=a(725);const m={chartMargins:{top:0,bottom:0,left:0,right:0},partition:{idealFontSizeJump:1.1,outerSizeRatio:1,emptySizeRatio:.8,circlePadding:4}},b=c()(n.EuiFlexGroup).withConfig({displayName:"DonutTextWrapper",componentId:"sc-g5h38u-0"})(["top:",";width:100%;max-width:77px;position:absolute;z-index:1;",""],(({$isChartEmbeddablesEnabled:e,$dataExists:t})=>e&&!t?"66%":"34%;"),(({className:e,$donutTextWrapperStyles:t})=>e&&t?`&.${e} {${t}}`:"")),g=c()(n.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItem",componentId:"sc-g5h38u-1"})(["position:relative;align-items:center;"]),f=({children:e,dataExists:t,donutTextWrapperClassName:a,donutTextWrapperStyles:s,isChartEmbeddablesEnabled:o,label:l,title:c})=>{const{euiTheme:u}=Object(n.useEuiTheme)(),d=Object(i.useMemo)((()=>({color:u.colors.disabled})),[u.colors.disabled]),p=o?void 0:"eui-textTruncate";return r.a.createElement(n.EuiFlexGroup,{alignItems:"center",justifyContent:"center",responsive:!1,gutterSize:"l","data-test-subj":"donut-chart"},r.a.createElement(g,{grow:o},r.a.createElement(b,{$dataExists:t,$donutTextWrapperStyles:s,$isChartEmbeddablesEnabled:o,alignItems:"center",className:a,direction:"column",gutterSize:"none",justifyContent:"center"},r.a.createElement(n.EuiFlexItem,null,c),l&&r.a.createElement(n.EuiFlexItem,{className:p},r.a.createElement(n.EuiToolTip,{content:l},r.a.createElement(n.EuiText,{className:p,size:"s",style:t?void 0:d},l)))),e))},y=r.a.memo(f),h=({data:e,fillColor:t,height:a=90,label:l,legendItems:c,onPartitionClick:b,title:g,totalCount:f})=>{const{baseTheme:h,theme:v}=Object(u.i)(),E=Object(i.useCallback)((e=>{if(b){var t;const a=e.flat(2),n=a.length>0&&"groupByRollup"in a[0]&&null!=(null===(t=a[0])||void 0===t?void 0:t.groupByRollup)?`${a[0].groupByRollup}`:"";Object(o.isEmpty)(n.trim())||b(n.toLowerCase())}}),[b]);return r.a.createElement(y,{dataExists:null!=e&&e.length>0,label:l,title:g,isChartEmbeddablesEnabled:!1},r.a.createElement(r.a.Fragment,null,null==e||null==f||0===f?r.a.createElement(p.a,{size:a}):r.a.createElement(s.Chart,{size:a},r.a.createElement(s.Settings,{theme:[m,v],baseTheme:h,onElementClick:E}),r.a.createElement(s.Partition,{id:"donut-chart",data:e,layout:s.PartitionLayout.sunburst,valueAccessor:e=>e.value,valueFormatter:e=>`${Object(s.defaultPartitionValueFormatter)(e)}`,layers:[{groupByRollup:e=>{var t;return null!==(t=e.label)&&void 0!==t?t:e.key},nodeLabel:e=>e,shape:{fillColor:t}}]})),c&&(null==c?void 0:c.length)>0&&r.a.createElement(n.EuiFlexItem,null,r.a.createElement(d.a,{legendItems:c,height:a}))))}},function(e,t,a){"use strict";a.d(t,"b",(function(){return l})),a.d(t,"a",(function(){return p}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(40);const l="#FAFBFD",c=s.a.div.withConfig({displayName:"BigRing",componentId:"sc-1m6sj8k-0"})(["border-radius:50%;",""],(({size:e})=>`height: ${e}px;\n    width: ${e}px;\n    background-color: ${l};\n    text-align: center;\n    line-height: ${e}px;`)),u=s.a.div.withConfig({displayName:"SmallRing",componentId:"sc-1m6sj8k-1"})(["border-radius:50%;",""],(({size:e})=>`\n    height: ${e}px;\n    width: ${e}px;\n    background-color: ${Object(o.useEuiBackgroundColor)("plain")};\n    display: inline-block;\n    vertical-align: middle;`)),d=({size:e=90,donutWidth:t=20})=>e-t>0?i.a.createElement(c,{size:e,"data-test-subj":"empty-donut"},i.a.createElement(u,{size:e-t,"data-test-subj":"empty-donut-small"})):null,p=i.a.memo(d)},function(e,t,a){"use strict";a.d(t,"a",(function(){return R}));var n=a(104),i=a.n(n),r=a(40),s=a(2),o=a.n(s),l=a(57),c=a(42),u=a(343),d=a.n(u),p=a(47),m=a(41),b=a.n(m),g=a(130),f=a.n(g),y=a(153),h=a(102),v=a(456),E=a(293),x=a(228),j=a(327),S=a(917),k=a(297),O=a(424),w=a(390),T=a(311),I=a(211);const C=b()(r.EuiFlexItem).withConfig({displayName:"LegendFlexItem",componentId:"sc-1257qcd-0"})(["overview:hidden;"]),M=e=>null!=e&&!!Object(c.get)("value.length",e)&&(e.value||[]).every((({x:e,y:t})=>Object(c.isNumber)(t)&&t>=0)),_=["y"],F=[e=>Object(x.a)(e.g)?e.g:j.c],A=({data:e,forceHiddenLegend:t=!1,yAxisTitle:a,...n})=>{const r=Object(k.i)(),u=Object(h.m)(),p=Object(c.get)("configs.axis.xTickFormatter",n),m=Object(c.get)("configs.axis.yTickFormatter",n),b=Object(c.getOr)(0,"configs.axis.tickSize",n),g=`stat-items-barchart-${e[0].key}-x`,f=`stat-items-barchart-${e[0].key}-y`,y={...k.e,...d()(Object(c.get)("configs.settings",n),r)},v=Object(s.useMemo)((()=>d()({tickLine:{size:b}},Object(c.getOr)({},"configs.axis.bottom.style",n))),[n,b]),E=Object(s.useMemo)((()=>d()({tickLine:{size:b}},Object(c.getOr)({},"configs.axis.left.style",n))),[n,b]),x=Object(c.get)("configs.axis.bottom.labelFormat",n);return n.width&&n.height?o.a.createElement(l.Chart,null,o.a.createElement(l.Settings,i()({},y,{showLegend:y.showLegend&&!t})),e.map((e=>{var t;const a=e.key;return M(e)?o.a.createElement(l.BarSeries,{id:a,key:a,name:e.key,xScaleType:Object(c.getOr)(l.ScaleType.Linear,"configs.series.xScaleType",n),yScaleType:Object(c.getOr)(l.ScaleType.Linear,"configs.series.yScaleType",n),xAccessor:"x",yAccessors:_,timeZone:u,splitSeriesAccessors:F,data:null!==(t=e.value)&&void 0!==t?t:[],stackAccessors:Object(c.get)("configs.series.stackAccessors",n),color:e.color?e.color:void 0,barSeriesStyle:Object(c.get)("configs.series.barSeriesStyle",n)}):null})),o.a.createElement(l.Axis,{id:g,position:l.Position.Bottom,showOverlappingTicks:!1,style:v,tickFormat:p,labelFormat:x}),o.a.createElement(l.Axis,{id:f,position:l.Position.Left,style:E,tickFormat:m,title:a})):null};A.displayName="BarChartBaseComponent";const D=o.a.memo(A);D.displayName="BarChartBase";const N=[],P=({barChart:e,configs:t,stackByField:a,scopeId:n,visualizationActionsOptions:l})=>{const{ref:u,width:d,height:m}=Object(E.b)(),b=Object(s.useMemo)((()=>null!=e&&null!=a?e.map(((e,t)=>{var i;return{color:null!==(i=e.color)&&void 0!==i?i:t<v.a.length?v.a[t]:void 0,dataProviderId:Object(y.i)(`draggable-legend-item-${Object(p.v4)()}-${a}-${e.key}`),scopeId:n,field:a,value:e.key}})):N),[e,a,n]),g=Object(c.get)("yAxisTitle",t),f=Object(c.get)("customHeight",t),h=Object(c.get)("customWidth",t),x=Object(k.g)(f,m),j=Object(k.h)(h,d),_=Object(s.useMemo)((()=>{return t=e,Array.isArray(t)&&!Object(k.f)(t)&&t.some(M);var t}),[e]);return o.a.createElement(k.d,null,o.a.createElement(T.a,{targetClassNames:[I.a]},_&&e&&o.a.createElement(k.a,{gutterSize:"none"},o.a.createElement(r.EuiFlexItem,{grow:!0},o.a.createElement(k.c,{ref:u,height:x},o.a.createElement(D,{configs:t,data:e,yAxisTitle:g,forceHiddenLegend:null!=a,height:x,width:x}))),o.a.createElement(C,{grow:!1},o.a.createElement(O.a,{legendItems:b,height:m}))),!_&&o.a.createElement(S.a,{height:x,width:j,data:e}),null!=l&&o.a.createElement(w.a,i()({},l,{className:"viz-actions"}))))},R=o.a.memo(P,((e,t)=>e.stackByField===t.stackByField&&e.scopeId===t.scopeId&&f()(e.configs,t.configs)&&f()(e.barChart,t.barChart)))},,,function(e,t,a){"use strict";a.d(t,"T",(function(){return i})),a.d(t,"n",(function(){return r})),a.d(t,"L",(function(){return s})),a.d(t,"p",(function(){return o})),a.d(t,"a",(function(){return l})),a.d(t,"b",(function(){return c})),a.d(t,"ab",(function(){return u})),a.d(t,"M",(function(){return d})),a.d(t,"u",(function(){return p})),a.d(t,"s",(function(){return m})),a.d(t,"t",(function(){return b})),a.d(t,"r",(function(){return g})),a.d(t,"q",(function(){return f})),a.d(t,"cb",(function(){return y})),a.d(t,"Q",(function(){return h})),a.d(t,"bb",(function(){return v})),a.d(t,"O",(function(){return E})),a.d(t,"P",(function(){return x})),a.d(t,"eb",(function(){return j})),a.d(t,"v",(function(){return S})),a.d(t,"R",(function(){return k})),a.d(t,"X",(function(){return O})),a.d(t,"Z",(function(){return w})),a.d(t,"Y",(function(){return T})),a.d(t,"G",(function(){return I})),a.d(t,"H",(function(){return C})),a.d(t,"F",(function(){return M})),a.d(t,"J",(function(){return _})),a.d(t,"I",(function(){return F})),a.d(t,"E",(function(){return A})),a.d(t,"N",(function(){return D})),a.d(t,"c",(function(){return N})),a.d(t,"K",(function(){return P})),a.d(t,"S",(function(){return R})),a.d(t,"d",(function(){return L})),a.d(t,"m",(function(){return B})),a.d(t,"o",(function(){return q})),a.d(t,"g",(function(){return z})),a.d(t,"f",(function(){return $})),a.d(t,"l",(function(){return V})),a.d(t,"j",(function(){return U})),a.d(t,"k",(function(){return H})),a.d(t,"h",(function(){return G})),a.d(t,"i",(function(){return Q})),a.d(t,"e",(function(){return W})),a.d(t,"db",(function(){return K})),a.d(t,"W",(function(){return Y})),a.d(t,"U",(function(){return J})),a.d(t,"V",(function(){return X})),a.d(t,"w",(function(){return Z})),a.d(t,"C",(function(){return ee})),a.d(t,"A",(function(){return te})),a.d(t,"z",(function(){return ae})),a.d(t,"B",(function(){return ne})),a.d(t,"D",(function(){return ie})),a.d(t,"x",(function(){return re})),a.d(t,"y",(function(){return se}));var n=a(5);n.i18n.translate("xpack.securitySolution.detectionEngine.rules.all.exceptions.idTitle",{defaultMessage:"List ID"}),n.i18n.translate("xpack.securitySolution.detectionEngine.rules.all.exceptions.listName",{defaultMessage:"Name"}),n.i18n.translate("xpack.securitySolution.detectionEngine.rules.all.exceptions.actionsTitle",{defaultMessage:"Actions"});const i=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.rules.all.exceptions.showingExceptionLists",{values:{totalLists:e},defaultMessage:"Showing {totalLists} {totalLists, plural, =1 {list} other {lists}}"}),r=(n.i18n.translate("xpack.securitySolution.detectionEngine.rules.all.exceptions.rulesAssignedTitle",{defaultMessage:"Rules assigned to"}),n.i18n.translate("xpack.securitySolution.detectionEngine.rules.all.exceptions.dateCreatedTitle",{defaultMessage:"Date created"}),n.i18n.translate("xpack.securitySolution.detectionEngine.rules.all.exceptions.dateUpdatedTitle",{defaultMessage:"Last edited"}),n.i18n.translate("xpack.securitySolution.detectionEngine.rules.all.exceptions.errorFetching",{defaultMessage:"Error fetching exception lists"})),s=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allExceptionLists.filters.noExceptionsTitle",{defaultMessage:"No exception lists found"}),o=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allExceptionLists.search.placeholder",{defaultMessage:"Search exception lists"}),l=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allExceptions.tableTitle",{defaultMessage:"Shared Exception Lists"}),c=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allExceptions.tableSubtitle",{defaultMessage:"To view rule specific exceptions navigate to that rule's details page."}),u=e=>n.i18n.translate("xpack.securitySolution.exceptions.allExceptionsRowPerPage",{defaultMessage:"Rows per page: {rowSize}",values:{rowSize:e}}),d=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.allExceptions.filters.noListsBody",{defaultMessage:"We weren't able to find any exception lists."}),p=e=>n.i18n.translate("xpack.securitySolution.exceptions.list.export_success",{values:{listName:e},defaultMessage:'Exception list "{listName}" exported successfully'}),m=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.all.exceptions.exportError",{defaultMessage:"Exception list export error"}),b=e=>n.i18n.translate("xpack.securitySolution.exceptions.list.duplicate_success",{values:{listName:e},defaultMessage:'Exception list "{listName}" duplicated successfully'}),g=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.all.exceptions.duplicateError",{defaultMessage:"Exception list duplication error"}),f=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.all.exceptions.deleteError",{defaultMessage:"Error occurred deleting exception list"}),y=e=>n.i18n.translate("xpack.securitySolution.exceptions.referenceModalSuccessDescription",{defaultMessage:"Exception list - {listId} - deleted successfully.",values:{listId:e}}),h=n.i18n.translate("xpack.securitySolution.exceptions.referenceModalTitle",{defaultMessage:"Remove exception list"}),v=e=>n.i18n.translate("xpack.securitySolution.exceptions.referenceModalDefaultDescription",{defaultMessage:"Are you sure you wish to DELETE exception list with the name {listName}?",values:{listName:e}}),E=n.i18n.translate("xpack.securitySolution.exceptions.referenceModalCancelButton",{defaultMessage:"Cancel"}),x=n.i18n.translate("xpack.securitySolution.exceptions.referenceModalDeleteButton",{defaultMessage:"Remove exception list"}),j=e=>n.i18n.translate("xpack.securitySolution.exceptions.referenceModalDescription",{defaultMessage:"This exception list is associated with ({referenceCount}) {referenceCount, plural, =1 {rule} other {rules}}. Removing this exception list will also remove its reference from the associated rules.",values:{referenceCount:e}}),S=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.all.exceptions.searchPlaceholder",{defaultMessage:"Search by name or list_id:id"}),k=n.i18n.translate("xpack.securitySolution.detectionEngine.rules.all.exceptions.refresh",{defaultMessage:"Refresh"}),O=n.i18n.translate("xpack.securitySolution.exceptions.exceptionListsImportButton",{defaultMessage:"Import list"}),w=n.i18n.translate("xpack.securitySolution.lists.exceptionListImportSuccessTitle",{defaultMessage:"Exception list imported"}),T=n.i18n.translate("xpack.securitySolution.lists.exceptionListUploadError",{defaultMessage:"There was an error uploading the exception list."}),I=n.i18n.translate("xpack.securitySolution.exceptions.manageExceptions.importExceptionList",{defaultMessage:"Import exception list"}),C=n.i18n.translate("xpack.securitySolution.exceptionsTable.importExceptionListFlyoutHeader",{defaultMessage:"Import shared exception list"}),M=n.i18n.translate("xpack.securitySolution.exceptionsTable.importExceptionListFlyoutBody",{defaultMessage:"Select shared exception lists to import"}),_=n.i18n.translate("xpack.securitySolution.exceptionsTable.importExceptionListWarning",{defaultMessage:"We found a pre-existing list with that id"}),F=n.i18n.translate("xpack.securitySolution.exceptionsTable.importExceptionListOverwrite",{defaultMessage:"Overwrite the existing list"}),A=n.i18n.translate("xpack.securitySolution.exceptionsTable.importExceptionListAsNewList",{defaultMessage:"Create new list"}),D=n.i18n.translate("xpack.securitySolution.exceptions.badge.readOnly.tooltip",{defaultMessage:"Unable to create, edit or delete exceptions"}),N=n.i18n.translate("xpack.securitySolution.exceptions.exceptionListsCloseImportFlyout",{defaultMessage:"Close"}),P=n.i18n.translate("xpack.securitySolution.exceptions.exceptionListsFilePickerPrompt",{defaultMessage:"Select or drag and drop multiple files"}),R=n.i18n.translate("xpack.securitySolution.exceptionsTable.rulesCountLabel",{defaultMessage:"Rules"}),L=n.i18n.translate("xpack.securitySolution.exceptionsTable.createdBy",{defaultMessage:"Created By"}),B=n.i18n.translate("xpack.securitySolution.exceptionsTable.createdAt",{defaultMessage:"Date created"}),q=n.i18n.translate("xpack.securitySolution.exceptionsTable.exceptionsCountLabel",{defaultMessage:"Exceptions"}),z=n.i18n.translate("xpack.securitySolution.exceptions.manageExceptions.createSharedListButton",{defaultMessage:"Create shared list"}),$=n.i18n.translate("xpack.securitySolution.exceptions.manageExceptions.createItemButton",{defaultMessage:"Create exception item"}),V=n.i18n.translate("xpack.securitySolution.exceptions.createSharedExceptionListTitle",{defaultMessage:"Create shared exception list"}),U=n.i18n.translate("xpack.securitySolution.exceptions.createSharedExceptionListFlyoutNameField",{defaultMessage:"Shared exception list name"}),H=n.i18n.translate("xpack.securitySolution.exceptions.createSharedExceptionListFlyoutNameFieldPlaceholder",{defaultMessage:"New exception list"}),G=n.i18n.translate("xpack.securitySolution.exceptions.createSharedExceptionListFlyoutDescription",{defaultMessage:"Description (optional)"}),Q=n.i18n.translate("xpack.securitySolution.exceptions.createSharedExceptionListFlyoutDescriptionPlaceholder",{defaultMessage:"New exception list description"}),W=n.i18n.translate("xpack.securitySolution.exceptions.createSharedExceptionListFlyoutCreateButton",{defaultMessage:"Create shared exception list"}),K=e=>n.i18n.translate("xpack.securitySolution.exceptions.createSharedExceptionListSuccessDescription",{defaultMessage:"List with name {listName} was created!",values:{listName:e}}),Y=n.i18n.translate("xpack.securitySolution.exceptions.createSharedExceptionListSuccessTitle",{defaultMessage:"Created list"}),J=n.i18n.translate("xpack.securitySolution.exceptions.sortBy",{defaultMessage:"Sort by:"}),X=n.i18n.translate("xpack.securitySolution.exceptions.sortByCreateAt",{defaultMessage:"Created At"}),Z=n.i18n.translate("xpack.securitySolution.exceptions.expiredExceptionModalCancelButton",{defaultMessage:"Cancel"}),ee=n.i18n.translate("xpack.securitySolution.exceptions.expiredExceptionModalExportTitle",{defaultMessage:"Export exception list?"}),te=n.i18n.translate("xpack.securitySolution.exceptions.expiredExceptionModalDuplicateTitle",{defaultMessage:"Duplicate exception list?"}),ae=n.i18n.translate("xpack.securitySolution.exceptions.expiredExceptionModalIncludeDuplicateDescription",{defaultMessage:"You’re duplicating an exception list. Switch the toggle off to exclude expired exceptions."}),ne=n.i18n.translate("xpack.securitySolution.exceptions.expiredExceptionModalIncludeExportDescription",{defaultMessage:"You’re exporting an exception list. Switch the toggle off to exclude expired exceptions."}),ie=n.i18n.translate("xpack.securitySolution.exceptions.expiredExceptionModalIncludeSwitchLabel",{defaultMessage:"Include expired exceptions"}),re=n.i18n.translate("xpack.securitySolution.exceptions.expiredExceptionModalConfirmDuplicateButton",{defaultMessage:"Duplicate"}),se=n.i18n.translate("xpack.securitySolution.exceptions.expiredExceptionModalConfirmExportButton",{defaultMessage:"Export"})},function(e,t,a){"use strict";a.d(t,"b",(function(){return s})),a.d(t,"a",(function(){return o}));var n=a(42),i=a(176),r=a(190);const s=(e,t)=>e?e.map((e=>{const a=e.id.split("."),i=a.length>1?a[0]:(({browserFields:e,field:t})=>Object(n.has)(`base.fields.${t}`,e)?"base":t)({field:e.id,browserFields:t});return{...e,...Object(n.get)([i,"fields",e.id],t)}})):[],o=(e,t)=>{var a;return{columnHeaderType:r.a,id:e,initialWidth:i.a,...null!==(a=t.find((t=>t.id===e)))&&void 0!==a?a:{}}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(2),i=a(102),r=a(245);const s=(e=[])=>{const{getAppUrl:t}=Object(i.c)();return Object(n.useMemo)((()=>e.reduce(((e,a)=>{var n;const i=a.id,s=Object(r.j)(i);return e[i]={href:t({path:s}),children:null!==(n=a.name)&&void 0!==n?n:i,target:"_blank"},e}),{})),[t,e])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(45),i=a(2),r=a(8),s=a(290);const o=()=>{const e=Object(n.useLocation)(),t=Object(n.useHistory)(),{toUrlParams:a,urlParams:o}=Object(s.a)();return Object(i.useCallback)(((n,i=!1)=>{t.push({...e,search:a(i?n:Object(r.pickBy)({...o,...n},(e=>void 0!==e)))})}),[o,t,e,a])}},,function(e,t,a){"use strict";a.d(t,"a",(function(){return x})),a.d(t,"b",(function(){return j}));var n=a(40),i=a(2),r=a.n(i),s=a(42),o=a(119),l=a(17),c=a(105),u=a(382),d=a(291),p=a(272),m=a(199),b=a(188),g=a(116),f=a(946),y=a(682),h=a(4),v=a(183),E=a(328);const x=e=>{var t,a,o,l,c,u;const{columnId:g,rowIndex:h,scopeId:v}=e,E=Object(i.useMemo)((()=>g===b.n&&Object(p.c)(v)&&0===h&&!e.isDetails),[g,e.isDetails,h,v]),x=null===(t=e.ecsData)||void 0===t||null===(a=t.kibana)||void 0===a||null===(o=a.alert.suppression)||void 0===o||null===(l=o.docs_count)||void 0===l?void 0:l[0],j=null===(c=Object(s.find)({field:"kibana.alert.suppression.docs_count"},e.data))||void 0===c||null===(u=c.value)||void 0===u?void 0:u[0],S=x?parseInt(x,10):j,k=r.a.createElement(d.a,{isTourAnchor:E,step:m.a.pointToAlertName,tourId:m.b.alertsCases},r.a.createElement(f.a,e));return g===b.n&&S&&S>0?r.a.createElement(n.EuiFlexGroup,{gutterSize:"xs"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiToolTip,{position:"top",content:Object(y.c)(S)},r.a.createElement(n.EuiIcon,{type:"layers"}))),r.a.createElement(n.EuiFlexItem,{grow:!1},k)):k},j=({scopeId:e,tableId:t})=>()=>{var a;const{browserFields:n}=Object(g.d)(e),d=Object(i.useMemo)((()=>Object(v.a)(n)),[n]),p=Object(i.useMemo)((()=>o.j.getTableByIdSelector()),[]),m=Object(l.b)(),b=(null!==(a=Object(c.b)((e=>{var a;return(null!==(a=p(e,t))&&void 0!==a?a:o.q).viewMode})))&&void 0!==a?a:o.q.viewMode)===h.Jc.gridView?Object(E.b)(m):E.a;return Object(i.useCallback)((({columnId:e,colIndex:a,data:i,ecsData:o,eventId:l,header:c,isDetails:p=!1,isDraggable:m=!1,isExpandable:g,isExpanded:f,rowIndex:y,rowRenderers:h,setCellProps:v,linkValues:E,truncate:j=!0})=>{var S;const k=null!=c?c:{id:e,...d[e]},O=i.map((e=>{let t=e;if(["_id","_index"].includes(e.field)){var a;const n=null!==(a=e.value)&&void 0!==a?a:"";t={field:e.field,value:Array.isArray(n)?n:[n]}}return t})),w=b.find((t=>t.id===e)),T=Object(s.getOr)([],null!==(S=null==w?void 0:w.linkField)&&void 0!==S?S:"",o);return r.a.createElement(x,{browserFields:n,columnId:e,data:O,ecsData:o,eventId:l,header:k,isDetails:p,isDraggable:m,isExpandable:g,isExpanded:f,linkValues:null!=E?E:T,rowIndex:y,colIndex:a,rowRenderers:null!=h?h:u.b,setCellProps:v,scopeId:t,truncate:j,asPlainText:!1})}),[d,n,b])}},function(e,t,a){"use strict";var n;a.d(t,"a",(function(){return i})),function(e){e.GROUP_TOGGLED="alerts_table_toggled_",e.GROUPED_ALERTS="alerts_table_group_by_"}(n||(n={}));const i={groupToggled:({isOpen:e,groupingId:t,groupNumber:a})=>`${n.GROUP_TOGGLED}${e?"on":"off"}_${t}_group-${a}`,groupChanged:({groupingId:e,selected:t})=>`${n.GROUPED_ALERTS}${e}_${t}`}},function(e,t,a){"use strict";a.d(t,"d",(function(){return i})),a.d(t,"e",(function(){return r})),a.d(t,"i",(function(){return s})),a.d(t,"j",(function(){return o})),a.d(t,"b",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"a",(function(){return u})),a.d(t,"h",(function(){return d})),a.d(t,"g",(function(){return p})),a.d(t,"f",(function(){return m}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.detectionEngine.relatedIntegrations.installedTitle",{defaultMessage:"Installed"}),r=n.i18n.translate("xpack.securitySolution.detectionEngine.relatedIntegrations.installedTooltip",{defaultMessage:"Integration is installed. Configure an integration policy and ensure Elastic Agents are assigned this policy to ingest compatible events."}),s=n.i18n.translate("xpack.securitySolution.detectionEngine.relatedIntegrations.uninstalledTitle",{defaultMessage:"Not installed"}),o=n.i18n.translate("xpack.securitySolution.detectionEngine.relatedIntegrations.uninstalledTooltip",{defaultMessage:"Integration is not installed. Follow the integration link to install and configure the integration."}),l=n.i18n.translate("xpack.securitySolution.detectionEngine.relatedIntegrations.enabledTitle",{defaultMessage:"Installed: enabled"}),c=n.i18n.translate("xpack.securitySolution.detectionEngine.relatedIntegrations.enabledTooltip",{defaultMessage:"Integration is installed and an integration policy with the required configuration exists. Ensure Elastic Agents are assigned this policy to ingest compatible events."}),u=n.i18n.translate("xpack.securitySolution.detectionEngine.relatedIntegrations.badgeTitle",{defaultMessage:"integrations"}),d=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.relatedIntegrations.popoverTitle",{values:{integrationsCount:e},defaultMessage:"[{integrationsCount}] Related {integrationsCount, plural, =1 {integration} other {integrations}} available"}),p=e=>n.i18n.translate("xpack.securitySolution.detectionEngine.relatedIntegrations.popoverDescription",{values:{integrationsCount:e},defaultMessage:"Install and configure {integrationsCount, plural, =1 {the below integration} other {one or more of the below integrations}} to ingest the necessary data for this detection rule:"}),m=(e,t)=>n.i18n.translate("xpack.securitySolution.detectionEngine.relatedIntegrations.popoverDescriptionInstalledVersionTooltip",{values:{installedVersion:e,requiredVersion:t},defaultMessage:"Version mismatch -- please resolve! Installed version `{installedVersion}` when required version `{requiredVersion}`"})},function(e,t,a){"use strict";a.d(t,"d",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return s})),a.d(t,"e",(function(){return o})),a.d(t,"c",(function(){return l}));var n=a(238);const i=({group:e,id:t,action_type_id:a,params:n,uuid:i,frequency:r,alerts_filter:s})=>({group:e,id:t,params:n,actionTypeId:a,...s&&{alertsFilter:s},...i&&{uuid:i},...r&&{frequency:r}}),r=({group:e,id:t,actionTypeId:a,params:n,uuid:i,frequency:r,alertsFilter:s})=>({group:e,id:t,params:n,action_type_id:a,...s&&{alerts_filter:s},...i&&{uuid:i},...r&&{frequency:r}}),s=({group:e,id:t,params:a,frequency:n,alertsFilter:i})=>({group:e,id:t,params:a,...i&&{alerts_filter:i},...n&&{frequency:n}}),o=({action_type_id:e,params:t})=>{if(e===n.a.OSQUERY){const{saved_query_id:a,ecs_mapping:n,pack_id:i,...r}=t;return{params:{...r,savedQueryId:a,ecsMapping:n,packId:i},actionTypeId:e}}return{params:t,actionTypeId:e}},l=({actionTypeId:e,params:t})=>{if(e===n.a.OSQUERY){const{savedQueryId:a,ecsMapping:n,packId:i,...r}=t;return{params:{...r,saved_query_id:a,ecs_mapping:n,pack_id:i},action_type_id:e}}return{params:t,action_type_id:e}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o})),a.d(t,"b",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"d",(function(){return u})),a.d(t,"e",(function(){return d}));var n=a(43),i=a(112),r=a(600),s=a(262);let o;!function(e){e.Prebuilt="prebuilt",e.Custom="custom"}(o||(o={}));const l=n.partial({searchTerm:n.string,source:Object(i.u)("RuleSource",o),tags:n.array(n.string),enabled:n.boolean,ruleExecutionStatus:s.c}),c=n.partial({field:r.b.props.field,order:r.b.props.order}),u=n.partial({perPage:r.a.props.perPage}),d=n.partial({page:r.a.props.page,perPage:r.a.props.perPage})},function(e,t,a){"use strict";a.d(t,"c",(function(){return d})),a.d(t,"d",(function(){return p})),a.d(t,"b",(function(){return m})),a.d(t,"a",(function(){return b})),a.d(t,"g",(function(){return g})),a.d(t,"f",(function(){return f})),a.d(t,"e",(function(){return y})),a.d(t,"i",(function(){return h})),a.d(t,"h",(function(){return v}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(40),l=a(48),c=a(589);const u=s()(o.EuiHealth).withConfig({displayName:"StyledEuiHealth",componentId:"sc-1rr4lsj-0"})(["line-height:inherit;"]),d=l.euiLightVars.euiColorVis0,p=l.euiLightVars.euiColorVis5,m=l.euiLightVars.euiColorVis7,b=l.euiLightVars.euiColorVis9,g=47,f=73,y=99,h=[{value:"low",inputDisplay:i.a.createElement(u,{color:d},c.i)},{value:"medium",inputDisplay:i.a.createElement(u,{color:p},c.j)},{value:"high",inputDisplay:i.a.createElement(u,{color:m},c.h)},{value:"critical",inputDisplay:i.a.createElement(u,{color:b},c.f)}],v={low:21,medium:g,high:f,critical:y}},function(e,t,a){"use strict";a.d(t,"a",(function(){return b})),a.d(t,"b",(function(){return f}));var n=a(41),i=a.n(n),r=a(2),s=a.n(r),o=a(597),l=a(756),c=a(125),u=a(469),d=a(855);const p=i()(c.c).withConfig({displayName:"StyledForm",componentId:"sc-tp8win-0"})(["max-width:235px !important;"]),m=({isLoading:e,isUpdateView:t=!1,form:a})=>s.a.createElement(s.a.Fragment,null,s.a.createElement(u.a,{addPadding:!t},s.a.createElement(p,{form:a,"data-test-subj":"stepScheduleRule"},s.a.createElement(c.e,{path:"interval",component:l.a,componentProps:{idAria:"detectionEngineStepScheduleRuleInterval",isDisabled:e,dataTestSubj:"detectionEngineStepScheduleRuleInterval",minimumValue:1}}),s.a.createElement(c.e,{path:"from",component:l.a,componentProps:{idAria:"detectionEngineStepScheduleRuleFrom",isDisabled:e,dataTestSubj:"detectionEngineStepScheduleRuleFrom",minimumValue:1}})))),b=Object(r.memo)(m),g=({addPadding:e,defaultValues:t,descriptionColumns:a,isInPanelView:n=!1})=>s.a.createElement(u.a,{addPadding:e},s.a.createElement(o.a,{columns:a,schema:d.a,data:t,isInPanelView:n})),f=Object(r.memo)(g)},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(2),i=a(46),r=a(495),s=a(108),o=a(137);const l=({savedQueryId:e,ruleType:t,onError:a})=>{var l;const c=Object(r.a)(),{addError:u}=Object(s.a)(),d=Object(i.useQuery)(["detectionEngine","rule","savedQuery",e],(async()=>e&&"saved_query"===t?c.getSavedQuery(e):null),{onError:null!=a?a:e=>{u(e,{title:o.Lc})},retry:!1,refetchOnWindowFocus:!1}),p=Object(n.useMemo)((()=>{var e;return d.data?{saved_id:d.data.id,filters:null!==(e=d.data.attributes.filters)&&void 0!==e?e:[],query:d.data.attributes.query,title:d.data.attributes.title}:null}),[d.data]);return{isSavedQueryLoading:!!e&&d.isLoading,savedQueryBar:p,savedQuery:null!==(l=d.data)&&void 0!==l?l:void 0}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(2),i=a(143);const r=({exceptionLists:e})=>{const[t,a]=Object(n.useState)(!0),[r,s]=Object(n.useState)([]),[o,l]=Object(n.useState)({}),c=Object(n.useCallback)((t=>{const a=e.reduce(((e,{id:t,...a})=>(e[t]={...a,id:t,rules:[]},e)),{});return t.reduce(((e,t)=>{const a=t.exceptions_list;return null!=a&&a.length>0&&a.forEach((a=>{const n=e[a.id];null!=n&&(e[a.id]={...n,rules:[...n.rules,t]})})),e}),a)}),[e]);return Object(n.useEffect)((()=>{let t=!0;const n=new AbortController;return(async()=>{if(0===e.length&&t)return a(!1),s([]),void l({});try{a(!0);const{data:e}=await Object(i.j)({pagination:{page:1,perPage:1e4},signal:n.signal}),r=c(e),o=Object.keys(r).map((e=>r[e]));s(o),l(r),t&&a(!1)}catch(e){t&&a(!1)}})(),()=>{t=!1,n.abort()}}),[e.length,c]),[t,r,o]}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o})),a.d(t,"b",(function(){return l}));var n=a(2),i=a.n(n),r=a(40),s=a(198);const o={DUPLICATE:"duplicate",EXPORT:"export"},l=Object(n.memo)((({handleCloseModal:e,onModalConfirm:t,action:a})=>{const[l,c]=Object(n.useState)(!0),u=Object(n.useCallback)((()=>{c(!l)}),[c,l]),d=Object(n.useCallback)((()=>{t(l),e()}),[l,e,t]);return i.a.createElement(r.EuiConfirmModal,{title:a===o.EXPORT?s.M:s.K,onCancel:e,onConfirm:d,cancelButtonText:s.G,confirmButtonText:a===o.EXPORT?s.I:s.H,defaultFocusedButton:"confirm","data-test-subj":"includeExpiredExceptionsConfirmationModal"},i.a.createElement(r.EuiText,null,a===o.EXPORT?s.L:s.J),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(r.EuiSwitch,{label:s.N,checked:l,onChange:u,"data-test-subj":"includeExpiredExceptionsConfirmationModalSwitch"}))}));l.displayName="IncludeExpiredExceptionsModal"},function(e,t,a){"use strict";a.d(t,"a",(function(){return m})),a.d(t,"b",(function(){return b}));var n=a(2),i=a.n(n),r=a(24),s=a(110),o=a(116),l=a(348),c=a(186),u=a(266),d=a(175);const p=Object(n.createContext)(void 0),m=({id:e,indexName:t,scopeId:a,ruleId:m,children:b})=>{var g;const f=Object(u.a)(),y=t?null!==(g=Object(c.a)(t,f))&&void 0!==g?g:t:"",[{pageName:h}]=Object(d.a)(),v=h===r.c.detections?s.SourcererScopeName.detections:s.SourcererScopeName.default,E=Object(o.d)(v),[x,j,S,k]=Object(l.a)({indexName:y,eventId:null!=e?e:"",runtimeMappings:E.runtimeMappings,skip:!e}),O=Object(n.useMemo)((()=>e&&t&&a?{eventId:e,indexName:t,scopeId:a,ruleId:null!=m?m:"",indexPattern:E.indexPattern,dataAsNestedObject:k}:void 0),[e,t,a,m,E.indexPattern,k]);return i.a.createElement(p.Provider,{value:O},b)},b=()=>{const e=Object(n.useContext)(p);if(!e)throw new Error("PreviewPanelContext can only be used within PreviewPanelContext provider");return e}},function(e,t,a){"use strict";a.d(t,"a",(function(){return Et})),a.d(t,"b",(function(){return kt})),a.d(t,"c",(function(){return wt}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(5),c=a(8),u=a(246),d=a.n(u),p=a(44),m=a(672),b=a(204),g=a(648),f=a(486),y=a(162),h=a(417),v=a(213),E=a(597),x=a(3),j=a(130),S=a.n(j),k=a(13),O=a(671),w=a(673),T=a(102),I=a(495),C=a(125);const M=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.importTimelineModalTitle",{defaultMessage:"Import query from saved timeline"}),_=["duplicate","createFrom"],F=e=>{var t;return{filters:null!==(t=e.attributes.filters)&&void 0!==t?t:[],query:e.attributes.query,saved_id:e.id,title:e.attributes.title}},A=({defaultSavedQuery:e,browserFields:t,dataTestSubj:a,field:s,idAria:o,indexPattern:l,isLoading:c=!1,onCloseTimelineSearch:u,openTimelineSearch:d=!1,resizeParentContainer:p,onValidityChange:m,isDisabled:b,resetToSavedQuery:g,onOpenTimeline:f,onSavedQueryError:y})=>{const{value:h,setValue:v}=s,[E,j]=Object(i.useState)(-1),[A,D]=Object(i.useState)(!1),[N,P]=Object(i.useState)(e),[R,L]=Object(i.useState)(!1),{isInvalid:B,errorMessage:q}=Object(C.i)(s),{uiSettings:z}=Object(T.j)().services,[$]=Object(i.useState)(new k.FilterManager(z)),V=Object(I.a)();Object(i.useEffect)((()=>{null!=m&&m(!B)}),[B,m]),Object(i.useEffect)((()=>{let e=!0;const t=new x.Subscription;return $.setFilters([]),t.add($.getUpdates$().subscribe({next:()=>{if(e){const e=$.getFilters(),{filters:t}=h;S()(t,e)||v({...h,filters:e})}}})),()=>{e=!1,t.unsubscribe()}}),[h,$,v]),Object(i.useEffect)((()=>{let e=!0;return async function(){const{filters:t,saved_id:a}=h;if(S()(t,$.getFilters())||$.setFilters(t),null!=a&&null!=N&&a!==N.id||null!=a&&null==N)try{const t=await V.getSavedQuery(a);e&&null!=t&&P(t),L(!1)}catch{P(void 0),L(!0)}else null==a&&null!=N&&P(void 0)}(),()=>{e=!1}}),[h,$,N,V,L,v]),Object(i.useEffect)((()=>{R&&(null==y||y())}),[y,R]),Object(i.useEffect)((()=>{if(g&&N){const e=F(N);v(e)}}),[g,N,v]);const U=Object(i.useCallback)((e=>{const{query:t}=h;S()(t,e)||v({...h,query:e})}),[h,v]),H=Object(i.useCallback)((e=>{const{query:t}=h;if(!S()(t,e)){const t=R?null:h.saved_id;v({...h,query:e,saved_id:t})}}),[h,v,R]),G=Object(i.useCallback)((e=>{if(null!=e){const{saved_id:t}=h;if(L(!1),P(e),e.id!==t){const t=F(e);v(t)}else v({filters:[],query:{query:"",language:"kuery"},saved_id:null})}}),[h,v,L]),Q=Object(i.useCallback)((()=>{D(!0),u()}),[u]),W=Object(i.useCallback)((e=>{D(!1),null==f||f(e)}),[f]);return r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiFormRow,{label:s.label,labelAppend:s.labelAppend,helpText:s.helpText,error:q,isInvalid:B,fullWidth:!0,"data-test-subj":a,describedByIds:o?[o]:void 0},r.a.createElement(n.EuiMutationObserver,{observerOptions:{subtree:!0,attributes:!0,childList:!0},onMutation:()=>{if(null!=p){const e=document.getElementById("kbnTypeahead__items");if(null!=e){const t=e.getBoundingClientRect(),a=document.getElementById("define-rule");if(null!=a){const e=a.getBoundingClientRect();(-1===E||e.height<E+t.height)&&p(E+t.height-100),-1===E&&j(e.height)}}else p(-1)}}},(e=>r.a.createElement("div",{ref:e},r.a.createElement(w.a,{indexPattern:l,isLoading:c||A,isRefreshPaused:!1,filterQuery:h.query,filterManager:$,filters:$.getFilters()||[],onChangedQuery:H,onSubmitQuery:U,savedQuery:N,onSavedQuery:G,hideSavedQuery:!1,displayStyle:"inPage",isDisabled:b}))))),d?r.a.createElement(O.a,{hideActions:_,modalTitle:M,onClose:Q,onOpen:W}):null)};var D=a(197);const N=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.eqlTypeTitle",{defaultMessage:"Event Correlation"}),P=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.eqlTypeDescription",{defaultMessage:"Use Event Query Language (EQL) to match events, generate sequences, and stack data"}),R=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.queryTypeTitle",{defaultMessage:"Custom query"}),L=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.queryTypeDescription",{defaultMessage:"Use KQL or Lucene to detect issues across indices."}),B=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.mlTypeTitle",{defaultMessage:"Machine Learning"}),q=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.mlTypeDescription",{defaultMessage:"Select ML job to detect anomalous activity."}),z=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.thresholdTypeTitle",{defaultMessage:"Threshold"}),$=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.thresholdTypeDescription",{defaultMessage:"Aggregate query results to detect when number of matches exceeds threshold."}),V=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.threatMatchTitle",{defaultMessage:"Indicator Match"}),U=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.threatMatchDescription",{defaultMessage:"Use indicators from intelligence sources to detect matching events and alerts."}),H=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.newTermsTitle",{defaultMessage:"New Terms"}),G=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.newTermsDescription",{defaultMessage:"Find documents with values appearing for the first time."}),Q=o.a.span.withConfig({displayName:"SmallText",componentId:"sc-1i47q47-0"})(["font-size:",";"],(({theme:e})=>e.eui.euiFontSizeS)),W=({hasValidLicense:e=!1})=>r.a.createElement(Q,null,e?q:r.a.createElement(p.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.createRule.stepDefineRule.ruleTypeField.mlTypeDisabledDescription",defaultMessage:"Access to ML requires a {subscriptionsLink}.",values:{subscriptionsLink:r.a.createElement(n.EuiLink,{href:"https://www.elastic.co/subscriptions",target:"_blank"},r.a.createElement(p.FormattedMessage,{id:"xpack.securitySolution.components.stepDefineRule.ruleTypeField.subscriptionsLink",defaultMessage:"Platinum subscription"}))}}));W.displayName="MlCardDescriptionComponent";const K=r.a.memo(W);K.displayName="MlCardDescription";const Y=Object(i.memo)((({describedByIds:e=[],field:t,isUpdateView:a,hasValidLicense:s,isMlAdmin:o})=>{const l=t.value,c=Object(i.useCallback)((e=>{t.setValue(e)}),[t]),u=Object(i.useCallback)((()=>c("eql")),[c]),d=Object(i.useCallback)((()=>c("machine_learning")),[c]),p=Object(i.useCallback)((()=>c("query")),[c]),m=Object(i.useCallback)((()=>c("threshold")),[c]),g=Object(i.useCallback)((()=>c("threat_match")),[c]),f=Object(i.useCallback)((()=>c("new_terms")),[c]),y=Object(i.useMemo)((()=>({onClick:u,isSelected:Object(D.b)(l)})),[l,u]),h=Object(i.useMemo)((()=>({onClick:p,isSelected:Object(D.e)(l)})),[l,p]),v=Object(i.useMemo)((()=>({isDisabled:!s||!o,onClick:d,isSelected:Object(b.d)(l)})),[l,d,s,o]),E=Object(i.useMemo)((()=>({onClick:m,isSelected:Object(D.g)(l)})),[l,m]),x=Object(i.useMemo)((()=>({onClick:g,isSelected:Object(D.f)(l)})),[l,g]),j=Object(i.useMemo)((()=>({onClick:f,isSelected:Object(D.d)(l)})),[l,f]);return r.a.createElement(n.EuiFormRow,{fullWidth:!0,"data-test-subj":"selectRuleType",describedByIds:e,label:t.label},r.a.createElement(n.EuiFlexGrid,{columns:3},(!a||h.isSelected)&&r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiCard,{"data-test-subj":"customRuleType",title:R,titleSize:"xs",description:L,icon:r.a.createElement(n.EuiIcon,{size:"xl",type:"search"}),selectable:h,layout:"horizontal"})),(!a||v.isSelected)&&r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiCard,{"data-test-subj":"machineLearningRuleType",title:B,titleSize:"xs",description:r.a.createElement(K,{hasValidLicense:s}),icon:r.a.createElement(n.EuiIcon,{size:"l",type:"machineLearningApp"}),isDisabled:v.isDisabled&&!v.isSelected,selectable:v,layout:"horizontal"})),(!a||E.isSelected)&&r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiCard,{"data-test-subj":"thresholdRuleType",title:z,titleSize:"xs",description:$,icon:r.a.createElement(n.EuiIcon,{size:"l",type:"indexFlush"}),selectable:E,layout:"horizontal"})),(!a||y.isSelected)&&r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiCard,{"data-test-subj":"eqlRuleType",title:N,titleSize:"xs",description:P,icon:r.a.createElement(n.EuiIcon,{size:"l",type:"eql"}),selectable:y,layout:"horizontal"})),(!a||x.isSelected)&&r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiCard,{"data-test-subj":"threatMatchRuleType",title:V,titleSize:"xs",description:U,icon:r.a.createElement(n.EuiIcon,{size:"l",type:"list"}),selectable:x,layout:"horizontal"})),(!a||j.isSelected)&&r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiCard,{"data-test-subj":"newTermsRuleType",title:H,titleSize:"xs",description:G,icon:r.a.createElement(n.EuiIcon,{size:"l",type:"magnifyWithPlus"}),selectable:j,layout:"horizontal"}))))}));Y.displayName="SelectRuleType";const J=({describedByIds:e=[],field:t})=>{const a=t.value,s=Object(i.useCallback)((e=>{const a=Number(e.currentTarget.value);t.setValue(a)}),[t]);return r.a.createElement(n.EuiFormRow,{label:t.label,"data-test-subj":"anomalyThresholdSlider",describedByIds:e},r.a.createElement(n.EuiFlexGroup,null,r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiRange,{value:a,onChange:s,fullWidth:!0,showInput:!0,showRange:!0,showTicks:!0,tickInterval:25,min:0,max:100}))))};var X=a(474),Z=a(471);const ee=o.a.div.withConfig({displayName:"HelpTextWarningContainer",componentId:"sc-1r7zcmv-0"})(["margin-top:10px;"]),te=({href:e,notRunningJobIds:t})=>r.a.createElement(r.a.Fragment,null,r.a.createElement(p.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.createRule.stepDefineRule.machineLearningJobIdHelpText",defaultMessage:"We've provided a few common jobs to get you started. To add your own custom jobs, assign a group of 'security' to those jobs in the {machineLearning} application to make them appear here.",values:{machineLearning:r.a.createElement(n.EuiLink,{href:e,target:"_blank"},r.a.createElement(p.FormattedMessage,{id:"xpack.securitySolution.components.mlJobSelect.machineLearningLink",defaultMessage:"Machine Learning"}))}}),t.length>0&&r.a.createElement(ee,{"data-test-subj":"ml-warning-not-running-jobs"},r.a.createElement(n.EuiText,{size:"xs"},r.a.createElement("span",null,1===t.length?r.a.createElement(p.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.createRule.stepDefineRule.mlEnableJobSingle",defaultMessage:"The selected ML job, {jobName}, is not currently running. We will start {jobName} when you enable this rule.",values:{jobName:t[0]}}):r.a.createElement(p.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.createRule.stepDefineRule.mlEnableJobMulti",defaultMessage:"The selected ML jobs, {jobNames}, are not currently running. We will start all of these jobs when you enable this rule.",values:{jobNames:t.reduce(((e,t,a,n)=>e+(a<n.length-1?", ":", and ")+t))}}))))),ae=r.a.memo(te),ne=l.i18n.translate("xpack.securitySolution.detectionEngine.mlSelectJob.createCustomJobButtonTitle",{defaultMessage:"Create custom job"}),ie=o.a.div.withConfig({displayName:"JobDisplayContainer",componentId:"sc-jfjxl-0"})(["width:100%;height:100%;display:flex;flex-direction:column;"]),re=o()(n.EuiFlexGroup).withConfig({displayName:"MlJobSelectEuiFlexGroup",componentId:"sc-jfjxl-1"})(["margin-bottom:5px;"]),se=o()(n.EuiButton).withConfig({displayName:"MlJobEuiButton",componentId:"sc-jfjxl-2"})(["margin-top:20px;"]),oe=({description:e,name:t,id:a})=>r.a.createElement(ie,null,r.a.createElement("strong",null,null!=t?t:a),r.a.createElement(n.EuiToolTip,{content:e},r.a.createElement(n.EuiText,{size:"xs",color:"subdued"},r.a.createElement("p",null,e)))),le=e=>{var t;return r.a.createElement(oe,{id:e.value.id,description:e.value.description,name:null===(t=e.value)||void 0===t?void 0:t.name})},ce=({describedByIds:e=[],field:t})=>{const a=t.value,{isInvalid:s,errorMessage:o}=Object(C.i)(t),{loading:l,jobs:c}=Object(X.a)(),{getUrlForApp:u,navigateToApp:d}=Object(T.j)().services.application,p=u("ml"),m=Object(i.useCallback)((e=>{const a=e.map((e=>e.value.id));t.setValue(a)}),[t]),g=c.map((e=>{var t,a;return{value:{id:e.id,description:e.description,name:null===(t=e.customSettings)||void 0===t?void 0:t.security_app_display_name},label:`${null===(a=e.customSettings)||void 0===a?void 0:a.security_app_display_name} ${e.id}`}})),f=g.filter((e=>a.includes(e.value.id))).map((e=>{var t;return{...e,label:null!==(t=e.value.name)&&void 0!==t?t:e.value.id}})),y=Object(i.useMemo)((()=>c.filter((({id:e})=>a.includes(e))).reduce(((e,t)=>(Object(b.c)(t.jobState,t.datafeedState)||e.push(t.id),e)),[])),[c,a]);return r.a.createElement(re,{justifyContent:"flexStart"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiFormRow,{label:t.label,helpText:r.a.createElement(ae,{href:p,notRunningJobIds:y}),isInvalid:s,error:o,"data-test-subj":"mlJobSelect",describedByIds:e},r.a.createElement(n.EuiFlexGroup,null,r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiComboBox,{isLoading:l,onChange:m,options:g,placeholder:Z.k,renderOption:le,rowHeight:50,selectedOptions:f}))))),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(se,{iconType:"popout",iconSide:"right",onClick:()=>d("ml",{openInNewTab:!0})},ne)))};var ue=a(1131),de=a(469);const pe=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.thresholdField.thresholdFieldPlaceholderText",{defaultMessage:"All results"}),me=o()(n.EuiFlexItem).withConfig({displayName:"OperatorWrapper",componentId:"sc-1raxjfh-0"})(["align-self:center;"]),be=["detectionEngineStepDefineRuleThresholdField"],ge=["detectionEngineStepDefineRuleThresholdValue"],fe=["detectionEngineStepDefineRuleThresholdCardinalityField"],ye=["detectionEngineStepDefineRuleThresholdCardinalityValue"],he=({thresholdField:e,thresholdValue:t,browserFields:a,thresholdCardinalityField:s,thresholdCardinalityValue:o})=>{const l=Object(i.useMemo)((()=>({fullWidth:!0,noSuggestions:!1,options:a.map((e=>({label:e.name}))),placeholder:pe,onCreateOption:void 0,style:{width:"410px"}})),[a]),c=Object(i.useMemo)((()=>({fullWidth:!0,noSuggestions:!1,options:a.map((e=>({label:e.name}))),placeholder:pe,onCreateOption:void 0,style:{width:"410px"},singleSelection:{asPlainText:!0}})),[a]);return r.a.createElement(n.EuiFlexGroup,{direction:"column",style:{marginLeft:0}},r.a.createElement(n.EuiFlexGroup,null,r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(C.b,{field:e,idAria:be[0],"data-test-subj":be[0],describedByIds:be,type:e.type,euiFieldProps:l})),r.a.createElement(me,{grow:!1},">="),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(C.b,{field:t,idAria:ge[0],"data-test-subj":ge[0],describedByIds:ge,type:t.type}))),r.a.createElement(n.EuiFlexGroup,null,r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(C.b,{field:s,idAria:fe[0],"data-test-subj":fe[0],describedByIds:fe,type:s.type,euiFieldProps:c})),r.a.createElement(me,{grow:!1},">="),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(C.b,{field:o,idAria:ye[0],"data-test-subj":ye[0],describedByIds:ye,type:o.type}))))},ve=r.a.memo(he),Ee=()=>{const[e,t]=Object(i.useState)(!1),{docLinks:a}=Object(T.j)().services,s=r.a.createElement(n.EuiButtonIcon,{iconType:"questionInCircle",onClick:()=>t(!e),"aria-label":"Open help popover"});return r.a.createElement(n.EuiPopover,{button:s,isOpen:e,closePopover:()=>t(!1)},r.a.createElement(n.EuiText,{style:{width:320},size:"s"},r.a.createElement(p.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.createRule.stepDefineRule.alertSuppressionMissingFieldsTooltipContent",defaultMessage:"Choose how to handle events with missing {suppressBy} fields. Either group events with missing fields together, or create a separate alert for each event. {learnMoreLink}",values:{suppressBy:r.a.createElement("strong",null,r.a.createElement(p.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.createRule.stepDefineRule.alertSuppressionMissingFieldsTooltipSuppressByDescription",defaultMessage:"Suppress alerts by"})),learnMoreLink:r.a.createElement(n.EuiLink,{href:a.links.siem.configureAlertSuppression,target:"_blank"},r.a.createElement(p.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.createRule.stepDefineRule.alertSuppressionMissingFieldsTooltipLink",defaultMessage:"Learn more"}))}})))},xe=r.a.memo(Ee);xe.displayName="SuppressionInfoIcon";var je=a(590),Se=a(1124);const ke=l.i18n.translate("xpack.securitySolution.detectionEngine.stepDefineRule.pickDataView",{defaultMessage:"Select a Data View"}),Oe=l.i18n.translate("xpack.securitySolution.detectionEngine.stepDefineRule.dataViewNotFoundLabel",{defaultMessage:"Selected data view not found"}),we=l.i18n.translate("xpack.securitySolution.detectionEngine.stepDefineRule.dataViewIncludesAlertsIndexLabel",{defaultMessage:"Default Security data view"}),Te=l.i18n.translate("xpack.securitySolution.detectionEngine.stepDefineRule.dataViewIncludesAlertsIndexDescription",{defaultMessage:"The default Security data view includes the alerts index. This could result in redundant alerts being generated from existing alerts."}),Ie=({kibanaDataViews:e,field:t})=>{let a,s,o;if(null!=t){const e=Object(C.i)(t);a=e.isInvalid,s=e.errorMessage,o=t.value}const c=Object(i.useMemo)((()=>null!=e&&Object.keys(e).length>0),[e]),u=Object(i.useMemo)((()=>null!=o&&""!==o&&c&&!Object.hasOwn(e,o)),[c,o,e]),[d,p]=Object(i.useState)(u||null==o||""===o?[]:[{id:e[o].id,label:e[o].title}]),[m,b]=Object(i.useState)(!1);Object(i.useEffect)((()=>{if(!u&&o){const t=e[o].title,a=e[o].id;b("security-solution-default"===a),p([{id:a,label:t}])}else p([])}),[o,t,e,u,b]);const g=Object(i.useMemo)((()=>c?Object.values(e).map((e=>({label:e.title,id:e.id}))):[]),[c,e]);return r.a.createElement(r.a.Fragment,null,u&&null!=o&&r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiCallOut,{title:Oe,color:"warning",iconType:"help"},r.a.createElement("p",null,(f=o,l.i18n.translate("xpack.securitySolution.detectionEngine.stepDefineRule.dataViewNotFoundDescription",{values:{dataView:f},defaultMessage:'Your data view of "id": "{dataView}" was not found. It could be that it has since been deleted.'})))),r.a.createElement(n.EuiSpacer,{size:"s"})),m&&r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiCallOut,{title:we,color:"warning",iconType:"help","data-test-subj":"defaultSecurityDataViewWarning"},r.a.createElement("p",null,Te)),r.a.createElement(n.EuiSpacer,{size:"s"})),r.a.createElement(n.EuiFormRow,{label:null==t?void 0:t.label,helpText:null==t?void 0:t.helpText,error:s,isInvalid:a,"data-test-subj":"pick-rule-data-source"},r.a.createElement(n.EuiComboBox,{isClearable:!0,singleSelection:{asPlainText:!0},onChange:e=>{const a=e;if(p(null!=a?a:[]),null!=a&&a.length>0&&null!=a[0].id){const e=a[0].id;null==t||t.setValue(e)}else null==t||t.setValue(void 0)},options:g,selectedOptions:d,"aria-label":ke,placeholder:ke,"data-test-subj":"detectionsDataViewSelectorDropdown"})));var f};var Ce=a(370),Me=a(316),_e=a(522);const Fe=o()(n.EuiFlexItem).withConfig({displayName:"FlexItemWithLabel",componentId:"sc-17p8w56-0"})(["padding-top:20px;text-align:center;"]),Ae=o()(n.EuiFlexItem).withConfig({displayName:"FlexItemWithoutLabel",componentId:"sc-17p8w56-1"})(["text-align:center;"]),De=({entry:e,indexPattern:t,threatIndexPatterns:a,showLabel:s,onChange:o})=>{const l=Object(i.useCallback)((([t])=>{const{updatedEntry:a,index:n}=Object(Ce.e)(e,t);o(a,n)}),[o,e]),c=Object(i.useCallback)((([t])=>{const{updatedEntry:a,index:n}=Object(Ce.f)(e,t);o(a,n)}),[o,e]),u=Object(i.useMemo)((()=>{const a=r.a.createElement(Me.b,{placeholder:_e.c,indexPattern:t,selectedField:e.field,isClearable:!1,isLoading:!1,isDisabled:null==t,onChange:l,"data-test-subj":"entryField",fieldInputWidth:360});return s?r.a.createElement(n.EuiFormRow,{label:_e.b,"data-test-subj":"entryItemFieldInputFormRow"},a):r.a.createElement(n.EuiFormRow,{label:"","data-test-subj":"entryItemFieldInputFormRow"},a)}),[l,t,e,s]),d=Object(i.useMemo)((()=>{const t=r.a.createElement(Me.b,{placeholder:_e.c,indexPattern:a,selectedField:e.value,isClearable:!1,isLoading:!1,isDisabled:null==a,onChange:c,"data-test-subj":"threatEntryField",fieldInputWidth:360});return s?r.a.createElement(n.EuiFormRow,{label:_e.f,"data-test-subj":"threatFieldInputFormRow"},t):r.a.createElement(n.EuiFormRow,{label:"","data-test-subj":"threatFieldInputFormRow"},t)}),[c,a,e,s]);return r.a.createElement(n.EuiFlexGroup,{direction:"row",gutterSize:"s",alignItems:"center",justifyContent:"spaceAround","data-test-subj":"itemEntryContainer"},r.a.createElement(n.EuiFlexItem,{grow:!1},u),r.a.createElement(n.EuiFlexItem,{grow:!0},r.a.createElement(n.EuiFlexGroup,{justifyContent:"spaceAround",alignItems:"center"},s?r.a.createElement(Fe,{grow:!0},_e.d):r.a.createElement(Ae,{grow:!0},_e.d))),r.a.createElement(n.EuiFlexItem,{grow:!1},d))};De.displayName="EntryItem";const Ne=o()(n.EuiFlexItem).withConfig({displayName:"MyFirstRowContainer",componentId:"sc-12uv1nj-0"})(["padding-top:20px;"]),Pe=r.a.memo((({entries:e,isOnlyItem:t,entryIndex:a,itemIndex:s,onDelete:o})=>{const l=t&&1===e.length&&0===s&&(null==e[0].field||""===e[0].field),c=Object(i.useCallback)((()=>{o(a)}),[o,a]),u=r.a.createElement(n.EuiButtonIcon,{color:"danger",iconType:"trash",onClick:c,isDisabled:l,"aria-label":"entryDeleteButton",className:"itemEntryDeleteButton","data-test-subj":"itemEntryDeleteButton"});return 0===a&&0===s?r.a.createElement(Ne,{grow:!1,"data-test-subj":"firstRowDeleteButton"},u):r.a.createElement(n.EuiFlexItem,{grow:!1,"data-test-subj":"deleteButton"},u)}));Pe.displayName="EntryDeleteButton";var Re=a(603);const Le=o()(n.EuiFlexItem).withConfig({displayName:"MyInvisibleAndBadge",componentId:"sc-80qzis-0"})(["visibility:hidden;"]),Be=o()(n.EuiFlexItem).withConfig({displayName:"MyFirstRowContainer",componentId:"sc-80qzis-1"})(["padding-top:20px;"]),qe=r.a.memo((({entriesLength:e,entryItemIndex:t})=>{const a=r.a.createElement(Re.a,{includeAntennas:!0,type:"and"});return e>1&&0===t?r.a.createElement(Be,{grow:!1,"data-test-subj":"entryItemEntryFirstRowAndBadge"},a):e<=1?r.a.createElement(Le,{grow:!1,"data-test-subj":"entryItemEntryInvisibleAndBadge"},a):r.a.createElement(n.EuiFlexItem,{grow:!1,"data-test-subj":"entryItemEntryAndBadge"},a)}));qe.displayName="AndBadge";const ze=o()(n.EuiFlexItem).withConfig({displayName:"MyOverflowContainer",componentId:"sc-1omlazu-0"})(["overflow:hidden;width:100%;"]),$e=r.a.memo((({listItem:e,listItemIndex:t,indexPattern:a,threatIndexPatterns:s,isOnlyItem:o,andLogicIncluded:l,onDeleteEntryItem:c,onChangeEntryItem:u})=>{const d=Object(i.useCallback)(((a,n)=>{const i=[...e.entries.slice(0,n),{...a},...e.entries.slice(n+1)],r={...e,entries:i};u(r,t)}),[u,e,t]),p=Object(i.useCallback)((a=>{const n=Object(Ce.i)(e,a);c(n,t)}),[e,c,t]),m=Object(i.useMemo)((()=>null!=a&&e.entries.length>0?Object(Ce.g)(a,s,e.entries):[]),[e.entries,a,s]);return r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiFlexGroup,{gutterSize:"s","data-test-subj":"entriesContainer"},l&&r.a.createElement(qe,{entriesLength:e.entries.length,entryItemIndex:t}),r.a.createElement(ze,{grow:6},r.a.createElement(n.EuiFlexGroup,{gutterSize:"s",direction:"column"},m.map(((i,l)=>r.a.createElement(n.EuiFlexItem,{key:i.id,grow:1},r.a.createElement(n.EuiFlexGroup,{gutterSize:"xs",alignItems:"center",direction:"row"},r.a.createElement(ze,{grow:1},r.a.createElement(De,{entry:i,threatIndexPatterns:s,indexPattern:a,showLabel:0===t&&0===l,onChange:d})),r.a.createElement(Pe,{entries:e.entries,isOnlyItem:o,entryIndex:i.entryIndex,itemIndex:t,onDelete:p})))))))))}));$e.displayName="ListItem";const Ve=o()(n.EuiButton).withConfig({displayName:"MyEuiButton",componentId:"sc-gfoihj-0"})(["min-width:95px;"]),Ue=({isOrDisabled:e=!1,isAndDisabled:t=!1,onAndClicked:a,onOrClicked:i})=>r.a.createElement(n.EuiFlexGroup,{gutterSize:"s",alignItems:"center"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(Ve,{fill:!0,size:"s",iconType:"plusInCircle",onClick:a,"data-test-subj":"andButton",isDisabled:t},_e.a)),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(Ve,{fill:!0,size:"s",iconType:"plusInCircle",onClick:i,isDisabled:e,"data-test-subj":"orButton"},_e.e))),He=o()(n.EuiFlexItem).withConfig({displayName:"MyInvisibleAndBadge",componentId:"sc-a20478-0"})(["visibility:hidden;"]),Ge=o()(Re.a).withConfig({displayName:"MyAndBadge",componentId:"sc-a20478-1"})(["& > .euiFlexItem{margin:0;}"]),Qe=o()(n.EuiFlexItem).withConfig({displayName:"MyButtonsContainer",componentId:"sc-a20478-2"})(["margin:16px 0;"]),We={andLogicIncluded:!1,entries:[],entriesToDelete:[]},Ke=({listItems:e,indexPatterns:t,threatIndexPatterns:a,onChange:s})=>{const[{entries:o,entriesToDelete:l,andLogicIncluded:c},u]=Object(i.useReducer)(((e,t)=>{switch(t.type){case"setEntries":{const a=t.entries.filter((({entries:e})=>e.length>1)).length>0;return{...e,andLogicIncluded:a,entries:t.entries}}case"setDefault":return{...e,...t.initialState,entries:[{...t.lastEntry,entries:[Object(Ce.d)()]}]};default:return e}}),{...We}),d=Object(i.useCallback)((e=>{u({type:"setEntries",entries:e})}),[u]),p=Object(i.useCallback)((e=>{u({type:"setDefault",initialState:We,lastEntry:e})}),[u]),m=Object(i.useCallback)(((e,t)=>{const a=[...o.slice(0,t),{...e},...o.slice(t+1)];d(a)}),[d,o]),b=Object(i.useCallback)(((e,t)=>{0===e.entries.length?0===[...o.slice(0,t),...o.slice(t+1)].length?p(e):d([...o.slice(0,t),...o.slice(t+1)]):m(e,t)}),[m,d,o,p]),g=Object(i.useCallback)((()=>{const e=o[o.length-1],{entries:t}=e,a={...e,entries:[...t,Object(Ce.d)()]};d([...o.slice(0,o.length-1),{...a}])}),[d,o]),f=Object(i.useCallback)((()=>{const e=Object(Ce.h)();d([...o,{...e}])}),[d,o]),y=Object(i.useCallback)((()=>{g()}),[g]);return Object(i.useEffect)((()=>{s({entryItems:Object(Ce.c)(o),entriesToDelete:l})}),[s,l,o]),Object(i.useEffect)((()=>{(0===o.length||1===o.length&&null!=o[0].entries&&0===o[0].entries.length)&&f()}),[o,f]),Object(i.useEffect)((()=>{e.length>0&&d(e)}),[]),r.a.createElement(n.EuiFlexGroup,{gutterSize:"s",direction:"column"},o.map(((e,i)=>{var s;const l=null!==(s=e.id)&&void 0!==s?s:`${i}`;return r.a.createElement(n.EuiFlexItem,{grow:1,key:l},r.a.createElement(n.EuiFlexGroup,{gutterSize:"s",direction:"column"},0!==i&&(c?r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiFlexGroup,{gutterSize:"none",direction:"row"},r.a.createElement(He,{grow:!1},r.a.createElement(Ge,{includeAntennas:!0,type:"and"})),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(Ge,{type:"or"})))):r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(Ge,{type:"or"}))),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement($e,{key:l,listItem:e,indexPattern:t,threatIndexPatterns:a,listItemIndex:i,andLogicIncluded:c,isOnlyItem:1===o.length,onDeleteEntryItem:b,onChangeEntryItem:m}))))})),r.a.createElement(Qe,{"data-test-subj":"andOrOperatorButtons"},r.a.createElement(n.EuiFlexGroup,{gutterSize:"s"},c&&r.a.createElement(He,{grow:!1},r.a.createElement(Re.a,{includeAntennas:!0,type:"and"})),r.a.createElement(n.EuiFlexItem,{grow:1},r.a.createElement(Ue,{isOrDisabled:!1,isAndDisabled:!1,onOrClicked:f,onAndClicked:y})))))};Ke.displayName="ThreatMatch";const Ye=Object(C.j)({component:C.b}),Je=({threatIndexModified:e,handleResetThreatIndices:t,threatMapping:a,indexPatterns:s,threatIndexPatterns:o,threatIndexPatternsLoading:l,threatBrowserFields:c,onValidityChange:u})=>{const{setValue:d,value:p}=a,{isInvalid:m,errorMessage:b}=Object(C.i)(a),[g,f]=Object(i.useState)(!1);Object(i.useEffect)((()=>{u&&u(!m&&g)}),[g,m,u]);const y=Object(i.useCallback)((({entryItems:e})=>{d(e)}),[d]);return r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiSpacer,{size:"m"}),r.a.createElement(n.EuiFlexGroup,{direction:"column"},r.a.createElement(n.EuiFlexItem,{grow:!0},r.a.createElement(Ye,{path:"threatIndex",config:{...je.a.threatIndex,labelAppend:e?r.a.createElement(Et,{onClick:t,iconType:"refresh"},Z.m):null},componentProps:{idAria:"detectionEngineStepDefineRuleThreatMatchIndices","data-test-subj":"detectionEngineStepDefineRuleThreatMatchIndices",euiFieldProps:{fullWidth:!0,isDisabled:!1,placeholder:""}}})),r.a.createElement(n.EuiFlexItem,{grow:!0},r.a.createElement(C.e,{path:"threatQueryBar",config:{...je.a.threatQueryBar,labelAppend:null},component:A,componentProps:{browserFields:c,idAria:"detectionEngineStepDefineThreatRuleQueryBar",indexPattern:o,isDisabled:!1,isLoading:l,dataTestSubj:"detectionEngineStepDefineThreatRuleQueryBar",openTimelineSearch:!1,onValidityChange:f}}))),r.a.createElement(n.EuiSpacer,{size:"m"}),r.a.createElement(n.EuiFormRow,{label:a.label,labelAppend:a.labelAppend,helpText:a.helpText,error:b,isInvalid:m,fullWidth:!0},r.a.createElement(Ke,{listItems:p,indexPatterns:s,threatIndexPatterns:o,"data-test-subj":"threatmatch-builder","id-aria":"threatmatch-builder",onChange:y})),r.a.createElement(n.EuiSpacer,{size:"m"}))},Xe=r.a.memo(Je);var Ze=a(183);const et=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.newTermsField.placeholderText",{defaultMessage:"Select a field"}),tt=({browserFields:e,field:t})=>{const a=Object(i.useMemo)((()=>({fullWidth:!0,noSuggestions:!1,options:e.map((e=>({label:e.name}))),placeholder:et,onCreateOption:void 0,style:{width:"410px"}})),[e]);return r.a.createElement(C.b,{field:t,idAria:"detectionEngineStepDefineRuleNewTermsField",euiFieldProps:a})},at=r.a.memo(tt);var nt=a(756),it=a(895),rt=a(1049),st=a(894),ot=a(17),lt=a(207),ct=a(104),ut=a.n(ct);const dt=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRuleForm.secondsOptionDescription",{defaultMessage:"Seconds"}),pt=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRuleForm.minutesOptionDescription",{defaultMessage:"Minutes"}),mt=l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRuleForm.hoursOptionDescription",{defaultMessage:"Hours"}),bt=(l.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRuleForm.daysOptionDescription",{defaultMessage:"Days"}),o()(n.EuiFormRow).withConfig({displayName:"StyledEuiFormRow",componentId:"sc-tpunic-0"})(["max-width:none;.euiFormControlLayout{max-width:235px;width:auto;}.euiFormControlLayout__childrenWrapper > *:first-child{box-shadow:none;height:38px;width:100%;}.euiFormControlLayout__childrenWrapper > select{background-color:",";color:",";}.euiFormControlLayout--group .euiFormControlLayout{min-width:100px;}.euiFormControlLayoutIcons{color:",";}.euiFormControlLayout:not(:first-child){border-left:1px solid ",";}"],(({theme:e})=>Object(n.transparentize)(e.eui.euiColorPrimary,.1)),(({theme:e})=>e.eui.euiColorPrimary),(({theme:e})=>e.eui.euiColorPrimary),(({theme:e})=>e.eui.euiColorLightShade))),gt=o()(n.EuiSelect).withConfig({displayName:"MyEuiSelect",componentId:"sc-tpunic-1"})(["width:auto;"]),ft=({durationValueField:e,durationUnitField:t,minimumValue:a=0,isDisabled:s,durationUnitOptions:o=[{value:"s",text:dt},{value:"m",text:pt},{value:"h",text:mt}]})=>{const{isInvalid:l,errorMessage:c}=Object(C.i)(e),{value:u,setValue:d}=e,{value:p,setValue:m}=t,b=Object(i.useCallback)((e=>{m(e.target.value)}),[m]),g=Object(i.useCallback)((e=>{const t=((e,t=0)=>{const a=parseInt(e,10);return Number.isNaN(a)?t:Math.max(t,Math.min(a,Number.MAX_SAFE_INTEGER))})(e.target.value,a);d(t)}),[a,d]),f={disabled:s};return r.a.createElement(bt,{error:c,isInvalid:l},r.a.createElement(n.EuiFormControlLayout,{append:r.a.createElement(gt,ut()({fullWidth:!1,options:o,onChange:b,value:p,"data-test-subj":"timeType"},f))},r.a.createElement(n.EuiFieldNumber,ut()({fullWidth:!1,min:a,max:Number.MAX_SAFE_INTEGER,onChange:g,value:u,"data-test-subj":"interval"},f))))},yt=r.a.memo(ft),ht=Object(C.j)({component:C.b}),vt=o.a.div.withConfig({displayName:"StyledVisibleContainer",componentId:"sc-1pj0rui-0"})(["display:",";"],(e=>e.isVisible?"block":"none")),Et=o()(n.EuiButtonEmpty).withConfig({displayName:"MyLabelButton",componentId:"sc-1pj0rui-1"})(["height:18px;font-size:12px;.euiIcon{width:14px;height:14px;}"]);Et.defaultProps={flush:"right"};const xt=o()(n.EuiFormRow).attrs((({$isVisible:e})=>({style:{display:e?"flex":"none"}}))).withConfig({displayName:"RuleTypeEuiFormRow",componentId:"sc-1pj0rui-2"})([""]),jt=o()(xt).withConfig({displayName:"IntendedRuleTypeEuiFormRow",componentId:"sc-1pj0rui-3"})(["",""],(({theme:e})=>`padding-left: ${e.eui.euiSizeXL};`)),St=({isLoading:e,isUpdateView:t=!1,kibanaDataViews:a,indicesConfig:s,threatIndicesConfig:o,defaultSavedQuery:u,form:h,optionsSelected:E,setOptionsSelected:x,indexPattern:j,isIndexPatternLoading:S,browserFields:k,isQueryBarValid:O,setIsQueryBarValid:w,setIsThreatQueryBarValid:T,ruleType:I,index:M,threatIndex:_,groupByFields:F,dataSourceType:N,shouldLoadQueryDynamically:P,queryBarTitle:R,queryBarSavedId:L})=>{const B=Object(y.a)(),[q,z]=Object(i.useState)(!1),[$,V]=Object(i.useState)(!1),[U,H]=Object(i.useState)(!1),G=Object(ot.b)(),{getFields:Q,reset:W,setFieldValue:K}=h,X=(({field:e,setFieldValue:t,value:a})=>{const n=Object(i.useRef)(!1),r=Object(i.useRef)(),[s,o]=Object(i.useState)((()=>null));return Object(i.useEffect)((()=>{n.current&&a===r.current&&(n.current=!1,r.current=void 0,s())}),[a,s]),Object(i.useCallback)(((a,i)=>{t(e,a),o((()=>i)),r.current=a,n.current=!0}),[e,t])})({field:"ruleType",value:I,setFieldValue:K}),ee=Object(i.useCallback)((({index:e,queryBar:t,eqlOptions:a})=>{const n=()=>{K("index",e),K("queryBar",t)};"eql"===t.query.language?(X("eql",n),x((e=>({...e,...null!=a?a:{}})))):n()}),[K,X,x]),{onOpenTimeline:te,loading:ae}=Object(m.c)(ee),ne=d()(I),ie=Object(i.useCallback)((e=>{h.setFieldValue("dataSourceType",e),h.getFields().index.reset({resetValue:!1}),h.getFields().dataViewId.reset({resetValue:!1})}),[h]),[re,se]=Object(i.useState)([]);Object(i.useEffect)((()=>{const{fields:e}=j;se(function(e){return e.filter((e=>!0===e.aggregatable))}(e))}),[j]);const oe=Object(i.useMemo)((()=>(e=>{const t=new Set(["string","number","ip","boolean"]);return e.filter((e=>!0===e.aggregatable&&t.has(e.type)))})(re)),[re]),[le,{browserFields:pe,indexPatterns:me}]=Object(Ze.b)(_);Object(i.useEffect)((()=>{W({resetValues:!1})}),[W,I]),Object(i.useEffect)((()=>{V(!Object(c.isEqual)(M,s))}),[M,s]),Object(i.useEffect)((()=>{H(!Object(c.isEqual)(_,o))}),[_,o]),Object(i.useEffect)((()=>{const{queryBar:e}=Q();null!=e&&(Object(D.f)(I)&&!Object(D.f)(ne)&&Object(c.isEqual)(e.value,rt.a.forNormalRules)?e.reset({defaultValue:rt.a.forThreatMatchRules}):!Object(D.f)(I)&&Object(D.f)(ne)&&Object(c.isEqual)(e.value,rt.a.forThreatMatchRules)&&e.reset({defaultValue:rt.a.forNormalRules}))}),[I,ne,Q]);const be=Object(i.useCallback)((()=>{O||h.setFieldValue("shouldLoadQueryDynamically",!1)}),[O,h]),ge=Object(i.useCallback)((()=>{Q().index.setValue(s)}),[Q,s]),fe=Object(i.useCallback)((()=>{Q().threatIndex.setValue(o)}),[Q,o]),ye=Object(i.useCallback)((()=>{z(!0)}),[]),he=Object(i.useCallback)((()=>{z(!1)}),[]),Ee=Object(i.useCallback)((({thresholdField:e,thresholdValue:t,thresholdCardinalityField:a,thresholdCardinalityValue:n})=>r.a.createElement(ve,{browserFields:re,thresholdField:e,thresholdValue:t,thresholdCardinalityField:a,thresholdCardinalityValue:n})),[re]),ke=Object(i.useCallback)((({threatMapping:e})=>r.a.createElement(Xe,{handleResetThreatIndices:fe,indexPatterns:j,threatBrowserFields:pe,threatIndexModified:U,threatIndexPatterns:me,threatIndexPatternsLoading:le,threatMapping:e,onValidityChange:T})),[fe,j,T,pe,U,me,le]),Oe=Object(i.useCallback)((({groupByRadioSelection:e,groupByDurationUnit:t,groupByDurationValue:a})=>r.a.createElement(n.EuiRadioGroup,{disabled:!G.isAtLeast(lt.ab)||null==F||0===F.length,idSelected:e.value,options:[{id:v.b.PerRuleExecution,label:"Per rule execution"},{id:v.b.PerTimePeriod,label:r.a.createElement(r.a.Fragment,null,"Per time period",r.a.createElement(yt,{durationValueField:a,durationUnitField:t,isDisabled:!G.isAtLeast(lt.ab)||0===(null==F?void 0:F.length)||e.value!==v.b.PerTimePeriod,minimumValue:1}))}],onChange:t=>{e.setValue(t)},"data-test-subj":"groupByDurationOptions"})),[G,F]),we=Object(i.useCallback)((({suppressionMissingFields:e})=>r.a.createElement(n.EuiRadioGroup,{disabled:!G.isAtLeast(lt.ab)||null==F||0===F.length,idSelected:e.value,options:[{id:lt.b.Suppress,label:Z.c},{id:lt.b.DoNotSuppress,label:Z.a}],onChange:t=>{e.setValue(t)},"data-test-subj":"suppressionMissingFieldsOptions"})),[G,F]),Te=Object(i.useMemo)((()=>[{id:v.a.IndexPatterns,label:l.i18n.translate("xpack.securitySolution.ruleDefine.indexTypeSelect.indexPattern",{defaultMessage:"Index Patterns"}),iconType:N===v.a.IndexPatterns?"checkInCircleFilled":"empty","data-test-subj":`rule-index-toggle-${v.a.IndexPatterns}`},{id:v.a.DataView,label:l.i18n.translate("xpack.securitySolution.ruleDefine.indexTypeSelect.dataView",{defaultMessage:"Data View"}),iconType:N===v.a.DataView?"checkInCircleFilled":"empty","data-test-subj":`rule-index-toggle-${v.a.DataView}`}]),[N]),Ce=Object(i.useMemo)((()=>null==a||0===Object.keys(a).length?r.a.createElement(n.EuiLoadingSpinner,{size:"l"}):r.a.createElement(C.e,{key:"DataViewSelector",path:"dataViewId",component:Ie,componentProps:{kibanaDataViews:a}})),[a]),Me=Object(i.useMemo)((()=>r.a.createElement(xt,{label:Z.o,$isVisible:!0,fullWidth:!0},r.a.createElement(n.EuiFlexGroup,{direction:"column",gutterSize:"s","data-test-subj":"dataViewIndexPatternButtonGroupFlexGroup"},r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiText,{size:"xs"},r.a.createElement(p.FormattedMessage,{id:"xpack.securitySolution.dataViewSelectorText1",defaultMessage:"Use Kibana "}),r.a.createElement(it.a,{guidePath:"kibana",docPath:"data-views.html",linkText:"Data Views"}),r.a.createElement(p.FormattedMessage,{id:"xpack.securitySolution.dataViewSelectorText2",defaultMessage:" or specify individual "}),r.a.createElement(it.a,{guidePath:"kibana",docPath:"index-patterns-api-create.html",linkText:"index patterns"}),r.a.createElement(p.FormattedMessage,{id:"xpack.securitySolution.dataViewSelectorText3",defaultMessage:" as your rule's data source to be searched."}))),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(xt,{$isVisible:!0},r.a.createElement(n.EuiButtonGroup,{isFullWidth:!0,legend:"Rule index pattern or data view selector","data-test-subj":"dataViewIndexPatternButtonGroup",idSelected:N,onChange:ie,options:Te,color:"primary"}))),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(vt,{isVisible:N===v.a.DataView},Ce),r.a.createElement(vt,{isVisible:N===v.a.IndexPatterns},r.a.createElement(ht,{path:"index",config:{...Object(c.omit)(je.a.index,"label"),labelAppend:$?r.a.createElement(Et,{onClick:ge,iconType:"refresh"},Z.m):null},componentProps:{idAria:"detectionEngineStepDefineRuleIndices","data-test-subj":"detectionEngineStepDefineRuleIndices",euiFieldProps:{fullWidth:!0,placeholder:"",isDisabled:ae,isLoading:ae}}})))))),[ae,N,ie,Te,Ce,$,ge]),_e=Object(i.useMemo)((()=>r.a.createElement(C.e,{key:"QueryBarDefineRule",path:"queryBar",config:{...je.a.queryBar,label:Z.l,labelAppend:r.a.createElement(Et,{"data-test-subj":"importQueryFromSavedTimeline",onClick:ye,disabled:P},Z.h)},component:A,componentProps:{browserFields:k,idAria:"detectionEngineStepDefineRuleQueryBar",indexPattern:j,isDisabled:e||P||ae,resetToSavedQuery:P,isLoading:S||ae,dataTestSubj:"detectionEngineStepDefineRuleQueryBar",openTimelineSearch:q,onValidityChange:w,onCloseTimelineSearch:he,onSavedQueryError:be,defaultSavedQuery:u,onOpenTimeline:te}})),[ye,P,k,j,e,ae,S,q,w,he,be,u,te]),Fe=Object(i.useCallback)(((e,t)=>{x((a=>({...a,[e]:t})))}),[x]),Ae=Object(i.useMemo)((()=>Object(c.isEmpty)(j.fields)?{keywordFields:[],dateFields:[],nonDateFields:[]}:{keywordFields:j.fields.filter((e=>{var t;return null===(t=e.esTypes)||void 0===t?void 0:t.includes("keyword")})).map((e=>({label:e.name}))),dateFields:j.fields.filter((e=>"date"===e.type)).map((e=>({label:e.name}))),nonDateFields:j.fields.filter((e=>"date"!==e.type)).map((e=>({label:e.name})))}),[j]),De=Object(i.useMemo)((()=>({describedByIds:["detectionEngineStepDefineRuleType"],isUpdateView:t,hasValidLicense:Object(f.a)(B),isMlAdmin:Object(g.a)(B)})),[t,B]);return r.a.createElement(r.a.Fragment,null,r.a.createElement(de.a,{addPadding:!t},r.a.createElement(C.c,{form:h,"data-test-subj":"stepDefineRule"},r.a.createElement(vt,{isVisible:!1},r.a.createElement(C.e,{path:"dataSourceType",componentProps:{euiFieldProps:{fullWidth:!0,placeholder:""}}})),r.a.createElement(C.e,{path:"ruleType",component:Y,componentProps:De}),r.a.createElement(xt,{$isVisible:!Object(b.d)(I),fullWidth:!0},r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiSpacer,{size:"s"}),Me,r.a.createElement(n.EuiSpacer,{size:"s"}),Object(D.b)(I)?r.a.createElement(C.e,{key:"EqlQueryBar",path:"queryBar",component:Se.a,componentProps:{optionsData:Ae,optionsSelected:E,isSizeOptionDisabled:!0,onOptionsChange:Fe,onValidityChange:w,idAria:"detectionEngineStepDefineRuleEqlQueryBar",isDisabled:e,isLoading:S,indexPattern:j,showFilterBar:!0,dataTestSubj:"detectionEngineStepDefineRuleEqlQueryBar"},config:{...je.a.queryBar,label:Z.e}}):_e)),Object(D.e)(I)&&r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiSpacer,{size:"s"}),r.a.createElement(xt,{label:Z.n,$isVisible:Boolean(L),fullWidth:!0},r.a.createElement(ht,{path:"shouldLoadQueryDynamically",componentProps:{idAria:"detectionEngineStepDefineRuleShouldLoadQueryDynamically","data-test-subj":"detectionEngineStepDefineRuleShouldLoadQueryDynamically",euiFieldProps:{disabled:e,label:R?Z.s(R):Z.t()}}}))),r.a.createElement(xt,{$isVisible:Object(D.e)(I),"data-test-subj":"alertSuppressionInput"},r.a.createElement(C.e,{path:"groupByFields",component:st.a,componentProps:{browserFields:oe,disabledText:Z.g,isDisabled:!G.isAtLeast(lt.ab)&&0===(null==F?void 0:F.length)}})),r.a.createElement(jt,{$isVisible:Object(D.e)(I),"data-test-subj":"alertSuppressionDuration"},r.a.createElement(C.f,{fields:{groupByRadioSelection:{path:"groupByRadioSelection"},groupByDurationValue:{path:"groupByDuration.value"},groupByDurationUnit:{path:"groupByDuration.unit"}}},Oe)),r.a.createElement(jt,{$isVisible:Object(D.e)(I),"data-test-subj":"alertSuppressionMissingFields",label:r.a.createElement("span",null,Z.b," ",r.a.createElement(xe,null)),fullWidth:!0},r.a.createElement(C.f,{fields:{suppressionMissingFields:{path:"suppressionMissingFields"}}},we)),r.a.createElement(xt,{$isVisible:Object(b.d)(I),fullWidth:!0},r.a.createElement(r.a.Fragment,null,r.a.createElement(C.e,{path:"machineLearningJobId",component:ce,componentProps:{describedByIds:["detectionEngineStepDefineRulemachineLearningJobId"]}}),r.a.createElement(C.e,{path:"anomalyThreshold",component:J,componentProps:{describedByIds:["detectionEngineStepDefineRuleAnomalyThreshold"]}}))),r.a.createElement(xt,{$isVisible:Object(D.g)(I),"data-test-subj":"thresholdInput",fullWidth:!0},r.a.createElement(r.a.Fragment,null,r.a.createElement(C.f,{fields:{thresholdField:{path:"threshold.field"},thresholdValue:{path:"threshold.value"},thresholdCardinalityField:{path:"threshold.cardinality.field"},thresholdCardinalityValue:{path:"threshold.cardinality.value"}}},Ee))),r.a.createElement(xt,{$isVisible:Object(D.f)(I),"data-test-subj":"threatMatchInput",fullWidth:!0},r.a.createElement(r.a.Fragment,null,r.a.createElement(C.f,{fields:{threatMapping:{path:"threatMapping"}}},ke))),r.a.createElement(xt,{$isVisible:Object(D.d)(I),"data-test-subj":"newTermsInput",fullWidth:!0},r.a.createElement(r.a.Fragment,null,r.a.createElement(C.e,{path:"newTermsFields",component:at,componentProps:{browserFields:oe}}),r.a.createElement(C.e,{path:"historyWindowSize",component:nt.a,componentProps:{idAria:"detectionEngineStepDefineRuleHistoryWindowSize",dataTestSubj:"detectionEngineStepDefineRuleHistoryWindowSize",timeTypes:["m","h","d"]}}))),r.a.createElement(C.e,{path:"timeline",component:ue.a,componentProps:{idAria:"detectionEngineStepDefineRuleTimeline",isDisabled:e,dataTestSubj:"detectionEngineStepDefineRuleTimeline"}}))))},kt=Object(i.memo)(St),Ot=({addPadding:e,defaultValues:t,descriptionColumns:a,indexPattern:n,isInPanelView:i=!1})=>{const s=Object(h.e)(t);return r.a.createElement(de.a,{"data-test-subj":"definitionRule",addPadding:e},r.a.createElement(E.a,{columns:a,schema:Object(h.b)(je.a,t.ruleType),data:Object(h.b)(s,t.ruleType),indexPatterns:n,isInPanelView:i}))},wt=Object(i.memo)(Ot)},function(e,t,a){"use strict";a.d(t,"a",(function(){return fe})),a.d(t,"b",(function(){return he}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(197),c=a(104),u=a.n(c),d=a(42),p=a(137),m=a(125);const b=o()(n.EuiFormRow).withConfig({displayName:"MyEuiFormRow",componentId:"sc-7izzbw-0"})([".euiFormRow__labelWrapper{.euiText{padding-right:32px;}}"]),g=o()(n.EuiButtonEmpty).withConfig({displayName:"MyAddItemButton",componentId:"sc-7izzbw-1"})(["margin:4px 0px;font-size:12px;.euiIcon{width:12px;height:12px;}"]);g.defaultProps={flush:"left",iconType:"plusInCircle",size:"s"};const f=({addText:e,dataTestSubj:t,field:a,idAria:s,isDisabled:o,validate:l})=>{const[c,f]=Object(i.useState)(!1),{isInvalid:y,errorMessage:h}=Object(m.i)(a),[v,E]=Object(i.useState)(-1),x=Object(i.useRef)([]),j=Object(i.useCallback)((e=>{const t=a.value,n=[...t.slice(0,e),...t.slice(e+1)];a.setValue(0===n.length?[""]:n),x.current=[...x.current.slice(0,e),...x.current.slice(e+1)],x.current=x.current.map(((t,a)=>(a>=e&&null!=x.current[e]&&(t.value="re-render"),t)))}),[a]),S=Object(i.useCallback)((()=>{const e=a.value;a.setValue([...e,""])}),[a]),k=Object(i.useCallback)(((e,t)=>{const n=a.value,i=e.target.value;a.setValue([...n.slice(0,t),i,...n.slice(t+1)])}),[a]),O=Object(i.useCallback)(((e,t)=>{null!=t&&(x.current=[...x.current.slice(0,e),t,...x.current.slice(e+1)])}),[x]);Object(i.useEffect)((()=>{-1===v||Object(d.isEmpty)(x.current)||null==x.current[v]||(x.current[v].focus(),E(-1))}),[v,x.current]);const w=a.value;return r.a.createElement(b,{label:a.label,labelAppend:a.labelAppend,error:c?h:null,isInvalid:c&&y,fullWidth:!0,"data-test-subj":t,describedByIds:s?[s]:void 0},r.a.createElement(r.a.Fragment,null,w.map(((e,t)=>{const a={disabled:o,...t===w.length-1?{inputRef:O.bind(null,t)}:{},value:e,isInvalid:null!=l&&c&&l(e)};return r.a.createElement("div",{key:t},r.a.createElement(n.EuiFlexGroup,{gutterSize:"s",alignItems:"center"},r.a.createElement(n.EuiFlexItem,{grow:!0},r.a.createElement(n.EuiFieldText,u()({onBlur:()=>f(!0),onChange:e=>k(e,t),fullWidth:!0},a))),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiButtonIcon,{color:"danger",iconType:"trash",isDisabled:o||Object(d.isEmpty)(e)&&1===w.length,onClick:()=>j(t),"aria-label":p.ub}))),w.length-1!==t&&r.a.createElement(n.EuiSpacer,{size:"s"}))})),r.a.createElement(g,{onClick:S,isDisabled:o},e)))};var y=a(597),h=a(8),v=a(334);const E=[{framework:"MITRE ATT&CK",tactic:{id:"none",name:"none",reference:"none"},technique:[]}];Object(v.c)([]);var x=a(5);const j=x.i18n.translate("xpack.securitySolution.detectionEngine.mitreAttack.threatsDescription",{defaultMessage:"threats"}),S=x.i18n.translate("xpack.securitySolution.detectionEngine.mitreAttack.tacticsDescription",{defaultMessage:"tactic"}),k=x.i18n.translate("xpack.securitySolution.detectionEngine.mitreAttack.techniquesDescription",{defaultMessage:"technique"}),O=x.i18n.translate("xpack.securitySolution.detectionEngine.mitreAttack.subtechniquesDescription",{defaultMessage:"subtechnique"}),w=x.i18n.translate("xpack.securitySolution.detectionEngine.mitreAttack.addTacticTitle",{defaultMessage:"Add tactic"}),T=x.i18n.translate("xpack.securitySolution.detectionEngine.mitreAttack.addTechniqueTitle",{defaultMessage:"Add technique"}),I=x.i18n.translate("xpack.securitySolution.detectionEngine.mitreAttack.addSubtechniqueTitle",{defaultMessage:"Add subtechnique"}),C=x.i18n.translate("xpack.securitySolution.detectionEngine.mitreAttack.tacticPlaceHolderDescription",{defaultMessage:"Select a tactic ..."}),M=x.i18n.translate("xpack.securitySolution.detectionEngine.mitreAttack.techniquePlaceHolderDescription",{defaultMessage:"Select a technique ..."}),_=x.i18n.translate("xpack.securitySolution.detectionEngine.mitreAttack.subtechniquePlaceHolderDescription",{defaultMessage:"Select a subtechnique ..."}),F=o.a.div.withConfig({displayName:"SubtechniqueContainer",componentId:"sc-1wna1kp-0"})(["margin-left:48px;"]),A=({field:e,idAria:t,isDisabled:s,threatIndex:o,techniqueIndex:l,onFieldChange:c})=>{const u=e.value,[m,b]=Object(i.useState)([]);Object(i.useEffect)((()=>{!async function(){const e=await a.e(19).then(a.bind(null,1443));b(e.subtechniques)}()}),[]);const f=Object(i.useMemo)((()=>{var e;return[...null!==(e=u[o].technique)&&void 0!==e?e:[]]}),[u,o]),y=Object(i.useCallback)((t=>{var a;const n=[...e.value],i=null!==(a=f[l].subtechnique)&&void 0!==a?a:[];null!=i&&(i.splice(t,1),f[l]={...f[l],subtechnique:i},n[o].technique=f,c(n))}),[e,c,l,f,o]),h=Object(i.useCallback)((()=>{const t=[...e.value],a=f[l].subtechnique;f[l]=null!=a?{...f[l],subtechnique:[...a,{id:"none",name:"none",reference:"none"}]}:{...f[l],subtechnique:[{id:"none",name:"none",reference:"none"}]},t[o].technique=f,c(t)}),[e,c,l,f,o]),v=Object(i.useCallback)(((t,a)=>{const n=[...e.value],{id:i,reference:r,name:s}=m.find((e=>e.value===a))||{id:"",name:"",reference:""},u=f[l].subtechnique;null!=u&&c([...n.slice(0,o),{...n[o],technique:[...f.slice(0,l),{...f[l],subtechnique:[...u.slice(0,t),{id:i,reference:r,name:s},...u.slice(t+1)]},...f.slice(l+1)]},...n.slice(o+1)])}),[e.value,m,f,l,c,o]),E=Object(i.useCallback)(((t,a,i)=>{const s=m.filter((e=>e.techniqueId===f[l].id));return r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiSuperSelect,{id:"mitreAttackSubtechnique",options:[..."none"===i.name?[{inputDisplay:r.a.createElement(r.a.Fragment,null,_),value:"none",disabled:a}]:[],...s.map((e=>({inputDisplay:r.a.createElement(r.a.Fragment,null,e.label),value:e.value,disabled:a})))],prepend:`${e.label} ${O}`,"aria-label":"",onChange:v.bind(null,t),fullWidth:!0,valueOfSelected:Object(d.camelCase)(i.name),"data-test-subj":"mitreAttackSubtechnique",disabled:a,placeholder:_}))}),[m,e.label,v,f,l]),x=Object(i.useMemo)((()=>f[l].subtechnique),[f,l]);return r.a.createElement(F,null,null!=x&&x.map(((e,a)=>r.a.createElement("div",{key:a},r.a.createElement(n.EuiSpacer,{size:"s"}),r.a.createElement(n.EuiFormRow,{fullWidth:!0,describedByIds:t?[`${t} ${O}`]:void 0},r.a.createElement(n.EuiFlexGroup,{gutterSize:"s",alignItems:"center"},r.a.createElement(n.EuiFlexItem,{grow:!0},E(a,s,e)),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiButtonIcon,{color:"danger",iconType:"trash",isDisabled:s,onClick:()=>y(a),"aria-label":p.ub}))))))),r.a.createElement(g,{"data-test-subj":"addMitreAttackSubtechnique",onClick:h,isDisabled:s},I))},D=(e,t)=>e.some((e=>e.techniqueId===t.id)),N=o.a.div.withConfig({displayName:"TechniqueContainer",componentId:"sc-1e8h3t0-0"})(["",""],(({theme:e})=>Object(s.css)(["margin-left:24px;padding-left:24px;border-left:2px solid ",";"],e.eui.euiColorLightestShade))),P=({field:e,idAria:t,isDisabled:s,threatIndex:o,onFieldChange:l})=>{var c;const u=e.value,[m,b]=Object(i.useState)([]),[f,y]=Object(i.useState)([]);Object(i.useEffect)((()=>{!async function(){const e=await a.e(19).then(a.bind(null,1443));b(e.techniques),y(e.subtechniques)}()}),[]);const h=Object(i.useCallback)((t=>{var a;const n=[...e.value],i=null!==(a=n[o].technique)&&void 0!==a?a:[];i.splice(t,1),n[o]={...n[o],technique:i},l(n)}),[e,o,l]),v=Object(i.useCallback)((()=>{var t;const a=[...e.value];a[o]={...a[o],technique:[...null!==(t=a[o].technique)&&void 0!==t?t:[],{id:"none",name:"none",reference:"none",subtechnique:[]}]},l(a)}),[e,o,l]),E=Object(i.useCallback)(((t,a)=>{var n;const i=[...e.value],{id:r,reference:s,name:c}=m.find((e=>e.value===a))||{id:"",name:"",reference:""},u=null!==(n=i[o].technique)&&void 0!==n?n:[];l([...i.slice(0,o),{...i[o],technique:[...u.slice(0,t),{id:r,reference:s,name:c,subtechnique:[]},...u.slice(t+1)]},...i.slice(o+1)])}),[e.value,m,o,l]),x=Object(i.useCallback)(((t,a,i,s)=>{const o=m.filter((e=>e.tactics.includes(Object(d.kebabCase)(t))));return r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiSuperSelect,{id:"mitreAttackTechnique",options:[..."none"===s.name?[{inputDisplay:r.a.createElement(r.a.Fragment,null,M),value:"none",disabled:i}]:[],...o.map((e=>({inputDisplay:r.a.createElement(r.a.Fragment,null,e.label),value:e.value,disabled:i})))],prepend:`${e.label} ${k}`,"aria-label":"",onChange:E.bind(null,a),fullWidth:!0,valueOfSelected:Object(d.camelCase)(s.name),"data-test-subj":"mitreAttackTechnique",disabled:i,placeholder:M}))}),[e.label,m,E]),j=null!==(c=u[o].technique)&&void 0!==c?c:[];return r.a.createElement(N,null,j.map(((a,i)=>r.a.createElement("div",{key:i},r.a.createElement(n.EuiSpacer,{size:"s"}),r.a.createElement(n.EuiFormRow,{fullWidth:!0,describedByIds:t?[`${t} ${k}`]:void 0},r.a.createElement(n.EuiFlexGroup,{gutterSize:"s",alignItems:"center"},r.a.createElement(n.EuiFlexItem,{grow:!0},x(u[o].tactic.name,i,s,a)),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiButtonIcon,{color:"danger",iconType:"trash",isDisabled:s,onClick:()=>h(i),"aria-label":p.ub})))),r.a.createElement(A,{field:e,idAria:t,isDisabled:s||"none"===a.name||!1===D(f,a),threatIndex:o,techniqueIndex:i,onFieldChange:l})))),r.a.createElement(g,{"data-test-subj":"addMitreAttackTechnique",onClick:v,isDisabled:s},T))},R=o.a.div.withConfig({displayName:"MitreAttackContainer",componentId:"sc-17z3rkk-0"})(["margin-top:16px;"]),L=o()(n.EuiFormRow).withConfig({displayName:"InitialMitreAttackFormRow",componentId:"sc-17z3rkk-1"})([".euiFormRow__labelWrapper{.euiText{padding-right:32px;}}"]),B=Object(i.memo)((({field:e,idAria:t,isDisabled:s})=>{const o=Object(i.useCallback)((t=>{const a=[...e.value];a.splice(t,1),Object(d.isEmpty)(a)?e.setValue(E):e.setValue(a)}),[e]),l=Object(i.useCallback)((()=>{const t=[...e.value];Object(d.isEmpty)(t[t.length-1])?e.setValue([{tactic:{id:"none",name:"none",reference:"none"},technique:[]}]):e.setValue([...t,{tactic:{id:"none",name:"none",reference:"none"},technique:[]}])}),[e]),[c,u]=Object(i.useState)([]);Object(i.useEffect)((()=>{!async function(){const e=await a.e(19).then(a.bind(null,1443));u(e.tactics)}()}),[]);const m=Object(i.useCallback)(((t,a)=>{const n=[...e.value],{id:i,reference:r,name:s}=c.find((e=>e.value===a))||{id:"",name:"",reference:""};n.splice(t,1,{...n[t],tactic:{id:i,reference:r,name:s},technique:[]}),e.setValue([...n])}),[e,c]),b=Object(i.useMemo)((()=>[...e.value]),[e]),f=Object(i.useCallback)(((t,a,i)=>{const l=t.tactic.name;return r.a.createElement(n.EuiFlexGroup,{gutterSize:"s",alignItems:"center"},r.a.createElement(n.EuiFlexItem,{grow:!0},r.a.createElement(n.EuiSuperSelect,{id:"mitreAttackTactic",options:[..."none"===l?[{inputDisplay:r.a.createElement(r.a.Fragment,null,C),value:"none",disabled:i}]:[],...c.map((e=>({inputDisplay:r.a.createElement(r.a.Fragment,null,e.label),value:e.value,disabled:i})))],prepend:`${e.label} ${S}`,"aria-label":"",onChange:m.bind(null,a),fullWidth:!0,valueOfSelected:Object(d.camelCase)(l),"data-test-subj":"mitreAttackTactic",placeholder:C})),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiButtonIcon,{color:"danger",iconType:"trash",isDisabled:s||Object(h.isEqual)(b,E),onClick:()=>o(a),"aria-label":p.ub})))}),[e.label,s,o,c,m,b]),y=Object(i.useCallback)((t=>{e.setValue(t)}),[e]);return r.a.createElement(R,null,b.map(((a,i)=>r.a.createElement("div",{key:i},0===i?r.a.createElement(L,{fullWidth:!0,label:`${e.label} ${j}`,labelAppend:e.labelAppend,describedByIds:t?[`${t} ${S}`]:void 0},r.a.createElement(r.a.Fragment,null,f(a,i,s))):r.a.createElement(n.EuiFormRow,{fullWidth:!0,describedByIds:t?[`${t} ${S}`]:void 0},f(a,i,s)),r.a.createElement(P,{field:e,threatIndex:i,isDisabled:s||"none"===a.tactic.name,idAria:t,onFieldChange:y})))),r.a.createElement(g,{"data-test-subj":"addMitreAttackTactic",onClick:l,isDisabled:s},w))}));var q=a(739),z=a(228),$=a(893),V=a(589),U=a(469),H=a(481),G=a(316),Q=a(102),W=a(810);const K=o.a.div.withConfig({displayName:"NestedContent",componentId:"sc-1dv52ek-0"})(["margin-left:24px;"]),Y=o()(n.EuiFlexItem).withConfig({displayName:"EuiFlexItemComboBoxColumn",componentId:"sc-1dv52ek-1"})(["max-width:376px;"]),J=o()(n.EuiFlexItem).withConfig({displayName:"EuiFlexItemIconColumn",componentId:"sc-1dv52ek-2"})(["width:20px;"]),X=o()(n.EuiFlexItem).withConfig({displayName:"EuiFlexItemSeverityColumn",componentId:"sc-1dv52ek-3"})(["width:80px;"]),Z=({dataTestSubj:e,field:t,idAria:a,indices:s,isDisabled:o,options:l,setRiskScore:c})=>{const{services:u}=Object(Q.j)(),{value:p,isMappingChecked:m,mapping:b}=t.value,{setValue:g}=t,f=Object(i.useCallback)(((e,t)=>{g({value:p,isMappingChecked:m,mapping:[...b.slice(0,t),...e,...b.slice(t+1)]})}),[p,m,b,g]),y=Object(i.useCallback)(((e,t,[a])=>{var n;const i=[{...b[e],field:null!==(n=null==a?void 0:a.name)&&void 0!==n?n:"",value:null!=a?b[e].value:"",operator:"equals",severity:t}];f(i,e)}),[b,f]),h=Object(i.useCallback)((e=>{g({value:e,isMappingChecked:m,mapping:b}),c(e)}),[m,b,g,c]),v=Object(i.useCallback)(((e,t,a)=>{const n=[{...b[e],field:b[e].field,value:null!=b[e].field&&""!==b[e].field?a:"",operator:"equals",severity:t}];f(n,e)}),[b,f]),E=Object(i.useCallback)((()=>{g({value:p,mapping:[...b],isMappingChecked:!m})}),[m,b,p,g]),x=Object(i.useMemo)((()=>r.a.createElement("div",null,r.a.createElement(n.EuiFlexGroup,{gutterSize:"s"},r.a.createElement(n.EuiFlexItem,null,W.b)),r.a.createElement(n.EuiSpacer,{size:"xs"}),r.a.createElement(n.EuiText,{size:"xs"},W.c))),[]),j=Object(i.useMemo)((()=>r.a.createElement("div",null,r.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"s",onClick:o?d.noop:E},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiCheckbox,{id:"severity-mapping-override",checked:m,disabled:o,onChange:E})),r.a.createElement(n.EuiFlexItem,null,W.d)),r.a.createElement(n.EuiSpacer,{size:"xs"}),r.a.createElement(K,null,r.a.createElement(n.EuiText,{size:"xs"},W.e)))),[E,o,m]);return r.a.createElement(n.EuiFlexGroup,{direction:"column"},r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiFormRow,{label:x,labelAppend:t.labelAppend,helpText:t.helpText,error:"errorMessage",isInvalid:!1,fullWidth:!0,"data-test-subj":"detectionEngineStepAboutRuleSeverity",describedByIds:["detectionEngineStepAboutRuleSeverity"]},r.a.createElement(n.EuiSuperSelect,{fullWidth:!1,disabled:!1,valueOfSelected:p,onChange:h,options:l,"data-test-subj":"select"}))),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiFormRow,{label:j,labelAppend:t.labelAppend,helpText:m?r.a.createElement(K,null,W.f):"",error:"errorMessage",isInvalid:!1,fullWidth:!0,"data-test-subj":`${e}-severityOverride`,describedByIds:a?[a]:void 0},r.a.createElement(K,null,r.a.createElement(n.EuiSpacer,{size:"s"}),m&&r.a.createElement(n.EuiFlexGroup,{direction:"column",gutterSize:"s"},r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"s"},r.a.createElement(Y,null,r.a.createElement(n.EuiFormLabel,null,W.g)),r.a.createElement(Y,null,r.a.createElement(n.EuiFormLabel,null,W.h)),r.a.createElement(J,{grow:!1}),r.a.createElement(X,{grow:!1},r.a.createElement(n.EuiFormLabel,null,W.a)))),b.map(((e,t)=>{var a;return r.a.createElement(n.EuiFlexItem,{key:`${e.severity}-${t}`},r.a.createElement(n.EuiFlexGroup,{"data-test-subj":"severityOverrideRow",alignItems:"center",gutterSize:"s"},r.a.createElement(Y,null,r.a.createElement(G.b,{placeholder:"",selectedField:ee(e,s),isLoading:!1,isDisabled:o,isClearable:!1,indexPattern:s,onChange:y.bind(null,t,e.severity),"data-test-subj":`detectionEngineStepAboutRuleSeverityMappingField-${e.severity}-${t}`,"aria-label":`detectionEngineStepAboutRuleSeverityMappingField-${e.severity}-${t}`})),r.a.createElement(Y,null,r.a.createElement(G.a,{autocompleteService:u.unifiedSearch.autocomplete,placeholder:"",selectedField:ee(e,s),selectedValue:e.value,isClearable:!1,isDisabled:o,isLoading:!1,indexPattern:s,onChange:v.bind(null,t,e.severity),"data-test-subj":`detectionEngineStepAboutRuleSeverityMappingValue-${e.severity}-${t}`,"aria-label":`detectionEngineStepAboutRuleSeverityMappingValue-${e.severity}-${t}`})),r.a.createElement(J,{grow:!1},r.a.createElement(n.EuiIcon,{type:"sortRight"})),r.a.createElement(X,{grow:!1},null===(a=l.find((t=>t.value===e.severity)))||void 0===a?void 0:a.inputDisplay)))})))))))},ee=(e,t)=>{const{field:a}=e,[n]=t.fields.filter((({name:e})=>a===e));return null!=n?n:{name:a,type:"string"}};var te=a(811);const ae=o.a.div.withConfig({displayName:"NestedContent",componentId:"sc-1udkauk-0"})(["margin-left:24px;"]),ne=o()(n.EuiFlexItem).withConfig({displayName:"EuiFlexItemComboBoxColumn",componentId:"sc-1udkauk-1"})(["max-width:376px;"]),ie=o()(n.EuiFlexItem).withConfig({displayName:"EuiFlexItemIconColumn",componentId:"sc-1udkauk-2"})(["width:20px;"]),re=o()(n.EuiFlexItem).withConfig({displayName:"EuiFlexItemRiskScoreColumn",componentId:"sc-1udkauk-3"})(["width:160px;"]),se=({dataTestSubj:e,field:t,idAria:a,indices:s,isDisabled:o,placeholder:l})=>{const{value:c,isMappingChecked:u,mapping:p}=t.value,{setValue:m}=t,b=Object(i.useMemo)((()=>["number"]),[]),g=Object(i.useMemo)((()=>oe(p,s)),[p,s]),f=Object(i.useCallback)((e=>{const t=e.target.value;m({value:Number(t.trim()),isMappingChecked:u,mapping:p})}),[m,u,p]),y=Object(i.useCallback)((([e])=>{var t;m({value:c,isMappingChecked:u,mapping:[{field:null!==(t=null==e?void 0:e.name)&&void 0!==t?t:"",operator:"equals",value:"",risk_score:void 0}]})}),[m,c,u]),h=Object(i.useCallback)((()=>{m({value:c,isMappingChecked:!u,mapping:[...p]})}),[m,c,u,p]),v=Object(i.useMemo)((()=>r.a.createElement("div",null,r.a.createElement(n.EuiFlexGroup,{gutterSize:"s"},r.a.createElement(n.EuiFlexItem,null,te.a)),r.a.createElement(n.EuiSpacer,{size:"xs"}),r.a.createElement(n.EuiText,{size:"xs"},te.c))),[]),E=Object(i.useMemo)((()=>r.a.createElement("div",null,r.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"s",onClick:o?d.noop:h},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiCheckbox,{id:"risk_score-mapping-override",checked:u,disabled:o,onChange:h})),r.a.createElement(n.EuiFlexItem,null,te.e)),r.a.createElement(n.EuiSpacer,{size:"xs"}),r.a.createElement(ae,null,r.a.createElement(n.EuiText,{size:"xs"},te.f)))),[u,h,o]);return r.a.createElement(n.EuiFlexGroup,{direction:"column"},r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiFormRow,{label:v,labelAppend:t.labelAppend,helpText:t.helpText,error:"errorMessage",isInvalid:!1,fullWidth:!0,"data-test-subj":`${e}-defaultRisk`,describedByIds:a?[a]:void 0},r.a.createElement(n.EuiRange,{value:c,onChange:f,max:100,min:0,showRange:!0,showInput:!0,fullWidth:!1,showTicks:!0,tickInterval:25,"data-test-subj":`${e}-defaultRiskRange`}))),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiFormRow,{label:E,labelAppend:t.labelAppend,helpText:u?r.a.createElement(ae,null,te.g):"",error:"errorMessage",isInvalid:!1,fullWidth:!0,"data-test-subj":`${e}-riskOverride`,describedByIds:a?[a]:void 0},r.a.createElement(ae,null,r.a.createElement(n.EuiSpacer,{size:"s"}),u&&r.a.createElement(n.EuiFlexGroup,{direction:"column",gutterSize:"s"},r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"s"},r.a.createElement(ne,null,r.a.createElement(n.EuiFormLabel,null,te.h)),r.a.createElement(ie,{grow:!1}),r.a.createElement(re,{grow:!1},r.a.createElement(n.EuiFormLabel,null,te.a)))),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"s"},r.a.createElement(ne,null,r.a.createElement(G.b,{placeholder:null!=l?l:"",indexPattern:s,selectedField:g,fieldTypeFilter:b,isLoading:!1,isClearable:!1,isDisabled:o,onChange:y,"data-test-subj":e,"aria-label":a})),r.a.createElement(ie,{grow:!1},r.a.createElement(n.EuiIcon,{type:"sortRight"})),r.a.createElement(re,{grow:!1},r.a.createElement(n.EuiText,{size:"s"},te.d)))))))))},oe=(e,t)=>{var a,n;const i=null!==(a=null==e||null===(n=e[0])||void 0===n?void 0:n.field)&&void 0!==a?a:"",[r]=t.fields.filter((({name:e})=>null!=i&&i===e));return null!=r?r:{name:i,type:"number"}},le=({dataTestSubj:e,field:t,idAria:a,indices:s,isDisabled:o,fieldType:l,placeholder:c})=>{const u=Object(i.useCallback)((([e])=>{var a;t.setValue(null!==(a=null==e?void 0:e.name)&&void 0!==a?a:"")}),[t]),d=Object(i.useMemo)((()=>{var e;const a=null!==(e=t.value)&&void 0!==e?e:"",[n]=s.fields.filter((({name:e})=>null!=a&&a===e));return n}),[t.value,s]),p=Object(i.useMemo)((()=>[l]),[l]);return r.a.createElement(n.EuiFormRow,{"data-test-subj":e,describedByIds:a?[a]:void 0,fullWidth:!0,helpText:t.helpText,label:t.label,labelAppend:t.labelAppend},r.a.createElement(G.b,{placeholder:null!=c?c:"",indexPattern:s,selectedField:d,fieldTypeFilter:p,isLoading:!1,isDisabled:o,isClearable:!1,onChange:u,"data-test-subj":e,"aria-label":a,fieldInputWidth:500}))};var ce=a(183),ue=a(4),de=a(881),pe=a(894);const me=Object(m.j)({component:m.b});o.a.div.withConfig({displayName:"ThreeQuartersContainer",componentId:"sc-1uryycj-0"})(["max-width:740px;"]).displayName="ThreeQuartersContainer";const be=o.a.div.withConfig({displayName:"TagContainer",componentId:"sc-1uryycj-1"})(["margin-top:16px;"]);be.displayName="TagContainer";const ge=({ruleType:e,machineLearningJobId:t,index:a,dataViewId:s,timestampOverride:o,isActive:c=!1,isUpdateView:u=!1,isLoading:d,form:p})=>{const{data:b}=Object(Q.j)().services,g=Object(i.useMemo)((()=>Object(l.f)(e)),[e]),{ruleIndices:y}=Object(de.a)(t,a),[h,{indexPatterns:v}]=Object(ce.b)(y),[E,x]=Object(i.useState)(v);Object(i.useEffect)((()=>{null==a||""!==s&&null!=s||x(v)}),[s,a,v]),Object(i.useEffect)((()=>{(async()=>{if(null!=s&&""!==s){const e=await b.dataViews.get(s);x(e)}})()}),[b.dataViews,s,v,x]);const{getFields:j}=p,S=Object(i.useCallback)((e=>{const t=q.h[e];if(null!=t){const e=j().riskScore;e.setValue({...e.value,value:t})}}),[j]);return r.a.createElement(r.a.Fragment,null,r.a.createElement(U.a,{addPadding:!u},r.a.createElement(m.c,{form:p},r.a.createElement(me,{path:"name",componentProps:{idAria:"detectionEngineStepAboutRuleName","data-test-subj":"detectionEngineStepAboutRuleName",euiFieldProps:{fullWidth:!0,disabled:d}}}),r.a.createElement(n.EuiSpacer,{size:"l"}),r.a.createElement(me,{path:"description",componentProps:{idAria:"detectionEngineStepAboutRuleDescription","data-test-subj":"detectionEngineStepAboutRuleDescription",euiFieldProps:{disabled:d,compressed:!0,fullWidth:!0}}}),r.a.createElement(n.EuiSpacer,{size:"l"}),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(m.e,{path:"severity",component:Z,componentProps:{dataTestSubj:"detectionEngineStepAboutRuleSeverityField",idAria:"detectionEngineStepAboutRuleSeverityField",isDisabled:d||h,options:q.i,indices:E,setRiskScore:S}})),r.a.createElement(n.EuiSpacer,{size:"l"}),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(me,{path:"riskScore",component:se,componentProps:{dataTestSubj:"detectionEngineStepAboutRuleRiskScore",idAria:"detectionEngineStepAboutRuleRiskScore",isDisabled:d||h,indices:E}})),r.a.createElement(be,null,r.a.createElement(me,{path:"tags",componentProps:{idAria:"detectionEngineStepAboutRuleTags","data-test-subj":"detectionEngineStepAboutRuleTags",euiFieldProps:{fullWidth:!0,isDisabled:d||h,placeholder:""}}})),r.a.createElement(n.EuiSpacer,{size:"l"}),r.a.createElement(n.EuiAccordion,{"data-test-subj":"advancedSettings",id:"advancedSettingsAccordion",buttonContent:V.d},r.a.createElement(n.EuiSpacer,{size:"l"}),r.a.createElement(m.e,{path:"references",component:f,componentProps:{addText:V.b,idAria:"detectionEngineStepAboutRuleReferenceUrls",isDisabled:d,dataTestSubj:"detectionEngineStepAboutRuleReferenceUrls",validate:z.c}}),r.a.createElement(m.e,{path:"falsePositives",component:f,componentProps:{addText:V.a,idAria:"detectionEngineStepAboutRuleFalsePositives",isDisabled:d,dataTestSubj:"detectionEngineStepAboutRuleFalsePositives"}}),r.a.createElement(m.e,{path:"threat",component:B,componentProps:{idAria:"detectionEngineStepAboutRuleMitreThreat",isDisabled:d,dataTestSubj:"detectionEngineStepAboutRuleMitreThreat"}}),r.a.createElement(n.EuiSpacer,{size:"l"}),r.a.createElement(m.e,{path:"investigationFields",component:pe.a,componentProps:{browserFields:E.fields,isDisabled:d||h,fullWidth:!0}}),r.a.createElement(n.EuiSpacer,{size:"l"}),r.a.createElement(m.e,{path:"note",component:H.a,componentProps:{idAria:"detectionEngineStepAboutRuleNote",isDisabled:d,dataTestSubj:"detectionEngineStepAboutRuleNote",placeholder:V.c}}),r.a.createElement(n.EuiSpacer,{size:"l"}),r.a.createElement(me,{path:"author",componentProps:{idAria:"detectionEngineStepAboutRuleAuthor","data-test-subj":"detectionEngineStepAboutRuleAuthor",euiFieldProps:{fullWidth:!0,isDisabled:d,placeholder:""}}}),r.a.createElement(n.EuiSpacer,{size:"l"}),r.a.createElement(me,{path:"license",componentProps:{idAria:"detectionEngineStepAboutRuleLicense","data-test-subj":"detectionEngineStepAboutRuleLicense",euiFieldProps:{fullWidth:!0,disabled:d,placeholder:""}}}),r.a.createElement(n.EuiSpacer,{size:"l"}),r.a.createElement(n.EuiFormRow,{label:V.g,fullWidth:!0},r.a.createElement(me,{path:"isAssociatedToEndpointList",componentProps:{idAria:"detectionEngineStepAboutRuleAssociatedToEndpointList","data-test-subj":"detectionEngineStepAboutRuleAssociatedToEndpointList",euiFieldProps:{disabled:d}}})),r.a.createElement(n.EuiFormRow,{label:V.e,fullWidth:!0},r.a.createElement(me,{path:"isBuildingBlock",componentProps:{idAria:"detectionEngineStepAboutRuleBuildingBlock","data-test-subj":"detectionEngineStepAboutRuleBuildingBlock",euiFieldProps:{disabled:d}}})),r.a.createElement(n.EuiSpacer,{size:"l"}),g&&r.a.createElement(r.a.Fragment,null,r.a.createElement(me,{path:"threatIndicatorPath",componentProps:{idAria:"detectionEngineStepAboutThreatIndicatorPath","data-test-subj":"detectionEngineStepAboutThreatIndicatorPath",euiFieldProps:{fullWidth:!0,disabled:d,placeholder:ue.I}}})),r.a.createElement(n.EuiSpacer,{size:"l"}),r.a.createElement(m.e,{path:"ruleNameOverride",component:le,componentProps:{dataTestSubj:"detectionEngineStepAboutRuleRuleNameOverride",fieldType:"string",idAria:"detectionEngineStepAboutRuleRuleNameOverride",indices:E,isDisabled:d||h,placeholder:""}}),r.a.createElement(n.EuiSpacer,{size:"l"}),r.a.createElement(m.e,{path:"timestampOverride",component:le,componentProps:{dataTestSubj:"detectionEngineStepAboutRuleTimestampOverride",fieldType:"date",idAria:"detectionEngineStepAboutRuleTimestampOverride",indices:E,isDisabled:d||h,placeholder:""}}),!!o&&"@timestamp"!==o&&r.a.createElement(r.a.Fragment,null,r.a.createElement(me,{path:"timestampOverrideFallbackDisabled",componentProps:{idAria:"detectionTimestampOverrideFallbackDisabled","data-test-subj":"detectionTimestampOverrideFallbackDisabled",euiFieldProps:{disabled:d}}}))))))},fe=Object(i.memo)(ge),ye=({addPadding:e,defaultValues:t,descriptionColumns:a,isInPanelView:n=!1})=>r.a.createElement(U.a,{"data-test-subj":"aboutStep",addPadding:e},r.a.createElement(y.a,{columns:a,schema:$.a,data:t,isInPanelView:n})),he=Object(i.memo)(ye)},function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"b",(function(){return i})),a.d(t,"c",(function(){return r}));const n="matrixHistogram";let i;!function(e){e.authentications="authentications",e.anomalies="anomalies",e.events="events",e.alerts="alerts",e.dns="dns",e.preview="preview"}(i||(i={}));const r={[i.alerts]:"aggregations.alertsGroup.buckets",[i.anomalies]:"aggregations.anomalyActionGroup.buckets",[i.authentications]:"aggregations.eventActionGroup.buckets",[i.dns]:"aggregations.dns_name_query_count.buckets",[i.events]:"aggregations.eventActionGroup.buckets",[i.preview]:"aggregations.preview.buckets"}},function(e,t,a){"use strict";a.d(t,"a",(function(){return f}));var n=a(2),i=a.n(n),r=a(42),s=a(822),o=a(40),l=a(44),c=a(108),u=a(375),d=a(239),p=a(461),m=a(399);const b=i.a.memo((({endpointId:e,hostName:t,casesInfo:a,cancelCallback:r,successCallback:s})=>{const[b,g]=Object(n.useState)(""),[f,y]=Object(n.useState)(!1),h=a.map((e=>e.id)),{loading:v,isolateHost:E}=(({endpointId:e,comment:t,caseIds:a})=>{const[i,r]=Object(n.useState)(!1),{addError:s}=Object(c.a)();return{loading:i,isolateHost:Object(n.useCallback)((async()=>{try{r(!0);const n=await Object(d.b)({endpointId:e,comment:t,caseIds:a&&a.length>0?a:void 0});return r(!1),!!n.action}catch(e){return r(!1),s(e.message,{title:u.b}),!1}}),[e,t,a,s])}})({endpointId:e,comment:b,caseIds:h}),x=Object(n.useCallback)((async()=>{const e=await E();y(e),e&&s&&s()}),[E,s]),j=Object(n.useCallback)((()=>r()),[r]),S=Object(n.useCallback)((({comment:e})=>g(e)),[]),k=Object(n.useMemo)((()=>a.length),[a]),O=Object(n.useMemo)((()=>i.a.createElement(m.a,{onClick:j,buttonText:p.c})),[j]),w=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(o.EuiSpacer,{size:"m"}),i.a.createElement(m.b,{hostName:t,onCancel:j,onConfirm:x,onChange:S,comment:b,isLoading:v,messageAppend:i.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.detections.hostIsolation.impactedCases",defaultMessage:"This action will be added to {cases}.",values:{cases:i.a.createElement("b",null,Object(p.a)(k))}})}))),[t,j,x,S,b,v,k]);return f?O:w}));b.displayName="IsolateHost";const g=i.a.memo((({endpointId:e,hostName:t,casesInfo:a,cancelCallback:r,successCallback:s})=>{const[b,g]=Object(n.useState)(""),[f,y]=Object(n.useState)(!1),h=a.map((e=>e.id)),{loading:v,unIsolateHost:E}=(({endpointId:e,comment:t,caseIds:a})=>{const[i,r]=Object(n.useState)(!1),{addError:s}=Object(c.a)();return{loading:i,unIsolateHost:Object(n.useCallback)((async()=>{try{r(!0);const n=await Object(d.c)({endpointId:e,comment:t,caseIds:a&&a.length>0?a:void 0});return r(!1),!!n.action}catch(e){return r(!1),s(e.message,{title:u.b}),!1}}),[e,t,a,s])}})({endpointId:e,comment:b,caseIds:h}),x=Object(n.useCallback)((async()=>{const e=await E();y(e),e&&s&&s()}),[s,E]),j=Object(n.useCallback)((()=>r()),[r]),S=Object(n.useCallback)((({comment:e})=>g(e)),[]),k=Object(n.useMemo)((()=>a.length),[a]),O=Object(n.useMemo)((()=>i.a.createElement(m.a,{onClick:j,buttonText:p.c})),[j]),w=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(o.EuiSpacer,{size:"m"}),i.a.createElement(m.d,{hostName:t,onCancel:j,onConfirm:x,onChange:S,comment:b,isLoading:v,messageAppend:i.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.detections.hostIsolation.impactedCases",defaultMessage:"This action will be added to {cases}.",values:{cases:i.a.createElement("b",null,Object(p.a)(k))}})}))),[t,j,x,S,b,v,k]);return f?O:w}));g.displayName="UnisolateHost";const f=i.a.memo((({details:e,cancelCallback:t,successCallback:a,isolateAction:o})=>{const l=Object(n.useMemo)((()=>{var t;const a=null===(t=Object(r.find)({category:"agent",field:"agent.id"},e))||void 0===t?void 0:t.values;return a?a[0]:""}),[e]),c=Object(n.useMemo)((()=>{var t;const a=null===(t=Object(r.find)({category:"host",field:"host.name"},e))||void 0===t?void 0:t.values;return a?a[0]:""}),[e]),u=Object(n.useMemo)((()=>{var t;const a=null===(t=Object(r.find)({category:"_id",field:"_id"},e))||void 0===t?void 0:t.values;return a?a[0]:""}),[e]),{casesInfo:d}=Object(s.a)({alertId:u});return"isolateHost"===o?i.a.createElement(b,{endpointId:l,hostName:c,casesInfo:d,cancelCallback:t,successCallback:a}):i.a.createElement(g,{endpointId:l,hostName:c,casesInfo:d,cancelCallback:t,successCallback:a})}));f.displayName="HostIsolationContent"},function(e,t,a){"use strict";a.d(t,"a",(function(){return p}));var n=a(43),i=a(120),r=a(128);n.exact(n.type({id:r.z})),n.exact(n.type({items:n.array(i.i)})),n.exact(n.type({name:n.string,description:n.string}));var s=a(112);n.intersection([n.exact(n.type({namespace_types:i.a})),n.exact(n.partial({ids:s.l,list_ids:s.l}))]);const o=n.exact(n.type({name:r.x,id:r.z,rule_id:r.E,exception_lists:i.y})),l=n.intersection([i.o,n.exact(n.type({referenced_rules:n.array(o)}))]),c=n.record(i.B,l);n.exact(n.type({references:n.array(c)}));var u=a(4);const d=`${u.Cb}/rules`,p=(u.gb,`${d}/exceptions/_find_references`)},function(e,t,a){"use strict";a.d(t,"a",(function(){return b})),a.d(t,"b",(function(){return g})),a.d(t,"c",(function(){return f}));var n=a(8),i=a(197),r=a(102),s=a(213),o=a(3),l=a(51);const c=e=>"parsing_exception"===e||"verification_exception"===e||"mapping_exception"===e,u=e=>Object(n.has)(e,"error.type"),d=e=>e.error.root_cause.filter((e=>c(e.type))).map((e=>e.reason));var p=a(371);let m;!function(e){e.FAILED_REQUEST="ERR_FAILED_REQUEST",e.INVALID_EQL="ERR_INVALID_EQL"}(m||(m={}));const b=(e,t)=>{let a,n=[];return(...i)=>(a&&clearTimeout(a),a=setTimeout((()=>{const t=e(...i);n.forEach((e=>e(t))),n=[]}),t),new Promise((e=>n.push(e))))},g=async(...e)=>{const[{value:t,formData:a}]=e,{query:b}=t,g=b.query,{dataViewId:f,index:y,ruleType:h}=a;if(void 0===h&&!Object(n.isEmpty)(g)||Object(i.b)(h)&&!Object(n.isEmpty)(g))try{const{data:e}=r.b.get();let t=null==y?void 0:y.join(),i={};if(null!=f&&""!==f&&a.dataSourceType===s.a.DataView){const a=await e.dataViews.get(f);t=a.title,i=a.getRuntimeMappings()}const p=(new AbortController).signal,b=await(async({data:e,dataViewTitle:t,query:a,signal:i,runtimeMappings:r})=>{const{rawResponse:s}=await Object(o.firstValueFrom)(e.search.search({params:{index:t,body:{query:a,runtime_mappings:r,size:0}},options:{ignore:[400]}},{strategy:l.EQL_SEARCH_STRATEGY,abortSignal:i}));if((e=>u(e)&&c(Object(n.get)(e,"error.type")))(s.body))return{valid:!1,errors:d(s.body)};if(u(s.body))throw new Error(JSON.stringify(s.body));return{valid:!0,errors:[]}})({data:e,query:g,signal:p,dataViewTitle:t,runtimeMappings:i});if(!1===(null==b?void 0:b.valid))return{code:m.INVALID_EQL,message:"",messages:b.errors}}catch(e){return{code:m.FAILED_REQUEST,message:p.m,error:e}}},f=e=>{const t=e.errors.length>0,a=!e.isChangingValue&&!t;if(t){const[t]=e.errors,n=t.message;return t.code===m.INVALID_EQL?{isValid:a,message:n,messages:t.messages}:{isValid:a,message:n,error:t.error}}return{isValid:a,message:""}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(104),i=a.n(n),r=(a(2),a(53)),s=a.n(r),o=a(40),l=a(21);const c={iconType:"questionInCircle",color:"gray"},u={binary:{iconType:"tokenBinary"},boolean:{iconType:"tokenBoolean"},conflict:{iconType:"warning",color:"euiColorVis9",shape:"square"},date:{iconType:"tokenDate"},date_range:{iconType:"tokenDate"},dense_vector:{iconType:"tokenDenseVector"},geo_point:{iconType:"tokenGeo"},geo_shape:{iconType:"tokenGeo"},ip:{iconType:"tokenIP"},ip_range:{iconType:"tokenIP"},flattened:{iconType:"tokenFlattened"},match_only_text:{iconType:"tokenString"},murmur3:{iconType:"tokenSearchType"},number:{iconType:"tokenNumber"},number_range:{iconType:"tokenNumber"},rank_feature:{iconType:"tokenRankFeature"},rank_features:{iconType:"tokenRankFeatures"},histogram:{iconType:"tokenHistogram"},_source:{iconType:"editorCodeBlock",color:"gray"},point:{iconType:"tokenShape"},shape:{iconType:"tokenShape"},string:{iconType:"tokenString"},text:{iconType:"tokenString"},keyword:{iconType:"tokenKeyword"},gauge:{iconType:"tokenMetricGauge"},counter:{iconType:"tokenMetricCounter"},nested:{iconType:"tokenNested"},version:{iconType:"tokenTag"}};function d({type:e,label:t,size:a="s",scripted:n,className:r,...d}){const p=u[e]||c;return Object(l.jsx)(o.EuiToken,i()({},p,{className:s()("kbnFieldIcon",r),"aria-label":t||e,title:t||e,size:a,fill:n?"dark":void 0},d))}a(1269);Object.keys({xs:"kbnFieldButton--xs",s:"kbnFieldButton--s"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(2),i=a.n(n),r=a(181),s=a(333),o=a(102),l=a(470),c=a(265);const u=a(5).i18n.translate("xpack.securitySolution.detectionEngine.rulesSnoozeBadge.error.unableToFetch",{defaultMessage:"Unable to fetch snooze settings"});function d({ruleId:e,showTooltipInline:t=!1}){const a=Object(o.j)().services.triggersActionsUi.getRulesListNotifyBadge,{snoozeSettings:n,error:d}=function(e){var t,a;const{state:{rulesSnoozeSettings:n}}=null!==(t=Object(c.c)())&&void 0!==t?t:{state:{}},{data:i,isFetching:r,isError:s}=Object(l.a)([e],{enabled:!(null!=n&&n.data[e]||null!=n&&n.isFetching)}),o=null!==(a=null==n?void 0:n.data[e])&&void 0!==a?a:null==i?void 0:i[e],d=(null==n?void 0:n.isFetching)||r;return{snoozeSettings:o,error:(null==n?void 0:n.isError)||s||!o&&!d?u:void 0}}(e),[{canUserCRUD:p}]=Object(r.b)(),m=Object(s.c)(p),b=Object(l.b)();return i.a.createElement(a,{ruleId:e,snoozeSettings:n,loading:!n&&!d,disabled:!m||d,showTooltipInline:t,onRuleChanged:b})}},function(e,t,a){"use strict";let n,i;a.d(t,"d",(function(){return n})),a.d(t,"e",(function(){return i})),a.d(t,"l",(function(){return r})),a.d(t,"a",(function(){return s})),a.d(t,"f",(function(){return o})),a.d(t,"j",(function(){return u})),a.d(t,"k",(function(){return d})),a.d(t,"h",(function(){return p})),a.d(t,"i",(function(){return m})),a.d(t,"g",(function(){return b})),a.d(t,"b",(function(){return g})),a.d(t,"c",(function(){return c.c})),function(e){e.timestamp="@timestamp",e.hostName="host.name",e.hostRiskScore="host.risk.calculated_score_norm",e.hostRisk="host.risk.calculated_level",e.userName="user.name",e.userRiskScore="user.risk.calculated_score_norm",e.userRisk="user.risk.calculated_level",e.alertsCount="alertsCount"}(n||(n={})),function(e){e.unknown="Unknown",e.low="Low",e.moderate="Moderate",e.high="High",e.critical="Critical"}(i||(i={}));const r=e=>"user"in e,s={[i.critical]:0,[i.high]:0,[i.low]:0,[i.moderate]:0,[i.unknown]:0},o=[i.unknown,i.low,i.moderate,i.high,i.critical];var l=a(4),c=a(599);const u=(e,t=!0,a)=>a?Object(c.d)(e):`${l.Yb}${t?"latest_":""}${e}`,d=(e,t=!0,a)=>a?Object(c.d)(e):`${l.ac}${t?"latest_":""}${e}`,p=e=>({terms:{"host.name":e}}),m=e=>({terms:{"user.name":e}}),b=(e,t)=>t===c.c.host?{terms:{"host.name":e}}:{terms:{"user.name":e}};let g;!function(e){e.hostsRiskScore="hostsRiskScore",e.usersRiskScore="usersRiskScore",e.kpiRiskScore="kpiRiskScore"}(g||(g={}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"c",(function(){return n})),a.d(t,"d",(function(){return c})),a.d(t,"b",(function(){return u}));var n={};a.r(n),a.d(n,"selectGlobalUrlParam",(function(){return r}));var i=a(514);const r=e=>e.globalUrlParam;var s=a(130),o=a.n(s),l=a(208);const c={},u=Object(l.reducerWithInitialState)(c).case(i.registerUrlParam,((e,{key:t,initialValue:a})=>void 0!==e[t]?(console.error(`Url param key '${t}' is already being used.`),e):{...e,[t]:a})).case(i.deregisterUrlParam,((e,{key:t})=>{const a={...e};return delete a[t],a})).case(i.updateUrlParam,((e,{key:t,value:a})=>void 0===e[t]||o()(e[t],a)?e:{...e,[t]:a})).build()},function(e,t,a){"use strict";a.d(t,"a",(function(){return v})),a.d(t,"b",(function(){return x}));var n=a(2),i=a.n(n),r=a(5),s=a(40),o=a(141),l=a(290),c=a(829),u=a(107),d=a(732),p=a(794),m=a(102),b=a(368),g=a(827),f=a(126),y=a(487),h=a(381);const v=Object.freeze({flyoutEditTitle:r.i18n.translate("xpack.securitySolution.artifactListPage.flyoutEditTitle",{defaultMessage:"Add artifact"}),flyoutCreateTitle:r.i18n.translate("xpack.securitySolution.artifactListPage.flyoutCreateTitle",{defaultMessage:"Create artifact"}),flyoutCancelButtonLabel:r.i18n.translate("xpack.securitySolution.artifactListPage.flyoutCancelButtonLabel",{defaultMessage:"Cancel"}),flyoutCreateSubmitButtonLabel:r.i18n.translate("xpack.securitySolution.artifactListPage.flyoutCreateSubmitButtonLabel",{defaultMessage:"Add"}),flyoutEditSubmitButtonLabel:r.i18n.translate("xpack.securitySolution.artifactListPage.flyoutEditSubmitButtonLabel",{defaultMessage:"Save"}),flyoutDowngradedLicenseTitle:r.i18n.translate("xpack.securitySolution.artifactListPage.expiredLicenseTitle",{defaultMessage:"Expired License"}),flyoutDowngradedLicenseInfo:r.i18n.translate("xpack.securitySolution.artifactListPage.flyoutDowngradedLicenseInfo",{defaultMessage:"Your Kibana license has been downgraded. Future policy configurations will now be globally assigned to all policies."}),flyoutDowngradedLicenseDocsInfo:e=>r.i18n.translate("xpack.securitySolution.artifactListPage.flyoutDowngradedLicenseDocsInfo",{defaultMessage:"For more information, see our documentation."}),flyoutEditItemLoadFailure:e=>r.i18n.translate("xpack.securitySolution.artifactListPage.flyoutEditItemLoadFailure",{defaultMessage:"Failed to retrieve item for edit. Reason: {errorMessage}",values:{errorMessage:e}}),flyoutCreateSubmitSuccess:({name:e})=>r.i18n.translate("xpack.securitySolution.some_page.flyoutCreateSubmitSuccess",{defaultMessage:'"{name}" has been added.',values:{name:e}}),flyoutEditSubmitSuccess:({name:e})=>r.i18n.translate("xpack.securitySolution.artifactListPage.flyoutEditSubmitSuccess",{defaultMessage:'"{name}" has been updated.',values:{name:e}})}),E=(e,t)=>({isValid:!1,item:null!=t?t:Object(b.a)(e)}),x=Object(n.memo)((({apiClient:e,item:t,policies:a,policiesIsLoading:r,FormComponent:b,onSuccess:x,onClose:j,submitHandler:S,labels:k={},"data-test-subj":O,size:w="m"})=>{var T,I;const{docLinks:{links:{securitySolution:C}}}=Object(m.j)().services,M=Object(u.a)(O),_=Object(m.n)(),F=Object(c.a)(),A=Object(d.a)(),{urlParams:D}=Object(l.a)(),N=Object(o.b)(),P=Object(n.useMemo)((()=>({...v,...k})),[k]),[R,L]=Object(n.useState)(!1),[B,q]=Object(n.useState)(void 0),z="edit"===D.show,$=z?"edit":"create",{isLoading:V,mutateAsync:U,error:H}=Object(g.a)(e,$),G=Object(n.useMemo)((()=>S?R:V),[R,V,S]),Q=Object(n.useMemo)((()=>S?B:H),[B,H,S]),{isRefetching:W,error:K,refetch:Y}=Object(h.d)(e,null!==(T=D.itemId)&&void 0!==T?T:"",void 0,{enabled:!1}),[J,X]=Object(n.useState)(E.bind(null,e.listId,t)),Z=((e,t)=>{const a=Object(f.a)().endpointPrivileges;return Object(n.useMemo)((()=>"edit"===t&&!a.canCreateArtifactsByPolicy&&Object(y.d)(e)),[a.canCreateArtifactsByPolicy,e,t])})({tags:null!==(I=J.item.tags)&&void 0!==I?I:[]},$),ee=Object(n.useMemo)((()=>!!t||!!J.item.item_id),[J.item.item_id,t]),te=Object(n.useMemo)((()=>z&&!ee),[ee,z]),ae=Object(n.useCallback)((()=>{G||(A({...D,itemId:void 0,show:void 0},!0),j())}),[G,j,A,D]),ne=Object(n.useCallback)((({item:e,isValid:t})=>{N()&&X({item:e,isValid:t})}),[N]),ie=Object(n.useCallback)((e=>{_.addSuccess(z?P.flyoutEditSubmitSuccess(e):P.flyoutCreateSubmitSuccess(e)),N()&&(A({...D,itemId:void 0,show:void 0},!0),x())}),[z,N,P,x,A,_,D]),re=Object(n.useCallback)((()=>{S?(L(!0),S(J.item,$).then(ie).catch((e=>{N()&&q(e)})).finally((()=>{N()&&L(!1)}))):U(J.item).then(ie)}),[$,J.item,ie,N,U,S]);return Object(n.useEffect)((()=>{!z||ee||K||!te||W||Y().then((({data:t})=>{t&&N()&&X(E(e.listId,t))}))}),[e.listId,K,Y,z,te,W,ee,N]),Object(n.useEffect)((()=>{var e;z&&K&&(_.addWarning(P.flyoutEditItemLoadFailure((null==K||null===(e=K.body)||void 0===e?void 0:e.message)||K.message)),A({itemId:void 0,show:void 0}))}),[K,z,P,A,_,D.itemId]),!F||K?null:i.a.createElement(s.EuiFlyout,{size:w,onClose:ae,"data-test-subj":O},i.a.createElement(s.EuiFlyoutHeader,{hasBorder:!0},i.a.createElement(s.EuiTitle,{size:"m"},i.a.createElement("h2",null,z?P.flyoutEditTitle:P.flyoutCreateTitle))),!te&&Z&&i.a.createElement(s.EuiCallOut,{title:P.flyoutDowngradedLicenseTitle,color:"warning",iconType:"help","data-test-subj":M("expiredLicenseCallout")},P.flyoutDowngradedLicenseInfo," ",P.flyoutDowngradedLicenseDocsInfo(C)),i.a.createElement(s.EuiFlyoutBody,null,te&&i.a.createElement(p.a,{"data-test-subj":M("loader")}),!te&&i.a.createElement(b,{onChange:ne,disabled:G,item:J.item,error:null!=Q?Q:void 0,mode:$,policies:a,policiesIsLoading:r})),!te&&i.a.createElement(s.EuiFlyoutFooter,null,i.a.createElement(s.EuiFlexGroup,{justifyContent:"spaceBetween"},i.a.createElement(s.EuiFlexItem,{grow:!1},i.a.createElement(s.EuiButtonEmpty,{"data-test-subj":M("cancelButton"),onClick:ae,disabled:G},P.flyoutCancelButtonLabel)),i.a.createElement(s.EuiFlexItem,{grow:!1},i.a.createElement(s.EuiButton,{"data-test-subj":M("submitButton"),fill:!0,disabled:!J.isValid||G,onClick:re,isLoading:G},z?P.flyoutEditSubmitButtonLabel:P.flyoutCreateSubmitButtonLabel)))))}));x.displayName="ArtifactFlyout"},function(e,t,a){"use strict";a.d(t,"a",(function(){return y}));var n=a(104),i=a.n(n),r=a(40),s=a(42),o=a(2),l=a.n(o),c=a(41),u=a.n(c),d=a(125),p=a(5);const m=[{value:"s",text:p.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRuleForm.secondsOptionDescription",{defaultMessage:"Seconds"})},{value:"m",text:p.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRuleForm.minutesOptionDescription",{defaultMessage:"Minutes"})},{value:"h",text:p.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRuleForm.hoursOptionDescription",{defaultMessage:"Hours"})},{value:"d",text:p.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRuleForm.daysOptionDescription",{defaultMessage:"Days"})}],b=u()(r.EuiFlexItem).withConfig({displayName:"StyledLabelAppend",componentId:"sc-gbwqm5-0"})(["&.euiFlexItem{margin-left:31px;}"]),g=u()(r.EuiFormRow).withConfig({displayName:"StyledEuiFormRow",componentId:"sc-gbwqm5-1"})(["max-width:none;.euiFormControlLayout{max-width:auto;width:auto;}.euiFormControlLayout__childrenWrapper > *:first-child{box-shadow:none;height:38px;width:100%;}.euiFormControlLayout__childrenWrapper > select{background-color:",";color:",";}.euiFormControlLayout--group .euiFormControlLayout{min-width:100px;}.euiFormControlLayoutIcons{color:",";}.euiFormControlLayout:not(:first-child){border-left:1px solid ",";}"],(({theme:e})=>Object(r.transparentize)(e.eui.euiColorPrimary,.1)),(({theme:e})=>e.eui.euiColorPrimary),(({theme:e})=>e.eui.euiColorPrimary),(({theme:e})=>e.eui.euiColorLightShade)),f=u()(r.EuiSelect).withConfig({displayName:"MyEuiSelect",componentId:"sc-gbwqm5-2"})(["width:auto;"]),y=({dataTestSubj:e,field:t,idAria:a,isDisabled:n,minimumValue:c=0,timeTypes:u=["s","m","h"],fullWidth:p=!1})=>{const[y,h]=Object(o.useState)(u[0]),[v,E]=Object(o.useState)(0),{isInvalid:x,errorMessage:j}=Object(d.i)(t),{value:S,setValue:k}=t,O=Object(o.useCallback)((e=>{h(e.target.value),k(`${v}${e.target.value}`)}),[k,v]),w=Object(o.useCallback)((e=>{const t=((e,t=0)=>{const a=parseInt(e,10);return Number.isNaN(a)?t:Math.max(t,Math.min(a,Number.MAX_SAFE_INTEGER))})(e.target.value,c);E(t),k(`${t}${y}`)}),[c,k,y]);Object(o.useEffect)((()=>{if(S!==`${v}${y}`){const e=S.match(/\d+/g),t=S.match(/[a-zA-Z]+/g);Object(s.isEmpty)(e)||null==e||isNaN(Number(e[0]))||Number(e[0])===Number(v)||E(Number(e[0])),!Object(s.isEmpty)(t)&&null!=t&&u.includes(t[0])&&t[0]!==y&&h(t[0])}}),[y,u,v,S]);const T={disabled:n},I=Object(o.useMemo)((()=>l.a.createElement(r.EuiFlexGroup,{gutterSize:"s",justifyContent:"flexStart",alignItems:"center"},l.a.createElement(r.EuiFlexItem,{grow:!1,component:"span"},t.label),l.a.createElement(b,{grow:!1,component:"span"},t.labelAppend))),[t.label,t.labelAppend]);return l.a.createElement(g,{label:I,helpText:t.helpText,error:j,isInvalid:x,fullWidth:p,"data-test-subj":e,describedByIds:a?[a]:void 0},l.a.createElement(r.EuiFormControlLayout,{append:l.a.createElement(f,i()({fullWidth:!1,options:m.filter((e=>u.includes(e.value))),onChange:O,value:y,"aria-label":t.label,"data-test-subj":"timeType"},T))},l.a.createElement(r.EuiFieldNumber,i()({fullWidth:!0,min:c,max:Number.MAX_SAFE_INTEGER,onChange:w,value:v,"data-test-subj":"interval"},T))))}},function(e,t,a){"use strict";a.d(t,"b",(function(){return n.a})),a.d(t,"a",(function(){return y})),a(742),a(566),a(592),a(594);var n=a(593),i=(a(595),a(2)),r=a(244),s=a(214),o=a(8),l=a(226),c=a(181),u=a(4),d=a(102),p=a(605),m=a(900),b=a(198),g=a(353);const f={contentText:"",rulesReferences:[],isLoading:!1,listId:"",listNamespaceType:"single"},y=e=>{const t=Object(d.n)(),{services:a}=Object(d.j)(),{http:n,notifications:y}=a,{navigateToApp:h}=a.application,{exportExceptionList:v,deleteExceptionList:E,duplicateExceptionList:x}=Object(s.c)(n),[{loading:j,canUserCRUD:S,canUserREAD:k}]=Object(c.b)(),[O,w]=Object(i.useState)(),[T,I]=Object(i.useState)(!1),[C,M]=Object(i.useState)(),[_,F]=Object(i.useState)(!1),[A,D]=Object(i.useState)([]),[N,P]=Object(i.useState)([]),[R,L]=Object(i.useState)(!0),[B,q]=Object(i.useState)(""),[z,$]=Object(i.useState)(),[V,U]=Object(i.useState)(!1),[H,G]=Object(i.useState)(f),[Q,W]=Object(i.useState)(!0),[K,Y]=Object(i.useState)(!1),J=Object(g.b)(),X=Object(i.useMemo)((()=>({pageId:u.wc.exceptions,path:"",onNavigate:()=>{h(u.l,{deepLinkId:u.wc.exceptions,path:""})}})),[h]),Z=Object(i.useCallback)(((e,a,n,i)=>{null==t||t.addError(e,{title:null!=n?n:"",toastMessage:null!=i?i:""}),q(null!=a?a:"")}),[t]),ee=Object(i.useCallback)((async e=>{const t=await Object(p.e)(e.list_id);D(t)}),[]),te=Object(i.useCallback)((async()=>{try{if(l.a.includes(e))return F(!0);w(!0);const t=await Object(p.d)({id:e,http:n});if(!t||!Object(m.b)(t))return w(!1),F(!0);if(M(t),await ee(t),w(!1),F(!1),Object(m.a)(t))return L(!1)}catch(e){Z(e,r.i.ERROR,b.q,b.p)}}),[e,n,ee,Z]);Object(i.useEffect)((()=>{te()}),[te]);const[ae,ne]=Object(i.useState)(!1),ie=Object(i.useCallback)((async t=>{try{var a;C&&await Object(p.i)({http:n,list:{id:C.id,list_id:e,type:C.type,name:t.name,description:null!==(a=t.description)&&void 0!==a?a:"",namespace_type:C.namespace_type}})}catch(e){Z(e)}}),[e,Z,n,C]),re=Object(i.useCallback)((async e=>{try{if(!C)return;await v({id:C.id,listId:C.list_id,includeExpiredExceptions:e,namespaceType:C.namespace_type,onError:e=>Z(e),onSuccess:e=>{$(e),null==t||t.addSuccess(b.C(C.name))}})}catch(e){Z(e,void 0,b.r,b.s)}}),[C,v,Z,t]),se=Object(i.useCallback)((async e=>{try{if(!C)return;await x({listId:C.list_id,includeExpiredExceptions:e,namespaceType:C.namespace_type,onError:e=>Z(e),onSuccess:e=>{null==t||t.addSuccess(b.v(C.name)),h(u.l,{deepLinkId:u.wc.exceptions,path:`/details/${e.list_id}`})}})}catch(e){Z(e,void 0,b.n,b.o)}}),[C,x,Z,t,h]),oe=Object(i.useCallback)((()=>{$(void 0)}),[]),le=Object(i.useCallback)((e=>()=>{y.toasts.addSuccess({title:b.nb(null!=e?e:H.listId)})}),[y.toasts,H.listId]),ce=Object(i.useCallback)((e=>{Z(e)}),[Z]),ue=Object(i.useCallback)((async()=>{try{if(!C)return;await E({id:C.id,namespaceType:C.namespace_type,onError:ce,onSuccess:le})}catch(e){Z(e)}finally{G(f),U(!1),h(u.l,{deepLinkId:u.wc.exceptions,path:""})}}),[C,E,ce,le,Z,h]),de=Object(i.useCallback)((()=>{try{if(!C)return;G({contentText:A.length?b.pb(A.length):b.mb(C.name),rulesReferences:A.map((({name:e})=>e)),isLoading:!0,listId:C.list_id,listNamespaceType:C.namespace_type}),U(!0)}catch(e){Z(e)}}),[Z,A,C]),pe=Object(i.useCallback)((()=>{U(!1),G({contentText:"",rulesReferences:[],isLoading:!1,listId:"",listNamespaceType:"single"})}),[]),me=Object(i.useCallback)((async()=>{try{await Object(p.h)({rules:A,listId:e}),ue()}catch(e){Z(e)}}),[e,A,Z,ue]),be=Object(i.useCallback)((()=>{D(N),P(N),ne(!1),I(!1),W(!0)}),[N]),ge=Object(i.useCallback)((()=>{ne(!0)}),[]),fe=Object(i.useCallback)((()=>N.filter((e=>!A.includes(e)))),[A,N]),ye=Object(i.useCallback)((()=>A.filter((e=>!N.includes(e)))),[A,N]),he=Object(i.useCallback)((e=>{P(e),W(!1)}),[]),ve=Object(i.useCallback)((async()=>{try{if(!C)return ne(!1);I(!0);const t=fe(),a=ye();if(!t.length&&!a.length||Object(o.isEqual)(t,a))return be();Promise.all([Object(p.h)({rules:a,listId:e}),Object(p.f)({rules:t,listId:e,id:C.id,listType:C.type,listNamespaceType:C.namespace_type})]).then((()=>{Y(!0),be()})).then((()=>Y(!1))).then((()=>J())).catch((e=>{Z(e,void 0,b.E,b.F),I(!1)})).finally((()=>{te()}))}catch(e){Z(e)}}),[C,fe,ye,be,e,J,Z,te]),Ee=Object(i.useCallback)((()=>{ne(!1)}),[]);return{isLoading:O||j,invalidListId:_,isReadOnly:!(S||!k),list:C,listName:null==C?void 0:C.name,listDescription:null==C?void 0:C.description,listId:e,canUserEditList:R,linkedRules:A,exportedList:z,handleOnDownload:oe,viewerStatus:B,showManageRulesFlyout:ae,headerBackOptions:X,referenceModalState:H,showReferenceErrorModal:V,showManageButtonLoader:T,refreshExceptions:K,disableManageButton:Q,handleDelete:de,onDuplicateList:se,onEditListDetails:ie,onExportList:re,onDeleteList:ue,onManageRules:ge,onSaveManageRules:ve,onCancelManageRules:Ee,onRuleSelectionChange:he,handleCloseReferenceErrorModal:pe,handleReferenceDelete:me}}},,function(e,t,a){"use strict";a.d(t,"a",(function(){return r})),a.d(t,"b",(function(){return s}));var n=a(102),i=a(215);const r=async e=>n.b.get().http.post(i.r,{body:JSON.stringify(e),version:"2023-10-31"}),s=async e=>n.b.get().http.post(i.x,{body:JSON.stringify(e),version:"2023-10-31"})},function(e,t,a){"use strict";(function(e){}).call(this,a(300).Buffer)},function(e,t,a){"use strict";(function(e){}).call(this,a(300).Buffer)},function(e,t,a){"use strict";const n=a(763);e.exports=class extends Error{constructor(e){super(e.filter((e=>""!==e)).map((e=>"string"==typeof e?e:e instanceof Error?e.message:n(e))).join(" ")||"Unknown error"),"function"==typeof Error.captureStackTrace&&Error.captureStackTrace(this,t.assert)}}},function(e,t,a){"use strict";e.exports=function(...e){try{return JSON.stringify.apply(null,e)}catch(e){return"[Cannot display object: "+e.message+"]"}}},function(e,t,a){"use strict";(function(a){const n={};t=e.exports={array:Array.prototype,buffer:a&&a.prototype,date:Date.prototype,error:Error.prototype,generic:Object.prototype,map:Map.prototype,promise:Promise.prototype,regex:RegExp.prototype,set:Set.prototype,weakMap:WeakMap.prototype,weakSet:WeakSet.prototype},n.typeMap=new Map([["[object Error]",t.error],["[object Map]",t.map],["[object Promise]",t.promise],["[object Set]",t.set],["[object WeakMap]",t.weakMap],["[object WeakSet]",t.weakSet]]),t.getInternalProto=function(e){if(Array.isArray(e))return t.array;if(a&&e instanceof a)return t.buffer;if(e instanceof Date)return t.date;if(e instanceof RegExp)return t.regex;if(e instanceof Error)return t.error;const i=Object.prototype.toString.call(e);return n.typeMap.get(i)||t.generic}}).call(this,a(300).Buffer)},function(e,t,a){"use strict";(function(t){const n=a(301),i=a(539),r=a(540),s={};e.exports=s.merge=function(e,a,o){if(n(e&&"object"==typeof e,"Invalid target value: must be an object"),n(null==a||"object"==typeof a,"Invalid source value: must be null, undefined, or an object"),!a)return e;if(o=Object.assign({nullOverride:!0,mergeArrays:!0},o),Array.isArray(a)){n(Array.isArray(e),"Cannot merge array onto an object"),o.mergeArrays||(e.length=0);for(let t=0;t<a.length;++t)e.push(i(a[t],{symbols:o.symbols}));return e}const l=r.keys(a,o);for(let n=0;n<l.length;++n){const r=l[n];if("__proto__"===r||!Object.prototype.propertyIsEnumerable.call(a,r))continue;const c=a[r];if(c&&"object"==typeof c){if(e[r]===c)continue;!e[r]||"object"!=typeof e[r]||Array.isArray(e[r])!==Array.isArray(c)||c instanceof Date||t&&t.isBuffer(c)||c instanceof RegExp?e[r]=i(c,{symbols:o.symbols}):s.merge(e[r],c,o)}else(null!=c||o.nullOverride)&&(e[r]=c)}return e}}).call(this,a(300).Buffer)},function(e,t,a){"use strict";e.exports=function(){}},function(e,t,a){"use strict";(function(t){const n=a(764),i={mismatched:null};e.exports=function(e,t,a){return a=Object.assign({prototype:!0},a),!!i.isDeepEqual(e,t,a,[])},i.isDeepEqual=function(e,a,r,s){if(e===a)return 0!==e||1/e==1/a;const o=typeof e;if(o!==typeof a)return!1;if(null===e||null===a)return!1;if("function"===o){if(!r.deepFunction||e.toString()!==a.toString())return!1}else if("object"!==o)return e!=e&&a!=a;const l=i.getSharedType(e,a,!!r.prototype);switch(l){case n.buffer:return t&&t.prototype.equals.call(e,a);case n.promise:return e===a;case n.regex:return e.toString()===a.toString();case i.mismatched:return!1}for(let t=s.length-1;t>=0;--t)if(s[t].isSame(e,a))return!0;s.push(new i.SeenEntry(e,a));try{return!!i.isDeepEqualObj(l,e,a,r,s)}finally{s.pop()}},i.getSharedType=function(e,t,a){if(a)return Object.getPrototypeOf(e)!==Object.getPrototypeOf(t)?i.mismatched:n.getInternalProto(e);const r=n.getInternalProto(e);return r!==n.getInternalProto(t)?i.mismatched:r},i.valueOf=function(e){const t=e.valueOf;if(void 0===t)return e;try{return t.call(e)}catch(e){return e}},i.hasOwnEnumerableProperty=function(e,t){return Object.prototype.propertyIsEnumerable.call(e,t)},i.isSetSimpleEqual=function(e,t){for(const a of Set.prototype.values.call(e))if(!Set.prototype.has.call(t,a))return!1;return!0},i.isDeepEqualObj=function(e,t,a,r,s){const{isDeepEqual:o,valueOf:l,hasOwnEnumerableProperty:c}=i,{keys:u,getOwnPropertySymbols:d}=Object;if(e===n.array){if(!r.part){if(t.length!==a.length)return!1;for(let e=0;e<t.length;++e)if(!o(t[e],a[e],r,s))return!1;return!0}for(const e of t)for(const t of a)if(o(e,t,r,s))return!0}else if(e===n.set){if(t.size!==a.size)return!1;if(!i.isSetSimpleEqual(t,a)){const e=new Set(Set.prototype.values.call(a));for(const a of Set.prototype.values.call(t)){if(e.delete(a))continue;let t=!1;for(const n of e)if(o(a,n,r,s)){e.delete(n),t=!0;break}if(!t)return!1}}}else if(e===n.map){if(t.size!==a.size)return!1;for(const[e,n]of Map.prototype.entries.call(t)){if(void 0===n&&!Map.prototype.has.call(a,e))return!1;if(!o(n,Map.prototype.get.call(a,e),r,s))return!1}}else if(e===n.error&&(t.name!==a.name||t.message!==a.message))return!1;const p=l(t),m=l(a);if((t!==p||a!==m)&&!o(p,m,r,s))return!1;const b=u(t);if(!r.part&&b.length!==u(a).length&&!r.skip)return!1;let g=0;for(const e of b)if(r.skip&&r.skip.includes(e))void 0===a[e]&&++g;else{if(!c(a,e))return!1;if(!o(t[e],a[e],r,s))return!1}if(!r.part&&b.length-g!==u(a).length)return!1;if(!1!==r.symbols){const e=d(t),n=new Set(d(a));for(const i of e){if(!r.skip||!r.skip.includes(i))if(c(t,i)){if(!c(a,i))return!1;if(!o(t[i],a[i],r,s))return!1}else if(c(a,i))return!1;n.delete(i)}for(const e of n)if(c(a,e))return!1}return!0},i.SeenEntry=class{constructor(e,t){this.obj=e,this.ref=t}isSame(e,t){return this.obj===e&&this.ref===t}}}).call(this,a(300).Buffer)},function(e,t,a){"use strict";e.exports=function(e){return e.replace(/[\^\$\.\*\+\-\?\=\!\:\|\\\/\(\)\[\]\{\}\,]/g,"\\$&")}},function(e,t,a){"use strict";a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return s}));var n=a(50),i=a.n(n);const r=e=>{const{from:t,to:a}=e,n=i()(a).diff(i()(t));return{kind:"absolute",fromStr:void 0,toStr:void 0,from:i()(t).subtract(n).toISOString(),to:i()(a).subtract(n).toISOString()}},s=e=>{const{from:t,to:a}=e,n=i()(a).diff(i()(t));return{kind:"absolute",fromStr:void 0,toStr:void 0,from:i()(t).add(n).toISOString(),to:i()(a).add(n).toISOString()}}},function(e,t,a){"use strict";a.d(t,"b",(function(){return s})),a.d(t,"a",(function(){return o}));var n=a(208),i=a(534),r=a(708);const s={},o=Object(n.reducerWithInitialState)(s).case(r.a,((e,{tableId:t,...a})=>({...e,[t]:{activeGroups:[],options:Object(i.c)(t),...e[t]?e[t]:{},...a}})))},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=e=>{const t=Object.values(e);return e=>e&&t.includes(e)?e:null}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.__FOR_TESTING__resetDeprecationsSeen=t.ofType=t.combineEpics=t.StateObservable=t.createEpicMiddleware=void 0;var n=a(1160);Object.defineProperty(t,"createEpicMiddleware",{enumerable:!0,get:function(){return n.createEpicMiddleware}});var i=a(773);Object.defineProperty(t,"StateObservable",{enumerable:!0,get:function(){return i.StateObservable}});var r=a(1161);Object.defineProperty(t,"combineEpics",{enumerable:!0,get:function(){return r.combineEpics}});var s=a(1162);Object.defineProperty(t,"ofType",{enumerable:!0,get:function(){return s.ofType}});var o=a(548);Object.defineProperty(t,"__FOR_TESTING__resetDeprecationsSeen",{enumerable:!0,get:function(){return o.resetDeprecationsSeen}})},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.StateObservable=void 0;var n=a(34),i=a(3),r=function(e){function t(t,a){var n=e.call(this,(function(e){var t=n.__notifier.subscribe(e);return t&&!t.closed&&e.next(n.value),t}))||this;return n.__notifier=new i.Subject,n.value=a,t.subscribe((function(e){e!==n.value&&(n.value=e,n.__notifier.next(e))})),n}return n.__extends(t,e),t}(i.Observable);t.StateObservable=r},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r}));var n=a(47);const i=()=>Object(n.v4)(),r=({prevPromptContexts:e,promptContext:t})=>({...e,[t.id]:{...t}})},function(e,t,a){"use strict";a.d(t,"f",(function(){return i})),a.d(t,"g",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"d",(function(){return o})),a.d(t,"h",(function(){return l})),a.d(t,"a",(function(){return c})),a.d(t,"b",(function(){return u})),a.d(t,"e",(function(){return d}));var n=a(5);const i=n.i18n.translate("xpack.elasticAssistant.assistant.settings.settingsAriaLabel",{defaultMessage:"Settings"}),r=n.i18n.translate("xpack.elasticAssistant.assistant.settings.settingsTooltip",{defaultMessage:"Settings"}),s=n.i18n.translate("xpack.elasticAssistant.assistant.settings.settingsConversationsMenuItemTitle",{defaultMessage:"Conversations"}),o=n.i18n.translate("xpack.elasticAssistant.assistant.settings.settingsQuickPromptsMenuItemTitle",{defaultMessage:"Quick Prompts"}),l=n.i18n.translate("xpack.elasticAssistant.assistant.settings.settingsSystemPromptsMenuItemTitle",{defaultMessage:"System Prompts"}),c=n.i18n.translate("xpack.elasticAssistant.assistant.settings.settingsAnonymizationMenuItemTitle",{defaultMessage:"Anonymization"}),u=(n.i18n.translate("xpack.elasticAssistant.assistant.settings.settingsFunctionsMenuItemTitle",{defaultMessage:"Functions"}),n.i18n.translate("xpack.elasticAssistant.assistant.settings.settingsAdvancedMenuItemTitle",{defaultMessage:"Advanced"}),n.i18n.translate("xpack.elasticAssistant.assistant.settings.modalTitle",{defaultMessage:"System Prompts"}),n.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.slCancelButtonTitle",{defaultMessage:"Cancel"})),d=n.i18n.translate("xpack.elasticAssistant.assistant.promptEditor.systemPrompt.slSaveButtonTitle",{defaultMessage:"Save"})},function(e,t,a){"use strict";a.d(t,"d",(function(){return i})),a.d(t,"c",(function(){return r})),a.d(t,"b",(function(){return s})),a.d(t,"a",(function(){return o}));var n=a(5);const i=n.i18n.translate("xpack.elasticAssistant.connectors.models.modelSelector.placeholderText",{defaultMessage:"Select or type to create new..."}),r=n.i18n.translate("xpack.elasticAssistant.connectors.models.modelSelector.modelTitle",{defaultMessage:"Model"}),s=n.i18n.translate("xpack.elasticAssistant.connectors.models.modelSelector.helpLabel",{defaultMessage:"Model to use for this connector"}),o=n.i18n.translate("xpack.elasticAssistant.connectors.models.modelSelector.customOptionText",{defaultMessage:"Create new Model named"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return l})),a.d(t,"b",(function(){return u}));var n=a(2),i=a.n(n),r=a(40),s=a(776),o=a(21);const l="gpt-3.5-turbo",c=[l,"gpt-4"],u=i.a.memo((({models:e=c,onModelSelectionChange:t,selectedModel:a=c[0]})=>{const[i,l]=Object(n.useState)(e.map((e=>({label:e})))),u=Object(n.useMemo)((()=>a?[{label:a}]:[]),[a]),d=Object(n.useCallback)((a=>{var n,i;const r=0===a.length?void 0:null!==(n=e.find((e=>{var t;return e===(null===(t=a[0])||void 0===t?void 0:t.label)})))&&void 0!==n?n:null===(i=a[0])||void 0===i?void 0:i.label;null==t||t(r)}),[t,e]),p=Object(n.useCallback)(((e,t=[])=>{if(!e||!e.trim().toLowerCase())return;const a=e.trim().toLowerCase(),n={value:e,label:e};-1!==t.findIndex((e=>e.label.trim().toLowerCase()===a))||l([...i,n]),d([n])}),[d,i]),m=Object(n.useCallback)((e=>{0===e.length?d([]):-1!==i.findIndex((t=>t.label===(null==e?void 0:e[0].label)))&&d(e)}),[d,i]);return Object(o.jsx)(r.EuiComboBox,{"aria-label":s.b,compressed:!0,isClearable:!1,placeholder:s.d,customOptionText:`${s.a} {searchValue}`,singleSelection:{asPlainText:!0},options:i,selectedOptions:u,onChange:m,onCreateOption:p,fullWidth:!0})}));u.displayName="ModelSelector"},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=n.__importStar(a(2)),r=a(2),s=n.__importDefault(a(360)),o=n.__importDefault(a(1169));t.default=function(e){return function(t){var a,l;l=i.isValidElement(t)?(a=t).props:t;var c=s.default({buffered:[],time:0,duration:0,paused:!0,muted:!1,volume:1}),u=c[0],d=c[1],p=r.useRef(null),m=function(e,t){return function(a){try{t&&t(a)}finally{e&&e(a)}}},b=function(){return d({paused:!1})},g=function(){return d({paused:!0})},f=function(){var e=p.current;e&&d({muted:e.muted,volume:e.volume})},y=function(){var e=p.current;if(e){var t=e.duration,a=e.buffered;d({duration:t,buffered:o.default(a)})}},h=function(){var e=p.current;e&&d({time:e.currentTime})},v=function(){var e=p.current;e&&d({buffered:o.default(e.buffered)})};a=a?i.cloneElement(a,n.__assign(n.__assign({controls:!1},l),{ref:p,onPlay:m(l.onPlay,b),onPause:m(l.onPause,g),onVolumeChange:m(l.onVolumeChange,f),onDurationChange:m(l.onDurationChange,y),onTimeUpdate:m(l.onTimeUpdate,h),onProgress:m(l.onProgress,v)})):i.createElement(e,n.__assign(n.__assign({controls:!1},l),{ref:p,onPlay:m(l.onPlay,b),onPause:m(l.onPause,g),onVolumeChange:m(l.onVolumeChange,f),onDurationChange:m(l.onDurationChange,y),onTimeUpdate:m(l.onTimeUpdate,h),onProgress:m(l.onProgress,v)}));var E=!1,x={play:function(){var e=p.current;if(e&&!E){var t=e.play();if("object"==typeof t){E=!0;var a=function(){E=!1};t.then(a,a)}return t}},pause:function(){var e=p.current;if(e&&!E)return e.pause()},seek:function(e){var t=p.current;t&&void 0!==u.duration&&(e=Math.min(u.duration,Math.max(0,e)),t.currentTime=e)},volume:function(e){var t=p.current;t&&(e=Math.min(1,Math.max(0,e)),t.volume=e,d({volume:e}))},mute:function(){var e=p.current;e&&(e.muted=!0)},unmute:function(){var e=p.current;e&&(e.muted=!1)}};return r.useEffect((function(){var e=p.current;e&&(d({volume:e.volume,muted:e.muted,paused:e.paused}),l.autoPlay&&e.paused&&x.play())}),[l.src]),[a,u,x,p]}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=function(e,t){return"boolean"==typeof t?t:!e};t.default=function(e){return n.useReducer(i,e)}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(781)),s=a(446);t.default=function(e,t,a){void 0===e&&(e=0),void 0===t&&(t=null),void 0===a&&(a=null);var n=s.resolveHookState(e);"number"!=typeof n&&console.error("initialValue has to be a number, got "+typeof e),"number"==typeof a?n=Math.max(n,a):null!==a&&console.error("min has to be a number, got "+typeof a),"number"==typeof t?n=Math.min(n,t):null!==t&&console.error("max has to be a number, got "+typeof t);var o=r.default(n),l=o[0],c=o[1];return[l(),i.useMemo((function(){var e=function(e){var n=l(),i=s.resolveHookState(e,n);n!==i&&("number"==typeof a&&(i=Math.max(i,a)),"number"==typeof t&&(i=Math.min(i,t)),n!==i&&c(i))};return{get:l,set:e,inc:function(t){void 0===t&&(t=1);var a=s.resolveHookState(t,l());"number"!=typeof a&&console.error("delta has to be a number or function returning a number, got "+typeof a),e((function(e){return e+a}))},dec:function(t){void 0===t&&(t=1);var a=s.resolveHookState(t,l());"number"!=typeof a&&console.error("delta has to be a number or function returning a number, got "+typeof a),e((function(e){return e-a}))},reset:function(t){void 0===t&&(t=n);var a=s.resolveHookState(t,l());"number"!=typeof a&&console.error("value has to be a number or function returning a number, got "+typeof a),n=a,e(a)}}}),[n,a,t])]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(308)),s=a(446);t.default=function(e){var t=i.useRef(s.resolveHookState(e)),a=r.default();return i.useMemo((function(){return[function(){return t.current},function(e){t.current=s.resolveHookState(e,t.current),a()}]}),[])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e,t){void 0===t&&(t=!0);var a=n.useState(!1),i=a[0],r=a[1];return n.useEffect((function(){var a=function(){return r(!0)},n=function(){return r(!1)};t&&e&&e.current&&(e.current.addEventListener("mouseover",a),e.current.addEventListener("mouseout",n));var i=e.current;return function(){t&&i&&(i.removeEventListener("mouseover",a),i.removeEventListener("mouseout",n))}}),[t,e]),i}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(447)),s=function(){};t.default=function(e,t,a,n){void 0===t&&(t=s),void 0===a&&(a={}),void 0===n&&(n=[e]);var o=a.event,l=void 0===o?"keydown":o,c=a.target,u=a.options,d=i.useMemo((function(){var a,n="function"==typeof(a=e)?a:"string"==typeof a?function(e){return e.key===a}:a?function(){return!0}:function(){return!1};return function(e){if(n(e))return t(e)}}),n);r.default(l,d,c,u)}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(783));t.default=function(e){var t=i.useState([!1,null]),a=t[0],n=t[1];return r.default(e,(function(e){return n([!0,e])}),{event:"keydown"},[a]),r.default(e,(function(e){return n([!1,e])}),{event:"keyup"},[a]),a}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e){var t=n.useRef(e);return t.current=e,t}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e,t){n.useEffect((function(){return e&&e(),function(){t&&t()}}),[])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(308)),s=a(446);t.default=function(e){void 0===e&&(e=[]);var t=i.useRef(s.resolveHookState(e)),a=r.default(),n=i.useMemo((function(){var i={set:function(e){t.current=s.resolveHookState(e,t.current),a()},push:function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];e.length&&n.set((function(t){return t.concat(e)}))},updateAt:function(e,t){n.set((function(a){var n=a.slice();return n[e]=t,n}))},insertAt:function(e,t){n.set((function(a){var n=a.slice();return e>n.length?n[e]=t:n.splice(e,0,t),n}))},update:function(e,t){n.set((function(a){return a.map((function(a){return e(a,t)?t:a}))}))},updateFirst:function(e,a){var i=t.current.findIndex((function(t){return e(t,a)}));i>=0&&n.updateAt(i,a)},upsert:function(e,a){var i=t.current.findIndex((function(t){return e(t,a)}));i>=0?n.updateAt(i,a):n.push(a)},sort:function(e){n.set((function(t){return t.slice().sort(e)}))},filter:function(e,t){n.set((function(a){return a.slice().filter(e,t)}))},removeAt:function(e){n.set((function(t){var a=t.slice();return a.splice(e,1),a}))},clear:function(){n.set([])},reset:function(){n.set(s.resolveHookState(e).slice())}};return i.remove=i.removeAt,i}),[]);return[t.current,n]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2);t.default=function(e){void 0===e&&(e={});var t=i.useState(e),a=t[0],r=t[1],s=i.useMemo((function(){return{set:function(e,t){r((function(a){var i;return n.__assign(n.__assign({},a),((i={})[e]=t,i))}))},setAll:function(e){r(e)},remove:function(e){r((function(t){var a=t,i=e;return a[i],n.__rest(a,["symbol"==typeof i?i:i+""])}))},reset:function(){return r(e)}}}),[r]),o=n.__assign({get:i.useCallback((function(e){return a[e]}),[a])},s);return[a,o]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34).__importDefault(a(361));t.default=function(e){n.default((function(){e()}))}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(362));t.default=function(e){var t=r.default({docX:0,docY:0,posX:0,posY:0,elX:0,elY:0,elH:0,elW:0}),a=t[0],n=t[1];return i.useEffect((function(){var t=function(t){if(e&&e.current){var a=e.current.getBoundingClientRect(),i=a.left,r=a.top,s=a.width,o=a.height,l=i+window.pageXOffset,c=r+window.pageYOffset,u=t.pageX-l,d=t.pageY-c;n({docX:t.pageX,docY:t.pageY,posX:l,posY:c,elX:u,elY:d,elH:o,elW:s})}};return document.addEventListener("mousemove",t),function(){document.removeEventListener("mousemove",t)}}),[e]),a}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(35));t.default=function(e,t){void 0===e&&(e=1e12),void 0===t&&(t=0);var a=i.useState(0),n=a[0],s=a[1];return r.default((function(){var a,n,i,r=function(){var t=Math.min(1,(Date.now()-i)/e);s(t),o()},o=function(){a=requestAnimationFrame(r)},l=setTimeout((function(){n=setTimeout((function(){cancelAnimationFrame(a),s(1)}),e),i=Date.now(),o()}),t);return function(){clearTimeout(n),clearTimeout(l),cancelAnimationFrame(a)}}),[e,t]),n}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=parseInt(i.version.substr(0,i.version.indexOf(".")))>15,s=function(e){return"function"==typeof e};t.default=function(e,t){for(var a=[],o=2;o<arguments.length;o++)a[o-2]=arguments[o];var l=e.render,c=e.children,u=void 0===c?l:c,d=e.component,p=e.comp,m=void 0===p?d:p;return s(u)?u.apply(void 0,n.__spreadArrays([t],a)):m?i.createElement(m,t):u instanceof Array?r?u:i.createElement.apply(void 0,n.__spreadArrays(["div",null],u)):u&&u instanceof Object?"string"==typeof u.type?u:i.cloneElement(u,Object.assign({},u.props,t)):u||null}},,,function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=a(5).i18n.translate("securitySolutionPackages.ecsDataQualityDashboard.incompatibleTab.dataQualityDashboardConversationId",{defaultMessage:"Data Quality dashboard"})},function(e,t,a){!function(e){"use strict";var t,a=[],n="ResizeObserver loop completed with undelivered notifications.";!function(e){e.BORDER_BOX="border-box",e.CONTENT_BOX="content-box",e.DEVICE_PIXEL_CONTENT_BOX="device-pixel-content-box"}(t||(t={}));var i,r=function(e){return Object.freeze(e)},s=function(e,t){this.inlineSize=e,this.blockSize=t,r(this)},o=function(){function e(e,t,a,n){return this.x=e,this.y=t,this.width=a,this.height=n,this.top=this.y,this.left=this.x,this.bottom=this.top+this.height,this.right=this.left+this.width,r(this)}return e.prototype.toJSON=function(){var e=this;return{x:e.x,y:e.y,top:e.top,right:e.right,bottom:e.bottom,left:e.left,width:e.width,height:e.height}},e.fromRect=function(t){return new e(t.x,t.y,t.width,t.height)},e}(),l=function(e){return e instanceof SVGElement&&"getBBox"in e},c=function(e){if(l(e)){var t=e.getBBox(),a=t.width,n=t.height;return!a&&!n}var i=e,r=i.offsetWidth,s=i.offsetHeight;return!(r||s||e.getClientRects().length)},u=function(e){var t;if(e instanceof Element)return!0;var a=null===(t=null==e?void 0:e.ownerDocument)||void 0===t?void 0:t.defaultView;return!!(a&&e instanceof a.Element)},d="undefined"!=typeof window?window:{},p=new WeakMap,m=/auto|scroll/,b=/^tb|vertical/,g=/msie|trident/i.test(d.navigator&&d.navigator.userAgent),f=function(e){return parseFloat(e||"0")},y=function(e,t,a){return void 0===e&&(e=0),void 0===t&&(t=0),void 0===a&&(a=!1),new s((a?t:e)||0,(a?e:t)||0)},h=r({devicePixelContentBoxSize:y(),borderBoxSize:y(),contentBoxSize:y(),contentRect:new o(0,0,0,0)}),v=function(e,t){if(void 0===t&&(t=!1),p.has(e)&&!t)return p.get(e);if(c(e))return p.set(e,h),h;var a=getComputedStyle(e),n=l(e)&&e.ownerSVGElement&&e.getBBox(),i=!g&&"border-box"===a.boxSizing,s=b.test(a.writingMode||""),u=!n&&m.test(a.overflowY||""),d=!n&&m.test(a.overflowX||""),v=n?0:f(a.paddingTop),E=n?0:f(a.paddingRight),x=n?0:f(a.paddingBottom),j=n?0:f(a.paddingLeft),S=n?0:f(a.borderTopWidth),k=n?0:f(a.borderRightWidth),O=n?0:f(a.borderBottomWidth),w=j+E,T=v+x,I=(n?0:f(a.borderLeftWidth))+k,C=S+O,M=d?e.offsetHeight-C-e.clientHeight:0,_=u?e.offsetWidth-I-e.clientWidth:0,F=i?w+I:0,A=i?T+C:0,D=n?n.width:f(a.width)-F-_,N=n?n.height:f(a.height)-A-M,P=D+w+_+I,R=N+T+M+C,L=r({devicePixelContentBoxSize:y(Math.round(D*devicePixelRatio),Math.round(N*devicePixelRatio),s),borderBoxSize:y(P,R,s),contentBoxSize:y(D,N,s),contentRect:new o(j,v,D,N)});return p.set(e,L),L},E=function(e,a,n){var i=v(e,n),r=i.borderBoxSize,s=i.contentBoxSize,o=i.devicePixelContentBoxSize;switch(a){case t.DEVICE_PIXEL_CONTENT_BOX:return o;case t.BORDER_BOX:return r;default:return s}},x=function(e){var t=v(e);this.target=e,this.contentRect=t.contentRect,this.borderBoxSize=r([t.borderBoxSize]),this.contentBoxSize=r([t.contentBoxSize]),this.devicePixelContentBoxSize=r([t.devicePixelContentBoxSize])},j=function(e){if(c(e))return 1/0;for(var t=0,a=e.parentNode;a;)t+=1,a=a.parentNode;return t},S=function(){var e=1/0,t=[];a.forEach((function(a){if(0!==a.activeTargets.length){var n=[];a.activeTargets.forEach((function(t){var a=new x(t.target),i=j(t.target);n.push(a),t.lastReportedSize=E(t.target,t.observedBox),i<e&&(e=i)})),t.push((function(){a.callback.call(a.observer,n,a.observer)})),a.activeTargets.splice(0,a.activeTargets.length)}}));for(var n=0,i=t;n<i.length;n++)(0,i[n])();return e},k=function(e){a.forEach((function(t){t.activeTargets.splice(0,t.activeTargets.length),t.skippedTargets.splice(0,t.skippedTargets.length),t.observationTargets.forEach((function(a){a.isActive()&&(j(a.target)>e?t.activeTargets.push(a):t.skippedTargets.push(a))}))}))},O=function(){var e,t=0;for(k(t);a.some((function(e){return e.activeTargets.length>0}));)t=S(),k(t);return a.some((function(e){return e.skippedTargets.length>0}))&&("function"==typeof ErrorEvent?e=new ErrorEvent("error",{message:n}):((e=document.createEvent("Event")).initEvent("error",!1,!1),e.message=n),window.dispatchEvent(e)),t>0},w=[],T=function(e){if(!i){var t=0,a=document.createTextNode("");new MutationObserver((function(){return w.splice(0).forEach((function(e){return e()}))})).observe(a,{characterData:!0}),i=function(){a.textContent="".concat(t?t--:t++)}}w.push(e),i()},I=0,C={attributes:!0,characterData:!0,childList:!0,subtree:!0},M=["resize","load","transitionend","animationend","animationstart","animationiteration","keyup","keydown","mouseup","mousedown","mouseover","mouseout","blur","focus"],_=function(e){return void 0===e&&(e=0),Date.now()+e},F=!1,A=new(function(){function e(){var e=this;this.stopped=!0,this.listener=function(){return e.schedule()}}return e.prototype.run=function(e){var t,a=this;if(void 0===e&&(e=250),!F){F=!0;var n=_(e);t=function(){var t=!1;try{t=O()}finally{if(F=!1,e=n-_(),!I)return;t?a.run(1e3):e>0?a.run(e):a.start()}},T((function(){requestAnimationFrame(t)}))}},e.prototype.schedule=function(){this.stop(),this.run()},e.prototype.observe=function(){var e=this,t=function(){return e.observer&&e.observer.observe(document.body,C)};document.body?t():d.addEventListener("DOMContentLoaded",t)},e.prototype.start=function(){var e=this;this.stopped&&(this.stopped=!1,this.observer=new MutationObserver(this.listener),this.observe(),M.forEach((function(t){return d.addEventListener(t,e.listener,!0)})))},e.prototype.stop=function(){var e=this;this.stopped||(this.observer&&this.observer.disconnect(),M.forEach((function(t){return d.removeEventListener(t,e.listener,!0)})),this.stopped=!0)},e}()),D=function(e){!I&&e>0&&A.start(),!(I+=e)&&A.stop()},N=function(){function e(e,a){this.target=e,this.observedBox=a||t.CONTENT_BOX,this.lastReportedSize={inlineSize:0,blockSize:0}}return e.prototype.isActive=function(){var e,t=E(this.target,this.observedBox,!0);return e=this.target,!l(e)&&!function(e){switch(e.tagName){case"INPUT":if("image"!==e.type)break;case"VIDEO":case"AUDIO":case"EMBED":case"OBJECT":case"CANVAS":case"IFRAME":case"IMG":return!0}return!1}(e)&&"inline"===getComputedStyle(e).display&&(this.lastReportedSize=t),this.lastReportedSize.inlineSize!==t.inlineSize||this.lastReportedSize.blockSize!==t.blockSize},e}(),P=function(e,t){this.activeTargets=[],this.skippedTargets=[],this.observationTargets=[],this.observer=e,this.callback=t},R=new WeakMap,L=function(e,t){for(var a=0;a<e.length;a+=1)if(e[a].target===t)return a;return-1},B=function(){function e(){}return e.connect=function(e,t){var a=new P(e,t);R.set(e,a)},e.observe=function(e,t,n){var i=R.get(e),r=0===i.observationTargets.length;L(i.observationTargets,t)<0&&(r&&a.push(i),i.observationTargets.push(new N(t,n&&n.box)),D(1),A.schedule())},e.unobserve=function(e,t){var n=R.get(e),i=L(n.observationTargets,t),r=1===n.observationTargets.length;i>=0&&(r&&a.splice(a.indexOf(n),1),n.observationTargets.splice(i,1),D(-1))},e.disconnect=function(e){var t=this,a=R.get(e);a.observationTargets.slice().forEach((function(a){return t.unobserve(e,a.target)})),a.activeTargets.splice(0,a.activeTargets.length)},e}(),q=function(){function e(e){if(0===arguments.length)throw new TypeError("Failed to construct 'ResizeObserver': 1 argument required, but only 0 present.");if("function"!=typeof e)throw new TypeError("Failed to construct 'ResizeObserver': The callback provided as parameter 1 is not a function.");B.connect(this,e)}return e.prototype.observe=function(e,t){if(0===arguments.length)throw new TypeError("Failed to execute 'observe' on 'ResizeObserver': 1 argument required, but only 0 present.");if(!u(e))throw new TypeError("Failed to execute 'observe' on 'ResizeObserver': parameter 1 is not of type 'Element");B.observe(this,e,t)},e.prototype.unobserve=function(e){if(0===arguments.length)throw new TypeError("Failed to execute 'unobserve' on 'ResizeObserver': 1 argument required, but only 0 present.");if(!u(e))throw new TypeError("Failed to execute 'unobserve' on 'ResizeObserver': parameter 1 is not of type 'Element");B.unobserve(this,e)},e.prototype.disconnect=function(){B.disconnect(this)},e.toString=function(){return"function ResizeObserver () { [polyfill code] }"},e}();e.ResizeObserver=q,e.ResizeObserverEntry=x,e.ResizeObserverSize=s,Object.defineProperty(e,"__esModule",{value:!0})}(t)},function(e,t,a){"use strict";a.d(t,"a",(function(){return M}));var n=a(40),i=a(48),r=a(42),s=a(2),o=a.n(s),l=a(41),c=a.n(l),u=a(134),d=a(113),p=a(4),m=a(102),b=a(117),g=a(224),f=a(393),y=a(149),h=a(274),v=a(123),E=a(231),x=a(162),j=a(473),S=a(168),k=a(925),O=a(330),w=a(284),T=a(212),I=a(492);const C=c()(n.EuiFlexGroup).withConfig({displayName:"UserRiskOverviewWrapper",componentId:"sc-1f042fn-0"})(["padding-top:",";width:",";"],(({theme:e})=>e.eui.euiSizeM),(({$width:e})=>e)),M=o.a.memo((({anomaliesData:e,contextID:t,sourcererScopeId:a,data:l,id:c,isDraggable:M=!1,isInDetailsSidePanel:_=!1,isLoadingAnomaliesData:F,loading:A,narrowDateRange:D,startDate:N,endDate:P,userName:R,indexPatterns:L,jobNameById:B})=>{const q=Object(x.a)(),z=Object(E.a)(q),[$]=Object(m.p)(p.B),V=Object(s.useMemo)((()=>R?Object(d.E)([R]):void 0),[R]),{from:U,to:H}=Object(u.a)(),G=Object(s.useMemo)((()=>({from:U,to:H})),[U,H]),{data:Q,isAuthorized:W}=Object(w.c)({filterQuery:V,skip:null==R,timerange:G,riskEntity:d.w.user}),K=Object(s.useCallback)(((e,n)=>o.a.createElement(g.a,{rowItems:Object(r.getOr)([],e,n),attrName:e,idPrefix:t?`user-overview-${t}`:"user-overview",isDraggable:M,sourcererScopeId:a})),[t,M,a]),[Y,J]=Object(s.useMemo)((()=>{const e=Q&&Q.length>0?Q[0]:void 0;return[{title:o.a.createElement(I.a,{title:k.k,riskScoreEntity:d.w.user}),description:o.a.createElement(o.a.Fragment,null,e?Math.round(e.user.risk.calculated_score_norm):Object(b.d)())},{title:o.a.createElement(I.a,{title:k.j,riskScoreEntity:d.w.host}),description:o.a.createElement(o.a.Fragment,null,e?o.a.createElement(T.b,{severity:e.user.risk.calculated_level,hideBackgroundColor:!0}):Object(b.d)())}]}),[Q]),X=Object(s.useMemo)((()=>[{title:k.i,description:l&&l.user?K("user.id",l):Object(b.d)()},{title:k.h,description:l&&l.user?K("user.domain",l):Object(b.d)()}]),[l,K]),Z=Object(s.useMemo)((()=>z?[...X,{title:k.g,description:o.a.createElement(j.a,{anomalies:e,startDate:N,endDate:P,isLoading:F,narrowDateRange:D,jobNameById:B})}]:X),[e,X,P,F,D,N,z,B]),ee=Object(s.useMemo)((()=>[Z,[{title:k.a,description:o.a.createElement(f.a,{indexPatterns:L,field:"user.name",value:R,type:f.b.FIRST_SEEN})},{title:k.f,description:o.a.createElement(f.a,{indexPatterns:L,field:"user.name",value:R,type:f.b.LAST_SEEN})}],[{title:k.d,description:K("host.os.name",l)},{title:k.b,description:K("host.os.family",l)},{title:k.c,description:o.a.createElement(g.a,{rowItems:Object(r.getOr)([],"host.ip",l),attrName:"host.ip",idPrefix:t?`user-overview-${t}`:"user-overview",sourcererScopeId:a,isDraggable:M,render:e=>null!=e?o.a.createElement(v.h,{ip:e}):Object(b.d)()})}]]),[l,L,K,t,a,M,R,Z]);return o.a.createElement(o.a.Fragment,null,o.a.createElement(y.c,null,o.a.createElement(S.g,{direction:_?"column":"row","data-test-subj":"user-overview"},!_&&o.a.createElement(y.b,{queryId:c,title:k.e,inspectIndex:0}),ee.map(((e,t)=>o.a.createElement(O.a,{descriptionList:e,key:t}))),A&&o.a.createElement(h.a,{overlay:!0,overlayBackground:$?i.euiDarkVars.euiPageBackgroundColor:i.euiLightVars.euiPageBackgroundColor,size:"xl"}))),W&&o.a.createElement(C,{gutterSize:_?"m":"none",direction:_?"column":"row","data-test-subj":"user-risk-overview",$width:_?"100%":"66.6%"},o.a.createElement(n.EuiFlexItem,null,o.a.createElement(S.d,{listItems:[Y]})),o.a.createElement(n.EuiFlexItem,null,o.a.createElement(S.d,{listItems:[J]}))))}));M.displayName="UserOverview"},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(2),i=a.n(n),r=a(40);const s=e=>String(Math.ceil(e));i.a.memo((({score:e})=>{const t=s(e),a=o(e);return i.a.createElement(r.EuiHealth,{color:a},t)})).displayName="ScoreHealth";const o=e=>e>=75?"#fe5050":e>=50?"#fba740":e>=25?"#fdec25":e>=3?"#8bc8fb":e>=0?"#d2e9f7":"#ffffff"},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=e=>{const t=Object.entries(e);if(Array.isArray(t[0])){const[[e,a]]=t;return[e,a]}return[null,null]}},function(e,t,a){"use strict";a.d(t,"d",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"f",(function(){return s})),a.d(t,"a",(function(){return o})),a.d(t,"e",(function(){return l})),a.d(t,"c",(function(){return c}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.entityAnalytics.totalLabel",{defaultMessage:"Total"}),r=n.i18n.translate("xpack.securitySolution.entityAnalytics.hostsRiskDashboard.title",{defaultMessage:"Host Risk Scores"}),s=n.i18n.translate("xpack.securitySolution.entityAnalytics.usersRiskDashboard.title",{defaultMessage:"User Risk Scores"}),o=n.i18n.translate("xpack.securitySolution.entityAnalytics.hostsRiskDashboard.hostsTableTooltip",{defaultMessage:"The host risk table is not affected by the time range. This table shows the latest recorded risk score for each host."}),l=n.i18n.translate("xpack.securitySolution.entityAnalytics.usersRiskDashboard.usersTableTooltip",{defaultMessage:"The user risk table is not affected by the time range. This table shows the latest recorded risk score for each user."}),c=n.i18n.translate("xpack.securitySolution.entityAnalytics.riskDashboard.tableTooltipTitle",{defaultMessage:"In Technical Preview"})},function(e,t,a){"use strict";(function(e,t){a(1264);var n=a(1265),i=a.n(n);a(82),a(8),a(1266),i.a.resolve(i.a.join(e,"..")),"\n/*\n * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one\n * or more contributor license agreements. Licensed under the Elastic License\n * 2.0 and the Server Side Public License, v 1; you may not use this file except\n * in compliance with, at your election, the Elastic License 2.0 or the Server\n * Side Public License, v 1.\n */\n// ---------------------------------- WARNING ----------------------------------\n// this file was generated, and should not be edited by hand\n// ---------------------------------- WARNING ----------------------------------\nimport * as rt from 'io-ts';\nimport { Either } from 'fp-ts/lib/Either';\n%%IMPORTS%%\nconst ISO_DATE_PATTERN = /^d{4}-d{2}-d{2}Td{2}:d{2}:d{2}.d{3}Z$/;\nexport const IsoDateString = new rt.Type<string, string, unknown>(\n  'IsoDateString',\n  rt.string.is,\n  (input, context): Either<rt.Errors, string> => {\n    if (typeof input === 'string' && ISO_DATE_PATTERN.test(input)) {\n      return rt.success(input);\n    } else {\n      return rt.failure(input, context);\n    }\n  },\n  rt.identity\n);\nexport type IsoDateStringC = typeof IsoDateString;\nexport const schemaDate = IsoDateString;\nexport const schemaDateArray = rt.array(IsoDateString);\nexport const schemaDateRange = rt.partial({\n  gte: schemaDate,\n  lte: schemaDate,\n});\nexport const schemaDateRangeArray = rt.array(schemaDateRange);\nexport const schemaUnknown = rt.unknown;\nexport const schemaUnknownArray = rt.array(rt.unknown);\nexport const schemaString = rt.string;\nexport const schemaStringArray = rt.array(schemaString);\nexport const schemaNumber = rt.number;\nexport const schemaNumberArray = rt.array(schemaNumber);\nexport const schemaStringOrNumber = rt.union([schemaString, schemaNumber]);\nexport const schemaStringOrNumberArray = rt.array(schemaStringOrNumber);\nexport const schemaBoolean = rt.boolean;\nexport const schemaBooleanArray = rt.array(schemaBoolean);\nconst schemaGeoPointCoords = rt.type({\n  type: schemaString,\n  coordinates: schemaNumberArray,\n});\nconst schemaGeoPointString = schemaString;\nconst schemaGeoPointLatLon = rt.type({\n  lat: schemaNumber,\n  lon: schemaNumber,\n});\nconst schemaGeoPointLocation = rt.type({\n  location: schemaNumberArray,\n});\nconst schemaGeoPointLocationString = rt.type({\n  location: schemaString,\n});\nexport const schemaGeoPoint = rt.union([\n  schemaGeoPointCoords,\n  schemaGeoPointString,\n  schemaGeoPointLatLon,\n  schemaGeoPointLocation,\n  schemaGeoPointLocationString,\n]);\nexport const schemaGeoPointArray = rt.array(schemaGeoPoint);\n// prettier-ignore\nconst %%schemaPrefix%%Required = %%REQUIRED_FIELDS%%;\nconst %%schemaPrefix%%Optional = %%OPTIONAL_FIELDS%%;\n\n// prettier-ignore\nexport const %%schemaPrefix%%Schema = rt.intersection([%%schemaPrefix%%Required, %%schemaPrefix%%Optional%%INCLUDED_SCHEMAS%%]);\n// prettier-ignore\nexport type %%schemaPrefix%% = rt.TypeOf<typeof %%schemaPrefix%%Schema>;\n\n".trim()}).call(this,"/",a(404))},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=e=>e?e[0]:void 0},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a.n(n),r=a(40),s=a(170),o=a(422);const l=({width:e=o.b,dataTestSubj:t,content:a,ariaLabel:n,iconType:l="",isDisabled:c=!1,onClick:u,children:d,buttonType:p="icon"})=>i.a.createElement(i.a.Fragment,null,"icon"===p&&i.a.createElement("div",null,i.a.createElement(s.l,{textAlign:"center",width:e},null!=d?d:i.a.createElement(r.EuiToolTip,{"data-test-subj":`${t}-tool-tip`,content:a},i.a.createElement(r.EuiButtonIcon,{"aria-label":n,"data-test-subj":`${t}-button`,iconType:l,isDisabled:c,onClick:u,size:"s"})))),"text"===p&&i.a.createElement(r.EuiContextMenuItem,{"aria-label":n,"data-test-subj":`${t}-button-menu-item`,disabled:c,onClick:u,color:"text",size:"s"},i.a.createElement(r.EuiText,{"data-test-subj":`${t}-button`,size:"m"},a)),"emptyButton"===p&&i.a.createElement(r.EuiButtonEmpty,{onClick:u,iconType:"timeline",flush:"right",size:"xs","data-test-subj":t},a));l.displayName="ActionIconItemComponent";const c=i.a.memo(l)},function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(40),i=a(42),r=a(2),s=a.n(r),o=a(106),l=a(389);const c=e=>e?"pinFilled":"pin",u=s.a.memo((({ariaLabel:e,allowUnpinning:t,isAlert:a,isDisabled:r,onClick:u=i.noop,pinned:d,timelineType:p})=>{const m=p===o.l.template,b=(({isAlert:e,isTemplate:t,isPinned:a})=>t?l.b(e):a?l.c(e):l.g(e))({isAlert:a,isTemplate:m,isPinned:d}),g=null!=e?e:b;return s.a.createElement(n.EuiButtonIcon,{"aria-label":g,"data-test-subj":"pin",iconType:c(d),onClick:u,isDisabled:r||m||!t,size:"s"})}));u.displayName="Pin"},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(677);const i=({handleClick:e})=>({key:"osquery-action-item","data-test-subj":"osquery-action-item",onClick:e,size:"s",name:n.a})},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a(108),r=a(102),s=a(183),o=a(513),l=a(881);const c=e=>{const{data:t,spaces:a}=Object(r.j)().services,{addWarning:c}=Object(i.a)(),[u,d]=Object(n.useState)(!1),[p,m]=Object(n.useState)(""),b=Object(n.useMemo)((()=>null!=e&&1===e.length),[e]),g=Object(n.useMemo)((()=>null!=e&&b&&"machine_learning"===e[0].type),[b,e]);Object(n.useEffect)((()=>{(async()=>{if(a){const e=await a.getActiveSpace();m(e.id)}})()}),[a]);const f=Object(n.useMemo)((()=>null!=e&&b?e[0].data_view_id||null:`security-solution-${p}`),[b,e,p]),y=Object(n.useMemo)((()=>!f&&null!=e&&b&&null!=e[0].index?e[0].index:[]),[f,b,e]),h=Object(n.useMemo)((()=>{var t;return g&&b&&null!=e&&null!==(t=e[0].machine_learning_job_id)&&void 0!==t?t:[]}),[g,b,e]),{mlJobLoading:v,ruleIndices:E}=Object(l.a)(h),x=Object(n.useMemo)((()=>g&&E.length>0?E:null!=f?[]:y),[g,f,y,E]),[j,{indexPatterns:S,dataView:k}]=Object(s.b)(x,!1,"indexFields"),[O,w]=Object(n.useState)(null),[T,I]=Object(n.useState)(null);Object(n.useEffect)((()=>{(async()=>{if(""!==p&&f){d(!0);const e=await t.dataViews.get(f);d(!1),w(e),I(e.toSpec())}})()}),[f,t.dataViews,w,p]);const C=Object(n.useCallback)((async e=>{let a=[];const n=null!=T?T:k;if(!n)return a;try{a=await t.dataViews.getFieldsForIndexPattern(n,{pattern:"",includeUnmapped:!0,fields:e})}catch(e){c(e,{title:o.b})}return a}),[c,t.dataViews,T,k]);return{isLoading:j||v||u,indexPatterns:Object(n.useMemo)((()=>f&&null!=O?O:S),[f,O,S]),getExtendedFields:C}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(143),r=a(102),s=a(458);const o=()=>{const e=Object(r.n)(),[t,a]=Object(n.useState)(!0),[o,l]=Object(n.useState)(!1),[c,u]=Object(n.useState)(null),d=Object(n.useRef)(null);return Object(n.useEffect)((()=>{let t=!0;const n=new AbortController;return d.current=async r=>{try{a(!0);const{references:e}=await Object(i.l)({lists:r,signal:n.signal}),s=e.reduce(((e,t)=>{const[[a,n]]=Object.entries(t);return e[a]=n,e}),{});t&&(a(!1),l(!1),u(s))}catch(n){t&&(l(!0),a(!1),e.addError(n,{title:s.c}))}},()=>{t=!1,n.abort()}}),[e]),[t,o,c,d.current]}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(214),r=a(281),s=a(102);const o=()=>{const{services:{http:e}}=Object(s.j)(),[t,a]=Object(n.useState)(!1),o=Object(n.useRef)(null),{addExceptionListItem:l,updateExceptionListItem:c}=Object(i.c)(e);return Object(n.useEffect)((()=>{const e=new AbortController;return o.current=async e=>{a(!0);const t=await Promise.all(e.map((e=>{if("id"in e&&null!=e.id){const t=Object(r.i)(e);return c({listItem:t})}return l({listItem:e})})));return a(!1),t},()=>{a(!1),e.abort()}}),[c,e,l]),[t,o.current]}},function(e,t,a){"use strict";a.d(t,"c",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return s}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.osquery.action.shortEmptyTitle",{defaultMessage:"Osquery is not available"}),r=n.i18n.translate("xpack.securitySolution.osquery.action.permissionDenied",{defaultMessage:"Permission denied"}),s=n.i18n.translate("xpack.securitySolution.osquery.action.unavailable",{defaultMessage:"The Osquery Manager integration is not added to the agent policy. To run queries on the host, add the Osquery Manager integration to the agent policy in Fleet."})},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"g",(function(){return s})),a.d(t,"h",(function(){return o})),a.d(t,"d",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"e",(function(){return u})),a.d(t,"f",(function(){return d}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.alerts.severityMapping.severityTitle",{defaultMessage:"Default severity"}),r=n.i18n.translate("xpack.securitySolution.alerts.severityMapping.defaultSeverityTitle",{defaultMessage:"Severity"}),s=n.i18n.translate("xpack.securitySolution.alerts.severityMapping.sourceFieldTitle",{defaultMessage:"Source field"}),o=n.i18n.translate("xpack.securitySolution.alerts.severityMapping.sourceValueTitle",{defaultMessage:"Source value"}),l=n.i18n.translate("xpack.securitySolution.alerts.severityMapping.severityMappingTitle",{defaultMessage:"Severity override"}),c=n.i18n.translate("xpack.securitySolution.alerts.severityMapping.defaultDescriptionLabel",{defaultMessage:"Select a severity level for all alerts generated by this rule."}),u=n.i18n.translate("xpack.securitySolution.alerts.severityMapping.mappingDescriptionLabel",{defaultMessage:"Use source event values to override the default severity."}),d=n.i18n.translate("xpack.securitySolution.alerts.severityMapping.mappingDetailsLabel",{defaultMessage:"For multiple matches the highest severity match will apply. If no match is found, the default severity will be used."})},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"d",(function(){return s})),a.d(t,"h",(function(){return o})),a.d(t,"e",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"f",(function(){return u})),a.d(t,"g",(function(){return d}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.alerts.riskScoreMapping.riskScoreTitle",{defaultMessage:"Risk score"}),r=n.i18n.translate("xpack.securitySolution.alerts.riskScoreMapping.defaultRiskScoreTitle",{defaultMessage:"Default risk score"}),s=n.i18n.translate("xpack.securitySolution.alerts.riskScoreMapping.riskScoreFieldTitle",{defaultMessage:"kibana.alert.risk_score"}),o=n.i18n.translate("xpack.securitySolution.alerts.riskScoreMapping.sourceFieldTitle",{defaultMessage:"Source field"}),l=n.i18n.translate("xpack.securitySolution.alerts.riskScoreMapping.riskScoreMappingTitle",{defaultMessage:"Risk score override"}),c=n.i18n.translate("xpack.securitySolution.alerts.riskScoreMapping.defaultDescriptionLabel",{defaultMessage:"Select a risk score for all alerts generated by this rule."}),u=n.i18n.translate("xpack.securitySolution.alerts.riskScoreMapping.mappingDescriptionLabel",{defaultMessage:"Use a source event value to override the default risk score."}),d=n.i18n.translate("xpack.securitySolution.alerts.riskScoreMapping.mappingDetailsLabel",{defaultMessage:"If value is out of bounds, or field is not present, the default risk score will be used."})},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a.n(n),r=a(40),s=a(331),o=a(337),l=a(188);const c=i.a.memo((({contextId:e,data:t,eventId:a,fieldFromBrowserField:n,getLinkValue:c,isDraggable:u=!1,linkValue:d,style:p,values:m})=>i.a.createElement(r.EuiFlexGroup,{alignItems:"flexStart","data-test-subj":`event-field-${t.field}`,direction:"column",gutterSize:"none",style:p},null!=m&&m.map(((p,m)=>{var b;return null==n?i.a.createElement(r.EuiFlexItem,{grow:!1,key:`${m}-${p}`},i.a.createElement(r.EuiText,{size:"xs",key:`${m}-${p}`},p)):i.a.createElement(r.EuiFlexItem,{className:"eventFieldsTable__fieldValue",grow:!1,key:`${m}-${p}`},t.field===l.i?i.a.createElement(s.a,{value:p}):i.a.createElement(o.a,{contextId:`${e}-${a}-${t.field}-${m}-${p}`,eventId:a,fieldFormat:t.format,fieldName:t.field,fieldType:t.type,isAggregatable:n.aggregatable,isDraggable:u,isObjectArray:t.isObjectArray,value:p,linkValue:null!==(b=c&&c(t.field))&&void 0!==b?b:d,truncate:!1}))})))));c.displayName="FieldValueCell"},function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(40),i=a(2),r=a.n(i),s=a(113),o=a(4),l=a(814);const c=({riskScoreEntity:e,title:t})=>{const a=e===s.w.user?o.Zb:o.Xb;return r.a.createElement(n.EuiLink,{target:"_blank",rel:"noopener nofollow noreferrer",href:a},t||l.f)},u=r.a.memo(c);u.displayName="RiskScoreDocLink"},function(e,t,a){"use strict";a.d(t,"d",(function(){return r})),a.d(t,"b",(function(){return s})),a.d(t,"i",(function(){return o})),a.d(t,"f",(function(){return l})),a.d(t,"e",(function(){return c})),a.d(t,"h",(function(){return u}));var n=a(5),i=a(225);a.d(t,"a",(function(){return i.a})),a.d(t,"c",(function(){return i.b})),a.d(t,"g",(function(){return i.c})),a.d(t,"j",(function(){return i.d}));const r=e=>n.i18n.translate("xpack.securitySolution.entityAnalytics.riskDashboard.riskToolTip",{defaultMessage:"{riskEntity} risk classification is determined by {riskEntityLowercase} risk score. {riskEntity}s classified as Critical or High are indicated as risky.",values:{riskEntity:Object(i.d)(e),riskEntityLowercase:Object(i.d)(e,!0)}}),s=e=>n.i18n.translate("xpack.securitySolution.entityAnalytics.riskDashboard.nameTitle",{defaultMessage:"{riskEntity} Name",values:{riskEntity:Object(i.d)(e)}}),o=n.i18n.translate("xpack.securitySolution.entityAnalytics.riskDashboard.viewAllLabel",{defaultMessage:"View all"}),l=n.i18n.translate("xpack.securitySolution.entityAnalytics.riskDashboard.learnMore",{defaultMessage:"Learn more"}),c=n.i18n.translate("xpack.securitySolution.entityAnalytics.riskDashboard.hostsTableTooltip",{defaultMessage:"The Host Risk Score panel displays the list of risky hosts and their latest risk score. You may filter this list using global filters in the KQL search bar. The time-range picker filter will display Alerts within the selected time range only and does not filter the list of risky hosts."}),u=n.i18n.translate("xpack.securitySolution.entityAnalytics.riskDashboard.usersTableTooltip",{defaultMessage:"The User Risk Score panel displays the list of risky users and their latest risk score. You may filter this list using global filters in the KQL search bar. The time-range picker filter will display Alerts within the selected time range only and does not filter the list of risky users."})},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=a(5).i18n.translate("xpack.securitySolution.source.destination.packetsLabel",{defaultMessage:"pkts"})},function(e,t,a){!function(e){"use strict";function t(e,t){return e<t?-1:e>t?1:e>=t?0:NaN}function a(e){let a=e,n=e;function i(e,t,a,i){for(null==a&&(a=0),null==i&&(i=e.length);a<i;){const r=a+i>>>1;n(e[r],t)<0?a=r+1:i=r}return a}return 1===e.length&&(a=(t,a)=>e(t)-a,n=function(e){return(a,n)=>t(e(a),n)}(e)),{left:i,center:function(e,t,n,r){null==n&&(n=0),null==r&&(r=e.length);const s=i(e,t,n,r-1);return s>n&&a(e[s-1],t)>-a(e[s],t)?s-1:s},right:function(e,t,a,i){for(null==a&&(a=0),null==i&&(i=e.length);a<i;){const r=a+i>>>1;n(e[r],t)>0?i=r:a=r+1}return a}}}function n(e){return null===e?NaN:+e}const i=a(t),r=i.right,s=i.left,o=a(n).center;function l(e,t){let a=0;if(void 0===t)for(let t of e)null!=t&&(t=+t)>=t&&++a;else{let n=-1;for(let i of e)null!=(i=t(i,++n,e))&&(i=+i)>=i&&++a}return a}function c(e){return 0|e.length}function u(e){return!(e>0)}function d(e){return"object"!=typeof e||"length"in e?e:Array.from(e)}function p(e,t){let a,n=0,i=0,r=0;if(void 0===t)for(let t of e)null!=t&&(t=+t)>=t&&(a=t-i,i+=a/++n,r+=a*(t-i));else{let s=-1;for(let o of e)null!=(o=t(o,++s,e))&&(o=+o)>=o&&(a=o-i,i+=a/++n,r+=a*(o-i))}if(n>1)return r/(n-1)}function m(e,t){const a=p(e,t);return a?Math.sqrt(a):a}function b(e,t){let a,n;if(void 0===t)for(const t of e)null!=t&&(void 0===a?t>=t&&(a=n=t):(a>t&&(a=t),n<t&&(n=t)));else{let i=-1;for(let r of e)null!=(r=t(r,++i,e))&&(void 0===a?r>=r&&(a=n=r):(a>r&&(a=r),n<r&&(n=r)))}return[a,n]}class Adder{constructor(){this._partials=new Float64Array(32),this._n=0}add(e){const t=this._partials;let a=0;for(let n=0;n<this._n&&n<32;n++){const i=t[n],r=e+i,s=Math.abs(e)<Math.abs(i)?e-(r-i):i-(r-e);s&&(t[a++]=s),e=r}return t[a]=e,this._n=a+1,this}valueOf(){const e=this._partials;let t,a,n,i=this._n,r=0;if(i>0){for(r=e[--i];i>0&&(t=r,a=e[--i],r=t+a,n=a-(r-t),!n););i>0&&(n<0&&e[i-1]<0||n>0&&e[i-1]>0)&&(a=2*n,t=r+a,a==t-r&&(r=t))}return r}}class InternMap extends Map{constructor(e,t=h){if(super(),Object.defineProperties(this,{_intern:{value:new Map},_key:{value:t}}),null!=e)for(const[t,a]of e)this.set(t,a)}get(e){return super.get(g(this,e))}has(e){return super.has(g(this,e))}set(e,t){return super.set(f(this,e),t)}delete(e){return super.delete(y(this,e))}}class InternSet extends Set{constructor(e,t=h){if(super(),Object.defineProperties(this,{_intern:{value:new Map},_key:{value:t}}),null!=e)for(const t of e)this.add(t)}has(e){return super.has(g(this,e))}add(e){return super.add(f(this,e))}delete(e){return super.delete(y(this,e))}}function g({_intern:e,_key:t},a){const n=t(a);return e.has(n)?e.get(n):a}function f({_intern:e,_key:t},a){const n=t(a);return e.has(n)?e.get(n):(e.set(n,a),a)}function y({_intern:e,_key:t},a){const n=t(a);return e.has(n)&&(a=e.get(a),e.delete(n)),a}function h(e){return null!==e&&"object"==typeof e?e.valueOf():e}function v(e){return e}function E(e,...t){return S(e,v,v,t)}function x(e,t,...a){return S(e,v,t,a)}function j(e){if(1!==e.length)throw new Error("duplicate key");return e[0]}function S(e,t,a,n){return function e(i,r){if(r>=n.length)return a(i);const s=new InternMap,o=n[r++];let l=-1;for(const e of i){const t=o(e,++l,i),a=s.get(t);a?a.push(e):s.set(t,[e])}for(const[t,a]of s)s.set(t,e(a,r));return t(s)}(e,0)}function k(e,t){return Array.from(t,(t=>e[t]))}function O(e,...a){if("function"!=typeof e[Symbol.iterator])throw new TypeError("values is not iterable");e=Array.from(e);let[n=t]=a;if(1===n.length||a.length>1){const i=Uint32Array.from(e,((e,t)=>t));return a.length>1?(a=a.map((t=>e.map(t))),i.sort(((e,n)=>{for(const i of a){const a=t(i[e],i[n]);if(a)return a}}))):(n=e.map(n),i.sort(((e,a)=>t(n[e],n[a])))),k(e,i)}return e.sort(n)}var w=Array.prototype.slice;function T(e){return function(){return e}}var I=Math.sqrt(50),C=Math.sqrt(10),M=Math.sqrt(2);function _(e,t,a){var n,i,r,s,o=-1;if(a=+a,(e=+e)==(t=+t)&&a>0)return[e];if((n=t<e)&&(i=e,e=t,t=i),0===(s=F(e,t,a))||!isFinite(s))return[];if(s>0){let a=Math.round(e/s),n=Math.round(t/s);for(a*s<e&&++a,n*s>t&&--n,r=new Array(i=n-a+1);++o<i;)r[o]=(a+o)*s}else{s=-s;let a=Math.round(e*s),n=Math.round(t*s);for(a/s<e&&++a,n/s>t&&--n,r=new Array(i=n-a+1);++o<i;)r[o]=(a+o)/s}return n&&r.reverse(),r}function F(e,t,a){var n=(t-e)/Math.max(0,a),i=Math.floor(Math.log(n)/Math.LN10),r=n/Math.pow(10,i);return i>=0?(r>=I?10:r>=C?5:r>=M?2:1)*Math.pow(10,i):-Math.pow(10,-i)/(r>=I?10:r>=C?5:r>=M?2:1)}function A(e,t,a){let n;for(;;){const i=F(e,t,a);if(i===n||0===i||!isFinite(i))return[e,t];i>0?(e=Math.floor(e/i)*i,t=Math.ceil(t/i)*i):i<0&&(e=Math.ceil(e*i)/i,t=Math.floor(t*i)/i),n=i}}function D(e){return Math.ceil(Math.log(l(e))/Math.LN2)+1}function N(){var e=v,t=b,a=D;function n(n){Array.isArray(n)||(n=Array.from(n));var i,s,o=n.length,l=new Array(o);for(i=0;i<o;++i)l[i]=e(n[i],i,n);var c=t(l),u=c[0],d=c[1],p=a(l,u,d);if(!Array.isArray(p)){const e=d,a=+p;if(t===b&&([u,d]=A(u,d,a)),(p=_(u,d,a))[p.length-1]>=d)if(e>=d&&t===b){const e=F(u,d,a);isFinite(e)&&(e>0?d=(Math.floor(d/e)+1)*e:e<0&&(d=(Math.ceil(d*-e)+1)/-e))}else p.pop()}for(var m=p.length;p[0]<=u;)p.shift(),--m;for(;p[m-1]>d;)p.pop(),--m;var g,f=new Array(m+1);for(i=0;i<=m;++i)(g=f[i]=[]).x0=i>0?p[i-1]:u,g.x1=i<m?p[i]:d;for(i=0;i<o;++i)u<=(s=l[i])&&s<=d&&f[r(p,s,0,m)].push(n[i]);return f}return n.value=function(t){return arguments.length?(e="function"==typeof t?t:T(t),n):e},n.domain=function(e){return arguments.length?(t="function"==typeof e?e:T([e[0],e[1]]),n):t},n.thresholds=function(e){return arguments.length?(a="function"==typeof e?e:Array.isArray(e)?T(w.call(e)):T(e),n):a},n}function P(e,t){let a;if(void 0===t)for(const t of e)null!=t&&(a<t||void 0===a&&t>=t)&&(a=t);else{let n=-1;for(let i of e)null!=(i=t(i,++n,e))&&(a<i||void 0===a&&i>=i)&&(a=i)}return a}function R(e,t){let a;if(void 0===t)for(const t of e)null!=t&&(a>t||void 0===a&&t>=t)&&(a=t);else{let n=-1;for(let i of e)null!=(i=t(i,++n,e))&&(a>i||void 0===a&&i>=i)&&(a=i)}return a}function L(e,a,n=0,i=e.length-1,r=t){for(;i>n;){if(i-n>600){const t=i-n+1,s=a-n+1,o=Math.log(t),l=.5*Math.exp(2*o/3),c=.5*Math.sqrt(o*l*(t-l)/t)*(s-t/2<0?-1:1);L(e,a,Math.max(n,Math.floor(a-s*l/t+c)),Math.min(i,Math.floor(a+(t-s)*l/t+c)),r)}const t=e[a];let s=n,o=i;for(B(e,n,a),r(e[i],t)>0&&B(e,n,i);s<o;){for(B(e,s,o),++s,--o;r(e[s],t)<0;)++s;for(;r(e[o],t)>0;)--o}0===r(e[n],t)?B(e,n,o):(++o,B(e,o,i)),o<=a&&(n=o+1),a<=o&&(i=o-1)}return e}function B(e,t,a){const n=e[t];e[t]=e[a],e[a]=n}function q(e,t,a){if(n=(e=Float64Array.from(function*(e,t){if(void 0===t)for(let t of e)null!=t&&(t=+t)>=t&&(yield t);else{let a=-1;for(let n of e)null!=(n=t(n,++a,e))&&(n=+n)>=n&&(yield n)}}(e,a))).length){if((t=+t)<=0||n<2)return R(e);if(t>=1)return P(e);var n,i=(n-1)*t,r=Math.floor(i),s=P(L(e,r).subarray(0,r+1));return s+(R(e.subarray(r+1))-s)*(i-r)}}function z(e,t){let a,n=-1,i=-1;if(void 0===t)for(const t of e)++i,null!=t&&(a<t||void 0===a&&t>=t)&&(a=t,n=i);else for(let r of e)null!=(r=t(r,++i,e))&&(a<r||void 0===a&&r>=r)&&(a=r,n=i);return n}function $(e,t){let a,n=-1,i=-1;if(void 0===t)for(const t of e)++i,null!=t&&(a>t||void 0===a&&t>=t)&&(a=t,n=i);else for(let r of e)null!=(r=t(r,++i,e))&&(a>r||void 0===a&&r>=r)&&(a=r,n=i);return n}function V(e,t){return[e,t]}function U(e,a=t){if(1===a.length)return $(e,a);let n,i=-1,r=-1;for(const t of e)++r,(i<0?0===a(t,t):a(t,n)<0)&&(n=t,i=r);return i}var H=G(Math.random);function G(e){return function(t,a=0,n=t.length){let i=n-(a=+a);for(;i;){const n=e()*i--|0,r=t[i+a];t[i+a]=t[n+a],t[n+a]=r}return t}}function Q(e){if(!(i=e.length))return[];for(var t=-1,a=R(e,W),n=new Array(a);++t<a;)for(var i,r=-1,s=n[t]=new Array(i);++r<i;)s[r]=e[r][t];return n}function W(e){return e.length}function K(e){return e instanceof Set?e:new Set(e)}function Y(e,t){const a=e[Symbol.iterator](),n=new Set;for(const e of t){if(n.has(e))continue;let t,i;for(;({value:t,done:i}=a.next());){if(i)return!1;if(n.add(t),Object.is(e,t))break}}return!0}e.Adder=Adder,e.InternMap=InternMap,e.InternSet=InternSet,e.ascending=t,e.bin=N,e.bisect=r,e.bisectCenter=o,e.bisectLeft=s,e.bisectRight=r,e.bisector=a,e.count=l,e.cross=function(...e){const t="function"==typeof e[e.length-1]&&function(e){return t=>e(...t)}(e.pop()),a=(e=e.map(d)).map(c),n=e.length-1,i=new Array(n+1).fill(0),r=[];if(n<0||a.some(u))return r;for(;;){r.push(i.map(((t,a)=>e[a][t])));let s=n;for(;++i[s]===a[s];){if(0===s)return t?r.map(t):r;i[s--]=0}}},e.cumsum=function(e,t){var a=0,n=0;return Float64Array.from(e,void 0===t?e=>a+=+e||0:i=>a+=+t(i,n++,e)||0)},e.descending=function(e,t){return t<e?-1:t>e?1:t>=e?0:NaN},e.deviation=m,e.difference=function(e,...t){e=new Set(e);for(const a of t)for(const t of a)e.delete(t);return e},e.disjoint=function(e,t){const a=t[Symbol.iterator](),n=new Set;for(const t of e){if(n.has(t))return!1;let e,i;for(;({value:e,done:i}=a.next())&&!i;){if(Object.is(t,e))return!1;n.add(e)}}return!0},e.every=function(e,t){if("function"!=typeof t)throw new TypeError("test is not a function");let a=-1;for(const n of e)if(!t(n,++a,e))return!1;return!0},e.extent=b,e.fcumsum=function(e,t){const a=new Adder;let n=-1;return Float64Array.from(e,void 0===t?e=>a.add(+e||0):i=>a.add(+t(i,++n,e)||0))},e.filter=function(e,t){if("function"!=typeof t)throw new TypeError("test is not a function");const a=[];let n=-1;for(const i of e)t(i,++n,e)&&a.push(i);return a},e.fsum=function(e,t){const a=new Adder;if(void 0===t)for(let t of e)(t=+t)&&a.add(t);else{let n=-1;for(let i of e)(i=+t(i,++n,e))&&a.add(i)}return+a},e.greatest=function(e,a=t){let n,i=!1;if(1===a.length){let r;for(const s of e){const e=a(s);(i?t(e,r)>0:0===t(e,e))&&(n=s,r=e,i=!0)}}else for(const t of e)(i?a(t,n)>0:0===a(t,t))&&(n=t,i=!0);return n},e.greatestIndex=function(e,a=t){if(1===a.length)return z(e,a);let n,i=-1,r=-1;for(const t of e)++r,(i<0?0===a(t,t):a(t,n)>0)&&(n=t,i=r);return i},e.group=E,e.groupSort=function(e,a,n){return(1===a.length?O(x(e,a,n),(([e,a],[n,i])=>t(a,i)||t(e,n))):O(E(e,n),(([e,n],[i,r])=>a(n,r)||t(e,i)))).map((([e])=>e))},e.groups=function(e,...t){return S(e,Array.from,v,t)},e.histogram=N,e.index=function(e,...t){return S(e,v,j,t)},e.indexes=function(e,...t){return S(e,Array.from,j,t)},e.intersection=function(e,...t){e=new Set(e),t=t.map(K);e:for(const a of e)for(const n of t)if(!n.has(a)){e.delete(a);continue e}return e},e.least=function(e,a=t){let n,i=!1;if(1===a.length){let r;for(const s of e){const e=a(s);(i?t(e,r)<0:0===t(e,e))&&(n=s,r=e,i=!0)}}else for(const t of e)(i?a(t,n)<0:0===a(t,t))&&(n=t,i=!0);return n},e.leastIndex=U,e.map=function(e,t){if("function"!=typeof e[Symbol.iterator])throw new TypeError("values is not iterable");if("function"!=typeof t)throw new TypeError("mapper is not a function");return Array.from(e,((a,n)=>t(a,n,e)))},e.max=P,e.maxIndex=z,e.mean=function(e,t){let a=0,n=0;if(void 0===t)for(let t of e)null!=t&&(t=+t)>=t&&(++a,n+=t);else{let i=-1;for(let r of e)null!=(r=t(r,++i,e))&&(r=+r)>=r&&(++a,n+=r)}if(a)return n/a},e.median=function(e,t){return q(e,.5,t)},e.merge=function(e){return Array.from(function*(e){for(const t of e)yield*t}(e))},e.min=R,e.minIndex=$,e.nice=A,e.pairs=function(e,t=V){const a=[];let n,i=!1;for(const r of e)i&&a.push(t(n,r)),n=r,i=!0;return a},e.permute=k,e.quantile=q,e.quantileSorted=function(e,t,a=n){if(i=e.length){if((t=+t)<=0||i<2)return+a(e[0],0,e);if(t>=1)return+a(e[i-1],i-1,e);var i,r=(i-1)*t,s=Math.floor(r),o=+a(e[s],s,e);return o+(+a(e[s+1],s+1,e)-o)*(r-s)}},e.quickselect=L,e.range=function(e,t,a){e=+e,t=+t,a=(i=arguments.length)<2?(t=e,e=0,1):i<3?1:+a;for(var n=-1,i=0|Math.max(0,Math.ceil((t-e)/a)),r=new Array(i);++n<i;)r[n]=e+n*a;return r},e.reduce=function(e,t,a){if("function"!=typeof t)throw new TypeError("reducer is not a function");const n=e[Symbol.iterator]();let i,r,s=-1;if(arguments.length<3){if(({done:i,value:a}=n.next()),i)return;++s}for(;({done:i,value:r}=n.next()),!i;)a=t(a,r,++s,e);return a},e.reverse=function(e){if("function"!=typeof e[Symbol.iterator])throw new TypeError("values is not iterable");return Array.from(e).reverse()},e.rollup=x,e.rollups=function(e,t,...a){return S(e,Array.from,t,a)},e.scan=function(e,t){const a=U(e,t);return a<0?void 0:a},e.shuffle=H,e.shuffler=G,e.some=function(e,t){if("function"!=typeof t)throw new TypeError("test is not a function");let a=-1;for(const n of e)if(t(n,++a,e))return!0;return!1},e.sort=O,e.subset=function(e,t){return Y(t,e)},e.sum=function(e,t){let a=0;if(void 0===t)for(let t of e)(t=+t)&&(a+=t);else{let n=-1;for(let i of e)(i=+t(i,++n,e))&&(a+=i)}return a},e.superset=Y,e.thresholdFreedmanDiaconis=function(e,t,a){return Math.ceil((a-t)/(2*(q(e,.75)-q(e,.25))*Math.pow(l(e),-1/3)))},e.thresholdScott=function(e,t,a){return Math.ceil((a-t)/(3.5*m(e)*Math.pow(l(e),-1/3)))},e.thresholdSturges=D,e.tickIncrement=F,e.tickStep=function(e,t,a){var n=Math.abs(t-e)/Math.max(0,a),i=Math.pow(10,Math.floor(Math.log(n)/Math.LN10)),r=n/i;return r>=I?i*=10:r>=C?i*=5:r>=M&&(i*=2),t<e?-i:i},e.ticks=_,e.transpose=Q,e.union=function(...e){const t=new Set;for(const a of e)for(const e of a)t.add(e);return t},e.variance=p,e.zip=function(){return Q(arguments)},Object.defineProperty(e,"__esModule",{value:!0})}(t)},function(e,t,a){!function(e,t){"use strict";var a=new Date,n=new Date;function i(e,t,r,s){function o(t){return e(t=0===arguments.length?new Date:new Date(+t)),t}return o.floor=function(t){return e(t=new Date(+t)),t},o.ceil=function(a){return e(a=new Date(a-1)),t(a,1),e(a),a},o.round=function(e){var t=o(e),a=o.ceil(e);return e-t<a-e?t:a},o.offset=function(e,a){return t(e=new Date(+e),null==a?1:Math.floor(a)),e},o.range=function(a,n,i){var r,s=[];if(a=o.ceil(a),i=null==i?1:Math.floor(i),!(a<n&&i>0))return s;do{s.push(r=new Date(+a)),t(a,i),e(a)}while(r<a&&a<n);return s},o.filter=function(a){return i((function(t){if(t>=t)for(;e(t),!a(t);)t.setTime(t-1)}),(function(e,n){if(e>=e)if(n<0)for(;++n<=0;)for(;t(e,-1),!a(e););else for(;--n>=0;)for(;t(e,1),!a(e););}))},r&&(o.count=function(t,i){return a.setTime(+t),n.setTime(+i),e(a),e(n),Math.floor(r(a,n))},o.every=function(e){return e=Math.floor(e),isFinite(e)&&e>0?e>1?o.filter(s?function(t){return s(t)%e==0}:function(t){return o.count(0,t)%e==0}):o:null}),o}var r=i((function(){}),(function(e,t){e.setTime(+e+t)}),(function(e,t){return t-e}));r.every=function(e){return e=Math.floor(e),isFinite(e)&&e>0?e>1?i((function(t){t.setTime(Math.floor(t/e)*e)}),(function(t,a){t.setTime(+t+a*e)}),(function(t,a){return(a-t)/e})):r:null};var s=r.range;const o=1e3,l=60*o,c=60*l,u=24*c,d=7*u,p=30*u,m=365*u;var b=i((function(e){e.setTime(e-e.getMilliseconds())}),(function(e,t){e.setTime(+e+t*o)}),(function(e,t){return(t-e)/o}),(function(e){return e.getUTCSeconds()})),g=b.range,f=i((function(e){e.setTime(e-e.getMilliseconds()-e.getSeconds()*o)}),(function(e,t){e.setTime(+e+t*l)}),(function(e,t){return(t-e)/l}),(function(e){return e.getMinutes()})),y=f.range,h=i((function(e){e.setTime(e-e.getMilliseconds()-e.getSeconds()*o-e.getMinutes()*l)}),(function(e,t){e.setTime(+e+t*c)}),(function(e,t){return(t-e)/c}),(function(e){return e.getHours()})),v=h.range,E=i((e=>e.setHours(0,0,0,0)),((e,t)=>e.setDate(e.getDate()+t)),((e,t)=>(t-e-(t.getTimezoneOffset()-e.getTimezoneOffset())*l)/u),(e=>e.getDate()-1)),x=E.range;function j(e){return i((function(t){t.setDate(t.getDate()-(t.getDay()+7-e)%7),t.setHours(0,0,0,0)}),(function(e,t){e.setDate(e.getDate()+7*t)}),(function(e,t){return(t-e-(t.getTimezoneOffset()-e.getTimezoneOffset())*l)/d}))}var S=j(0),k=j(1),O=j(2),w=j(3),T=j(4),I=j(5),C=j(6),M=S.range,_=k.range,F=O.range,A=w.range,D=T.range,N=I.range,P=C.range,R=i((function(e){e.setDate(1),e.setHours(0,0,0,0)}),(function(e,t){e.setMonth(e.getMonth()+t)}),(function(e,t){return t.getMonth()-e.getMonth()+12*(t.getFullYear()-e.getFullYear())}),(function(e){return e.getMonth()})),L=R.range,B=i((function(e){e.setMonth(0,1),e.setHours(0,0,0,0)}),(function(e,t){e.setFullYear(e.getFullYear()+t)}),(function(e,t){return t.getFullYear()-e.getFullYear()}),(function(e){return e.getFullYear()}));B.every=function(e){return isFinite(e=Math.floor(e))&&e>0?i((function(t){t.setFullYear(Math.floor(t.getFullYear()/e)*e),t.setMonth(0,1),t.setHours(0,0,0,0)}),(function(t,a){t.setFullYear(t.getFullYear()+a*e)})):null};var q=B.range,z=i((function(e){e.setUTCSeconds(0,0)}),(function(e,t){e.setTime(+e+t*l)}),(function(e,t){return(t-e)/l}),(function(e){return e.getUTCMinutes()})),$=z.range,V=i((function(e){e.setUTCMinutes(0,0,0)}),(function(e,t){e.setTime(+e+t*c)}),(function(e,t){return(t-e)/c}),(function(e){return e.getUTCHours()})),U=V.range,H=i((function(e){e.setUTCHours(0,0,0,0)}),(function(e,t){e.setUTCDate(e.getUTCDate()+t)}),(function(e,t){return(t-e)/u}),(function(e){return e.getUTCDate()-1})),G=H.range;function Q(e){return i((function(t){t.setUTCDate(t.getUTCDate()-(t.getUTCDay()+7-e)%7),t.setUTCHours(0,0,0,0)}),(function(e,t){e.setUTCDate(e.getUTCDate()+7*t)}),(function(e,t){return(t-e)/d}))}var W=Q(0),K=Q(1),Y=Q(2),J=Q(3),X=Q(4),Z=Q(5),ee=Q(6),te=W.range,ae=K.range,ne=Y.range,ie=J.range,re=X.range,se=Z.range,oe=ee.range,le=i((function(e){e.setUTCDate(1),e.setUTCHours(0,0,0,0)}),(function(e,t){e.setUTCMonth(e.getUTCMonth()+t)}),(function(e,t){return t.getUTCMonth()-e.getUTCMonth()+12*(t.getUTCFullYear()-e.getUTCFullYear())}),(function(e){return e.getUTCMonth()})),ce=le.range,ue=i((function(e){e.setUTCMonth(0,1),e.setUTCHours(0,0,0,0)}),(function(e,t){e.setUTCFullYear(e.getUTCFullYear()+t)}),(function(e,t){return t.getUTCFullYear()-e.getUTCFullYear()}),(function(e){return e.getUTCFullYear()}));ue.every=function(e){return isFinite(e=Math.floor(e))&&e>0?i((function(t){t.setUTCFullYear(Math.floor(t.getUTCFullYear()/e)*e),t.setUTCMonth(0,1),t.setUTCHours(0,0,0,0)}),(function(t,a){t.setUTCFullYear(t.getUTCFullYear()+a*e)})):null};var de=ue.range;function pe(e,a,n,i,s,g){const f=[[b,1,o],[b,5,5*o],[b,15,15*o],[b,30,30*o],[g,1,l],[g,5,5*l],[g,15,15*l],[g,30,30*l],[s,1,c],[s,3,3*c],[s,6,6*c],[s,12,12*c],[i,1,u],[i,2,2*u],[n,1,d],[a,1,p],[a,3,3*p],[e,1,m]];function y(a,n,i){const s=Math.abs(n-a)/i,o=t.bisector((([,,e])=>e)).right(f,s);if(o===f.length)return e.every(t.tickStep(a/m,n/m,i));if(0===o)return r.every(Math.max(t.tickStep(a,n,i),1));const[l,c]=f[s/f[o-1][2]<f[o][2]/s?o-1:o];return l.every(c)}return[function(e,t,a){const n=t<e;n&&([e,t]=[t,e]);const i=a&&"function"==typeof a.range?a:y(e,t,a),r=i?i.range(e,+t+1):[];return n?r.reverse():r},y]}const[me,be]=pe(ue,le,W,H,V,z),[ge,fe]=pe(B,R,S,E,h,f);e.timeDay=E,e.timeDays=x,e.timeFriday=I,e.timeFridays=N,e.timeHour=h,e.timeHours=v,e.timeInterval=i,e.timeMillisecond=r,e.timeMilliseconds=s,e.timeMinute=f,e.timeMinutes=y,e.timeMonday=k,e.timeMondays=_,e.timeMonth=R,e.timeMonths=L,e.timeSaturday=C,e.timeSaturdays=P,e.timeSecond=b,e.timeSeconds=g,e.timeSunday=S,e.timeSundays=M,e.timeThursday=T,e.timeThursdays=D,e.timeTickInterval=fe,e.timeTicks=ge,e.timeTuesday=O,e.timeTuesdays=F,e.timeWednesday=w,e.timeWednesdays=A,e.timeWeek=S,e.timeWeeks=M,e.timeYear=B,e.timeYears=q,e.utcDay=H,e.utcDays=G,e.utcFriday=Z,e.utcFridays=se,e.utcHour=V,e.utcHours=U,e.utcMillisecond=r,e.utcMilliseconds=s,e.utcMinute=z,e.utcMinutes=$,e.utcMonday=K,e.utcMondays=ae,e.utcMonth=le,e.utcMonths=ce,e.utcSaturday=ee,e.utcSaturdays=oe,e.utcSecond=b,e.utcSeconds=g,e.utcSunday=W,e.utcSundays=te,e.utcThursday=X,e.utcThursdays=re,e.utcTickInterval=be,e.utcTicks=me,e.utcTuesday=Y,e.utcTuesdays=ne,e.utcWednesday=J,e.utcWednesdays=ie,e.utcWeek=W,e.utcWeeks=te,e.utcYear=ue,e.utcYears=de,Object.defineProperty(e,"__esModule",{value:!0})}(t,a(816))},function(e,t,a){"use strict";a.d(t,"a",(function(){return l})),a.d(t,"b",(function(){return c})),a.d(t,"c",(function(){return u}));var n=a(40),i=a(42),r=a(2),s=a.n(r),o=a(121);const l="process.name",c="user.name",u=s.a.memo((({contextId:e,eventId:t,isDraggable:a,processName:r,userName:u})=>s.a.createElement(n.EuiFlexGroup,{alignItems:"flexStart","data-test-subj":"user-process",direction:"column",justifyContent:"center",gutterSize:"none"},null!=u?Object(i.uniq)(u).map((i=>s.a.createElement(n.EuiFlexItem,{grow:!1,key:i},s.a.createElement(o.c,{contextId:e,"data-test-subj":"user-name",eventId:t,field:c,isDraggable:a,value:i,iconType:"user",isAggregatable:!0,fieldType:"keyword"})))):null,null!=r?Object(i.uniq)(r).map((i=>s.a.createElement(n.EuiFlexItem,{grow:!1,key:i},s.a.createElement(o.c,{contextId:e,eventId:t,field:l,isDraggable:a,value:i,iconType:"console",isAggregatable:!0,fieldType:"keyword"})))):null)));u.displayName="UserProcess"},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(2),i=a.n(n),r=a(121),s=a(392),o=a(127);const l=i.a.memo((({contextId:e,eventId:t,hostName:a,workingDirectory:n,isDraggable:l})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(o.c,{grow:!1,component:"span"},i.a.createElement(r.c,{contextId:e,eventId:t,field:"host.name",value:a,isDraggable:l,fieldType:"keyword",isAggregatable:!0})),null!=n&&i.a.createElement(o.c,{grow:!1,component:"span"},s.e),i.a.createElement(o.c,{grow:!1,component:"span"},i.a.createElement(r.c,{contextId:e,eventId:t,field:"process.working_directory",value:n,iconType:"folderOpen",isDraggable:l,fieldType:"keyword",isAggregatable:!0})))));l.displayName="HostWorkingDir"},function(e,t,a){"use strict";a.d(t,"a",(function(){return k}));var n=a(42),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(106),c=a(449),u=a(607),d=a(485),p=a(569),m=a(395),b=a(608),g=a(868),f=a(571),y=a(818),h=a(380),v=a(460),E=a(570),x=a(532),j=a(275);const S=o.a.div.withConfig({displayName:"Details",componentId:"sc-1voakd9-0"})(["margin:5px 0;"]);S.displayName="Details";const k={id:l.d.netflow,isInstance:e=>"network_traffic"===`${Object(n.get)("event.category",e)}`.toLowerCase()||(e=>{const t=`${e}`.toLowerCase();return"network_flow"===t||"netflow_flow"===t})(Object(n.get)("event.action",e)),renderRow:({data:e,isDraggable:t,scopeId:a})=>r.a.createElement(j.a,null,r.a.createElement(S,null,r.a.createElement(g.a,{contextId:`netflow-row-renderer-render-row-${a}-${e._id}`,destinationBytes:Object(c.a)(Object(n.get)(x.a,e)),destinationGeoContinentName:Object(c.a)(Object(n.get)(E.b,e)),destinationGeoCountryName:Object(c.a)(Object(n.get)(E.d,e)),destinationGeoCountryIsoCode:Object(c.a)(Object(n.get)(E.c,e)),destinationGeoRegionName:Object(c.a)(Object(n.get)(E.e,e)),destinationGeoCityName:Object(c.a)(Object(n.get)(E.a,e)),destinationIp:Object(c.a)(Object(n.get)(m.a,e)),destinationPackets:Object(c.a)(Object(n.get)(x.b,e)),destinationPort:Object(c.a)(Object(n.get)(h.a,e)),eventDuration:Object(c.a)(Object(n.get)(d.b,e)),eventId:Object(n.get)(p.a,e),eventEnd:Object(c.a)(Object(n.get)(f.b,e)),eventStart:Object(c.a)(Object(n.get)(f.c,e)),isDraggable:t,networkBytes:Object(c.a)(Object(n.get)(v.a,e)),networkCommunityId:Object(c.a)(Object(n.get)(v.b,e)),networkDirection:Object(c.a)(Object(n.get)(v.c,e)),networkPackets:Object(c.a)(Object(n.get)(v.d,e)),networkProtocol:Object(c.a)(Object(n.get)(v.e,e)),processName:Object(c.a)(Object(n.get)(y.a,e)),sourceBytes:Object(c.a)(Object(n.get)(x.c,e)),sourceGeoContinentName:Object(c.a)(Object(n.get)(E.h,e)),sourceGeoCountryName:Object(c.a)(Object(n.get)(E.j,e)),sourceGeoCountryIsoCode:Object(c.a)(Object(n.get)(E.i,e)),sourceGeoRegionName:Object(c.a)(Object(n.get)(E.k,e)),sourceGeoCityName:Object(c.a)(Object(n.get)(E.g,e)),sourceIp:Object(c.a)(Object(n.get)(m.d,e)),sourcePackets:Object(c.a)(Object(n.get)(x.d,e)),sourcePort:Object(c.a)(Object(n.get)(h.c,e)),tlsClientCertificateFingerprintSha1:Object(c.a)(Object(n.get)(u.b,e)),tlsFingerprintsJa3Hash:Object(c.a)(Object(n.get)(b.a,e)),tlsServerCertificateFingerprintSha1:Object(c.a)(Object(n.get)(u.c,e)),transport:Object(c.a)(Object(n.get)(v.f,e)),userName:Object(c.a)(Object(n.get)(y.b,e))})))}},function(e,t,a){"use strict";a.d(t,"e",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"d",(function(){return s})),a.d(t,"c",(function(){return o})),a.d(t,"a",(function(){return l})),a.d(t,"f",(function(){return c}));var n=a(5);n.i18n.translate("xpack.securitySolution.timeline.expandableEvent.messageTitle",{defaultMessage:"Message"});const i=n.i18n.translate("xpack.securitySolution.timeline.expandableEvent.openAlertDetails",{defaultMessage:"Open alert details page"}),r=n.i18n.translate("xpack.securitySolution.timeline.expandableEvent.closeEventDetailsLabel",{defaultMessage:"close"}),s=n.i18n.translate("xpack.securitySolution.timeline.expandableEvent.placeholder",{defaultMessage:"Select an event to show event details"}),o=n.i18n.translate("xpack.securitySolution.timeline.expandableEvent.eventTitleLabel",{defaultMessage:"Event details"}),l=n.i18n.translate("xpack.securitySolution.timeline.expandableEvent.alertTitleLabel",{defaultMessage:"Alert details"}),c=n.i18n.translate("xpack.securitySolution.timeline.expandableEvent.shareAlert",{defaultMessage:"Share alert"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(8),i=a(2),r=a(4),s=a(108),o=a(239),l=a(375);const c=({alertId:e})=>{const[t,a]=Object(i.useState)(!1),[c,u]=Object(i.useState)([]),{addError:d}=Object(s.a)();return Object(i.useEffect)((()=>{let t=!0;return a(!0),Object(n.isEmpty)(e)||(async()=>{try{const a=await Object(o.f)({alertId:e,owner:[r.i]});t&&u(a)}catch(e){d(e.message,{title:l.a})}t&&a(!1)})(),()=>{t=!1}}),[e,d]),{loading:t,casesInfo:c}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(120),r=a(181),s=a(135);const o=({isEndpointAlert:e,onAddExceptionTypeClick:t})=>{const[{canUserCRUD:a,hasIndexWrite:o}]=Object(r.b)(),l=Object(n.useCallback)((()=>{t()}),[t]),c=Object(n.useCallback)((()=>{t(i.b.ENDPOINT)}),[t]),u=!a||!o||!e,d=!a||!o;return{exceptionActionItems:Object(n.useMemo)((()=>d?[]:[{key:"add-endpoint-exception-menu-item","data-test-subj":"add-endpoint-exception-menu-item",disabled:u,onClick:c,name:s.d},{key:"add-exception-menu-item","data-test-subj":"add-exception-menu-item",disabled:d,onClick:l,name:s.g}]),[u,d,l,c])}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(2),i=a(135);const r=({onAddEventFilterClick:e,disabled:t=!1,tooltipMessage:a})=>({eventFilterActionItems:Object(n.useMemo)((()=>[{key:"add-event-filter-menu-item","data-test-subj":"add-event-filter-menu-item",onClick:e,disabled:t,toolTipContent:a,name:i.e}]),[e,t,a])})},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(129),r=a(1123),s=a(285);const o=({closePopover:e,ecsRowData:t,refetch:a})=>{var o;const{hasIndexWrite:l}=Object(s.a)(),c=t._id,u=Object(n.useMemo)((()=>{var e,a,n,r;return[{_id:c,_index:null!==(e=t._index)&&void 0!==e?e:"",data:[{field:i.kb,value:null!==(a=null==t||null===(n=t.kibana)||void 0===n?void 0:n.alert.workflow_tags)&&void 0!==a?a:[]}],ecs:{_id:c,_index:null!==(r=t._index)&&void 0!==r?r:""}}]}),[c,t._index,null==t||null===(o=t.kibana)||void 0===o?void 0:o.alert.workflow_tags]),{alertTagsItems:d,alertTagsPanels:p}=Object(r.a)({refetch:a}),m=Object(n.useMemo)((()=>d.map((e=>({name:e.name,panel:e.panel,"data-test-subj":e["data-test-subj"],key:e.key})))),[d]);return{alertTagsItems:l?m:[],alertTagsPanels:Object(n.useMemo)((()=>p.map((t=>{const a=t.renderContent({closePopoverMenu:e,setIsBulkActionsLoading:()=>{},alertItems:u});return{title:t.title,content:a,id:t.id}}))),[u,p,e])}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(2);const i=({refetch:e,onRuleChange:t,isActiveTimelines:a})=>{const[i,r]=Object(n.useState)(!1),[s,o]=Object(n.useState)(null);return{exceptionFlyoutType:s,openAddExceptionFlyout:i,onAddExceptionTypeClick:Object(n.useCallback)((e=>{o(null!=e?e:null),r(!0)}),[]),onAddExceptionCancel:Object(n.useCallback)((()=>{o(null),r(!1)}),[]),onAddExceptionConfirm:Object(n.useCallback)(((n,i,s)=>{e&&(!1===a||s)&&e(),null!=t&&n&&t(),r(!1)}),[t,e,a])}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(381);const i=(e,t)=>{const a=Object(n.g)(e),i=Object(n.b)(e);return"create"===t?i:a}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a.n(n),r=a(40),s=a(107);const o=Object(n.memo)((({title:e,subtitle:t,actions:a,children:o,restrictWidth:l=!1,hasBottomBorder:c=!0,hideHeader:u=!1,headerBackComponent:d,...p})=>{const m=Object(n.useMemo)((()=>i.a.createElement(r.EuiFlexGroup,{direction:"column",gutterSize:"none",alignItems:"flexStart"},i.a.createElement(r.EuiFlexItem,{grow:!1},d&&i.a.createElement(i.a.Fragment,null,d)),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiTitle,{size:"l"},i.a.createElement("span",{"data-test-subj":"header-page-title"},e))))),[d,e]),b=Object(n.useMemo)((()=>t?i.a.createElement("span",{"data-test-subj":"header-panel-subtitle"},t):void 0),[t]),g=Object(s.a)(p["data-test-subj"]);return i.a.createElement("div",p,!u&&i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiPageHeader,{pageTitle:m,description:b,bottomBorder:c,rightSideItems:a?[a]:void 0,restrictWidth:l,"data-test-subj":g("header")}),i.a.createElement(r.EuiSpacer,{size:"l"})),i.a.createElement(r.EuiPageContent_Deprecated,{hasBorder:!1,hasShadow:!1,paddingSize:"none",color:"transparent",borderRadius:"none"},i.a.createElement(r.EuiPageContentBody_Deprecated,{restrictWidth:l},o)))}));o.displayName="AdministrationListPage"},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(2),i=a(290);const r=["create","edit"],s=(e=!0,t=!0)=>{var a;const s=null!==(a=Object(i.a)().urlParams.show)&&void 0!==a?a:"";return Object(n.useMemo)((()=>!!r.includes(s)&&("create"===s&&t||"edit"===s&&e)),[t,e,s])}},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"d",(function(){return o}));var n=a(226);function i(e){return(null==e?void 0:e.filter((e=>!e.startsWith("policy:"))))||[]}function r(e,t=[]){return e.isGlobal?[n.d,...t]:e.selected.map((e=>`policy:${e.id}`)).concat(t)}function s(e,t){return e.find((e=>e===n.d))?{isGlobal:!0,selected:[]}:{isGlobal:!1,selected:e.reduce(((e,a)=>{const n=a.split(":")[1],i=t.find((e=>e.id===n));return void 0!==i&&e.push(i),e}),[])}}function o(e){return void 0!==e&&void 0!==e.find((e=>e===n.d))}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(2);const i=()=>{const[e,t]=Object(n.useState)(!1),a=Object(n.useCallback)((()=>{t(!0)}),[]);return{closeAddEventFilterModal:Object(n.useCallback)((()=>{t(!1)}),[]),isAddEventFilterModalOpen:e,onAddEventFilterClick:a}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(119),i=a(139),r=a(542);const s=Object(i.createSelector)(Object(r.globalFiltersQuerySelector)(),Object(r.getTimelineSelector)(),Object(r.globalQuerySelector)(),Object(r.globalQuery)(),Object(r.timelineQueryByIdSelector)(),Object(n.o)(),((e,t,a,n,i,r)=>({filters:e,input:t,query:a,globalQueries:n,timelineQuery:i,dataTable:r})))},function(e,t,a){e.exports=a.p+"2d015490d219c87a014c81f9555e556a.svg"},function(e,t,a){e.exports=a.p+"432a17d27c37a1b4467753dcc2332f12.svg"},function(e,t,a){"use strict";a.d(t,"c",(function(){return s})),a.d(t,"b",(function(){return o})),a.d(t,"a",(function(){return l}));var n=a(113),i=a(314),r=a(200);const s=e=>({...e.page.queries,[r.HostsTableType.authentications]:{...e.page.queries[r.HostsTableType.authentications],activePage:i.a},[r.HostsTableType.hosts]:{...e.page.queries[r.HostsTableType.hosts],activePage:i.a},[r.HostsTableType.events]:{...e.page.queries[r.HostsTableType.events],activePage:i.a},[r.HostsTableType.uncommonProcesses]:{...e.page.queries[r.HostsTableType.uncommonProcesses],activePage:i.a}}),o=e=>({...e.details.queries,[r.HostsTableType.authentications]:{...e.details.queries[r.HostsTableType.authentications],activePage:i.a},[r.HostsTableType.hosts]:{...e.details.queries[r.HostsTableType.hosts],activePage:i.a},[r.HostsTableType.events]:{...e.details.queries[r.HostsTableType.events],activePage:i.a},[r.HostsTableType.uncommonProcesses]:{...e.details.queries[r.HostsTableType.uncommonProcesses],activePage:i.a}}),l=(e,t)=>e.length>0?[{query:{bool:{should:e.map((e=>({match_phrase:{[t===n.w.user?n.x.userRisk:n.x.hostRisk]:{query:e}}})))}},meta:{alias:null,disabled:!1,negate:!1}}]:[]},function(e,t,a){const n=a(192);e.exports=(e,t,a)=>0===n(e,t,a)},function(e,t,a){const n=a(192);e.exports=(e,t,a)=>0!==n(e,t,a)},function(e,t,a){const n=a(836),i=a(837),r=a(462),s=a(489),o=a(578),l=a(396);e.exports=(e,t,a,c)=>{switch(t){case"===":return"object"==typeof e&&(e=e.version),"object"==typeof a&&(a=a.version),e===a;case"!==":return"object"==typeof e&&(e=e.version),"object"==typeof a&&(a=a.version),e!==a;case"":case"=":case"==":return n(e,a,c);case"!=":return i(e,a,c);case">":return r(e,a,c);case">=":return s(e,a,c);case"<":return o(e,a,c);case"<=":return l(e,a,c);default:throw new TypeError(`Invalid operator: ${t}`)}}},function(e,t,a){"use strict";const n=a(2),i=a(1310),r=a(496),s=a(1311),o=a(1358),l=a(1399),c=a(1359),u=a(1360),d=a(1362),p=a(1363).hastChildrenToReact;e.exports=f;const m={}.hasOwnProperty,b="https://github.com/remarkjs/react-markdown/blob/main/changelog.md",g={renderers:{to:"components",id:"change-renderers-to-components"},astPlugins:{id:"remove-buggy-html-in-markdown-parser"},allowDangerousHtml:{id:"remove-buggy-html-in-markdown-parser"},escapeHtml:{id:"remove-buggy-html-in-markdown-parser"},source:{to:"children",id:"change-source-to-children"},allowNode:{to:"allowElement",id:"replace-allownode-allowedtypes-and-disallowedtypes"},allowedTypes:{to:"allowedElements",id:"replace-allownode-allowedtypes-and-disallowedtypes"},disallowedTypes:{to:"disallowedElements",id:"replace-allownode-allowedtypes-and-disallowedtypes"},includeNodeIndex:{to:"includeElementIndex",id:"change-includenodeindex-to-includeelementindex"}};function f(e){for(const t in g)if(m.call(g,t)&&m.call(e,t)){const e=g[t];console.warn(`[react-markdown] Warning: please ${e.to?`use \`${e.to}\` instead of`:"remove"} \`${t}\` (see <${b}#${e.id}> for more info)`),delete g[t]}const t=r().use(s).use(e.remarkPlugins||e.plugins||[]).use(o,{allowDangerousHtml:!0}).use(e.rehypePlugins||[]).use(u,e);let a;"string"==typeof e.children?a=i(e.children):(void 0!==e.children&&null!==e.children&&console.warn(`[react-markdown] Warning: please pass a string as \`children\` (not: \`${e.children}\`)`),a=i());const l=t.runSync(t.parse(a),a);if("root"!==l.type)throw new TypeError("Expected a `root` node");let d=n.createElement(n.Fragment,{},p({options:e,schema:c,listDepth:0},l));return e.className&&(d=n.createElement("div",{className:e.className},d)),d}f.defaultProps={transformLinkUri:d},f.propTypes={children:l.string,className:l.string,allowElement:l.func,allowedElements:l.arrayOf(l.string),disallowedElements:l.arrayOf(l.string),unwrapDisallowed:l.bool,remarkPlugins:l.arrayOf(l.oneOfType([l.object,l.func,l.arrayOf(l.oneOfType([l.object,l.func]))])),rehypePlugins:l.arrayOf(l.oneOfType([l.object,l.func,l.arrayOf(l.oneOfType([l.object,l.func]))])),sourcePos:l.bool,rawSourcePos:l.bool,skipHtml:l.bool,includeElementIndex:l.bool,transformLinkUri:l.oneOfType([l.func,l.bool]),linkTarget:l.oneOfType([l.func,l.string]),transformImageUri:l.func,components:l.object},f.uriTransformer=d},function(e,t,a){"use strict";var n={}.hasOwnProperty;e.exports=n},function(e,t,a){"use strict";e.exports=function(e){for(var t=-1,a=0;++t<e.length;)a+="string"==typeof e[t]?e[t].length:1;return a}},function(e,t,a){"use strict";var n=a(369),i=a(251),r=a(315);function s(e,t){for(var a,n,r,s,o,l,c=e[t][1],u=e[t][2],d=t-1,p=[],m=c._tokenizer||u.parser[c.contentType](c.start),b=m.events,g=[],f={};c;){for(;e[++d][1]!==c;);p.push(d),c._tokenizer||(a=u.sliceStream(c),c.next||a.push(null),n&&m.defineSkip(c.start),c.isInFirstContentOfListItem&&(m._gfmTasklistFirstContentOfListItem=!0),m.write(a),c.isInFirstContentOfListItem&&(m._gfmTasklistFirstContentOfListItem=void 0)),n=c,c=c.next}for(c=n,r=b.length;r--;)"enter"===b[r][0]?s=!0:s&&b[r][1].type===b[r-1][1].type&&b[r][1].start.line!==b[r][1].end.line&&(y(b.slice(r+1,o)),c._tokenizer=c.next=void 0,c=c.previous,o=r+1);for(m.events=c._tokenizer=c.next=void 0,y(b.slice(0,o)),r=-1,l=0;++r<g.length;)f[l+g[r][0]]=l+g[r][1],l+=g[r][1]-g[r][0]-1;return f;function y(t){var a=p.pop();g.unshift([a,a+t.length-1]),i(e,a,2,t)}}e.exports=function(e){for(var t,a,o,l,c,u,d,p={},m=-1;++m<e.length;){for(;m in p;)m=p[m];if(t=e[m],m&&"chunkFlow"===t[1].type&&"listItemPrefix"===e[m-1][1].type&&((o=0)<(u=t[1]._tokenizer.events).length&&"lineEndingBlank"===u[o][1].type&&(o+=2),o<u.length&&"content"===u[o][1].type))for(;++o<u.length&&"content"!==u[o][1].type;)"chunkText"===u[o][1].type&&(u[o][1].isInFirstContentOfListItem=!0,o++);if("enter"===t[0])t[1].contentType&&(n(p,s(e,m)),m=p[m],d=!0);else if(t[1]._container||t[1]._movePreviousLineEndings){for(o=m,a=void 0;o--&&("lineEnding"===(l=e[o])[1].type||"lineEndingBlank"===l[1].type);)"enter"===l[0]&&(a&&(e[a][1].type="lineEndingBlank"),l[1].type="lineEnding",a=o);a&&(t[1].end=r(e[a][1].start),(c=e.slice(a,m)).unshift(t),i(e,a,m-a+1,c))}}return!d}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(369),i=a(315),r=l("text"),s=l("string"),o={resolveAll:c()};function l(e){return{tokenize:function(t){var a=this,n=this.parser.constructs[e],i=t.attempt(n,r,s);return r;function r(e){return l(e)?i(e):s(e)}function s(e){if(null!==e)return t.enter("data"),t.consume(e),o;t.consume(e)}function o(e){return l(e)?(t.exit("data"),i(e)):(t.consume(e),o)}function l(e){var t=n[e],i=-1;if(null===e)return!0;if(t)for(;++i<t.length;)if(!t[i].previous||t[i].previous.call(a,a.previous))return!0}},resolveAll:c("text"===e?u:void 0)}}function c(e){return function(t,a){for(var n,i=-1;++i<=t.length;)void 0===n?t[i]&&"data"===t[i][1].type&&(n=i,i++):t[i]&&"data"===t[i][1].type||(i!==n+2&&(t[n][1].end=t[i-1][1].end,t.splice(n+2,i-n-2),i=n+2),n=void 0);return e?e(t,a):t}}function u(e,t){for(var a,r,s,o,l,c,u,d,p=-1;++p<=e.length;)if((p===e.length||"lineEnding"===e[p][1].type)&&"data"===e[p-1][1].type){for(r=e[p-1][1],o=(a=t.sliceStream(r)).length,l=-1,c=0,u=void 0;o--;)if("string"==typeof(s=a[o])){for(l=s.length;32===s.charCodeAt(l-1);)c++,l--;if(l)break;l=-1}else if(-2===s)u=!0,c++;else if(-1!==s){o++;break}c&&(d={type:p===e.length||u||c<2?"lineSuffix":"hardBreakTrailing",start:{line:r.end.line,column:r.end.column-c,offset:r.end.offset-c,_index:r.start._index+o,_bufferIndex:o?l:r.start._bufferIndex+l},end:i(r.end)},r.end=i(d.start),r.start.offset===r.end.offset?n(r,d):(e.splice(p,0,["enter",d,t],["exit",d,t]),p+=2)),p++}return e}t.resolver=o,t.string=s,t.text=r},function(e,t,a){"use strict";e.exports=function(e){return e<32||127===e}},function(e,t,a){e.exports=a(33)(3364)},function(e,t,a){"use strict";var n=a(253)(/\d/);e.exports=n},function(e,t,a){"use strict";var n=a(844),i=a(252),r=a(147);e.exports=function(e,t,a,s,o,l,c,u,d){var p=d||1/0,m=0;return function(t){return 60===t?(e.enter(s),e.enter(o),e.enter(l),e.consume(t),e.exit(l),b):n(t)||41===t?a(t):(e.enter(s),e.enter(c),e.enter(u),e.enter("chunkString",{contentType:"string"}),y(t))};function b(a){return 62===a?(e.enter(l),e.consume(a),e.exit(l),e.exit(o),e.exit(s),t):(e.enter(u),e.enter("chunkString",{contentType:"string"}),g(a))}function g(t){return 62===t?(e.exit("chunkString"),e.exit(u),b(t)):null===t||60===t||r(t)?a(t):(e.consume(t),92===t?f:g)}function f(t){return 60===t||62===t||92===t?(e.consume(t),g):g(t)}function y(r){return 40===r?++m>p?a(r):(e.consume(r),y):41===r?m--?(e.consume(r),y):(e.exit("chunkString"),e.exit(u),e.exit(c),e.exit(s),t(r)):null===r||i(r)?m?a(r):(e.exit("chunkString"),e.exit(u),e.exit(c),e.exit(s),t(r)):n(r)?a(r):(e.consume(r),92===r?h:y)}function h(t){return 40===t||41===t||92===t?(e.consume(t),y):y(t)}}},function(e,t,a){"use strict";var n=a(147),i=a(237);e.exports=function(e,t,a,r,s,o){var l,c=this,u=0;return function(t){return e.enter(r),e.enter(s),e.consume(t),e.exit(s),e.enter(o),d};function d(i){return null===i||91===i||93===i&&!l||94===i&&!u&&"_hiddenFootnoteSupport"in c.parser.constructs||u>999?a(i):93===i?(e.exit(o),e.enter(s),e.consume(i),e.exit(s),e.exit(r),t):n(i)?(e.enter("lineEnding"),e.consume(i),e.exit("lineEnding"),d):(e.enter("chunkString",{contentType:"string"}),p(i))}function p(t){return null===t||91===t||93===t||n(t)||u++>999?(e.exit("chunkString"),d(t)):(e.consume(t),l=l||!i(t),92===t?m:p)}function m(t){return 91===t||92===t||93===t?(e.consume(t),u++,p):p(t)}}},function(e,t,a){"use strict";var n=a(147),i=a(237),r=a(154);e.exports=function(e,t){var a;return function s(o){return n(o)?(e.enter("lineEnding"),e.consume(o),e.exit("lineEnding"),a=!0,s):i(o)?r(e,s,a?"linePrefix":"lineSuffix")(o):t(o)}}},function(e,t,a){"use strict";var n=a(147),i=a(154);e.exports=function(e,t,a,r,s,o){var l;return function(t){return e.enter(r),e.enter(s),e.consume(t),e.exit(s),l=40===t?41:t,c};function c(a){return a===l?(e.enter(s),e.consume(a),e.exit(s),e.exit(r),t):(e.enter(o),u(a))}function u(t){return t===l?(e.exit(o),c(l)):null===t?a(t):n(t)?(e.enter("lineEnding"),e.consume(t),e.exit("lineEnding"),i(e,u,"linePrefix")):(e.enter("chunkString",{contentType:"string"}),d(t))}function d(t){return t===l||null===t||n(t)?(e.exit("chunkString"),u(t)):(e.consume(t),92===t?p:d)}function p(t){return t===l||92===t?(e.consume(t),d):d(t)}}},function(e,t,a){"use strict";var n=a(147),i=a(237),r=a(154),s={name:"thematicBreak",tokenize:function(e,t,a){var s,o=0;return function(t){return e.enter("thematicBreak"),s=t,l(t)};function l(u){return u===s?(e.enter("thematicBreakSequence"),c(u)):i(u)?r(e,l,"whitespace")(u):o<3||null!==u&&!n(u)?a(u):(e.exit("thematicBreak"),t(u))}function c(t){return t===s?(e.consume(t),o++,c):(e.exit("thematicBreakSequence"),l(t))}}};e.exports=s},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"d",(function(){return r})),a.d(t,"a",(function(){return s})),a.d(t,"e",(function(){return o})),a.d(t,"c",(function(){return l}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.ruleActionsField.ruleActionsFormErrorsTitle",{defaultMessage:"Please fix issues listed below"}),r=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleNotifyWhen.onActiveAlert.display",{defaultMessage:"Per rule run"}),s=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleNotifyWhen.onThrottleInterval.display",{defaultMessage:"Custom frequency"}),o=n.i18n.translate("xpack.securitySolution.detectionEngine.body.summary.message",{defaultMessage:"Rule {ruleName} generated {signalsCount} alerts",values:{ruleName:"{{context.rule.name}}",signalsCount:"{{state.signals_count}}"}}),l=n.i18n.translate("xpack.securitySolution.detectionEngine.body.forEachAlert.message",{defaultMessage:"Rule {ruleName} generated alert {alertId}",values:{ruleName:"{{context.rule.name}}",alertId:"{{alert.id}}"}})},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(108),i=a(332),r=a(304);const s=(e,t)=>{const{addError:a}=Object(n.a)();return Object(i.a)(e,{onError:e=>a(e,{title:r.b}),...t})}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"h",(function(){return r})),a.d(t,"i",(function(){return s})),a.d(t,"d",(function(){return o})),a.d(t,"e",(function(){return l})),a.d(t,"f",(function(){return c})),a.d(t,"g",(function(){return u})),a.d(t,"b",(function(){return d})),a.d(t,"c",(function(){return p}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.documentationLinks.ariaLabelEnding",{defaultMessage:"click to open documentation in a new tab"}),r="sec-requirements.html",s=n.i18n.translate("xpack.securitySolution.documentationLinks.solutionRequirements.text",{defaultMessage:"Elastic Security system requirements"}),o="detections-permissions-section.html",l=n.i18n.translate("xpack.securitySolution.documentationLinks.detectionsRequirements.text",{defaultMessage:"Detections prerequisites and requirements"}),c="alerts-ui-monitor.html#ml-job-compatibility",u=n.i18n.translate("xpack.securitySolution.documentationLinks.mlJobCompatibility.text",{defaultMessage:"ML job compatibility"}),d="rules-coverage.html",p=n.i18n.translate("xpack.securitySolution.documentationLinks.coverageOverview.text",{defaultMessage:"Learn more."})},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(5);const i={interval:{label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRule.fieldIntervalLabel",{defaultMessage:"Runs every"}),helpText:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRule.fieldIntervalHelpText",{defaultMessage:"Rules run periodically and detect alerts within the specified time frame."})},from:{label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRule.fieldAdditionalLookBackLabel",{defaultMessage:"Additional look-back time"}),helpText:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRule.fieldAdditionalLookBackHelpText",{defaultMessage:"Adds time to the look-back period to prevent missed alerts."})}}},,,function(e,t,a){"use strict";a.d(t,"e",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"a",(function(){return o})),a.d(t,"d",(function(){return l})),a.d(t,"b",(function(){return c}));var n=a(172),i=a(137);function r(e){switch(e){case n.b.export:return i.Dc;case n.b.duplicate:return i.pc;case n.b.delete:return i.hc;case n.b.enable:return i.yc;case n.b.disable:return i.lc;case n.b.edit:return i.tc}}function s(e,t){switch(e){case n.b.export:return u(t.succeeded,t.total);case n.b.duplicate:return i.qc(t.succeeded);case n.b.delete:return i.ic(t.succeeded);case n.b.enable:return i.zc(t.succeeded);case n.b.disable:return i.mc(t.succeeded)}}function o(e,t){const a=t.skipped>0?` ${i.uc}`:null;return e.some((e=>e.type===n.a.add_index_patterns||e.type===n.a.set_index_patterns||e.type===n.a.delete_index_patterns))?`${i.vc(t.succeeded,t.skipped)}${a}`:i.vc(t.succeeded,t.skipped)}function l(e){switch(e){case n.b.export:return i.Ac;case n.b.duplicate:return i.nc;case n.b.delete:return i.fc;case n.b.enable:return i.wc;case n.b.disable:return i.jc;case n.b.edit:return i.rc}}function c(e,t){var a,r;const s=null===(a=t.body)||void 0===a||null===(r=a.attributes)||void 0===r?void 0:r.summary;if(!s)return"";switch(e){case n.b.export:return i.Bc(s.failed);case n.b.duplicate:return i.oc(s.failed);case n.b.delete:return i.gc(s.failed);case n.b.enable:return i.xc(s.failed);case n.b.disable:return i.kc(s.failed);case n.b.edit:return i.sc(s.failed,s.skipped)}}const u=(e,t)=>{const a=[i.Ec(e,t)];return t>e&&a.push(i.Cc),a.join(" ")}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(108),r=a(172),s=a(858);function o(){const e=Object(i.a)();return Object(n.useCallback)((({actionType:t,summary:a,editPayload:n})=>{const i=t===r.b.edit?Object(s.a)(null!=n?n:[],a):Object(s.c)(t,a);e.addSuccess({title:Object(s.e)(t),text:i})}),[e])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(2),i=a(172),r=a(265);function s(){const e=Object(r.c)();return Object(n.useCallback)((t=>{const a=null!=e&&e.state.isAllSelected?e.state.rules:[];return(t===i.b.enable?a.filter((e=>!e.enabled)):t===i.b.disable?a.filter((e=>e.enabled)):a).map((e=>e.id))}),[e])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(41);const i=a.n(n).a.div.withConfig({displayName:"Display",componentId:"sc-1f84jld-0"})(["",";"],(({show:e})=>e?"":"display: none;"));i.displayName="Display"},function(e,t,a){"use strict";a.d(t,"c",(function(){return i})),a.d(t,"e",(function(){return r})),a.d(t,"d",(function(){return s})),a.d(t,"g",(function(){return o})),a.d(t,"f",(function(){return l})),a.d(t,"a",(function(){return c})),a.d(t,"b",(function(){return u}));var n=a(5);n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.pageTitle",{defaultMessage:"Rule details"}),n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.backToRulesButton",{defaultMessage:"Rules"});const i=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.enableRuleLabel",{defaultMessage:"Enable"}),r=(n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.unknownDescription",{defaultMessage:"Unknown"}),n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExceptionsTab",{defaultMessage:"Rule exceptions"})),s=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.endpointExceptionsTab",{defaultMessage:"Endpoint exceptions"}),o=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionResultsTab",{defaultMessage:"Execution results"}),l=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionEventsTab",{defaultMessage:"Execution events"}),c=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.deletedRule",{defaultMessage:"Deleted rule"}),u=n.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.deleteRuleConfirmationBody",{defaultMessage:'This action will delete the rule. Click "Delete" to continue.'})},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(2);const i=({onInit:e,onFinish:t})=>{const a=Object(n.useRef)(),i=Object(n.useCallback)((()=>{var e;null===(e=a.current)||void 0===e||e.call(a,!0)}),[]),r=Object(n.useCallback)((()=>{var e;null===(e=a.current)||void 0===e||e.call(a,!1)}),[]);return[Object(n.useCallback)((()=>(e(),new Promise((e=>{a.current=e})).finally((()=>{t()})))),[e,t]),i,r]}},,function(e,t,a){"use strict";a.d(t,"a",(function(){return bt}));var n=a(2),i=a.n(n),r=a(40),s=a(41),o=a.n(s),l=a(102);const c="commandInputHistory";var u=a(295),d=a(0),p=a.n(d);class parsed_command_input_ParsedCommand{constructor(e){p()(this,"name",void 0),p()(this,"args",void 0),p()(this,"hasArgs",void 0),this.input=e;const t=(e=>{const t=e.trim(),a={name:b(t),args:{}};if(!t)return a;const n=t.indexOf(" "),i=-1===n?[]:t.substring(n).trim().split(/--/);for(const e of i){const t=e.trim();if(t){const e=/[ =]/.exec(t),n=(e?t.substring(0,e.index).trim():t).trim();if(n)if(a.args[n]||(a.args[n]=[]),n!==t&&e){let i=t.substring(e.index+1).trim().replace(/\\-\\-/g,"--");'"'===i.charAt(0)&&(i=i.substring(1)),'"'===i.charAt(i.length-1)&&(i=i.substring(0,i.length-1)),a.args[n].push(i)}else a.args[n].push(!0)}}return a})(e);this.name=t.name,this.args=t.args,this.hasArgs=Object.keys(this.args).length>0}hasArg(e){return e in this.args}}const m=e=>new parsed_command_input_ParsedCommand(e),b=e=>{const t=e.trimStart();if(!t)return"";const a=e.indexOf(" ");return-1===a?t:t.substring(0,a)},g=e=>{let t="",a="";const n=[];if(e.args)for(const[i,r]of Object.entries(e.args))r.required?(t.length&&(t+=" "),t+=`--${i}`):r.exclusiveOr?n.push(`--${i}`):(a.length&&(a+=" "),a+=`--${i}`);const i=({required:e,exclusive:t,optional:a})=>`${e||""}${t?` ${t}`:""} ${a&&a.length>0?`[${a}]`:""}`.trim();return n.length>0?n.map((e=>i({required:t,exclusive:e,optional:a}))):t||a?[i({required:t,optional:a})]:[]};var f=a(5),y=a(47);const h=f.i18n.translate("xpack.securitySolution.handleInputAreaState.inputPlaceholderText",{defaultMessage:"Submit response action"}),v=(e,t)=>{if(t&&t.argsWithValueSelectors)for(const n of Object.keys(t.argsWithValueSelectors))if(e.hasArg(n)){var a;const i=null!==(a=t.argState[n])&&void 0!==a?a:[];e.args[n]=i.map((e=>e.value))}},E=(e,{type:t,payload:a})=>{var n;switch(t){case"updateInputPopoverState":if(e.input.showPopover!==a.show)return{...e,input:{...e.input,showPopover:a.show}};break;case"updateInputHistoryState":return{...e,input:{...e.input,history:[{id:Object(y.v4)(),input:a.command,display:null!==(n=a.display)&&void 0!==n?n:a.command},...e.input.history.slice(0,99)]}};case"clearInputHistoryState":return{...e,input:{...e.input,history:[]}};case"updateInputTextEnteredState":const{leftOfCursorText:t,rightOfCursorText:o="",argState:l}="function"==typeof a?a(e.input):a;if(e.input.leftOfCursorText!==t||e.input.rightOfCursorText!==o){var i;const a=m(t+o);let n=e.input.enteredCommand;if(n&&l&&(null===(i=n)||void 0===i?void 0:i.argState)!==l&&(n={...n,argState:l}),a.name&&(!n||a.name!==n.commandDefinition.name)||!a.name&&n){n=void 0;const t=e.commands.find((e=>e.name===a.name));if(t){let e;for(const[a,n]of Object.entries(null!==(r=t.args)&&void 0!==r?r:{})){var r;n.SelectorComponent&&(e||(e={}),e[a]=n)}n={argState:{},commandDefinition:t,argsWithValueSelectors:e}}}return v(a,n),{...e,input:{...e.input,leftOfCursorText:t,rightOfCursorText:o,parsedInput:a,enteredCommand:n}}}break;case"updateInputPlaceholderState":if(e.input.placeholder!==a.placeholder)return{...e,input:{...e.input,placeholder:a.placeholder||h}};break;case"setInputState":if(e.input.visibleState!==a.value)return{...e,input:{...e.input,visibleState:a.value}};break;case"updateInputCommandArgState":if(e.input.enteredCommand){var s;const{name:t,instance:n,state:i}=a,r=[...null!==(s=e.input.enteredCommand.argState[t])&&void 0!==s?s:[]];r[n]=i;const o={...e.input.enteredCommand,argState:{...e.input.enteredCommand.argState,[t]:r}},l=m(e.input.leftOfCursorText+e.input.rightOfCursorText);return v(l,o),{...e,input:{...e.input,parsedInput:l,enteredCommand:o}}}}return e};var x=a(44),j=a(229);const S=Object.freeze({mustHaveValue:e=>f.i18n.translate("xpack.securitySolution.console.commandValidation.mustHaveValue",{defaultMessage:"Argument --{argName} must have a value",values:{argName:e}}),mustBeNumber:e=>f.i18n.translate("xpack.securitySolution.console.commandValidation.mustBeNumber",{defaultMessage:"Argument --${argName} value must be a number",values:{argName:e}}),mustBeGreaterThanZero:e=>f.i18n.translate("xpack.securitySolution.console.commandValidation.mustBeGreaterThanZero",{defaultMessage:"Argument --{argName} value must be greater than zero",values:{argName:e}}),NO_ARGUMENTS_SUPPORTED:f.i18n.translate("xpack.securitySolution.console.commandValidation.noArgumentsSupported",{defaultMessage:"Command does not support any arguments"}),missingRequiredArg:e=>f.i18n.translate("xpack.securitySolution.console.commandValidation.missingRequiredArg",{defaultMessage:"Missing required argument: --{argName}",values:{argName:e}}),unsupportedArg:e=>f.i18n.translate("xpack.securitySolution.console.commandValidation.unsupportedArg",{defaultMessage:"Unsupported argument: --{argName}",values:{argName:e}}),noMultiplesAllowed:e=>f.i18n.translate("xpack.securitySolution.console.commandValidation.argSupportedOnlyOnce",{defaultMessage:"Argument can only be used once: --{argName}",values:{argName:e}}),argValueValidatorError:(e,t)=>f.i18n.translate("xpack.securitySolution.console.commandValidation.invalidArgValue",{defaultMessage:"Invalid argument value: --{argName}. {error}",values:{argName:e,error:t}}),missingArguments:e=>f.i18n.translate("xpack.securitySolution.console.commandValidation.mustHaveArgs",{defaultMessage:"Missing required arguments: {missingArgs}",values:{missingArgs:e}}),MUST_HAVE_AT_LEAST_ONE_ARG:f.i18n.translate("xpack.securitySolution.console.commandValidation.oneArgIsRequired",{defaultMessage:"At least one argument must be used"}),onlyOneFromExclusiveOr:e=>i.a.createElement(j.a,null,i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.commandValidation.exclusiveOr",defaultMessage:"This command supports only one of the following arguments: {argNames}",values:{argNames:i.a.createElement(j.a,{bold:!0,inline:!0},e)}})),unknownArgument:(e,t,a)=>i.a.createElement(j.a,null,i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.commandValidation.unknownArgument",defaultMessage:"The following {command} {countOfInvalidArgs, plural, =1 {argument is} other {arguments are}} not supported by this command: {unknownArgs}",values:{countOfInvalidArgs:e,command:i.a.createElement(j.a,{bold:!0,inline:!0},t),unknownArgs:i.a.createElement(j.a,{bold:!0,inline:!0},a)}}))});var k=a(107);const O=(e="")=>{const t=oe().state.dataTestSubj;return t?t+(e?`-${e}`:""):""},w=f.i18n.translate("xpack.securitySolution.console.unsupportedMessageCallout.title",{defaultMessage:"Unsupported"}),T=Object(n.memo)((({children:e,header:t=w,"data-test-subj":a})=>i.a.createElement("div",{"data-test-subj":a},i.a.createElement(r.EuiText,{size:"s"},i.a.createElement(r.EuiTextColor,{color:"danger"},t)),i.a.createElement(r.EuiSpacer,{size:"s"}),e)));T.displayName="UnsupportedMessageCallout";const I={className:"euiTruncateText"},C=Object(n.memo)((({commandDef:e})=>{const t=Object(n.useMemo)((()=>g(e).map(((t,a)=>i.a.createElement(i.a.Fragment,{key:`helpUsage-${a}`},a>0&&i.a.createElement(r.EuiSpacer,{size:"xs"}),i.a.createElement(j.a,null,`${e.name} ${t}`))))),[e]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiDescriptionList,{compressed:!0,type:"column",className:"descriptionList-20_80",listItems:[{title:i.a.createElement(j.a,null,f.i18n.translate("xpack.securitySolution.console.commandUsage.inputUsage",{defaultMessage:"Usage"})),description:t&&t.length>0?t:e.name}],descriptionProps:I,titleProps:I}),i.a.createElement(r.EuiSpacer,{size:"s"}),e.exampleUsage&&i.a.createElement(r.EuiDescriptionList,{compressed:!0,type:"column",className:"descriptionList-20_80",listItems:[{title:i.a.createElement(j.a,null,f.i18n.translate("xpack.securitySolution.console.commandUsage.exampleUsage",{defaultMessage:"Example"})),description:i.a.createElement(j.a,null,e.exampleUsage)}],descriptionProps:I,titleProps:I}))}));C.displayName="CommandInputUsage";const M=Object(n.memo)((({commandDef:e,errorMessage:t})=>{const a=Object(k.a)(O()),s=Object(n.useMemo)((()=>{var t;return Object.keys(null!==(t=e.args)&&void 0!==t?t:[]).length>0}),[e.args]),o=Object(n.useMemo)((()=>s&&e.args?Object.entries(e.args).reduce(((e,t)=>{const a={title:`--${t[0]}`,description:t[1].about};return t[1].required?e.required.push(a):t[1].exclusiveOr?e.exclusiveOr.push(a):e.optional.push(a),e}),{required:[],exclusiveOr:[],optional:[]}):{required:[],exclusiveOr:[],optional:[]}),[e.args,s]),l=(t,n)=>{const s=n.map((e=>i.a.createElement("div",null,i.a.createElement(j.a,{bold:!0,inline:!0},e.title),i.a.createElement(j.a,{inline:!0}," - ",e.description))));return i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiSpacer,{size:"s"}),e.args&&i.a.createElement(r.EuiDescriptionList,{compressed:!0,type:"column",className:"descriptionList-20_80",listItems:[{title:i.a.createElement(j.a,null,t),description:s}],descriptionProps:I,titleProps:I,"data-test-subj":a("commandUsage-options")}))},c=Object(n.useCallback)((()=>t?i.a.createElement(T,{header:i.a.createElement(j.a,{textColor:"danger"},i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.validationError.title",defaultMessage:"Unsupported action"})),"data-test-subj":a("validationError")},i.a.createElement("div",{"data-test-subj":a("badArgument-message")},t),i.a.createElement(r.EuiSpacer,{size:"s"})):null),[t,a]);return i.a.createElement(r.EuiPanel,{paddingSize:"none",color:"transparent","data-test-subj":a("commandUsage")},c(),i.a.createElement(r.EuiDescriptionList,{compressed:!0,type:"column",className:"descriptionList-20_80",listItems:[{title:i.a.createElement(j.a,null,f.i18n.translate("xpack.securitySolution.console.commandUsage.about",{defaultMessage:"About"})),description:i.a.createElement(j.a,null,e.about)}],descriptionProps:I,titleProps:I,"data-test-subj":a("commandUsage-options")}),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(C,{commandDef:e}),o.required&&o.required.length>0&&l(f.i18n.translate("xpack.securitySolution.console.commandUsage.requiredLabel",{defaultMessage:"Required parameters"}),o.required),o.exclusiveOr&&o.exclusiveOr.length>0&&l(f.i18n.translate("xpack.securitySolution.console.commandUsage.exclusiveOr",{defaultMessage:"Include only one parameter"}),o.exclusiveOr),o.optional&&o.optional.length>0&&l(f.i18n.translate("xpack.securitySolution.console.commandUsage.optional",{defaultMessage:"Optional parameters"}),o.optional))}));M.displayName="CommandUsage";const _=Object(n.memo)((({title:e,children:t})=>{const a=Object(k.a)(O());return i.a.createElement(r.EuiPanel,{hasShadow:!1,color:"transparent",paddingSize:"none","data-test-subj":a("helpOutput")},t)}));_.displayName="HelpOutput";const F=Object(n.memo)((e=>{const t=e.command.commandDefinition.HelpComponent;return Object(n.useEffect)((()=>{t||e.setStatus("success")}),[t,e]),t?i.a.createElement(t,e):i.a.createElement(_,{command:e.command,title:f.i18n.translate("xpack.securitySolution.console.buildInCommand.helpArgument.helpTitle",{defaultMessage:"{cmdName} command",values:{cmdName:e.command.args.name}})},i.a.createElement(M,{commandDef:e.command.commandDefinition,errorMessage:e.store.errorMessage}))}));F.displayName="HelpCommandArgument";const A=Object(n.memo)((({command:e,setStatus:t})=>{const a=Object(k.a)(O()),s=Object(n.useMemo)((()=>i.a.createElement(j.a,null,i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.unknownCommand.helpMessage",defaultMessage:"The text you entered {userInput} is unsupported! Click {helpIcon} {boldHelp} or type {helpCmd} for assistance.",values:{userInput:i.a.createElement(j.a,{bold:!0,inline:!0},e.input),helpIcon:i.a.createElement(r.EuiIcon,{type:"help"}),helpCmd:i.a.createElement(j.a,{bold:!0,inline:!0},"help"),boldHelp:i.a.createElement("strong",null,i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.unknownCommand.helpMessage.help",defaultMessage:"Help"}))}}))),[e.input]);return Object(n.useEffect)((()=>{t("success")}),[t]),i.a.createElement(T,{header:i.a.createElement(j.a,{textColor:"danger"},i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.unknownCommand.title",defaultMessage:"Unsupported text/command"})),"data-test-subj":a("unknownCommandError")},s)}));A.displayName="UnknownCommand";const D=Object(n.memo)((({command:e,setStatus:t,store:a})=>{const s=Object(k.a)(O());return Object(n.useEffect)((()=>{t("success")}),[t]),i.a.createElement(T,{header:i.a.createElement(j.a,{textColor:"danger"},i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.badArgument.title",defaultMessage:"Unsupported argument"})),"data-test-subj":s("badArgument")},i.a.createElement("div",{"data-test-subj":s("badArgument-message")},a.errorMessage),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(C,{commandDef:e.commandDefinition}),i.a.createElement(j.a,null,i.a.createElement(r.EuiSpacer,{size:"m"}),i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.badArgument.helpMessage",defaultMessage:"Enter {helpCmd} for further assistance.",values:{helpCmd:i.a.createElement(j.a,{bold:!0,inline:!0},`${e.commandDefinition.name} --help`)}})))}));D.displayName="BadArgument";const N=Object(n.memo)((({command:e,setStatus:t,store:a})=>{const s=Object(k.a)(O());return Object(n.useEffect)((()=>{t("success")}),[t]),i.a.createElement(T,{header:i.a.createElement(j.a,{textColor:"error"},i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.validationError.title",defaultMessage:"Unsupported action"})),"data-test-subj":s("validationError")},i.a.createElement("div",{"data-test-subj":s("validationError-message")},a.errorMessage),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(C,{commandDef:e.commandDefinition}),i.a.createElement(j.a,null,i.a.createElement(r.EuiSpacer,{size:"m"}),i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.validationError.helpMessage",defaultMessage:"Enter {helpCmd} for further assistance.",values:{helpCmd:i.a.createElement(j.a,{bold:!0,inline:!0},`${e.commandDefinition.name} --help`)}})))}));N.displayName="ValidationError";const P=e=>`--${e}`,R=(e,t)=>{const a=E(e,{type:"updateInputHistoryState",payload:{command:t.command.input,display:t.command.inputDisplay}});return a.commandHistory=[...e.commandHistory,t],a},L={name:"unknown-command",about:"unknown command",RenderComponent:()=>null},B=(e={})=>({status:"pending",store:e}),q=(e,t)=>({...e,commandDefinition:{...e.commandDefinition,RenderComponent:t}}),z=(e,t=B(),a=!0)=>({id:Object(y.v4)(),isValid:a,enteredAt:(new Date).toISOString(),command:e,state:t}),$=()=>oe().dispatch,V=Object(n.memo)((({status:e,setStatus:t})=>{const a=$();return Object(n.useEffect)((()=>{"pending"===e&&a({type:"clear"}),t("success")}),[e,t,a]),null}));V.displayName="ClearCommand";var U=a(8);const H=e=>{if(!e.mustHaveArgs||!e.args)return e.name;let t=!1;const a=Object.entries(e.args).reduce(((e,[a,n])=>n.required?(e[a]=n,e):n.exclusiveOr&&!t?(t=!0,e[a]=n,e):e),{});return`${e.name} --${Object.keys(a).join(" --")}`},G=f.i18n.translate("xpack.securitySolution.console.commandList.otherCommandsGroup.label",{defaultMessage:"Other commands"}),Q=e=>e.replace(/[^A-Za-z0-9]/g,""),W=o()(r.EuiBasicTable).withConfig({displayName:"StyledEuiBasicTable",componentId:"sc-10x4uz4-0"})(["margin-top:",";.euiTableHeaderCell{.euiTableCellContent__text{color:",";font-size:",";padding-bottom:",";padding-left:",";}}"],(({theme:{eui:e}})=>e.euiSizeS),(({theme:{eui:e}})=>e.euiTextColor),(({theme:{eui:e}})=>e.euiFontSize),(({theme:{eui:e}})=>e.euiSizeS),(({theme:{eui:e}})=>e.euiSizeS)),K=o()(r.EuiCallOut).withConfig({displayName:"StyledEuiCallOut",componentId:"sc-10x4uz4-1"})(["margin:",";padding:",";border-radius:",";"],(({theme:{eui:e}})=>e.euiSize),(({theme:{eui:e}})=>e.euiSize),(({theme:{eui:e}})=>e.euiSizeXS)),Y=o()(r.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-10x4uz4-2"})(["padding-left:",";"],(({theme:{eui:e}})=>e.euiSizeS)),J=o()(r.EuiFlexGrid).withConfig({displayName:"StyledEuiFlexGrid",componentId:"sc-10x4uz4-3"})(["@media only screen and (min-width:","){max-width:75%;}@media only screen and (min-width:","){max-width:50%;}"],(e=>e.theme.eui.euiBreakpoints.l),(e=>e.theme.eui.euiBreakpoints.xl)),X=o()(r.EuiBadge).withConfig({displayName:"StyledEuiBadge",componentId:"sc-10x4uz4-4"})(["font-size:10px !important;span{color:"," !important;}"],(({theme:{eui:e}})=>e.euiShadowColor)),Z=Object(n.memo)((({commands:e,display:t="default"})=>{const a=Object(k.a)(O("commandList")),s=$(),{docLinks:o}=Object(l.j)().services,c=Object(n.useMemo)((()=>{var e;return i.a.createElement(r.EuiDescriptionList,{compressed:!0,listItems:[{title:i.a.createElement(X,null,i.a.createElement(j.a,{inline:!0,bold:!0},null===(e=ne.find((e=>"--help"===e.name)))||void 0===e?void 0:e.name)),description:i.a.createElement(r.EuiText,{color:"subdued",size:"xs"},i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.commandList.footerText",defaultMessage:"For more help with the individual commands use the --help argument. Ex: processes --help"}))}]})}),[]),u=Object(n.useCallback)((e=>()=>{s({type:"updateInputTextEnteredState",payload:()=>({leftOfCursorText:e,rightOfCursorText:""})}),s({type:"addFocusToKeyCapture"})}),[s]),d=Object(n.useMemo)((()=>{const t=new Map,a=e.filter((e=>!0!==e.helpHidden));for(const e of a){const{helpGroupLabel:a=G,helpGroupPosition:n=1/0}=e,i=t.get(a);i?(i.list.push(e),i.position===1/0&&void 0!==n&&n!==i.position&&(i.position=n)):t.set(e.helpGroupLabel,{label:a,position:n,list:[e]})}return Object(U.sortBy)(Array.from(t.values()),"position").map((e=>{const t=e.list.map((e=>void 0===e.helpCommandPosition?{...e,helpCommandPosition:1/0}:e));return Object(U.sortBy)(t,"helpCommandPosition")}))}),[e]),p=Object(n.useCallback)((e=>e[0].helpGroupLabel===ae.supporting.label?[...ne,...e].map((t=>{var a,n;return{[null!==(a=null===(n=e[0])||void 0===n?void 0:n.helpGroupLabel)&&void 0!==a?a:G]:t}})):e.map((t=>{var a,n;return{[null!==(a=null===(n=e[0])||void 0===n?void 0:n.helpGroupLabel)&&void 0!==a?a:G]:t}}))),[]),m=Object(n.useCallback)((e=>{var t,n;const s=null!==(t=null===(n=e[0])||void 0===n?void 0:n.helpGroupLabel)&&void 0!==t?t:G,o=Q(s);return[{field:s,name:i.a.createElement("div",{"data-test-subj":a("group")},s),render:e=>{const t=H(e);return i.a.createElement(Y,{alignItems:"center","data-test-subj":a(`${o}-${e.name}`)},i.a.createElement(r.EuiFlexItem,{grow:1},i.a.createElement(r.EuiDescriptionList,{"data-test-subj":a("command"),listItems:[{title:i.a.createElement(r.EuiBadge,{"data-test-subj":a("commandName")},t),description:i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiSpacer,{size:"xs"}),i.a.createElement(r.EuiText,{color:"subdued",size:"xs"},e.about))}]})),e.helpGroupLabel!==ae.supporting.label&&!0!==e.helpHidden&&e.RenderComponent&&i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiToolTip,{content:!0===e.helpDisabled?f.i18n.translate("xpack.securitySolution.console.commandList.disabledButtonTooltip",{defaultMessage:"Unsupported command"}):f.i18n.translate("xpack.securitySolution.console.commandList.addButtonTooltip",{defaultMessage:"Add to text bar"})},i.a.createElement(r.EuiButtonIcon,{iconType:"plusInCircle","aria-label":`updateTextInputCommand-${e.name}`,onClick:u(`${t} `),isDisabled:!0===e.helpDisabled,"data-test-subj":a(`${o}-${e.name}-addToInput`)}))))}}]}),[a,u]),b=Object(n.useCallback)((e=>e.filter((e=>"help"!==e.name&&"clear"!==e.name))),[]);if("table"===t){const e=[i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.commandList.callout.multipleResponses",defaultMessage:"You can enter consecutive response actions — no need to wait for previous actions to complete."}),i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.commandList.callout.leavingResponder",defaultMessage:"Leaving the response console does not terminate any actions that have been submitted."}),i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.commandList.callout.visitSupportSections",defaultMessage:"{learnMore} about response actions and using the console.",values:{learnMore:i.a.createElement(r.EuiLink,{href:o.links.securitySolution.responseActions,target:"_blank","data-test-subj":a("helpfulHintDocLink")},i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.commandList.callout.readMoreLink",defaultMessage:"Learn more"}))}})],t=i.a.createElement(K,{title:i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.commandList.callout.title",defaultMessage:"Helpful tips:"}),"data-test-subj":a("helpfulTips")},i.a.createElement("ul",null,e.map(((e,t)=>i.a.createElement("li",{key:t},i.a.createElement(r.EuiText,{size:"s"},e))))));return i.a.createElement("div",{"data-test-subj":a()},d.map(((e,t)=>{var n;return i.a.createElement(W,{"data-test-subj":a(Q(null!==(n=e[0].helpGroupLabel)&&void 0!==n?n:G)),key:`styledEuiBasicTable-${t}`,items:p(e),columns:m(e)})})),t)}return i.a.createElement("div",{"data-test-subj":a()},i.a.createElement(r.EuiSpacer,{size:"s"}),d.map((e=>{const t=e[0].helpGroupLabel,n=b(e);return 0===n.length?null:i.a.createElement(J,{columns:3,responsive:!1,gutterSize:"l",key:t,direction:"column"},n.map((e=>{const t=H(e);return i.a.createElement(r.EuiFlexItem,{key:e.name},i.a.createElement(r.EuiDescriptionList,{compressed:!0,listItems:[{title:i.a.createElement(r.EuiToolTip,{content:t},i.a.createElement(X,null,i.a.createElement(j.a,{inline:!0,bold:!0},t))),description:i.a.createElement(r.EuiText,{color:"subdued",size:"xs"},e.about)}],"data-test-subj":a("command")}))})))})),i.a.createElement(r.EuiSpacer,{size:"xl"}),c)}));Z.displayName="CommandList";const ee=()=>oe().state.commands,te=Object(n.memo)((e=>{const t=ee(),a=oe().state.HelpComponent;return Object(n.useEffect)((()=>{a||e.setStatus("success")}),[a,e]),a?i.a.createElement(a,e):i.a.createElement(_,{command:e.command,title:f.i18n.translate("xpack.securitySolution.console.builtInCommands.help.helpTitle",{defaultMessage:"Available commands"})},i.a.createElement(Z,{commands:t}))}));te.displayName="HelpCommand";const ae=Object.freeze({supporting:{label:f.i18n.translate("xpack.securitySolution.console.builtInCommands.groups.supporting",{defaultMessage:"Supporting commands & parameters"})}}),ne=Object.freeze([{name:"--comment",about:f.i18n.translate("xpack.securitySolution.console.commandList.commonArgs.comment",{defaultMessage:"Add comment to any action Ex: isolate --comment your comment"})},{name:"--help",about:f.i18n.translate("xpack.securitySolution.console.commandList.commonArgs.help",{defaultMessage:"Command assistance Ex: isolate --help"})}]),ie=(e,t)=>{var a,n,r,s;let o=e;switch(t.type){case"scrollDown":e.scrollToBottom();break;case"addFocusToKeyCapture":null===(a=e.keyCapture)||void 0===a||null===(n=a.current)||void 0===n||n.focus();break;case"removeFocusFromKeyCapture":null===(r=e.keyCapture)||void 0===r||null===(s=r.current)||void 0===s||s.blur();break;case"updateFooterContent":e.footerContent!==t.payload.value&&(o={...e,footerContent:t.payload.value});break;case"executeCommand":o=((e,t)=>{const{parsedInput:a,enteredCommand:n,input:r}=t.payload;if(""===a.name)return e;const s=null==n?void 0:n.commandDefinition;if(!s)return R(e,z({input:a.input,inputDisplay:r,args:a,commandDefinition:{...L,RenderComponent:A}},void 0,!1));const o={input:a.input,inputDisplay:r,args:a,commandDefinition:s},l=(c=s.args)?Object.entries(c).filter((([e,t])=>t.required)).map((([e])=>e)):[];var c;const u=(e=>e?Object.entries(e).reduce(((e,[t,a])=>(a.exclusiveOr&&e.push(t),e)),[]):[])(s.args),d=S.onlyOneFromExclusiveOr(u.map(P).join(", "));if(a.hasArgs){if(a.hasArg("help")){if(Object.keys(a.args).length>1||a.args.help.length>1||!0!==a.args.help[0])return R(e,z(q(o,D),void 0,!1));if(null!=s&&s.validate){const t=s.validate(o);if(!0!==t)return R(e,z(q(o,F),B({errorMessage:t}),!1))}return R(e,z(q(o,F),void 0,!1))}if(!s.args||0===Object.keys(s.args).length)return R(e,z(q(o,D),B({errorMessage:S.NO_ARGUMENTS_SUPPORTED}),!1));const t=((e,t)=>{const a=[];return Object.keys(e).forEach((e=>{"help"===e||t&&t[e]||a.push(e)})),a})(a.args,s.args);if(t.length)return R(e,z(q(o,D),B({errorMessage:S.unknownArgument(t.length,a.name,t.map(P).join(", "))}),!1));for(const t of l)if(!a.args[t])return R(e,z(q(o,D),B({errorMessage:i.a.createElement(j.a,null,S.missingRequiredArg(t))}),!1));if(u.filter((e=>a.args[e])).length>1)return R(e,z(q(o,D),B({errorMessage:d}),!1));for(const t of Object.keys(a.args)){var p;const n=null===(p=s.args)||void 0===p?void 0:p[t],r=a.args[t];if(!n)return R(e,z(q(o,D),B({errorMessage:i.a.createElement(j.a,null,S.unsupportedArg(t))}),!1));if(!n.allowMultiples&&Array.isArray(r)&&r.length>1)return R(e,z(q(o,D),B({errorMessage:i.a.createElement(j.a,null,S.noMultiplesAllowed(t))}),!1));if(void 0!==n.mustHaveValue&&!1!==n.mustHaveValue){let a="";if(0===r.length?a=S.mustHaveValue(t):r.some(((e,i)=>{switch(n.mustHaveValue){case!0:case"non-empty-string":("boolean"==typeof e||"non-empty-string"===n.mustHaveValue&&0===e.trim().length)&&(a=S.mustHaveValue(t));break;case"truthy":e||(a=S.mustHaveValue(t));break;case"number":case"number-greater-than-zero":{const s=Number(e);Number.isSafeInteger(s)?"number-greater-than-zero"===n.mustHaveValue&&s<=0&&(a=S.mustBeGreaterThanZero(t)):a=S.mustBeNumber(t),a||(r[i]=s)}}return!!a})),a)return R(e,z(q(o,D),B({errorMessage:i.a.createElement(j.a,null,a)}),!1))}if(n.validate){const a=n.validate(r);if(!0!==a)return R(e,z(q(o,D),B({errorMessage:i.a.createElement(j.a,null,S.argValueValidatorError(t,a))}),!1))}}}else{if(l.length>0)return R(e,z(q(o,D),B({errorMessage:i.a.createElement(j.a,null,S.missingArguments(l.map((e=>P(e))).join(", ")))}),!1));if(u.length>0)return R(e,z(q(o,D),B({errorMessage:d}),!1));if(s.mustHaveArgs)return R(e,z(q(o,D),B({errorMessage:i.a.createElement(j.a,null,S.MUST_HAVE_AT_LEAST_ONE_ARG)}),!1))}if(s.validate){const t=s.validate(o);if(!0!==t)return R(e,z(q(o,N),B({errorMessage:t}),!1))}return R(e,z(o))})(e,t);break;case"updateCommandStatusState":case"updateCommandStoreState":o=((e,{type:t,payload:{id:a,value:n}})=>{let i=!1;const r=e.commandHistory.map((e=>{if(i||e.id!==a)return e;i=!0;const r={...e,state:{...e.state}};switch(t){case"updateCommandStoreState":r.state.store=n(r.state.store);break;case"updateCommandStatusState":if(r.state.status===n)return i=!1,e;r.state.status=n}return r}));return i?{...e,commandHistory:r}:e})(e,t);break;case"showSidePanel":o=((e,t)=>"showSidePanel"===t.type&&e.sidePanel.show!==t.payload.show?{...e,sidePanel:{...e.sidePanel,show:t.payload.show}}:e)(e,t);break;case"updateInputPopoverState":case"updateInputHistoryState":case"clearInputHistoryState":case"updateInputTextEnteredState":case"updateInputPlaceholderState":case"setInputState":case"updateInputCommandArgState":o=E(e,t);break;case"clear":o={...e,commandHistory:[]}}return o},re=Object(n.createContext)(null),se=Object(n.memo)((({commands:e,scrollToBottom:t,keyCapture:a,HelpComponent:r,dataTestSubj:s,storagePrefix:o,managedKey:d,children:p})=>{const[b,g]=Object(u.d)(d),y=(e=>{const{storage:t}=Object(l.j)().services;return Object(n.useMemo)((()=>{if(e){var a;const n=null!==(a=t.get(`${e}.${c}`))&&void 0!==a?a:{version:2,data:[]};return 2!==n.version&&(e=>{const{data:t,version:a}=e;for(const e of t)a<2&&(e.display=e.input);e.version=2})(n),n.data}return[]}),[t,e])})(o),v=(e=>{const{storage:t}=Object(l.j)().services;return Object(n.useCallback)((a=>{if(e){const n={version:2,data:a};t.set(`${e}.${c}`,n)}}),[t,e])})(o),E=Object(n.useCallback)((e=>{const t=(({commands:e,...t},a)=>{const n=[{name:"help",about:f.i18n.translate("xpack.securitySolution.console.builtInCommands.helpAbout",{defaultMessage:"List all available commands"}),RenderComponent:te,helpGroupLabel:ae.supporting.label,helpCommandPosition:1},{name:"clear",about:f.i18n.translate("xpack.securitySolution.console.builtInCommands.clearAbout",{defaultMessage:"Clear console screen"}),RenderComponent:V,helpGroupLabel:ae.supporting.label,helpCommandPosition:0}].concat(e),i=null!=a?a:{commands:n,...t,commandHistory:[],sidePanel:{show:null},footerContent:"",input:{leftOfCursorText:"",rightOfCursorText:"",parsedInput:m(""),enteredCommand:void 0,placeholder:h,showPopover:void 0,history:[],visibleState:void 0}};return a&&Object.assign(i,{commands:n,...t}),i})(e,b?b():void 0);return t.input.history=y,t}),[b,y]),[x,j]=Object(n.useReducer)(ie,{commands:e,scrollToBottom:t,keyCapture:a,HelpComponent:r,dataTestSubj:s,storagePrefix:o},E);return Object(n.useEffect)((()=>{g&&g(x)}),[x,g]),Object(n.useEffect)((()=>{o&&x.input.history&&v(x.input.history)}),[v,x.input.history,o]),i.a.createElement(re.Provider,{value:{state:x,dispatch:j}},p)}));se.displayName="ConsoleStateProvider";const oe=()=>{const e=Object(n.useContext)(re);if(!e)throw new Error("ConsoleStateContext not defined");return e},le=()=>oe().state.input.visibleState,ce=Object(n.memo)((()=>{const e=oe().state.footerContent,t=Object(k.a)(O()),a=le(),s=Object(n.useMemo)((()=>"error"===a?"danger":"subdued"),[a]);return i.a.createElement(r.EuiPanel,{hasShadow:!1,paddingSize:"none",color:"transparent","data-test-subj":t("footer")},i.a.createElement(r.EuiText,{size:"xs",color:s,className:"font-style-italic"},e||i.a.createElement(i.a.Fragment,null," ")))}));ce.displayName="ConsoleFooter";const ue=()=>oe().state.sidePanel,de=(f.i18n.translate("xpack.securitySolution.console.layoutHeader.helpButtonTitle",{defaultMessage:"Help"}),f.i18n.translate("xpack.securitySolution.console.layoutHeader.helpButtonLabel",{defaultMessage:"Show help"})),pe=o()(r.EuiButtonEmpty).withConfig({displayName:"StyledEuiButtonEmpty",componentId:"sc-lvlnbi-0"})(["margin-left:auto;height:inherit;"]),me=Object(n.memo)((({TitleComponent:e})=>{const t=$(),a=ue().show,s=Object(k.a)(O("header")),o="help"===a,l=Object(n.useCallback)((()=>{t({type:"showSidePanel",payload:{show:o?null:"help"}})}),[t,o]);return i.a.createElement(r.EuiFlexGroup,{gutterSize:"none",alignItems:"center",justifyContent:"spaceBetween",responsive:!1},i.a.createElement(r.EuiFlexItem,{grow:1,className:"eui-textTruncate noThemeOverrides","data-test-subj":s("titleComponentContainer")},e?i.a.createElement(e,null):""),!o&&i.a.createElement(r.EuiFlexItem,{grow:1},i.a.createElement(pe,{style:{marginLeft:"auto"},onClick:l,iconType:"help",title:de,"aria-label":de,isSelected:o,"data-test-subj":s("helpButton")},i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.layoutHeader.helpButtonTitle",defaultMessage:"Help"}))))}));me.displayName="ConsoleHeader";var be=a(104),ge=a.n(be),fe=a(53),ye=a.n(fe);const he=()=>{const{leftOfCursorText:e,rightOfCursorText:t,parsedInput:a,enteredCommand:i}=oe().state.input;return Object(n.useMemo)((()=>({leftOfCursorText:e,rightOfCursorText:t,parsedInput:a,enteredCommand:i,fullTextEntered:e+t})),[i,e,a,t])},ve=o.a.div.withConfig({displayName:"InputDisplayContainer",componentId:"sc-cduvts-0"})(["overflow:hidden !important;.inputDisplay{& > *{flex-direction:row;align-items:center;}}.cursor{display:inline-block;width:1px;height:","em;background-color:",";}"],(({theme:{eui:e}})=>e.euiLineHeight),(({theme:e})=>e.eui.euiTextSubduedColor)),Ee=Object(n.memo)((({leftOfCursor:e,rightOfCursor:t})=>{const a=Object(k.a)(O()),s=$(),{leftOfCursorText:o,fullTextEntered:l}=he(),c=Object(n.useRef)(null),u=Object(n.useRef)(null),d=Object(n.useRef)(null),p=o.length,m=Object(n.useCallback)((e=>{const t=e.target;if(l.length&&t.classList&&t.classList.contains("chr")){const a=Array.from(e.currentTarget.querySelectorAll("span.chr")).indexOf(t),n=l.substring(0,a+1),i=l.substring(a+1);s({type:"updateInputTextEnteredState",payload:{leftOfCursorText:n,rightOfCursorText:i}})}}),[s,l]);return Object(n.useEffect)((()=>{if(u.current){const e=e=>{if(u.current){const t=e[0];if(t&&t.rootBounds){const e=u.current.scrollLeft,a=t.rootBounds.right,n=t.rootBounds.left,i=t.boundingClientRect.right;if(i>a-20){const a=e+(i-t.rootBounds.width)+20;u.current.scrollLeft=a}else if(i<n+20){const t=i-20<0?0:e-20;u.current.scrollLeft=t}}}};return c.current=new IntersectionObserver(e,{root:u.current,rootMargin:"0px -10px",threshold:0}),()=>{var e;null===(e=c.current)||void 0===e||e.disconnect(),c.current=null}}}),[]),Object(n.useEffect)((()=>{if(c.current&&d.current){const e=c.current,t=d.current;return e.observe(t),()=>{e.unobserve(t)}}}),[p]),i.a.createElement(ve,{ref:u},i.a.createElement(r.EuiFlexGroup,{responsive:!1,alignItems:"center",gutterSize:"none",className:"inputDisplay",onClick:m},i.a.createElement(r.EuiFlexItem,{grow:!1,"data-test-subj":a("cmdInput-leftOfCursor"),className:"noMinWidth"},e),i.a.createElement(r.EuiFlexItem,{grow:!1,className:"noMinWidth"},i.a.createElement("span",{className:"cursor essentialAnimation",ref:d})),i.a.createElement(r.EuiFlexItem,{className:"noMinWidth","data-test-subj":a("cmdInput-rightOfCursor")},t)))}));Ee.displayName="InputDisplay";const xe=()=>oe().state.input.showPopover,je=o.a.span.withConfig({displayName:"ArgumentSelectorWrapperContainer",componentId:"sc-jnz75k-0"})(["border:",";border-radius:",";overflow:hidden;user-select:none;.flexGroup{align-items:stretch;}.selectorContainer{padding:0 ",";max-width:25vw;display:flex;align-items:center;height:100%;}.argNameContainer{background-color:",";}.argName{padding-left:",";height:100%;display:flex;align-items:center;white-space:nowrap;}"],(({theme:{eui:e}})=>e.euiBorderThin),(({theme:{eui:e}})=>e.euiBorderRadiusSmall),(({theme:{eui:e}})=>e.euiSizeXS),(({theme:{eui:e}})=>e.euiFormInputGroupLabelBackground),(({theme:{eui:e}})=>e.euiSizeXS)),Se=Object(n.memo)((({argName:e,argIndex:t,argDefinition:{SelectorComponent:a}})=>{const s=$(),{valueText:o,value:l,store:c}=((e,t)=>{const a=oe().state.input.enteredCommand;return Object(n.useMemo)((()=>{var n;const i=null==a||null===(n=a.argState[e])||void 0===n?void 0:n.at(t);return null!=i?i:{value:void 0,valueText:""}}),[e,a,t])})(e,t),u=Object(n.useCallback)((a=>{s({type:"updateInputCommandArgState",payload:{name:e,instance:t,state:a}})}),[t,e,s]);return i.a.createElement(je,{className:"eui-displayInlineBlock"},i.a.createElement(r.EuiFlexGroup,{className:"flexGroup",responsive:!1,alignItems:"center",gutterSize:"none"},i.a.createElement(r.EuiFlexItem,{grow:!1,className:"argNameContainer"},i.a.createElement("div",{className:"argName"},i.a.createElement("span",null,`--${e}=`))),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement("div",{className:"selectorContainer noThemeOverrides eui-textTruncate"},i.a.createElement(a,{value:l,valueText:null!=o?o:"",argName:e,argIndex:t,store:c,onChange:u})))))}));Se.displayName="ArgumentSelectorWrapper";const ke=[""," ","="],Oe=(e={})=>({value:"",renderValue:null,isArgSelector:!1,argName:"",argIndex:0,argState:void 0,...e}),we=e=>e.split("").map((e=>Oe({value:e,renderValue:e}))),Te=(e,t,a)=>{var n;return i.a.createElement("span",{className:"chr",key:`${e}.${a}.${null!==(n=t.value)&&void 0!==n?n:"$"}`},t.renderValue)},Ie=(e,t)=>{let a=t.value;var n,i;return e&&t.isArgSelector&&(a+=`="${null!==(n=null===(i=t.argState)||void 0===i?void 0:i.valueText)&&void 0!==n?n:""}"`),a};class entered_input_EnteredInput{constructor(e,t,a,n){if(p()(this,"leftOfCursorContent",void 0),p()(this,"rightOfCursorContent",void 0),p()(this,"canHaveArgValueSelectors",void 0),p()(this,"argState",void 0),this.leftOfCursorContent=we(e),this.rightOfCursorContent=we(t),this.canHaveArgValueSelectors=Boolean(null==n?void 0:n.argsWithValueSelectors),a.hasArgs&&n&&n.argsWithValueSelectors){this.argState=n.argState;const s=[{input:e,items:this.leftOfCursorContent,side:"left"},{input:t,items:this.rightOfCursorContent,side:"right"}];for(const[e,o]of Object.entries(n.argsWithValueSelectors))if(a.hasArg(e)){let a=0;for(const{input:l,items:c,side:u}of s){const s=`--${e}`;let d=l.indexOf(s);for(;d>-1;){const p=s.length,m=d+p,b=l.charAt(m),g="left"===u&&""===b&&ke.includes(t.charAt(0));if(ke.includes(b)&&(g||"left"===u&&""!==b||"right"===u)){var r;const t=Array.from({length:p},Oe),l=null===(r=n.argState[e])||void 0===r?void 0:r.at(a);t[0]=Oe({value:s,renderValue:i.a.createElement(Se,{argName:e,argIndex:a,argDefinition:o}),isArgSelector:!0,argName:e,argIndex:a++,argState:l}),c.splice(d,p,...t)}d=l.indexOf(s,m)}}}this.leftOfCursorContent=this.leftOfCursorContent.filter((({value:e})=>e.length>0)),this.rightOfCursorContent=this.rightOfCursorContent.filter((({value:e})=>e.length>0))}}replaceSelection(e,t){const a=this.getFullText(),n=t?Oe({value:t}):void 0;let i=a.indexOf(e);const r=[...this.leftOfCursorContent,...this.rightOfCursorContent];this.canHaveArgValueSelectors&&r.forEach(((e,t)=>{e.isArgSelector&&t<i&&(i-=e.value.length-1)}));const s=r.splice(i,e.length);n&&(r.splice(i,0,n),i++),this.leftOfCursorContent=r.splice(0,i),this.rightOfCursorContent=r,this.removeArgState(s)}removeArgState(e){if(this.argState){let a=!1;const n={...this.argState};for(const{argName:i,argIndex:r,isArgSelector:s}of e){var t;s&&null!==(t=n[i])&&void 0!==t&&t.at(r)&&(n[i]=n[i].filter(((e,t)=>t!==r)),a=!0)}a&&(this.argState=n)}}getLeftOfCursorText(e=!1){return this.leftOfCursorContent.map(Ie.bind(null,e)).join("")}getRightOfCursorText(e=!1){return this.rightOfCursorContent.map(Ie.bind(null,e)).join("")}getFullText(e=!1){return this.getLeftOfCursorText(e)+this.getRightOfCursorText(e)}getLeftOfCursorRenderingContent(){return i.a.createElement(i.a.Fragment,null,this.leftOfCursorContent.map(Te.bind(null,"left")))}getRightOfCursorRenderingContent(){return i.a.createElement(i.a.Fragment,null,this.rightOfCursorContent.map(Te.bind(null,"right")))}getArgState(){return this.argState}moveCursorTo(e){switch(e){case"end":this.leftOfCursorContent.push(...this.rightOfCursorContent.splice(0));break;case"home":this.rightOfCursorContent.unshift(...this.leftOfCursorContent.splice(0));break;case"left":if(this.leftOfCursorContent.length){const e=this.leftOfCursorContent.pop();e&&this.rightOfCursorContent.unshift(e)}break;case"right":if(this.rightOfCursorContent.length){const e=this.rightOfCursorContent.shift();e&&this.leftOfCursorContent.push(e)}}}addValue(e,t=""){t.length&&e.length?this.replaceSelection(t,e):e&&this.leftOfCursorContent.push(Oe({value:e}))}deleteChar(e=""){if(e)this.replaceSelection(e,"");else{const e=this.rightOfCursorContent.shift();null!=e&&e.isArgSelector&&this.removeArgState([e])}}backspaceChar(e=""){if(e)this.replaceSelection(e,"");else{const e=this.leftOfCursorContent.pop();null!=e&&e.isArgSelector&&this.removeArgState([e])}}clear(){this.leftOfCursorContent=[],this.rightOfCursorContent=[],this.argState=void 0}}const Ce=f.i18n.translate("xpack.securitySolution.inputCapture.ariaPlaceHolder",{defaultMessage:"Enter a command"}),Me=()=>{const e=getSelection();e&&e.removeAllRanges()},_e=o.a.div.withConfig({displayName:"InputCaptureContainer",componentId:"sc-19dx6ae-0"})([".focus-container{outline:none !important;}.textSelectionBoundaryHelper{opacity:0;position:absolute;top:-100vh;left:-100vw;}.invisible-input{&,&:focus{border:none;outline:none;background-image:none;background-color:transparent;-webkit-box-shadow:none;-moz-box-shadow:none;box-shadow:none;animation:none !important;width:1ch !important;position:absolute;opacity:0;top:-100vh;left:-100vw;}"]),Fe=Object(n.memo)((({onCapture:e,focusRef:t,onChangeFocus:a,children:r})=>{const s=Object(k.a)(O()),o=Object(n.useRef)(null),l=Object(n.useRef)(null),c=Object(n.useRef)(null),u=Object(n.useCallback)((()=>{if(o.current){var e,t,a;const n=document.getSelection(),i=(null!==(e=null==n?void 0:n.toString())&&void 0!==e?e:"").replace(/[\r\n]/g,""),r=!(!o.current||!n)&&(null===(t=o.current)||void 0===t?void 0:t.contains(n.focusNode))&&(null===(a=o.current)||void 0===a?void 0:a.contains(n.anchorNode));return n&&0!==i.length&&r?i:""}return""}),[]),d=Object(n.useCallback)((t=>{if(t.metaKey||t.ctrlKey){if("a"===t.key){t.preventDefault();const e=window.getSelection();if(e&&l.current){const t=document.createRange();t.selectNodeContents(l.current),t.toString().length>0&&(e.removeAllRanges(),e.addRange(t))}}return}const a=/^[\w\d]{2}/.test(t.key)?"":t.key,n=u(),i=Object(U.pick)(t,["key","altKey","ctrlKey","keyCode","metaKey","repeat","shiftKey"]);e({value:a,selection:n,eventDetails:i}),n&&Me()}),[u,e]),p=Object(n.useCallback)((t=>{t.preventDefault(),t.stopPropagation();const a=t.clipboardData.getData("text").replace(/[\r\n]/g,""),n=u();e({value:a,selection:n,eventDetails:{altKey:!1,ctrlKey:!1,key:"Meta",keyCode:91,metaKey:!0,repeat:!1,shiftKey:!1}}),n&&Me()}),[u,e]),m=Object(n.useCallback)((()=>{a&&a(!0)}),[a]),b=Object(n.useCallback)((()=>{a&&a(!1)}),[a]),g=Object(n.useMemo)((()=>({focus:(e=!1)=>{var t,a,n;!e&&(null!==(t=null===(a=window.getSelection())||void 0===a?void 0:a.toString())&&void 0!==t?t:"").length>0||document.activeElement===c.current||null===(n=c.current)||void 0===n||n.focus()},blur:()=>{var e;c.current&&document.activeElement===c.current&&(null===(e=c.current)||void 0===e||e.blur())}})),[]);return t&&(t.current=g),i.a.createElement(_e,{"data-test-subj":s("inputCapture"),onKeyDown:d,onPaste:p},i.a.createElement("div",{role:"textbox","aria-placeholder":Ce,tabIndex:0,ref:o,className:"focus-container","data-test-subj":s("keyCapture-input"),onBlur:b,onFocus:m},i.a.createElement("div",{className:"textSelectionBoundaryHelper"}," "),i.a.createElement("div",{ref:l,className:"text-container"},r),i.a.createElement("div",{className:"textSelectionBoundaryHelper"}," "),i.a.createElement("input",{ref:c,type:"text",value:"",tabIndex:-1,onPaste:p,onChange:()=>{},spellCheck:"false",className:"invisible-input"})))}));Fe.displayName="InputCapture";const Ae=f.i18n.translate("xpack.securitySolution.useInputHints.noArguments",{defaultMessage:"Hit enter to execute"}),De=f.i18n.translate("xpack.securitySolution.useInputHints.viewInputHistory",{defaultMessage:"Press the up arrow key to access previously entered commands"}),Ne=o()(r.EuiText).withConfig({displayName:"InputPlaceholderContainer",componentId:"sc-6afwlc-0"})(["position:absolute;pointer-events:none;padding-left:0.5em;width:96%;color:",";user-select:none;"],(({theme:{eui:e}})=>e.euiFormControlPlaceholderText)),Pe=Object(n.memo)((()=>{const{fullTextEntered:e}=he(),t=oe().state.input.placeholder,a=Object(k.a)(O());return e.length>0?null:i.a.createElement(Ne,{size:"s",className:"eui-textTruncate","data-test-subj":a("inputPlaceholder")},i.a.createElement("div",{className:"eui-textTruncate"},t))}));Pe.displayName="InputPlaceholder";const Re=o()(r.EuiCode).withConfig({displayName:"StyledEuiCode",componentId:"sc-qp7srp-0"})(["padding-left:0;"]),Le=Object(n.memo)((({input:e,isValid:t=!0})=>{const a=Object(k.a)(O()),s=Object(n.useMemo)((()=>t?e:i.a.createElement(r.EuiTextColor,null,e)),[e,t]);return i.a.createElement(Re,{transparentBackground:!0,"data-test-subj":a("userCommandText")},s)}));Le.displayName="UserCommandInput";const Be=Object(n.memo)((()=>{const[e,t]=Object(n.useState)(!1),a=$(),s=Object(k.a)(O()),o=Object(n.useCallback)((()=>{t(!0)}),[]),l=Object(n.useCallback)((()=>{t(!1)}),[]),c=Object(n.useCallback)((()=>{a({type:"clearInputHistoryState"}),t(!1)}),[a]);return i.a.createElement(i.a.Fragment,null,e&&i.a.createElement(r.EuiConfirmModal,{title:f.i18n.translate("xpack.securitySolution.commandInputClearHistory.confirmTitle",{defaultMessage:"Clear input history"}),cancelButtonText:f.i18n.translate("xpack.securitySolution.commandInputClearHistory.confirmCancelButton",{defaultMessage:"Cancel"}),confirmButtonText:f.i18n.translate("xpack.securitySolution.commandInputClearHistory.confirmSubmitButton",{defaultMessage:"Clear"}),buttonColor:"danger",onCancel:l,onConfirm:c},i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.commandInputClearHistory.confirmMessage",defaultMessage:"This action cannot be undone. Are you sure you wish to continue?"})),i.a.createElement(r.EuiFlexGroup,{responsive:!1,justifyContent:"flexEnd",gutterSize:"none"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonEmpty,{size:"xs",tabIndex:-1,onClick:o,disabled:e,"data-test-subj":s("clearInputHistoryButton")},i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.commandInputClearHistory.clearHistoryButtonLabel",defaultMessage:"Clear input history"})))))}));Be.displayName="CommandInputClearHistory";const qe=f.i18n.translate("xpack.securitySolution.commandInputHistory.noHistoryEmptyMessage",{defaultMessage:"No commands have been entered"}),ze=f.i18n.translate("xpack.securitySolution.commandInputHistory.filterPlaceholder",{defaultMessage:"Filter previously entered actions"}),$e=f.i18n.translate("xpack.securitySolution.commandInputHistory.noFilteredMatchesFoundMessage",{defaultMessage:"No entries found matching the filter entered"}),Ve=Object(n.memo)((()=>{const e=$(),t=oe().state.input.history,[a]=Object(n.useState)(he()),s=Object(n.useRef)(!1),o=Object(k.a)(O()),l=Object(n.useMemo)((()=>t.map(((e,t)=>({label:e.display,key:e.id,data:e})))),[t]),c=Object(n.useMemo)((()=>({showIcons:!1,bordered:!0})),[]),u=Object(n.useMemo)((()=>({placeholder:ze,compressed:!0,fullWidth:!0})),[]),d=Object(n.useCallback)(((e,a)=>i.a.createElement(i.a.Fragment,null,e,i.a.createElement(r.EuiSpacer,{size:"s"}),t.length>0?a:i.a.createElement("div",{tabIndex:-1}))),[t.length]),p=Object(n.useCallback)((t=>{s.current=!0;const a=t.find((e=>"on"===e.checked));e({type:"updateInputPopoverState",payload:{show:void 0}}),e({type:"updateInputPlaceholderState",payload:{placeholder:""}}),a&&e({type:"updateInputTextEnteredState",payload:{leftOfCursorText:a.data.input,rightOfCursorText:""}}),e({type:"addFocusToKeyCapture"})}),[e]),m=Object(n.useCallback)((t=>{t&&e({type:"updateInputPlaceholderState",payload:{placeholder:t.data.input}})}),[e]),b=Object(n.useCallback)((e=>i.a.createElement(Le,{input:e.label})),[]);return Object(n.useEffect)((()=>(e({type:"updateInputTextEnteredState",payload:{leftOfCursorText:"",rightOfCursorText:""}}),()=>{s.current||(e({type:"updateInputTextEnteredState",payload:{leftOfCursorText:a.leftOfCursorText,rightOfCursorText:a.rightOfCursorText}}),e({type:"updateInputPlaceholderState",payload:{placeholder:""}}))})),[e,s,a]),i.a.createElement("div",null,t.length>0&&i.a.createElement(Be,null),i.a.createElement(r.EuiSelectable,{options:l,onChange:p,onActiveOptionChange:m,renderOption:b,listProps:c,singleSelection:!0,searchable:!0,searchProps:u,emptyMessage:qe,noMatchesMessage:$e,"data-test-subj":o("inputHistorySelector"),"data-console-input-history":!0},d))}));Ve.displayName="CommandInputHistory";const Ue=Object(n.memo)((({children:e,width:t="92vw"})=>{const a=Object(k.a)(O()),s=xe(),o=void 0!==s,l=$(),c=Object(n.useMemo)((()=>({width:t,borderBottomLeftRadius:0,borderBottomRightRadius:0})),[t]),u=Object(n.useMemo)((()=>({clickOutsideDisables:!0})),[]),d=Object(n.useCallback)((()=>{l({type:"updateInputPopoverState",payload:{show:void 0}}),l({type:"addFocusToKeyCapture"})}),[l]);return Object(n.useEffect)((()=>{s||l({type:"addFocusToKeyCapture"})}),[l,s]),i.a.createElement(r.EuiPopover,{button:e,closePopover:d,isOpen:o,panelStyle:c,anchorPosition:"upLeft",hasArrow:!1,display:"block",attachToAnchor:!0,focusTrapProps:u,ownFocus:!1,"data-test-subj":a("inputPopover")},s&&i.a.createElement(r.EuiFocusTrap,{clickOutsideDisables:!0},"input-history"===s&&i.a.createElement(Ve,null)))}));Ue.displayName="InputAreaPopover";const He=o.a.div.withConfig({displayName:"CommandInputContainer",componentId:"sc-ujnhrt-0"})(["background-color:",";border-radius:",";padding:",";outline:",";&:focus-within{border-bottom:",";border-bottom-color:",";}&.error{border-bottom-color:",";}.textEntered{white-space:break-spaces;}.prompt{padding-right:1ch;}&.withPopover{border-top-left-radius:0;border-top-right-radius:0;}&.hasFocus{.cursor{background-color:",";animation:cursor-blink-animation 1s steps(5,start) infinite;-webkit-animation:cursor-blink-animation 1s steps(5,start) infinite;@keyframes cursor-blink-animation{to{visibility:hidden;}}@-webkit-keyframes cursor-blink-animation{to{visibility:hidden;}}}}"],(({theme:{eui:e}})=>e.euiFormBackgroundColor),(({theme:{eui:e}})=>e.euiBorderRadius),(({theme:{eui:e}})=>e.euiSizeS),(({theme:{eui:e}})=>e.euiBorderThin),(({theme:{eui:e}})=>e.euiBorderThick),(({theme:{eui:e}})=>e.euiColorPrimary),(({theme:{eui:e}})=>e.euiColorDanger),(({theme:{eui:e}})=>e.euiTextColor)),Ge=Object(n.memo)((({prompt:e="",focusRef:t,...a})=>{(()=>{const e=$(),t=Boolean(xe()),a=(()=>{const e=oe().state.input.parsedInput;return-1!==e.input.trimStart().indexOf(" ")?e.name:""})(),i=ee(),{leftOfCursorText:r}=he(),s=Object(n.useMemo)((()=>{if(a)return i.find((e=>e.name===a))}),[a,i]);Object(n.useEffect)((()=>{if(a&&!t)if(s&&!0!==s.helpHidden){var n,i;const t=null!==(n=null==s?void 0:s.exampleInstruction)&&void 0!==n?n:"",a=null!==(i=null==s?void 0:s.exampleUsage)&&void 0!==i?i:"";let r=null!=t?t:"";if(a&&(r+=t?` ${f.i18n.translate("xpack.securitySolution.useInputHints.exampleInstructions",{defaultMessage:"Ex: [ {exampleUsage} ]",values:{exampleUsage:a}})}`:a),!r||!a){const e=g(s);e.length>0?r+=`${s.name} ${e}`:r+=Ae}e({type:"updateFooterContent",payload:{value:r}}),e({type:"setInputState",payload:{value:void 0}})}else e({type:"updateFooterContent",payload:{value:(o=a,f.i18n.translate("xpack.securitySolution.useInputHints.unknownCommand",{defaultMessage:"Unknown command {commandName}",values:{commandName:o}}))}}),e({type:"setInputState",payload:{value:"error"}});else e({type:"updateFooterContent",payload:{value:r||t?"":De}}),e({type:"setInputState",payload:{value:void 0}});var o}),[a,s,e,t,r])})();const s=Object(k.a)(O()),o=$(),{rightOfCursorText:l,leftOfCursorText:c,fullTextEntered:u,enteredCommand:d,parsedInput:p}=he(),m=le(),b=!!xe(),[y,h]=Object(n.useState)(!1),[v,E]=Object(n.useState)(void 0),[x,j]=Object(n.useState)("94vw"),S=Object(n.useRef)(null),w=t||S,T=Object(n.useMemo)((()=>ye()({cmdInput:!0,hasFocus:y,error:"error"===m,withPopover:b})),[y,b,m]),I=Object(n.useMemo)((()=>0===u.trim().length),[u]),C=Object(n.useMemo)((()=>new entered_input_EnteredInput(c,l,p,d)),[d,c,p,l]),M=Object(n.useCallback)((({width:e})=>{e>0&&j(`${e}px`)}),[]),_=Object(n.useCallback)((()=>{E({input:C.getFullText(!0),enteredCommand:d,parsedInput:p})}),[d,p,C]),F=Object(n.useCallback)((e=>{h(e)}),[]),A=Object(n.useCallback)((e=>{w.current&&w.current.focus(),b&&o({type:"updateInputPopoverState",payload:{show:void 0}})}),[o,b,w]),D=Object(n.useCallback)((({value:e,selection:t,eventDetails:a})=>{const n=a.keyCode;if(38===n)return o({type:"removeFocusFromKeyCapture"}),void o({type:"updateInputPopoverState",payload:{show:"input-history"}});o({type:"updateInputTextEnteredState",payload:({leftOfCursorText:a,rightOfCursorText:i,enteredCommand:r,parsedInput:s})=>{const o=new entered_input_EnteredInput(a,i,s,r);switch(o.addValue(null!=e?e:"",t),n){case 8:o.backspaceChar(t);break;case 46:o.deleteChar(t);break;case 13:E({input:o.getFullText(!0),enteredCommand:r,parsedInput:s}),o.clear();break;case 37:o.moveCursorTo("left");break;case 39:o.moveCursorTo("right");break;case 36:o.moveCursorTo("home");break;case 35:o.moveCursorTo("end")}return{leftOfCursorText:o.getLeftOfCursorText(),rightOfCursorText:o.getRightOfCursorText(),argState:o.getArgState()}}})}),[o]);return Object(n.useEffect)((()=>{v&&(o({type:"executeCommand",payload:v}),E(void 0),o({type:"updateInputTextEnteredState",payload:{leftOfCursorText:"",rightOfCursorText:""}}))}),[v,o]),i.a.createElement(Ue,{width:x},i.a.createElement(r.EuiResizeObserver,{onResize:M},(n=>i.a.createElement(He,ge()({},a,{className:T,onClick:A,ref:n,"data-test-subj":s("cmdInput-container")}),i.a.createElement(r.EuiFlexGroup,{responsive:!1,alignItems:"center",gutterSize:"none"},e&&i.a.createElement(r.EuiFlexItem,{grow:!1,"data-test-subj":s("cmdInput-prompt")},i.a.createElement("span",{className:"eui-displayInlineBlock prompt"},e)),i.a.createElement(r.EuiFlexItem,{className:"textEntered"},i.a.createElement(Fe,{onCapture:D,onChangeFocus:F,focusRef:t},i.a.createElement(Ee,{leftOfCursor:C.getLeftOfCursorRenderingContent(),rightOfCursor:C.getRightOfCursorRenderingContent()})),i.a.createElement(Pe,null)),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonIcon,{"data-test-subj":s("inputTextSubmitButton"),"aria-label":"submit-command",iconType:"playFilled",color:"primary",isDisabled:I,onClick:_})))))))}));Ge.displayName="CommandInput";var Qe=a(50),We=a.n(Qe);const Ke=Object(n.memo)((({size:e="s",color:t,children:a,"data-test-subj":n,className:s})=>{const{euiTheme:o}=Object(r.useEuiTheme)();return i.a.createElement(r.EuiText,{size:e,"data-test-subj":n,className:`font-family-code ${null!=s?s:""}`},i.a.createElement(r.EuiTextColor,{color:null!=t?t:o.colors.text},a))}));Ke.displayName="ConsoleText";const Ye=Object(n.memo)((()=>{const e=Object(k.a)(O());return i.a.createElement(Ke,{"data-test-subj":e("longRunningCommandHint")},i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.longRunningCommandHintMessage",defaultMessage:"Hint: We are still working on this task. You may leave the console or place another command while this command is processing."}))}));Ye.displayName="LongRunningCommandHint";const Je=f.i18n.translate("xpack.securitySolution.commandExecutionResult.successTitle",{defaultMessage:"Action completed."}),Xe=f.i18n.translate("xpack.securitySolution.commandExecutionResult.failureTitle",{defaultMessage:"Action failed."}),Ze=f.i18n.translate("xpack.securitySolution.commandExecutionResult.pending",{defaultMessage:"Action pending."}),et=Object(n.memo)((({showAs:e="success",title:t,showTitle:a=!0,"data-test-subj":s,className:o,children:l})=>{const c=O(),u=Object(k.a)(null!=s?s:c),d=Object(n.useMemo)((()=>ye()({"eui-displayInlineBlock":"pending"===e,"font-family-code":!0,[o||"_"]:Boolean(o)})),[o,e]);return i.a.createElement(r.EuiPanel,{hasShadow:!1,paddingSize:"none",borderRadius:"none",color:"transparent",className:d,"data-test-subj":s||u("commandExecutionResult")},"pending"===e?i.a.createElement(Ke,null,null!=l?l:Ze):i.a.createElement(i.a.Fragment,null,a&&i.a.createElement(i.a.Fragment,null,i.a.createElement(Ke,{color:"success"===e?"success":"danger"},t||("success"===e?Je:Xe)),i.a.createElement(r.EuiSpacer,{size:"s"})),l))}));et.displayName="CommandExecutionResult";const tt=o.a.div.withConfig({displayName:"CommandOutputContainer",componentId:"sc-1wmcd6l-0"})(["position:relative;.busy-indicator{margin-left:0.5em;}"]),at=Object(n.memo)((({item:{command:e,state:t,id:a,enteredAt:s,isValid:o}})=>{const l=$(),c=e.commandDefinition.RenderComponent,[u,d]=Object(n.useState)(!1),p=Object(n.useMemo)((()=>"pending"===t.status),[t.status]),m=Object(n.useCallback)((e=>{l({type:"updateCommandStatusState",payload:{id:a,value:e}})}),[l,a]),b=Object(n.useCallback)((e=>{l({type:"updateCommandStoreState",payload:{id:a,value:e}})}),[l,a]);return Object(n.useEffect)((()=>{let e;if(p&&!u){const t=We()().diff(We()(s),"seconds");if(t>=15)return void d(!0);e=setTimeout((()=>{d(!0)}),1e3*(15-t))}return()=>{e&&clearTimeout(e)}}),[s,u,p]),i.a.createElement(tt,null,i.a.createElement("div",null,i.a.createElement(Le,{input:e.inputDisplay,isValid:o})),i.a.createElement("div",{className:"noThemeOverrides"},i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(r.EuiSpacer,{size:"xs"}),i.a.createElement(c,{command:e,store:t.store,status:t.status,setStore:b,setStatus:m,ResultComponent:et}),p&&i.a.createElement(r.EuiLoadingChart,{className:"busy-indicator",mono:!0}),p&&u&&i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(Ye,null))))}));at.displayName="CommandExecutionOutput";const nt=a(61).css`
  ${({theme:{eui:e}})=>e.euiSizeL}
`,it=o()(r.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItemHistoryItem",componentId:"sc-1249lql-0"})(["border-bottom:"," dashed ",";margin-bottom:",";padding-bottom:",";"],(({theme:{eui:e}})=>e.euiBorderWidthThin),(({theme:{eui:e}})=>e.euiBorderColor),nt,nt),rt=Object(n.memo)((({children:e})=>{const t=Object(k.a)(O());return i.a.createElement(it,{grow:!0,"data-test-subj":t("historyItem")},e)}));rt.displayName="HistoryItem";const st=Object(n.memo)((e=>{const t=oe().state.commandHistory,a=$(),s=Object(k.a)(O()),o=Object(n.useMemo)((()=>t.map((e=>i.a.createElement(rt,{key:e.id},i.a.createElement(at,{item:e}))))),[t]);return Object(n.useEffect)((()=>{a({type:"scrollDown"})}),[a,t.length]),i.a.createElement(r.EuiFlexGroup,ge()({"data-test-subj":s("historyOutput")},e,{wrap:!0,direction:"column",alignItems:"stretch",responsive:!1,gutterSize:"none"}),o)}));st.displayName="HistoryOutput";const ot=o()(r.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItemNoPadding",componentId:"sc-ojfnk7-0"})(["padding:0 !important;"]),lt=Object(n.memo)((({headerContent:e,children:t})=>{const a=Object(k.a)(O("sidePanel"));return i.a.createElement(r.EuiFlexGroup,{direction:"column",responsive:!1,className:"eui-fullHeight",gutterSize:"none","data-test-subj":a()},e&&i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiFlexItem,{grow:!1,className:"layout-container","data-test-subj":a("header")},e),i.a.createElement(r.EuiHorizontalRule,{margin:"none"})),i.a.createElement(ot,{className:"eui-scrollBar eui-yScroll layout-container"},i.a.createElement("div",{"data-test-subj":a("body")},t)))}));lt.displayName="SidePanelContentLayout";const ct=o()(r.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-u9ickv-0"})(["padding-top:",";padding-right:",";"],(({theme:{eui:e}})=>e.euiPanelPaddingModifiers.paddingSmall),(({theme:{eui:e}})=>e.euiPanelPaddingModifiers.paddingSmall)),ut=Object(n.memo)((()=>{const e=$(),t=ee(),a=Object(k.a)(O("sidePanel")),s=ue().show,o=Object(n.useCallback)((()=>{e({type:"showSidePanel",payload:{show:null}})}),[e]),l=Object(n.useMemo)((()=>"help"===s?i.a.createElement(i.a.Fragment,null,i.a.createElement(ct,null,i.a.createElement(r.EuiFlexItem,null,i.a.createElement(r.EuiTitle,{size:"s","data-test-subj":a("headerTitle")},i.a.createElement("h3",null,i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.sidePanel.helpTitle",defaultMessage:"Help"})))),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonIcon,{"aria-label":"closeSidePanelIcon",iconType:"cross",color:"text",onClick:o,"data-test-subj":a("headerCloseButton")}))),i.a.createElement(r.EuiSpacer,{size:"m"}),i.a.createElement(r.EuiText,{size:"s"},i.a.createElement(x.FormattedMessage,{id:"xpack.securitySolution.console.sidePanel.helpDescription",defaultMessage:"Use the add ({icon}) button to populate a response action to the text bar. Add additional parameters or comments as necessary.",values:{icon:i.a.createElement(r.EuiIcon,{type:"plusInCircle"})}}))):null),[s,a,o]),c=Object(n.useMemo)((()=>"help"===s?i.a.createElement("div",{"data-test-subj":a("helpContent")},i.a.createElement(Z,{commands:t,display:"table"})):null),[t,a,s]);return s?i.a.createElement(lt,{headerContent:l},c):null}));ut.displayName="RightPanelContentManager";const dt=o()(r.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItemWhite",componentId:"sc-hd3kv7-0"})(["background-color:"," !important;border-radius:",";box-shadow:0 "," "," ",";"],(({theme:{eui:e}})=>e.euiHeaderBackgroundColor),(({theme:{eui:e}})=>`0 ${e.euiSizeXS} ${e.euiSizeXS} 0`),(({theme:{eui:e}})=>e.euiSizeXS),(({theme:{eui:e}})=>e.euiSizeXS),(({theme:{eui:e}})=>Object(r.transparentize)(e.euiShadowColor,.04))),pt=Object(n.memo)((e=>Boolean(ue().show)?i.a.createElement(dt,{grow:!1,className:"layout-rightPanel"},i.a.createElement(ut,null)):null));pt.displayName="SidePanelFlexItem";const mt=o.a.div.withConfig({displayName:"ConsoleWindow",componentId:"sc-d15gh7-0"})(["height:100%;background-color:",";border:",";border-radius:",";.layout{height:100%;width:100%;min-height:300px;min-width:300px;overflow:hidden;&-hideOverflow{overflow:hidden;}&-bottomBorder{border-bottom:"," solid ",";}&-container{padding:",";}&-header{background-color:",";border-bottom:1px solid ",";border-top-left-radius:",";border-top-right-radius:",";padding:"," "," "," ",";}&-commandInput{padding-top:",";padding-bottom:",";}&-footer{padding-top:0;padding-bottom:",";}&-rightPanel{width:35%;background-color:",";border-left:",";}&-historyOutput{overflow:auto;}&-historyViewport{height:100%;overflow-x:hidden;white-space:pre-wrap;}.euiFlexItem:not(.noMinWidth):not(.noThemeOverrides .euiFlexItem){min-width:0;}}.font-family-code{font-family:",";}.font-style-italic{font-style:italic;}.descriptionList-20_80{&.euiDescriptionList{> .euiDescriptionList__title{width:20%;margin-top:",";}> .euiDescriptionList__description{width:80%;margin-top:",";}}}"],(({theme:{eui:e}})=>e.euiPageBackgroundColor),(({theme:{eui:e}})=>e.euiBorderThin),(({theme:{eui:e}})=>e.euiBorderRadiusSmall),(({theme:{eui:e}})=>e.euiSizeS),(({theme:{eui:e}})=>e.euiPageBackgroundColor),(({theme:{eui:e}})=>e.euiPanelPaddingModifiers.paddingMedium),(({theme:{eui:e}})=>e.euiColorEmptyShade),(({theme:{eui:e}})=>e.euiColorLightShade),(({theme:{eui:e}})=>e.euiBorderRadiusSmall),(({theme:{eui:e}})=>e.euiBorderRadiusSmall),(({theme:{eui:e}})=>e.euiSize),(({theme:{eui:e}})=>e.euiSize),(({theme:{eui:e}})=>e.euiSize),(({theme:{eui:e}})=>e.euiSize),(({theme:{eui:e}})=>e.euiSizeXS),(({theme:{eui:e}})=>e.euiSizeXS),(({theme:{eui:e}})=>e.euiSizeXS),(({theme:{eui:e}})=>e.euiFormBackgroundColor),(({theme:{eui:e}})=>e.euiBorderThin),(({theme:{eui:e}})=>e.euiCodeFontFamily),(({theme:{eui:e}})=>e.euiSizeS),(({theme:{eui:e}})=>e.euiSizeS)),bt=Object(n.memo)((({prompt:e,commands:t,HelpComponent:a,TitleComponent:s,storagePrefix:o,managedKey:l,...c})=>{const d=Object(n.useRef)(null),p=Object(n.useRef)(null),m=Object(k.a)(c["data-test-subj"]),b=Object(u.c)(l),g=Object(n.useCallback)((()=>{setTimeout((()=>{d.current&&(d.current.scrollTop=d.current.scrollHeight)}),1)}),[]),f=Object(n.useCallback)((()=>{p.current&&p.current.focus()}),[]);return Object(n.useEffect)((()=>{b&&!b.isOpen||setTimeout(f,2)}),[f,b]),i.a.createElement(se,{commands:t,scrollToBottom:g,keyCapture:p,managedKey:l,HelpComponent:a,dataTestSubj:c["data-test-subj"],storagePrefix:o},i.a.createElement(mt,c,i.a.createElement(r.EuiFlexGroup,{className:"layout",gutterSize:"none",responsive:!1},i.a.createElement(r.EuiFlexItem,null,i.a.createElement(r.EuiFlexGroup,{direction:"column",className:"layout",gutterSize:"none",responsive:!1,"data-test-subj":m("mainPanel")},i.a.createElement(r.EuiFlexItem,{grow:!1,className:"layout-header"},i.a.createElement(me,{TitleComponent:s})),i.a.createElement(r.EuiFlexItem,{grow:!0,className:"layout-hideOverflow"},i.a.createElement(r.EuiFlexGroup,{gutterSize:"none",responsive:!1,className:"layout-hideOverflow"},i.a.createElement(r.EuiFlexItem,{className:"eui-fullHeight layout-hideOverflow"},i.a.createElement(r.EuiFlexGroup,{direction:"column",gutterSize:"none",responsive:!1,className:"layout-hideOverflow"},i.a.createElement(r.EuiFlexItem,{grow:!0,className:"layout-historyOutput"},i.a.createElement("div",{className:"layout-container layout-historyViewport eui-scrollBar eui-yScroll",ref:d},i.a.createElement(st,null))),i.a.createElement(r.EuiFlexItem,{onClick:f,grow:!1,className:"layout-container layout-commandInput","data-test-subj":m("mainPanel-inputArea")},i.a.createElement(Ge,{prompt:e,focusRef:p})),i.a.createElement(r.EuiFlexItem,{grow:!1,className:"layout-container layout-footer"},i.a.createElement(ce,null)))))))),i.a.createElement(pt,null))))}));bt.displayName="Console"},function(e,t,a){"use strict";a.d(t,"b",(function(){return ni})),a.d(t,"a",(function(){return ii})),a.d(t,"c",(function(){return oi}));var n=a(40),i=a(5),r=a(264),s=a(42),o=a(2),l=a.n(o),c=a(45),u=a(103),d=a(41),p=a.n(d),m=a(120),b=a(59),g=a(119),f=a(1042),y=a(1058),h=a(1048),v=a(204),E=a(661),x=a(114),j=a(105),S=a(102),k=a(384),O=a(201),w=a(423),T=a(222),I=a(695),C=a(219),M=a(8),_=a(180),F=a(166),A=a(383);const D=i.i18n.translate("xpack.securitySolution.detectionEngine.details.stepAboutRule.detailsLabel",{defaultMessage:"Details"}),N=i.i18n.translate("xpack.securitySolution.detectionEngine.details.stepAboutRule.aboutText",{defaultMessage:"About"}),P=i.i18n.translate("xpack.securitySolution.detectionEngine.details.stepAboutRule.investigationGuideLabel",{defaultMessage:"Investigation guide"}),R=i.i18n.translate("xpack.securitySolution.detectionEngine.details.stepAboutRule.setupGuideLabel",{defaultMessage:"Setup guide"}),L=i.i18n.translate("xpack.securitySolution.detectionEngine.details.stepAboutRule.controlLegend",{defaultMessage:"Viewing"});var B=a(746);const q=_.css`
  height: 100%;
`,z={id:"details",label:D,"data-test-subj":"stepAboutDetailsToggle-details"},$={id:"notes",label:P,"data-test-subj":"stepAboutDetailsToggle-notes"},V={id:"setup",label:R,"data-test-subj":"stepAboutDetailsToggle-setup"},U=({stepData:e,stepDataDetails:t,loading:a})=>{const[i,r]=Object(o.useState)("details"),[s,c]=Object(o.useState)(0),u=Object(o.useCallback)((e=>{c(e.height)}),[c]),d=Object(o.useMemo)((()=>{const e=!Object(M.isEmpty)(null==t?void 0:t.note)&&""!==(null==t?void 0:t.note.trim()),a=!Object(M.isEmpty)(null==t?void 0:t.setup)&&""!==(null==t?void 0:t.setup.trim());return[...e||a?[z]:[],...e?[$]:[],...a?[V]:[]]}),[t]);return l.a.createElement(n.EuiPanel,{hasBorder:!0,className:_.css`
        position: relative;
      `},a&&l.a.createElement(l.a.Fragment,null,l.a.createElement(n.EuiProgress,{size:"xs",color:"accent",position:"absolute"}),l.a.createElement(F.a,{title:N})),null!=e&&null!=t&&l.a.createElement(n.EuiFlexGroup,{gutterSize:"xs",direction:"column",className:q},l.a.createElement(n.EuiFlexItem,{grow:!1,key:"header"},l.a.createElement(F.a,{title:N},d.length>0&&l.a.createElement(n.EuiButtonGroup,{options:d,idSelected:i,onChange:e=>{r(e)},"data-test-subj":"stepAboutDetailsToggle",legend:L}))),l.a.createElement(n.EuiFlexItem,{key:"details"},"details"===i&&l.a.createElement(n.EuiResizeObserver,{"data-test-subj":"stepAboutDetailsContent",onResize:u},(a=>l.a.createElement("div",{ref:a,className:q},l.a.createElement(G,{maxHeight:120},l.a.createElement(Q,{maxHeight:120},l.a.createElement(n.EuiText,{size:"s","data-test-subj":"stepAboutRuleDetailsToggleDescriptionText"},t.description))),l.a.createElement(n.EuiSpacer,{size:"m"}),l.a.createElement(B.b,{addPadding:!1,descriptionColumns:"singleSplit",defaultValues:e})))),"notes"===i&&l.a.createElement(G,{"data-test-subj":"stepAboutDetailsNoteContent",maxHeight:s},l.a.createElement(Q,{maxHeight:s},l.a.createElement(A.b,null,t.note))),"setup"===i&&l.a.createElement(G,{"data-test-subj":"stepAboutDetailsSetupContent",maxHeight:s},l.a.createElement(Q,{maxHeight:s},l.a.createElement(A.b,null,t.setup))))))},H=Object(o.memo)(U);function G({maxHeight:e,"data-test-subj":t,children:a}){return l.a.createElement("div",{className:_.css`
        max-height: ${e}px;
        overflow-y: hidden;
        word-break: break-word;
      `,"data-test-subj":t},a)}function Q({maxHeight:e,children:t}){return l.a.createElement("div",{className:`eui-yScroll ${_.css`
        max-height: ${e}px;
      `}`},t)}var W=a(656),K=a(181),Y=a(745),J=a(740),X=a(528),Z=a(312),ee=a(1107),te=a(1108),ae=a(334),ne=a(954),ie=a(134),re=a(138),se=a(151),oe=a(4),le=a(687),ce=a(172),ue=a(472),de=a(196),pe=a(159),me=a(333),be=a(1067),ge=a(612),fe=a(1050),ye=a(137);const he=i.i18n.translate("xpack.securitySolution.detectionEngine.rules.components.ruleActionsOverflow.allActionsTitle",{defaultMessage:"All actions"}),ve=p()(n.EuiButtonIcon).withConfig({displayName:"MyEuiButtonIcon",componentId:"sc-1ut3lkn-0"})(["&.euiButtonIcon{svg{transform:rotate(90deg);}border:1px solid ",";width:40px;height:40px;}"],(({theme:e})=>e.euiColorPrimary)),Ee=({rule:e,userHasPermissions:t,canDuplicateRuleWithActions:a,showBulkDuplicateExceptionsConfirmation:i,confirmDeletion:r})=>{const[s,,c,u]=Object(ue.a)(),{navigateToApp:d}=Object(S.j)().services.application,{startTransaction:p}=Object(pe.b)(),{executeBulkAction:m}=Object(ge.b)({suppressSuccessToast:!0}),{bulkExport:b}=Object(be.a)(),g=Object(fe.a)(),f=Object(o.useCallback)((()=>{d(oe.l,{deepLinkId:oe.wc.rules,path:Object(O.e)()})}),[d]),y=Object(o.useMemo)((()=>null!=e?[l.a.createElement(n.EuiContextMenuItem,{key:ye.Ab,icon:"copy",disabled:!a||!t,"data-test-subj":"rules-details-duplicate-rule",onClick:async()=>{p({name:de.e.DUPLICATE}),c();const t=await i();if(null===t)return;const a=await m({type:ce.b.duplicate,ids:[e.id],duplicatePayload:{include_exceptions:t===le.a.withExceptions||t===le.a.withExceptionsExcludeExpiredExceptions,include_expired_exceptions:!(t===le.a.withExceptionsExcludeExpiredExceptions)}}),n=null==a?void 0:a.attributes.results.created;null!=n&&n.length&&Object(ge.a)(n[0].id,d)}},l.a.createElement(n.EuiToolTip,{position:"left",content:Object(me.a)(e,a)?void 0:ye.Qb},l.a.createElement(l.a.Fragment,null,ye.Ab))),l.a.createElement(n.EuiContextMenuItem,{key:ye.Hb,icon:"exportAction",disabled:!t||e.immutable,"data-test-subj":"rules-details-export-rule",onClick:async()=>{p({name:de.e.EXPORT}),c();const t=await b({ids:[e.id]});t&&await g(t)}},ye.Hb),l.a.createElement(n.EuiContextMenuItem,{key:ye.xb,icon:"trash",disabled:!t,"data-test-subj":"rules-details-delete-rule",onClick:async()=>{c(),!1!==await r()&&(p({name:de.e.DELETE}),await m({type:ce.b.delete,ids:[e.id]}),f())}},ye.xb)]:[]),[b,a,c,m,d,f,e,i,p,t,g,r]),h=Object(o.useMemo)((()=>l.a.createElement(n.EuiToolTip,{position:"top",content:he},l.a.createElement(ve,{iconType:"boxesHorizontal","aria-label":he,isDisabled:!t,"data-test-subj":"rules-details-popover-button-icon",onClick:u}))),[u,t]);return l.a.createElement(l.a.Fragment,null,l.a.createElement(n.EuiPopover,{anchorPosition:"leftCenter",button:h,closePopover:c,id:"ruleActionsOverflow",isOpen:s,"data-test-subj":"rules-details-popover",ownFocus:!0,panelPaddingSize:"none",repositionOnScroll:!0},l.a.createElement(n.EuiContextMenuPanel,{"data-test-subj":"rules-details-menu-panel",items:y})))},xe=l.a.memo(Ee);xe.displayName="RuleActionsOverflow";var je=a(162),Se=a(648),ke=a(486),Oe=a(131),we=a(178),Te=a(861),Ie=a(148),Ce=a(116),Me=a(110),_e=a(1393),Fe=a(505),Ae=a(50),De=a.n(Ae),Ne=a(49);const Pe=1e3;var Re=a(64),Le=a(44),Be=(a(1371),a(21)),qe=a(317),ze=a(108),$e=a(122),Ve=a(541),Ue=a(587);const He=Object(o.createContext)(null),Ge=({children:e})=>{var t;const{storage:a}=Object(S.j)().services,[n,i]=Object(o.useState)([]),[r,s]=Object(o.useState)(1e3),[c,u]=Object(o.useState)(!0),[d,p]=Object(o.useState)("now-24h"),[m,b]=Object(o.useState)("now"),[g,f]=Object(o.useState)(""),[y,h]=Object(o.useState)([]),[v,E]=Object(o.useState)(null!==(t=a.get(oe.oc))&&void 0!==t&&t),[x,j]=Object(o.useState)(1),[k,O]=Object(o.useState)(5),[w,T]=Object(o.useState)("timestamp"),[I,C]=Object(o.useState)("desc"),M=Object(o.useMemo)((()=>({[ni.executionResults]:{state:{superDatePicker:{recentlyUsedRanges:n,refreshInterval:r,isPaused:c,start:d,end:m},queryText:g,statusFilters:y,showMetricColumns:v,pagination:{pageIndex:x,pageSize:k},sort:{sortField:w,sortDirection:I}},actions:{setEnd:b,setIsPaused:u,setPageIndex:j,setPageSize:O,setQueryText:f,setRecentlyUsedRanges:i,setRefreshInterval:s,setShowMetricColumns:E,setSortDirection:C,setSortField:T,setStart:p,setStatusFilters:h}}})),[m,c,x,k,g,n,r,v,I,w,d,y]);return l.a.createElement(He.Provider,{value:M},e)};var Qe=a(1418),We=a(1417);const Ke=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.tableTitle",{defaultMessage:"Execution log"}),Ye=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.tableSubtitle",{defaultMessage:"A log of rule execution results"}),Je=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.searchPlaceholder",{defaultMessage:"duration > 100 and gapDuration > 10"}),Xe=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.showMetricColumnsSwitchTitle",{defaultMessage:"Show metrics columns"}),Ze=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.statusColumn",{defaultMessage:"Status"}),et=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.statusColumnTooltip",{defaultMessage:"Overall status of execution."}),tt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.timestampColumn",{defaultMessage:"Timestamp"}),at=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.timestampColumnTooltip",{defaultMessage:"Datetime rule execution initiated."}),nt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.durationColumn",{defaultMessage:"Duration"}),it=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.durationColumnTooltip",{defaultMessage:"The length of time it took for the rule to run (hh:mm:ss:SSS)."}),rt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.messageColumn",{defaultMessage:"Message"}),st=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.messageColumnTooltip",{defaultMessage:"Relevant message from execution outcome."}),ot=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.gapDurationColumn",{defaultMessage:"Gap Duration"}),lt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.gapTooltipSeeDocsDescription",{defaultMessage:"see documentation"}),ct=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.indexDurationColumn",{defaultMessage:"Index Duration"}),ut=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.indexDurationColumnTooltip",{defaultMessage:"The length of time it took to index detected alerts (hh:mm:ss:SSS)."}),dt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.searchDurationColumn",{defaultMessage:"Search Duration"}),pt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.searchDurationColumnTooltip",{defaultMessage:"The length of time it took to search for alerts (hh:mm:ss:SSS)."}),mt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.schedulingDelayColumn",{defaultMessage:"Scheduling Delay"}),bt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.schedulingDelayColumnTooltip",{defaultMessage:"The length of time from rule scheduled till rule executed (hh:mm:ss:SSS)."}),gt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.actionsColumn",{defaultMessage:"Actions"}),ft=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.actionsColumnTooltip",{defaultMessage:"Filter alerts by rule execution ID."}),yt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.actionSearchFiltersUpdatedTitle",{defaultMessage:"Global search filters have been updated"}),ht=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.actionSearchFiltersUpdatedDescription",{defaultMessage:"Search filters have been updated to show alerts from selected rule execution"}),vt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.actionSearchFiltersUpdatedRestoreButtonTitle",{defaultMessage:"Restore previous filters"}),Et=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.actionFieldNotFoundErrorTitle",{defaultMessage:"Unable to filter alerts"}),xt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.actionFieldNotFoundErrorDescription",{defaultMessage:"Cannot find field 'kibana.alert.rule.execution.uuid' in alerts index."}),jt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.durationNotAvailableDescription",{defaultMessage:"N/A"}),St=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.durationGreaterThanYearDescription",{defaultMessage:"> 1 Year"}),kt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.fullMessage",{defaultMessage:"Full message"}),Ot=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.expandRow",{defaultMessage:"Expand rows"}),wt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.expand",{defaultMessage:"Expand"}),Tt=i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.collapse",{defaultMessage:"Collapse"});var It=a(117),Ct=a(132),Mt=a(1109),_t=a(1110);const Ft=e=>{const{duration:t,isSeconds:a=!1,allowZero:n=!0}=e,i=Object(o.useMemo)((()=>n&&t>=0?(e=>{if(!e)return"00:00:00:000";const t=De.a.duration(e),a=Math.floor(t.asDays()).toString().padStart(3,"0"),n=Math.floor(t.asHours()%24).toString().padStart(2,"0"),i=Math.floor(t.asMinutes()%60).toString().padStart(2,"0"),r=t.seconds().toString().padStart(2,"0"),s=t.milliseconds().toString().padStart(3,"0");return Math.floor(t.asDays())>0?Math.floor(t.asDays())>=365?St:`${a}:${n}:${i}:${r}:${s}`:`${n}:${i}:${r}:${s}`})(a?1e3*t:t):jt),[n,t,a]);return l.a.createElement("span",{"data-test-subj":"rule-duration-format-value"},i)},At=l.a.memo(Ft);At.displayName="RuleDurationFormat";const Dt=[{name:l.a.createElement(_t.a,{title:Ze,tooltipContent:et}),field:"security_status",render:e=>l.a.createElement(Fe.c,{status:e,showTooltip:!0}),sortable:!1,truncateText:!1,width:"10%"},{field:"timestamp",name:l.a.createElement(_t.a,{title:tt,tooltipContent:at}),render:e=>l.a.createElement(Ct.a,{value:e,fieldName:"timestamp"}),sortable:!0,truncateText:!1,width:"15%"},{field:"duration_ms",name:l.a.createElement(_t.a,{title:nt,tooltipContent:it}),render:e=>l.a.createElement(l.a.Fragment,null,e?l.a.createElement(At,{duration:e}):Object(It.e)()),sortable:!0,truncateText:!1,width:"10%"}],Nt=e=>({field:"security_message",name:l.a.createElement(_t.a,{title:rt,tooltipContent:st}),render:(e,t)=>"succeeded"===t.security_status?e:l.a.createElement(Pt,null,e),sortable:!1,width:e});var Pt=p()("div").withConfig({displayName:"_StyledDiv",componentId:"sc-okzjc9-0"})(["display:-webkit-box;-webkit-line-clamp:3;-webkit-box-orient:vertical;overflow:hidden;"]),Rt=a(283);const Lt={status:"kibana.alert.rule.execution.status",timestamp:"@timestamp",duration:"event.duration",message:"message",gapDuration:"kibana.alert.rule.execution.metrics.execution_gap_duration_s",indexDuration:"kibana.alert.rule.execution.metrics.total_indexing_duration_ms",searchDuration:"kibana.alert.rule.execution.metrics.total_search_duration_ms",totalActions:"kibana.alert.rule.execution.metrics.number_of_triggered_actions",schedulingDelay:"kibana.task.schedule_delay"},Bt=[Rt.f.succeeded,Rt.f.failed,Rt.f["partial failure"]],qt=l.a.memo((({onlyShowFilters:e,selectedStatuses:t,onStatusFilterChange:a,onSearch:i})=>{const r=Object(o.useCallback)((e=>{i((e=>Object.entries(Lt).reduce(((e,[t,a])=>Object(M.replace)(e,t,a)),e))(e))}),[i]);return l.a.createElement(n.EuiFlexGroup,{gutterSize:"s"},l.a.createElement(n.EuiFlexItem,{grow:!0},!e&&l.a.createElement(n.EuiFieldSearch,{"data-test-subj":"executionLogSearch","aria-label":Je,placeholder:Je,onSearch:r,isClearable:!0,fullWidth:!0})),l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(Fe.b,{items:Bt,selectedItems:t,onChange:a})))}));qt.displayName="ExecutionLogSearchBar";const zt="kibana.alert.rule.execution.uuid",$t=p()(n.EuiSwitch).withConfig({displayName:"UtilitySwitch",componentId:"sc-z5yvfc-0"})(["margin-left:17px;"]),Vt=p()(n.EuiFlexItem).withConfig({displayName:"DatePickerEuiFlexItem",componentId:"sc-z5yvfc-1"})(["max-width:582px;"]),Ut=({ruleId:e,selectAlertsTab:t})=>{var a,r;const{docLinks:s,data:{query:{filterManager:c}},storage:d,timelines:p}=Object(S.j)().services,{[ni.executionResults]:{state:{superDatePicker:{recentlyUsedRanges:m,refreshInterval:b,isPaused:g,start:f,end:y},queryText:h,statusFilters:v,showMetricColumns:E,pagination:{pageIndex:k,pageSize:O},sort:{sortField:w,sortDirection:T}},actions:{setEnd:I,setIsPaused:C,setPageIndex:M,setPageSize:_,setQueryText:A,setRecentlyUsedRanges:D,setRefreshInterval:N,setShowMetricColumns:P,setSortDirection:R,setSortField:L,setStart:B,setStatusFilters:q}}}=(()=>{const e=Object(o.useContext)(He);return Object(Ue.a)(e,"useRuleDetailsContext should be used inside RuleDetailsContextProvider"),e})(),{indexPattern:z}=Object(Ce.d)(Me.SourcererScopeName.detections),{addError:$,addSuccess:V,remove:U}=Object(ze.a)(),H=Object(u.useDispatch)(),G=Object(o.useMemo)((()=>$e.d.globalFiltersQuerySelector()),[]),Q=Object(o.useMemo)((()=>$e.d.globalQuerySelector()),[]),W=Object(j.a)($e.d.globalTimeRangeSelector),K=Object(j.a)(Q),Y=Object(j.a)(G),J=Object(o.useRef)({filters:Y,query:K,timerange:W}),X=Object(o.useRef)(""),Z=Object(o.useCallback)((()=>{Object(Ve.a)(J.current.timerange)?H(Object(se.setAbsoluteRangeDatePicker)({id:x.a.global,from:J.current.timerange.from,to:J.current.timerange.to})):Object(Ve.b)(J.current.timerange)&&H(Object(se.setRelativeRangeDatePicker)({id:x.a.global,from:J.current.timerange.from,fromStr:J.current.timerange.fromStr,to:J.current.timerange.to,toStr:J.current.timerange.toStr})),H(Object(se.setFilterQuery)({id:x.a.global,query:J.current.query.query,language:J.current.query.language})),c.removeAll(),c.addFilters(J.current.filters),U(X.current)}),[H,c,U]),{data:ee,dataUpdatedAt:te,isFetching:ae,isLoading:ne,refetch:ie}=Object(Fe.d)({ruleId:e,start:f,end:y,queryText:h,statusFilters:v,page:k,perPage:O,sortField:w,sortOrder:T}),re=null!==(a=null==ee?void 0:ee.events)&&void 0!==a?a:[],le=null!==(r=null==ee?void 0:ee.total)&&void 0!==r?r:0,ce=Object(o.useMemo)((()=>z.fields.find((e=>e.name===zt))),[z]),ue=Object(o.useCallback)((({page:e={},sort:t={}})=>{const{index:a,size:n}=e,{field:i,direction:r}=t;M(a+1),_(n),L(i),R(r)}),[M,_,R,L]),de=Object(o.useCallback)((e=>{const t=m.filter((t=>!(t.start===e.start&&t.end===e.end)));t.unshift({start:e.start,end:e.end}),B(e.start),I(e.end),D(t.length>10?t.slice(0,9):t)}),[m,I,D,B]),pe=Object(o.useCallback)((e=>{C(e.isPaused),N(e.refreshInterval>6e4?e.refreshInterval:6e4)}),[C,N]),me=Object(o.useCallback)((e=>{ie()}),[ie]),be=Object(o.useCallback)((e=>{A(e)}),[A]),ge=Object(o.useCallback)((e=>{q(e)}),[q]),fe=Object(o.useCallback)(((e,a)=>{if(null!=ce){J.current={filters:Y,query:K,timerange:W};const r=Object(Ne.buildFilter)(z,ce,Ne.FILTERS.PHRASE,!1,!1,e,null);H(Object(se.setAbsoluteRangeDatePicker)({id:x.a.global,from:De()(a).subtract(1,"days").toISOString(),to:De()(a).add(1,"days").toISOString()})),c.removeAll(),c.addFilters(r),H(Object(se.setFilterQuery)({id:x.a.global,query:"",language:"kuery"})),t(),X.current=V({title:yt,text:(i=l.a.createElement(l.a.Fragment,null,l.a.createElement("p",null,ht),l.a.createElement(n.EuiFlexGroup,{justifyContent:"flexEnd",gutterSize:"s"},l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(n.EuiButton,{size:"s",onClick:Z},vt)))),e=>(Object(Re.render)(Object(Be.jsx)(Le.I18nProvider,null,i),e),()=>Object(Re.unmountComponentAtNode)(e)))},{toastLifeTimeMs:6e5}).id}else $(xt,{title:Et});var i}),[$,V,H,c,Y,z,K,Z,t,W,ce]),ye=Object(o.useCallback)((e=>{d.set(oe.oc,e),P(e)}),[P,d]),he=Object(o.useMemo)((()=>({pageIndex:k-1,pageSize:O,totalItemCount:le>Pe?Pe:le,pageSizeOptions:[5,10,25,50]})),[le,k,O]),ve=Object(o.useMemo)((()=>({sort:{field:w,direction:T}})),[T,w]),Ee=Object(o.useMemo)((()=>[{field:zt,name:gt,width:"64px",actions:[{name:"Edit",isPrimary:!0,field:"",description:ft,icon:"filter",type:"icon",onClick:e=>{null!=e&&e.execution_uuid&&fe(e.execution_uuid,e.timestamp)},"data-test-subj":"action-filter-by-execution-id"}]}]),[fe]),xe=Object(o.useCallback)((e=>`${e.execution_uuid}`),[]),je=Object(o.useCallback)((e=>l.a.createElement(n.EuiDescriptionList,{className:"eui-fullWidth",listItems:[{title:kt,description:l.a.createElement(We.a,{text:e.security_message})}]})),[]),Se=Object(Qe.a)({getItemId:xe,renderItem:je}),ke=Object(o.useMemo)((()=>{const e=[...Dt];return E?e.push(Nt("20%"),...(e=>[{field:"gap_duration_s",name:l.a.createElement(_t.a,{title:ot,customTooltip:l.a.createElement("div",{style:{maxWidth:"20px"}},l.a.createElement(Mt.a,{columnName:ot},l.a.createElement(n.EuiText,{size:"s",style:{width:350}},l.a.createElement("p",null,l.a.createElement(Le.FormattedMessage,{defaultMessage:"Duration of gap in Rule execution (hh:mm:ss:SSS). Adjust Rule look-back or {seeDocs} for mitigating gaps.",id:"xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.gapDurationColumnTooltip",values:{seeDocs:l.a.createElement(n.EuiLink,{href:`${e.links.siem.troubleshootGaps}`,target:"_blank"},lt)}})))))}),render:e=>l.a.createElement(l.a.Fragment,null,e?l.a.createElement(At,{duration:e,isSeconds:!0}):Object(It.e)()),sortable:!0,truncateText:!1,width:"10%"},{field:"indexing_duration_ms",name:l.a.createElement(_t.a,{title:ct,tooltipContent:ut}),render:e=>l.a.createElement(l.a.Fragment,null,e?l.a.createElement(At,{duration:e}):Object(It.e)()),sortable:!0,truncateText:!1,width:"10%"},{field:"search_duration_ms",name:l.a.createElement(_t.a,{title:dt,tooltipContent:pt}),render:e=>l.a.createElement(l.a.Fragment,null,e?l.a.createElement(At,{duration:e}):Object(It.e)()),sortable:!0,truncateText:!1,width:"10%"},{field:"schedule_delay_ms",name:l.a.createElement(_t.a,{title:mt,tooltipContent:bt}),render:e=>l.a.createElement(l.a.Fragment,null,e?l.a.createElement(At,{duration:e}):Object(It.e)()),sortable:!0,truncateText:!1,width:"10%"}])(s)):e.push(Nt("50%")),e.push(...Ee,(({toggleRowExpanded:e,isRowExpanded:t})=>({align:n.RIGHT_ALIGNMENT,width:"40px",isExpander:!0,name:l.a.createElement(n.EuiScreenReaderOnly,null,l.a.createElement("span",null,Ot)),render:a=>"succeeded"===a.security_status?null:l.a.createElement(n.EuiButtonIcon,{onClick:()=>e(a),"aria-label":t(a)?Tt:wt,iconType:t(a)?"arrowUp":"arrowDown"})}))({toggleRowExpanded:Se.toggleRowExpanded,isRowExpanded:Se.isRowExpanded})),e}),[Ee,s,E,Se.toggleRowExpanded,Se.isRowExpanded]);return l.a.createElement(n.EuiPanel,{hasBorder:!0},l.a.createElement(n.EuiFlexGroup,{gutterSize:"s"},l.a.createElement(n.EuiFlexItem,{grow:!0},l.a.createElement(F.a,{title:Ke,subtitle:Ye})),l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(qt,{onlyShowFilters:!0,selectedStatuses:v,onStatusFilterChange:ge,onSearch:be})),l.a.createElement(Vt,null,l.a.createElement(n.EuiSuperDatePicker,{start:f,end:y,onTimeChange:de,onRefresh:me,isPaused:g,isLoading:ae,refreshInterval:b,onRefreshChange:pe,recentlyUsedRanges:m,width:"full"}))),l.a.createElement(n.EuiSpacer,{size:"s"}),l.a.createElement(qe.a,null,l.a.createElement(qe.d,null,l.a.createElement(qe.c,null,l.a.createElement(qe.e,{dataTestSubj:"executionsShowing"},(Oe=le>Pe?Pe:le,i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.totalExecutionsLabel",{values:{totalItems:Oe},defaultMessage:"Showing {totalItems} {totalItems, plural, =1 {rule execution} other {rule executions}}"})))),le>Pe&&l.a.createElement(qe.c,{grow:!0},l.a.createElement(qe.e,{dataTestSubj:"exceptionsShowing",shouldWrap:!0},l.a.createElement(n.EuiTextColor,{color:"danger"},((e,t)=>i.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleExecutionLog.searchLimitExceededLabel",{values:{totalItems:e,maxItems:1e3},defaultMessage:"More than {totalItems} rule executions match filters provided. Showing first {maxItems} by most recent '@timestamp'. Constrain filters further to view additional execution events."}))(le))))),l.a.createElement(qe.d,null,l.a.createElement(qe.c,null,l.a.createElement(qe.e,{dataTestSubj:"lastUpdated"},p.getLastUpdated({showUpdating:ne||ae,updatedAt:te})),l.a.createElement($t,{label:Xe,checked:E,compressed:!0,onChange:e=>ye(e.target.checked)})))),l.a.createElement(n.EuiBasicTable,{columns:ke,items:re,loading:ae,sorting:ve,pagination:he,onChange:ue,itemId:xe,itemIdToExpandedRowMap:Se.itemIdToExpandedRowMap,isExpandable:!0}));var Oe},Ht=l.a.memo(Ut);Ht.displayName="ExecutionLogTable";var Gt=a(586),Qt=a(741),Wt=a(862),Kt=a(955),Yt=a(696),Jt=a(282),Xt=a(1112),Zt=a(1377),ea=a(335),ta=a(214),aa=a(156),na=a(210);const ia=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.noSearchResultsPromptTitle",{defaultMessage:"No results match your search criteria"}),ra=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.noSearchResultsPromptBody",{defaultMessage:"Try modifying your search."}),sa=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.addExceptionsEmptyPromptTitle",{defaultMessage:"Add exceptions to this rule"}),oa=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.emptyPromptBody",{defaultMessage:"There are no exceptions for this rule. Create your first rule exception."}),la=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.endpoint.emptyPromptBody",{defaultMessage:"There are no endpoint exceptions. Create your first endpoint exception."}),ca=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.emptyPromptButtonLabel",{defaultMessage:"Add rule exception"}),ua=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.endpoint.emptyPromptButtonLabel",{defaultMessage:"Add endpoint exception"}),da=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.exceptionItemsFetchError",{defaultMessage:"Unable to load exception items"}),pa=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.exceptionItemsFetchErrorDescription",{defaultMessage:"There was an error loading the exception items. Contact your administrator for help."}),ma=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.exceptionItemSearchErrorTitle",{defaultMessage:"Error searching"}),ba=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.exceptionItemSearchErrorBody",{defaultMessage:"An error occurred searching for exception items. Please try again."}),ga=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.exceptionDeleteErrorTitle",{defaultMessage:"Error deleting exception item"}),fa=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.paginationAriaLabel",{defaultMessage:"Exception item table pagination"}),ya=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.exceptionItemDeleteSuccessTitle",{defaultMessage:"Exception deleted"}),ha=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.exceptionEndpointDetailsDescription",{defaultMessage:"Endpoint exceptions are added to both the detection rule and the Elastic Endpoint agent on your hosts."}),va=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.exceptionDetectionDetailsDescription",{defaultMessage:"Rule exceptions are added to the detection rule."}),Ea=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.searchPlaceholder",{defaultMessage:'Filter exceptions using simple query syntax, for example, name:"my list"'}),xa=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.addToEndpointListLabel",{defaultMessage:"Add endpoint exception"}),ja=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.addToDetectionsListLabel",{defaultMessage:"Add rule exception"}),Sa=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.activeDetectionsLabel",{defaultMessage:"Active exceptions"}),ka=i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.expiredDetectionsLabel",{defaultMessage:"Expired exceptions"}),Oa={strict:!0,fields:{created_by:{type:"string"},description:{type:"string"},id:{type:"string"},item_id:{type:"string"},list_id:{type:"string"},name:{type:"string"},os_types:{type:"string"},tags:{type:"string"}}},wa=({canAddException:e,isEndpoint:t,isSearching:a,onSearch:i,onAddExceptionClick:r})=>{const s=Object(o.useCallback)((({queryText:e})=>{i({search:e})}),[i]),c=Object(o.useCallback)((()=>{r()}),[r]),u=Object(o.useMemo)((()=>t?xa:ja),[t]);return l.a.createElement(n.EuiFlexGroup,{alignItems:"center"},l.a.createElement(n.EuiFlexItem,{grow:!0},l.a.createElement(n.EuiSearchBar,{box:{placeholder:Ea,incremental:!0,schema:Oa,"data-test-subj":"exceptionsViewerSearchBar"},filters:[],onChange:s})),!e&&l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(n.EuiButton,{"data-test-subj":"exceptionsHeaderAddExceptionBtn",onClick:c,isDisabled:a,fill:!0},u)))};wa.displayName="ExceptionsViewerSearchBarComponent";const Ta=l.a.memo(wa);Ta.displayName="ExceptionsViewerSearchBar";const Ia=({pagination:e,onPaginationChange:t})=>{var a;const i=Object(o.useCallback)((a=>{t({pagination:{page:e.pageIndex,perPage:a}})}),[t,e.pageIndex]),r=Object(o.useCallback)((a=>{t({pagination:{page:a,perPage:e.pageSize}})}),[t,e.pageSize]);return l.a.createElement(n.EuiTablePagination,{"aria-label":fa,pageCount:null!==(a=Math.ceil(e.totalItemCount/e.pageSize))&&void 0!==a?a:0,activePage:e.pageIndex,onChangePage:r,itemsPerPage:e.pageSize,onChangeItemsPerPage:i,itemsPerPageOptions:e.pageSizeOptions,"data-test-subj":"allExceptionItemsPagination"})};Ia.displayName="ExceptionsViewerPaginationComponent";const Ca=l.a.memo(Ia);Ca.displayName="ExceptionsViewerPagination";const Ma=p.a.span.withConfig({displayName:"StyledText",componentId:"sc-1co6joy-0"})(["font-weight:bold;"]),_a=p.a.div.withConfig({displayName:"MyUtilities",componentId:"sc-1co6joy-1"})(["height:50px;"]),Fa=p()(n.EuiFlexGroup).withConfig({displayName:"StyledBarGroup",componentId:"sc-1co6joy-2"})(["align-items:center;"]),Aa=p()(qe.e).withConfig({displayName:"PaginationUtilityBarText",componentId:"sc-1co6joy-3"})(["align-self:center;"]),Da=({pagination:e,lastUpdated:t,exceptionsToShow:a,onChangeExceptionsToShow:i,isEndpoint:r})=>l.a.createElement(_a,null,l.a.createElement(qe.a,null,l.a.createElement(qe.d,null,l.a.createElement(qe.c,null,l.a.createElement(Aa,{dataTestSubj:"exceptionsShowing"},l.a.createElement(Le.FormattedMessage,{id:"xpack.securitySolution.exceptions.viewer.paginationDetails",defaultMessage:"Showing {partOne} of {partTwo}",values:{partOne:l.a.createElement(Ma,null,`${0===e.totalItemCount?"0":"1"}-${Math.min(e.pageSize,e.totalItemCount)}`),partTwo:l.a.createElement(Ma,null,`${e.totalItemCount}`)}})))),l.a.createElement(qe.d,null,l.a.createElement(Fa,null,l.a.createElement(qe.e,{dataTestSubj:"lastUpdated"},l.a.createElement(n.EuiText,{size:"s","data-test-subj":"exceptionsViewerLastUpdated"},l.a.createElement(Le.FormattedMessage,{id:"xpack.securitySolution.exceptions.viewer.lastUpdated",defaultMessage:"Updated {updated}",values:{updated:l.a.createElement(Ct.b,{value:t})}}))),!r&&l.a.createElement(n.EuiButtonGroup,{legend:"Displayed exceptions button group",options:[{id:"active",label:Sa},{id:"expired",label:ka}],idToSelectedMap:a,onChange:i,type:"multi"})))));Da.displayName="ExceptionsViewerUtilityComponent";const Na=l.a.memo(Da);Na.displayName="ExceptionsViewerUtility";var Pa=a(281);const Ra=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.editItemButton",{defaultMessage:"Edit rule exception"}),La=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.deleteItemButton",{defaultMessage:"Delete rule exception"}),Ba=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.endpoint.editItemButton",{defaultMessage:"Edit endpoint exception"}),qa=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.endpoint.deleteItemButton",{defaultMessage:"Delete endpoint exception"}),za=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.createdLabel",{defaultMessage:"Created"}),$a=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.updatedLabel",{defaultMessage:"Updated"}),Va=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.expiresLabel",{defaultMessage:"Expires at"}),Ua=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.expiredLabel",{defaultMessage:"Expired at"}),Ha=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.metaDetailsBy",{defaultMessage:"by"}),Ga=e=>i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.showCommentsLabel",{values:{comments:e},defaultMessage:"Show {comments, plural, =1 {comment} other {comments}} ({comments})"}),Qa=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.matchOperator",{defaultMessage:"IS"}),Wa=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.matchOperator.not",{defaultMessage:"IS NOT"}),Ka=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.wildcardMatchesOperator",{defaultMessage:"MATCHES"}),Ya=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.wildcardDoesNotMatchOperator",{defaultMessage:"DOES NOT MATCH"}),Ja=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.nestedOperator",{defaultMessage:"has"}),Xa=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.matchAnyOperator",{defaultMessage:"is one of"}),Za=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.matchAnyOperator.not",{defaultMessage:"is not one of"}),en=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.existsOperator",{defaultMessage:"exists"}),tn=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.existsOperator.not",{defaultMessage:"does not exist"}),an=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.listOperator",{defaultMessage:"included in"}),nn=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.listOperator.not",{defaultMessage:"is not included in"}),rn=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.and",{defaultMessage:"AND"}),sn=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.os",{defaultMessage:"OS"}),on=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.windows",{defaultMessage:"Windows"}),ln=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.linux",{defaultMessage:"Linux"}),cn=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.conditions.macos",{defaultMessage:"Mac"}),un=i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.affectedList",{defaultMessage:"Affects shared list"}),dn=Object(o.memo)((({item:e,actions:t,disableActions:a=!1,dataTestSubj:i})=>{const[r,s]=Object(o.useState)(!1),c=()=>s(!1),u=Object(o.useMemo)((()=>t.map((e=>l.a.createElement(n.EuiContextMenuItem,{"data-test-subj":`${i}-actionItem-${e.key}`,key:e.key,icon:e.icon,onClick:()=>{c(),e.onClick()}},e.label)))),[i,t]);return l.a.createElement(n.EuiFlexGroup,{"data-test-subj":i,justifyContent:"spaceBetween"},l.a.createElement(n.EuiFlexItem,{grow:9},l.a.createElement(n.EuiTitle,{size:"xs",textTransform:"uppercase","data-test-subj":`${i}-title`},l.a.createElement("h3",null,e.name))),l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(n.EuiPopover,{button:l.a.createElement(n.EuiButtonIcon,{isDisabled:a,"aria-label":"Exception item actions menu",iconType:"boxesHorizontal",onClick:()=>s((e=>!e)),"data-test-subj":`${i}-actionButton`}),panelPaddingSize:"none",isOpen:r,closePopover:c,"data-test-subj":`${i}-items`},l.a.createElement(n.EuiContextMenuPanel,{size:"s",items:u}))))}));dn.displayName="ExceptionItemCardHeader";var pn=a(316);const mn=p.a.div.withConfig({displayName:"Container",componentId:"sc-14md3lb-0"})(["display:inline;margin-left:",";"],(({theme:e})=>`${e.eui.euiSizeXS}`)),bn=({value:e,tooltipIconType:t="iInCircle",tooltipIconText:a})=>{const{showSpaceWarningIcon:i,warningText:r}=(({value:e,tooltipIconText:t})=>({showSpaceWarningIcon:!!(Array.isArray(e)?e.find(pn.d):Object(pn.d)(e)),warningText:t||pn.c.FIELD_SPACE_WARNING}))({value:e,tooltipIconText:a});return i&&e?l.a.createElement(mn,null,l.a.createElement(n.EuiToolTip,{position:"top",content:r},l.a.createElement(n.EuiIcon,{"data-test-subj":"value_with_space_warning_tooltip",type:t,color:"warning"}))):null},gn=Object.freeze({linux:ln,mac:cn,macos:cn,windows:on}),fn=Object.freeze({[m.d.NESTED]:Ja,[m.d.MATCH_ANY]:Xa,[m.d.MATCH]:Qa,[m.d.WILDCARD]:Ka,[m.d.EXISTS]:en,[m.d.LIST]:an}),yn=Object.freeze({[m.d.MATCH_ANY]:Za,[m.d.MATCH]:Wa,[m.d.WILDCARD]:Ya,[m.d.EXISTS]:tn,[m.d.LIST]:nn}),hn=p()(n.EuiFlexGroup).withConfig({displayName:"EuiFlexGroupNested",componentId:"sc-6hh4xv-0"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeXL)),vn=p()(n.EuiFlexItem).withConfig({displayName:"EuiFlexItemNested",componentId:"sc-6hh4xv-1"})(["margin-bottom:6px !important;margin-top:6px !important;"]),En=p()("span").withConfig({displayName:"StyledCondition",componentId:"sc-6hh4xv-2"})(["margin-right:6px;"]),xn=p()(n.EuiPanel).withConfig({displayName:"StyledConditionContent",componentId:"sc-6hh4xv-3"})(["border:1px;border-color:#d3dae6;border-style:solid;"]),jn=Object(o.memo)((({os:e,entries:t,dataTestSubj:a})=>{const i=Object(o.useMemo)((()=>null!=e&&e.length>0?e.map((e=>{var t;return null!==(t=gn[e])&&void 0!==t?t:e})).join(", "):null),[e]),r=(e,t)=>"match_any"===e&&Array.isArray(t)?t.map((e=>l.a.createElement(n.EuiBadge,{color:"hollow"},e))):null!=t?t:"",s=(e,t)=>{var a,n;return"nested"===e?"":"included"===t?null!==(a=fn[e])&&void 0!==a?a:e:null!==(n=yn[e])&&void 0!==n?n:e},c=Object(o.useCallback)(((e,t)=>{if("nested"===e&&t.length)return t.map((e=>{const{field:t,type:i,operator:o}=e,c="value"in e?e.value:"";return l.a.createElement(hn,{"data-test-subj":`${a}-nestedCondition`,key:t+i+c,direction:"row",alignItems:"center",gutterSize:"m",responsive:!1},l.a.createElement(vn,{grow:!1},l.a.createElement(n.EuiToken,{iconType:"tokenNested",size:"s"})),l.a.createElement(vn,{grow:!1},l.a.createElement(n.EuiExpression,{description:"",value:t,color:"subdued"})),l.a.createElement(vn,{grow:!1},l.a.createElement(n.EuiExpression,{description:s(i,o),value:r(i,c)})),l.a.createElement(bn,{value:c}))}))}),[a]),u=Object(o.useCallback)((e=>"list"===e.type?e.list.id:"value"in e?e.value:""),[]);return l.a.createElement(xn,{color:"subdued",hasBorder:!0,hasShadow:!1,"data-test-subj":a},null!=i&&l.a.createElement("div",{"data-test-subj":`${a}-os`},l.a.createElement("strong",null,l.a.createElement(n.EuiExpression,{description:"",value:sn}),l.a.createElement(n.EuiExpression,{description:Qa,value:i}))),t.map(((e,t)=>{const{field:i,type:o}=e,d=u(e),p="entries"in e?e.entries:[],m="operator"in e?e.operator:"";return l.a.createElement("div",{"data-test-subj":`${a}-condition`,key:i+o+d+t},l.a.createElement("div",{className:"eui-xScroll"},l.a.createElement(n.EuiExpression,{description:0===t?"":l.a.createElement(En,null,rn),value:i,color:0===t?"primary":"subdued"}),l.a.createElement(n.EuiExpression,{description:s(o,m),value:r(o,d)}),l.a.createElement(bn,{value:d})),null!=p&&c(o,p))})))}));jn.displayName="ExceptionItemCardConditions";var Sn=a(692);const kn=p()(n.EuiFlexItem).withConfig({displayName:"StyledFlexItem",componentId:"sc-1vvqq31-0"})(["border-right:1px solid #d3dae6;padding:4px 12px 4px 0;"]),On=Object(o.memo)((({item:e,listAndReferences:t,dataTestSubj:a})=>{const[r,s]=Object(o.useState)(!1),[c,u]=Object(o.useState)(!1),d=()=>u((e=>!e)),p=()=>s((e=>!e)),b=()=>u(!1),g=()=>s(!1),f=Object(o.useMemo)((()=>!!e.expire_time&&new Date(e.expire_time)<=new Date),[e]),y=Object(o.useMemo)((()=>null==t?[]:t.referenced_rules.map((e=>l.a.createElement(n.EuiContextMenuItem,{"data-test-subj":`${a}-rulesAffected-${e.id}`,key:e.id},l.a.createElement(n.EuiToolTip,{content:e.name,anchorClassName:"eui-textTruncate"},l.a.createElement(Sn.f,{external:!0,referenceId:e.id,referenceName:e.name})))))),[t,a]),h=Object(o.useMemo)((()=>{var e,r;return null==t?l.a.createElement(l.a.Fragment,null):l.a.createElement(kn,{grow:!1},l.a.createElement(n.EuiPopover,{button:l.a.createElement(n.EuiButtonEmpty,{onClick:d,iconType:"list","data-test-subj":`${a}-affectedRulesButton`},(r=null!==(e=null==t?void 0:t.referenced_rules.length)&&void 0!==e?e:0,i.i18n.translate("xpack.securitySolution.ruleExceptions.exceptionItem.affectedRules",{values:{numRules:r},defaultMessage:"Affects {numRules} {numRules, plural, =1 {rule} other {rules}}"}))),panelPaddingSize:"none",isOpen:c,closePopover:b,"data-test-subj":`${a}-rulesPopover`,id:"rulesPopover"},l.a.createElement(n.EuiContextMenuPanel,{size:"s",items:y})))}),[t,a,c,y]),v=Object(o.useMemo)((()=>null==t?l.a.createElement(l.a.Fragment,null):t.type!==m.b.RULE_DEFAULT?l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(n.EuiPopover,{button:l.a.createElement(n.EuiButtonEmpty,{onClick:p,iconType:"list","data-test-subj":`${a}-affectedListsButton`},un),panelPaddingSize:"none",isOpen:r,closePopover:g,"data-test-subj":`${a}-listsPopover`,id:"listsPopover"},l.a.createElement(n.EuiContextMenuPanel,{size:"s",items:[l.a.createElement(n.EuiContextMenuItem,{"data-test-subj":`${a}-listsAffected-${t.id}`,key:t.id},l.a.createElement(n.EuiToolTip,{content:t.name,anchorClassName:"eui-textTruncate"},l.a.createElement(Sn.e,{dataTestSubj:"link-to-exception-list",linkTitle:t.name,listId:null==t?void 0:t.list_id,external:!0})))]}))):l.a.createElement(l.a.Fragment,null)),[t,a,r]);return l.a.createElement(n.EuiFlexGroup,{alignItems:"center",responsive:!1,gutterSize:"s","data-test-subj":a},l.a.createElement(kn,{grow:!1},l.a.createElement(wn,{fieldName:"created_by",label:za,value1:l.a.createElement(Ct.a,{fieldName:"created_at",value:e.created_at}),value2:e.created_by,dataTestSubj:`${a}-createdBy`})),l.a.createElement(kn,{grow:!1},l.a.createElement(wn,{fieldName:"updated_by",label:$a,value1:l.a.createElement(Ct.a,{fieldName:"updated_at",value:e.updated_at}),value2:e.updated_by,dataTestSubj:`${a}-updatedBy`})),null!=e.expire_time&&l.a.createElement(l.a.Fragment,null,l.a.createElement(kn,{grow:!1},l.a.createElement(wn,{fieldName:"expire_time",label:f?Ua:Va,value1:l.a.createElement(Ct.a,{fieldName:"expire_time",value:e.expire_time}),dataTestSubj:`${a}-expireTime`}))),null!=t&&l.a.createElement(l.a.Fragment,null,h,v))}));On.displayName="ExceptionItemCardMetaInfo";const wn=Object(o.memo)((({label:e,value1:t,value2:a,dataTestSubj:i})=>l.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"s",wrap:!1,responsive:!1},l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(n.EuiText,{size:"xs",style:{fontFamily:"Inter"}},e)),l.a.createElement(n.EuiFlexItem,{grow:!1,"data-test-subj":`${i}-value1`},l.a.createElement(n.EuiBadge,{color:"default",style:{fontFamily:"Inter"}},t)),null!=a&&l.a.createElement(l.a.Fragment,null,l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(n.EuiText,{size:"xs",style:{fontFamily:"Inter"}},Ha)),l.a.createElement(n.EuiFlexItem,{grow:!1,"data-test-subj":`${i}-value2`},l.a.createElement(n.EuiFlexGroup,{responsive:!1,gutterSize:"xs",alignItems:"center",wrap:!1},l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(n.EuiBadge,{color:"hollow",style:{fontFamily:"Inter"}},a))))))));wn.displayName="MetaInfoDetails";const Tn=Object(o.memo)((({comments:e})=>{const{euiTheme:t}=Object(n.useEuiTheme)();return l.a.createElement(n.EuiFlexItem,null,l.a.createElement(n.EuiAccordion,{id:"exceptionItemCardComments",buttonContent:l.a.createElement(n.EuiText,{size:"s",style:{color:t.colors.primary}},Ga(e.length)),arrowDisplay:"none","data-test-subj":"exceptionsViewerCommentAccordion"},l.a.createElement(n.EuiPanel,{hasBorder:!1,hasShadow:!1,paddingSize:"m"},l.a.createElement(n.EuiCommentList,{comments:e}))))}));Tn.displayName="ExceptionItemCardComments";const In=({disableActions:e,exceptionItem:t,isEndpoint:a,listAndReferences:i,onDeleteException:r,onEditException:s,dataTestSubj:c})=>{const u=Object(o.useCallback)((()=>{r({id:t.id,name:t.name,namespaceType:t.namespace_type})}),[r,t.id,t.name,t.namespace_type]),d=Object(o.useCallback)((()=>{s(t)}),[s,t]),p=Object(o.useMemo)((()=>Object(Pa.j)(t.comments)),[t.comments]);return l.a.createElement(n.EuiPanel,{paddingSize:"l","data-test-subj":c,hasBorder:!0,hasShadow:!1},l.a.createElement(n.EuiFlexGroup,{gutterSize:"m",direction:"column"},l.a.createElement(n.EuiFlexItem,{"data-test-subj":`${c}-header`},l.a.createElement(dn,{item:t,actions:[{key:"edit",icon:"controlsHorizontal",label:a?Ba:Ra,onClick:d},{key:"delete",icon:"trash",label:a?qa:La,onClick:u}],disableActions:e,dataTestSubj:"exceptionItemCardHeader"})),l.a.createElement(n.EuiFlexItem,{"data-test-subj":`${c}-meta`},l.a.createElement(On,{item:t,listAndReferences:i,dataTestSubj:"exceptionItemCardMetaInfo"})),l.a.createElement(n.EuiFlexItem,null,l.a.createElement(jn,{os:t.os_types,entries:t.entries,dataTestSubj:"exceptionItemCardConditions"})),p.length>0&&l.a.createElement(Tn,{comments:p})))};In.displayName="ExceptionItemCardComponent";const Cn=l.a.memo(In);Cn.displayName="ExceptionItemCard";var Mn=a(1378),_n=a.n(Mn);const Fn=({isReadOnly:e,isEndpoint:t,currentState:a,onCreateExceptionListItem:i})=>{const{euiTheme:r}=Object(n.useEuiTheme)(),s=Object(o.useMemo)((()=>{switch(a){case"error":return l.a.createElement(n.EuiEmptyPrompt,{color:"danger",iconType:"error",title:l.a.createElement("h2",null,da),body:l.a.createElement("p",null,pa),"data-test-subj":"exceptionItemViewerEmptyPrompts-error"});case"empty":return l.a.createElement(n.EuiEmptyPrompt,{color:"subdued",iconType:"plusInCircle",iconColor:r.colors.darkestShade,title:l.a.createElement("h2",{"data-test-subj":"exceptionsEmptyPromptTitle"},sa),body:l.a.createElement("p",{"data-test-subj":"exceptionsEmptyPromptBody"},t?la:oa),actions:[l.a.createElement(n.EuiButton,{"data-test-subj":"exceptionsEmptyPromptButton",onClick:i,iconType:"plusInCircle",color:"primary",isDisabled:e,fill:!0},t?ua:ca)],"data-test-subj":"exceptionItemViewerEmptyPrompts-empty"});case"empty_search":return l.a.createElement(n.EuiEmptyPrompt,{color:"plain",layout:"horizontal",hasBorder:!0,hasShadow:!1,icon:l.a.createElement(n.EuiImage,{size:"fullWidth",alt:"",url:_n.a}),title:l.a.createElement("h3",null,ia),body:l.a.createElement("p",null,ra),"data-test-subj":"exceptionItemViewerEmptyPrompts-emptySearch"});default:return l.a.createElement(n.EuiSkeletonText,{lines:4,"data-test-subj":"exceptionItemViewerEmptyPrompts-loading"})}}),[a,r.colors.darkestShade,e,t,i]);return l.a.createElement(n.EuiPanel,{hasShadow:!1,hasBorder:!1,color:"empty_search"===a?"subdued":"transparent",style:{margin:`${r.size.l} 0`,padding:`${r.size.l} 0`}},s)},An=l.a.memo(Fn);An.displayName="ExeptionItemsViewerEmptyPrompts";const Dn=p()(n.EuiFlexItem).withConfig({displayName:"MyFlexItem",componentId:"sc-1rc5djy-0"})(["margin:",";&:first-child{margin:",";}"],(({theme:e})=>`${e.eui.euiSize} 0`),(({theme:e})=>`${e.eui.euiSizeXS} 0 ${e.eui.euiSize}`)),Nn=({isReadOnly:e,exceptions:t,isEndpoint:a,disableActions:i,ruleReferences:r,viewerState:s,onCreateExceptionListItem:o,onDeleteException:c,onEditExceptionItem:u})=>l.a.createElement(l.a.Fragment,null,null!=s&&"deleting"!==s?l.a.createElement(An,{isReadOnly:e,isEndpoint:a,currentState:s,onCreateExceptionListItem:o}):l.a.createElement(n.EuiFlexGroup,{direction:"column",className:"eui-yScrollWithShadows"},l.a.createElement(n.EuiFlexItem,{grow:!1,className:"eui-yScrollWithShadows"},l.a.createElement(n.EuiFlexGroup,{"data-test-subj":"exceptionsContainer",gutterSize:"none",direction:"column"},t.map((e=>l.a.createElement(Dn,{"data-test-subj":"exceptionItemContainer",grow:!1,key:e.id},l.a.createElement(Cn,{disableActions:i,exceptionItem:e,isEndpoint:a,listAndReferences:null!=r?r[e.list_id]:null,onDeleteException:c,onEditException:u,dataTestSubj:"exceptionItemsViewerItem"}))))))));Nn.displayName="ExceptionItemsViewerComponent";const Pn=l.a.memo(Nn);Pn.displayName="ExceptionsViewerItems";var Rn=a(598),Ln=a(418),Bn=a(807);const qn=p()(n.EuiText).withConfig({displayName:"StyledText",componentId:"sc-h4xwnx-0"})(["font-style:italic;"]),zn=["error"],$n=["loading","empty_search","empty","error","searching"],Vn={pagination:{pageIndex:0,pageSize:25,totalItemCount:0,pageSizeOptions:[5,10,25,50,100,200,300]},exceptions:[],exceptionToEdit:null,currenFlyout:null,viewerState:"loading",isReadOnly:!0,lastUpdated:Date.now(),exceptionsToShow:{active:!0}},Un=({rule:e,listTypes:t,isViewReadOnly:a,onRuleChange:r})=>{const{services:s}=Object(S.j)(),c=Object(S.n)(),[{canUserCRUD:u,hasIndexWrite:d}]=Object(K.b)(),p=Object(o.useMemo)((()=>null!=e&&null!=e.exceptions_list?e.exceptions_list.filter((({type:e})=>t.includes(e))):[]),[t,e]),b=Object(o.useMemo)((()=>p.map((({id:e,list_id:t,namespace_type:a})=>({id:e,listId:t,namespaceType:a})))),[p]),g=Object(o.useMemo)((()=>1===t.length&&t[0]===m.b.ENDPOINT),[t]),[{exceptions:f,pagination:y,currenFlyout:h,exceptionToEdit:v,viewerState:E,isReadOnly:x,lastUpdated:j,exceptionsToShow:k},O]=Object(o.useReducer)(((e,t)=>{switch(t.type){case"setExceptions":{var a;const{exceptions:n,pagination:i}=t;return{...e,pagination:{...e.pagination,pageIndex:i.page-1,pageSize:i.perPage,totalItemCount:null!==(a=i.total)&&void 0!==a?a:0},exceptions:n}}case"updateExceptionToEdit":{const{exception:a}=t;return{...e,exceptionToEdit:a}}case"updateFlyoutOpen":return{...e,currenFlyout:t.flyoutType};case"setViewerState":return{...e,viewerState:t.state};case"setIsReadOnly":return{...e,isReadOnly:t.readOnly};case"setLastUpdateTime":return{...e,lastUpdated:t.lastUpdate};case"setExceptionsToShow":{const a={...e.exceptionsToShow,[t.optionId]:!e.exceptionsToShow[t.optionId]};return a.active||a.expired?{...e,exceptionsToShow:a}:{...e,exceptionsToShow:{active:!0}}}default:return e}}),{...Vn}),w=Object(o.useCallback)((e=>{O({type:"setLastUpdateTime",lastUpdate:e})}),[O]),T=Object(o.useCallback)((({exceptions:e,pagination:t})=>{w(Date.now()),O({type:"setExceptions",exceptions:e,pagination:t})}),[O,w]),I=Object(o.useCallback)((e=>{O({type:"setViewerState",state:e})}),[O]),C=Object(o.useCallback)((e=>{O({type:"updateFlyoutOpen",flyoutType:e})}),[O]),M=Object(o.useCallback)((e=>{O({type:"setIsReadOnly",readOnly:e})}),[O]),_=Object(o.useCallback)((e=>{O({type:"setExceptionsToShow",optionId:e})}),[O]),[F,A,D,N]=Object(Bn.a)();Object(o.useEffect)((()=>{null!=N&&b.length&&N(b)}),[b,N]),Object(o.useEffect)((()=>{A?I("error"):null==E&&F?I("loading"):"loading"!==E||F||I(null)}),[F,A,I,E]);const P=Object(o.useMemo)((()=>p.map((e=>e.namespace_type))),[p]),R=Object(o.useMemo)((()=>{if(g||k.active&&k.expired)return;const e=Object(na.m)({namespaceType:P});return k.active?Object(na.d)(e):k.expired?Object(na.e)(e):void 0}),[k,P,g]),L=Object(o.useCallback)((async e=>{var t;const a=new AbortController,n=null!=(null==e?void 0:e.pagination)?{page:(null!==(t=e.pagination.page)&&void 0!==t?t:0)+1,perPage:e.pagination.perPage}:{page:y.pageIndex+1,perPage:y.pageSize};if(0===p.length)return{data:[],pageIndex:y.pageIndex,itemsPerPage:y.pageSize,total:0};const{page:i,per_page:r,total:o,data:l}=await Object(aa.m)({filter:R,http:s.http,listIds:p.map((e=>e.list_id)),namespaceTypes:P,search:null==e?void 0:e.search,pagination:n,signal:a.signal});return{data:l.map((e=>Object(ta.b)(e))),pageIndex:i,itemsPerPage:r,total:o}}),[y.pageIndex,y.pageSize,p,s.http,R,P]),B=Object(o.useCallback)((async()=>{const e=new AbortController;if(0===p.length)return 0;const{total:t}=await Object(aa.m)({filter:void 0,http:s.http,listIds:p.map((e=>e.list_id)),namespaceTypes:P,pagination:{},signal:e.signal});return t}),[p,P,s.http]),q=Object(o.useCallback)((async e=>{try{const{pageIndex:t,itemsPerPage:a,total:n,data:i}=await L(e);I(n>0?null:"empty"),T({exceptions:i,pagination:{page:t,perPage:a,total:n}}),I(n>0?null:await B()>0?"empty_search":"empty")}catch(e){I("error"),c.addError(e,{title:da,toastMessage:pa})}}),[L,T,I,c,B]),z=Object(o.useCallback)((async e=>{try{I("searching");const{pageIndex:t,itemsPerPage:a,total:n,data:i}=await L(e);I(n>0?null:"empty_search"),T({exceptions:i,pagination:{page:t,perPage:a,total:n}})}catch(e){c.addError(e,{title:ma,toastMessage:ba})}}),[L,T,I,c]),$=Object(o.useCallback)((e=>{_(e)}),[_]),V=Object(o.useCallback)((()=>{C("addException")}),[C]),U=Object(o.useCallback)((e=>{O({type:"updateExceptionToEdit",exception:e}),C("editException")}),[C]),H=Object(o.useCallback)((e=>{C(null),e&&null!=r&&r()}),[r,C]),G=Object(o.useCallback)((e=>{C(null),e&&null!=r&&r(),q()}),[C,q,r]),Q=Object(o.useCallback)((async({id:e,name:t,namespaceType:a})=>{const n=new AbortController;try{I("deleting"),await Object(aa.e)({http:s.http,id:e,namespaceType:a,signal:n.signal}),c.addSuccess({title:ya,text:(r=t,i.i18n.translate("xpack.securitySolution.ruleExceptions.allExceptionItems.exceptionItemDeleteSuccessText",{values:{itemName:r},defaultMessage:'"{itemName}" deleted successfully.'}))}),await q()}catch(e){I("error"),c.addError(e,{title:ga})}var r}),[q,s.http,I,c]);Object(o.useEffect)((()=>{M(a||!u||!d)}),[M,a,u,d]),Object(o.useEffect)((()=>{p.length>0?q():I("empty")}),[p.length,q,I]);const W=Object(o.useMemo)((()=>null!=D&&null!=v?D[v.list_id]:null),[D,v]);return l.a.createElement(l.a.Fragment,null,"editException"===h&&null!=W&&null!=v&&null!=e&&l.a.createElement(Rn.a,{rule:e,list:W,itemToEdit:v,showAlertCloseOptions:!0,onCancel:H,onConfirm:G,"data-test-subj":"editExceptionItemFlyout"}),"addException"===h&&null!=e&&l.a.createElement(Ln.a,{rules:[e],isBulkAction:!1,isEndpointItem:g,onCancel:H,onConfirm:G,"data-test-subj":"addExceptionItemFlyout",showAlertCloseOptions:!0}),l.a.createElement(n.EuiPanel,{hasBorder:!1,hasShadow:!1},l.a.createElement(l.a.Fragment,null,l.a.createElement(qn,{size:"s"},g?ha:va),l.a.createElement(n.EuiSpacer,{size:"l"}),!zn.includes(E)&&l.a.createElement(l.a.Fragment,null,l.a.createElement(Na,{pagination:y,exceptionsToShow:k,onChangeExceptionsToShow:$,lastUpdated:j,isEndpoint:g}),l.a.createElement(n.EuiSpacer,{size:"m"}),l.a.createElement(Ta,{canAddException:x,isEndpoint:g,isSearching:"searching"===E,onSearch:z,onAddExceptionClick:V})),l.a.createElement(n.EuiSpacer,{size:"l"}),l.a.createElement(Pn,{isReadOnly:x,disableActions:x||"deleting"===E,exceptions:f,isEndpoint:g,ruleReferences:D,viewerState:E,onDeleteException:Q,onEditExceptionItem:U,onCreateExceptionListItem:V}),!$n.includes(E)&&l.a.createElement(Ca,{onPaginationChange:q,pagination:y}))))};Un.displayName="ExceptionsViewerComponent";const Hn=l.a.memo(Un);Hn.displayName="ExceptionsViewer";var Gn=a(123);function Qn({ruleId:e,disabled:t=!1,disabledReason:a}){const{application:{navigateToApp:i}}=Object(S.j)().services,r=Object(o.useCallback)((t=>{t.preventDefault(),i(oe.l,{deepLinkId:Oe.a.rules,path:Object(O.b)(e)})}),[i,e]);return l.a.createElement(n.EuiToolTip,{position:"top",content:a},l.a.createElement(Gn.l,{"data-test-subj":"editRuleSettingsLink",onClick:r,iconType:"controlsHorizontal",isDisabled:t,deepLinkId:Oe.a.rules,path:Object(O.b)(e)},ye.Cb))}var Wn=a(1052),Kn=a(1113),Yn=a(1114),Jn=a(863),Xn=a(752),Zn=a(956),ei=a(213);const ti=p.a.div.withConfig({displayName:"StyledFullHeightContainer",componentId:"sc-fdhtli-0"})(["display:flex;flex-direction:column;flex:1 1 auto;"]),ai=p.a.div.withConfig({displayName:"StyledMinHeightTabContainer",componentId:"sc-fdhtli-1"})(["min-height:800px;"]);let ni;!function(e){e.alerts="alerts",e.exceptions="rule_exceptions",e.endpointExceptions="endpoint_exceptions",e.executionResults="execution_results",e.executionEvents="execution_events"}(ni||(ni={}));const ii={[ni.alerts]:Gt.a,[ni.exceptions]:Wt.e,[ni.endpointExceptions]:Wt.d,[ni.executionResults]:Wt.g,[ni.executionEvents]:Wt.f},ri=({clearEventsDeleted:e,clearEventsLoading:t,clearSelected:a})=>{var d,p,M,_,F,A,D;const{data:N,application:{navigateToApp:P,capabilities:{actions:R}},timelines:L,spaces:B}=Object(S.j)().services,q=Object(u.useDispatch)(),z=Object(o.useRef)(null),$=Object(o.useMemo)((()=>g.j.getTableByIdSelector()),[]),V=Object(j.b)((e=>{var t;return(null!==(t=$(e,g.e.alertsOnRuleDetailsPage))&&void 0!==t?t:g.q).graphEventId})),U=Object(j.b)((e=>{var t;return(null!==(t=$(e,g.e.alertsOnRuleDetailsPage))&&void 0!==t?t:g.q).updated})),G=Object(j.b)((e=>{var t;return(null!==(t=$(e,g.e.alertsOnRuleDetailsPage))&&void 0!==t?t:g.q).isLoading})),Q=Object(o.useMemo)((()=>re.d.globalFiltersQuerySelector()),[]),le=Object(o.useMemo)((()=>re.d.globalQuerySelector()),[]),ce=Object(j.a)(le),de=Object(j.a)(Q),{to:pe,from:be}=Object(ie.a)(),[{loading:ge,isSignalIndexExists:fe,isAuthenticated:he,hasEncryptionKey:ve,canUserCRUD:Ee,hasIndexRead:Ae,signalIndexName:De,hasIndexWrite:Ne,hasIndexMaintenance:Pe}]=Object(K.b)(),{loading:Re,needsConfiguration:Le}=Object(I.a)(),{indexPattern:Be,runtimeMappings:qe,loading:ze}=Object(Ce.d)(Me.SourcererScopeName.detections),$e=ge||Re,{detailName:Ve}=Object(c.useParams)(),{rule:Ue,refresh:He,loading:Qe,isExistingRule:We}=Object(Jt.a)(Ve),{pollForSignalIndex:Ke}=Object(Zt.a)(),[Ye,Je]=Object(o.useState)(null),Xe=Qe&&null==Ye,{starting:Ze,startMlJobs:et}=Object(Wn.a)(),tt=Object(o.useCallback)((async()=>{await et(null==Ye?void 0:Ye.machine_learning_job_id)}),[Ye,et]),at=Object(o.useMemo)((()=>({[ni.alerts]:{id:ni.alerts,name:ii[ni.alerts],disabled:!1,href:`/rules/id/${Ve}/${ni.alerts}`},[ni.exceptions]:{id:ni.exceptions,name:ii[ni.exceptions],disabled:null==Ye,href:`/rules/id/${Ve}/${ni.exceptions}`},[ni.endpointExceptions]:{id:ni.endpointExceptions,name:ii[ni.endpointExceptions],disabled:null==Ye,href:`/rules/id/${Ve}/${ni.endpointExceptions}`},[ni.executionResults]:{id:ni.executionResults,name:ii[ni.executionResults],disabled:!We,href:`/rules/id/${Ve}/${ni.executionResults}`},[ni.executionEvents]:{id:ni.executionEvents,name:ii[ni.executionEvents],disabled:!We,href:`/rules/id/${Ve}/${ni.executionEvents}`}})),[We,Ye,Ve]),[nt,it]=Object(o.useState)(at),[rt,st,ot]=Object(ue.a)(),[lt,ct,ut]=Object(Jn.a)({onInit:st,onFinish:ot}),{aboutRuleData:dt,modifiedAboutRuleDetailsData:pt,defineRuleData:mt,scheduleRuleData:bt,ruleActionsData:gt}=null!=Ye?Object(ae.g)({rule:Ye,detailsView:!0}):{aboutRuleData:null,modifiedAboutRuleDetailsData:null,defineRuleData:null,scheduleRuleData:null,ruleActionsData:null},[ft,yt]=Object(o.useState)();Object(o.useEffect)((()=>{(async()=>{if(null!=(null==mt?void 0:mt.dataViewId)&&""!==(null==mt?void 0:mt.dataViewId)){const e=await N.dataViews.get(null==mt?void 0:mt.dataViewId);yt(e.title)}})()}),[N.dataViews,null==mt?void 0:mt.dataViewId]);const{indexPattern:ht}=Object(Zn.b)({dataSourceType:null!==(d=null==mt?void 0:mt.dataSourceType)&&void 0!==d?d:ei.a.IndexPatterns,index:null!==(p=null==mt?void 0:mt.index)&&void 0!==p?p:[],dataViewId:null==mt?void 0:mt.dataViewId}),{showBuildingBlockAlerts:vt,setShowBuildingBlockAlerts:Et,showOnlyThreatIndicatorAlerts:xt}=Object(h.a)(g.e.alertsOnRuleDetailsPage),jt=Object(je.a)(),{globalFullScreen:St}=Object(we.a)(),[kt,Ot]=Object(o.useState)(g.c),{isSavedQueryLoading:wt,savedQueryBar:Tt}=Object(Qt.a)({savedQueryId:null==Ye?void 0:Ye.saved_id,ruleType:null==Ye?void 0:Ye.type}),It=Object(ke.a)(jt)&&Object(Se.a)(jt),Ct=Object(o.useMemo)((()=>!(null!=(null==Ye?void 0:Ye.actions)&&(null==Ye?void 0:Ye.actions.length)>0&&Object(me.d)(R.show))||R.show),[R,null==Ye?void 0:Ye.actions]),Mt=Object(o.useCallback)((()=>{P(oe.l,{deepLinkId:Oe.a.rules,path:Object(O.c)(null!=Ve?Ve:"","alerts","")})}),[P,Ve]);Object(o.useEffect)((()=>{null!=Ue&&Je(Ue)}),[Ue]),Object(o.useEffect)((()=>{if(Ye){const e=Ye.outcome;if(B&&"aliasMatch"===e){const e=`rules/id/${Ye.id}${window.location.search}${window.location.hash}`;B.ui.redirectLegacyUrl({path:e,aliasPurpose:Ye.alias_purpose,objectNoun:i.i18n.translate("xpack.triggersActionsUI.sections.ruleDetails.redirectObjectNoun",{defaultMessage:"rule"})})}}}),[Ye,B]);const _t=Object(o.useMemo)((()=>{if(null!=(null==Ye?void 0:Ye.alias_target_id)&&B&&"conflict"===Ye.outcome){const e=Ye.alias_target_id,t=`rules/id/${e}${window.location.search}${window.location.hash}`;return l.a.createElement(l.a.Fragment,null,l.a.createElement(n.EuiSpacer,null),B.ui.components.getLegacyUrlConflict({objectNoun:i.i18n.translate("xpack.triggersActionsUI.sections.ruleDetails.redirectObjectNoun",{defaultMessage:"rule"}),currentObjectId:Ye.id,otherObjectId:e,otherObjectPath:t}))}return null}),[Ye,B]),Ft=Object(Fe.e)();Object(o.useEffect)((()=>{const e=[];var t;(Ae||e.push(ni.alerts),Ft.extendedLogging.isEnabled||e.push(ni.executionEvents),null!=Ye)&&((null!==(t=Ye.exceptions_list)&&void 0!==t?t:[]).some((e=>e.type===m.b.ENDPOINT))||e.push(ni.endpointExceptions));const a=Object(s.omit)(e,at);it(a)}),[Ae,Ye,at,Ft]);const At=Object(o.useMemo)((()=>ze||G||$e),[ze,G,$e]),Dt=Object(o.useMemo)((()=>l.a.createElement(l.a.Fragment,null,null==Ye?void 0:Ye.name," ",Qe&&l.a.createElement(n.EuiLoadingSpinner,{size:"m"}))),[Ye,Qe]),Nt=Object(o.useMemo)((()=>Qe||We?void 0:{text:Wt.a,color:"default"}),[We,Qe]),Pt=Object(o.useMemo)((()=>Ye?[l.a.createElement(ne.a,{createdBy:null==Ye?void 0:Ye.created_by,createdAt:null==Ye?void 0:Ye.created_at}),null!=(null==Ye?void 0:Ye.updated_by)?l.a.createElement(ne.b,{updatedBy:null==Ye?void 0:Ye.updated_by,updatedAt:null==Ye?void 0:Ye.updated_at}):""]:Qe?l.a.createElement(n.EuiLoadingSpinner,{size:"m"}):null),[Ye,Qe]),Rt=Object(o.useCallback)((n=>{const i=g.e.alertsOnRuleDetailsPage;t({id:i}),e({id:i}),a({id:i}),Ot(n)}),[t,e,a,Ot]);Object(o.useEffect)((()=>{Et(null!=(null==Ye?void 0:Ye.building_block_type))}),[Ye,Et]);const Lt=Object(o.useMemo)((()=>{var e;return[...Object(Z.c)(null!==(e=null==Ye?void 0:Ye.rule_id)&&void 0!==e?e:""),...Object(Z.d)(vt),...Object(Z.a)(kt),...Object(Z.e)(xt)]}),[Ye,vt,xt,kt]),Bt=Object(o.useMemo)((()=>[...Lt,...de]),[Lt,de]),qt=null==Ye||null===(M=Ye.execution_summary)||void 0===M?void 0:M.last_execution,zt=null==qt?void 0:qt.status,$t=null!==(_=null==qt?void 0:qt.date)&&void 0!==_?_:"",Vt=null!==(F=null==qt?void 0:qt.message)&&void 0!==F?F:"",Ut=Object(o.useMemo)((()=>l.a.createElement(l.a.Fragment,null,Qe?l.a.createElement(n.EuiFlexItem,null,l.a.createElement(n.EuiLoadingSpinner,{size:"m","data-test-subj":"rule-status-loader"})):l.a.createElement(_e.a,{status:zt,date:$t},l.a.createElement(n.EuiButtonIcon,{"data-test-subj":"ruleLastExecutionStatusRefreshButton",color:"primary",onClick:He,iconType:"refresh","aria-label":ye.dc,isDisabled:!We})),l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(Xn.a,{ruleId:Ve,showTooltipInline:!0})))),[Ve,zt,$t,Qe,We,He]),Gt=Object(o.useMemo)((()=>Qe?l.a.createElement(n.EuiFlexItem,null,l.a.createElement(n.EuiLoadingSpinner,{size:"m","data-test-subj":"rule-status-loader"})):l.a.createElement(_e.c,{status:zt,date:$t,message:Vt})),[zt,$t,Vt,Qe]),ta=Object(o.useCallback)((({x:e})=>{if(!e)return;const[t,a]=e;q(Object(se.setAbsoluteRangeDatePicker)({id:x.a.global,from:new Date(t).toISOString(),to:new Date(a).toISOString()}))}),[q]),aa=Object(o.useCallback)((e=>{Je((t=>t?{...t,enabled:e}:t))}),[]),na=Object(o.useCallback)((()=>{Object(Ie.j)(z.current)}),[z]),ia=Object(o.useCallback)((()=>{Object(Ie.m)()}),[]),ra=Object(o.useCallback)((e=>{Object(b.isTab)(e)&&Object(Ie.l)({containerElement:z.current,keyboardEvent:e,onSkipFocusBeforeEventsTable:na,onSkipFocusAfterEventsTable:ia})}),[z,na,ia]),sa=Object(o.useMemo)((()=>[kt]),[kt]),oa=Object(o.useMemo)((()=>L.getLastUpdated({updatedAt:U||Date.now(),showUpdating:At})),[U,At,L]),la=Object(o.useCallback)((e=>l.a.createElement(f.a,{configId:oe.e.RULE_DETAILS,flyoutSize:"m",inputFilters:[...Bt,...e],tableId:g.e.alertsOnRuleDetailsPage,onRuleChange:He})),[Bt,He]),{isBulkDuplicateConfirmationVisible:ca,showBulkDuplicateConfirmation:ua,cancelRuleDuplication:da,confirmRuleDuplication:pa}=Object(Kn.a)();if(Object(ae.h)(fe,he,ve,Le))return P(oe.l,{deepLinkId:Oe.a.alerts,path:Object(O.a)()}),null;const ma=null!=gt&&gt.actions.length>0,ba=null!=gt&&(gt.responseActions||[]).length>0,ga=ma||ba;return l.a.createElement(l.a.Fragment,null,l.a.createElement(Kt.a,null),l.a.createElement(Yt.a,null),ca&&l.a.createElement(Yn.a,{onCancel:da,onConfirm:pa,rulesCount:1}),rt&&l.a.createElement(n.EuiConfirmModal,{title:ye.Vc,onCancel:ut,onConfirm:ct,confirmButtonText:ye.wb,cancelButtonText:ye.vb,buttonColor:"danger",defaultFocusedButton:"confirm","data-test-subj":"deleteRulesConfirmationModal"},Wt.b),l.a.createElement(ti,{onKeyDown:ra,ref:z},l.a.createElement(n.EuiWindowEvent,{event:"resize",handler:s.noop}),l.a.createElement(k.a,{show:Object(Ie.n)({globalFullScreen:St,graphEventId:V})},l.a.createElement(w.a,{id:x.a.global,pollForSignalIndex:Ke,indexPattern:Be})),l.a.createElement(Ge,null,l.a.createElement(T.a,{noPadding:St},l.a.createElement(Te.a,{show:!St},l.a.createElement(ea.a,{border:!0,subtitle:Pt,subtitle2:l.a.createElement(l.a.Fragment,null,l.a.createElement(n.EuiFlexGroup,{gutterSize:"xs",alignItems:"center",justifyContent:"flexStart"},l.a.createElement(n.EuiFlexItem,{grow:!1},_e.d.STATUS,":"),Ut)),title:Dt,badgeOptions:Nt},l.a.createElement(n.EuiFlexGroup,{alignItems:"center"},l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(n.EuiToolTip,{position:"top",content:Object(me.b)(Ye,It,Ct,Ee)},l.a.createElement(n.EuiFlexGroup,null,l.a.createElement(ee.a,{id:null!==(A=null==Ye?void 0:Ye.id)&&void 0!==A?A:"-1",isDisabled:!We||!Object(me.a)(Ye,Ct)||!Object(me.c)(Ee)||Object(v.d)(null==Ye?void 0:Ye.type)&&!It,enabled:We&&null!==(D=null==Ye?void 0:Ye.enabled)&&void 0!==D&&D,startMlJobsIfNeeded:tt,onChange:aa}),l.a.createElement(n.EuiFlexItem,null,Wt.c)))),l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"s",responsive:!1},l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(Qn,{ruleId:Ve,disabled:!We||!Object(me.c)(Ee)||Object(v.d)(null==Ye?void 0:Ye.type)&&!It,disabledReason:Object(me.b)(Ye,It,Ct,Ee)})),l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(xe,{rule:Ye,userHasPermissions:We&&Object(me.c)(Ee),canDuplicateRuleWithActions:Object(me.a)(Ye,Ct),showBulkDuplicateExceptionsConfirmation:ua,confirmDeletion:lt})))))),Gt,_t,l.a.createElement(n.EuiSpacer,null),l.a.createElement(n.EuiFlexGroup,null,l.a.createElement(n.EuiFlexItem,{"data-test-subj":"aboutRule",component:"section",grow:1},l.a.createElement(H,{loading:Xe,stepData:dt,stepDataDetails:pt})),l.a.createElement(n.EuiFlexItem,{grow:1},l.a.createElement(n.EuiFlexGroup,{direction:"column"},l.a.createElement(n.EuiFlexItem,{component:"section",grow:1,"data-test-subj":"defineRule"},l.a.createElement(te.a,{loading:Xe||wt,title:ye.tb},null!=mt&&!wt&&!Ze&&l.a.createElement(Y.c,{addPadding:!1,descriptionColumns:"singleSplit",defaultValues:{dataViewTitle:ft,...mt,queryBar:null!=Tt?Tt:mt.queryBar},indexPattern:ht}))),l.a.createElement(n.EuiSpacer,null),l.a.createElement(n.EuiFlexItem,{"data-test-subj":"schedule",component:"section",grow:1},l.a.createElement(te.a,{loading:Xe,title:ye.Mc},null!=bt&&l.a.createElement(J.b,{addPadding:!1,descriptionColumns:"singleSplit",defaultValues:bt}))),ga&&l.a.createElement(n.EuiFlexItem,{"data-test-subj":"actions",component:"section",grow:1},l.a.createElement(te.a,{loading:Xe,title:ye.c},l.a.createElement(X.b,{addPadding:!1,defaultValues:gt})))))),l.a.createElement(n.EuiSpacer,null),l.a.createElement(E.a,{navTabs:nt}),l.a.createElement(n.EuiSpacer,null)),l.a.createElement(ai,null,l.a.createElement(r.c,null,l.a.createElement(r.a,{path:`/rules/id/:detailName/:tabName(${ni.alerts})`},l.a.createElement(l.a.Fragment,null,l.a.createElement(n.EuiFlexGroup,{alignItems:"center",justifyContent:"spaceBetween"},l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(Xt.a,{status:kt,onFilterGroupChanged:Rt})),l.a.createElement(n.EuiFlexItem,{grow:!1},oa)),l.a.createElement(n.EuiSpacer,{size:"l"}),l.a.createElement(Te.a,{show:!St},l.a.createElement(W.a,{filters:Bt,query:ce,signalIndexName:De,defaultStackByOption:"event.category",updateDateRange:ta,runtimeMappings:qe}),l.a.createElement(n.EuiSpacer,null)),null!=Ve&&l.a.createElement(y.a,{currentAlertStatusFilterValue:sa,defaultFilters:Bt,from:be,globalFilters:de,globalQuery:ce,hasIndexMaintenance:null!=Pe&&Pe,hasIndexWrite:null!=Ne&&Ne,loading:$e,renderChildComponent:la,runtimeMappings:qe,signalIndexName:De,tableId:g.e.alertsOnRuleDetailsPage,to:pe}))),l.a.createElement(r.a,{path:`/rules/id/:detailName/:tabName(${ni.exceptions})`},l.a.createElement(Hn,{rule:Ye,listTypes:[m.b.DETECTION,m.b.RULE_DEFAULT],onRuleChange:He,isViewReadOnly:!We,"data-test-subj":"exceptionTab"})),l.a.createElement(r.a,{path:`/rules/id/:detailName/:tabName(${ni.endpointExceptions})`},l.a.createElement(Hn,{rule:Ye,listTypes:[m.b.ENDPOINT],onRuleChange:He,isViewReadOnly:!We,"data-test-subj":"endpointExceptionsTab"})),l.a.createElement(r.a,{path:`/rules/id/:detailName/:tabName(${ni.executionResults})`},l.a.createElement(Ht,{ruleId:Ve,selectAlertsTab:Mt})),l.a.createElement(r.a,{path:`/rules/id/:detailName/:tabName(${ni.executionEvents})`},l.a.createElement(Fe.a,{ruleId:Ve}))))))),l.a.createElement(C.a,{pageName:Oe.a.rules,state:{ruleName:null==Ye?void 0:Ye.name,isExistingRule:We}}))},si=Object(u.connect)(null,(e=>({clearSelected:({id:t})=>e(g.h.clearSelected({id:t})),clearEventsLoading:({id:t})=>e(g.h.clearEventsLoading({id:t})),clearEventsDeleted:({id:t})=>e(g.h.clearEventsDeleted({id:t}))})));ri.displayName="RuleDetailsPageComponent";const oi=si(l.a.memo(ri));oi.displayName="RuleDetailsPage"},function(e,t,a){"use strict";a.d(t,"a",(function(){return O})),a.d(t,"c",(function(){return h})),a.d(t,"b",(function(){return le})),a.d(t,"d",(function(){return me}));var n=a(54),i=a(42),r=a(2),s=a.n(r),o=a(142),l=a(573),c=a(40),u=a(568),d=a(461),p=a(821);const m=({showAlertDetails:e,isolateAction:t})=>s.a.createElement(s.a.Fragment,null,s.a.createElement(c.EuiButtonEmpty,{iconType:"arrowLeft",iconSide:"left",flush:"left",onClick:e},s.a.createElement(c.EuiText,{size:"xs"},s.a.createElement("p",null,p.a))),s.a.createElement(c.EuiTitle,null,s.a.createElement("h2",null,"isolateHost"===t?d.b:d.d))),b=s.a.memo(m),g=({eventId:e,eventIndex:t,isAlert:a,isHostIsolationPanelOpen:n,isolateAction:i,loading:r,promptContextId:o,ruleName:l,showAlertDetails:c,timestamp:d})=>s.a.createElement(s.a.Fragment,null,n?s.a.createElement(b,{isolateAction:i,showAlertDetails:c}):s.a.createElement(u.b,{eventId:e,eventIndex:t,isAlert:a,loading:r,promptContextId:o,ruleName:l,timestamp:d})),f=s.a.memo(g),y=({eventId:e,eventIndex:t,isAlert:a,isHostIsolationPanelOpen:n,isolateAction:i,loading:r,promptContextId:o,ruleName:l,showAlertDetails:u,timestamp:d})=>s.a.createElement(c.EuiFlyoutHeader,{hasBorder:n},s.a.createElement(g,{eventId:e,eventIndex:t,isAlert:a,isHostIsolationPanelOpen:n,isolateAction:i,loading:r,promptContextId:o,ruleName:l,showAlertDetails:u,timestamp:d})),h=s.a.memo(y);var v=a(41),E=a.n(v),x=a(399),j=a(748);const S=E()(c.EuiFlyoutBody).withConfig({displayName:"StyledEuiFlyoutBody",componentId:"sc-p7dcu3-0"})([".euiFlyoutBody__overflow{display:flex;flex:1;overflow:hidden;.euiFlyoutBody__overflowContent{flex:1;overflow:hidden;padding:",";}}"],(({theme:e})=>`0 ${e.eui.euiSizeM} ${e.eui.euiSizeM}`)),k=({alertId:e,browserFields:t,detailsData:a,detailsEcsData:n,event:i,handleIsolationActionSuccess:r,handleOnEventClosed:o,hostName:l,isAlert:c,isDraggable:d,isReadOnly:p,isolateAction:m,isHostIsolationPanelOpen:b,isIsolateActionSuccessBannerVisible:g,loading:f,rawEventData:y,showAlertDetails:h,scopeId:v})=>s.a.createElement(S,null,g&&s.a.createElement(x.c,{hostName:l,alertId:e,isolateAction:m}),b?s.a.createElement(j.a,{details:a,cancelCallback:h,successCallback:r,isolateAction:m}):s.a.createElement(u.a,{browserFields:t,detailsData:a,detailsEcsData:n,event:i,isAlert:c,isDraggable:d,loading:f,rawEventData:y,scopeId:v,timelineTabType:"flyout",handleOnEventClosed:o,isReadOnly:p})),O=s.a.memo(k);var w=a(104),T=a.n(w),I=a(103),C=a(115),M=a(119),_=a(291),F=a(199),A=a(44),D=a(126),N=a(319),P=a(350),R=a(1132),L=a(1096),B=a(823),q=a(558),z=a(500),$=a(824),V=a(932),U=a(185),H=a(8),G=a(239),Q=a(1384),W=a(228);var K=a(124),Y=a(887),J=a(102),X=a(805),Z=a(825);const ee=s.a.memo((({detailsData:e,ecsData:t,handleOnEventClosed:a,isHostIsolationPanelOpen:n,loadingEventDetails:i,onAddEventFilterClick:o,onAddExceptionTypeClick:l,onAddIsolationStatusClick:u,refetch:p,refetchFlyoutData:m,onOsqueryClick:b,scopeId:g})=>{var f;const y=Object(K.a)("tGridEnabled"),{loading:h,canWriteEventFilters:v}=Object(D.a)().endpointPrivileges,E=Object(r.useMemo)((()=>!h&&v),[v,h]),{osquery:x}=Object(J.j)().services,[j,S]=Object(r.useState)(!1),k=Object(r.useMemo)((()=>[{category:"kibana",field:"kibana.alert.rule.uuid",name:"ruleId"},{category:"kibana",field:"kibana.alert.rule.name",name:"ruleName"},{category:"kibana",field:"kibana.alert.workflow_status",name:"alertStatus"},{category:"event",field:"event.kind",name:"eventKind"},{category:"_id",field:"_id",name:"eventId"}].reduce(((t,a)=>({...t,[a.name]:Object(P.a)({category:a.category,field:a.field},e)})),{})),[e]),O="event"===k.eventKind,w=Object(r.useMemo)((()=>{var e,a;return null==t||null===(e=t.agent)||void 0===e||null===(a=e.type)||void 0===a?void 0:a.includes("endpoint")}),[t]),T=Object(r.useMemo)((()=>O&&w),[O,w]),I=Object(r.useMemo)((()=>Object(P.a)({category:"agent",field:"agent.id"},e)),[e]),ee=Object(r.useCallback)((()=>{S(!j)}),[j]),te=Object(r.useCallback)((()=>{S(!1)}),[]),ae=Object(r.useCallback)((()=>{a(),S(!1)}),[a]),ne=Object(r.useCallback)((e=>{u(e),S(!1)}),[u]),ie=(({closePopover:e,detailsData:t,isHostIsolationPanelOpen:a,onAddIsolationStatusClick:n})=>{const{canIsolateHost:i,canUnIsolateHost:s}=Object(D.a)().endpointPrivileges,o=Object(r.useMemo)((()=>Object(N.b)({data:t||[]})),[t]),l=Object(r.useMemo)((()=>Object(P.a)({category:"agent",field:"agent.id"},t)),[t]),c=Object(r.useMemo)((()=>Object(P.a)({category:"host",field:"host.os.name"},t)),[t]),u=Object(r.useMemo)((()=>Object(P.a)({category:"agent",field:"agent.version"},t)),[t]),{loading:p,isIsolated:m,agentStatus:b,capabilities:g}=(({agentId:e})=>{const[t,a]=Object(r.useState)(!1),[n,i]=Object(r.useState)([]),[s,o]=Object(r.useState)(),[l,c]=Object(r.useState)(0),[u,d]=Object(r.useState)(0),[p,m]=Object(r.useState)(!1);return Object(r.useEffect)((()=>{const t=new AbortController;let n,r=!0;return m(!0),Object(H.isEmpty)(e)||(async()=>{try{const s=await Object(G.g)({agentId:e,signal:t.signal});r&&(a(Object(W.b)(s.metadata)),s.metadata.Endpoint.capabilities&&i([...s.metadata.Endpoint.capabilities]),o(s.host_status),n=s.metadata.elastic.agent.id)}catch(e){if("AbortError"===e.name)return;r&&400===e.body.statusCode&&o(U.c.UNENROLLED)}try{const{data:e}=await Object(Q.a)(n);var s,l,u,p;r&&(c(null!==(s=null===(l=e[0].pending_actions)||void 0===l?void 0:l.isolate)&&void 0!==s?s:0),d(null!==(u=null===(p=e[0].pending_actions)||void 0===p?void 0:p.unisolate)&&void 0!==u?u:0))}catch(e){return}r&&m(!1)})(),()=>{r=!1,t.abort()}}),[e]),{loading:p,capabilities:n,isIsolated:t,agentStatus:s,pendingIsolation:l,pendingUnisolation:u}})({agentId:l}),f=Object(r.useMemo)((()=>!!o&&Object(V.a)({osName:c,version:u,capabilities:g})),[u,g,c,o]),y=Object(r.useCallback)((()=>{e(),n(m?"unisolateHost":"isolateHost")}),[e,m,n]);return Object(r.useMemo)((()=>{if(!o||!f||p||a)return[];const e=[{key:"isolate-host-action-item","data-test-subj":"isolate-host-action-item",disabled:b===U.c.UNENROLLED,onClick:y,name:m?d.d:d.b}];return i||m&&s?e:[]}),[o,f,p,a,b,y,i,m,s])})({closePopover:te,detailsData:e,onAddIsolationStatusClick:ne,isHostIsolationPanelOpen:n}),re=((e,t)=>{const{loading:a,canAccessResponseConsole:n}=Object(D.a)().endpointPrivileges,i=Object(r.useMemo)((()=>Object(N.c)(e||[])),[e]),o=Object(r.useMemo)((()=>Object(P.a)({category:"agent",field:"agent.id"},e)),[e]),{handleResponseActionsClick:l,isDisabled:c,tooltip:u}=Object(R.a)({endpointId:o,onClick:t});return Object(r.useMemo)((()=>{const e=[];return!a&&n&&i&&e.push({key:"endpointResponseActions-action-item","data-test-subj":"endpointResponseActions-action-item",disabled:c,toolTipContent:u,size:"s",onClick:l,name:s.a.createElement(A.FormattedMessage,{id:"xpack.securitySolution.endpoint.detections.takeAction.responseActionConsole.buttonLabel",defaultMessage:"Respond"})}),e}),[n,l,i,a,c,u])})(e,te),se=Object(r.useCallback)((e=>{l(e),S(!1)}),[l]),{exceptionActionItems:oe}=Object(B.a)({isEndpointAlert:Object(N.a)({ecsData:t}),onAddExceptionTypeClick:se}),le=Object(r.useCallback)((()=>{o(),S(!1)}),[o]),{eventFilterActionItems:ce}=Object($.a)({onAddEventFilterClick:le}),ue=Object(r.useCallback)((()=>{te()}),[te]),{actionItems:de}=Object(q.a)({alertStatus:k.alertStatus,closePopover:ae,eventId:k.eventId,refetch:p,scopeId:g}),{alertTagsItems:pe,alertTagsPanels:me}=Object(Z.a)({closePopover:te,ecsRowData:null!=t?t:{_id:k.eventId},refetch:p}),{investigateInTimelineActionItems:be}=Object(z.a)({ecsRowData:t,onInvestigateInTimelineAlertClick:te}),ge=null==x?void 0:x.isOsqueryAvailable({agentId:I}),fe=Object(r.useCallback)((()=>{b(I),S(!1)}),[b,S,I]),ye=Object(r.useMemo)((()=>Object(X.a)({handleClick:fe})),[fe]),he=Object(r.useMemo)((()=>!O&&k.ruleId?[...de,...pe,...oe]:T&&E?ce:[]),[ce,T,E,oe,de,O,k.ruleId,pe]),ve=[M.e.alertsOnAlertsPage,M.e.alertsOnRuleDetailsPage].includes(g),{addToCaseActionItems:Ee,handleAddToNewCaseClick:xe}=Object(Y.a)({ecsData:t,nonEcsData:null!==(f=null==e?void 0:e.map((e=>({field:e.field,value:e.values}))))&&void 0!==f?f:[],onMenuItemClick:ue,onSuccess:m,isActiveTimelines:Object(C.isActiveTimeline)(g),isInDetections:ve,refetch:p}),je=Object(r.useMemo)((()=>[...y?Ee:[],...he,...ie,...re,...ge?[ye]:[],...be]),[y,Ee,he,ie,re,ge,ye,be]),Se=[{id:0,items:je},...me],ke=Object(r.useMemo)((()=>s.a.createElement(_.a,{onClick:xe,step:F.a.addAlertToCase,tourId:F.b.alertsCases},s.a.createElement(c.EuiButton,{"data-test-subj":"take-action-dropdown-btn",fill:!0,iconSide:"right",iconType:"arrowDown",onClick:ee},L.d))),[xe,ee]);return je.length&&!i&&t?s.a.createElement(c.EuiPopover,{id:"AlertTakeActionPanel",button:ke,isOpen:j,closePopover:te,panelPaddingSize:"none",anchorPosition:"downLeft",repositionOnScroll:!0},s.a.createElement(c.EuiContextMenu,{size:"s",initialPanelId:0,panels:Se,"data-test-subj":"takeActionPanelMenu"})):null}));var te=a(826),ae=a(875),ne=a(876),ie=a(831),re=a(122),se=a(511);const oe=s.a.memo((({detailsData:e,detailsEcsData:t,handleOnEventClosed:a,isHostIsolationPanelOpen:n,isReadOnly:o,loadingEventDetails:l,onAddIsolationStatusClick:u,scopeId:d,globalQuery:p,timelineQuery:m,refetchFlyoutData:b})=>{var g;const f=null!=t&&null!==(g=t.kibana)&&void 0!==g&&g.alert?null==t?void 0:t._id:null,y=Object(r.useMemo)((()=>{var t,a,n;return null!==(t=null===(a=Object(i.find)({category:"signal",field:"signal.rule.index"},e))||void 0===a?void 0:a.values)&&void 0!==t?t:null===(n=Object(i.find)({category:"kibana",field:"kibana.alert.rule.parameters.index"},e))||void 0===n?void 0:n.values}),[e]),h=Object(r.useMemo)((()=>Array.isArray(y)?y:void 0),[y]),v=Object(r.useMemo)((()=>{var t,a,n;return null!==(t=null===(a=Object(i.find)({category:"signal",field:"signal.rule.data_view_id"},e))||void 0===a?void 0:a.values)&&void 0!==t?t:null===(n=Object(i.find)({category:"kibana",field:"kibana.alert.rule.parameters.data_view_id"},e))||void 0===n?void 0:n.values}),[e]),E=Object(r.useMemo)((()=>Array.isArray(v)?v[0]:void 0),[v]),x=Object(r.useMemo)((()=>[{category:"signal",field:"signal.rule.id",name:"ruleId"},{category:"signal",field:"signal.rule.rule_id",name:"ruleRuleId"},{category:"signal",field:"signal.rule.name",name:"ruleName"},{category:"signal",field:"kibana.alert.workflow_status",name:"alertStatus"},{category:"_id",field:"_id",name:"eventId"}].reduce(((t,a)=>({...t,[a.name]:Object(P.a)({category:a.category,field:a.field},e)})),{})),[e]),j=e=>{e.forEach((e=>e.refetch&&e.refetch()))},S=Object(r.useCallback)((()=>{Object(C.isActiveTimeline)(d)?j([m]):j(p)}),[d,m,p]),{exceptionFlyoutType:k,openAddExceptionFlyout:O,onAddExceptionTypeClick:w,onAddExceptionCancel:I,onAddExceptionConfirm:M}=Object(te.a)({refetch:S,isActiveTimelines:Object(C.isActiveTimeline)(d)}),{closeAddEventFilterModal:_,isAddEventFilterModalOpen:F,onAddEventFilterClick:A}=Object(ie.a)(),[D,N]=Object(r.useState)(null),R=Object(r.useCallback)((()=>{N(null)}),[N]);return o?null:s.a.createElement(s.a.Fragment,null,s.a.createElement(c.EuiFlyoutFooter,{"data-test-subj":"side-panel-flyout-footer"},s.a.createElement(c.EuiFlexGroup,{justifyContent:"flexEnd"},s.a.createElement(c.EuiFlexItem,{grow:!1},t&&s.a.createElement(ee,{detailsData:e,ecsData:t,handleOnEventClosed:a,isHostIsolationPanelOpen:n,loadingEventDetails:l,onAddEventFilterClick:A,onAddExceptionTypeClick:w,onAddIsolationStatusClick:u,refetchFlyoutData:b,refetch:S,scopeId:d,onOsqueryClick:N})))),O&&null!=x.ruleId&&null!=x.ruleRuleId&&null!=x.eventId&&s.a.createElement(ae.a,T()({},x,{ruleIndices:h,ruleDataViewId:E,exceptionListType:k,onCancel:I,onConfirm:M})),F&&null!=t&&s.a.createElement(ne.a,{data:t,onCancel:_}),D&&null!=t&&s.a.createElement(se.a,{agentId:D,defaultValues:f?{alertIds:[f]}:void 0,onClose:R,ecsData:t}))})),le=Object(I.connect)((()=>{const e=re.d.globalQuery(),t=re.d.timelineQueryByIdSelector();return(a,{scopeId:n})=>({globalQuery:e(a),timelineQuery:t(a,n)})}))(s.a.memo(oe));var ce=a(348),ue=a(116),de=a(110),pe=a(186);const me=()=>{var e,t;const{browserFields:a,runtimeMappings:c}=Object(ue.d)(de.SourcererScopeName.detections),[u,d]=Object(r.useState)({id:void 0,indexName:void 0}),[p,m,b,g,y]=Object(ce.a)({entityType:n.EntityType.EVENTS,indexName:null!==(e=u.indexName)&&void 0!==e?e:"",eventId:null!==(t=u.id)&&void 0!==t?t:"",runtimeMappings:c,skip:!u.id}),{alertId:h,isAlert:v,hostName:E,ruleName:x,timestamp:j}=Object(pe.b)(m),{isolateAction:S,isHostIsolationPanelOpen:k,isIsolateActionSuccessBannerVisible:w,handleIsolationActionSuccess:T,showAlertDetails:I,showHostIsolationPanel:C}=Object(l.a)(),M=Object(r.useCallback)((({isLoading:e,alert:t})=>(d((e=>e.id!==t._id?{id:t._id,indexName:t._index}:e)),s.a.createElement(O,{alertId:h,browserFields:a,detailsData:m,detailsEcsData:g,event:{eventId:t._id,indexName:t._index},hostName:null!=E?E:"",handleIsolationActionSuccess:T,handleOnEventClosed:i.noop,isAlert:v,isDraggable:!1,isolateAction:S,isIsolateActionSuccessBannerVisible:w,isHostIsolationPanelOpen:k,loading:e||p,rawEventData:b,showAlertDetails:I,scopeId:o.f.casePage,isReadOnly:!1}))),[h,a,m,g,T,E,v,k,w,S,p,b,I]),_=Object(r.useCallback)((({isLoading:e})=>{var t;return s.a.createElement(f,{isHostIsolationPanelOpen:k,isAlert:v,eventIndex:null!==(t=u.indexName)&&void 0!==t?t:"",eventId:h,isolateAction:S,loading:e||p,ruleName:x,showAlertDetails:I,timestamp:j})}),[u.indexName,v,h,k,S,p,x,I,j]),F=Object(r.useCallback)((({isLoading:e,alert:t})=>s.a.createElement(le,{detailsData:m,detailsEcsData:g,refetchFlyoutData:y,handleOnEventClosed:i.noop,isHostIsolationPanelOpen:k,isReadOnly:!1,loadingEventDetails:e||p,onAddIsolationStatusClick:C,scopeId:o.f.casePage})),[m,g,k,p,y,C]);return Object(r.useMemo)((()=>({body:M,header:_,footer:F})),[M,_,F])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return G}));var n=a(40),i=a(2),r=a.n(i),s=a(42),o=a(607),l=a(608);const c=r.a.memo((({contextId:e,eventId:t,isDraggable:a,tlsClientCertificateFingerprintSha1:i,tlsFingerprintsJa3Hash:c,tlsServerCertificateFingerprintSha1:u})=>r.a.createElement(n.EuiFlexGroup,{alignItems:"center","data-test-subj":"fingerprints-group",direction:"column",justifyContent:"center",gutterSize:"none"},null!=c?Object(s.uniq)(c).map((i=>r.a.createElement(n.EuiFlexItem,{grow:!1,key:i},r.a.createElement(l.b,{eventId:t,fieldName:l.a,contextId:e,isDraggable:a,value:i})))):null,null!=i?Object(s.uniq)(i).map((i=>r.a.createElement(n.EuiFlexItem,{grow:!1,key:i},r.a.createElement(o.a,{eventId:t,certificateType:"client",contextId:e,fieldName:o.b,isDraggable:a,value:i})))):null,null!=u?Object(s.uniq)(u).map((i=>r.a.createElement(n.EuiFlexItem,{grow:!1,key:i},r.a.createElement(o.a,{eventId:t,certificateType:"server",contextId:e,fieldName:o.c,isDraggable:a,value:i})))):null)));c.displayName="Fingerprints";var u=a(41),d=a.n(u),p=a(113),m=a(121),b=a(460);const g="questionInCircle",f=e=>{if(null==e)return g;switch(`${e}`.toLowerCase()){case p.n.outbound:case p.n.outgoing:return"arrowUp";case p.n.inbound:case p.n.incoming:case p.n.listening:return"arrowDown";case p.n.external:return"globe";case p.n.internal:return"bullseye";case p.n.unknown:default:return g}},y=r.a.memo((({contextId:e,eventId:t,direction:a,isDraggable:n})=>r.a.createElement(m.c,{contextId:e,eventId:t,field:b.c,iconType:f(a),isDraggable:n,value:a,isAggregatable:!0,fieldType:"keyword"})));y.displayName="DirectionBadge";var h=a(815),v=a(727);const E=d()(n.EuiFlexItem).withConfig({displayName:"EuiFlexItemMarginRight",componentId:"sc-10udnrm-0"})(["margin-right:3px;"]);E.displayName="EuiFlexItemMarginRight";const x=d()(n.EuiText).withConfig({displayName:"Stats",componentId:"sc-10udnrm-1"})(["margin:0 5px;"]);x.displayName="Stats";const j=r.a.memo((({bytes:e,communityId:t,contextId:a,direction:i,eventId:o,isDraggable:l,packets:c,protocol:u,transport:d})=>r.a.createElement(n.EuiFlexGroup,{alignItems:"center",justifyContent:"center",gutterSize:"none"},null!=i?Object(s.uniq)(i).map((e=>r.a.createElement(E,{grow:!1,key:e},r.a.createElement(y,{contextId:a,direction:e,eventId:o,isDraggable:l})))):null,null!=u?Object(s.uniq)(u).map((e=>r.a.createElement(E,{grow:!1,key:e},r.a.createElement(m.c,{contextId:a,eventId:o,field:b.e,isDraggable:l,value:e,isAggregatable:!0,fieldType:"keyword"})))):null,null!=e?Object(s.uniq)(e).map((e=>isNaN(Number(e))?null:r.a.createElement(E,{grow:!1,key:e},r.a.createElement(m.b,{field:b.a,id:`network-default-draggable-${a}-${o}-${b.a}-${e}`,isDraggable:l,value:e},r.a.createElement(x,{size:"xs"},r.a.createElement("span",null,r.a.createElement(v.a,{value:e}))))))):null,null!=c?Object(s.uniq)(c).map((e=>r.a.createElement(E,{grow:!1,key:e},r.a.createElement(m.b,{field:b.d,id:`network-default-draggable-${a}-${o}-${b.d}-${e}`,isDraggable:l,value:e},r.a.createElement(x,{size:"xs"},r.a.createElement("span",null,`${e} ${h.a}`)))))):null,null!=d?Object(s.uniq)(d).map((e=>r.a.createElement(E,{grow:!1,key:e},r.a.createElement(m.c,{contextId:a,"data-test-subj":"network-transport",eventId:o,field:b.f,isDraggable:l,value:e,isAggregatable:!0,fieldType:"keyword"})))):null,null!=t?Object(s.uniq)(t).map((e=>r.a.createElement(n.EuiFlexItem,{grow:!1,key:e},r.a.createElement(m.c,{contextId:a,eventId:o,field:b.b,isDraggable:l,value:e,isAggregatable:!0,fieldType:"keyword"})))):null)));j.displayName="Network";var S=a(532),k=a(130),O=a.n(k),w=a(395),T=a(1039),I=a(380),C=a(392),M=a(570);const _=d.a.span.withConfig({displayName:"IpPortSeparator",componentId:"sc-12b0nt-0"})(["margin:0 3px;"]);_.displayName="IpPortSeparator";const F=r.a.memo((({contextId:e,eventId:t,isDraggable:a,port:i,portFieldName:s})=>null!=i?r.a.createElement(n.EuiFlexGroup,{gutterSize:"none"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(_,{"data-test-subj":"ip-port-separator"},":")),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(T.a,{contextId:e,"data-test-subj":"port",eventId:t,fieldName:s,isDraggable:a,value:i}))):null));F.displayName="PortWithSeparator";const A=r.a.memo((({contextId:e,eventId:t,ip:a,ipFieldName:i,isDraggable:s,port:o,portFieldName:l})=>r.a.createElement(n.EuiFlexGroup,{gutterSize:"none"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(w.c,{contextId:e,"data-test-subj":"ip",eventId:t,fieldName:i,isDraggable:s,value:a})),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(F,{contextId:e,eventId:t,isDraggable:s,port:o,portFieldName:l})))));A.displayName="IpWithPort";const D=d.a.div.withConfig({displayName:"Label",componentId:"sc-1ym4dlz-0"})(["font-weight:bold;margin-top:2px;"]),N=({destinationIp:e,sourceIp:t,type:a})=>"source"===a&&null!=t&&t.some((e=>!Object(s.isEmpty)(e)))||"destination"===a&&null!=e&&e.some((e=>!Object(s.isEmpty)(e))),P=({destinationPort:e,sourcePort:t,type:a})=>("source"===a&&null!=t?t:"destination"===a&&null!=e?e:[]).filter((e=>null!=e)).map((e=>`${e}`)).filter((e=>!Object(s.isEmpty)(e))),R=r.a.memo((({contextId:e,destinationIp:t,destinationPort:a,eventId:i,isDraggable:o,sourceIp:l,sourcePort:c,type:u})=>{const d="source"===u?l:t,p="source"===u?w.d:w.a,m="source"===u?c:a,b="source"===u?I.c:I.a;if(null==d)return null;const g=null!=m&&d.length===m.length?d.map(((e,t)=>({ip:e,port:null!=m[t]?`${m[t]}`:null}))):d.map((e=>({ip:e,port:null})));return r.a.createElement(n.EuiFlexGroup,{gutterSize:"none"},Object(s.uniqWith)(O.a,g).map((t=>null!=t.ip&&r.a.createElement(n.EuiFlexItem,{grow:!1,key:t.ip},r.a.createElement(A,{contextId:e,"data-test-subj":`${u}-ip-and-port`,eventId:i,ip:t.ip,ipFieldName:p,isDraggable:o,port:t.port,portFieldName:b})))))}));R.displayName="IpAdressesWithPorts";const L=r.a.memo((({contextId:e,destinationGeoContinentName:t,destinationGeoCountryName:a,destinationGeoCountryIsoCode:i,destinationGeoRegionName:s,destinationGeoCityName:o,destinationIp:l,destinationPort:c,eventId:u,isDraggable:d,sourceGeoContinentName:p,sourceGeoCountryName:m,sourceGeoCountryIsoCode:b,sourceGeoRegionName:g,sourceGeoCityName:f,sourceIp:y,sourcePort:h,type:v})=>{const E="source"===v?C.i:C.c;return N({destinationIp:l,sourceIp:y,type:v})||(({destinationPort:e,sourcePort:t,type:a})=>P({destinationPort:e,sourcePort:t,type:a}).length>0)({destinationPort:c,sourcePort:h,type:v})?r.a.createElement(n.EuiBadge,{"data-test-subj":`${v}-ip-badge`,color:"hollow",title:""},r.a.createElement(n.EuiFlexGroup,{alignItems:"center","data-test-subj":`${v}-ip-group`,direction:"column",gutterSize:"xs"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(D,null,E)),r.a.createElement(n.EuiFlexItem,{grow:!1},N({destinationIp:l,sourceIp:y,type:v})?r.a.createElement(R,{contextId:e,destinationIp:l,destinationPort:c,eventId:u,isDraggable:d,sourceIp:y,sourcePort:h,type:v}):r.a.createElement(n.EuiFlexGroup,{gutterSize:"none"},P({destinationPort:c,sourcePort:h,type:v}).map(((t,a)=>r.a.createElement(n.EuiFlexItem,{key:`port-${t}-${a}`,grow:!1},r.a.createElement(T.a,{contextId:e,"data-test-subj":"port",eventId:u,fieldName:`${v}.port`,isDraggable:d,value:t})))))),r.a.createElement(n.EuiFlexItem,null,r.a.createElement(M.f,{contextId:e,destinationGeoContinentName:t,destinationGeoCountryName:a,destinationGeoCountryIsoCode:i,destinationGeoRegionName:s,destinationGeoCityName:o,eventId:u,isDraggable:d,sourceGeoContinentName:p,sourceGeoCountryName:m,sourceGeoCountryIsoCode:b,sourceGeoRegionName:g,sourceGeoCityName:f,type:v})))):null}));L.displayName="SourceDestinationIp";const B=r.a.memo((({contextId:e,destinationBytes:t,destinationGeoContinentName:a,destinationGeoCountryName:i,destinationGeoCountryIsoCode:s,destinationGeoRegionName:o,destinationGeoCityName:l,destinationIp:c,destinationPackets:u,destinationPort:d,eventId:p,isDraggable:m,sourceBytes:b,sourceGeoContinentName:g,sourceGeoCountryName:f,sourceGeoCountryIsoCode:y,sourceGeoRegionName:h,sourceGeoCityName:v,sourcePackets:E,sourceIp:x,sourcePort:j})=>r.a.createElement(n.EuiFlexGroup,{justifyContent:"center",gutterSize:"none"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(L,{contextId:e,destinationGeoContinentName:a,destinationGeoCountryName:i,destinationGeoCountryIsoCode:s,destinationGeoRegionName:o,destinationGeoCityName:l,destinationIp:c,destinationPort:d,eventId:p,isDraggable:m,sourceGeoContinentName:g,sourceGeoCountryName:f,sourceGeoCountryIsoCode:y,sourceGeoRegionName:h,sourceGeoCityName:v,sourceIp:x,sourcePort:j,type:"source"})),r.a.createElement(S.e,{contextId:e,destinationBytes:t,destinationPackets:u,eventId:p,isDraggable:m,sourceBytes:b,sourcePackets:E}),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(L,{contextId:e,destinationGeoContinentName:a,destinationGeoCountryName:i,destinationGeoCountryIsoCode:s,destinationGeoRegionName:o,destinationGeoCityName:l,destinationIp:c,destinationPort:d,eventId:p,isDraggable:m,sourceGeoContinentName:g,sourceGeoCountryName:f,sourceGeoCountryIsoCode:y,sourceGeoRegionName:h,sourceGeoCityName:v,sourceIp:x,sourcePort:j,type:"destination"})))));B.displayName="SourceDestinationWithArrows";const q=d()(n.EuiFlexItem).withConfig({displayName:"EuiFlexItemMarginTop",componentId:"sc-ru6rd-0"})(["margin-top:3px;"]);q.displayName="EuiFlexItemMarginTop";const z=r.a.memo((({contextId:e,destinationBytes:t,destinationGeoContinentName:a,destinationGeoCountryName:i,destinationGeoCountryIsoCode:s,destinationGeoRegionName:o,destinationGeoCityName:l,destinationIp:c,destinationPackets:u,destinationPort:d,eventId:p,isDraggable:m,networkBytes:b,networkCommunityId:g,networkDirection:f,networkPackets:y,networkProtocol:h,sourceBytes:v,sourceGeoContinentName:E,sourceGeoCountryName:x,sourceGeoCountryIsoCode:S,sourceGeoRegionName:k,sourceGeoCityName:O,sourceIp:w,sourcePackets:T,sourcePort:I,transport:C})=>r.a.createElement(n.EuiFlexGroup,{alignItems:"center",direction:"column",justifyContent:"center",gutterSize:"none"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(j,{bytes:b,packets:y,communityId:g,contextId:e,direction:f,eventId:p,isDraggable:m,protocol:h,transport:C})),r.a.createElement(q,{grow:!1},r.a.createElement(B,{contextId:e,destinationBytes:t,destinationGeoContinentName:a,destinationGeoCountryName:i,destinationGeoCountryIsoCode:s,destinationGeoRegionName:o,destinationGeoCityName:l,destinationIp:c,destinationPackets:u,destinationPort:d,eventId:p,isDraggable:m,sourceBytes:v,sourceGeoContinentName:E,sourceGeoCountryName:x,sourceGeoCountryIsoCode:S,sourceGeoRegionName:k,sourceGeoCityName:O,sourceIp:w,sourcePackets:T,sourcePort:I})))));z.displayName="SourceDestination";var $=a(571),V=a(818);const U=d()(n.EuiFlexItem).withConfig({displayName:"EuiFlexItemMarginRight",componentId:"sc-ub9rva-0"})(["margin-right:10px;"]);U.displayName="EuiFlexItemMarginRight";const H=r.a.memo((({contextId:e,destinationBytes:t,destinationGeoContinentName:a,destinationGeoCountryName:i,destinationGeoCountryIsoCode:s,destinationGeoRegionName:o,destinationGeoCityName:l,destinationIp:c,destinationPackets:u,destinationPort:d,eventDuration:p,eventId:m,eventEnd:b,eventStart:g,isDraggable:f,networkBytes:y,networkCommunityId:h,networkDirection:v,networkPackets:E,networkProtocol:x,processName:j,sourceBytes:S,sourceGeoContinentName:k,sourceGeoCountryName:O,sourceGeoCountryIsoCode:w,sourceGeoRegionName:T,sourceGeoCityName:I,sourceIp:C,sourcePackets:M,sourcePort:_,transport:F,userName:A})=>r.a.createElement(n.EuiFlexGroup,{"data-test-subj":"netflow-columns",gutterSize:"none",justifyContent:"center",wrap:!0},r.a.createElement(U,{grow:!1},r.a.createElement(V.c,{contextId:e,eventId:m,isDraggable:f,processName:j,userName:A})),r.a.createElement(U,{grow:!1},r.a.createElement($.a,{contextId:e,eventDuration:p,eventId:m,eventEnd:b,eventStart:g,isDraggable:f})),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(z,{contextId:e,destinationBytes:t,destinationGeoContinentName:a,destinationGeoCountryName:i,destinationGeoCountryIsoCode:s,destinationGeoRegionName:o,destinationGeoCityName:l,destinationIp:c,destinationPackets:u,destinationPort:d,eventId:m,isDraggable:f,networkBytes:y,networkCommunityId:h,networkDirection:v,networkPackets:E,networkProtocol:x,sourceBytes:S,sourceGeoContinentName:k,sourceGeoCountryName:O,sourceGeoCountryIsoCode:w,sourceGeoRegionName:T,sourceGeoCityName:I,sourceIp:C,sourcePackets:M,sourcePort:_,transport:F})))));H.displayName="NetflowColumns";const G=r.a.memo((({contextId:e,destinationBytes:t,destinationGeoContinentName:a,destinationGeoCountryName:i,destinationGeoCountryIsoCode:s,destinationGeoRegionName:o,destinationGeoCityName:l,destinationIp:u,destinationPackets:d,destinationPort:p,eventDuration:m,eventId:b,eventEnd:g,eventStart:f,isDraggable:y,networkBytes:h,networkCommunityId:v,networkDirection:E,networkPackets:x,networkProtocol:j,processName:S,sourceBytes:k,sourceGeoContinentName:O,sourceGeoCountryName:w,sourceGeoCountryIsoCode:T,sourceGeoRegionName:I,sourceGeoCityName:C,sourcePackets:M,sourceIp:_,sourcePort:F,tlsClientCertificateFingerprintSha1:A,tlsFingerprintsJa3Hash:D,tlsServerCertificateFingerprintSha1:N,transport:P,userName:R})=>r.a.createElement(n.EuiFlexGroup,{alignItems:"center","data-test-subj":"netflow-rows",direction:"column",justifyContent:"center",wrap:!0,gutterSize:"none"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(H,{contextId:e,destinationBytes:t,destinationGeoContinentName:a,destinationGeoCountryName:i,destinationGeoCountryIsoCode:s,destinationGeoRegionName:o,destinationGeoCityName:l,destinationIp:u,destinationPackets:d,destinationPort:p,eventDuration:m,eventId:b,eventEnd:g,eventStart:f,isDraggable:y,networkBytes:h,networkCommunityId:v,networkDirection:E,networkPackets:x,networkProtocol:j,processName:S,sourceBytes:k,sourceGeoContinentName:O,sourceGeoCountryName:w,sourceGeoCountryIsoCode:T,sourceGeoRegionName:I,sourceGeoCityName:C,sourceIp:_,sourcePackets:M,sourcePort:F,transport:P,userName:R})),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(c,{contextId:e,eventId:b,isDraggable:y,tlsClientCertificateFingerprintSha1:A,tlsFingerprintsJa3Hash:D,tlsServerCertificateFingerprintSha1:N})))));G.displayName="Netflow"},function(e,t,a){"use strict";a.d(t,"a",(function(){return $}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(5);const c=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.allActionsTooltip",{defaultMessage:"All actions"}),u=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.allowAction",{defaultMessage:"Allow"}),d=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.allowByDefaultAction",{defaultMessage:"Allow by default"}),p=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.allowedColumnTitle",{defaultMessage:"Allowed"}),m=(l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.alwaysSubmenu",{defaultMessage:"Always"}),l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.anonymizeAction",{defaultMessage:"Anonymize"})),b=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.anonymizeByDefaultAction",{defaultMessage:"Anonymize by default"}),g=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.anonymizedColumnTitle",{defaultMessage:"Anonymized"}),f=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.bulkActions",{defaultMessage:"Bulk actions"}),y=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.defaultsSubmenu",{defaultMessage:"Defaults"}),h=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.denyAction",{defaultMessage:"Deny"}),v=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.denyByDefaultAction",{defaultMessage:"Deny by default"}),E=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.fieldColumnTitle",{defaultMessage:"Field"}),x=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.noButtonLabel",{defaultMessage:"No"}),j=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.resetButton",{defaultMessage:"Reset"}),S=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.unanonymizeAction",{defaultMessage:"Unanonymize"}),k=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.unanonymizeByDefaultAction",{defaultMessage:"Unanonymize by default"}),O=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.valuesColumnTitle",{defaultMessage:"Values"}),w=l.i18n.translate("xpack.elasticAssistant.assistant.dataAnonymizationEditor.contextEditor.yesButtonLabel",{defaultMessage:"Yes"}),T="primary-panel-id",I="secondary-panel-id";var C=a(21);const M=({appliesTo:e,disabled:t,disableAllow:a=!1,disableAnonymize:r=!1,disableDeny:s=!1,disableUnanonymize:o=!1,onListUpdated:l,onlyDefaults:p,selected:g})=>{const[E,x]=Object(i.useState)(!1),j=Object(n.useGeneratedHtmlId)({prefix:"contextEditorBulkActions"}),O=Object(i.useCallback)((()=>x(!1)),[]),w=Object(i.useCallback)((()=>x((e=>!e))),[]),M=Object(i.useMemo)((()=>Object(C.jsx)(n.EuiToolTip,{content:"multipleRows"===e?void 0:c},Object(C.jsx)(n.EuiButtonEmpty,{"data-test-subj":"bulkActionsButton",disabled:t,iconType:"multipleRows"===e?"arrowDown":"boxesVertical",iconSide:"multipleRows"===e?"right":void 0,onClick:w,size:"xs"},"multipleRows"===e?f:null))),[e,t,w]),_=Object(i.useMemo)((()=>(({disableAllow:e,disableAnonymize:t,disableDeny:a,disableUnanonymize:n,closePopover:i,onListUpdated:r,onlyDefaults:s,selected:o})=>{const l=s?T:I,c=s?I:T,p=[s?[]:{icon:"check",name:d,onClick:()=>{i();const e=o.map((({field:e})=>({field:e,operation:"add",update:"allow"}))),t=o.map((({field:e})=>({field:e,operation:"add",update:"defaultAllow"})));r([...e,...t])}}].flat(),g=[{id:l,title:y,items:[...p,{icon:"cross",name:v,onClick:()=>{i();const e=o.map((({field:e})=>({field:e,operation:"remove",update:"allow"}))),t=o.map((({field:e})=>({field:e,operation:"remove",update:"defaultAllow"})));r([...e,...t])}},{icon:"eyeClosed",name:b,onClick:()=>{i();const e=o.map((({field:e})=>({field:e,operation:"add",update:"allowReplacement"}))),t=o.map((({field:e})=>({field:e,operation:"add",update:"defaultAllowReplacement"})));r([...e,...t])}},{icon:"eye",name:k,onClick:()=>{i();const e=o.map((({field:e})=>({field:e,operation:"remove",update:"allowReplacement"}))),t=o.map((({field:e})=>({field:e,operation:"remove",update:"defaultAllowReplacement"})));r([...e,...t])}}]}],f=[{id:c,items:[{disabled:e,icon:"check",name:u,onClick:()=>{i();const e=o.map((({field:e})=>({field:e,operation:"add",update:"allow"})));r(e)}},{disabled:a,icon:"cross",name:h,onClick:()=>{i();const e=o.map((({field:e})=>({field:e,operation:"remove",update:"allow"})));r(e)}},{disabled:t,icon:"eyeClosed",name:m,onClick:()=>{i();const e=o.map((({field:e})=>({field:e,operation:"add",update:"allowReplacement"})));r(e)}},{disabled:n,icon:"eye",name:S,onClick:()=>{i();const e=o.map((({field:e})=>({field:e,operation:"remove",update:"allowReplacement"})));r(e)}},{isSeparator:!0,key:"sep"},{name:y,panel:l}]},...g];return s?g:f})({disableAllow:a,disableAnonymize:r,disableDeny:s,disableUnanonymize:o,closePopover:O,onListUpdated:l,onlyDefaults:p,selected:g})),[O,a,r,s,o,l,p,g]);return Object(C.jsx)(n.EuiPopover,{anchorPosition:"downLeft",button:M,closePopover:O,"data-test-subj":"bulkActions",id:j,isOpen:E,panelPaddingSize:"none"},Object(C.jsx)(n.EuiContextMenu,{initialPanelId:T,panels:_,size:"s"}))},_=r.a.memo(M),F="allowed",A="anonymized",D="field",N=o()(n.EuiButtonEmpty)`
  max-height: 24px;
`;var P=a(305);const R=({onListUpdated:e,onlyDefaults:t,onReset:a,onSelectAll:i,selected:r,totalFields:s})=>Object(C.jsx)(n.EuiFlexGroup,{alignItems:"center","data-test-subj":"toolbar",gutterSize:"none"},Object(C.jsx)(n.EuiFlexItem,{grow:!1},Object(C.jsx)(n.EuiText,{color:"subdued","data-test-subj":"selectedFields",size:"xs"},(e=>l.i18n.translate("xpack.elasticAssistant.dataAnonymizationEditor.contextEditor.selectedFields",{values:{selected:e},defaultMessage:"Selected {selected} fields"}))(r.length))),Object(C.jsx)(n.EuiFlexItem,{grow:!1},Object(C.jsx)(n.EuiButtonEmpty,{"data-test-subj":"selectAllFields",iconType:"pagesSelect",onClick:i,size:"xs"},(e=>l.i18n.translate("xpack.elasticAssistant.dataAnonymizationEditor.contextEditor.selectAllFields",{values:{totalFields:e},defaultMessage:"Select all {totalFields} fields"}))(s))),Object(C.jsx)(n.EuiFlexItem,{grow:!1},Object(C.jsx)(_,{appliesTo:"multipleRows",disabled:0===r.length,onListUpdated:e,onlyDefaults:t,selected:r})),null!=a&&Object(C.jsx)(n.EuiFlexItem,{grow:!0},Object(C.jsx)(n.EuiFlexGroup,{alignItems:"center","data-test-subj":"toolbarTrailingActions",gutterSize:"none",justifyContent:"flexEnd"},Object(C.jsx)(n.EuiFlexItem,{grow:!1},Object(C.jsx)(n.EuiButtonEmpty,{"data-test-subj":"resetFields",iconType:"eraser",onClick:a,size:"xs"},j)))));R.displayName="ToolbarComponent";const L=r.a.memo(R),B={sort:{direction:"desc",field:F}},q={box:{incremental:!0},filters:[{field:F,type:"is",name:p},{field:A,type:"is",name:g}]},z=({allow:e,allowReplacement:t,onListUpdated:a,onReset:r,rawData:s,pageSize:o=10})=>{const[l,c]=Object(i.useState)([]),u=Object(i.useMemo)((()=>({selectable:()=>!0,onSelectionChange:e=>c(e),initialSelected:[]})),[]),d=Object(i.useRef)(null),m=Object(i.useMemo)((()=>(({onListUpdated:e,rawData:t})=>{const a={field:"actions",name:"",render:(a,n)=>Object(C.jsx)(_,{appliesTo:"singleRow",disabled:!1,disableAllow:n.allowed,disableDeny:!n.allowed,disableAnonymize:!n.allowed||n.allowed&&n.anonymized,disableUnanonymize:!n.allowed||n.allowed&&!n.anonymized,onListUpdated:e,onlyDefaults:null==t,selected:[n]}),sortable:!1,width:"36px"},i={field:"rawValues",name:O,render:e=>Object(C.jsx)(n.EuiCode,{"data-test-subj":"rawValues"},e.join(",")),sortable:!1},r=[{field:F,name:p,render:(a,{allowed:i,field:r})=>Object(C.jsx)(n.EuiSwitch,{"data-test-subj":"allowed",checked:i,label:"",showLabel:!1,onChange:()=>{e([{field:r,operation:i?"remove":"add",update:null==t?"defaultAllow":"allow"}]),null==t&&i&&e([{field:r,operation:"remove",update:"defaultAllowReplacement"}])}}),sortable:!0,width:"75px"},{field:A,name:g,render:(a,{allowed:i,anonymized:r,field:s})=>Object(C.jsx)(N,{"data-test-subj":"anonymized",disabled:!i,color:r?"primary":"text",flush:"both",iconType:r?"eyeClosed":"eye",isSelected:!!r,onClick:()=>e([{field:s,operation:r?"remove":"add",update:null==t?"defaultAllowReplacement":"allowReplacement"}])},Object(C.jsx)(n.EuiText,{size:"xs"},r?w:x)),sortable:!0,width:"102px"},{field:D,name:E,sortable:!0,width:"260px"}];return null==t?[...r,a]:[...r,i,a]})({onListUpdated:a,rawData:s})),[a,s]),b=Object(i.useMemo)((()=>(({allow:e,allowReplacement:t,rawData:a})=>{const n=new Set(t),i=new Set(e);return null!==a&&"object"==typeof a?Object.keys(a).sort().reduce(((e,t)=>[...e,{field:t,allowed:Object(P.b)({allowSet:i,field:t}),anonymized:Object(P.c)({allowReplacementSet:n,field:t}),denied:Object(P.d)({allowSet:i,field:t}),rawValues:a[t]}]),[]):e.sort().reduce(((e,t)=>[...e,{field:t,allowed:!0,anonymized:n.has(t),denied:!1,rawValues:[]}]),[])})({allow:e,allowReplacement:t,rawData:s})),[e,t,s]),f=Object(i.useCallback)((()=>{var e;null===(e=d.current)||void 0===e||e.setSelection(b),setTimeout((()=>c(b)),0)}),[b]),y=Object(i.useMemo)((()=>({initialPageSize:o,pageSizeOptions:[5,10,25,50]})),[o]),h=Object(i.useMemo)((()=>Object(C.jsx)(L,{onListUpdated:a,onlyDefaults:null==s,onReset:r,onSelectAll:f,selected:l,totalFields:b.length})),[a,r,f,s,b.length,l]);return Object(C.jsx)(n.EuiInMemoryTable,{allowNeutralSort:!1,childrenBetween:h,columns:m,compressed:!0,"data-test-subj":"contextEditor",isSelectable:!0,itemId:D,items:b,pagination:y,ref:d,search:q,selection:u,sorting:B})};z.displayName="ContextEditorComponent";const $=r.a.memo(z)},function(e,t,a){"use strict";a.d(t,"a",(function(){return T}));var n=a(106),i=a(8),r=a(41),s=a.n(r),o=a(4),l=a(167);const c=s.a.div.withConfig({displayName:"HorizontalSpacer",componentId:"sc-1o769t7-0"})(["margin:0 ",";"],(({theme:e})=>e.eui.euiSizeXS));var u=a(40),d=a(2),p=a.n(d),m=a(569),b=a(275),g=a(42),f=a(44),y=a(121);const h=({contextId:e,eventId:t,isDraggable:a,sourceField:n,sourceValue:i})=>p.a.createElement(u.EuiFlexGroup,{alignItems:"center","data-test-subj":"threat-match-details",direction:"row",justifyContent:"center",gutterSize:"none",wrap:!0},p.a.createElement(u.EuiFlexItem,{grow:!1},p.a.createElement(y.c,{contextId:e,"data-test-subj":"threat-match-details-source-field",eventId:t,field:l.g,isDraggable:a,value:n,isAggregatable:!0,fieldType:"keyword"})),p.a.createElement(u.EuiFlexItem,{grow:!1},p.a.createElement(c,null,p.a.createElement(f.FormattedMessage,{defaultMessage:"matched",id:"xpack.securitySolution.alerts.rowRenderers.cti.threatMatch.matchedVerb"}))),p.a.createElement(u.EuiFlexItem,{grow:!1},p.a.createElement(y.c,{contextId:e,"data-test-subj":"threat-match-details-source-value",eventId:t,field:n,isDraggable:a,value:i,isAggregatable:!0,fieldType:"keyword"})));var v=a(337);const E=({contextId:e,eventId:t,feedName:a,indicatorReference:n,indicatorType:i,isDraggable:r})=>p.a.createElement(u.EuiFlexGroup,{alignItems:"flexStart","data-test-subj":"threat-match-indicator-details",direction:"row",justifyContent:"center",gutterSize:"none",wrap:!0},i&&p.a.createElement(u.EuiFlexItem,{grow:!1},p.a.createElement(y.c,{contextId:e,"data-test-subj":"threat-match-indicator-details-indicator-type",eventId:t,field:l.h,isDraggable:r,value:i,isAggregatable:!0,fieldType:"keyword"})),a&&p.a.createElement(p.a.Fragment,null,p.a.createElement(u.EuiFlexItem,{grow:!1,component:"span"},p.a.createElement(c,null,p.a.createElement(f.FormattedMessage,{defaultMessage:"provided by",id:"xpack.securitySolution.alerts.rowRenderers.cti.threatMatch.providerPreposition"}))),p.a.createElement(u.EuiFlexItem,{grow:!1},p.a.createElement(y.c,{contextId:e,"data-test-subj":"threat-match-indicator-details-indicator-feedName",eventId:t,field:l.e,isDraggable:r,value:a,isAggregatable:!0,fieldType:"keyword"}))),n&&p.a.createElement(p.a.Fragment,null,p.a.createElement(u.EuiFlexItem,{grow:!1},p.a.createElement(c,null,":")),p.a.createElement(u.EuiFlexItem,{grow:!1},p.a.createElement(v.a,{contextId:e,"data-test-subj":"threat-match-indicator-details-indicator-reference",eventId:t,fieldName:l.j,isDraggable:r,value:n,isAggregatable:!0,fieldType:"keyword"})))),x=({contextId:e,data:t,eventId:a,isDraggable:n})=>{const i={contextId:e,eventId:a,indicatorReference:Object(g.getOr)([],l.p,t)[0],feedName:Object(g.getOr)([],l.e,t)[0],indicatorType:Object(g.getOr)([],l.n,t)[0],isDraggable:n,sourceField:Object(g.get)(l.l,t)[0],sourceValue:Object(g.get)(l.k,t)[0]};return p.a.createElement(j,i)},j=({contextId:e,eventId:t,feedName:a,indicatorReference:n,indicatorType:i,isDraggable:r,sourceField:s,sourceValue:o})=>p.a.createElement(u.EuiFlexGroup,{alignItems:"center","data-test-subj":"threat-match-row",gutterSize:"s",justifyContent:"center"},p.a.createElement(u.EuiFlexItem,{grow:!1},p.a.createElement(h,{contextId:e,eventId:t,isDraggable:r,sourceField:s,sourceValue:o})),p.a.createElement(u.EuiFlexItem,{grow:!1},p.a.createElement(E,{contextId:e,eventId:t,feedName:a,indicatorReference:n,indicatorType:i,isDraggable:r})));var S=a(392);const k=s.a.div.withConfig({displayName:"SpacedContainer",componentId:"sc-e4rhpb-0"})(["margin:"," 0;"],(({theme:e})=>e.eui.euiSizeS)),O=({data:e,isDraggable:t,scopeId:a})=>{const n=Object(i.get)(e,o.pb),r=Object(i.get)(e,m.a),s=Object(d.useCallback)(((e="max")=>{const i="max"===e?n.slice(0,2):n;return p.a.createElement(b.a,{"data-test-subj":"threat-match-row-renderer"},p.a.createElement(k,null,i.map(((e,i)=>{const s=`threat-match-row-${a}-${r}-${i}`;return p.a.createElement(d.Fragment,{key:s},p.a.createElement(x,{contextId:s,data:e,eventId:r,isDraggable:t}),i<n.length-1&&p.a.createElement(u.EuiHorizontalRule,{margin:"s"}))}))))}),[n,r,t,a]),l=Object(d.useCallback)((()=>s("all")),[s]);return p.a.createElement(u.EuiFlexGroup,{direction:"column",justifyContent:"center",alignItems:"center",gutterSize:"none"},p.a.createElement(u.EuiFlexItem,null,s()),n.length>2&&p.a.createElement(u.EuiFlexItem,null,p.a.createElement(w,{title:Object(S.h)(n.length),renderChildren:l})))},w=({title:e,renderChildren:t})=>{const[a,n]=Object(d.useState)(!1),i=()=>n(!1);let r;return a&&(r=p.a.createElement(u.EuiModal,{onClose:i},p.a.createElement(u.EuiModalHeader,{"data-test-subj":"threat-match-row-modal"},p.a.createElement(u.EuiModalHeaderTitle,null,S.b)),p.a.createElement(u.EuiModalBody,null,t()),p.a.createElement(u.EuiModalFooter,null,p.a.createElement(u.EuiButton,{onClick:i,fill:!0},S.a)))),p.a.createElement("div",null,p.a.createElement(u.EuiButtonEmpty,{"data-test-subj":"threat-match-row-show-all",iconType:"popout",color:"primary",onClick:()=>n(!0)},e),r)},T={id:n.d.threat_match,isInstance:e=>(e=>{const t=Object(i.get)(e,o.pb);return null==t?[]:Array.isArray(t)?t:[t]})(e).some((e=>l.i.some((t=>!Object(i.isEmpty)(Object(i.get)(e,t)))))),renderRow:({data:e,isDraggable:t,scopeId:a})=>p.a.createElement(O,{data:e,isDraggable:t,scopeId:a})}},function(e,t,a){"use strict";a.d(t,"a",(function(){return F}));var n=a(42),i=a(2),r=a.n(i),s=a(106),o=a(275),l=a(40),c=a(41),u=a.n(c),d=a(250),p=a(321),m=a(153),b=a(123),g=a(379),f=a(127);const y=["IPv4","IPv6"];var h=a(121),v=a(150);const E="suricata.eve.alert.signature",x="suricata.eve.alert.signature_id",j=u()(l.EuiFlexItem).withConfig({displayName:"SignatureFlexItem",componentId:"sc-1paeiel-0"})(["min-width:77px;"]);j.displayName="SignatureFlexItem";const S=u()(l.EuiBadge).withConfig({displayName:"Badge",componentId:"sc-1paeiel-1"})(["vertical-align:top;"]);S.displayName="Badge";const k=u()(l.EuiFlexItem).withConfig({displayName:"LinkFlexItem",componentId:"sc-1paeiel-2"})(["margin-left:6px;"]);k.displayName="LinkFlexItem";const O=r.a.memo((({tokens:e})=>r.a.createElement(r.a.Fragment,null,e.map((e=>r.a.createElement(f.c,{key:e,grow:!1},r.a.createElement(l.EuiBadge,{iconType:"tag",color:"hollow",title:""},e)))))));O.displayName="Tokens";const w=r.a.memo((({id:e,isDraggable:t,signatureId:a})=>{const n=Object(i.useMemo)((()=>({and:[],enabled:!0,id:Object(m.i)(`suricata-draggable-signature-id-${e}-sig-${a}`),name:String(a),excluded:!1,kqlQuery:"",queryMatch:{field:x,value:a,operator:v.d}})),[e,a]),s=Object(i.useCallback)(((e,t,n)=>n.isDragging?r.a.createElement(p.a,null,r.a.createElement(g.a,{dataProvider:e})):r.a.createElement(l.EuiToolTip,{"data-test-subj":"signature-id-tooltip",content:x},r.a.createElement(S,{iconType:"number",color:"hollow",title:""},a))),[a]);return r.a.createElement(j,{grow:!1},r.a.createElement(p.b,{dataProvider:n,isDraggable:t,render:s,isAggregatable:!0,fieldType:"keyword"}))}));w.displayName="DraggableSignatureId";const T=r.a.memo((({contextId:e,id:t,isDraggable:a,signature:n,signatureId:i})=>{const s=(e=>e.trim().split(" ").reduce(((e,t,a)=>e.length===a&&t===t.toUpperCase()&&""!==t||y.includes(t)?[...e,t]:e),[]))(n);return r.a.createElement(l.EuiFlexGroup,{justifyContent:"center",gutterSize:"none",wrap:!0},r.a.createElement(w,{id:`draggable-signature-id-${e}-${t}`,isDraggable:a,signatureId:i}),r.a.createElement(O,{tokens:s}),r.a.createElement(k,{grow:!1},r.a.createElement(h.b,{"data-test-subj":"draggable-signature-link",field:E,id:`suricata-signature-default-draggable-${e}-${t}-${E}`,isDraggable:a,value:n,tooltipPosition:"bottom"},r.a.createElement("div",null,r.a.createElement(b.c,{link:n},n.split(" ").splice(s.length).join(" "))))))}));T.displayName="SuricataSignature";const I=u()(l.EuiFlexItem).withConfig({displayName:"LinkEuiFlexItem",componentId:"sc-i69i1c-0"})(["display:inline;"]);I.displayName="LinkEuiFlexItem";const C=r.a.memo((({signatureId:e})=>{const[t,s]=Object(i.useState)(void 0);return Object(i.useEffect)((()=>{let t=!0;return async function(){if(null!=e)try{const i=await(async e=>{const t=(await a.e(20).then(a.t.bind(null,1652,7))).db,i=(r=t,s=e,Object.prototype.hasOwnProperty.call(r,s)?t[e]:null);var r,s;return null!=i?Object(n.uniq)(i):[]})(e);t&&null!=i&&s(i)}catch(e){s(void 0)}else t&&s(void 0)}(),()=>{t=!1}}),[e]),r.a.createElement(l.EuiFlexGroup,{"data-test-subj":"suricataRefs",gutterSize:"none",justifyContent:"center",wrap:!0},t&&t.map((e=>r.a.createElement(I,{key:e,grow:!1},r.a.createElement(l.EuiLink,{href:e,color:"subdued",target:"_blank"},e)))))}));C.displayName="SuricataRefs";const M=u.a.div.withConfig({displayName:"Details",componentId:"sc-1y9aljy-0"})(["margin:5px 0;"]);M.displayName="Details";const _=r.a.memo((({data:e,isDraggable:t,timelineId:a})=>{const i=Object(n.get)("suricata.eve.alert.signature[0]",e),s=Object(n.get)("suricata.eve.alert.signature_id[0]",e);return null!=s&&null!=i?r.a.createElement(M,null,r.a.createElement(T,{contextId:`suricata-signature-${a}-${e._id}`,id:e._id,isDraggable:t,signature:i,signatureId:s}),r.a.createElement(C,{signatureId:s}),r.a.createElement(l.EuiSpacer,{size:"s"}),r.a.createElement(d.a,{data:e,isDraggable:t,timelineId:a})):null}));_.displayName="SuricataDetails";const F={id:s.d.suricata,isInstance:e=>{const t=Object(n.get)("event.module[0]",e);return null!=t&&"suricata"===t.toLowerCase()},renderRow:({data:e,isDraggable:t,scopeId:a})=>r.a.createElement(o.a,null,r.a.createElement(_,{data:e,isDraggable:t,timelineId:a}))}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(46),i=a(602),r=a(102);const s=()=>r.b.get().http,o=({packages:e})=>Object(n.useQuery)(["installedIntegrations",{packages:e}],(async({signal:t})=>{var a;return null!==(a=(await(e=>{var t;const{packages:a,signal:n}=e;return s().fetch(i.a,{method:"GET",query:{packages:null==a||null===(t=a.sort())||void 0===t?void 0:t.join(",")},signal:n})})({packages:e,signal:t})).installed_integrations)&&void 0!==a?a:[]}),{keepPreviousData:!0,staleTime:3e5,onError:e=>{}})},function(e,t,a){"use strict";a.d(t,"a",(function(){return G}));var n=a(42),i=a(2),r=a.n(i),s=a(106),o=a(275),l=a(40),c=a(41),u=a.n(c),d=a(250),p=a(321),m=a(153),b=a(123),g=a(379),f=a(150),y=a(5);const h=y.i18n.translate("xpack.securitySolution.zeek.s0Description",{defaultMessage:"Connection attempt seen, no reply"}),v=y.i18n.translate("xpack.securitySolution.zeek.s1Description",{defaultMessage:"Connection established, not terminated"}),E=y.i18n.translate("xpack.securitySolution.zeek.s2Description",{defaultMessage:"Connection established and close attempt by originator seen (but no reply from responder)"}),x=y.i18n.translate("xpack.securitySolution.zeek.s3Description",{defaultMessage:"Connection established and close attempt by responder seen (but no reply from originator)"}),j=y.i18n.translate("xpack.securitySolution.zeek.sfDescription",{defaultMessage:"Normal SYN/FIN completion"}),S=y.i18n.translate("xpack.securitySolution.zeek.rejDescription",{defaultMessage:"Connection attempt rejected"}),k=y.i18n.translate("xpack.securitySolution.zeek.rstoODescription",{defaultMessage:"Connection established, originator aborted (sent a RST)"}),O=y.i18n.translate("xpack.securitySolution.zeek.rstrDescription",{defaultMessage:"Established, responder aborted"}),w=y.i18n.translate("xpack.securitySolution.zeek.rstosoDescription",{defaultMessage:"Originator sent a SYN followed by a RST, no SYN-ACK from the responder"}),T=y.i18n.translate("xpack.securitySolution.zeek.rstrhDescription",{defaultMessage:"Responder sent a SYN ACK followed by a RST, no SYN from the (purported) originator"}),I=y.i18n.translate("xpack.securitySolution.zeek.shDescription",{defaultMessage:"Originator sent a SYN followed by a FIN, no SYN ACK from the responder"}),C=y.i18n.translate("xpack.securitySolution.zeek.shrDescription",{defaultMessage:"Responder sent a SYN ACK followed by a FIN, no SYN from the originator"}),M=y.i18n.translate("xpack.securitySolution.zeek.othDescription",{defaultMessage:"No SYN seen, just midstream traffic"}),_=u()(l.EuiBadge).withConfig({displayName:"Badge",componentId:"sc-1b5gq3p-0"})(["vertical-align:top;"]);_.displayName="Badge";const F=u()(l.EuiFlexItem).withConfig({displayName:"TokensFlexItem",componentId:"sc-1b5gq3p-1"})(["margin-left:3px;"]);F.displayName="TokensFlexItem";const A=u()(l.EuiFlexItem).withConfig({displayName:"LinkFlexItem",componentId:"sc-1b5gq3p-2"})(["margin-left:6px;"]);A.displayName="LinkFlexItem";const D=e=>e,N=e=>{const t=e.split(".");return t.length>=2&&null!=t[1]?""!==t[1]?t[1]:t[0]:e},P=e=>`Dropped:${e}`,R=e=>`md5: ${e.substr(0,7)}...`,L=e=>`sha1: ${e.substr(0,7)}...`,B=r.a.memo((({id:e,field:t,isDraggable:a,value:n,stringRenderer:s=D})=>{const o=Object(i.useMemo)((()=>({and:[],enabled:!0,id:Object(m.i)(`draggable-zeek-element-draggable-wrapper-${e}-${t}-${n}`),name:String(n),excluded:!1,kqlQuery:"",queryMatch:{field:t,value:String(n),operator:f.d}})),[t,e,n]),c=Object(i.useCallback)(((e,a,i)=>i.isDragging?r.a.createElement(p.a,null,r.a.createElement(g.a,{dataProvider:e})):r.a.createElement(l.EuiToolTip,{"data-test-subj":"badge-tooltip",content:t},r.a.createElement(_,{iconType:"tag",color:"hollow",title:""},s(String(n))))),[t,s,n]);return null!=n?r.a.createElement(F,{grow:!1},r.a.createElement(p.b,{dataProvider:o,isDraggable:a,render:c,isAggregatable:!0,fieldType:"keyword"})):null}));B.displayName="DraggableZeekElement";const q=r.a.memo((({value:e,link:t})=>null!=e?null!=t?r.a.createElement(A,{grow:!1},r.a.createElement("div",null,r.a.createElement(b.c,{link:t},e))):r.a.createElement(A,{grow:!1},r.a.createElement("div",null,r.a.createElement(b.c,{link:e}))):null));q.displayName="Link";const z=r.a.memo((({value:e})=>null!=e?r.a.createElement(A,{grow:!1},r.a.createElement("div",null,r.a.createElement(b.j,{domain:e,overflowIndexStart:1,showDomain:!0,"data-test-subj":"reputationLinkSha"}))):null));z.displayName="TotalVirusLinkSha";const $={S0:h,S1:v,S2:E,S3:x,SF:j,REJ:S,RSTO:k,RSTR:O,RSTOS0:w,RSTRH:T,SH:I,SHR:C,OTH:M},V=r.a.memo((({data:e,isDraggable:t,timelineId:a})=>{const i=`zeek-signature-draggable-zeek-element-${a}-${e._id}`,s=Object(n.get)("zeek.session_id[0]",e),o=Object(n.get)("event.dataset[0]",e),c=Object(n.get)("zeek.ssl.version[0]",e),u=Object(n.get)("zeek.ssl.cipher[0]",e),d=Object(n.get)("zeek.connection.state[0]",e),p=Object(n.get)("zeek.connection.history[0]",e),m=Object(n.get)("zeek.notice.note[0]",e),b=Object(n.get)("zeek.notice.msg[0]",e),g=(e=>null!=e?String(e):null)(Object(n.get)("zeek.notice.dropped[0]",e)),f=Object(n.get)("zeek.dns.query[0]",e),y=Object(n.get)("zeek.dns.qclass_name[0]",e),h=Object(n.get)("http.request.method[0]",e),v=Object(n.get)("http.response.status_code[0]",e),E=Object(n.get)("url.original[0]",e),x=Object(n.get)("zeek.files.sha1[0]",e),j=Object(n.get)("zeek.files.md5[0]",e),S=(e=>{if(null!=e){const t=$[e];return null!=t?`${e} ${t}`:e}return null})(d),k=(e=>null!=e&&null!=$[e]?$[e]:null)(d);return r.a.createElement(r.a.Fragment,null,r.a.createElement(l.EuiFlexGroup,{justifyContent:"center",gutterSize:"none",wrap:!0},r.a.createElement(B,{id:i,field:"zeek.session_id",isDraggable:t,value:s}),r.a.createElement(B,{id:i,field:"event.dataset",isDraggable:t,value:o,stringRenderer:N}),r.a.createElement(B,{id:i,field:"zeek.files.sha1",isDraggable:t,value:x,stringRenderer:L}),r.a.createElement(B,{id:i,field:"zeek.files.md5",isDraggable:t,value:j,stringRenderer:R}),r.a.createElement(B,{id:i,field:"zeek.notice.dropped",isDraggable:t,value:g,stringRenderer:P}),r.a.createElement(B,{id:i,field:"zeek.ssl.version",isDraggable:t,value:c}),r.a.createElement(B,{id:i,field:"zeek.ssl.cipher",isDraggable:t,value:u}),r.a.createElement(B,{id:i,field:"zeek.connection.state",isDraggable:t,value:d}),r.a.createElement(B,{id:i,field:"http.request.method",isDraggable:t,value:h}),r.a.createElement(B,{id:i,field:"zeek.connection.history",isDraggable:t,value:p}),r.a.createElement(B,{id:i,field:"zeek.notice.note",isDraggable:t,value:m}),r.a.createElement(B,{id:i,field:"zeek.dns.query",isDraggable:t,value:f}),r.a.createElement(B,{id:i,field:"zeek.dns.qclass_name",isDraggable:t,value:y}),r.a.createElement(B,{id:i,field:"http.response.status_code",isDraggable:t,value:v})),r.a.createElement(l.EuiFlexGroup,{justifyContent:"center",gutterSize:"none"},r.a.createElement(q,{link:S,value:k}),r.a.createElement(q,{value:u}),r.a.createElement(q,{value:f}),r.a.createElement(q,{value:b}),r.a.createElement(q,{value:E}),r.a.createElement(z,{value:x})))}));V.displayName="ZeekSignature";const U=u.a.div.withConfig({displayName:"Details",componentId:"sc-1ixpiaf-0"})(["margin:5px 0;"]);U.displayName="Details";const H=r.a.memo((({data:e,isDraggable:t,timelineId:a})=>null!=e.zeek?r.a.createElement(U,null,r.a.createElement(V,{data:e,isDraggable:t,timelineId:a}),r.a.createElement(l.EuiSpacer,{size:"s"}),r.a.createElement(d.a,{data:e,isDraggable:t,timelineId:a})):null));H.displayName="ZeekDetails";const G={id:s.d.zeek,isInstance:e=>{const t=Object(n.get)("event.module[0]",e);return null!=t&&"zeek"===t.toLowerCase()},renderRow:({data:e,isDraggable:t,scopeId:a})=>r.a.createElement(o.a,null,r.a.createElement(H,{data:e,isDraggable:t,timelineId:a}))}},function(e,t,a){"use strict";a.d(t,"a",(function(){return b}));var n=a(2),i=a.n(n),r=a(40),s=a(8),o=a(5);const l=o.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.addToRulesTableSelection.addToSelectedRulesDescription",{defaultMessage:"After you create the exception, it is added to the rules you link. "});var c=a(565),u=a(313);const d=Object(n.memo)((({rule:e,linkedRules:t,onRuleLinkChange:a})=>{const s=Object(n.useMemo)((()=>Boolean(t.find((t=>t.id===e.id)))),[t,e.id]),o=Object(n.useCallback)((({target:{checked:n}})=>{const i=n?[...t,e]:null==t?void 0:t.filter((t=>t.id!==e.id));"function"==typeof a&&a(i)}),[t,a,e]);return i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiSwitch,{onChange:o,label:"",checked:s}))}));d.displayName="LinkRuleSwitch";var p=a(853);const m=({initiallySelectedRules:e,onRuleSelectionChange:t})=>{const{isLoading:a,searchOptions:m,pagination:b,sortedRulesByLinkedRulesOnTop:g,rulesTableColumnsWithLinkSwitch:f,onTableChange:y,addToSelectedRulesDescription:h}=(({initiallySelectedRules:e,onRuleSelectionChange:t})=>{const{data:{rules:a}={rules:[],total:0},isFetched:r}=Object(p.a)({filterOptions:{filter:"",showCustomRules:!1,showElasticRules:!1,tags:[]},sortingOptions:void 0,pagination:{page:1,perPage:1e4}}),[m,b]=Object(n.useState)({pageIndex:0,initialPageSize:25,showPerPageOptions:!1}),[g,f]=Object(n.useState)(e||[]);Object(n.useEffect)((()=>{t(g)}),[g,t]);const y=Object(n.useMemo)((()=>Object(s.sortBy)(a,[t=>null==e?void 0:e.find((e=>e.id===t.id))])),[e,a]),h=Object(n.useMemo)((()=>{const e=y.reduce(((e,t)=>{const{tags:a}=t;return a.forEach((t=>e.add(t))),e}),new Set);return Array.from(e).map((e=>({value:e,name:e,field:"tags"})))}),[y]),v=Object(n.useMemo)((()=>({box:{incremental:!0,schema:!0},filters:[{type:"field_value_selection",operator:"exact",name:o.i18n.translate("xpack.securitySolution.exceptions.addToRulesTable.tagsFilterLabel",{defaultMessage:"Tags"}),multiSelect:"or",options:h}]})),[h]),E=Object(n.useMemo)((()=>[{field:"link",name:c.b,align:"left","data-test-subj":"ruleActionLinkRuleSwitch",render:(e,t)=>i.a.createElement(d,{rule:t,linkedRules:g,onRuleLinkChange:f})},...Object(u.c)()]),[g]),x=Object(n.useCallback)((({page:{index:e}})=>b({...m,pageIndex:e})),[m]);return{isLoading:!r,pagination:m,searchOptions:v,sortedRulesByLinkedRulesOnTop:y,rulesTableColumnsWithLinkSwitch:E,addToSelectedRulesDescription:l,onTableChange:x}})({initiallySelectedRules:e,onRuleSelectionChange:t});return i.a.createElement(r.EuiPanel,{color:"subdued",borderRadius:"none",hasShadow:!1},i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiText,{size:"s"},h),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(r.EuiInMemoryTable,{tableLayout:"auto",search:m,"data-test-subj":"addExceptionToRulesTable",tableCaption:"Rules table",items:g,loading:a,columns:f,message:a?i.a.createElement(r.EuiSkeletonText,{lines:4,"data-test-subj":"exceptionItemViewerEmptyPromptsLoading"}):void 0,pagination:b,onTableChange:y})))},b=i.a.memo(m);b.displayName="ExceptionsAddToRulesTable"},function(e,t,a){"use strict";a.d(t,"b",(function(){return U})),a.d(t,"a",(function(){return H}));var n=a(2),i=a.n(n),r=a(40),s=a(8),o=a(103),l=a(120),c=a(42),u=a(119),d=a(282),p=a(422),m=a(115),b=a(805),g=a(102),f=a(511),y=a(175),h=a(281),v=a(126),E=a(170),x=a(418),j=a(135),S=a(122),k=a(233),O=a(232),w=a(299),T=a(876),I=a(558),C=a(826),M=a(823),_=a(831),F=a(389),A=a(824),D=a(887),N=a(319),P=a(5),R=a(123),L=a(124),B=a(169),q=a(4);const z=P.i18n.translate("xpack.securitySolution.detectionEngine.alerts.actions.openAlertDetails",{defaultMessage:"Open alert details page"});var $=a(825);const V=({ariaLabel:e=j.E,ariaRowindex:t,columnValues:a,disabled:o,ecsRowData:l,onRuleChange:d,scopeId:h,globalQuery:x,timelineQuery:S,refetch:k})=>{var O,w,P,V,U,G,Q,W,K,Y,J,X,Z,ee,te,ae,ne,ie,re;const[se,oe]=Object(n.useState)(!1),[le,ce]=Object(n.useState)(!1),[ue]=Object(y.a)(),de=Object(n.useCallback)((()=>{oe(!1)}),[]),pe=null!=l&&null!==(me=l.kibana)&&void 0!==me&&me.alert?null==l?void 0:l._id:null;var me;const be=Object(c.get)(0,null==l||null===(O=l.kibana)||void 0===O||null===(w=O.alert)||void 0===w||null===(P=w.rule)||void 0===P?void 0:P.uuid),ge=Object(c.get)(0,null==l||null===(V=l.kibana)||void 0===V||null===(U=V.alert)||void 0===U||null===(G=U.rule)||void 0===G?void 0:G.rule_id),fe=Object(c.get)(0,null==l||null===(Q=l.kibana)||void 0===Q||null===(W=Q.alert)||void 0===W||null===(K=W.rule)||void 0===K?void 0:K.name),ye=[u.e.alertsOnAlertsPage,u.e.alertsOnRuleDetailsPage].includes(h),{addToCaseActionItems:he}=Object(D.a)({ecsData:l,onMenuItemClick:de,isActiveTimelines:Object(m.isActiveTimeline)(null!=h?h:""),ariaLabel:Object(F.a)({ariaRowindex:t,columnValues:a}),isInDetections:ye,refetch:k}),{loading:ve,canWriteEventFilters:Ee}=Object(v.a)().endpointPrivileges,xe=Object(n.useMemo)((()=>!ve&&Ee),[Ee,ve]),je=Object(c.get)(0,null==l||null===(Y=l.kibana)||void 0===Y||null===(J=Y.alert)||void 0===J?void 0:J.workflow_status),Se=Object(n.useMemo)((()=>{var e;return-1!==Object(s.indexOf)(null===(e=l.event)||void 0===e?void 0:e.kind,"event")}),[l]),ke=Object(n.useMemo)((()=>{var e,t;return null===(e=l.agent)||void 0===e||null===(t=e.type)||void 0===t?void 0:t.includes("endpoint")}),[l]),Oe=Object(n.useMemo)((()=>Se&&ke),[Se,ke]),we=Object(n.useMemo)((()=>h===u.e.hostsPageEvents||h===u.e.usersPageEvents),[h]),Te=Object(n.useCallback)((()=>{oe(!se)}),[se]),Ie=Object(n.useCallback)((()=>{oe(!1)}),[]),Ce=Object(n.useMemo)((()=>i.a.createElement(r.EuiToolTip,{position:"top",content:j.E},i.a.createElement(r.EuiButtonIcon,{"aria-label":e,"data-test-subj":"timeline-context-menu-button",size:"s",iconType:"boxesHorizontal","data-popover-open":se,onClick:Te,isDisabled:o}))),[o,Te,e,se]),Me=e=>{e.forEach((e=>e.refetch&&e.refetch()))},_e=Object(n.useCallback)((()=>{Object(m.isActiveTimeline)(null!=h?h:"")?(Me([S]),"alerts"===ue.pageName&&Me(x)):(Me(x),k&&k())}),[h,x,S,ue,k]),Fe=null!==(X=null===(Z=l["kibana.alert.rule.parameters"])||void 0===Z?void 0:Z.index)&&void 0!==X?X:null==l||null===(ee=l.signal)||void 0===ee||null===(te=ee.rule)||void 0===te?void 0:te.index,Ae=null!==(ae=null===(ne=l["kibana.alert.rule.parameters"])||void 0===ne?void 0:ne.data_view_id)&&void 0!==ae?ae:null==l||null===(ie=l.signal)||void 0===ie||null===(re=ie.rule)||void 0===re?void 0:re.data_view_id,{exceptionFlyoutType:De,openAddExceptionFlyout:Ne,onAddExceptionCancel:Pe,onAddExceptionConfirm:Re,onAddExceptionTypeClick:Le}=Object(C.a)({refetch:_e,onRuleChange:d,isActiveTimelines:Object(m.isActiveTimeline)(null!=h?h:"")}),{closeAddEventFilterModal:Be,isAddEventFilterModalOpen:qe,onAddEventFilterClick:ze}=Object(_.a)(),{actionItems:$e}=Object(I.a)({alertStatus:je,eventId:null==l?void 0:l._id,scopeId:h,refetch:_e,closePopover:Ie}),Ve=Object(n.useCallback)((e=>{Le(e),Ie()}),[Ie,Le]),Ue=Object(n.useCallback)((()=>{ze(),Ie()}),[Ie,ze]),{exceptionActionItems:He}=Object(M.a)({isEndpointAlert:Object(N.a)({ecsData:l}),onAddExceptionTypeClick:Ve}),{eventFilterActionItems:Ge}=Object(A.a)({onAddEventFilterClick:Ue,disabled:!Oe||!we,tooltipMessage:we?void 0:j.f}),Qe=Object(n.useMemo)((()=>{var e;return Object(c.get)(0,null==l||null===(e=l.agent)||void 0===e?void 0:e.id)}),[l]),We=Object(n.useCallback)((()=>{ce((e=>!e)),oe(!1)}),[]),{osqueryActionItems:Ke}=(({handleClick:e})=>{const t=Object(n.useMemo)((()=>Object(b.a)({handleClick:e})),[e]),a=Object(g.j)().services.application.capabilities.osquery;return{osqueryActionItems:null!=a&&a.writeLiveQueries||null!=a&&a.runSavedQueries?[t]:[]}})({handleClick:We}),{alertDetailsActionItems:Ye}=(({ruleId:e,closePopover:t,alertId:a})=>{const n=Object(L.a)("alertDetailsPageEnabled"),i=[],{onClick:r}=Object(R.o)()({deepLinkId:q.wc.alerts,path:a?Object(B.a)(a):""});return e&&a&&n&&i.push({key:"open-alert-details-item","data-test-subj":"open-alert-details-page-menu-item",onClick:r,name:z}),{alertDetailsActionItems:i}})({alertId:pe,closePopover:Ie,ruleId:be}),{alertTagsItems:Je,alertTagsPanels:Xe}=Object($.a)({closePopover:Ie,ecsRowData:l,refetch:_e}),Ze=Object(n.useMemo)((()=>!Se&&be?[...he,...$e,...Je,...He,...Qe?Ke:[],...Ye]:[...he,...xe?Ge:[],...Qe?Ke:[]]),[Se,be,he,$e,He,Qe,Ke,Ye,Ge,xe,Je]),et=Object(n.useMemo)((()=>[{id:0,items:Ze},...Xe]),[Xe,Ze]),tt=Object(n.useMemo)((()=>i.a.createElement(f.a,{agentId:Qe,defaultValues:pe?{alertIds:[pe]}:void 0,onClose:We,ecsData:l})),[Qe,pe,l,We]);return i.a.createElement(i.a.Fragment,null,Ze.length>0&&i.a.createElement("div",{key:"actions-context-menu"},i.a.createElement(E.l,{textAlign:"center",width:p.b},i.a.createElement(r.EuiPopover,{id:"singlePanel",button:Ce,isOpen:se,closePopover:Ie,panelPaddingSize:"none",anchorPosition:"downLeft",repositionOnScroll:!0},i.a.createElement(r.EuiContextMenu,{size:"s",initialPanelId:0,panels:et,"data-test-subj":"actions-context-menu"})))),Ne&&be&&ge&&null!=fe&&null!=(null==l?void 0:l._id)&&i.a.createElement(H,{ruleId:be,ruleRuleId:ge,ruleIndices:Fe,ruleDataViewId:Ae,ruleName:fe,exceptionListType:De,eventId:null==l?void 0:l._id,onCancel:Pe,onConfirm:Re,alertStatus:je}),qe&&null!=l&&i.a.createElement(T.a,{data:l,onCancel:Be}),le&&Qe&&null!=l&&tt)},U=Object(o.connect)((()=>{const e=S.d.globalQuery(),t=S.d.timelineQueryByIdSelector();return(a,{scopeId:n})=>({globalQuery:e(a),timelineQuery:t(a,n)})}))(i.a.memo(V)),H=({ruleId:e,ruleRuleId:t,ruleIndices:a,ruleDataViewId:r,ruleName:s,exceptionListType:o,eventId:c,onCancel:u,onConfirm:p,alertStatus:m})=>{const{loading:b,signalIndexName:g}=Object(w.a)(),{rule:f,loading:y}=Object(d.a)(e),{loading:v,data:E}=Object(k.a)({query:Object(h.a)(c),indexName:g,queryName:O.a.ADD_EXCEPTION_FLYOUT}),j=Object(n.useMemo)((()=>{if(!1===v){const e=null==E?void 0:E.hits.hits[0];if(!e)return;const{_id:t,_index:a,_source:n}=e;return{...n,_id:t,_index:a}}}),[null==E?void 0:E.hits.hits,v]),S=Object(n.useMemo)((()=>{var e,t,n;return null!=j&&null!=(null===(e=j["kibana.alert.rule.parameters"])||void 0===e?void 0:e.index)?Array.isArray(j["kibana.alert.rule.parameters"].index)?j["kibana.alert.rule.parameters"].index:[j["kibana.alert.rule.parameters"].index]:null!=j&&null!=(null==j||null===(t=j.signal)||void 0===t||null===(n=t.rule)||void 0===n?void 0:n.index)?Array.isArray(j.signal.rule.index)?j.signal.rule.index:[j.signal.rule.index]:a}),[j,a]),T=Object(n.useMemo)((()=>{var e;return null!=j&&null!=(null===(e=j["kibana.alert.rule.parameters"])||void 0===e?void 0:e.data_view_id)?j["kibana.alert.rule.parameters"].data_view_id:r}),[j,r]),I=Object(n.useMemo)((()=>f?[f]:null),[f]),C=v&&b||null==j||null==S&&null==T;return i.a.createElement(x.a,{rules:I,isEndpointItem:o===l.b.ENDPOINT,alertData:j,isAlertDataLoading:C||y,alertStatus:m,isBulkAction:!1,showAlertCloseOptions:!0,onCancel:u,onConfirm:p})}},function(e,t,a){"use strict";a.d(t,"a",(function(){return x}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(44),l=a(40),c=a(3),u=a(827),d=a(888),p=a(47),m=a(575);const b=e=>{var t,a,n,i,r,s,o;return null!=e&&null!==(t=e.agent)&&void 0!==t&&null!==(a=t.type)&&void 0!==a&&a.includes("endpoint")?((null==e||null===(n=e.host)||void 0===n||null===(i=n.os)||void 0===i?void 0:i.name)||["windows"]).map((e=>e.toLowerCase())):null!==(r=null==e||null===(s=e.host)||void 0===s||null===(o=s.os)||void 0===o?void 0:o.family)&&void 0!==r?r:["windows"]},g=e=>{var t,a;return{comments:[],description:"",entries:e&&e.event&&e.process?[{field:"event.category",operator:"included",type:"match",value:(null!==(t=e.event.category)&&void 0!==t?t:[])[0]},{field:"process.executable",operator:"included",type:"match",value:(null!==(a=e.process.executable)&&void 0!==a?a:[])[0]}]:[{field:"",operator:"included",type:"match",value:""}],item_id:void 0,list_id:m.a,meta:{temporaryUuid:Object(p.v4)()},name:"",namespace_type:"agnostic",tags:["policy:all"],type:"simple",os_types:b(e)}};var f=a(102),y=a(503),h=a(347),v=a(574),E=a(5);const x=Object(r.memo)((({onCancel:e,data:t,...a})=>{var n,p;const m=Object(f.n)(),b=Object(f.i)(),{isLoading:x,mutateAsync:j}=Object(u.a)(v.a.getInstance(b),"create"),[S,k]=Object(r.useState)(),[O,w]=Object(r.useState)(!1),{data:{search:T}}=Object(f.j)().services,I=Object(y.b)({perPage:1e3,onError:e=>{m.addWarning(Object(h.b)(e))}}),[C,M]=Object(r.useState)(g(t)),_=Object(r.useMemo)((()=>I.isLoading||I.isRefetching),[I]);Object(r.useEffect)((()=>(t&&(async()=>{var e;if(!t||!t._index)return;const a=await Object(c.lastValueFrom)(T.search({params:{index:t._index,body:{query:{match:{_id:t._id}}}}}));k({...t,host:{...t.host,os:{...(null==t||null===(e=t.host)||void 0===e?void 0:e.os)||{},name:[a.rawResponse.hits.hits[0]._source.host.os.name]}}})})(),()=>{M(g())})),[]);const F=Object(r.useCallback)((()=>{_||x||e()}),[x,_,e]),A=Object(r.useCallback)((()=>j(C,{onSuccess:t=>{var a;m.addSuccess((a=t,E.i18n.translate("xpack.securitySolution.eventFilter.flyoutForm.creationSuccessToastTitle",{defaultMessage:'"{name}" has been added to the event filters list.',values:{name:null==a?void 0:a.name}}))),e()},onError:e=>{m.addError(e,{title:'There was an error creating the new event filter: "{error}"',message:{error:e.message}})}})),[C,e,j,m]),D=Object(r.useMemo)((()=>s.a.createElement(l.EuiButton,{"data-test-subj":"add-exception-confirm-button",fill:!0,disabled:!O||x||!!t&&!S||_,onClick:A,isLoading:_},t?s.a.createElement(o.FormattedMessage,{id:"xpack.securitySolution.eventFilters.eventFiltersFlyout.actions.confirm.update.withData",defaultMessage:"Add endpoint event filter"}):s.a.createElement(o.FormattedMessage,{id:"xpack.securitySolution.eventFilters.eventFiltersFlyout.actions.confirm.create",defaultMessage:"Add event filter"}))),[t,S,A,O,x,_]),N=Object(r.useCallback)((e=>{e&&(w(e.isValid),M(e.item))}),[]);return s.a.createElement(l.EuiFlyout,i()({size:"l",onClose:F,"data-test-subj":"eventFiltersCreateFlyout"},a),s.a.createElement(l.EuiFlyoutHeader,{hasBorder:!0},s.a.createElement(l.EuiTitle,{size:"m"},s.a.createElement("h2",null,t?s.a.createElement(o.FormattedMessage,{id:"xpack.securitySolution.eventFilters.eventFiltersFlyout.title.create.withData",defaultMessage:"Add endpoint event filter"}):s.a.createElement(o.FormattedMessage,{id:"xpack.securitySolution.eventFilters.eventFiltersFlyout.subtitle.create",defaultMessage:"Add event filter"}))),t?s.a.createElement(l.EuiTextColor,{color:"subdued"},s.a.createElement(o.FormattedMessage,{id:"xpack.securitySolution.eventFilters.eventFiltersFlyout.subtitle.create.withData",defaultMessage:"Endpoint security"})):null),s.a.createElement(l.EuiFlyoutBody,null,s.a.createElement(d.a,{allowSelectOs:!t,error:void 0,disabled:!1,item:C,mode:"create",onChange:N,policies:null!==(n=null==I||null===(p=I.data)||void 0===p?void 0:p.items)&&void 0!==n?n:[],policiesIsLoading:_})),s.a.createElement(l.EuiFlyoutFooter,null,s.a.createElement(l.EuiFlexGroup,{justifyContent:"spaceBetween"},s.a.createElement(l.EuiFlexItem,{grow:!1},s.a.createElement(l.EuiButtonEmpty,{isDisabled:x,"data-test-subj":"cancelExceptionAddButton",onClick:F},s.a.createElement(o.FormattedMessage,{id:"xpack.securitySolution.eventFilters.eventFiltersFlyout.actions.cancel",defaultMessage:"Cancel"}))),s.a.createElement(l.EuiFlexItem,{grow:!1},D))))}));x.displayName="EventFiltersFlyout"},function(e,t,a){"use strict";a.d(t,"a",(function(){return x})),a.d(t,"b",(function(){return j})),a.d(t,"c",(function(){return S}));var n=a(40),i=a(2),r=a.n(i),s=a(42),o=a(109),l=a(148),c=a(170),u=a(104),d=a.n(u);const p=({rowIndex:e,colIndex:t,data:a,header:n,eventId:s,linkValues:o,renderCellValue:l,tabType:c,timelineId:u})=>{const[p,m]=Object(i.useState)({});return r.a.createElement("div",d()({"data-test-subj":"statefulCell"},p),l({columnId:n.id,eventId:s,data:a,header:n,isDraggable:!0,isExpandable:!0,isExpanded:!1,isDetails:!1,isTimeline:!0,linkValues:o,rowIndex:e,colIndex:t,setCellProps:m,scopeId:u,key:null!=c?`${u}-${c}`:u}))};p.displayName="StatefulCellComponent";const m=r.a.memo(p);var b=a(5);const g=({column:e,row:t})=>b.i18n.translate("xpack.securitySolution.timeline.youAreInATableCellScreenReaderOnly",{values:{column:e,row:t},defaultMessage:"You are in a table cell. row: {row}, column: {column}"}),f=e=>b.i18n.translate("xpack.securitySolution.timeline.eventHasEventRendererScreenReaderOnly",{values:{row:e},defaultMessage:"The event in row {row} has an event renderer. Press shift + down arrow to focus it."}),y=({notesCount:e,row:t})=>b.i18n.translate("xpack.securitySolution.timeline.eventHasNotesScreenReaderOnly",{values:{notesCount:e,row:t},defaultMessage:"The event in row {row} has {notesCount, plural, =1 {a note} other {{notesCount} notes}}. Press shift + right arrow to focus notes."}),h=e=>{var t;const{altKey:a,ctrlKey:n,key:i,metaKey:r,shiftKey:s,target:l,type:u}=e,d=l;if((e=>{switch(e){case" ":case"Enter":return!0;default:return!1}})(i)&&null!==(t=d.className)&&void 0!==t&&t.includes(c.b)){const t=d.querySelector(`.${o.a}`),l=new KeyboardEvent(u,{altKey:a,bubbles:!0,cancelable:!0,ctrlKey:n,key:i,metaKey:r,shiftKey:s});" "===i&&e.preventDefault(),null==t||t.dispatchEvent(l)}},v=({action:e,width:t,actionsColumnWidth:a,ariaRowindex:i,columnId:s,columnValues:o,data:u,ecsData:d,eventIdToNoteIds:p,index:m,isEventPinned:b,isEventViewer:v,eventId:E,loadingEventIds:x,notesCount:j,onEventDetailsPanelOpened:S,onRowSelected:k,refetch:O,rowIndex:w,hasRowRenderers:T,onRuleChange:I,selectedEventIds:C,showCheckboxes:M,showNotes:_,tabType:F,timelineId:A,toggleShowNotes:D,setEventsLoading:N,setEventsDeleted:P})=>{const R=t||a;return r.a.createElement(c.m,{width:R,"data-test-subj":"event-actions-container",tabIndex:0},r.a.createElement(c.k,{$ariaColumnIndex:m+l.c,key:null!=F?`${E}_${F}`:`${E}`,onKeyDown:h,role:"button",tabIndex:0,width:t},r.a.createElement(c.l,{"data-test-subj":"cell-container"},r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiScreenReaderOnly,{"data-test-subj":"screenReaderOnly"},r.a.createElement("p",null,g({row:i,column:m+2}))),e&&r.a.createElement(e,{ariaRowindex:i,width:t,checked:Object.keys(C).includes(E),columnId:s,columnValues:o,eventId:E,data:u,ecsData:d,eventIdToNoteIds:p,index:m,isEventPinned:b,isEventViewer:v,loadingEventIds:x,onEventDetailsPanelOpened:S,onRowSelected:k,refetch:O,rowIndex:w,onRuleChange:I,showCheckboxes:M,showNotes:_,timelineId:A,toggleShowNotes:D,setEventsLoading:N,setEventsDeleted:P}))),T?r.a.createElement(n.EuiScreenReaderOnly,{"data-test-subj":"hasRowRendererScreenReaderOnly"},r.a.createElement("p",null,f(i))):null,j?r.a.createElement(n.EuiScreenReaderOnly,{"data-test-subj":"hasNotesScreenReaderOnly"},r.a.createElement("p",null,y({row:i,notesCount:j}))):null))},E=({_id:e,ariaRowindex:t,index:a,header:i,data:o,ecsData:u,hasRowRenderers:d,notesCount:p,renderCellValue:b,tabType:v,timelineId:E})=>{var x;const j=a+l.c;return r.a.createElement(c.k,{$ariaColumnIndex:j,key:null!=v?`${i.id}_${v}`:`${i.id}`,onKeyDown:h,role:"button",tabIndex:0,width:i.initialWidth},r.a.createElement(c.l,{"data-test-subj":"cell-container"},r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiScreenReaderOnly,{"data-test-subj":"screenReaderOnly"},r.a.createElement("p",null,g({row:t,column:j}))),r.a.createElement(m,{rowIndex:t-1,colIndex:j-1,data:o,header:i,eventId:e,linkValues:Object(s.getOr)([],null!==(x=i.linkField)&&void 0!==x?x:"",u),renderCellValue:b,tabType:v,timelineId:E}))),d?r.a.createElement(n.EuiScreenReaderOnly,{"data-test-subj":"hasRowRendererScreenReaderOnly"},r.a.createElement("p",null,f(t))):null,p?r.a.createElement(n.EuiScreenReaderOnly,{"data-test-subj":"hasNotesScreenReaderOnly"},r.a.createElement("p",null,y({row:t,notesCount:p}))):null)},x=r.a.memo((({ariaRowindex:e,actionsColumnWidth:t,columnHeaders:a,columnValues:n,data:s,ecsData:o,eventIdToNoteIds:l,isEventPinned:u,isEventViewer:d,id:p,loadingEventIds:m,notesCount:b,onEventDetailsPanelOpened:g,onRowSelected:f,refetch:y,hasRowRenderers:h,onRuleChange:x,renderCellValue:j,selectedEventIds:S,showCheckboxes:k,showNotes:O,tabType:w,timelineId:T,toggleShowNotes:I,trailingControlColumns:C,leadingControlColumns:M,setEventsLoading:_,setEventsDeleted:F})=>{const A=Object(i.useMemo)((()=>C?C.map((e=>e.rowCellRender)):[]),[C]),D=Object(i.useMemo)((()=>M.length+a.length),[M,a]),N=Object(i.useMemo)((()=>A.map(((a,i)=>a&&r.a.createElement(v,{action:a,width:C[i].width,actionsColumnWidth:t,ariaRowindex:e,checked:Object.keys(S).includes(p),columnId:C[i].id||"",columnValues:n,onRowSelected:f,"data-test-subj":"actions",eventId:p,data:s,key:i,index:D+i,rowIndex:e,ecsData:o,loadingEventIds:m,onEventDetailsPanelOpened:g,showCheckboxes:k,eventIdToNoteIds:l,isEventPinned:u,isEventViewer:d,notesCount:b,refetch:y,hasRowRenderers:h,onRuleChange:x,selectedEventIds:S,showNotes:O,tabType:w,timelineId:T,toggleShowNotes:I,setEventsLoading:_,setEventsDeleted:F})))),[C,p,s,o,f,u,d,t,e,n,l,h,D,m,b,g,x,y,S,k,O,w,T,I,A,_,F]),P=Object(i.useMemo)((()=>a.map(((t,a)=>r.a.createElement(E,{_id:p,index:a,header:t,key:null!=w?`${t.id}_${w}`:`${t.id}`,ariaRowindex:e,data:s,ecsData:o,hasRowRenderers:h,notesCount:b,renderCellValue:j,tabType:w,timelineId:T})))),[p,e,a,s,o,h,b,j,w,T]);return r.a.createElement(c.n,{"data-test-subj":"data-driven-columns"},P,N)}));x.displayName="DataDrivenColumns";const j=({data:e,fieldName:t})=>{if(!e||0===e.length)return;const a=e.find((e=>e.field===t));return null!=a&&null!=a.value?a.value:void 0},S=({data:e,fieldName:t})=>Object(i.useMemo)((()=>j({data:e,fieldName:t})),[e,t])},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r}));var n=a(278);const i={updateActiveGroups:({activeGroups:e,id:t})=>({payload:{activeGroups:e,id:t},type:n.a.updateActiveGroups}),updateGroupOptions:({newOptionList:e,id:t})=>({payload:{newOptionList:e,id:t},type:n.a.updateGroupOptions})};a(576);const r=(e,t)=>(e=>e.groups.groupById)(e)[t]},function(e,t,a){"use strict";a.d(t,"a",(function(){return L}));var n=a(40),i=a(48),r=a(42),s=a(2),o=a.n(s),l=a(41),c=a.n(l),u=a(134),d=a(113),p=a(4),m=a(102),b=a(117),g=a(224),f=a(393),y=a(149),h=a(274),v=a(123),E=a(231),x=a(162),j=a(473),S=a(168),k=a(926),O=a(889),w=a(330),T=a(5);const I=T.i18n.translate("xpack.securitySolution.host.details.endpoint.endpointPolicy",{defaultMessage:"Endpoint integration policy"}),C=T.i18n.translate("xpack.securitySolution.host.details.endpoint.policyStatus",{defaultMessage:"Policy Status"}),M=T.i18n.translate("xpack.securitySolution.host.details.endpoint.sensorversion",{defaultMessage:"Endpoint version"}),_=T.i18n.translate("xpack.securitySolution.host.details.endpoint.fleetAgentStatus",{defaultMessage:"Agent status"});var F=a(419);const A=o.a.memo((({contextID:e,data:t,sourcererScopeId:a})=>{const i=Object(s.useCallback)(((t,n,i)=>o.a.createElement(g.a,{rowItems:[Object(r.getOr)("",t,n)],attrName:i,idPrefix:e?`endpoint-overview-${e}`:"endpoint-overview",sourcererScopeId:a})),[e,a]),l=Object(s.useMemo)((()=>{var e,a,r;const s=null==t||null===(e=t.hostInfo)||void 0===e?void 0:e.metadata.Endpoint.policy.applied;return[[{title:I,description:null!==(a=null==s?void 0:s.name)&&void 0!==a?a:Object(b.d)()}],[{title:C,description:null!=s&&s.status?o.a.createElement(n.EuiHealth,{"aria-label":null==s?void 0:s.status,color:(null==s?void 0:s.status)===F.a.failure?"danger":null==s?void 0:s.status},null==s?void 0:s.status):Object(b.d)()}],[{title:M,description:null!=t&&null!==(r=t.hostInfo)&&void 0!==r&&r.metadata.agent.version?i("hostInfo.metadata.agent.version",t,"agent.version"):Object(b.d)()}],[{title:_,description:null!=t&&t.hostInfo?o.a.createElement(O.a,{endpointHostInfo:t.hostInfo,"data-test-subj":"endpointHostAgentStatus"}):Object(b.d)()}]]}),[t,i]);return o.a.createElement(o.a.Fragment,null,l.map(((e,t)=>o.a.createElement(w.a,{dataTestSubj:"endpoint-overview",descriptionList:e,key:t}))))}));A.displayName="EndpointOverview";var D=a(284),N=a(212),P=a(492);const R=c()(n.EuiFlexGroup).withConfig({displayName:"HostRiskOverviewWrapper",componentId:"sc-p9r0sg-0"})(["padding-top:",";width:",";"],(({theme:e})=>e.eui.euiSizeM),(({$width:e})=>e)),L=o.a.memo((({anomaliesData:e,contextID:t,sourcererScopeId:a,data:l,endDate:c,id:O,isDraggable:T=!1,isInDetailsSidePanel:I=!1,isLoadingAnomaliesData:C,indexNames:M,loading:_,narrowDateRange:F,startDate:L,hostName:B,jobNameById:q})=>{const z=Object(x.a)(),$=Object(E.a)(z),[V]=Object(m.p)(p.B),U=Object(s.useMemo)((()=>B?Object(d.D)([B]):void 0),[B]),{from:H,to:G}=Object(u.a)(),Q=Object(s.useMemo)((()=>({from:H,to:G})),[H,G]),{data:W,isAuthorized:K}=Object(D.c)({filterQuery:U,riskEntity:d.w.host,skip:null==B,timerange:Q}),Y=Object(s.useCallback)(((e,n)=>o.a.createElement(g.a,{rowItems:Object(r.getOr)([],e,n),attrName:e,idPrefix:t?`host-overview-${t}`:"host-overview",isDraggable:T,sourcererScopeId:a})),[t,T,a]),[J,X]=Object(s.useMemo)((()=>{const e=W&&W.length>0?W[0]:void 0;return[{title:o.a.createElement(P.a,{title:k.g,riskScoreEntity:d.w.host}),description:o.a.createElement(o.a.Fragment,null,e?Math.round(e.host.risk.calculated_score_norm):Object(b.d)())},{title:o.a.createElement(P.a,{title:k.f,riskScoreEntity:d.w.host}),description:o.a.createElement(o.a.Fragment,null,e?o.a.createElement(N.b,{severity:e.host.risk.calculated_level,hideBackgroundColor:!0}):Object(b.d)())}]}),[W]),Z=Object(s.useMemo)((()=>[{title:k.e,description:l&&l.host?Object(g.e)({host:l.host,isDraggable:T,noLink:!0}):Object(b.d)()},{title:k.d,description:o.a.createElement(f.a,{indexPatterns:M,field:"host.name",value:B,type:f.b.FIRST_SEEN})},{title:k.k,description:o.a.createElement(f.a,{indexPatterns:M,field:"host.name",value:B,type:f.b.LAST_SEEN})}]),[l,M,B,T]),ee=Object(s.useMemo)((()=>$?[...Z,{title:k.n,description:o.a.createElement(j.a,{anomalies:e,startDate:L,endDate:c,isLoading:C,narrowDateRange:F,jobNameById:q})}]:Z),[e,Z,c,C,F,L,$,q]),te=Object(s.useMemo)((()=>[ee,[{title:k.j,description:o.a.createElement(g.a,{rowItems:Object(r.getOr)([],"host.ip",l),attrName:"host.ip",idPrefix:t?`host-overview-${t}`:"host-overview",sourcererScopeId:a,isDraggable:T,render:e=>null!=e?o.a.createElement(v.h,{ip:e}):Object(b.d)()})},{title:k.m,description:Y("host.mac",l)},{title:k.p,description:Y("host.os.platform",l)}],[{title:k.o,description:Y("host.os.name",l)},{title:k.c,description:Y("host.os.family",l)},{title:k.r,description:Y("host.os.version",l)},{title:k.a,description:Y("host.architecture",l)}],[{title:k.b,description:Y("cloud.provider",l)},{title:k.q,description:Y("cloud.region",l)},{title:k.i,description:Y("cloud.instance.id",l)},{title:k.l,description:Y("cloud.machine.type",l)}]]),[t,a,l,ee,Y,T]);return o.a.createElement(o.a.Fragment,null,o.a.createElement(y.c,null,o.a.createElement(S.g,{direction:I?"column":"row","data-test-subj":"host-overview"},!I&&o.a.createElement(y.b,{queryId:O,title:k.h,inspectIndex:0}),te.map(((e,t)=>o.a.createElement(w.a,{descriptionList:e,key:t}))),_&&o.a.createElement(h.a,{overlay:!0,overlayBackground:V?i.euiDarkVars.euiPageBackgroundColor:i.euiLightVars.euiPageBackgroundColor,size:"xl"}))),K&&o.a.createElement(R,{gutterSize:I?"m":"none",direction:I?"column":"row","data-test-subj":"host-risk-overview",$width:I?"100%":"50%"},o.a.createElement(n.EuiFlexItem,null,o.a.createElement(S.d,{listItems:[J]})),o.a.createElement(n.EuiFlexItem,null,o.a.createElement(S.d,{listItems:[X]}))),l&&null!=l.endpoint?o.a.createElement(o.a.Fragment,null,o.a.createElement(n.EuiHorizontalRule,null),o.a.createElement(S.g,{direction:I?"column":"row"},o.a.createElement(A,{contextID:t,data:l.endpoint,sourcererScopeId:a}),_&&o.a.createElement(h.a,{overlay:!0,overlayBackground:V?i.euiDarkVars.euiPageBackgroundColor:i.euiLightVars.euiPageBackgroundColor,size:"xl"}))):null)}));L.displayName="HostOverview"},function(e,t,a){"use strict";a.d(t,"a",(function(){return h}));var n=a(40),i=a(2),r=a.n(i),s=a(699),o=a(670),l=a(53),c=a.n(l),u=a(516),d=a.n(u),p=a(5);p.i18n.translate("xpack.securitySolution.clipboard.copy",{defaultMessage:"Copy"});const m=p.i18n.translate("xpack.securitySolution.clipboard.copied",{defaultMessage:"Copied"}),b=p.i18n.translate("xpack.securitySolution.clipboard.to.the.clipboard",{defaultMessage:"to the clipboard"}),g=p.i18n.translate("xpack.securitySolution.clipboard.copy.to.the.clipboard",{defaultMessage:"Copy to the clipboard"});var f=a(108);const y=({children:e,content:t,isHoverAction:a,onCopy:i,titleSummary:s,toastLifeTimeMs:o})=>{const{addSuccess:l}=Object(f.a)(),u=c()("copy-to-clipboard",{securitySolution__hoverActionButton:a});return r.a.createElement(n.EuiButtonIcon,{"aria-label":g,className:u,"data-test-subj":"clipboard",iconType:"copyClipboard",onClick:e=>{e.preventDefault(),e.stopPropagation();const a=d()(`${t}`,{debug:!0});null!=i&&i({content:t,isSuccess:a}),a&&l(`${m} ${s} ${b}`,{toastLifeTimeMs:o})}},e)},h=r.a.memo((({isHoverAction:e,keyboardShortcut:t="",text:a,titleSummary:i})=>r.a.createElement(n.EuiToolTip,{content:r.a.createElement(s.a,{additionalScreenReaderOnlyContext:a,content:o.a,shortcut:t,showShortcut:""!==t})},r.a.createElement(y,{content:a,isHoverAction:e,titleSummary:i,toastLifeTimeMs:800}))));h.displayName="WithCopyToClipboard"},function(e,t,a){"use strict";a.d(t,"a",(function(){return m}));var n=a(2),i=a(474),r=a(141),s=a(231),o=a(486),l=a(108),c=a(102),u=a(162),d=a(1041);const p=Object(r.d)((async({http:e,jobIds:t,signal:a})=>e.fetch("/internal/ml/jobs/jobs",{method:"POST",version:"1",body:JSON.stringify({jobIds:t}),asSystemRequest:!0,signal:a}))),m=(e,t)=>{const a=Object(n.useMemo)((()=>null!=e?e:[]),[e]),{loading:m,jobs:b}=Object(i.a)(),g=Object(n.useMemo)((()=>b.filter((({id:e})=>a.includes(e)))),[b,a]),f=Object(n.useMemo)((()=>g.filter((({isInstalled:e})=>e)).map((e=>e.id))),[g]),{loading:y,jobs:h}=(e=>{const[t,a]=Object(n.useState)([]),{addError:i}=Object(l.a)(),m=Object(u.a)(),b=Object(c.i)(),{error:g,loading:f,result:y,start:h}=Object(r.a)(p),v=Object(s.a)(m),E=Object(o.a)(m);return Object(n.useEffect)((()=>{v&&E&&e.length>0&&h({http:b,jobIds:e})}),[b,v,E,h,e]),Object(n.useEffect)((()=>{y&&a(y)}),[y]),Object(n.useEffect)((()=>{g&&i(g,{title:d.a})}),[i,g]),{isLicensed:E,isMlUser:v,jobs:t,loading:f}})(f),v=Object(n.useMemo)((()=>{const e=h.map((e=>`.ml-anomalies-${e.results_index_name}`));return[...new Set(e)]}),[h]);return{mlJobLoading:m||y,ruleIndices:Object(n.useMemo)((()=>v.length>0?v:null!=t?t:[]),[t,v])}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return x}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(40),l=a(299),c=a(183),u=a(120),d=a(210),p=a(5);const m=p.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.alertsActions.sectionTitle",{defaultMessage:"Alerts actions"}),b=p.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.alertsActions.singleAlertCloseLabel",{defaultMessage:"Close this alert"}),g=p.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.alertsActions.bulkCloseLabel.disabled",{defaultMessage:"Close all alerts that match this exception and were generated by this rule (Lists and non-ECS fields are not supported)"}),f=p.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.alertsActions.bulkCloseLabel",{defaultMessage:"Close all alerts that match this exception and were generated by selected rule/s"}),y=p.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.alertsActions.endpointQuarantineText",{defaultMessage:"On all Endpoint hosts, quarantined files that match the exception are automatically restored to their original locations. This exception applies to all rules using Endpoint exceptions."}),h=s.a.section.withConfig({displayName:"FlyoutCheckboxesSection",componentId:"sc-1ggwgok-0"})(["overflow-y:inherit;height:auto;.euiFlyoutBody__overflowContent{padding-top:0;}"]),v=s()(o.EuiTitle).withConfig({displayName:"SectionHeader",componentId:"sc-1ggwgok-1"})(["",""],(()=>Object(r.css)(["font-weight:",";"],(({theme:e})=>e.eui.euiFontWeightSemiBold)))),E=({isAlertDataLoading:e,exceptionListItems:t,exceptionListType:a,shouldCloseSingleAlert:r,shouldBulkCloseAlert:s,disableBulkClose:p,alertData:E,alertStatus:x,onDisableBulkClose:j,onUpdateBulkCloseIndex:S,onBulkCloseCheckboxChange:k,onSingleAlertCloseCheckboxChange:O})=>{const{loading:w,signalIndexName:T}=Object(l.a)(),I=Object(n.useMemo)((()=>null!==T?[T]:[]),[T]),[C,{indexPatterns:M}]=Object(c.b)(I),_=Object(n.useCallback)((e=>{k(e.currentTarget.checked)}),[k]),F=Object(n.useCallback)((e=>{null!=O&&O(e.currentTarget.checked)}),[O]);return Object(n.useEffect)((()=>{S(s&&null!=I?I:void 0)}),[I,S,s]),Object(n.useEffect)((()=>{!0===p&&k(!1)}),[p,k]),Object(n.useEffect)((()=>{!1===C&&!1===w&&j((e=>{for(const{entries:t}of e)for(const e of null!=t?t:[])if(Object(d.l)(e)===u.d.LIST)return!0;return!1})(t)||((e,t)=>{const a=e=>t.fields.some((({name:t})=>t===e.field));if(0===e.length)return!1;for(const{entries:t}of e)for(const e of null!=t?t:[])if("nested"===e.type){for(const t of e.entries)if(!1===a(t))return!0}else if(!1===a(e))return!0;return!1})(t,M)||t.every((e=>0===e.entries.length)))}),[j,t,C,w,M]),i.a.createElement(h,null,i.a.createElement(v,{size:"xs"},i.a.createElement("h3",null,m)),i.a.createElement(o.EuiSpacer,{size:"s"}),null!=E&&"closed"!==x&&i.a.createElement(o.EuiFormRow,{fullWidth:!0},i.a.createElement(o.EuiCheckbox,{"data-test-subj":"closeAlertOnAddExceptionCheckbox",id:"close-alert-on-add-add-exception-checkbox",label:b,checked:r,onChange:F,disabled:w||C||e})),i.a.createElement(o.EuiFormRow,{fullWidth:!0},i.a.createElement(o.EuiCheckbox,{"data-test-subj":"bulkCloseAlertOnAddExceptionCheckbox",id:"bulk-close-alert-on-add-add-exception-checkbox",label:p?g:f,checked:s,onChange:_,disabled:p||w||C||e})),"endpoint"===a&&i.a.createElement(i.a.Fragment,null,i.a.createElement(o.EuiSpacer,{size:"s"}),i.a.createElement(o.EuiText,{"data-test-subj":"addExceptionEndpointText",color:"subdued",size:"s"},y)))},x=i.a.memo(E);x.displayName="ExceptionItemsFlyoutAlertsActions"},function(e,t,a){"use strict";a.d(t,"a",(function(){return b}));var n=a(2),i=a(312),r=a(156),s=a(49),o=a(102);var l=a(281),c=a(19),u=a(5);const d=u.i18n.translate("xpack.securitySolution.ruleExceptions.logic.closeAlerts.error",{defaultMessage:"Failed to close alerts"});var p=a(108),m=a(410);const b=()=>{const{addSuccess:e,addError:t,addWarning:a}=Object(p.a)(),[b,g]=Object(n.useState)(!1),f=Object(n.useRef)(null);return Object(n.useEffect)((()=>{let n=!0;const p=new AbortController;return f.current=async(b,f,y,h)=>{try{var v,E,x,j,S,k,O,w;let t,d;if(g(!0),null!=y&&(t=await Object(m.a)({signalIds:[y],status:"closed",signal:p.signal})),null!=h){const e=Object(i.b)(["open","acknowledged","in-progress"]),t=await(async(e,t,a,n,i,l=!0)=>{const c={fields:[],title:n.join()},{filter:u}=await Object(r.q)({http:o.b.get().http,exceptions:i,excludeExceptions:l,chunkSize:10}),d={query:e,language:t},p=((e,t)=>null!=t?[...e,t]:[...e])(a,u);return Object(s.buildEsQuery)(c,d,p,{allowLeadingWildcards:!0,queryStringOptions:{analyze_wildcard:!0},ignoreFilterIfFieldNotInIndex:!1,dateFormatTZ:"Zulu"})})("","kuery",[...b.flatMap((e=>Object(i.c)(e))),...e],h,Object(l.m)(f),!1);d=await Object(m.a)({query:t,status:"closed",signal:p.signal})}const I=(null!==(v=null===(E=t)||void 0===E?void 0:E.updated)&&void 0!==v?v:0)+(null!==(x=null===(j=d)||void 0===j?void 0:j.updated)&&void 0!==x?x:0),C=null!==(S=null===(k=t)||void 0===k?void 0:k.version_conflicts)&&void 0!==S?S:0+(null!==(O=null===(w=d)||void 0===w?void 0:w.version_conflicts)&&void 0!==O?O:0);n&&(g(!1),e((T=I,u.i18n.translate("xpack.securitySolution.ruleExceptions.logic.closeAlerts.success",{values:{numAlerts:T},defaultMessage:"Successfully updated {numAlerts} {numAlerts, plural, =1 {alert} other {alerts}}"}))),C>0&&a({title:c.f(C),text:c.g(I,C)}))}catch(e){n&&(g(!1),t(e,{title:d}))}var T},()=>{n=!1,p.abort()}}),[e,t,a]),[b,f.current]}},function(e,t,a){"use strict";a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return h}));var n=a(103),i=a(173);function r(e){return Object(n.useSelector)((function(t){return e(t[i.u][i.t])}))}var s=a(2),o=a.n(s),l=a(44),c=a(81),u=a(126),d=a(693),p=a(4),m=a(245),b=a(527),g=a(323),f=a(228),y=a(932);const h=(e,t)=>{const{getAppUrl:a}=Object(g.a)(),n=r(b.agentPolicies),i=r(b.uiQueryParams),h=Object(d.d)(),{canAccessResponseConsole:v,canIsolateHost:E,canUnIsolateHost:x,canAccessEndpointActionsLogManagement:j,canAccessFleet:S}=Object(u.a)().endpointPrivileges;return Object(s.useMemo)((()=>{if(!e)return[];const r=Object(f.b)(e),s=e.agent.id,u=e.Endpoint.policy.applied.id,d=e.host.hostname,b=e.elastic.agent.id,g=Object(y.a)({osName:e.host.os.name,version:e.agent.version,capabilities:e.Endpoint.capabilities}),{show:k,selected_endpoint:O,...w}=i,T=Object(m.d)({name:"endpointActivityLog",...w,selected_endpoint:s}),I=Object(m.d)({name:"endpointIsolate",...w,selected_endpoint:s}),C=Object(m.d)({name:"endpointUnIsolate",...w,selected_endpoint:s}),M=[];return r&&x?M.push({"data-test-subj":"unIsolateLink",icon:"lockOpen",key:"unIsolateHost",navigateAppId:p.l,navigateOptions:{path:C},href:a({path:C}),children:o.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.endpoint.actions.unIsolateHost",defaultMessage:"Release host"})}):g&&E&&M.push({"data-test-subj":"isolateLink",icon:"lock",key:"isolateHost",navigateAppId:p.l,navigateOptions:{path:I},href:a({path:I}),children:o.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.endpoint.actions.isolateHost",defaultMessage:"Isolate host"})}),[...M,...v?[{"data-test-subj":"console",icon:"console",key:"consoleLink",onClick:t=>{t.preventDefault(),h(e)},children:o.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.endpoint.actions.console",defaultMessage:"Respond"})}]:[],...null!=t&&t.isEndpointList&&j?[{"data-test-subj":"actionsLink",icon:"logoSecurity",key:"actionsLogLink",navigateAppId:p.l,navigateOptions:{path:T},href:a({path:T}),children:o.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.endpoint.actions.responseActionsHistory",defaultMessage:"View response actions history"})}]:[],{"data-test-subj":"hostLink",icon:"logoSecurity",key:"hostDetailsLink",navigateAppId:p.l,navigateOptions:{path:`/hosts/${d}`},href:a({path:`/hosts/${d}`}),children:o.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.endpoint.actions.hostDetails",defaultMessage:"View host details"})},...S?[{icon:"gear",key:"agentConfigLink","data-test-subj":"agentPolicyLink",navigateAppId:"fleet",navigateOptions:{path:`${c.pagePathGetters.policy_details({policyId:n[u]})[1]}`},href:`${a({appId:"fleet"})}${c.pagePathGetters.policy_details({policyId:n[u]})[1]}`,disabled:void 0===n[u],children:o.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.endpoint.actions.agentPolicy",defaultMessage:"View agent policy"})},{icon:"gear",key:"agentDetailsLink","data-test-subj":"agentDetailsLink",navigateAppId:"fleet",navigateOptions:{path:`${c.pagePathGetters.agent_details({agentId:b})[1]}`},href:`${a({appId:"fleet"})}${c.pagePathGetters.agent_details({agentId:b})[1]}`,children:o.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.endpoint.actions.agentDetails",defaultMessage:"View agent details"})},{icon:"gear",key:"agentPolicyReassignLink","data-test-subj":"agentPolicyReassignLink",navigateAppId:"fleet",navigateOptions:{path:`${c.pagePathGetters.agent_details({agentId:b})[1]}?openReassignFlyout=true`,state:{onDoneNavigateTo:[p.l,{path:Object(m.e)({name:"endpointList"})}]}},href:`${a({appId:"fleet"})}${c.pagePathGetters.agent_details({agentId:b})[1]}?openReassignFlyout=true`,children:o.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.endpoint.actions.agentPolicyReassign",defaultMessage:"Reassign agent policy"})}]:[]]}),[i,v,j,e,n,a,h,null==t?void 0:t.isEndpointList,E,x,S])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return b}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(5);const c=l.i18n.translate("xpack.elasticAssistant.dataAnonymizationEditor.stats.anonymizedStat.anonymizeFieldsdDescription",{defaultMessage:"Anonymized"});var u=a(553),d=a(21);const p=o()(n.EuiFlexItem)`
  margin-right: ${({theme:e})=>e.eui.euiSizeS};
`,m=({anonymized:e,isDataAnonymizable:t,showIcon:a=!1})=>{const r=Object(i.useMemo)((()=>(e=>e?"default":"subdued")(t)),[t]),s=Object(i.useMemo)((()=>(({anonymized:e,isDataAnonymizable:t})=>t&&0!==e?(e=>l.i18n.translate("xpack.elasticAssistant.dataAnonymizationEditor.stats.anonymizedStat.fieldsWillBeAnonymizedTooltip",{values:{anonymized:e},defaultMessage:"{anonymized} {anonymized, plural, =1 {field} other {fields}} in this context will be replaced with random values. Responses are automatically translated back to the original values."}))(e):(e=>l.i18n.translate("xpack.elasticAssistant.dataAnonymizationEditor.stats.anonymizedStat.noneOfTheDataWillBeAnonymizedTooltip",{values:{isDataAnonymizable:e},defaultMessage:"{isDataAnonymizable, select, true {Select fields to be replaced with random values. Responses are automatically translated back to the original values.} other {This context cannot be anonymized}}"}))(t))({anonymized:e,isDataAnonymizable:t})),[e,t]),o=Object(i.useMemo)((()=>Object(d.jsx)(n.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},a&&Object(d.jsx)(p,{grow:!1},Object(d.jsx)(n.EuiIcon,{color:r,"data-test-subj":"anonymizationIcon",size:"m",type:"eyeClosed"})),Object(d.jsx)(n.EuiFlexItem,{grow:!1},Object(d.jsx)(n.EuiText,{color:r,"data-test-subj":"description",size:"s"},c)))),[r,a]);return Object(d.jsx)(n.EuiToolTip,{content:s},Object(d.jsx)(n.EuiStat,{"data-test-subj":"anonymizedFieldsStat",description:o,reverse:!0,titleColor:r,title:e,titleSize:u.a}))};m.displayName="AnonymizedStatComponent";const b=r.a.memo(m)},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(2),i=a(5);i.i18n.translate("xpack.securitySolution.firstLastSeenHost.errorSearchDescription",{defaultMessage:"An error has occurred on first last seen host search"});const r=i.i18n.translate("xpack.securitySolution.firstLastSeenHost.failSearchDescription",{defaultMessage:"Failed to run search on first last seen host"});var s=a(194),o=a(113);const l=({field:e,value:t,order:a,defaultIndex:i,filterQuery:l})=>{const{loading:c,result:u,search:d,error:p}=Object(s.a)({factoryQueryType:o.d,initialResult:{firstSeen:null,lastSeen:null},errorMessage:r});return Object(n.useEffect)((()=>{d({defaultIndex:i,factoryQueryType:o.d,field:e,value:t,order:a,filterQuery:l})}),[i,e,t,a,d,l]),[c,Object(n.useMemo)((()=>({firstSeen:u.firstSeen,lastSeen:u.lastSeen,errorMessage:p?p.toString():null})),[u,p])]}},function(e,t,a){"use strict";a.d(t,"a",(function(){return m}));var n=a(2),i=a.n(n),r=a(63),s=a(199),o=a(291);const l=()=>document.querySelector('[tour-step="create-case-submit"]'),c=()=>{const[e,t]=Object(n.useState)(s.a.createCase),a=Object(n.useCallback)((()=>{var e;null===(e=l())||void 0===e||e.scrollIntoView()}),[]),r=Object(n.useCallback)((()=>{t(s.a.submitCase),a(),setTimeout((()=>{var e;null===(e=l())||void 0===e||e.focus()}),500)}),[a]);return i.a.createElement(i.a.Fragment,null,e===s.a.createCase&&i.a.createElement(o.a,{onClick:r,step:s.a.createCase,tourId:s.b.alertsCases}),e===s.a.submitCase&&i.a.createElement(o.a,{step:s.a.submitCase,tourId:s.b.alertsCases}))};var u=a(363),d=a(102),p=a(135);const m=({onMenuItemClick:e,ariaLabel:t,ecsData:a,nonEcsData:o,onSuccess:l,isActiveTimelines:m,isInDetections:b,refetch:g})=>{const{cases:f}=Object(d.j)().services,y=Object(d.h)(),h=Object(n.useMemo)((()=>{var e,t;return null==a||null===(e=a.event)||void 0===e||null===(t=e.kind)||void 0===t?void 0:t.includes("signal")}),[a]),v=Object(n.useMemo)((()=>{var e,t;return null!=a&&a._id?[{alertId:null!==(e=null==a?void 0:a._id)&&void 0!==e?e:"",index:null!==(t=null==a?void 0:a._index)&&void 0!==t?t:"",type:r.AttachmentType.alert,rule:f.helpers.getRuleIdFromEvent({ecs:a,data:null!=o?o:[]})}]:[]}),[f.helpers,a,o]),{activeStep:E,incrementStep:x,setStep:j,isTourShown:S}=Object(u.b)(),k=()=>{l&&l(),g&&g()},O=Object(n.useCallback)((async()=>{S(s.b.alertsCases)&&j(s.b.alertsCases,s.a.viewCase)}),[j,S]),w=Object(n.useMemo)((()=>!S(s.b.alertsCases)||E!==s.a.addAlertToCase&&E!==s.a.createCase&&E!==s.a.submitCase?{}:{initialValue:s.d}),[E,S]),T=f.hooks.useCasesAddToNewCaseFlyout({onClose:e,onSuccess:k,afterCaseCreated:O,...w}),I=f.hooks.useCasesAddToExistingCaseModal({onClose:e,onSuccess:k}),C=Object(n.useCallback)((()=>{e(),T.open({attachments:v,...S(s.b.alertsCases)?{headerContent:i.a.createElement(c,null)}:{}}),S(s.b.alertsCases)&&E===s.a.addAlertToCase&&x(s.b.alertsCases)}),[e,T,v,S,E,x]),M=Object(n.useCallback)((()=>{e(),I.open({getAttachments:()=>v})}),[v,e,I]);return{addToCaseActionItems:Object(n.useMemo)((()=>(m||b)&&y.create&&y.read&&h?[{"aria-label":t,"data-test-subj":"add-to-existing-case-action",key:"add-to-existing-case-action",onClick:M,size:"s",name:p.j},{"aria-label":t,"data-test-subj":"add-to-new-case-action",key:"add-to-new-case-action",onClick:C,size:"s",name:p.k}]:[]),[t,M,C,y.create,y.read,b,m,h]),handleAddToNewCaseClick:C}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return T}));var n=a(2),i=a.n(n),r=a(8),s=a(40),o=a(44),l=a(210),c=a(174),u=a(80),d=a(215),p=a(107),m=a(183),b=a(274),g=a(17),f=a(102),y=a(487),h=a(1097),v=a(347),E=a(575),x=a(953),j=a(830),S=a(611),k=a(574);const O=[c.c.MAC,c.c.WINDOWS,c.c.LINUX].map((e=>({value:e,inputDisplay:v.a[e]}))),w=e=>e.entries.map((e=>(delete e.id,e))),T=Object(n.memo)((({allowSelectOs:e=!0,item:t,policies:a,policiesIsLoading:v,onChange:T,mode:I})=>{const C=Object(p.a)("eventFilters-form"),{http:M}=Object(f.j)().services,_=Object(n.useCallback)((({field:e,query:t})=>new k.a(M).getSuggestions({field:e.name,query:t})),[M]),F=(A=_,Object(n.useMemo)((()=>({getQuerySuggestions:()=>{},hasQuerySuggestions:e=>!1,getValueSuggestions:A})),[A]));var A;const[D,N]=Object(n.useState)(!1),[P,R]=Object(n.useState)(!t.name),[L,B]=Object(n.useState)(""),[q,z]=Object(n.useState)(!1),[$,V]=Object(n.useState)([]),U=Object(g.b)().isPlatinumPlus(),H=Object(n.useMemo)((()=>Object(y.e)(t)),[t]),[G,Q]=Object(n.useState)(!Object(j.d)(null==t?void 0:t.tags)),[W,K]=Object(n.useState)(!1),Y=Object(n.useMemo)((()=>[d.z]),[]),[J,{indexPatterns:X}]=Object(m.b)(Y,void 0,d.k),[Z,ee]=Object(n.useState)(!!t.entries.length||!1),te=Object(n.useMemo)((()=>null==t?void 0:t.comments),[]),ae=Object(n.useMemo)((()=>U||"edit"===I&&(!H||G&&H&&D)),[I,H,D,U,G]),ne=Object(n.useMemo)((()=>!P&&!!t.entries.length&&t.entries.some((e=>""!==e.value||e.value.length))),[P,t.entries]),ie=Object(n.useCallback)((e=>{const a=e?{...t,...e}:t;w(a),T({item:a,isValid:ne&&Z})}),[Z,t,ne,T]);Object(n.useEffect)((()=>{!D&&t.tags&&Q(!Object(j.d)(t.tags))}),[t.tags,D]),Object(n.useEffect)((()=>{if(D)return;const e=t.tags?Object(y.c)({tags:t.tags}):[];if(!e.length)return;const n=a.filter((t=>e.includes(t.id)));V(n)}),[D,t,a]);const re=Object(n.useMemo)((()=>{const e=t;return e.entries=t.entries.length?t.entries:[{field:"",operator:"included",type:"match",value:""}],w(e),ee(!!t.entries.length),e}),[t]),se=Object(n.useCallback)((e=>{if(!t)return;const a=e.target.value.trim();R(!a),ie({name:a}),D||N(!0)}),[t,D,ie]),oe=Object(n.useMemo)((()=>{var e;return i.a.createElement(s.EuiFormRow,{label:h.e,fullWidth:!0,isInvalid:P&&q,error:h.d},i.a.createElement(s.EuiFieldText,{"aria-label":h.e,id:"eventFiltersFormInputName",defaultValue:null!==(e=null==t?void 0:t.name)&&void 0!==e?e:"","data-test-subj":C("name-input"),fullWidth:!0,maxLength:256,required:q,onChange:se,onBlur:()=>!q&&z(!0)}))}),[C,P,se,q,null==t?void 0:t.name]),le=Object(n.useCallback)((e=>{t&&(D||N(!0),ie({description:e.target.value.toString().trim()}))}),[t,D,ie]),ce=Object(n.useMemo)((()=>{var e;return i.a.createElement(s.EuiFormRow,{label:h.b,fullWidth:!0},i.a.createElement(s.EuiTextArea,{id:"eventFiltersFormInputDescription",defaultValue:null!==(e=null==t?void 0:t.description)&&void 0!==e?e:"",onChange:le,fullWidth:!0,"data-test-subj":C("description-input"),"aria-label":h.b,maxLength:256}))}),[null==t?void 0:t.description,C,le]),ue=Object(n.useMemo)((()=>{var e;return null!=t&&null!==(e=t.os_types)&&void 0!==e&&e.length?t.os_types[0]:c.c.WINDOWS}),[null==t?void 0:t.os_types]),de=Object(n.useCallback)((e=>{t&&(ie({os_types:[e],entries:t.entries}),D||N(!0))}),[t,D,ie]),pe=Object(n.useMemo)((()=>i.a.createElement(s.EuiFormRow,{label:h.f,fullWidth:!0},i.a.createElement(s.EuiSuperSelect,{name:"os",options:O,fullWidth:!0,valueOfSelected:ue,onChange:de}))),[de,ue]),me=Object(n.useCallback)((e=>{t&&(B(e),ie({comments:[{comment:e}]}),D||N(!0))}),[t,D,ie]),be=Object(n.useMemo)((()=>i.a.createElement(S.a,{exceptionItemComments:te,newCommentValue:L,newCommentOnChange:me})),[te,me,L]),ge=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiText,{size:"xs"},i.a.createElement("h3",null,i.a.createElement(o.FormattedMessage,{id:"xpack.securitySolution.eventFilters.commentsSectionTitle",defaultMessage:"Comments"}))),i.a.createElement(s.EuiSpacer,{size:"xs"}),i.a.createElement(s.EuiText,{size:"s"},i.a.createElement("p",null,i.a.createElement(o.FormattedMessage,{id:"xpack.securitySolution.eventFilters.commentsSectionDescription",defaultMessage:"Add a comment to your event filter."}))),i.a.createElement(s.EuiSpacer,{size:"m"}),be)),[be]),fe=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiText,{size:"xs"},i.a.createElement("h3",null,i.a.createElement(o.FormattedMessage,{id:"xpack.securitySolution.eventFilters.detailsSectionTitle",defaultMessage:"Details"}))),i.a.createElement(s.EuiSpacer,{size:"xs"}),i.a.createElement(s.EuiText,{size:"s"},i.a.createElement("p",null,h.a)),i.a.createElement(s.EuiSpacer,{size:"m"}),oe,ce)),[oe,ce]),ye=Object(n.useCallback)((e=>{var a,n,i,s,o,l,u,d,p;if(!D&&void 0===e.exceptionItems[0]||Object(r.isEqual)(null===(a=e.exceptionItems[0])||void 0===a?void 0:a.entries,null==t?void 0:t.entries)){var m;const t=(null===(m=e.exceptionItems[0])||void 0===m?void 0:m.entries.map((e=>e.field)))||[""];return K((p=t.reduce(((e,t)=>(t in e?e[t]++:e[t]=1,e)),{}),Object.values(p).some((e=>e>1)))),void(D||N(!0))}const b=void 0!==e.exceptionItems[0]?{...e.exceptionItems[0],name:null!==(n=null==t?void 0:t.name)&&void 0!==n?n:"",description:null!==(i=null==t?void 0:t.description)&&void 0!==i?i:"",comments:null!==(s=null==t?void 0:t.comments)&&void 0!==s?s:[],os_types:null!==(o=null==t?void 0:t.os_types)&&void 0!==o?o:[c.c.WINDOWS],tags:null!==(l=null==t?void 0:t.tags)&&void 0!==l?l:[],meta:t.meta}:t,g=void 0!==e.exceptionItems[0]&&!(e.errorExists&&(null===(u=e.exceptionItems[0])||void 0===u||null===(d=u.entries)||void 0===d||!d.length));ee(g),ie(b),D||N(!0)}),[t,D,ie]),he=Object(n.useMemo)((()=>Object(u.getExceptionBuilderComponentLazy)({allowLargeValueLists:!1,httpService:M,autocompleteService:F,exceptionListItems:[re],listType:E.c,listId:E.a,listNamespaceType:"agnostic",ruleName:h.g,indexPatterns:X,isOrDisabled:!0,isOrHidden:!0,isAndDisabled:!1,isNestedDisabled:!1,dataTestSubj:"alert-exception-builder",idAria:"alert-exception-builder",onChange:ye,operatorsList:l.b,osTypes:t.os_types})),[F,ye,M,X,t,re]),ve=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiText,{size:"xs"},i.a.createElement("h3",null,i.a.createElement(o.FormattedMessage,{id:"xpack.securitySolution.eventFilters.criteriaSectionTitle",defaultMessage:"Conditions"}))),i.a.createElement(s.EuiSpacer,{size:"xs"}),i.a.createElement(s.EuiText,{size:"s"},i.a.createElement("p",null,e?i.a.createElement(o.FormattedMessage,{id:"xpack.securitySolution.eventFilters.criteriaSectionDescription.withOs",defaultMessage:"Select an operating system and add conditions."}):i.a.createElement(o.FormattedMessage,{id:"xpack.securitySolution.eventFilters.criteriaSectionDescription.withoutOs",defaultMessage:"Add conditions."}))),i.a.createElement(s.EuiSpacer,{size:"m"}),e?i.a.createElement(i.a.Fragment,null,pe,i.a.createElement(s.EuiSpacer,null)):null,he)),[e,he,pe]),Ee=Object(n.useCallback)((e=>{const t=e.isGlobal?[y.b]:e.selected.map((e=>`${y.a}${e.id}`));e.isGlobal||V(e.selected),ie({tags:t}),D||N(!0)}),[ie,D,V]),xe=Object(n.useMemo)((()=>i.a.createElement(x.a,{selected:$,options:a,isGlobal:H,isLoading:v,isPlatinumPlus:U,onChange:Ee,"data-test-subj":C("effectedPolicies")})),[$,a,H,v,U,Ee,C]);return Object(n.useEffect)((()=>{ie()}),[ie]),J||!t?i.a.createElement(b.a,{size:"xl"}):i.a.createElement(s.EuiForm,{component:"div"},fe,i.a.createElement(s.EuiHorizontalRule,null),ve,W&&i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiSpacer,{size:"xs"}),i.a.createElement(s.EuiText,{color:"subdued",size:"xs","data-test-subj":"duplicate-fields-warning-message"},i.a.createElement(o.FormattedMessage,{id:"xpack.securitySolution.eventFilters.warningMessage.duplicateFields",defaultMessage:"Using multiples of the same filed values can degrade Endpoint performance and/or create ineffective rules"}))),ae&&i.a.createElement(i.a.Fragment,null,i.a.createElement(s.EuiHorizontalRule,null),xe),i.a.createElement(s.EuiHorizontalRule,null),ge)}));T.displayName="EventFiltersForm"},,function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(2),i=a.n(n),r=a(40),s=a(5);const o=s.i18n.translate("xpack.securitySolution.rule_exceptions.itemMeta.nameLabel",{defaultMessage:"Exception name"}),l=s.i18n.translate("xpack.securitySolution.rule_exceptions.itemMeta.namePlaceholder",{defaultMessage:"Name your exception"}),c=({exceptionItemName:e,onChange:t})=>{const a=Object(n.useCallback)((e=>{t(["name",e.target.value])}),[t]);return i.a.createElement(r.EuiFormRow,{label:o,"data-test-subj":"exceptionFlyoutName"},i.a.createElement(r.EuiFieldText,{placeholder:l,value:e,onChange:a,"data-test-subj":"exceptionFlyoutNameInput"}))},u=i.a.memo(c);u.displayName="ExceptionsFlyoutMeta"},function(e,t,a){"use strict";a.d(t,"a",(function(){return S}));var n=a(2),i=a.n(n),r=a(40),s=a(80),o=a(120),l=a(41),c=a.n(l),u=a(163),d=a(197),p=a(102),m=a(5);const b=m.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.itemConditions.conditionsTitle",{defaultMessage:"Conditions"}),g=m.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.itemConditions.infoLabel",{defaultMessage:"Alerts are generated when the rule's conditions are met, except when:"}),f=m.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.itemConditions.sequenceWarningAdd",{defaultMessage:"This rule's query contains an EQL sequence statement. The exception created will apply to all events in the sequence."}),y=m.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.itemConditions.sequenceWarningEdit",{defaultMessage:"This rule's query contains an EQL sequence statement. The exception modified will apply to all events in the sequence."}),h=m.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.itemConditions.operatingSystemPlaceHolder",{defaultMessage:"Select an operating system"});var v=a(458);const E=[{label:v.g,value:["windows"]},{label:v.f,value:["macos"]},{label:v.e,value:["linux"]},{label:v.h,value:["windows","macos"]}],x=c()(r.EuiTitle).withConfig({displayName:"SectionHeader",componentId:"sc-x9h592-0"})(["",""],(()=>Object(l.css)(["font-weight:",";"],(({theme:e})=>e.eui.euiFontWeightSemiBold)))),j=({exceptionItemName:e,allowLargeValueLists:t,exceptionListItems:a,indexPatterns:l,rules:c,exceptionListType:m,showOsTypeOptions:j,selectedOs:S,isEdit:k,onOsChange:O,onExceptionItemAdd:w,onSetErrorExists:T,getExtendedFields:I})=>{const{http:C,unifiedSearch:M}=Object(p.j)().services,_=Object(n.useMemo)((()=>m===o.b.ENDPOINT),[m]),F=Object(n.useMemo)((()=>null!=c&&c.some((e=>Object(d.b)(e.type)&&Object(d.a)(e.query)))),[c]),A=Object(n.useMemo)((()=>{if(_)return"endpoint_list";const e=_?u.k:void 0;return k?a[0].list_id:e}),[_,k,a]),D=Object(n.useMemo)((()=>{const e=_?"agnostic":void 0;return k?a[0].namespace_type:e}),[a,k,_]),N=Object(n.useCallback)((({exceptionItems:e,errorExists:t})=>{w(e),T(t)}),[T,w]),P=Object(n.useCallback)((e=>{const t=e[0].value;null!=O&&O(t||void 0)}),[O]),R=Object(n.useMemo)((()=>({asPlainText:!0})),[]),L=Object(n.useMemo)((()=>E.filter((e=>S===e.value))),[S]),B=Object(n.useMemo)((()=>j&&void 0===S),[j,S]),q=Object(n.useMemo)((()=>k?y:f),[k]),z=Object(n.useMemo)((()=>{var e;return null!==(e=k?a[0].os_types:S)&&void 0!==e?e:[]}),[a,k,S]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(x,{size:"xs"},i.a.createElement("h3",null,b)),F&&i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiCallOut,{"data-test-subj":"eqlSequenceCallout",title:q}),i.a.createElement(r.EuiSpacer,null)),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(r.EuiText,{size:"s"},g),i.a.createElement(r.EuiSpacer,{size:"s"}),j&&!k&&i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiFormRow,{label:v.d},i.a.createElement(r.EuiComboBox,{placeholder:h,singleSelection:R,options:E,selectedOptions:L,onChange:P,isClearable:!1,"data-test-subj":"osSelectionDropdown"})),i.a.createElement(r.EuiSpacer,{size:"l"})),j&&k&&i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiText,{size:"xs","data-test-subj":"exceptionItemSelectedOs"},i.a.createElement("dl",null,i.a.createElement("dt",null,v.d),i.a.createElement("dd",null,(e=>e.reduce(((e,t)=>`${(e=>"linux"===e?v.e:"macos"===e?v.f:v.g)(t)}, ${e}`),"").slice(0,-2))(z)))),i.a.createElement(r.EuiSpacer,null)),Object(s.getExceptionBuilderComponentLazy)({allowLargeValueLists:t,httpService:C,autocompleteService:M.autocomplete,exceptionListItems:a,listType:m,osTypes:z,listId:A,listNamespaceType:D,exceptionItemName:e,indexPatterns:l,isOrDisabled:B,isAndDisabled:B,isNestedDisabled:B,dataTestSubj:"alertExceptionBuilder",idAria:"alertExceptionBuilder",onChange:N,isDisabled:B,allowCustomFieldOptions:!_,getExtendedFields:I}))},S=i.a.memo(j);S.displayName="ExceptionsConditions"},function(e,t,a){"use strict";a.d(t,"a",(function(){return f}));var n=a(40),i=a(50),r=a.n(i),s=a(2),o=a.n(s),l=a(41),c=a.n(l),u=a(5);const d=u.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.expireTime.expireTimeLabel",{defaultMessage:"Exception will expire at"}),p=u.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.expireTime.exceptionExpireTime",{defaultMessage:"Exception Expiration"}),m=u.i18n.translate("xpack.securitySolution.rule_exceptions.flyoutComponents.expireTime.exceptionExpireTimeError",{defaultMessage:"Selected date and time must be in the future."}),b=c()(n.EuiTitle).withConfig({displayName:"SectionHeader",componentId:"sc-1t4zrw1-0"})(["",""],(()=>Object(l.css)(["font-weight:",";"],(({theme:e})=>e.eui.euiFontWeightSemiBold)))),g=({expireTime:e,setExpireTime:t,setExpireError:a})=>{const[i,l]=Object(s.useState)(e),[c,u]=Object(s.useState)(!1),[g,f]=Object(s.useState)([]),y=Object(s.useCallback)((e=>{l(null!=e?e:void 0),t(null!=e?e:void 0),null!=e&&e.isBefore()?(u(!0),f([m]),a(!0)):(u(!1),f([]),a(!1))}),[l,t,a]);return o.a.createElement("div",null,o.a.createElement(b,{size:"xs"},o.a.createElement("h3",null,p)),o.a.createElement(n.EuiSpacer,{size:"s"}),o.a.createElement(n.EuiFormRow,{error:g,isInvalid:c,label:d},o.a.createElement(n.EuiDatePicker,{showTimeSelect:!0,selected:i,isInvalid:c,onChange:y,onClear:()=>y(null),minDate:r()()})))},f=o.a.memo(g);f.displayName="ExceptionsExpireTime"},function(e,t,a){"use strict";a.d(t,"a",(function(){return m})),a.d(t,"b",(function(){return g}));var n=a(5),i=a(125),r=a(40),s=a(2),o=a.n(s),l=a(137);const c=o.a.createElement(r.EuiText,{color:"subdued",size:"xs"},l.Zb);var u=a(228),d=a(589);const{emptyField:p}=i.h,m={author:{type:i.a.COMBO_BOX,label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldAuthorLabel",{defaultMessage:"Author"}),helpText:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldAuthorHelpText",{defaultMessage:"Type one or more authors for this rule. Press enter after each author to add a new one."}),labelAppend:c,validations:[{validator:p(n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.authorFieldEmptyError",{defaultMessage:"An author must not be empty"})),type:i.g.ARRAY_ITEM,isBlocking:!1}]},name:{type:i.a.TEXT,label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldNameLabel",{defaultMessage:"Name"}),validations:[{validator:p(n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.nameFieldRequiredError",{defaultMessage:"A name is required."}))}]},description:{type:i.a.TEXTAREA,label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldDescriptionLabel",{defaultMessage:"Description"}),validations:[{validator:p(n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.descriptionFieldRequiredError",{defaultMessage:"A description is required."}))}]},isBuildingBlock:{type:i.a.CHECKBOX,label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldBuildingBlockLabel",{defaultMessage:'Mark all generated alerts as "building block" alerts'}),labelAppend:c},isAssociatedToEndpointList:{type:i.a.CHECKBOX,label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldAssociatedToEndpointListLabel",{defaultMessage:"Add existing Endpoint exceptions to the rule"}),labelAppend:c},severity:{value:{},mapping:{},isMappingChecked:{}},riskScore:{value:{},mapping:{},isMappingChecked:{}},references:{label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldReferenceUrlsLabel",{defaultMessage:"Reference URLs"}),labelAppend:c,validations:[{validator:(...e)=>{const[{value:t,path:a}]=e;let n=!1;return t.forEach((e=>{Object(u.c)(e)&&(n=!0)})),n?{code:"ERR_FIELD_FORMAT",path:a,message:d.k}:void 0}}]},falsePositives:{label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldFalsePositiveLabel",{defaultMessage:"False positive examples"}),labelAppend:c},investigationFields:{type:i.a.COMBO_BOX,label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldCustomHighlightedFieldsLabel",{defaultMessage:"Custom highlighted fields"}),labelAppend:c},license:{type:i.a.TEXT,label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldLicenseLabel",{defaultMessage:"License"}),helpText:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldLicenseHelpText",{defaultMessage:"Add a license name"}),labelAppend:c},ruleNameOverride:{type:i.a.TEXT,label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldRuleNameOverrideLabel",{defaultMessage:"Rule name override"}),helpText:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldRuleNameOverrideHelpText",{defaultMessage:"Choose a field from the source event to populate the rule name in the alert list."}),labelAppend:c},threat:{label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldMitreThreatLabel",{defaultMessage:"MITRE ATT&CK\\u2122"}),labelAppend:c},threatIndicatorPath:{type:i.a.TEXT,label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldThreatIndicatorPathLabel",{defaultMessage:"Indicator prefix override"}),helpText:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldThreatIndicatorPathHelpText",{defaultMessage:"Specify the document prefix containing your indicator fields. Used for enrichment of indicator match alerts."}),labelAppend:c},timestampOverride:{type:i.a.TEXT,label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldTimestampOverrideLabel",{defaultMessage:"Timestamp override"}),helpText:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldTimestampOverrideHelpText",{defaultMessage:"Choose timestamp field used when executing rule. Pick field with timestamp closest to ingest time (e.g. event.ingested)."}),labelAppend:c},timestampOverrideFallbackDisabled:{type:i.a.CHECKBOX,defaultValue:!1,label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldTimestampOverrideFallbackDisabledLabel",{defaultMessage:"Do not use @timestamp as a fallback timestamp field"}),labelAppend:c},tags:{type:i.a.COMBO_BOX,label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldTagsLabel",{defaultMessage:"Tags"}),helpText:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldTagsHelpText",{defaultMessage:"Type one or more custom identifying tags for this rule. Press enter after each tag to begin a new one."}),labelAppend:c,validations:[{validator:p(n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.tagFieldEmptyError",{defaultMessage:"A tag must not be empty"})),type:i.g.ARRAY_ITEM,isBlocking:!1}]},note:{type:i.a.TEXTAREA,label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.guideLabel",{defaultMessage:"Investigation guide"}),helpText:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.guideHelpText",{defaultMessage:"Provide helpful information for analysts that are investigating detection alerts. This guide will appear on the rule details page and in timelines (as notes) created from detection alerts generated by this rule."}),labelAppend:c}},b={type:i.a.TEXT,label:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldThreatIndicatorPathLabel",{defaultMessage:"Indicator prefix override"}),helpText:n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.fieldThreatIndicatorPathHelpText",{defaultMessage:"Specify the document prefix containing your indicator fields. Used for enrichment of indicator match alerts."}),validations:[{validator:p(n.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepAboutRule.threatIndicatorPathFieldEmptyError",{defaultMessage:"Indicator prefix override must not be empty"})),type:i.g.FIELD}]},g={...m,threatIndicatorPath:b}},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a.n(n),r=a(40),s=a(125);const o=a(5).i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepDefineRule.multiSelectFields.placeholderText",{defaultMessage:"Select a field"}),l=({browserFields:e,disabledText:t,isDisabled:a,field:l,fullWidth:c=!1})=>{const u=Object(n.useMemo)((()=>({fullWidth:!0,noSuggestions:!1,options:e.map((e=>({label:e.name}))),placeholder:o,onCreateOption:void 0,...c?{}:{style:{width:"410px"}},isDisabled:a})),[e,a,c]),d=i.a.createElement(s.b,{field:l,idAria:"detectionEngineMultiSelectAutocompleteField",euiFieldProps:u});return a?i.a.createElement(r.EuiToolTip,{position:"right",content:t},d):d},c=i.a.memo(l)},function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(2),i=a.n(n),r=a(102),s=a(40);const o=({url:e,children:t,ariaLabel:a})=>t?i.a.createElement(s.EuiToolTip,{content:e,position:"top","data-test-subj":"externalLinkTooltip"},i.a.createElement(s.EuiLink,{href:e,"aria-label":a,external:!0,target:"_blank",rel:"noopener","data-test-subj":"externalLink"},t)):null;var l=a(854);const c=({guidePath:e="security",docPath:t,linkText:a})=>{const{services:n}=Object(r.j)(),{ELASTIC_WEBSITE_URL:s,DOC_LINK_VERSION:c}=n.docLinks,u=`${s}guide/en/${e}/${c}/${t}`,d=`${a} - ${l.a}`;return i.a.createElement(o,{url:u,ariaLabel:d},a)},u=Object(n.memo)(c)},function(e,t,a){"use strict";a.d(t,"g",(function(){return I})),a.d(t,"d",(function(){return C})),a.d(t,"m",(function(){return M})),a.d(t,"p",(function(){return _})),a.d(t,"e",(function(){return F})),a.d(t,"l",(function(){return A})),a.d(t,"k",(function(){return P})),a.d(t,"i",(function(){return R})),a.d(t,"q",(function(){return B})),a.d(t,"f",(function(){return q})),a.d(t,"j",(function(){return z})),a.d(t,"o",(function(){return $})),a.d(t,"n",(function(){return V})),a.d(t,"h",(function(){return H})),a.d(t,"a",(function(){return G})),a.d(t,"c",(function(){return Q})),a.d(t,"b",(function(){return W}));var n=a(41),i=a.n(n),r=a(40),s=a(129),o=a(374),l=a(42),c=a(2),u=a.n(c),d=a(751),p=a(72),m=a(522),b=a(145),g=a(810),f=a(811),y=a(415),h=a(329),v=a(213),E=a(117),x=a(1094),j=a(207);const S=({label:e,license:t})=>u.a.createElement(u.a.Fragment,null,e,u.a.createElement(r.EuiBetaBadge,{label:y.e,style:{verticalAlign:"middle",marginLeft:"8px"},size:"s"}),!t.isAtLeast(j.ab)&&u.a.createElement(r.EuiToolTip,{position:"top",content:y.b},u.a.createElement(r.EuiIcon,{type:"warning",size:"l",color:"#BD271E",style:{marginLeft:"8px"}}))),k=i()(r.EuiFlexItem).withConfig({displayName:"NoteDescriptionContainer",componentId:"sc-1i3nngy-0"})(["height:105px;overflow-y:hidden;"]),O=e=>!Object(l.isEmpty)(e.join("")),w=i()(r.EuiBadge).withConfig({displayName:"EuiBadgeWrap",componentId:"sc-1i3nngy-1"})([".euiBadge__text{white-space:pre-wrap !important;}"]),T=i.a.div.withConfig({displayName:"Query",componentId:"sc-1i3nngy-2"})(["white-space:pre-wrap;"]),I=({field:e,filters:t,filterManager:a,query:n,savedId:i,savedQueryName:s,indexPatterns:o,queryLabel:c})=>{let d=[];const m=!Object(l.isEmpty)(i)&&!Object(l.isEmpty)(s);return m&&(d=[...d,{title:u.a.createElement(u.a.Fragment,null,y.s," "),description:u.a.createElement(u.a.Fragment,null,s," ")}]),Object(l.isEmpty)(t)||(a.setFilters(t),d=[...d,{title:u.a.createElement(u.a.Fragment,null,m?y.q:y.l," "),description:u.a.createElement(r.EuiFlexGroup,{wrap:!0,responsive:!1,gutterSize:"xs"},a.getFilters().map(((t,a)=>u.a.createElement(K,{grow:!1,key:`${e}-filter-${a}`},u.a.createElement(w,{color:"hollow"},null!=o?u.a.createElement(p.FilterBadgeGroup,{filters:[t],dataViews:[o]}):u.a.createElement(r.EuiLoadingSpinner,{size:"m"}))))))}]),Object(l.isEmpty)(n)||(d=[...d,{title:u.a.createElement(u.a.Fragment,null,m?y.r:null!=c?c:y.o),description:u.a.createElement(T,null,n)}]),d},C=e=>{let t=[];return Object(l.isEmpty)(e.eventCategoryField)||(t=[...t,{title:u.a.createElement(u.a.Fragment,null,y.h),description:u.a.createElement(u.a.Fragment,null,e.eventCategoryField)}]),Object(l.isEmpty)(e.tiebreakerField)||(t=[...t,{title:u.a.createElement(u.a.Fragment,null,y.i),description:u.a.createElement(u.a.Fragment,null,e.tiebreakerField)}]),Object(l.isEmpty)(e.timestampField)||(t=[...t,{title:u.a.createElement(u.a.Fragment,null,y.j),description:u.a.createElement(u.a.Fragment,null,e.timestampField)}]),t},M=({label:e,threat:t})=>t.length>0?[{title:e,description:u.a.createElement(x.a,{label:e,threat:t})}]:[],_=(e,t,a)=>O(a)?[{title:e,description:u.a.createElement(r.EuiText,{size:"s"},u.a.createElement("ul",null,a.map((e=>Object(l.isEmpty)(e)?null:u.a.createElement("li",{"data-test-subj":"unorderedListArrayDescriptionItem",key:`${t}-${e}`},e)))))}]:[],F=(e,t)=>{if(Object(l.isEmpty)(t))return[];const a=u.a.createElement(r.EuiFlexGroup,{responsive:!1,gutterSize:"xs",wrap:!0},t.map((t=>Object(l.isEmpty)(t)?null:u.a.createElement(r.EuiFlexItem,{grow:!1,key:`${e}-${t}`},u.a.createElement(w,{"data-test-subj":"customHighlightedFieldsStringArrayDescriptionBadgeItem",color:"hollow"},t)))));return[{title:e,description:a}]},A=(e,t,a)=>O(a)?[{title:e,description:u.a.createElement(r.EuiFlexGroup,{responsive:!1,gutterSize:"xs",wrap:!0},a.map((e=>Object(l.isEmpty)(e)?null:u.a.createElement(r.EuiFlexItem,{grow:!1,key:`${t}-${e}`},u.a.createElement(w,{"data-test-subj":"stringArrayDescriptionBadgeItem",color:"hollow"},e)))))}]:[],D=i()(r.EuiFlexItem).withConfig({displayName:"OverrideColumn",componentId:"sc-1i3nngy-3"})(["width:125px;max-width:125px;overflow:hidden;text-overflow:ellipsis;"]),N=i()(r.EuiFlexItem).withConfig({displayName:"OverrideValueColumn",componentId:"sc-1i3nngy-4"})(["width:30px;max-width:30px;overflow:hidden;text-overflow:ellipsis;"]),P=e=>[{title:g.a,description:u.a.createElement(h.a,{value:e.value})},...e.isMappingChecked?e.mapping.filter((e=>""!==e.field)).map(((e,t)=>({title:0===t?g.d:"",description:u.a.createElement(r.EuiFlexGroup,{alignItems:"center",gutterSize:"s"},u.a.createElement(D,null,u.a.createElement(r.EuiToolTip,{content:e.field,"data-test-subj":`severityOverrideField${t}`},u.a.createElement(u.a.Fragment,null,`${e.field}:`))),u.a.createElement(N,null,u.a.createElement(r.EuiToolTip,{content:e.value,"data-test-subj":`severityOverrideValue${t}`},Object(E.a)(e.value))),u.a.createElement(r.EuiFlexItem,{grow:!1},u.a.createElement(r.EuiIcon,{type:"sortRight"})),u.a.createElement(r.EuiFlexItem,null,u.a.createElement(h.a,{"data-test-subj":`severityOverrideSeverity${t}`,value:e.severity})))}))):[]],R=e=>[{title:f.b,description:e.value},...e.isMappingChecked?e.mapping.filter((e=>""!==e.field)).map(((e,t)=>({title:0===t?f.e:"",description:u.a.createElement(r.EuiFlexGroup,{alignItems:"center",gutterSize:"s"},u.a.createElement(D,null,u.a.createElement(r.EuiToolTip,{content:e.field,"data-test-subj":`riskScoreOverrideField${t}`},u.a.createElement(u.a.Fragment,null,e.field))),u.a.createElement(r.EuiFlexItem,{grow:!1},u.a.createElement(r.EuiIcon,{type:"sortRight"})),u.a.createElement(r.EuiFlexItem,null,s.q))}))):[]],L=i()(r.EuiLink).withConfig({displayName:"MyRefUrlLink",componentId:"sc-1i3nngy-5"})(["word-break:break-word;"]),B=(e,t)=>O(t)?[{title:e,description:u.a.createElement(r.EuiText,{size:"s"},u.a.createElement("ul",null,t.filter((e=>!Object(l.isEmpty)(e))).map(((e,t)=>u.a.createElement("li",{"data-test-subj":"urlsDescriptionReferenceLinkItem",key:`${t}-${e}`},u.a.createElement(L,{href:e,external:!0,target:"_blank"},e))))))}]:[],q=(e,t)=>""!==t.trim()?[{title:e,description:u.a.createElement(k,null,u.a.createElement("div",{"data-test-subj":"noteDescriptionItem",className:"eui-yScrollWithShadows"},t))}]:[],z=(e,t)=>{switch(t){case"machine_learning":return[{title:e,description:y.m}];case"query":case"saved_query":return[{title:e,description:y.p}];case"threshold":return[{title:e,description:y.x}];case"eql":return[{title:e,description:y.k}];case"threat_match":return[{title:e,description:y.t}];case"new_terms":return[{title:e,description:y.n}];default:return Object(b.a)(t)}},$=(e,t)=>[{title:e,description:u.a.createElement(u.a.Fragment,null,Object(l.isEmpty)(t.field[0])?`${y.w} >= ${t.value}`:`${y.v} ${Array.isArray(t.field)?t.field.join(","):t.field} >= ${t.value}`)}],V=(e,t)=>[{title:e,description:t.reduce(((e,t,a,{length:n})=>{const i=t.entries.reduce(((e,t,a,{length:n})=>1===n?`${t.field} ${m.d} ${t.value}`:0===a?`(${t.field} ${m.d} ${t.value})`:`${e} ${m.a} (${t.field} ${m.d} ${t.value})`),"");return 1===n?`${i}`:0===a?`(${i})`:`${e} ${m.e} (${i})`}),"")}],U=i()(r.EuiText).withConfig({displayName:"FieldTypeText",componentId:"sc-1i3nngy-6"})(["font-size:",";font-family:",";display:inline;"],(({theme:e})=>e.eui.euiFontSizeXS),(({theme:e})=>e.eui.euiCodeFontFamily)),H=(e,t)=>Object(l.isEmpty)(t)?[]:[{title:e,description:u.a.createElement(r.EuiFlexGrid,{gutterSize:"s"},t.map(((e,a)=>u.a.createElement(r.EuiFlexItem,{grow:!1},u.a.createElement(r.EuiFlexGroup,{alignItems:"center",gutterSize:"xs"},u.a.createElement(r.EuiFlexItem,{grow:!1},u.a.createElement(d.a,{"data-test-subj":"field-type-icon",type:Object(o.c)(e.type),label:e.type})),u.a.createElement(r.EuiFlexItem,{grow:!1},u.a.createElement(U,{grow:!1,size:"s"},` ${e.name}${a+1!==t.length?", ":""}`)))))))}],G=(e,t,a)=>{if(Object(l.isEmpty)(t))return[];const n=u.a.createElement(r.EuiFlexGroup,{responsive:!1,gutterSize:"xs",wrap:!0},t.map((t=>Object(l.isEmpty)(t)?null:u.a.createElement(r.EuiFlexItem,{grow:!1,key:`${e}-${t}`},u.a.createElement(w,{"data-test-subj":"stringArrayDescriptionBadgeItem",color:"hollow"},t)))));return[{title:u.a.createElement(S,{label:e,license:a}),description:n}]},Q=(e,t,a,n)=>{const i=n===v.b.PerTimePeriod?`${t.value}${t.unit}`:y.c;return[{title:u.a.createElement(S,{label:e,license:a}),description:i}]},W=(e,t,a)=>{if(Object(l.isEmpty)(t))return[];const n=t===j.b.Suppress?y.d:y.a;return[{title:u.a.createElement(S,{label:e,license:a}),description:n}]};var K=i()(r.EuiFlexItem).withConfig({displayName:"_StyledEuiFlexItem",componentId:"sc-1i3nngy-7"})({width:"100%"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(40),i=a(2),r=a.n(i),s=a(553),o=a(5);const l=o.i18n.translate("xpack.elasticAssistant.dataAnonymizationEditor.stats.allowedStat.allowedDescription",{defaultMessage:"Allowed"});var c=a(21);const u=({allowed:e,total:t})=>{const a=Object(i.useMemo)((()=>(({allowed:e,total:t})=>o.i18n.translate("xpack.elasticAssistant.dataAnonymizationEditor.stats.allowedStat.allowedTooltip",{values:{allowed:e,total:t},defaultMessage:"{allowed} of {total} fields in this context are allowed to be included in the conversation"}))({allowed:e,total:t})),[e,t]);return Object(c.jsx)(n.EuiToolTip,{content:a},Object(c.jsx)(n.EuiStat,{"data-test-subj":"allowedStat",description:l,reverse:!0,title:e,titleSize:s.a}))};u.displayName="AllowedStatComponent";const d=r.a.memo(u)},function(e,t,a){"use strict";a.d(t,"a",(function(){return j}));var n=a(21),i=a(40),r=a(2),s=a.n(r),o=a(48),l=a(41),c=a.n(l),u=a(42),d=a(555);const p=c.a.strong`
  margin-right: ${({theme:e})=>e.eui.euiSizeS};
`;var m={name:"16fopk3",styles:"overflow:hidden;&:hover{cursor:pointer;text-decoration:underline;}"};var b=a(136),g=a(306),f=a(372),y=a(357);const h="ADD_NEW_SYSTEM_PROMPT";var v={name:"1bxycju",styles:"min-width:100%"},E={name:"qhxz92",styles:"max-width:100%"};const x=({allSystemPrompts:e,compressed:t=!1,conversation:a,selectedPrompt:l,clearSelectedSystemPrompt:c,isClearable:x=!1,isEditing:j=!1,isDisabled:S=!1,isOpen:k=!1,isSettingsModalVisible:O,onSystemPromptSelectionChange:w,setIsEditing:T,setIsSettingsModalVisible:I,showTitles:C=!1})=>{var M;const{setSelectedSettingsTab:_}=Object(b.b)(),{setApiConfig:F}=Object(g.a)(),[A,D]=Object(r.useState)(k),N=Object(r.useCallback)((()=>D(!1)),[]),P=Object(r.useCallback)((e=>{a&&F({conversationId:a.id,apiConfig:{...a.apiConfig,defaultSystemPromptId:null==e?void 0:e.id}})}),[a,F]),R=Object(r.useMemo)((()=>({value:h,inputDisplay:d.a,dropdownDisplay:Object(n.jsx)(i.EuiFlexGroup,{gutterSize:"none",key:h},Object(n.jsx)(i.EuiFlexItem,{grow:!0},Object(n.jsx)(i.EuiButtonEmpty,{iconType:"plus",size:"xs","data-test-subj":"addSystemPrompt"},d.a)),Object(n.jsx)(i.EuiFlexItem,{grow:!1},Object(n.jsx)("div",{style:{width:"24px"}})))})),[]),L=Object(r.useMemo)((()=>(({prompts:e,showTitles:t=!1})=>{var a;return null!==(a=null==e?void 0:e.map((e=>(({content:e,id:t,name:a,showTitles:r=!1})=>({value:t,inputDisplay:Object(n.jsx)(i.EuiText,{color:"subdued","data-test-subj":"systemPromptText",css:m},r?a:e),dropdownDisplay:Object(n.jsx)(s.a.Fragment,null,Object(n.jsx)(p,{"data-test-subj":"name"},a),Object(n.jsx)(i.EuiToolTip,{content:void 0},Object(n.jsx)(i.EuiText,{color:"subdued","data-test-subj":"content",size:"s"},Object(u.isEmpty)(e)?Object(n.jsx)("p",null,d.d):Object(n.jsx)("p",null,e))))}))({...e,showTitles:t}))))&&void 0!==a?a:[]})({prompts:e,showTitles:C})),[e,C]),B=Object(r.useCallback)((t=>{if(t===h)return I(!0),void _(f.d);null!=w?w(t):P(e.find((e=>e.id===t))),null==T||T(!1)}),[e,w,T,I,_,P]),q=Object(r.useCallback)((()=>{P(void 0),null==T||T(!1),null==c||c()}),[c,T,P]),z=Object(r.useCallback)((()=>{null==T||T(!0),D(!0)}),[T]);return Object(n.jsx)(i.EuiFlexGroup,{"data-test-subj":"selectSystemPrompt",gutterSize:"none"},Object(n.jsx)(i.EuiFlexItem,{css:E},j&&Object(n.jsx)(i.EuiFormRow,{css:v},Object(n.jsx)(i.EuiSuperSelect,{popoverProps:{zIndex:o.euiThemeVars.euiZLevel8},compressed:t,"data-test-subj":y.a.PROMPT_SUPERSELECT,fullWidth:!0,hasDividers:!0,itemLayoutAlign:"top",disabled:S,isOpen:A&&!O,onChange:B,onBlur:N,options:[...L,R],placeholder:d.e,valueOfSelected:null!==(M=null==l?void 0:l.id)&&void 0!==M?M:e[0].id}))),Object(n.jsx)(i.EuiFlexItem,{grow:!1},j&&x&&Object(n.jsx)(i.EuiToolTip,{content:d.c},Object(n.jsx)(i.EuiButtonIcon,{"aria-label":d.c,"data-test-subj":"clearSystemPrompt",iconType:"cross",onClick:q})),!j&&Object(n.jsx)(i.EuiToolTip,{content:d.b},Object(n.jsx)(i.EuiButtonIcon,{"aria-label":d.b,"data-test-subj":"addSystemPrompt",iconType:"plus",onClick:z}))))};x.displayName="SelectSystemPromptComponent";const j=s.a.memo(x)},function(e,t,a){"use strict";a.d(t,"b",(function(){return F})),a.d(t,"a",(function(){return L}));var n=a(42),i=a(40),r=a(44),s=a(2),o=a.n(s),l=a(41),c=a.n(l),u=a(103),d=a(46),p=a(117),m=a(383),b=a(111),g=a(179),f=a(346),y=a(5);const h=y.i18n.translate("xpack.securitySolution.timeline.toggleEventDetailsTitle",{defaultMessage:"Expand event details"}),v=y.i18n.translate("xpack.securitySolution.timeline.addedANoteLabel",{defaultMessage:"added a note"}),E=y.i18n.translate("xpack.securitySolution.timeline.addedADescriptionLabel",{defaultMessage:"added description"}),x=y.i18n.translate("xpack.securitySolution.timeline.anUnknownUserLabel",{defaultMessage:"an unknown user"}),j=y.i18n.translate("xpack.securitySolution.timeline.deleteNoteLabel",{defaultMessage:"Delete Note"}),S=y.i18n.translate("xpack.securitySolution.timeline.cancelDeleteNoteLabel",{defaultMessage:"Keep Note"}),k=y.i18n.translate("xpack.securitySolution.timeline.promptDeleteNoteLabel",{defaultMessage:"Delete timeline note?"});var O=a(118),w=a(105),T=a(657),I=a(110),C=a(116),M=a(102),_=a(108);const F=c.a.section.withConfig({displayName:"NotePreviewsContainer",componentId:"sc-16ieedj-0"})(["padding-top:",";"],(({theme:e})=>`${e.eui.euiSizeS}`));F.displayName="NotePreviewsContainer";const A=({eventId:e,timelineId:t})=>{const a=Object(u.useDispatch)(),{selectedPatterns:n}=Object(C.d)(I.SourcererScopeName.timeline),r=Object(s.useCallback)((()=>{a(b.a.toggleDetailPanel({panelView:"eventDetail",tabType:O.d.notes,id:t,params:{eventId:e,indexName:n.join(",")}}))}),[a,e,n,t]);return o.a.createElement(i.EuiButtonIcon,{title:h,"aria-label":h,color:"text",iconType:"arrowRight",onClick:r})},D=o.a.memo(A),N=o.a.memo((({closeModal:e,confirmModal:t})=>o.a.createElement(i.EuiConfirmModal,{title:k,onCancel:e,onConfirm:t,cancelButtonText:S,confirmButtonText:j,buttonColor:"danger",defaultFocusedButton:"confirm"})));N.displayName="DeleteNoteConfirm";const P=o.a.memo((({noteId:e})=>{const[t,a]=Object(s.useState)(null),{mutate:n,isLoading:r}=function(e){const{services:{http:t}}=Object(M.j)(),a=Object(u.useDispatch)(),{addError:n}=Object(_.a)();return Object(d.useMutation)({mutationFn:e=>t.fetch("/api/note",{method:"DELETE",body:JSON.stringify({noteId:e})}),onSuccess:()=>{e&&a(g.a.deleteNote({id:e}))},onError:e=>{var t;n(e,{title:(t=e,y.i18n.translate("xpack.securitySolution.timeline.deleteNoteError",{defaultMessage:"An error occurred deleting note {error}",values:{error:t}}))})}})}(e),l=Object(s.useCallback)((async()=>{a(e)}),[e]),c=Object(s.useCallback)((()=>{a(null)}),[]),p=Object(s.useCallback)((()=>{n(e),a(null)}),[n,e]),m=Object(s.useMemo)((()=>r||null==e),[r,e]);return o.a.createElement(o.a.Fragment,null,o.a.createElement(i.EuiButtonIcon,{title:j,"aria-label":j,"data-test-subj":"delete-note",color:"text",iconType:"trash",onClick:l,disabled:m}),null!=t&&o.a.createElement(N,{closeModal:c,confirmModal:p}))}));P.displayName="DeleteNoteButton";const R=o.a.memo((({eventId:e,timelineId:t,noteId:a})=>e&&t?o.a.createElement(o.a.Fragment,null,o.a.createElement(D,{eventId:e,timelineId:t}),o.a.createElement(P,{noteId:a})):o.a.createElement(P,{noteId:a})));R.displayName="NoteActions";const L=o.a.memo((({eventIdToNoteIds:e,notes:t,timelineId:a,showTimelineDescription:l})=>{const c=Object(s.useMemo)((()=>b.b.getTimelineByIdSelector()),[]),u=Object(w.a)((e=>a?c(e,a):null)),d=Object(s.useMemo)((()=>l&&a&&null!=u&&u.description?[{username:Object(p.a)(u.updatedBy),event:E,"data-test-subj":"note-preview-description",id:"note-preview-description",timestamp:u.updated?o.a.createElement(r.FormattedRelative,{"data-test-subj":"updated",value:new Date(u.updated)}):Object(p.e)(),children:o.a.createElement(i.EuiText,{size:"s"},u.description),timelineAvatar:o.a.createElement(i.EuiAvatar,{"data-test-subj":"avatar",name:null!=u.updatedBy?u.updatedBy:"?",size:"l"}),actions:o.a.createElement(T.a,{timelineId:a,initialFocus:"description"})}]:[]),[u,a,l]),g=Object(s.useMemo)((()=>Object(n.uniqBy)("savedObjectId",t).map((t=>{var n,s,l;const c=null!=e?Object.entries(e).reduce(((e,[a,n])=>{var i;return n.includes(null!==(i=t.noteId)&&void 0!==i?i:"")?a:e}),null):null!==(n=t.eventId)&&void 0!==n?n:null;return{"data-test-subj":`note-preview-${t.savedObjectId}`,username:Object(p.a)(t.updatedBy),event:v,timestamp:t.updated?o.a.createElement(r.FormattedRelative,{"data-test-subj":"updated",value:new Date(t.updated)}):Object(p.e)(),children:o.a.createElement("div",{className:f.a,tabIndex:0},o.a.createElement(i.EuiScreenReaderOnly,{"data-test-subj":"screenReaderOnlyUserAddedANote"},o.a.createElement("p",null,`${null!==(s=t.updatedBy)&&void 0!==s?s:x} ${v}`)),o.a.createElement(m.b,null,null!==(l=t.note)&&void 0!==l?l:"")),actions:o.a.createElement(R,{eventId:c,timelineId:a,noteId:t.savedObjectId}),timelineAvatar:o.a.createElement(i.EuiAvatar,{"data-test-subj":"avatar",name:null!=t.updatedBy?t.updatedBy:"?",size:"l"})}}))),[e,t,a]);return o.a.createElement(i.EuiCommentList,{"data-test-subj":"note-comment-list",comments:[...d,...g]})}));L.displayName="NotePreviews"},function(e,t,a){"use strict";a.d(t,"a",(function(){return r})),a.d(t,"b",(function(){return s}));var n=a(120);const i=["endpoint_list"],r=e=>!!i.find((t=>t===e.list_id)),s=e=>n.o.is(e)},function(e,t,a){"use strict";a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return s}));var n=a(42),i=a(2);const r={pageName:a(131).a.noPage,detailName:void 0,tabName:void 0,search:"",pathName:"/",state:void 0},s=Object(i.createContext)([r,()=>n.noop])},,,function(e,t,a){var n=a(1006),i=a(1010),r=a(614),s=a(258),o=a(1016);e.exports=function(e){return"function"==typeof e?e:null==e?r:"object"==typeof e?s(e)?i(e[0],e[1]):n(e):o(e)}},function(e,t,a){e.exports=a(33)(1215)},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(40),i=a(2),r=a.n(i),s=a(558),o=a(135),l=a(337),c=a(122),u=a(105);const d=r.a.memo((({eventId:e,contextId:t,enrichedFieldInfo:a,scopeId:d,handleOnEventClosed:p})=>{const[m,b]=Object(i.useState)(!1),g=Object(i.useCallback)((()=>b(!m)),[m]),f=Object(i.useCallback)((()=>b(!1)),[]),y=Object(i.useCallback)((()=>{f(),p()}),[f,p]),h=Object(i.useMemo)((()=>c.d.globalQuery()),[]),v=Object(u.a)(h),E=Object(i.useCallback)((()=>{v.forEach((e=>e.refetch&&e.refetch()))}),[v]),{actionItems:x}=Object(s.a)({closePopover:y,eventId:e,scopeId:d,alertStatus:a.values[0],refetch:E}),j=Object(i.useMemo)((()=>[{id:0,items:x}]),[x]),S=Object(i.useMemo)((()=>x.length>0),[x]),k=Object(i.useMemo)((()=>r.a.createElement(l.a,{contextId:t,eventId:e,value:a.values[0],fieldName:a.data.field,linkValue:a.linkValue,fieldType:a.data.type,fieldFormat:a.data.format,isDraggable:!1,truncate:!1,isButton:S,onClick:S?g:void 0,onClickAriaLabel:o.x})),[t,e,a,g,S]);return S?r.a.createElement(n.EuiPopover,{button:k,isOpen:m,closePopover:f,panelPaddingSize:"none","data-test-subj":"alertStatus"},r.a.createElement(n.EuiPopoverTitle,{paddingSize:"m"},o.w),r.a.createElement(n.EuiContextMenu,{panels:j,initialPanelId:0,"data-test-subj":"event-details-alertStatusPopover"})):k}));d.displayName="StatusPopoverButton"},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(40),i=a(44),r=a(50),s=a.n(r),o=a(2),l=a.n(o);const c=l.a.memo((({children:e,date:t,fieldName:a,className:r=""})=>l.a.createElement(n.EuiToolTip,{"data-test-subj":"localized-date-tool-tip",anchorClassName:r,content:l.a.createElement(n.EuiFlexGroup,{"data-test-subj":"dates-container",direction:"column",gutterSize:"none"},null!=a?l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement("span",{"data-test-subj":"field-name"},a)):null,l.a.createElement(n.EuiFlexItem,{grow:!1},l.a.createElement(i.FormattedRelative,{"data-test-subj":"humanized-relative-date",value:s.a.utc(t).toDate()})),l.a.createElement(n.EuiFlexItem,{"data-test-subj":"with-day-of-week",grow:!1},s.a.utc(t).local().format("llll")),l.a.createElement(n.EuiFlexItem,{"data-test-subj":"with-time-zone-offset-in-hours",grow:!1},s()(t).format()))},l.a.createElement(l.a.Fragment,null,e))));c.displayName="LocalizedDateTooltip"},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(5);const i="siem";n.i18n.translate("xpack.securitySolution.guideConfig.title",{defaultMessage:"Detect threats in my data with SIEM"}),n.i18n.translate("xpack.securitySolution.guideConfig.description",{defaultMessage:"There are many ways to get your SIEM data into Elastic. In this guide, we'll help you get set up quickly using the Elastic Defend integration."}),n.i18n.translate("xpack.securitySolution.guideConfig.documentationLink",{defaultMessage:"Learn more"}),n.i18n.translate("xpack.securitySolution.guideConfig.addDataStep.title",{defaultMessage:"Add data with Elastic Defend"}),n.i18n.translate("xpack.securitySolution.guideConfig.addDataStep.description",{defaultMessage:"Install Elastic Agent and its Elastic Defend integration on one of your computers to get SIEM data flowing."}),n.i18n.translate("xpack.securitySolution.guideConfig.addDataStep.description.linkText",{defaultMessage:"Learn more"}),n.i18n.translate("xpack.securitySolution.guideConfig.rulesStep.title",{defaultMessage:"Turn on rules"}),n.i18n.translate("xpack.securitySolution.guideConfig.rulesStep.description",{defaultMessage:"Load the Elastic prebuilt rules, select the rules you want, and enable them to generate alerts."}),n.i18n.translate("xpack.securitySolution.guideConfig.rulesStep.manualCompletion.title",{defaultMessage:"Continue with the guide"}),n.i18n.translate("xpack.securitySolution.guideConfig.rulesStep.manualCompletion.description",{defaultMessage:"After you've enabled the rules you need, continue."}),n.i18n.translate("xpack.securitySolution.guideConfig.alertsStep.title",{defaultMessage:"Manage alerts and cases"}),n.i18n.translate("xpack.securitySolution.guideConfig.alertsStep.description",{defaultMessage:"Learn how to view and triage alerts with cases."}),n.i18n.translate("xpack.securitySolution.guideConfig.alertsStep.manualCompletion.title",{defaultMessage:"Continue the guide"}),n.i18n.translate("xpack.securitySolution.guideConfig.alertsStep.manualCompletion.description",{defaultMessage:"After you've explored the case, continue."})},function(e,t,a){"use strict";a.d(t,"a",(function(){return x})),a.d(t,"b",(function(){return j}));var n=a(42),i=a(2),r=a.n(i),s=a(103),o=a(3),l=a(130),c=a.n(l),u=a(49),d=a(114),p=a(116),m=a(110),b=a(161),g=a(495),f=a(673),y=a(148),h=a(111);const v="timeline-filter-drop-area",E=(e=[])=>e.filter((e=>e.meta.controlledBy!==v)),x=Object(i.memo)((({dataProviders:e,filters:t,filterManager:a,filterQuery:n,from:l,fromStr:u,kqlMode:x,isRefreshPaused:S,savedQueryId:k,setFilters:O,setSavedQueryId:w,refreshInterval:T,timelineId:I,to:C,toStr:M,updateReduxTime:_})=>{const F=Object(s.useDispatch)(),[A,D]=Object(i.useState)(null!=u?u:new Date(l).toISOString()),[N,P]=Object(i.useState)(null!=M?M:new Date(C).toISOString()),{browserFields:R,indexPattern:L}=Object(p.d)(m.SourcererScopeName.timeline),[B,q]=Object(i.useState)(void 0),[z,$]=Object(i.useState)({query:null!=n?n.expression:"",language:null!=n?n.kind:"kuery"}),[V,U]=Object(i.useState)(E(t)),[H,G]=Object(i.useState)(Object(b.f)(Object(y.g)(e,R),L)),Q=Object(g.a)(),W=Object(i.useCallback)(((e,t)=>F(h.a.applyKqlFilterQuery({id:I,filterQuery:{kuery:{kind:t,expression:e},serializedQuery:Object(b.f)(e,L)}}))),[F,L,I]);Object(i.useEffect)((()=>{let e=!0;const n=new o.Subscription;return a.setFilters(t),n.add(a.getUpdates$().subscribe({next:()=>{if(e){const e=E(a.getFilters());O(e),U(e)}}})),()=>{e=!1,n.unsubscribe()}}),[]),Object(i.useEffect)((()=>{const e=E(a.getFilters());c()(t,e)||a.setFilters(t)}),[t]),Object(i.useEffect)((()=>{$({query:null!=n?n.expression:"",language:null!=n?n.kind:"kuery"})}),[n]),Object(i.useEffect)((()=>{G(Object(b.f)(Object(y.g)(e,R),L))}),[e,R,L]),Object(i.useEffect)((()=>{null!=u&&null!=M?(D(u),P(M)):null!=l&&null!=C&&(D(new Date(l).toISOString()),P(new Date(C).toISOString()))}),[l,u,C,M]),Object(i.useEffect)((()=>{let e=!0;return async function(){if(null!=k&&null!=Q)try{const a=await Q.getSavedQuery(k);e&&null!=a&&q({...a,attributes:{...a.attributes,filters:E(t)}})}catch(e){q(void 0)}else e&&q(void 0)}(),()=>{e=!1}}),[k]);const K=Object(i.useCallback)(((e,t)=>{if((null==n||null!=n&&n.expression!==e.query||n.kind!==e.language)&&W(e.query,e.language),null!=t){const e=t.from.includes("now")||t.to.includes("now");_({id:d.a.timeline,end:t.to,start:t.from,isInvalid:!1,isQuickSelection:e,timelineId:I})}}),[n,I]),Y=Object(i.useCallback)((e=>{if(null!=e){if(e.id!==k&&w(e.id),null!=Q&&""!==H){const t=null!=e.attributes.filters?e.attributes.filters.findIndex((e=>e.meta.controlledBy===v)):-1;Q.updateQuery(e.id,{...e.attributes,filters:null!=e.attributes.filters?t>-1?[...e.attributes.filters.slice(0,t),j(H),...e.attributes.filters.slice(t+1)]:[...e.attributes.filters,j(H)]:[]})}}else w(null)}),[H,k,Q]);return r.a.createElement(f.a,{dateRangeFrom:A,dateRangeTo:N,hideSavedQuery:"search"===x,indexPattern:L,isRefreshPaused:S,filterQuery:z,filterManager:a,filters:V,onSubmitQuery:K,refreshInterval:T,savedQuery:B,onSavedQuery:Y,dataTestSubj:"timelineQueryInput",displayStyle:"inPage"})})),j=e=>{const t=JSON.parse(e),a=Object.keys(t);return{...t,meta:{alias:v,controlledBy:v,negate:!1,disabled:!1,type:"custom",key:Object(n.isEmpty)(a)?"bool":a[0],value:e},$state:{store:u.FilterStateStore.APP_STATE}}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(5);const i=e=>e?n.i18n.translate("xpack.securitySolution.toggleQuery.on",{defaultMessage:"Open"}):n.i18n.translate("xpack.securitySolution.toggleQuery.off",{defaultMessage:"Closed"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a.n(n),r=a(40),s=a(106),o=a(140),l=a(209);const c=({timelineType:e,elasticTemplateTimelineCount:t,customTemplateTimelineCount:a})=>{const[c,u]=Object(n.useState)(null),d=Object(n.useMemo)((()=>e===s.l.template),[e]),p=Object(n.useMemo)((()=>d?c:null),[c,d]),m=Object(n.useMemo)((()=>null==p?null:p===s.g.elastic?s.k.immutable:s.k.active),[p]),b=Object(n.useMemo)((()=>[{id:s.g.elastic,name:o.s,disabled:!d,withNext:!0,count:null!=t?t:void 0},{id:s.g.custom,name:o.r,disabled:!d,withNext:!1,count:null!=a?a:void 0}]),[a,t,d]),g=Object(n.useCallback)((e=>{u(c===e?null:e)}),[u,c]),f=Object(n.useMemo)((()=>d?b.map((e=>i.a.createElement(r.EuiFilterButton,{hasActiveFilters:e.id===p,key:`template-timeline-filter-${e.id}`,numFilters:e.count,onClick:g.bind(null,e.id),withNext:e.withNext,isDisabled:e.disabled,"data-test-subj":e.name},e.name))):null),[p,b,d,g]),y=Object(n.useCallback)((async()=>{p!==s.g.custom&&await Object(l.f)()}),[p]);return{timelineStatus:m,templateTimelineType:p,templateTimelineFilter:f,installPrepackagedTimelines:y}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a.n(n),r=a(118),s=a(106),o=a(242);const l=({closeGearMenu:e,outline:t,title:a,timelineId:n=r.c.active})=>{const{getButton:i}=Object(o.b)({timelineId:n,timelineType:s.l.template,closeGearMenu:e});return i({outline:t,title:a})},c=i.a.memo(l);c.displayName="NewTemplateTimeline"},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(2),i=a(606),r=a(102);const s=()=>{const{conversations:e}=Object(i.a)(),{services:{telemetry:t}}=Object(r.j)(),a=Object(n.useCallback)((t=>{var a;return(null!==(a=e[t])&&void 0!==a?a:{isDefault:!1}).isDefault?t:"Custom"}),[e]),s=Object(n.useCallback)((({fn:e,params:{conversationId:t,...n}})=>e({...n,conversationId:a(t)})),[a]);return{reportAssistantInvoked:e=>s({fn:t.reportAssistantInvoked,params:e}),reportAssistantMessageSent:e=>s({fn:t.reportAssistantMessageSent,params:e}),reportAssistantQuickPrompt:e=>s({fn:t.reportAssistantQuickPrompt,params:e})}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"d",(function(){return o})),a.d(t,"f",(function(){return l})),a.d(t,"e",(function(){return c}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.assistant.commentActions.addedNoteToTimelineToast",{defaultMessage:"Added note to timeline"}),r=n.i18n.translate("xpack.securitySolution.assistant.commentActions.addMessageContentAsTimelineNoteAriaLabel",{defaultMessage:"Add message content as a timeline note"}),s=n.i18n.translate("xpack.securitySolution.assistant.commentActions.addNoteToTimelineTooltip",{defaultMessage:"Add note to timeline"}),o=n.i18n.translate("xpack.securitySolution.assistant.commentActions.addToCaseExistingCase",{defaultMessage:"Add to existing case"}),l=n.i18n.translate("xpack.securitySolution.assistant.commentActions.elasticAiAssistantTitle",{defaultMessage:"Elastic AI Assistant"}),c=n.i18n.translate("xpack.securitySolution.assistant.commentActions.copyToClipboard",{defaultMessage:"Copy to clipboard"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return o})),a.d(t,"g",(function(){return l})),a.d(t,"e",(function(){return c})),a.d(t,"c",(function(){return u})),a.d(t,"b",(function(){return d})),a.d(t,"d",(function(){return p})),a.d(t,"f",(function(){return m}));var n=a(139),i=a(118),r=a(515),s=a(376);const o=()=>Object(n.createSelector)(s.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.activeTab)&&void 0!==t?t:i.d.query})),l=()=>Object(n.createSelector)(s.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.show)&&void 0!==t&&t})),c=()=>Object(n.createSelector)(s.selectTimeline,(e=>{var t;return Object.keys(null!==(t=null==e?void 0:e.pinnedEventIds)&&void 0!==t?t:{}).length})),u=()=>Object(n.createSelector)(s.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.noteIds)&&void 0!==t?t:[]})),d=()=>Object(n.createSelector)(s.selectTimeline,(e=>{var t;return null!==(t=null==e?void 0:e.eventIdToNoteIds)&&void 0!==t?t:{}})),p=()=>Object(n.createSelector)(r.selectNotesById,(e=>Object.values(e))),m=()=>Object(n.createSelector)(s.selectTimeline,(e=>null==e?void 0:e.scrollToTop))},function(e,t,a){"use strict";a.d(t,"a",(function(){return C}));var n=a(104),i=a.n(n),r=a(57),s=a(55),o=a.n(s),l=a(2),c=a.n(l),u=a(41),d=a.n(u),p=a(40),m=a(51),b=a(4),g=a(681),f=a(259),y=a(659),h=a(161),v=a(102),E=a(604),x=a(200),j=a(457),S=a(131),k=a(169),O=a(273);const w=e=>({text:e,value:e}),T=d()(p.EuiButton).withConfig({displayName:"StyledLinkButton",componentId:"sc-11itwu1-0"})(["margin-left:0;@media only screen and (min-width:","){margin-left:",";}"],(e=>e.theme.eui.euiBreakpoints.m),(({theme:e})=>e.eui.euiSizeL)),I=({combinedQueries:e,deleteQuery:t,filters:a,from:n,headerChildren:s,indexPattern:u,indexNames:d,runtimeMappings:p,onlyField:I,paddingSize:C,query:M,queryType:_,setAbsoluteRangeDatePickerTarget:F,setQuery:A,showLegend:D,showSpacer:N=!0,scopeId:P,sourcererScopeId:R,to:L,toggleTopN:B,hideQueryToggle:q=!1})=>{const z=Object(l.useMemo)((()=>`eventsByDatasetOverview-${_}`),[_]);Object(l.useEffect)((()=>()=>{t&&t({id:z})}),[t,z]);const $=Object(v.j)(),{formatUrl:V,search:U}=Object(k.m)(S.a.hosts),{navigateToApp:H}=$.services.application,[G]=Object(v.p)(b.O),Q=Object(l.useCallback)((e=>{e.preventDefault(),H(b.l,{deepLinkId:S.a.hosts,path:Object(f.c)(x.HostsTableType.events,U)})}),[H,U]),W=Object(l.useMemo)((()=>c.a.createElement(T,{onClick:Q,href:V(Object(f.c)(x.HostsTableType.events))},j.n)),[Q,V]),[K,Y]=Object(l.useMemo)((()=>null==e?Object(h.i)({config:Object(m.getEsQueryConfig)($.services.uiSettings),indexPattern:u,queries:[M],filters:a}):[e]),[e,$,u,M,a]);Object(O.a)({id:z,filterQuery:K,kqlError:Y,query:M,startDate:n,endDate:L});const J=Object(l.useMemo)((()=>{var e;return{...E.b,stackByOptions:null!=I?[w(I)]:E.b.stackByOptions,defaultStackByOption:null!=I?w(I):null!==(e=E.c.find((e=>"event.dataset"===e.text)))&&void 0!==e?e:E.c[0],legendPosition:r.Position.Right,subtitle:e=>`${g.c}: ${o()(e).format(G)} ${Object(g.d)(e)}`,titleSize:null==I?"m":"s"}}),[I,G]),X=Object(l.useMemo)((()=>null==I||null!=s?c.a.createElement(c.a.Fragment,null,s,null==I&&W):null),[I,s,W]);return c.a.createElement(y.a,i()({endDate:L,filterQuery:K,headerChildren:X,id:z,indexNames:d,runtimeMappings:p,onError:B,paddingSize:C,setAbsoluteRangeDatePickerTarget:F,setQuery:A,showSpacer:N,showLegend:D,skip:void 0===K,startDate:n,scopeId:P,sourcererScopeId:R},J,{title:null!=I?j.k(I):J.title,chartHeight:160,hideQueryToggle:q}))};I.displayName="EventsByDatasetComponent";const C=c.a.memo(I)},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(2),i=a.n(n),r=a(40),s=a(41),o=a.n(s),l=a(297),c=a(327);const u=o()(r.EuiFlexGroup).withConfig({displayName:"FlexGroup",componentId:"sc-1719m3x-0"})(["height:",";width:",";position:relative;margin:0;"],(({height:e})=>e||"100%"),(({width:e})=>e||"100%"));u.displayName="FlexGroup";const d=({height:e="100%",width:t="100%",data:a})=>i.a.createElement(u,{justifyContent:"center",alignItems:"center",height:e,width:t},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiText,{size:"s",textAlign:"center",color:"subdued","data-test-subj":"chartHolderText"},Object(l.f)(a)?c.a:c.b)))},function(e,t,a){"use strict";a.d(t,"f",(function(){return i})),a.d(t,"e",(function(){return r})),a.d(t,"g",(function(){return s})),a.d(t,"a",(function(){return o})),a.d(t,"b",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"h",(function(){return u})),a.d(t,"d",(function(){return d}));var n=a(5);const i=e=>n.i18n.translate("xpack.securitySolution.eventsTab.externalAlertsUnit",{values:{totalCount:e},defaultMessage:"external {totalCount, plural, =1 {alert} other {alerts}}"}),r=e=>n.i18n.translate("xpack.securitySolution.hosts.navigaton.eventsUnit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {event} other {events}}"}),s=n.i18n.translate("xpack.securitySolution.eventsTab.showing",{defaultMessage:"Showing"}),o=n.i18n.translate("xpack.securitySolution.eventsTab.alertsGraphTitle",{defaultMessage:"External alert trend"}),l=n.i18n.translate("xpack.securitySolution.eventsTab.errorFetchingAlertsData",{defaultMessage:"Failed to query alerts data"}),c=n.i18n.translate("xpack.securitySolution.eventsTab.errorFetchingEventsData",{defaultMessage:"Failed to query events data"}),u=n.i18n.translate("xpack.securitySolution.eventsTab.showExternalAlerts",{defaultMessage:"Show only external alerts"}),d=n.i18n.translate("xpack.securitySolution.eventsGraphTitle",{defaultMessage:"Events"})},function(e,t,a){"use strict";a.d(t,"c",(function(){return l})),a.d(t,"d",(function(){return c})),a.d(t,"f",(function(){return u})),a.d(t,"e",(function(){return d})),a.d(t,"a",(function(){return p})),a.d(t,"b",(function(){return m}));var n=a(42),i=a(50),r=a.n(i),s=a(920);const o=[],l=e=>{var t,a,n;return(null!==(t=null==e||null===(a=e.aggregations)||void 0===a||null===(n=a.alertsByGrouping)||void 0===n?void 0:n.buckets)&&void 0!==t?t:[]).reduce(((e,{key_as_string:t,key:a,alerts:n})=>{var i;return[...e,...(null!==(i=n.buckets)&&void 0!==i?i:[]).map((({key:e,doc_count:n})=>({x:e,y:n,g:null!=t?t:a.toString()})))]}),o)},c=(e,t,a,n,i)=>({aggs:{alertsByGrouping:{terms:{field:e,order:{_count:"desc"},size:10},aggs:{alerts:{date_histogram:{field:"@timestamp",fixed_interval:`${Math.floor(r()(a).diff(r()(t))/32)}ms`,min_doc_count:0,extended_bounds:{min:t,max:a}}}}}},query:{bool:{filter:[...n,{range:{"@timestamp":{gte:t,lte:a}}}]}},runtime_mappings:i,_source:!1,size:0}),u=({isInitialLoading:e,isLoadingAlerts:t})=>e&&t,d=e=>{try{return null==e||Object(n.isEmpty)(e)?{}:JSON.parse(e)}catch{return{}}},p=e=>{try{return Object(n.isEmpty)(e)?[]:[d(e)]}catch{return[]}},m=({callback:e,order:t}={})=>({id:"resetGroupByField",getDisplayName:()=>s.b,getIconType:()=>"editorRedo",type:"actionButton",isCompatible:async()=>!0,async execute({embeddable:t}){null==e||e();const a=t.getInput(),{attributes:{state:{visualization:{columns:n}}}}=a;t.updateInput({...a,attributes:{...a.attributes,state:{...a.attributes.state,visualization:{...a.attributes.state.visualization,columns:n.map((e=>({...e,hidden:!1})))}}}})},order:t})},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.components.chartSettingsPopover.contextMenuItems.inspectTitle",{defaultMessage:"Inspect"}),r=n.i18n.translate("xpack.securitySolution.components.chartSettingsPopover.contextMenuItems.resetGroupByFieldsMenuItem",{defaultMessage:"Reset group by fields"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(374);const i=new Set([n.b.STRING,n.b.BOOLEAN,n.b.NUMBER,n.b.IP]),r=e=>!!e&&i.has(e)},function(e,t,a){"use strict";a.d(t,"b",(function(){return c})),a.d(t,"c",(function(){return u})),a.d(t,"a",(function(){return p}));var n=a(2),i=a.n(n),r=a(40),s=a(44),o=a(58);const l={tall:490,short:250},c=Object(n.createContext)({tableId:null}),u=({height:e="tall"})=>i.a.createElement(r.EuiPanel,{color:"subdued"},i.a.createElement(r.EuiFlexGroup,{style:{height:l[e]},alignItems:"center",justifyContent:"center","data-test-subj":"loading-alerts-panel"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiLoadingSpinner,{size:"xl"})))),d={maxWidth:500},p=()=>{const{http:e}=Object(o.useKibana)().services;return i.a.createElement(r.EuiPanel,{color:"subdued","data-test-subj":"tGridEmptyState"},i.a.createElement(r.EuiFlexGroup,{alignItems:"center",justifyContent:"center"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiPanel,{hasBorder:!0,style:d},i.a.createElement(r.EuiFlexGroup,null,i.a.createElement(r.EuiFlexItem,null,i.a.createElement(r.EuiText,{size:"s"},i.a.createElement(r.EuiTitle,null,i.a.createElement("h3",null,i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.eventsViewer.empty.title",defaultMessage:"No results match your search criteria"}))),i.a.createElement("p",null,i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.eventsViewer.empty.description",defaultMessage:"Try searching over a longer period of time or modifying your search"})))),i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiImage,{size:"200",alt:"",url:e.basePath.prepend("/plugins/timelines/assets/illustration_product_no_results_magnifying_glass.svg")})))))))}},,function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(2),i=a.n(n),r=a(103),s=a(1430),o=a(709);const l=i.a.memo((e=>{const t=Object(r.useSelector)((t=>t.analyzer[e.resolverComponentInstanceID])),a=Object(r.useDispatch)();return t||a(Object(o.createResolver)({id:e.resolverComponentInstanceID})),Object(n.useEffect)((()=>{e.shouldUpdate&&a(Object(o.createResolver)({id:e.resolverComponentInstanceID}))}),[a,e.shouldUpdate,e.resolverComponentInstanceID]),i.a.createElement(s.a,e)}))},function(e,t,a){"use strict";a.d(t,"i",(function(){return i})),a.d(t,"h",(function(){return r})),a.d(t,"b",(function(){return s})),a.d(t,"c",(function(){return o})),a.d(t,"d",(function(){return l})),a.d(t,"a",(function(){return c})),a.d(t,"f",(function(){return u})),a.d(t,"e",(function(){return d})),a.d(t,"g",(function(){return p})),a.d(t,"k",(function(){return m})),a.d(t,"j",(function(){return b}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.user.details.overview.userIdTitle",{defaultMessage:"User ID"}),r=n.i18n.translate("xpack.securitySolution.user.details.overview.userDomainTitle",{defaultMessage:"Domain"}),s=n.i18n.translate("xpack.securitySolution.user.details.overview.familyTitle",{defaultMessage:"Family"}),o=n.i18n.translate("xpack.securitySolution.user.details.overview.ipAddressesTitle",{defaultMessage:"IP addresses"}),l=n.i18n.translate("xpack.securitySolution.user.details.overview.osTitle",{defaultMessage:"Operating system"}),c=n.i18n.translate("xpack.securitySolution.network.ipDetails.ipOverview.firstSeenTitle",{defaultMessage:"First seen"}),u=n.i18n.translate("xpack.securitySolution.user.ipDetails.ipOverview.lastSeenTitle",{defaultMessage:"Last seen"}),d=n.i18n.translate("xpack.securitySolution.user.details.overview.inspectTitle",{defaultMessage:"User overview"}),p=n.i18n.translate("xpack.securitySolution.user.details.overview.maxAnomalyScoreByJobTitle",{defaultMessage:"Max anomaly score by job"}),m=n.i18n.translate("xpack.securitySolution.user.details.overview.userRiskScoreTitle",{defaultMessage:"User risk score"}),b=n.i18n.translate("xpack.securitySolution.user.details.overview.userRiskClassification",{defaultMessage:"User risk classification"})},function(e,t,a){"use strict";a.d(t,"e",(function(){return i})),a.d(t,"d",(function(){return r})),a.d(t,"k",(function(){return s})),a.d(t,"n",(function(){return o})),a.d(t,"g",(function(){return l})),a.d(t,"f",(function(){return c})),a.d(t,"j",(function(){return u})),a.d(t,"m",(function(){return d})),a.d(t,"p",(function(){return p})),a.d(t,"o",(function(){return m})),a.d(t,"c",(function(){return b})),a.d(t,"r",(function(){return g})),a.d(t,"a",(function(){return f})),a.d(t,"b",(function(){return y})),a.d(t,"q",(function(){return h})),a.d(t,"i",(function(){return v})),a.d(t,"l",(function(){return E})),a.d(t,"h",(function(){return x}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.host.details.overview.hostIdTitle",{defaultMessage:"Host ID"}),r=n.i18n.translate("xpack.securitySolution.host.details.firstSeenTitle",{defaultMessage:"First seen"}),s=n.i18n.translate("xpack.securitySolution.host.details.lastSeenTitle",{defaultMessage:"Last seen"}),o=n.i18n.translate("xpack.securitySolution.host.details.overview.maxAnomalyScoreByJobTitle",{defaultMessage:"Max anomaly score by job"}),l=n.i18n.translate("xpack.securitySolution.host.details.overview.hostRiskScoreTitle",{defaultMessage:"Host risk score"}),c=n.i18n.translate("xpack.securitySolution.host.details.overview.hostRiskClassification",{defaultMessage:"Host risk classification"}),u=n.i18n.translate("xpack.securitySolution.host.details.overview.ipAddressesTitle",{defaultMessage:"IP addresses"}),d=n.i18n.translate("xpack.securitySolution.host.details.overview.macAddressesTitle",{defaultMessage:"MAC addresses"}),p=n.i18n.translate("xpack.securitySolution.host.details.overview.platformTitle",{defaultMessage:"Platform"}),m=n.i18n.translate("xpack.securitySolution.host.details.overview.osTitle",{defaultMessage:"Operating system"}),b=n.i18n.translate("xpack.securitySolution.host.details.overview.familyTitle",{defaultMessage:"Family"}),g=n.i18n.translate("xpack.securitySolution.host.details.versionLabel",{defaultMessage:"Version"}),f=n.i18n.translate("xpack.securitySolution.host.details.architectureLabel",{defaultMessage:"Architecture"}),y=n.i18n.translate("xpack.securitySolution.host.details.overview.cloudProviderTitle",{defaultMessage:"Cloud provider"}),h=n.i18n.translate("xpack.securitySolution.host.details.overview.regionTitle",{defaultMessage:"Region"}),v=n.i18n.translate("xpack.securitySolution.host.details.overview.instanceIdTitle",{defaultMessage:"Instance ID"}),E=n.i18n.translate("xpack.securitySolution.host.details.overview.machineTypeTitle",{defaultMessage:"Machine type"}),x=n.i18n.translate("xpack.securitySolution.host.details.overview.inspectTitle",{defaultMessage:"Host overview"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(50),i=a.n(n),r=a(2),s=a.n(r),o=a(40),l=a(236),c=a(167);const u=({range:e,setRange:t,loading:a})=>{const[n,u]=Object(r.useState)(e.from===c.a?i()().subtract(30,"d"):i()(e.from)),[d,p]=Object(r.useState)(e.to===c.b?i()():i()(e.to)),m=Object(r.useCallback)((()=>{n&&d&&n.isBefore(d)&&t({from:n.toISOString(),to:d.toISOString()})}),[d,t,n]),b=Object(r.useMemo)((()=>null==n?void 0:n.isBefore(d)),[n,d]);return s.a.createElement(o.EuiFlexGroup,null,s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiDatePickerRange,{"data-test-subj":"enrichment-query-range-picker",startDateControl:s.a.createElement(o.EuiDatePicker,{className:"start-picker",selected:n,onChange:u,startDate:n,endDate:d,isInvalid:!b,"aria-label":l.d,showTimeSelect:!0}),endDateControl:s.a.createElement(o.EuiDatePicker,{className:"end-picker",selected:d,onChange:p,startDate:n,endDate:d,isInvalid:!b,"aria-label":l.c,showTimeSelect:!0})})),s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiButton,{iconType:"refresh",onClick:m,isLoading:a,"data-test-subj":"enrichment-button",isDisabled:!b},l.n)))}},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a.n(n),r=a(803),s=a(135),o=a(500);const l=({ariaLabel:e=s.i,ecsRowData:t,buttonType:a,onInvestigateInTimelineAlertClick:n})=>{const{investigateInTimelineAlertClick:l}=Object(o.a)({ecsRowData:t,onInvestigateInTimelineAlertClick:n});return i.a.createElement(r.a,{ariaLabel:e,content:s.h,dataTestSubj:"send-alert-to-timeline",iconType:"timeline",onClick:l,isDisabled:!1,buttonType:a})},c=i.a.memo(l)},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(896);const i=e=>{var t;const a=null!=e&&e.fields?null==e?void 0:e.fields["kibana.alert.rule.parameters"]:null,i=a?null===(t=a[0])||void 0===t?void 0:t.threat:null;return i&&i.length>0?Object(n.m)({label:i[0].framework,threat:i}):null}},function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(346);const c=o.a.div.withConfig({displayName:"EuiCodeEditorContainer",componentId:"sc-a6c5kq-0"})([".euiCodeEditorWrapper{position:absolute;}"]),u=r.a.memo((({rawEventData:e})=>{const t=Object(i.useMemo)((()=>JSON.stringify(e,l.i,2)),[e]);return r.a.createElement(c,null,r.a.createElement(n.EuiCodeBlock,{language:"json",fontSize:"m",paddingSize:"m",isCopyable:!0,"data-test-subj":"jsonView"},t))}));u.displayName="JsonView"},function(e,t,a){"use strict";a.d(t,"a",(function(){return g}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(255),c=a(124),u=a(102),d=a(596),p=a(155),m=a(238);const b=o.a.div.withConfig({displayName:"TabContentWrapper",componentId:"sc-woclj6-0"})(["height:100%;position:relative;"]),g=({rawEventData:e,ecsData:t})=>{var a,i,s,o,g,f,y,h,v;const{services:{osquery:E}}=Object(u.j)(),x=Object(c.a)("responseActionsEnabled"),j=Object(c.a)("endpointResponseActionsEnabled"),S=e?Object(l.a)(e.fields):void 0,k=null==S||null===(a=S.kibana)||void 0===a||null===(i=a.alert)||void 0===i||null===(s=i.rule)||void 0===s||null===(o=s.parameters)||void 0===o?void 0:o[0].response_actions,O=!e||!x||j||!t||!(null!=k&&k.length),w=null!==(g=null==e?void 0:e._id)&&void 0!==g?g:"",{OsqueryResults:T,fetchAllLiveQueries:I}=E,{data:C}=I({filterQuery:{term:{alert_ids:w}},alertId:w,skip:O});if(O)return;const M=k.filter((e=>e.action_type_id===m.a.OSQUERY));if(null==M||!M.length)return;const _=(null==C?void 0:C.data.items)||[],F=null==S||null===(f=S.kibana)||void 0===f||null===(y=f.alert)||void 0===y||null===(h=y.rule)||void 0===h||null===(v=h.name)||void 0===v?void 0:v[0],A=r.a.createElement(b,{"data-test-subj":"osqueryViewWrapper"},r.a.createElement(T,{ruleName:F,actionItems:_,ecsData:t}),r.a.createElement(n.EuiSpacer,{size:"s"}));return{id:d.b.osqueryView,"data-test-subj":"osqueryViewTab",name:p.u,append:r.a.createElement(n.EuiNotificationBadge,{"data-test-subj":"osquery-actions-notification"},_.length),content:A}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(396),i=a.n(n);const r={macos:!0,windows:!0};function s(e){return e.includes("-")?e.substring(0,e.indexOf("-")):e}const o=({osName:e,version:t,capabilities:a})=>!(!t||!(({currentVersion:e,minVersionRequired:t="7.14.0"})=>{try{const a=s(e);return i()(t,a)}catch(a){return window&&window.console&&window.console.warn(`SecuritySolution: isVersionSupported(): Unable to determine if current version [${e}] meets minimum version [${t}]. Error: ${a.message}`),!1}})({currentVersion:t}))&&(function(e){const t=s(e);return i()("7.15.0",t)}(t)?function(e=[]){return e.includes("isolation")}(a):function(e){return(({currentOs:e,supportedOss:t=r})=>!!t[e])({currentOs:e.toLowerCase()})}(e))},,function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(65),i=a(504);const r=(e,t={})=>{var a;return e.get(i.a,{...t,query:{...t.query,kuery:`${null!=t&&null!==(a=t.query)&&void 0!==a&&a.kuery?`${t.query.kuery} and `:""}${n.PACKAGE_POLICY_SAVED_OBJECT_TYPE}.package.name: endpoint`}})}},function(e,t,a){"use strict";a.d(t,"b",(function(){return o})),a.d(t,"a",(function(){return l})),a.d(t,"d",(function(){return c})),a.d(t,"c",(function(){return u}));var n=a(2),i=a.n(n),r=a(5),s=a(44);const o={FORM_TITLE:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.applyTimelineTemplate.formTitle",{defaultMessage:"Apply Timeline template"}),TEMPLATE_SELECTOR_LABEL:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.applyTimelineTemplate.templateSelectorLabel",{defaultMessage:"Apply Timeline template to selected rules"}),TEMPLATE_SELECTOR_HELP_TEXT:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.applyTimelineTemplate.templateSelectorHelpText",{defaultMessage:"Select which Timeline to apply to selected rules when investigating generated alerts."}),TEMPLATE_SELECTOR_PLACEHOLDER:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.applyTimelineTemplate.templateSelectorPlaceholder",{defaultMessage:"Search Timeline template"}),TEMPLATE_SELECTOR_DEFAULT_VALUE:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.applyTimelineTemplate.templateSelectorDefaultValue",{defaultMessage:"None"}),warningCalloutMessage:e=>i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.applyTimelineTemplate.warningCalloutMessage",defaultMessage:"You're about to apply changes to {rulesCount, plural, one {# selected rule} other {# selected rules}}. If you previously applied Timeline templates to these rules, they will be overwritten or (if you select 'None') reset to none.",values:{rulesCount:e}})},l={FORM_TITLE:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.addRuleActions.formTitle",{defaultMessage:"Add rule actions"}),OVERWRITE_LABEL:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.addRuleActions.overwriteCheckboxLabel",{defaultMessage:"Overwrite all selected rules actions"}),RULE_VARIABLES_DETAIL:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.addRuleActions.ruleVariablesDetail",{defaultMessage:"Rule variables may affect only some of the rules you select, based on the rule types (for example, \\u007b\\u007bcontext.rule.threshold\\u007d\\u007d will only display values for threshold rules)."})},c={FORM_TITLE:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.setSchedule.formTitle",{defaultMessage:"Update rule schedules"}),INTERVAL_LABEL:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.setSchedule.intervalLabel",{defaultMessage:"Runs every"}),INTERVAL_HELP_TEXT:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.setSchedule.intervalHelpText",{defaultMessage:"Rules run periodically and detect alerts within the specified time frame."}),LOOKBACK_LABEL:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.setSchedule.lookbackLabel",{defaultMessage:"Additional look-back time"}),LOOKBACK_HELP_TEXT:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.setSchedule.lookbackHelpText",{defaultMessage:"Adds time to the look-back period to prevent missed alerts."}),warningCalloutMessage:e=>i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.setSchedule.warningCalloutMessage",defaultMessage:"You're about to apply changes to {rulesCount, plural, one {# selected rule} other {# selected rules}}. The changes you make will overwrite the existing rule schedules and additional look-back time (if any).",values:{rulesCount:e}})},u={MODAL_TITLE:e=>i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.exception.confirmation.modalTitle",defaultMessage:"Duplicate {rulesCount, plural, one {the rule} other {rules}}?",values:{rulesCount:e}}),MODAL_TEXT:e=>i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.exceptionsConfirmation.modalBody",defaultMessage:"You're duplicating {rulesCount, plural, one {# rule} other {# rules}}. Choose what to duplicate:",values:{rulesCount:e}}),DUPLICATE_EXCEPTIONS_TEXT:e=>i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.exceptionsConfirmation.with",defaultMessage:"The {rulesCount, plural, one {rule} other {rules}} and {rulesCount, plural, one {its} other {their}} active exceptions",values:{rulesCount:e}}),DUPLICATE_EXCEPTIONS_INCLUDE_EXPIRED_EXCEPTIONS_LABEL:e=>i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.includeExpiredExceptionsCheckboxLabel",defaultMessage:"The {rulesCount, plural, one {rule} other {rules}} and {rulesCount, plural, one {its} other {their}} exceptions",values:{rulesCount:e}}),DUPLICATE_WITHOUT_EXCEPTIONS_TEXT:e=>i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.exceptionsConfirmation.without",defaultMessage:"Only the {rulesCount, plural, one {rule} other {rules}}",values:{rulesCount:e}}),CONTINUE_BUTTON:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.exceptionsConfirmation.continueButton",{defaultMessage:"Duplicate"}),CANCEL_BUTTON:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.exceptionsConfirmation.cancelButton",{defaultMessage:"Cancel"}),DUPLICATE_TOOLTIP:r.i18n.translate("xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.duplicate.exceptionsConfirmation.tooltip",{defaultMessage:"Exception items associated with individual rules are duplicated. Exception items linked to shared exception lists are not. Instead, duplicated rules will reference the shared exception lists that contain the exception items."})}},function(e,t,a){"use strict";a.d(t,"c",(function(){return i})),a.d(t,"e",(function(){return r})),a.d(t,"d",(function(){return s})),a.d(t,"a",(function(){return o})),a.d(t,"b",(function(){return l}));var n=a(185);const i=(e="",t=!1,a="",i="",r="",s=!1)=>({meta:{license:e,license_uuid:a,cluster_uuid:i,cluster_name:r,cloud:t,serverless:s},global_manifest_version:"latest",windows:{events:{credential_access:!0,dll_and_driver_load:!0,dns:!0,file:!0,network:!0,process:!0,registry:!0,security:!0},malware:{mode:n.f.prevent,blocklist:!0},ransomware:{mode:n.f.prevent,supported:!0},memory_protection:{mode:n.f.prevent,supported:!0},behavior_protection:{mode:n.f.prevent,reputation_service:t,supported:!0},popup:{malware:{message:"",enabled:!0},ransomware:{message:"",enabled:!0},memory_protection:{message:"",enabled:!0},behavior_protection:{message:"",enabled:!0}},logging:{file:"info"},antivirus_registration:{enabled:!1},attack_surface_reduction:{credential_hardening:{enabled:!0}}},mac:{events:{process:!0,file:!0,network:!0},malware:{mode:n.f.prevent,blocklist:!0},behavior_protection:{mode:n.f.prevent,reputation_service:t,supported:!0},memory_protection:{mode:n.f.prevent,supported:!0},popup:{malware:{message:"",enabled:!0},behavior_protection:{message:"",enabled:!0},memory_protection:{message:"",enabled:!0}},logging:{file:"info"},advanced:{capture_env_vars:"DYLD_INSERT_LIBRARIES,DYLD_FRAMEWORK_PATH,DYLD_LIBRARY_PATH,LD_PRELOAD"}},linux:{events:{process:!0,file:!0,network:!0,session_data:!1,tty_io:!1},malware:{mode:n.f.prevent,blocklist:!0},behavior_protection:{mode:n.f.prevent,reputation_service:t,supported:!0},memory_protection:{mode:n.f.prevent,supported:!0},popup:{malware:{message:"",enabled:!0},behavior_protection:{message:"",enabled:!0},memory_protection:{message:"",enabled:!0}},logging:{file:"info"},advanced:{capture_env_vars:"LD_PRELOAD,LD_LIBRARY_PATH"}}}),r=(e=i())=>{const t={rollback:{self_healing:{enabled:!1}}};return{...e,windows:{...e.windows,advanced:void 0===e.windows.advanced?void 0:{...e.windows.advanced,alerts:void 0===e.windows.advanced.alerts?{...t}:{...e.windows.advanced.alerts,...t}},ransomware:{mode:n.f.off,supported:!1},memory_protection:{mode:n.f.off,supported:!1},behavior_protection:{mode:n.f.off,reputation_service:!1,supported:!1},attack_surface_reduction:{credential_hardening:{enabled:!1}},popup:{...e.windows.popup,malware:{message:"",enabled:!0},ransomware:{message:"",enabled:!1},memory_protection:{message:"",enabled:!1},behavior_protection:{message:"",enabled:!1}}},mac:{...e.mac,behavior_protection:{mode:n.f.off,reputation_service:!1,supported:!1},memory_protection:{mode:n.f.off,supported:!1},popup:{...e.mac.popup,malware:{message:"",enabled:!0},memory_protection:{message:"",enabled:!1},behavior_protection:{message:"",enabled:!1}}},linux:{...e.linux,behavior_protection:{mode:n.f.off,reputation_service:!1,supported:!1},memory_protection:{mode:n.f.off,supported:!1},popup:{...e.linux.popup,malware:{message:"",enabled:!0},memory_protection:{message:"",enabled:!1},behavior_protection:{message:"",enabled:!1}}}}},s=(e=i())=>({...e,windows:{...e.windows,ransomware:{...e.windows.ransomware,supported:!0},memory_protection:{...e.windows.memory_protection,supported:!0},behavior_protection:{...e.windows.behavior_protection,supported:!0}},mac:{...e.mac,behavior_protection:{...e.windows.behavior_protection,supported:!0},memory_protection:{...e.mac.memory_protection,supported:!0}},linux:{...e.linux,behavior_protection:{...e.windows.behavior_protection,supported:!0},memory_protection:{...e.linux.memory_protection,supported:!0}}}),o="Elastic Security {action} {filename}",l="Elastic Security {action} {rule}"},function(e,t,a){"use strict";a.d(t,"b",(function(){return r})),a.d(t,"a",(function(){return s}));var n=a(120),i=a(163);const r=["item_id","name","description","entries.value"],s={name:i.j,namespace_type:"agnostic",description:i.h,list_id:i.i,type:n.b.ENDPOINT_HOST_ISOLATION_EXCEPTIONS}},,function(e,t,a){"use strict";a.d(t,"a",(function(){return ye}));var n=a(2),i=a.n(n),r=a(103),s=a(56),o=a(672),l=a(102),c=a(4),u=a(105),d=a(118),p=a(111),m=a(12),b=a(479),g=a(190),f=a(44),y=a(41),h=a.n(y),v=a(106),E=a(947),x=a(317),j=a(209),S=a(126),k=a(40),O=a(140),w=a(45),T=a(108),I=a(675);const C=({onComplete:e,isEnableDownloader:t,exportedIds:a})=>{const{tabName:i}=Object(w.useParams)(),{addSuccess:r}=Object(T.a)(),s=Object(n.useCallback)((t=>{null!=e&&e(),r({title:i===v.l.template?O.U(t):O.T(t),"data-test-subj":"addObjectToContainerSuccess"})}),[r,e,i]),o=Object(n.useCallback)((()=>{null!=e&&e()}),[e]);return Object(n.useEffect)((()=>{(async()=>{if(null!=a&&a.length&&t){const e=await Object(j.b)({ids:a});e instanceof Blob?(Object(I.a)(e,`${O.n}.ndjson`),s(a.length)):o()}})()}),[a,t]),null};C.displayName="ExportTimeline";const M=i.a.memo(C);var _=a(42);const F=i.a.memo((({title:e,closeModal:t,onDelete:a})=>{const{tabName:r}=Object(w.useParams)(),s=r===v.l.template?O.j:O.k,o=Object(n.useCallback)((()=>{const t=null!=e?e.trim():"",a=Object(_.isEmpty)(t)?O.ab:t;return i.a.createElement(f.FormattedMessage,{id:"xpack.securitySolution.open.timeline.deleteTimelineModalTitle",defaultMessage:'Delete "{title}"?',"data-test-subj":"title",values:{title:a}})}),[e]);return i.a.createElement(k.EuiConfirmModal,{buttonColor:"danger",cancelButtonText:O.b,confirmButtonText:O.h,defaultFocusedButton:k.EUI_MODAL_CONFIRM_BUTTON,onCancel:t,onConfirm:a,title:o()},i.a.createElement("div",{"data-test-subj":"warning"},s))}));F.displayName="DeleteTimelineModal";const A=Object(y.createGlobalStyle)(["div[data-popover-open]{display:none;}"]),D=i.a.memo((({deleteTimelines:e,isModalOpen:t,savedObjectIds:a,title:r,onComplete:s})=>{const{addSuccess:o}=Object(T.a)(),{tabName:l}=Object(w.useParams)(),c=Object(n.useCallback)((()=>{null!=s&&s()}),[s]),u=Object(n.useCallback)((()=>{a.length>0&&(e(a),o({title:l===v.l.template?O.S(a.length):O.R(a.length)})),null!=s&&s()}),[e,a,s,o,l]);return i.a.createElement(i.a.Fragment,null,t&&i.a.createElement(A,{"data-test-subj":"remove-popover"}),t?i.a.createElement(k.EuiModal,{maxWidth:600,onClose:c},i.a.createElement(F,{"data-test-subj":"delete-timeline-modal",onDelete:u,title:r,closeModal:c})):null)}));D.displayName="DeleteTimelineModalOverlay";const N=({deleteTimelines:e,ids:t,isEnableDownloader:a,isDeleteTimelineModalOpen:n,onComplete:r,title:s})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(M,{"data-test-subj":"TimelineDownloader",exportedIds:t,isEnableDownloader:a,onComplete:r}),null!=e&&i.a.createElement(D,{"data-test-subj":"DeleteTimelineModalOverlay",deleteTimelines:e,isModalOpen:n,onComplete:r,savedObjectIds:t,title:s})),P=i.a.memo(N),R=()=>{const[e,t]=Object(n.useState)(null),[a,i]=Object(n.useState)(!1),[r,s]=Object(n.useState)(!1),o=Object(n.useCallback)((()=>{i(!1),t(null)}),[e]),l=Object(n.useCallback)((e=>{i(!0),null!=e&&t(e)}),[]),c=Object(n.useCallback)((e=>{s(!0),null!=e&&t(e)}),[]),u=Object(n.useCallback)((()=>{s(!1),t(null)}),[]);return{actionItem:e,onCompleteEditTimelineAction:Object(n.useCallback)((()=>{i(!1),s(!1),t(null)}),[]),isDeleteTimelineModalOpen:a,onCloseDeleteTimelineModal:o,onOpenDeleteTimelineModal:l,isEnableDownloader:r,enableExportTimelineDownloader:c,disableExportTimelineDownloader:u}},L=h.a.div.withConfig({displayName:"SearchRowContainer",componentId:"sc-1dq1et8-0"})(["&:not(:last-child){margin-bottom:",";}"],(e=>e.theme.eui.euiSizeL));L.displayName="SearchRowContainer";const B=h()(k.EuiFlexGroup).withConfig({displayName:"SearchRowFlexGroup",componentId:"sc-1dq1et8-1"})(["margin-bottom:",";"],(e=>e.theme.eui.euiSizeXS));B.displayName="SearchRowFlexGroup";const q=i.a.memo((({favoriteCount:e,onlyFavorites:t,onQueryChange:a,onToggleOnlyFavorites:r,children:s,timelineType:o})=>{const l=Object(n.useMemo)((()=>({placeholder:o===v.l.default?O.L:O.M,incremental:!1,"data-test-subj":"search-bar"})),[o]);return i.a.createElement(L,null,i.a.createElement(B,{gutterSize:"s"},i.a.createElement(k.EuiFlexItem,null,i.a.createElement(k.EuiSearchBar,{box:l,onChange:a})),i.a.createElement(k.EuiFlexItem,{grow:!1},i.a.createElement(k.EuiFilterGroup,{fullWidth:!0},i.a.createElement(i.a.Fragment,null,i.a.createElement(k.EuiFilterButton,{"data-test-subj":"only-favorites-toggle",hasActiveFilters:t,onClick:r,numFilters:null!=e?e:void 0},O.D),!!s&&s)))))}));q.displayName="SearchRow";var z=a(104),$=a.n(z);const V=({actionTimelineToShow:e,deleteTimelines:t,enableExportTimelineDownloader:a,onOpenDeleteTimelineModal:n,onOpenTimeline:i,onCreateRule:r,onCreateRuleFromEql:s,hasCrudAccess:o})=>[{width:o?"80px":"150px",actions:[{name:O.g,icon:"timeline",onClick:({savedObjectId:e})=>{i({duplicate:!0,timelineType:v.l.default,timelineId:e})},type:"icon",enabled:({savedObjectId:e})=>null!=e,description:O.g,"data-test-subj":"create-from-template",available:t=>t.timelineType===v.l.template&&e.includes("createFrom")},{name:O.f,icon:"visText",onClick:({savedObjectId:e})=>{i({duplicate:!0,timelineType:v.l.template,timelineId:e})},type:"icon",enabled:({savedObjectId:e})=>null!=e,description:O.f,"data-test-subj":"create-template-from-timeline",available:t=>t.timelineType!==v.l.template&&e.includes("createFrom")},{name:O.E,icon:"copy",onClick:({savedObjectId:e})=>{i({duplicate:!0,timelineId:null!=e?e:""})},type:"icon",enabled:({savedObjectId:e})=>null!=e,description:O.E,"data-test-subj":"open-duplicate",available:t=>t.timelineType!==v.l.template&&e.includes("duplicate")},{name:O.F,icon:"copy",onClick:({savedObjectId:e})=>{i({duplicate:!0,timelineId:null!=e?e:""})},type:"icon",enabled:({savedObjectId:e})=>null!=e,description:O.F,"data-test-subj":"open-duplicate-template",available:t=>t.timelineType===v.l.template&&e.includes("duplicate")},{name:O.o,icon:"exportAction",onClick:e=>{null!=a&&a(e)},enabled:e=>null!=e.savedObjectId&&e.status!==v.k.immutable,description:O.o,"data-test-subj":"export-timeline",available:()=>e.includes("export")},{name:O.i,icon:"trash",onClick:e=>{null!=n&&n(e)},enabled:({savedObjectId:e,status:t})=>null!=e&&t!==v.k.immutable,description:O.i,"data-test-subj":"delete-timeline",available:()=>e.includes("delete")&&null!=t},{name:O.d,icon:"indexEdit",onClick:e=>{null!=r&&e.savedObjectId&&r(e.savedObjectId)},enabled:e=>null!=r&&null!=e.savedObjectId&&e.status!==v.k.immutable,description:O.d,"data-test-subj":"create-rule-from-timeline",available:({queryType:t})=>e.includes("createRule")&&null!=r&&null!=t&&t.hasQuery},{name:O.e,icon:"indexEdit",onClick:e=>{null!=s&&e.savedObjectId&&s(e.savedObjectId)},enabled:e=>null!=s&&null!=e.savedObjectId&&e.status!==v.k.immutable,description:O.d,"data-test-subj":"create-rule-from-eql",available:({queryType:t})=>e.includes("createRuleFromEql")&&null!=s&&null!=t&&t.hasEql}]}],U="45px";var H=a(164),G=a(899),Q=a(117),W=a(132);const K=h.a.span.withConfig({displayName:"LineClampTextContainer",componentId:"sc-4zme7l-0"})(["text-overflow:ellipsis;display:-webkit-box;-webkit-line-clamp:5;-webkit-box-orient:vertical;overflow:hidden;"]),Y=({itemIdToExpandedNotesRowMap:e,onOpenTimeline:t,onToggleShowNotes:a,timelineType:n})=>[{isExpander:!0,render:({notes:t,savedObjectId:n})=>null!=t&&t.length>0&&null!=n?i.a.createElement(k.EuiButtonIcon,{"data-test-subj":"expand-notes",onClick:()=>null!=e[n]?a(Object(_.omit)(n,e)):a({...e,[n]:i.a.createElement(G.a,{notes:t})}),"aria-label":e[n]?O.c:O.m,iconType:e[n]?"arrowDown":"arrowRight"}):null,width:U},{dataType:"string",field:"title",name:n===v.l.default?O.Y:O.Z,render:(e,a)=>null!=a.savedObjectId?i.a.createElement(k.EuiLink,{"data-test-subj":`title-${a.savedObjectId}`,onClick:()=>t({duplicate:!1,timelineId:`${a.savedObjectId}`})},Object(H.f)(a)?O.ab:i.a.createElement(K,null,e)):i.a.createElement("div",{"data-test-subj":`title-no-saved-object-id-${e||"no-title"}`},Object(H.f)(a)?O.ab:e),sortable:!1},{dataType:"string",field:"description",name:O.l,render:e=>i.a.createElement(K,{"data-test-subj":"description"},null!=e&&e.trim().length>0?e:Object(Q.d)()),sortable:!1},{dataType:"date",field:"updated",name:O.y,render:(e,t)=>i.a.createElement("div",{"data-test-subj":"updated"},null!=t.updated?i.a.createElement(W.b,{value:e}):Object(Q.d)()),sortable:!0}],J=e=>e?[{dataType:"string",field:"updatedBy",name:O.B,render:e=>i.a.createElement("div",{"data-test-subj":"username"},Object(Q.a)(e)),sortable:!1}]:[],X=({timelineType:e})=>{const t={note:{align:"center",field:"eventIdToNoteIds",name:i.a.createElement(k.EuiToolTip,{content:O.C},i.a.createElement(k.EuiIcon,{"data-test-subj":"notes-count-header-icon",size:"m",type:"editorComment"})),render:(e,t)=>i.a.createElement("span",{"data-test-subj":"notes-count"},Object(H.d)(t)),sortable:!1,width:U},pinnedEvent:{align:"center",field:"pinnedEventIds",name:i.a.createElement(k.EuiToolTip,{content:O.J},i.a.createElement(k.EuiIcon,{"data-test-subj":"pinned-event-header-icon",size:"m",type:"pin"})),render:(e,t)=>i.a.createElement("span",{"data-test-subj":"pinned-event-count"},`${Object(H.e)(t)}`),sortable:!1,width:U},favorite:{align:"center",field:"favorite",name:i.a.createElement(k.EuiToolTip,{content:O.p},i.a.createElement(k.EuiIcon,{"data-test-subj":"favorites-header-icon",size:"m",type:"starEmpty"})),render:e=>{const t=null!=e&&e.length>0?"starFilled":"starEmpty";return i.a.createElement(k.EuiIcon,{"data-test-subj":`favorite-${t}-star`,type:t,size:"m"})},sortable:!1,width:U}},a=[t.note,t.favorite],n=[t.pinnedEvent,t.note,t.favorite];return e===v.l.template?a:n},Z=k.EuiBasicTable,ee=h()(Z).withConfig({displayName:"BasicTable",componentId:"sc-1yfhyq7-0"})([".euiTableCellContent{animation:none;}.euiTableRow-isExpandedRow .euiTableCellContent__text{width:100%;}"]);ee.displayName="BasicTable";const te=i.a.memo((({actionTimelineToShow:e,deleteTimelines:t,defaultPageSize:a,loading:r,itemIdToExpandedNotesRowMap:s,enableExportTimelineDownloader:o,onCreateRule:l,onCreateRuleFromEql:c,onOpenDeleteTimelineModal:u,onOpenTimeline:d,onSelectionChange:p,onTableChange:m,onToggleShowNotes:b,pageIndex:g,pageSize:f,searchResults:y,showExtendedColumns:h,sortField:E,sortDirection:x,tableRef:j,timelineType:k,totalSearchResultsCount:w})=>{const T={showPerPageOptions:h,pageIndex:g,pageSize:f,pageSizeOptions:[Math.floor(Math.max(a,1)/2),a,2*a],totalItemCount:w},I={sort:{field:E,direction:x}},C={selectable:e=>null!=e.savedObjectId&&e.status!==v.k.immutable,selectableMessage:e=>e?void 0:O.A,onSelectionChange:p},M=null!=j?{ref:j}:{},{kibanaSecuritySolutionsPrivileges:_}=Object(S.a)(),F=Object(n.useMemo)((()=>(({actionTimelineToShow:e,deleteTimelines:t,enableExportTimelineDownloader:a,itemIdToExpandedNotesRowMap:n,onCreateRule:i,onCreateRuleFromEql:r,onOpenDeleteTimelineModal:s,onOpenTimeline:o,onToggleShowNotes:l,showExtendedColumns:c,timelineType:u,hasCrudAccess:d})=>[...Y({itemIdToExpandedNotesRowMap:n,onOpenTimeline:o,onToggleShowNotes:l,timelineType:u}),...J(c),...X({timelineType:u}),...e.length?V({onCreateRule:i,onCreateRuleFromEql:r,actionTimelineToShow:e,deleteTimelines:t,enableExportTimelineDownloader:a,onOpenDeleteTimelineModal:s,onOpenTimeline:o,hasCrudAccess:d}):[]])({actionTimelineToShow:e,deleteTimelines:t,itemIdToExpandedNotesRowMap:s,enableExportTimelineDownloader:o,onCreateRule:l,onCreateRuleFromEql:c,onOpenDeleteTimelineModal:u,onOpenTimeline:d,onSelectionChange:p,onToggleShowNotes:b,showExtendedColumns:h,timelineType:k,hasCrudAccess:_.crud})),[e,t,s,o,l,c,u,d,p,b,h,k,_]),A=r||null==y?O.z:k===v.l.template?O.db:O.cb;return i.a.createElement(ee,$()({columns:F,"data-test-subj":"timelines-table",isExpandable:!0,isSelectable:e.includes("selectable"),itemId:"savedObjectId",itemIdToExpandedRowMap:s,items:null!=y?y:[],loading:r,noItemsMessage:A,onChange:m,pagination:T,selection:e.includes("selectable")?C:void 0,sorting:I},M))}));te.displayName="TimelinesTable";const ae=h.a.span.withConfig({displayName:"QueryText",componentId:"sc-1qxahey-0"})(["white-space:normal;word-break:break-word;"]),ne=i.a.memo((({deleteTimelines:e,defaultPageSize:t,favoriteCount:a,isLoading:r,itemIdToExpandedNotesRowMap:s,importDataModalToggle:o,onCreateRule:l,onCreateRuleFromEql:c,onDeleteSelected:u,onlyFavorites:d,onOpenTimeline:p,onQueryChange:m,onSelectionChange:b,onTableChange:g,onToggleOnlyFavorites:y,onToggleShowNotes:h,pageIndex:w,pageSize:T,query:I,refetch:C,searchResults:M,selectedItems:_,sortDirection:F,setImportDataModalToggle:A,sortField:D,timelineType:N=v.l.default,timelineStatus:L,timelineFilter:B,templateTimelineFilter:z,totalSearchResultsCount:$})=>{var V;const U=Object(n.useRef)(),{actionItem:G,enableExportTimelineDownloader:Q,isEnableDownloader:W,isDeleteTimelineModalOpen:K,onOpenDeleteTimelineModal:Y,onCompleteEditTimelineAction:J}=R(),{kibanaSecuritySolutionsPrivileges:X}=Object(S.a)(),{getBatchItemsPopoverContent:Z}=(({deleteTimelines:e,selectedItems:t,tableRef:a,timelineType:r=v.l.default})=>{const{enableExportTimelineDownloader:s,disableExportTimelineDownloader:o,isEnableDownloader:l,isDeleteTimelineModalOpen:c,onOpenDeleteTimelineModal:u,onCloseDeleteTimelineModal:d}=R(),p=Object(n.useCallback)((e=>{null!=e&&e(),null!=a&&null!=a.current&&a.current.changeSelection([]),o(),d()}),[o,d,a]),m=Object(n.useMemo)((()=>{return e=null!=t?t:[],(Array.isArray(e)?e:[e]).reduce(((e,t)=>null!=t.savedObjectId?[...e,t.savedObjectId]:[...e]),[]);var e}),[t]),b=Object(n.useCallback)((()=>s()),[s]),g=Object(n.useCallback)((()=>u()),[u]),f=Object(n.useCallback)((a=>{var n,s,o,u;const d=null==t||0===t.length,f=[];return t&&f.push(i.a.createElement(k.EuiContextMenuItem,{"data-test-subj":"export-timeline-action",disabled:d,icon:"exportAction",key:"ExportItemKey",onClick:b},O.o)),e&&f.push(i.a.createElement(k.EuiContextMenuItem,{"data-test-subj":"delete-timeline-action",disabled:d,icon:"trash",key:"DeleteItemKey",onClick:g},O.i)),i.a.createElement(i.a.Fragment,null,i.a.createElement(P,{deleteTimelines:e,ids:m,isEnableDownloader:l,isDeleteTimelineModalOpen:c,onComplete:p.bind(null,a),title:1!==(null==t?void 0:t.length)?r===v.l.template?O.N(null!==(n=null==t?void 0:t.length)&&void 0!==n?n:0):O.O(null!==(s=null==t?void 0:t.length)&&void 0!==s?s:0):null!==(o=null===(u=t[0])||void 0===u?void 0:u.title)&&void 0!==o?o:""}),i.a.createElement(k.EuiContextMenuPanel,{items:f}))}),[t,e,m,l,c,p,r,b,g]);return{onCompleteBatchActions:p,getBatchItemsPopoverContent:f}})({deleteTimelines:X.crud?e:void 0,selectedItems:_,tableRef:U,timelineType:N}),ee=Object(n.useMemo)((()=>i.a.createElement(f.FormattedMessage,{id:"xpack.securitySolution.open.timeline.showingNTemplatesLabel",defaultMessage:"{totalSearchResultsCount} {totalSearchResultsCount, plural, one {template} other {templates}} {with}",values:{totalSearchResultsCount:$,with:i.a.createElement(ae,{"data-test-subj":"selectable-query-text"},I.trim().length?`${O.bb} "${I.trim()}"`:"")}})),[$,I]),ne=Object(n.useMemo)((()=>i.a.createElement(f.FormattedMessage,{id:"xpack.securitySolution.open.timeline.showingNTimelinesLabel",defaultMessage:"{totalSearchResultsCount} {totalSearchResultsCount, plural, one {timeline} other {timelines}} {with}",values:{totalSearchResultsCount:$,with:i.a.createElement(ae,{"data-test-subj":"selectable-query-text"},I.trim().length?`${O.bb} "${I.trim()}"`:"")}})),[$,I]),ie=Object(n.useMemo)((()=>null!=G&&null!=G.savedObjectId?[G.savedObjectId]:[]),[G]),re=Object(n.useCallback)((()=>{null!=C&&C()}),[C]),se=Object(n.useCallback)((()=>{null!=A&&A(!1)}),[A]),oe=Object(n.useCallback)((()=>{null!=A&&A(!1),null!=C&&C()}),[A,C]),le=Object(n.useMemo)((()=>{if(X.crud){const t=["createFrom","duplicate",...null!=l?["createRule"]:[],...null!=c?["createRuleFromEql"]:[]];return L!==v.k.immutable&&(t.push("export"),t.push("selectable")),null!=u&&null!=e&&L!==v.k.immutable&&t.push("delete"),t}return L!==v.k.immutable?["export","selectable"]:[]}),[l,c,L,u,e,X]),ce=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,z)),[z]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(P,{deleteTimelines:e,ids:ie,isDeleteTimelineModalOpen:K,isEnableDownloader:W,onComplete:J,title:null!==(V=null==G?void 0:G.title)&&void 0!==V?V:O.ab}),i.a.createElement(E.a,{checkBoxLabel:O.I,closeModal:se,description:O.P,errorMessage:O.t,failedDetailed:O.u,importComplete:oe,importData:j.e,successMessage:O.V,showCheckBox:!1,showModal:null!=o&&o,submitBtnText:O.w,subtitle:O.x,title:O.v}),i.a.createElement("div",{className:H.a},!!B&&B,i.a.createElement(q,{"data-test-subj":"search-row",favoriteCount:a,onlyFavorites:d,onQueryChange:m,onToggleOnlyFavorites:y,query:I,timelineType:N},ce),i.a.createElement(x.a,{border:!0},i.a.createElement(x.d,null,i.a.createElement(x.c,null,i.a.createElement(x.e,{"data-test-subj":"query-message"},i.a.createElement(i.a.Fragment,null,O.Q," ",N===v.l.template?ee:ne))),i.a.createElement(x.c,null,L!==v.k.immutable&&i.a.createElement(i.a.Fragment,null,i.a.createElement(x.e,{"data-test-subj":"selected-count"},N===v.l.template?O.N(_.length):O.O(_.length)),i.a.createElement(x.b,{dataTestSubj:"batchActions",iconSide:"right",iconType:"arrowDown",popoverContent:Z,"data-test-subj":"utility-bar-action"},i.a.createElement("span",{"data-test-subj":"utility-bar-action-button"},O.a))),i.a.createElement(x.b,{dataTestSubj:"refreshButton",iconSide:"right",iconType:"refresh",onClick:re},O.K)))),i.a.createElement(te,{actionTimelineToShow:le,"data-test-subj":"timelines-table",deleteTimelines:e,defaultPageSize:t,loading:r,itemIdToExpandedNotesRowMap:s,enableExportTimelineDownloader:Q,onCreateRule:l,onCreateRuleFromEql:c,onOpenDeleteTimelineModal:Y,onOpenTimeline:p,onSelectionChange:b,onTableChange:g,onToggleShowNotes:h,pageIndex:w,pageSize:T,searchResults:M,showExtendedColumns:!0,sortDirection:F,sortField:D,timelineType:N,tableRef:U,totalSearchResultsCount:$})))}));ne.displayName="OpenTimeline";var ie=a(166);const re=i.a.memo((({children:e,onAddTimelinesToFavorites:t,selectedTimelinesCount:a,title:n})=>i.a.createElement(ie.a,{title:n,split:!0,height:40},i.a.createElement(k.EuiFlexGroup,{gutterSize:"s",responsive:!1},t&&i.a.createElement(k.EuiFlexItem,{grow:!1},i.a.createElement(k.EuiButton,{"data-test-subj":"favorite-selected",iconSide:"left",iconType:"starEmptySpace",isDisabled:0===a,onClick:t},O.q)),e&&i.a.createElement(k.EuiFlexItem,null,e)))));re.displayName="TitleRow";const se=h.a.div.withConfig({displayName:"HeaderContainer",componentId:"sc-98e87t-0"})(["width:100%;"]);se.displayName="HeaderContainer";const oe=Object(n.memo)((({deleteTimelines:e,defaultPageSize:t,favoriteCount:a,hideActions:r=[],isLoading:s,itemIdToExpandedNotesRowMap:o,onAddTimelinesToFavorites:l,onDeleteSelected:c,onlyFavorites:u,onOpenTimeline:d,onQueryChange:p,onSelectionChange:m,onTableChange:b,onToggleOnlyFavorites:g,onToggleShowNotes:f,pageIndex:y,pageSize:h,searchResults:v,selectedItems:E,sortDirection:x,sortField:j,timelineFilter:S,timelineType:O,templateTimelineFilter:w,title:T,totalSearchResultsCount:I})=>{const C=Object(n.useMemo)((()=>{const t=["createFrom","duplicate"];return null!=c&&null!=e&&t.push("delete"),t.filter((e=>!r.includes(e)))}),[c,e,r]),M=Object(n.useMemo)((()=>i.a.createElement(n.Fragment,{key:"search-row-content"},!!w&&w)),[w]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(k.EuiModalHeader,null,i.a.createElement(se,null,i.a.createElement(re,{"data-test-subj":"title-row",onAddTimelinesToFavorites:l,selectedTimelinesCount:E.length,title:T}))),i.a.createElement(k.EuiModalBody,null,i.a.createElement(i.a.Fragment,null,!!S&&i.a.createElement(i.a.Fragment,null,S,i.a.createElement(k.EuiSpacer,{size:"m"})),i.a.createElement(q,{"data-test-subj":"search-row",onlyFavorites:u,onQueryChange:p,onToggleOnlyFavorites:g,query:"",timelineType:O},M),i.a.createElement(te,{actionTimelineToShow:C,"data-test-subj":"timelines-table",deleteTimelines:e,defaultPageSize:t,loading:s,itemIdToExpandedNotesRowMap:o,onOpenTimeline:d,onSelectionChange:m,onTableChange:b,onToggleShowNotes:f,pageIndex:y,pageSize:h,searchResults:v,showExtendedColumns:!1,sortDirection:x,sortField:j,timelineType:O,totalSearchResultsCount:I}))))}));oe.displayName="OpenTimelineModalBody";var le=a(131),ce=a(169);let ue;!function(e){e.tab="tab",e.filter="filter"}(ue||(ue={}));var de=a(911),pe=a(110),me=a(116),be=a(159),ge=a(196);const fe=i.a.memo((({closeModalTimeline:e,defaultPageSize:t,hideActions:a=[],isModal:f=!1,importDataModalToggle:y,onOpenTimeline:h,setImportDataModalToggle:E,title:x})=>{const S=Object(r.useDispatch)(),{startTransaction:T}=Object(be.b)(),[I,C]=Object(n.useState)({}),[M,F]=Object(n.useState)(!1),[A,D]=Object(n.useState)(0),[N,P]=Object(n.useState)(t),[R,L]=Object(n.useState)(""),[B,q]=Object(n.useState)([]),[z,$]=Object(n.useState)("desc"),[V,U]=Object(n.useState)("updated"),G=Object(n.useMemo)((()=>p.b.getTimelineByIdSelector()),[]),Q=Object(u.b)((e=>{var t,a;return null!==(t=null===(a=G(e,d.c.active))||void 0===a?void 0:a.savedObjectId)&&void 0!==t?t:""})),{dataViewId:W,selectedPatterns:K}=Object(me.d)(pe.SourcererScopeName.timeline),Y=Object(n.useMemo)((()=>Object(H.b)(S)),[S]),J=Object(n.useCallback)((e=>S(Object(m.updateIsLoading)(e))),[S]),{customTemplateTimelineCount:X,defaultTimelineCount:Z,elasticTemplateTimelineCount:ee,favoriteCount:te,fetchAllTimeline:ae,timelines:ie,loading:re,totalCount:se,templateTimelineCount:fe}=Object(b.b)(),{timelineType:ye,timelineTabs:he,timelineFilters:ve}=(({defaultTimelineCount:e,templateTimelineCount:t})=>{const{formatUrl:a,search:r}=Object(ce.m)(le.a.timelines),{navigateToUrl:s}=Object(l.j)().services.application,{tabName:o}=Object(w.useParams)(),[c,u]=Object(n.useState)(o===v.l.default||o===v.l.template?o:v.l.default),d=a(Object(ce.k)(v.l.default,r)),p=a(Object(ce.k)(v.l.template,r)),m=Object(n.useCallback)((e=>{e.preventDefault(),s(d)}),[s,d]),b=Object(n.useCallback)((e=>{e.preventDefault(),s(p)}),[s,p]),g=Object(n.useCallback)((e=>[{id:v.l.default,name:O.X,href:d,disabled:!1,onClick:e===ue.tab?m:_.noop},{id:v.l.template,name:O.W,href:p,disabled:!1,onClick:e===ue.tab?b:_.noop}]),[d,p,m,b]),f=Object(n.useCallback)(((e,t)=>{u((t=>(t!==e&&u(e),t)))}),[u]),y=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(k.EuiTabs,{"data-test-subj":"open-timeline-subtabs"},g(ue.tab).map((e=>i.a.createElement(k.EuiTab,{"data-test-subj":`timeline-${ue.tab}-${e.id}`,isSelected:e.id===o,disabled:e.disabled,key:`timeline-${ue.tab}-${e.id}`,href:e.href,onClick:t=>{e.onClick(t),f(e.id,ue.tab)}},e.name)))),i.a.createElement(k.EuiSpacer,{size:"m"}))),[o]),h=Object(n.useMemo)((()=>i.a.createElement(k.EuiTabs,null,g(ue.filter).map((e=>i.a.createElement(k.EuiTab,{"data-test-subj":`open-timeline-modal-body-${ue.filter}-${e.id}`,isSelected:e.id===c,key:`timeline-${ue.filter}-${e.id}`,onClick:t=>{e.onClick(t),f(e.id,ue.filter)}},e.name))))),[c,g,f]);return{timelineType:c,timelineTabs:y,timelineFilters:h}})({defaultTimelineCount:Z,templateTimelineCount:fe}),{timelineStatus:Ee,templateTimelineFilter:xe,installPrepackagedTimelines:je}=Object(de.a)({timelineType:ye,customTemplateTimelineCount:X,elasticTemplateTimelineCount:ee}),Se=Object(n.useCallback)((()=>{ae({pageInfo:{pageIndex:A+1,pageSize:N},search:R,sort:{sortField:V,sortOrder:z},onlyUserFavorite:M,timelineType:ye,status:Ee})}),[ae,A,N,R,V,z,ye,Ee,M]),ke=Object(n.useCallback)((e=>{L(e.queryText.trim())}),[]),Oe=Object(n.useCallback)((async e=>{T({name:e.length>1?ge.f.BULK_DELETE:ge.f.DELETE}),e.includes(Q)&&S(Object(m.createTimeline)({id:d.c.active,columns:g.b,dataViewId:W,indexNames:K,show:!1})),await Object(j.a)(e),Se()}),[T,Q,Se,S,W,K]),we=Object(n.useCallback)((async e=>{await Oe(e)}),[Oe]),Te=Object(n.useCallback)((async()=>{await Oe((e=>e.reduce(((e,t)=>null!=t.savedObjectId?[...e,t.savedObjectId]:e),[]))(B)),Ne()}),[B,Oe]),Ie=Object(n.useCallback)((e=>{q(e)}),[]),Ce=Object(n.useCallback)((({page:e,sort:t})=>{const{index:a,size:n}=e,{field:i,direction:r}=t;D(a),P(n),$(r),U(i)}),[]),Me=Object(n.useCallback)((()=>{F(!M)}),[M]),_e=Object(n.useCallback)((e=>{C(e)}),[]),{navigateTo:Fe}=Object(l.l)(),Ae=Object(n.useCallback)((e=>Fe({deepLinkId:c.wc.rulesCreate,path:`?${o.b}=${Object(s.encode)(e)}`})),[Fe]),De=Object(n.useCallback)((e=>Fe({deepLinkId:c.wc.rulesCreate,path:`?${o.a}=${Object(s.encode)(e)}`})),[Fe]),Ne=Object(n.useCallback)((()=>{q([])}),[]),Pe=Object(n.useCallback)((({duplicate:t,timelineId:a,timelineType:n})=>{t&&T({name:ge.f.DUPLICATE}),f&&null!=e&&e(),Object(H.h)({duplicate:t,onOpenTimeline:h,timelineId:a,timelineType:n,updateIsLoading:J,updateTimeline:Y})}),[J,Y]);return Object(n.useEffect)((()=>{(()=>{const e=document.querySelector(`.${H.a} input`);null!=e&&e.focus()})()}),[]),Object(n.useEffect)((()=>{(async()=>{await je(),Se()})()}),[Se,je]),f?i.a.createElement(oe,{"data-test-subj":"open-timeline-modal",deleteTimelines:we,defaultPageSize:t,favoriteCount:te,hideActions:a,isLoading:re,itemIdToExpandedNotesRowMap:I,onAddTimelinesToFavorites:void 0,onlyFavorites:M,onOpenTimeline:Pe,onQueryChange:ke,onSelectionChange:Ie,onTableChange:Ce,onToggleOnlyFavorites:Me,onToggleShowNotes:_e,pageIndex:A,pageSize:N,query:R,searchResults:ie,selectedItems:B,sortDirection:z,sortField:V,templateTimelineFilter:xe,timelineType:ye,timelineStatus:Ee,timelineFilter:ve,title:x,totalSearchResultsCount:se}):i.a.createElement(ne,{"data-test-subj":"open-timeline",deleteTimelines:we,defaultPageSize:t,favoriteCount:te,isLoading:re,itemIdToExpandedNotesRowMap:I,importDataModalToggle:y,onAddTimelinesToFavorites:void 0,onCreateRule:Ae,onCreateRuleFromEql:De,onDeleteSelected:Te,onlyFavorites:M,onOpenTimeline:Pe,onQueryChange:ke,onSelectionChange:Ie,onTableChange:Ce,onToggleOnlyFavorites:Me,onToggleShowNotes:_e,pageIndex:A,pageSize:N,query:R,refetch:Se,searchResults:ie,setImportDataModalToggle:E,selectedItems:B,sortDirection:z,sortField:V,templateTimelineFilter:xe,timelineType:ye,timelineStatus:Ee,timelineFilter:he,title:x,totalSearchResultsCount:se})})),ye=i.a.memo(fe)},function(e,t,a){"use strict";a.d(t,"a",(function(){return H}));var n=a(2),i=a.n(n),r=a(40),s=a(45),o=a(141),l=a(828),c=a(1135),u=a(653),d=a(5),p=a(755),m=a(104),b=a.n(m);const g=Object(n.memo)((e=>{const t=Object(n.useRef)(null),a=i.a.createElement(r.EuiButton,b()({buttonRef:t},e));return Object(n.useEffect)((()=>{t.current&&t.current.focus()}),[]),a}));g.displayName="AutoFocusButton";var f=a(107),y=a(487),h=a(102),v=a(381);const E=Object.freeze({deleteActionFailure:(e,t)=>d.i18n.translate("xpack.securitySolution.artifactListPage.deleteActionFailure",{defaultMessage:'Unable to remove "{itemName}". Reason: {errorMessage}',values:{itemName:e,errorMessage:t}}),deleteActionSuccess:e=>d.i18n.translate("xpack.securitySolution.artifactListPage.deleteActionSuccess",{defaultMessage:'"{itemName}" has been removed',values:{itemName:e}})}),x=Object.freeze({deleteModalTitle:e=>d.i18n.translate("xpack.securitySolution.artifactListPage.deleteModalTitle",{defaultMessage:"Delete {itemName}",values:{itemName:e}}),deleteModalImpactTitle:d.i18n.translate("xpack.securitySolution.artifactListPage.deleteModalImpactTitle",{defaultMessage:"Warning"}),deleteModalImpactInfo:e=>d.i18n.translate("xpack.securitySolution.artifactListPage.deleteModalImpactInfo",{defaultMessage:"Deleting this entry will remove it from {count} associated {count, plural, one {policy} other {policies}}.",values:{count:Object(y.e)(e)?d.i18n.translate("xpack.securitySolution.artifactListPage.deleteModalImpactInfoAll",{defaultMessage:"all"}):Object(y.c)(e).length}}),deleteModalConfirmInfo:d.i18n.translate("xpack.securitySolution.artifactListPage.deleteModalConfirmInfo",{defaultMessage:"This action cannot be undone. Are you sure you wish to continue?"}),deleteModalSubmitButtonTitle:d.i18n.translate("xpack.securitySolution.artifactListPage.deleteModalSubmitButtonTitle",{defaultMessage:"Delete"}),deleteModalCancelButtonTitle:d.i18n.translate("xpack.securitySolution.artifactListPage.deleteModalCancelButtonTitle",{defaultMessage:"Cancel"})}),j=Object(n.memo)((({apiClient:e,item:t,onCancel:a,onSuccess:s,"data-test-subj":o,labels:l})=>{const c=Object(f.a)(o),{deleteArtifactItem:u,isLoading:d}=((e,t,a)=>{const i=Object(h.n)(),r=Object(v.c)(e,{onError:e=>{var n;i.addDanger(a.deleteActionFailure(t.name,(null===(n=e.body)||void 0===n?void 0:n.message)||e.message))},onSuccess:e=>{i.addSuccess(a.deleteActionSuccess(e.name))}});return Object(n.useMemo)((()=>({...r,deleteArtifactItem:r.mutateAsync})),[r])})(e,t,l),p=Object(n.useCallback)((()=>{u(t).then((()=>s()))}),[u,t,s]),m=Object(n.useCallback)((()=>{d||a()}),[d,a]);return i.a.createElement(r.EuiModal,{onClose:m,"data-test-subj":o},i.a.createElement(r.EuiModalHeader,{"data-test-subj":c("header")},i.a.createElement(r.EuiModalHeaderTitle,null,l.deleteModalTitle(t.name))),i.a.createElement(r.EuiModalBody,{"data-test-subj":c("body")},i.a.createElement(r.EuiText,null,i.a.createElement(r.EuiCallOut,{"data-test-subj":c("impactCallout"),title:l.deleteModalImpactTitle,color:"danger",iconType:"warning"},i.a.createElement("p",{"data-test-subj":c("impactCalloutInfo")},l.deleteModalImpactInfo(t))),i.a.createElement(r.EuiSpacer,{size:"m"}),i.a.createElement("p",null,l.deleteModalConfirmInfo))),i.a.createElement(r.EuiModalFooter,null,i.a.createElement(r.EuiButtonEmpty,{onClick:m,isDisabled:d,"data-test-subj":c("cancelButton")},l.deleteModalCancelButtonTitle),i.a.createElement(g,{fill:!0,color:"danger",onClick:p,isLoading:d,isDisabled:d,"data-test-subj":c("submitButton")},l.deleteModalSubmitButtonTitle)))}));j.displayName="ArtifactDeleteModal";const S=Object.freeze({pageTitle:d.i18n.translate("xpack.securitySolution.artifactListPage.pageTitle",{defaultMessage:"Artifact"}),pageAboutInfo:d.i18n.translate("xpack.securitySolution.artifactListPage.aboutInfo",{defaultMessage:"A list of artifacts for endpoint"}),pageAddButtonTitle:d.i18n.translate("xpack.securitySolution.artifactListPage.addButtonTitle",{defaultMessage:"Add artifact"}),emptyStateTitleNoEntries:d.i18n.translate("xpack.securitySolution.artifactListPage.emptyStateTitleNoEntries",{defaultMessage:"There are no entries to display."}),emptyStateTitle:d.i18n.translate("xpack.securitySolution.artifactListPage.emptyStateTitle",{defaultMessage:"Add your first artifact"}),emptyStateInfo:d.i18n.translate("xpack.securitySolution.artifactListPage.emptyStateInfo",{defaultMessage:"Add an artifact"}),emptyStatePrimaryButtonLabel:d.i18n.translate("xpack.securitySolution.artifactListPage.emptyStatePrimaryButtonLabel",{defaultMessage:"Add"}),searchPlaceholderInfo:d.i18n.translate("xpack.securitySolution.artifactListPage.searchPlaceholderInfo",{defaultMessage:"Search on the fields below: name, description, comments, value"}),getShowingCountLabel:e=>d.i18n.translate("xpack.securitySolution.artifactListPage.showingTotal",{defaultMessage:"Showing {total, plural, one {# artifact} other {# artifacts}}",values:{total:e}}),cardActionEditLabel:d.i18n.translate("xpack.securitySolution.artifactListPage.cardActionEditLabel",{defaultMessage:"Edit artifact"}),cardActionDeleteLabel:d.i18n.translate("xpack.securitySolution.artifactListPage.cardActionDeleteLabel",{defaultMessage:"Delete event filter"}),...p.a,...x,...E});var k=a(794),O=a(1062),w=a(503),T=a(347),I=a(41),C=a.n(I),M=a(1036);const _=C()(r.EuiEmptyPrompt).withConfig({displayName:"EmptyPrompt",componentId:"sc-1flznkw-0"})(["",""],(()=>Object(I.css)(["max-width:100%;"]))),F=Object(n.memo)((({onAdd:e,isAddDisabled:t=!1,backComponent:a,"data-test-subj":n,titleLabel:s,titleNoEntriesLabel:o,aboutInfo:l,primaryButtonLabel:c,secondaryAboutInfo:u,canCreateItems:d=!0})=>{const p=Object(f.a)(n);return i.a.createElement(M.a,null,d?i.a.createElement(_,{"data-test-subj":n,iconType:"plusInCircle",title:i.a.createElement("h2",{"data-test-subj":p("title")},s),body:i.a.createElement("div",{"data-test-subj":p("aboutInfo")},l,u?i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiSpacer,{size:"m"}),u):void 0),actions:[i.a.createElement(r.EuiButton,{fill:!0,isDisabled:t,onClick:e,"data-test-subj":p("addButton")},c),...a?[a]:[]]}):i.a.createElement(_,{"data-test-subj":n,iconType:"iInCircle",title:i.a.createElement("h2",{"data-test-subj":p("title-no-entries")},o)}))}));F.displayName="NoDataEmptyState";var A=a(829),D=a(732),N=a(46),P=a(173),R=a(290),L=a(1390),B=a(720);var q=a(226),z=a(44),$=a(488);const V=Object(n.memo)((({backButtonLabel:e,backButtonUrl:t,onBackButtonNavigateTo:a,...n})=>{const s=Object($.a)(...a);return i.a.createElement(r.EuiButtonEmpty,b()({},n,{"data-test-subj":"backToOrigin",size:"s",href:t,onClick:s,textProps:{className:"text"}}),e||i.a.createElement(z.FormattedMessage,{id:"xpack.securitySolution.list.backButton",defaultMessage:"Back"}))}));V.displayName="BackToExternalAppSecondaryButton";var U=a(685);const H=Object(n.memo)((({apiClient:e,ArtifactFormComponent:t,searchableFields:a=q.c,labels:d={},secondaryPageInfo:m,onFormSubmit:b,flyoutSize:g,"data-test-subj":y,allowCardEditAction:E=!0,allowCardCreateAction:x=!0,allowCardDeleteAction:I=!0})=>{var C,M;const{state:_}=Object(s.useLocation)(),z=Object(f.a)(y),$=Object(h.n)(),H=Object(o.b)(),G=Object(A.a)(E,x),Q=Object(D.a)(),{urlParams:{filter:W,includedPolicies:K}}=Object(R.a)(),{isPageInitializing:Y,isFetching:J,data:X,uiPagination:Z,doesDataExist:ee,error:te,refetch:ae}=((e,t)=>{const a=Object(o.b)(),{urlParams:{filter:i,includedPolicies:r}}=Object(R.a)(),{pagination:{page:s,pageSize:l}}=Object(B.b)(),c=((e,t,a)=>Object(n.useMemo)((()=>Object(L.a)({kuery:Object(L.b)(e,t),policies:a?a.split(","):[]})),[t,e,a]))(i,t,r),{data:u,isFetching:d,refetch:p}=Object(N.useQuery)(["does-data-exists",e],(async()=>e.hasData()),{enabled:!0,keepPreviousData:!0,refetchOnWindowFocus:!1}),[m,b]=Object(n.useState)({totalItemCount:0,pageSize:l,pageSizeOptions:[...P.f],pageIndex:s-1}),[g,f]=Object(n.useState)(!0),y=Object(v.e)(e,{page:s,perPage:l,filter:i,policies:r?r.split(","):[]},t),{data:h,isFetching:E,error:x,isSuccess:j}=y;return Object(n.useEffect)((()=>{a()&&g&&!d&&f(!1)}),[d,a,g]),Object(n.useEffect)((()=>{a()&&h&&!E&&j&&b((e=>({...e,pageIndex:h.page-1,pageSize:h.per_page,totalItemCount:h.total})))}),[E,a,j,h]),Object(n.useEffect)((()=>{!a()||E||d||x||"1"!==String(s)||c||!(h&&0===h.total&&u||h&&h.total>0&&!u)||p()}),[p,u,i,r,d,E,a,c,h,x,s]),Object(n.useMemo)((()=>({isPageInitializing:g,doesDataExist:null!=u&&u,uiPagination:m,...y})),[u,g,y,m])})(e,a);Object(n.useEffect)((()=>{var e;!J&&te&&$.addDanger((null==te||null===(e=te.body)||void 0===e?void 0:e.message)||te.message)}),[te,$,J]);const ne=Object(n.useMemo)((()=>{var e;return null!==(e=null==X?void 0:X.data)&&void 0!==e?e:[]}),[null==X?void 0:X.data]),[ie,re]=Object(n.useState)(void 0),[se,oe]=Object(n.useState)(void 0),le=Object(n.useMemo)((()=>({...S,...d})),[d]),ce=(({items:e,onAction:t,cardActionDeleteLabel:a,cardActionEditLabel:i,dataTestSubj:r,allowCardDeleteAction:s=!0,allowCardEditAction:o=!0})=>{const l=Object(f.a)(r),c=Object(h.n)(),{data:d}=Object(w.b)({onError:e=>{c.addDanger(Object(T.b)(e))}}),p=Object(u.f)(null==d?void 0:d.items),m=Object(n.useMemo)((()=>{const n={};for(const c of e){const e=[];o&&e.push({icon:"controlsHorizontal",onClick:()=>{t({type:"edit",item:c})},"data-test-subj":l("cardEditAction"),children:i}),s&&e.push({icon:"trash",onClick:()=>{t({type:"delete",item:c})},"data-test-subj":l("cardDeleteAction"),children:a}),n[c.id]={item:c,policies:p,"data-test-subj":r,actions:e.length>0?e:void 0,hideDescription:!c.description,hideComments:!c.comments.length}}return n}),[e,o,s,p,r,l,i,t,a]);return Object(n.useCallback)((e=>m[e.id]),[m])})({items:ne,onAction:Object(n.useCallback)((({type:e,item:t})=>{switch(e){case"edit":oe(t),Q({show:"edit",itemId:t.item_id});break;case"delete":re(t)}}),[Q]),cardActionDeleteLabel:le.cardActionDeleteLabel,cardActionEditLabel:le.cardActionEditLabel,dataTestSubj:z("card"),allowCardDeleteAction:I,allowCardEditAction:E}),ue=Object(w.b)({onError:e=>{$.addWarning(Object(T.b)(e))}}),de=function(e){const[t,a]=Object(n.useState)();return Object(n.useEffect)((()=>{e&&e.onBackButtonNavigateTo&&a(e)}),[e]),t}(_),pe=Object(n.useMemo)((()=>{if(de&&de.onBackButtonNavigateTo)return i.a.createElement(V,de)}),[de]),me=Object(n.useMemo)((()=>{if(de&&de.onBackButtonNavigateTo)return i.a.createElement(U.a,de)}),[de]),be=Object(n.useCallback)((()=>{Q({show:"create"})}),[Q]),ge=Object(n.useCallback)((({pageIndex:e,pageSize:t})=>{Q({page:e+1,pageSize:t}),window.scrollTo({top:0,left:0,behavior:"smooth"})}),[Q]),fe=Object(n.useCallback)(((e,t,a)=>{const n=e!==(null!=W?W:"")||t!==(null!=K?K:"");Q({filter:""===e.trim()?void 0:e,includedPolicies:""===t.trim()?void 0:t}),a&&!n&&ae()}),[W,K,ae,Q]),ye=Object(n.useCallback)((()=>{H()&&(re(void 0),ae())}),[H,ae]),he=Object(n.useCallback)((()=>{re(void 0)}),[]),ve=Object(n.useCallback)((()=>{oe(void 0),ae()}),[ae]),Ee=Object(n.useCallback)((()=>{oe(void 0)}),[]),xe=Object(n.useMemo)((()=>{const e=le.pageAboutInfo?i.a.createElement("span",{"data-test-subj":"header-panel-subtitle"},le.pageAboutInfo):void 0,t=m?i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiSpacer,{size:"m"}),m):void 0;return i.a.createElement(i.a.Fragment,null,e,t)}),[le.pageAboutInfo,m]);return Y?i.a.createElement(k.a,{"data-test-subj":z("pageLoader")}):i.a.createElement(l.a,{headerBackComponent:me,hideHeader:!ee,title:le.pageTitle,subtitle:xe,actions:x&&i.a.createElement(r.EuiButton,{fill:!0,iconType:"plusInCircle",isDisabled:G,onClick:be,"data-test-subj":z("pageAddButton")},le.pageAddButtonTitle),"data-test-subj":z("container")},G&&i.a.createElement(p.b,{apiClient:e,item:se,onSuccess:ve,onClose:Ee,FormComponent:t,labels:le,size:g,submitHandler:b,policies:(null===(C=ue.data)||void 0===C?void 0:C.items)||[],policiesIsLoading:ue.isLoading,"data-test-subj":z("flyout")}),ie&&i.a.createElement(j,{apiClient:e,item:ie,labels:le,"data-test-subj":z("deleteModal"),onSuccess:ye,onCancel:he}),ee?i.a.createElement(i.a.Fragment,null,i.a.createElement(O.a,{defaultValue:W,onSearch:fe,placeholder:le.searchPlaceholderInfo,hasPolicyFilter:!0,policyList:null===(M=ue.data)||void 0===M?void 0:M.items,defaultIncludedPolicies:K}),i.a.createElement(r.EuiSpacer,{size:"m"}),i.a.createElement(r.EuiText,{color:"subdued",size:"xs","data-test-subj":z("showCount")},le.getShowingCountLabel(Z.totalItemCount)),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(c.a,{items:ne,ItemComponent:u.a,itemComponentProps:ce,onChange:ge,error:te,loading:J,pagination:Z,contentClassName:"card-container","data-test-subj":z("list")})):i.a.createElement(F,{onAdd:be,titleNoEntriesLabel:le.emptyStateTitleNoEntries,titleLabel:le.emptyStateTitle,aboutInfo:le.emptyStateInfo,primaryButtonLabel:le.emptyStatePrimaryButtonLabel,backComponent:pe,"data-test-subj":z("emptyState"),secondaryAboutInfo:m,canCreateItems:x}))}));H.displayName="ArtifactListPage"},function(e,t,a){"use strict";a.d(t,"b",(function(){return fe})),a.d(t,"a",(function(){return _e}));var n=a(40),i=a(2),r=a.n(i),s=a(42),o=a(103),l=a(41),c=a.n(l),u=a(44),d=a(51),p=a(114),m=a(105),b=a(118),g=a(106),f=a(111),y=a(133),h=a(412),v=a(4),E=a(12),x=a(102),j=a(169),S=a(131),k=a(248);const O=({timelineId:e})=>{const t=Object(i.useMemo)((()=>f.b.getTimelineByIdSelector()),[]),{cases:a,application:{navigateToApp:l}}=Object(x.j)().services,c=Object(o.useDispatch)(),{graphEventId:u,savedObjectId:d,status:p,title:h,timelineType:O}=Object(m.a)((a=>{var n;return Object(s.pick)(["graphEventId","savedObjectId","status","title","timelineType"],null!==(n=t(a,e))&&void 0!==n?n:y.b)})),[w,T]=Object(i.useState)(!1),[I,C]=Object(i.useState)(!1),M=Object(i.useCallback)((async t=>{C(!1),await l(v.l,{deepLinkId:S.a.case,path:null!=t?Object(j.b)({id:t.id}):Object(j.c)()}),c(Object(E.setInsertTimeline)({graphEventId:u,timelineId:e,timelineSavedObjectId:d,timelineTitle:h}))}),[c,u,l,d,e,h]),_=Object(x.h)(),F=Object(i.useCallback)((()=>{T((e=>!e))}),[]),A=Object(i.useCallback)((()=>T(!1)),[]),D=Object(i.useCallback)((()=>{A(),l(v.l,{deepLinkId:S.a.case,path:Object(j.c)()}).then((()=>{c(Object(E.setInsertTimeline)({graphEventId:u,timelineId:e,timelineSavedObjectId:d,timelineTitle:h.length>0?h:k.l})),c(Object(E.showTimeline)({id:b.c.active,show:!1}))}))}),[c,u,l,A,d,e,h]),N=Object(i.useCallback)((()=>{A(),C(!0)}),[C,A]),P=Object(i.useCallback)((()=>{C(!1)}),[C]),R=Object(i.useCallback)((()=>{T(!1)}),[]),L=Object(i.useMemo)((()=>r.a.createElement(n.EuiButton,{fill:!0,size:"m","data-test-subj":"attach-timeline-case-button",iconType:"arrowDown",iconSide:"right",onClick:F,disabled:p===g.k.draft||O!==g.l.default},k.c)),[F,p,O]),B=Object(i.useMemo)((()=>[r.a.createElement(n.EuiContextMenuItem,{key:"new-case","data-test-subj":"attach-timeline-new-case",onClick:D},k.e),r.a.createElement(n.EuiContextMenuItem,{key:"existing-case","data-test-subj":"attach-timeline-existing-case",onClick:N},k.d)]),[N,D]);return r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiPopover,{id:"singlePanel",button:L,isOpen:w,closePopover:R,panelPaddingSize:"none",anchorPosition:"downLeft"},r.a.createElement(n.EuiContextMenuPanel,{items:B})),I&&a.ui.getAllCasesSelectorModal({onRowClick:M,onClose:P,owner:[v.i],permissions:_}))};O.displayName="AddToCaseButtonComponent";const w=r.a.memo(O);var T=a(701),I=a(657),C=a(149),M=a(130),_=a.n(M),F=a(3),A=a(13),D=a(113),N=a(108),P=a(5);const R=P.i18n.translate("xpack.securitySolution.timeline.kpiFailDescription",{defaultMessage:"An error has occurred"}),L=P.i18n.translate("xpack.securitySolution.timeline.kpiFailSearchDescription",{defaultMessage:"Failed to load KPIs"});var B=a(116),q=a(187),z=a(148),$=a(161),V=a(110),U=a(519);const H=e=>P.i18n.translate("xpack.securitySolution.timeline.flyout.header.closeTimelineButtonLabel",{defaultMessage:"Close {isTimeline, select, true {timeline} false {template}}",values:{isTimeline:e}}),G=P.i18n.translate("xpack.securitySolution.timeline.properties.unsavedLabel",{defaultMessage:"Unsaved"}),Q=P.i18n.translate("xpack.securitySolution.timeline.properties.autosavedLabel",{defaultMessage:"Autosaved"}),W=P.i18n.translate("xpack.securitySolution.timeline.properties.inspectTimelineTitle",{defaultMessage:"Timeline"}),K=P.i18n.translate("xpack.securitySolution.timeline.kpis.processKpiTitle",{defaultMessage:"Processes"}),Y=P.i18n.translate("xpack.securitySolution.timeline.kpis.hostKpiTitle",{defaultMessage:"Hosts"}),J=P.i18n.translate("xpack.securitySolution.timeline.kpis.sourceIpKpiTitle",{defaultMessage:"Source IPs"}),X=P.i18n.translate("xpack.securitySolution.timeline.kpis.destinationKpiTitle",{defaultMessage:"Destination IPs"}),Z=P.i18n.translate("xpack.securitySolution.timeline.kpis.userKpiTitle",{defaultMessage:"Users"}),ee=P.i18n.translate("xpack.securitySolution.timeline.properties.readMore",{defaultMessage:"Read More"}),te=({isOpen:e,title:t})=>P.i18n.translate("xpack.securitySolution.timeline.properties.timelineToggleButtonAriaLabel",{values:{isOpen:e,title:t},defaultMessage:"{isOpen, select, false {Open} true {Close} other {Toggle}} timeline {title}"}),ae=c()(n.EuiHealth).withConfig({displayName:"EuiHealthStyled",componentId:"sc-m1giyi-0"})(["display:block;"]),ne=c()(n.EuiButtonEmpty).withConfig({displayName:"StyledEuiButtonEmpty",componentId:"sc-m1giyi-1"})(["> span{padding:0;}"]),ie=c()(n.EuiFlexItem).withConfig({displayName:"TitleConatiner",componentId:"sc-m1giyi-2"})(["overflow:hidden;display:inline-block;text-overflow:ellipsis;"]),re=({timelineId:e,timelineStatus:t,timelineType:a,timelineTitle:l,updated:c,isOpen:d})=>{const p=Object(o.useDispatch)(),m=Object(i.useCallback)((()=>{p(f.a.showTimeline({id:e,show:!d})),Object(z.i)()}),[p,d,e]),b=Object(s.isEmpty)(l)?a===g.l.template?k.k:k.l:l,y=Object(i.useMemo)((()=>t===g.k.draft?r.a.createElement(r.a.Fragment,null,G):r.a.createElement(r.a.Fragment,null,Q," ",r.a.createElement(u.FormattedRelative,{"data-test-subj":"timeline-status",key:"timeline-status-autosaved",value:new Date(c)}))),[t,c]);return r.a.createElement(ne,{"aria-label":te({isOpen:d,title:b}),className:z.b,flush:"both","data-test-subj":"flyoutOverlay",size:"s",isSelected:d,onClick:m},r.a.createElement(n.EuiFlexGroup,{gutterSize:"none",alignItems:"center",justifyContent:"flexStart",responsive:!1},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiToolTip,{position:"top",content:y},r.a.createElement(ae,{color:t===g.k.draft?"warning":"success"}))),r.a.createElement(ie,{grow:!1},b),!d&&r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(U.b,null))))},se=r.a.memo(re);var oe=a(139),le=a(55),ce=a.n(le),ue=a(117);const de=c()(n.EuiStat).withConfig({displayName:"NoWrapEuiStat",componentId:"sc-iiqy2a-0"})(["& .euiStat__description{white-space:nowrap;}"]),pe=r.a.memo((({kpis:e,isLoading:t})=>{const a="0,0.[000]a",[s]=Object(x.p)(v.O),o=Object(i.useMemo)((()=>({process:null===e?Object(ue.e)():ce()(e.processCount).format(a),user:null===e?Object(ue.e)():ce()(e.userCount).format(a),host:null===e?Object(ue.e)():ce()(e.hostCount).format(a),sourceIp:null===e?Object(ue.e)():ce()(e.sourceIpCount).format(a),destinationIp:null===e?Object(ue.e)():ce()(e.destinationIpCount).format(a)})),[e]),l=Object(i.useMemo)((()=>({process:ce()(null==e?void 0:e.processCount).format(s),user:ce()(null==e?void 0:e.userCount).format(s),host:ce()(null==e?void 0:e.hostCount).format(s),sourceIp:ce()(null==e?void 0:e.sourceIpCount).format(s),destinationIp:ce()(null==e?void 0:e.destinationIpCount).format(s)})),[e,s]);return r.a.createElement(n.EuiFlexGroup,{wrap:!0,"data-test-subj":"siem-timeline-kpis"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiToolTip,{position:"left",content:l.process},r.a.createElement(de,{"data-test-subj":"siem-timeline-process-kpi",title:o.process,description:K,titleSize:"s",isLoading:t}))),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiToolTip,{position:"left",content:l.user},r.a.createElement(de,{"data-test-subj":"siem-timeline-user-kpi",title:o.user,description:Z,titleSize:"s",isLoading:t}))),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiToolTip,{position:"left",content:l.host},r.a.createElement(de,{"data-test-subj":"siem-timeline-host-kpi",title:o.host,description:Y,titleSize:"s",isLoading:t}))),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiToolTip,{position:"left",content:l.sourceIp},r.a.createElement(de,{"data-test-subj":"siem-timeline-source-ip-kpi",title:o.sourceIp,description:J,titleSize:"s",isLoading:t}))),r.a.createElement(n.EuiFlexItem,{grow:!1,style:{minWidth:100}},r.a.createElement(n.EuiToolTip,{position:"left",content:l.destinationIp},r.a.createElement(de,{"data-test-subj":"siem-timeline-destination-ip-kpi",title:o.destinationIp,description:X,titleSize:"s",isLoading:t}))))}));pe.displayName="TimelineKPIs";var me=a(639);const be=c()(n.EuiFlexItem).withConfig({displayName:"ActiveTimelinesContainer",componentId:"sc-a6ccyo-0"})(["overflow:hidden;"]),ge=({timelineId:e})=>{const t=Object(o.useDispatch)(),{browserFields:a,indexPattern:l}=Object(B.d)(V.SourcererScopeName.timeline),{uiSettings:c}=Object(x.j)().services,u=Object(i.useMemo)((()=>Object(d.getEsQueryConfig)(c)),[c]),g=Object(i.useMemo)((()=>f.b.getTimelineByIdSelector()),[]),{activeTab:h,dataProviders:v,kqlQuery:E,title:j,timelineType:S,status:k,updated:O,show:w,filters:I,kqlMode:M}=Object(m.a)((t=>{var a;return Object(s.pick)(["activeTab","dataProviders","kqlQuery","status","title","timelineType","updated","show","filters","kqlMode"],null!==(a=g(t,e))&&void 0!==a?a:y.b)})),_=Object(i.useMemo)((()=>!Object(s.isEmpty)(v)||!Object(s.isEmpty)(Object(s.get)("filterQuery.kuery.expression",E))),[v,E]),F=Object(i.useMemo)((()=>f.b.getKqlFilterQuerySelector()),[]),A=Object(o.useSelector)((t=>F(t,e))),D=Object(s.isEmpty)(v)&&Object(s.isEmpty)(A)&&"template"===S?" ":A,N=Object(i.useMemo)((()=>({query:D,language:"kuery"})),[D]),P=Object(i.useMemo)((()=>Object($.d)({config:u,dataProviders:v,indexPattern:l,browserFields:a,filters:I||[],kqlQuery:N,kqlMode:M})),[a,v,u,I,l,M,N]),R=Object(i.useCallback)((()=>{t(f.a.showTimeline({id:e,show:!1})),Object(z.i)()}),[t,e]),{euiTheme:L}=Object(n.useEuiTheme)();return r.a.createElement(n.EuiPanel,{borderRadius:"none",grow:!1,paddingSize:"s",hasShadow:!1,"data-test-subj":"timeline-flyout-header-panel",style:{backgroundColor:L.colors.emptyShade,color:L.colors.text}},r.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"s",responsive:!1},r.a.createElement(T.b,{timelineId:e}),r.a.createElement(be,{grow:!1},r.a.createElement(se,{timelineId:e,timelineType:S,timelineTitle:j,timelineStatus:k,isOpen:w,updated:O})),w&&r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiFlexGroup,{justifyContent:"flexEnd",gutterSize:"s",responsive:!1},(h===b.d.query||h===b.d.eql)&&r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(C.b,{compact:!0,queryId:`${e}-${h}`,inputId:p.a.timeline,inspectIndex:0,isDisabled:!_||void 0===(null==P?void 0:P.filterQuery),title:W})),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiToolTip,{content:H("default"===S)},r.a.createElement(n.EuiButtonIcon,{"aria-label":H("default"===S),"data-test-subj":"close-timeline",iconType:"cross",onClick:R})))))))},fe=r.a.memo(ge),ye=c.a.div.withConfig({displayName:"StyledDiv",componentId:"sc-a6ccyo-1"})(["display:-webkit-box;-webkit-line-clamp:1;-webkit-box-orient:vertical;overflow:hidden;word-break:break-word;"]),he=({description:e,onclick:t})=>{const[a,i]=Object(me.a)(e);return r.a.createElement(r.a.Fragment,null,r.a.createElement(ye,{ref:i},e),a&&r.a.createElement(n.EuiButtonEmpty,{flush:"left",onClick:t},ee))},ve=c()(n.EuiFlexGroup).withConfig({displayName:"StyledTimelineHeader",componentId:"sc-a6ccyo-2"})([""," flex:0;"],(({theme:e})=>`margin: ${e.eui.euiSizeXS} ${e.eui.euiSizeS} 0 ${e.eui.euiSizeS};`)),Ee=c.a.span.withConfig({displayName:"TimelineStatusInfoContainer",componentId:"sc-a6ccyo-3"})([""," white-space:nowrap;"],(({theme:e})=>`margin-left: ${e.eui.euiSizeS};`)),xe=c.a.div.withConfig({displayName:"KpisContainer",componentId:"sc-a6ccyo-4"})(["",""],(({theme:e})=>`margin-right: ${e.eui.euiSizeM};`)),je=c()(n.EuiFlexItem).withConfig({displayName:"RowFlexItem",componentId:"sc-a6ccyo-5"})(["flex-direction:row;align-items:center;"]),Se=c.a.h3.withConfig({displayName:"TimelineTitleContainer",componentId:"sc-a6ccyo-6"})(["display:-webkit-box;overflow:hidden;-webkit-line-clamp:1;-webkit-box-orient:vertical;word-break:break-word;"]),ke=({timelineId:e})=>{const t=Object(i.useMemo)((()=>f.b.getTimelineByIdSelector()),[]),{title:a,timelineType:o}=Object(m.a)((a=>{var n;return Object(s.pick)(["title","timelineType"],null!==(n=t(a,e))&&void 0!==n?n:y.b)})),l=Object(i.useMemo)((()=>o===g.l.template?k.k:k.l),[o]),c=Object(i.useMemo)((()=>a||l),[a,l]);return r.a.createElement(n.EuiToolTip,{content:c,position:"bottom"},r.a.createElement(n.EuiText,null,r.a.createElement(Se,{"data-test-subj":"timeline-title"},c)))},Oe=r.a.memo(ke),we=({timelineId:e})=>{const t=Object(i.useMemo)((()=>f.b.getTimelineByIdSelector()),[]),a=Object(m.a)((a=>{var n;return(null!==(n=t(a,e))&&void 0!==n?n:y.b).description})),s=Object(o.useDispatch)(),l=Object(i.useCallback)((t=>{s(Object(E.setActiveTabTimeline)({id:e,activeTab:b.d.notes,scrollToTop:!0}))}),[s,e]);return r.a.createElement(n.EuiText,{size:"s","data-test-subj":"timeline-description"},r.a.createElement(he,{description:a||k.f,onclick:l}))},Te=r.a.memo(we),Ie=({timelineId:e})=>{const t=Object(i.useMemo)((()=>Object(oe.createSelector)(f.b.selectTimeline,(e=>{var t,a;return{status:null!==(t=null==e?void 0:e.status)&&void 0!==t?t:g.k.draft,updated:null!==(a=null==e?void 0:e.updated)&&void 0!==a?a:void 0}}))),[]),{status:a,updated:s}=Object(m.a)((a=>t(a,e)));return Object(i.useMemo)((()=>a===g.k.draft),[a])?r.a.createElement(n.EuiText,{size:"xs"},r.a.createElement(n.EuiTextColor,{color:"warning","data-test-subj":"timeline-status"},G)):r.a.createElement(n.EuiText,{size:"xs"},r.a.createElement(n.EuiTextColor,{color:"default"},Q," ",r.a.createElement(u.FormattedRelative,{"data-test-subj":"timeline-status",key:"timeline-status-autosaved",value:new Date(s)})))},Ce=r.a.memo(Ie),Me=({timelineId:e})=>{var t;const{selectedPatterns:a,indexPattern:l,browserFields:c}=Object(B.d)(V.SourcererScopeName.timeline),u=Object(i.useMemo)((()=>Object(q.i)()),[]),p=Object(i.useMemo)((()=>Object(q.b)()),[]),g=Object(i.useMemo)((()=>e===b.c.active),[e]),v=Object(m.a)((e=>g?{from:u(e.inputs.timeline),to:p(e.inputs.timeline),interval:""}:{from:u(e.inputs.global),to:p(e.inputs.global),interval:""})),{uiSettings:E}=Object(x.j)().services,j=Object(i.useMemo)((()=>Object(d.getEsQueryConfig)(E)),[E]),S=Object(i.useMemo)((()=>f.b.getTimelineByIdSelector()),[]),k=Object(o.useSelector)((t=>{var a;return null!==(a=S(t,e))&&void 0!==a?a:y.b})),{dataProviders:O,filters:T,timelineType:C,kqlMode:M,activeTab:P}=k,z=Object(i.useMemo)((()=>f.b.getKqlFilterQuerySelector()),[]),U=Object(o.useSelector)((t=>z(t,e))),H=Object(s.isEmpty)(O)&&Object(s.isEmpty)(U)&&"template"===C?" ":U,G=Object(i.useMemo)((()=>({query:H,language:"kuery"})),[H]),Q=Object(i.useMemo)((()=>Object($.d)({config:j,dataProviders:O,indexPattern:l,browserFields:c,filters:T||[],kqlQuery:G,kqlMode:M})),[c,O,j,T,l,M,G]),W=Object(i.useMemo)((()=>Object(s.isEmpty)(O)&&Object(s.isEmpty)(T)&&Object(s.isEmpty)(G.query)||void 0===(null==Q?void 0:Q.filterQuery)),[O,T,G,Q]),[K,Y]=(({timerange:e,filterQuery:t,defaultIndex:a,isBlankTimeline:n})=>{const{data:r}=Object(x.j)().services,o=Object(i.useRef)(s.noop),l=Object(i.useRef)(new AbortController),c=Object(i.useRef)(new F.Subscription),[u,d]=Object(i.useState)(!1),[p,m]=Object(i.useState)(null),[b,g]=Object(i.useState)(null),{addError:f,addWarning:y}=Object(N.a)(),h=Object(i.useCallback)((e=>{if(null==e)return;const t=async()=>{l.current=new AbortController,d(!0),c.current=r.search.search(e,{strategy:"timelineSearchStrategy",abortSignal:l.current.signal}).subscribe({next:e=>{Object(A.isCompleteResponse)(e)?(d(!1),g(e),c.current.unsubscribe()):Object(A.isErrorResponse)(e)&&(d(!1),y(R),c.current.unsubscribe())},error:e=>{d(!1),f(e,{title:L}),c.current.unsubscribe()}})};c.current.unsubscribe(),l.current.abort(),t(),o.current=t}),[r.search,f,y]);return Object(i.useEffect)((()=>{m((n=>{const i={...null!=n?n:{},defaultIndex:a,timerange:e,filterQuery:t,factoryQueryType:D.A.kpi};return _()(n,i)?n:i}))}),[a,e,t]),Object(i.useEffect)((()=>(n?(d(!1),g(null)):h(p),()=>{c.current.unsubscribe(),l.current.abort()})),[n,p,h]),[u,b]})({defaultIndex:a,timerange:v,isBlankTimeline:W,filterQuery:null!==(t=null==Q?void 0:Q.filterQuery)&&void 0!==t?t:""}),J=Object(x.h)();return r.a.createElement(ve,{alignItems:"center",gutterSize:"s"},r.a.createElement(n.EuiFlexItem,null,r.a.createElement(n.EuiFlexGroup,{"data-test-subj":"properties-left",direction:"column",gutterSize:"none"},r.a.createElement(je,null,r.a.createElement(Oe,{timelineId:e}),r.a.createElement(I.a,{timelineId:e,initialFocus:"title"}),r.a.createElement(Ee,null,r.a.createElement(Ce,{timelineId:e}))),r.a.createElement(je,null,r.a.createElement(Te,{timelineId:e}),r.a.createElement(I.a,{timelineId:e,initialFocus:"description"})))),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(xe,null,P===b.d.query?r.a.createElement(pe,{kpis:Y,isLoading:K}):null)),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiFlexGroup,{gutterSize:"s"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(h.a,{timelineId:e})),J.create&&J.read&&r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(w,{timelineId:e})))))};Me.displayName="FlyoutHeaderComponent";const _e=r.a.memo(Me)},function(e,t,a){"use strict";a.d(t,"b",(function(){return E})),a.d(t,"a",(function(){return S})),a.d(t,"c",(function(){return C}));var n=a(2),i=a.n(n),r=a(40),s=a(106),o=a(676),l=a(169);const c="timeline";var u=a(5);const d=u.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.insertTimelineButtonLabel",{defaultMessage:"Insert timeline link"}),p=u.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.noTimelineNameFoundErrorMsg",{defaultMessage:"No timeline name found"}),m=u.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.noTimelineIdFoundErrorMsg",{defaultMessage:"No timeline id found"}),b=u.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.noParenthesesErrorMsg",{defaultMessage:"Expected left parentheses"}),g=e=>u.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.failedRetrieveTimelineErrorMsg",{defaultMessage:"Failed to retrieve timeline id: { timelineId }",values:{timelineId:e}}),f=u.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.timelineErrorTitle",{defaultMessage:"Timeline Error"});var y=a(131);const h=({onClosePopover:e,onInsert:t})=>{const{formatUrl:a}=Object(l.m)(y.a.timelines),c=Object(n.useCallback)((({timelines:e})=>[...e.map(((e,t)=>({description:e.description,favorite:e.favorite,label:e.title,id:e.savedObjectId,key:`${e.title}-${t}`,title:e.title,checked:void 0})))]),[]),u=Object(n.useCallback)(((e,n,i)=>{const r=a(Object(l.l)(null!=n?n:"",i),{absolute:!0,skipSearch:!0});t(`[${e}](${r})`,{block:!1})}),[a,t]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiModalHeader,null),i.a.createElement(r.EuiModalBody,null,i.a.createElement(o.a,{hideUntitled:!0,getSelectableOptions:c,onTimelineChange:u,onClosePopover:e,timelineType:s.l.default})))},v=Object(n.memo)(h),E={name:c,button:{label:d,iconType:"timeline"},helpText:i.a.createElement(r.EuiCodeBlock,{language:"md",paddingSize:"s",fontSize:"l"},"[title](url)"),editor:function({node:e,onSave:t,onCancel:a}){return i.a.createElement(v,{onClosePopover:a,onInsert:t})}};var x=a(56),j=a(478);const S=function(){const e=this.Parser,t=e.prototype.inlineTokenizers,a=e.prototype.inlineMethods,n=function(e,t,a){let n=0;if("["!==t[n])return!1;if(a)return!0;function i(e,a){if(t[n]!==e)throw new Error(b);n++;let i="",r=0;for(;n<t.length;n++){const s=t[n];if(s===a&&0===r)return n++,i;s===a?r--:s===e&&r++,i+=s}return""}const r=i("[","]"),s=i("(",")"),o=e.now();if(!r)return this.file.info(p,{line:o.line,column:o.column}),!1;try{var l;const t=s.split("?"),a=Object(j.parse)(t[1]),n=Object(x.safeDecode)(null!==(l=a.timeline)&&void 0!==l?l:""),{id:i="",graphEventId:u=""}=null!=n?n:{id:null,graphEventId:""};return i?e(`[${r}](${s})`)({type:c,id:i,title:r,graphEventId:u}):(this.file.info(m,{line:o.line,column:o.column+s.indexOf("id")}),!1)}catch{this.file.info((e=>u.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.toolTip.timelineUrlIsNotValidErrorMsg",{defaultMessage:"Timeline URL is not valid => {timelineUrl}",values:{timelineUrl:e}}))(s),{line:o.line,column:o.column})}return!1},i=function(e,t,a){return!(!1===t.startsWith("[")||!0===t.startsWith("[")&&!t.includes("timelines?timeline=(id"))&&n.call(this,e,t,a)};i.locator=(e,t)=>e.indexOf("[",t),t.timeline=i,a.splice(a.indexOf("url"),0,c)};var k=a(103),O=a(164),w=a(12),T=a(108);const I=({id:e,title:t,graphEventId:a})=>{const{addError:s}=Object(T.a)(),o=(()=>{const e=Object(k.useDispatch)();return Object(n.useCallback)(((t,a,n)=>{Object(O.h)({graphEventId:n,timelineId:t,onError:a,updateIsLoading:({id:t,isLoading:a})=>e(Object(w.updateIsLoading)({id:t,isLoading:a})),updateTimeline:Object(O.b)(e)})}),[e])})(),l=Object(n.useCallback)(((e,t)=>{s(e,{title:f,toastMessage:g(t)})}),[s]),c=Object(n.useCallback)((()=>o(null!=e?e:"",l,a)),[e,a,o,l]);return i.a.createElement(r.EuiToolTip,{content:(d=null!=e?e:"",u.i18n.translate("xpack.securitySolution.markdownEditor.plugins.timeline.toolTip.timelineId",{defaultMessage:"Timeline id: { timelineId }",values:{timelineId:d}}))},i.a.createElement(r.EuiLink,{onClick:c,"data-test-subj":`markdown-timeline-link-${e}`},t));var d},C=Object(n.memo)(I)},function(e,t,a){"use strict";a.d(t,"a",(function(){return N}));var n=a(40),i=a(2),r=a.n(i),s=a(8),o=a(167),l=a(236),c=a(336);const u=e=>Object(c.e)(e)?l.k:l.g,d=({type:e})=>r.a.createElement(n.EuiToolTip,{content:u(e)},r.a.createElement(n.EuiIcon,{type:"iInCircle",size:"m"}));var p=a(41),m=a.n(p);const b=m.a.div.withConfig({displayName:"OverflowParent",componentId:"sc-sjnml3-0"})(["display:inline-grid;"]),g=m.a.div.withConfig({displayName:"OverflowContainer",componentId:"sc-sjnml3-1"})(["white-space:nowrap;overflow:hidden;text-overflow:ellipsis;font-weight:bold;"]),f=({field:e="",feedName:t="",value:a=""})=>{const i=`${e} ${a}${t?` ${l.e} ${t}`:""}`;return r.a.createElement(n.EuiToolTip,{content:a},r.a.createElement(b,{"data-test-subj":"enrichment-button-content"},r.a.createElement(g,null,i)))},y=m.a.h5.withConfig({displayName:"StyledH5",componentId:"sc-1i38kio-0"})(["line-height:1.7rem;"]),h=e=>r.a.createElement(n.EuiTitle,{size:"xxxs"},r.a.createElement(y,null,e));h.displayName="ThreatSummaryTitle";var v=a(149),E=a(509);const x=m()(n.EuiInMemoryTable).withConfig({displayName:"ThreatSummaryTable",componentId:"sc-1pwinz3-0"})([".euiTableHeaderCell,.euiTableRowCell{border:none;}.euiTableHeaderCell .euiTableCellContent{padding:0;}"]);var j=a(4),S=a(802);const k=m()(n.EuiAccordion).withConfig({displayName:"StyledEuiAccordion",componentId:"sc-mlcc85-0"})([".euiAccordion__triggerWrapper{background:",";border-radius:",";height:",";margin-bottom:",";padding-left:",";}"],(({theme:e})=>e.eui.euiColorLightestShade),(({theme:e})=>e.eui.euiSizeXS),(({theme:e})=>e.eui.euiSizeXL),(({theme:e})=>e.eui.euiSizeS),(({theme:e})=>e.eui.euiSizeS)),O=[{field:"title",truncateText:!1,render:h,width:"220px",name:""},{field:"description",truncateText:!1,render:({fieldName:e,value:t})=>{const a=e.match(o.p)?r.a.createElement(n.EuiLink,{href:t,target:"_blank"},t):r.a.createElement("span",null,t);return r.a.createElement(n.EuiToolTip,{"data-test-subj":"message-tool-tip",content:r.a.createElement(n.EuiFlexGroup,{direction:"column",gutterSize:"none"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement("span",null,e)))},a)},name:""}],w=e=>Object.keys(e).sort().map((t=>({title:t.startsWith(j.I)?t.replace(`${j.I}`,"indicator"):t,description:{fieldName:t,value:Object(S.a)(e[t])}}))),T=({enrichment:e,index:t})=>{const{id:a="threat-details-item",field:i,feedName:s,type:o,value:u}=Object(c.c)(e),d=`${a}${i}`;return r.a.createElement(k,{id:d,key:d,initialIsOpen:!0,arrowDisplay:"right",buttonContent:r.a.createElement(f,{field:i,feedName:s,value:u}),extraAction:Object(c.e)(o)&&r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(v.b,{queryId:E.a,title:l.j}))},r.a.createElement(x,{columns:O,compressed:!0,"data-test-subj":`threat-details-view-${t}`,items:w(e)}))},I=({enrichments:e})=>r.a.createElement(r.a.Fragment,null,e.sort(((e,t)=>Object(c.d)(t)-Object(c.d)(e))).map(((t,a)=>r.a.createElement(r.a.Fragment,{key:`${t.id}`},r.a.createElement(T,{enrichment:t,index:a}),a<e.length-1&&r.a.createElement(n.EuiSpacer,{size:"m"})))));var C=a(44);const M=m.a.div.withConfig({displayName:"InlineBlock",componentId:"sc-oksmx3-0"})(["display:inline-block;line-height:1.7em;"]),_=({type:e})=>e?r.a.createElement(M,{"data-test-subj":"no-enrichments-found"},e===o.c.IndicatorMatchRule?l.l:r.a.createElement(C.FormattedMessage,{id:"xpack.securitySolution.enrichment.noInvestigationEnrichment",defaultMessage:"Additional threat intelligence wasn't found within the selected time frame. Try a different time frame, or {link} to collect threat intelligence for threat detection and matching.",values:{link:r.a.createElement(n.EuiLink,{href:"https://www.elastic.co/guide/en/security/current/es-threat-intel-integrations.html",target:"_blank"},r.a.createElement(C.FormattedMessage,{id:"xpack.securitySolution.enrichment.investigationEnrichmentDocumentationLink",defaultMessage:"enable threat intelligence integrations"}))}})):null,F=({type:e})=>e?r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiFlexGroup,{direction:"row",gutterSize:"xs",alignItems:"baseline"},r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiTitle,{size:"xxxs"},r.a.createElement("h5",null,e===o.c.IndicatorMatchRule?l.f:l.i))),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(d,{type:e}))),r.a.createElement(n.EuiSpacer,{size:"s"})):null,A=({enrichments:e,type:t,loading:a,dataTestSubj:i,children:s})=>r.a.createElement("div",{"data-test-subj":i},r.a.createElement(F,{type:t}),s,Array.isArray(e)?r.a.createElement(I,{enrichments:e}):r.a.createElement(r.a.Fragment,null,r.a.createElement(_,{type:t}),a&&r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiSpacer,{size:"m"}),r.a.createElement(n.EuiSkeletonText,{"data-test-subj":"loading-enrichments",lines:4})))),D=({enrichments:e,before:t=null,showInvestigationTimeEnrichments:a,loading:i,children:l})=>{const{[o.c.IndicatorMatchRule]:c,[o.c.InvestigationTime]:u,undefined:d}=Object(s.groupBy)(e,"matched.type");return r.a.createElement(r.a.Fragment,null,t,r.a.createElement(A,{dataTestSubj:"threat-match-detected",enrichments:c,type:o.c.IndicatorMatchRule}),a&&r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiHorizontalRule,null),r.a.createElement(A,{dataTestSubj:"enriched-with-threat-intel",enrichments:u,type:o.c.InvestigationTime,loading:i},l)),d&&r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiHorizontalRule,null),c&&r.a.createElement(n.EuiSpacer,{size:"l"}),r.a.createElement(A,{enrichments:d,dataTestSubj:"matches-with-no-type"})))},N=r.a.memo(D)},function(e,t,a){"use strict";a.d(t,"a",(function(){return M}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(40),l=a(44),c=a(126),u=a(46),d=a(3),p=a(8),m=a(215),b=a(255);let g,f;!function(e){e.asc="asc",e.desc="desc"}(g||(g={})),function(e){e.actions="responseActions",e.results="responseActionsResults"}(f||(f={}));var y=a(102);var h=a(1406),v=a(155),E=a(809);const x=({type:e})=>{const t=Object(n.useMemo)((()=>{if("endpoint"===e)return{icon:"logoSecurity",name:"Elastic Defend"}}),[e]);return i.a.createElement(o.EuiEmptyPrompt,{iconType:t.icon,title:i.a.createElement("h2",null,E.b),titleSize:"xs",body:i.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.responseActions.results.missingPrivileges",defaultMessage:"To access these results, ask your administrator for {integration} Kibana privileges.",values:{integration:i.a.createElement(o.EuiCode,null,t.name)}})})},j=({action:e,ruleName:t})=>{const{agent:a}=e,{action_id:r,expiration:s}=e.EndpointActions,{endpointPrivileges:{canAccessEndpointActionsLogManagement:p}}=Object(c.a)(),[b,v]=Object(n.useState)(!0),{data:E}=((e,{enabled:t,action:a,isLive:n=!1})=>{const{data:i}=Object(y.j)().services,{expiration:r,actionId:s,agent:o}=e;return Object(u.useQuery)({queryKey:["allResponsesResults",{actionId:s}],queryFn:async()=>{var e,t,a;const n=await Object(d.lastValueFrom)(i.search.search({actionId:s,expiration:r,sort:{order:g.desc,field:"@timestamp"},agents:(Array.isArray(o.id)?o.id:[o.id]).length,factoryQueryType:f.results},{strategy:m.l}));return{action_id:s,completedAt:null===(e=n.edges[0])||void 0===e||null===(t=e.fields)||void 0===t||null===(a=t["EndpointActions.completed_at"])||void 0===a?void 0:a[0],isExpired:n.isExpired,wasSuccessful:n.wasSuccessful,isCompleted:n.isCompleted,status:n.status}},select:e=>((e,t)=>{var a;const{rule:n}=e,{parameters:i,alert_id:r,comment:s,command:o,hosts:l}=e.EndpointActions.data;return{id:e.EndpointActions.action_id,agents:e.agent.id,parameters:i,...null!=r&&r.length?{alertIds:r}:{},...n?{ruleId:n.id,ruleName:n.name}:{},createdBy:(null===(a=e.rule)||void 0===a?void 0:a.name)||"unknown",comment:s,command:o,hosts:l,startedAt:e["@timestamp"],completedAt:null==t?void 0:t.completedAt,isCompleted:!(null==t||!t.isCompleted),isExpired:!(null==t||!t.isExpired),wasSuccessful:!(null==t||!t.isCompleted),status:t.status,agentState:{},errors:e.error?[e.error.message]:void 0}})(a,e),keepPreviousData:!0,enabled:t,refetchInterval:!!n&&5e3})})({actionId:r,expiration:s,agent:a},{enabled:p,action:e,isLive:b});Object(n.useEffect)((()=>{v((()=>{var e;return!E||!(null!==(e=E.errors)&&void 0!==e&&e.length)&&"pending"===E.status}))}),[E]);const j=E?S(E):"",k=Object(n.useMemo)((()=>null!=E&&E.hosts?Object.values(E.hosts)[0].name:""),[null==E?void 0:E.hosts]);return i.a.createElement(o.EuiComment,{username:t,timestamp:i.a.createElement(l.FormattedRelative,{value:e["@timestamp"]}),event:j,"data-test-subj":"endpoint-results-comment"},p?E?i.a.createElement(h.a,{action:E,"data-test-subj":`response-results-${k}`}):i.a.createElement(o.EuiLoadingSpinner,null):i.a.createElement(x,{type:"endpoint"}))},S=e=>{var t;return null!==(t=e.errors)&&void 0!==t&&t.length?v.g.failed(e.command):"pending"===e.status?v.g.pending(e.command):"successful"===e.status?v.g.executed(e.command):v.g.tried(e.command)},k=i.a.memo((({actions:e,ruleName:t,ecsData:a})=>{const{services:{osquery:r}}=Object(y.j)(),{OsqueryResult:s}=r,l=Object(n.useCallback)((e=>{if(O(e)){const n=e.action_id,r=e["@timestamp"];return i.a.createElement(s,{key:n,actionId:n,startDate:r,ruleName:t,ecsData:a})}return w(e)?i.a.createElement(j,{action:e,ruleName:t,key:e.EndpointActions.action_id}):null}),[s,a,t]);return i.a.createElement(i.a.Fragment,null,e.map((e=>i.a.createElement(i.a.Fragment,null,i.a.createElement(o.EuiSpacer,{size:"s"}),l(e),i.a.createElement(o.EuiSpacer,{size:"s"})))))}));k.displayName="ResponseActionsResults";const O=e=>e&&"input_type"in e&&"osquery"===(null==e?void 0:e.input_type),w=e=>e&&"EndpointActions"in e&&"endpoint"===(null==e?void 0:e.EndpointActions.input_type);var T=a(596),I=a(124);const C=s.a.div.withConfig({displayName:"TabContentWrapper",componentId:"sc-1y7ogme-0"})(["height:100%;position:relative;"]),M=({rawEventData:e,ecsData:t})=>{var a,n,r,s,c,h,E,x,j,S,O;const w=Object(I.a)("endpointResponseActionsEnabled"),M=e?Object(b.a)(e.fields):void 0,_=null==M||null===(a=M.kibana)||void 0===a||null===(n=a.alert)||void 0===n||null===(r=n.rule)||void 0===r||null===(s=r.parameters)||void 0===s?void 0:s[0].response_actions,F=!e||!w||!(null!=_&&_.length),A=null!==(c=null==e?void 0:e._id)&&void 0!==c?c:"",{data:D,isFetched:N}=((e,{enabled:t})=>{const{data:a}=Object(y.j)().services,{alertIds:n}=e;return Object(u.useQuery)({queryKey:["actions",{alertId:n[0]}],queryFn:async()=>{const e=await Object(d.lastValueFrom)(a.search.search({alertIds:n,sort:{order:g.desc,field:"@timestamp"},factoryQueryType:f.actions},{strategy:m.l})),t=Object(p.map)(Object(p.filter)(e.edges,"fields"),(e=>Object(b.a)(e.fields,!0)));return{...e,items:Object(p.compact)(t)}},enabled:t,keepPreviousData:!0})})({alertIds:[A]},{enabled:!F});if(F)return;const P=null==M||null===(h=M.kibana)||void 0===h||null===(E=h.alert)||void 0===E||null===(x=E.rule)||void 0===x||null===(j=x.name)||void 0===j?void 0:j[0],R=null!==(S=null==D||null===(O=D.items)||void 0===O?void 0:O.length)&&void 0!==S?S:0,L=i.a.createElement(i.a.Fragment,null,i.a.createElement(o.EuiSpacer,{size:"s"}),i.a.createElement(C,{"data-test-subj":"responseActionsViewWrapper"},N&&R&&null!=D&&D.items.length?i.a.createElement(k,{actions:D.items,ruleName:P,ecsData:t}):i.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.eventDetails.responseActionsViewNoActions",defaultMessage:"There are no response actions defined for this event."})));return{id:T.b.responseActionsView,"data-test-subj":"responseActionsViewTab",name:v.y,append:i.a.createElement(o.EuiNotificationBadge,{"data-test-subj":"response-actions-notification"},R),content:L}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return $}));var n=a(42),i=a(40),r=a(2),s=a.n(r),o=a(41),l=a.n(o),c=a(150),u=a(106),d=a(183),p=a(5);const m=p.i18n.translate("xpack.securitySolution.editDataProvider.doesNotExistLabel",{defaultMessage:"does not exist"}),b=p.i18n.translate("xpack.securitySolution.editDataProvider.existsLabel",{defaultMessage:"exists"}),g=p.i18n.translate("xpack.securitySolution.editDataProvider.fieldLabel",{defaultMessage:"Field"}),f=p.i18n.translate("xpack.securitySolution.editDataProvider.placeholder",{defaultMessage:"Select a field"}),y=p.i18n.translate("xpack.securitySolution.editDataProvider.isLabel",{defaultMessage:"is"}),h=p.i18n.translate("xpack.securitySolution.editDataProvider.isOneOfLabel",{defaultMessage:"is one of"}),v=p.i18n.translate("xpack.securitySolution.editDataProvider.isNotLabel",{defaultMessage:"is not"}),E=p.i18n.translate("xpack.securitySolution.editDataProvider.isNotOneOfLabel",{defaultMessage:"is not one of"}),x=p.i18n.translate("xpack.securitySolution.editDataProvider.includesPlaceholder",{defaultMessage:"enter one or more values"}),j=p.i18n.translate("xpack.securitySolution.editDataProvider.operatorLabel",{defaultMessage:"Operator"}),S=p.i18n.translate("xpack.securitySolution.editDataProvider.saveButton",{defaultMessage:"Save"}),k=p.i18n.translate("xpack.securitySolution.editDataProvider.valuePlaceholder",{defaultMessage:"value"}),O=p.i18n.translate("xpack.securitySolution.editDataProvider.valueLabel",{defaultMessage:"Value"}),w=p.i18n.translate("xpack.securitySolution.editDataProvider.selectAnOperatorPlaceholder",{defaultMessage:"Select an operator"}),T=e=>p.i18n.translate("xpack.securitySolution.editDataProvider.unavailableOperator",{values:{operator:e},defaultMessage:"{operator} operator is unavailable with templates"}),I=[{label:y},{label:v},{label:h},{label:E},{label:b},{label:m}],C=[],M=e=>e?Object.keys(e).sort().map((t=>{return{label:t,options:(a=e[t],null!=a.fields&&Object.keys(a.fields).length>0?Object.keys(a.fields):C).map((e=>({label:e})))};var a})):C,_=({browserFields:e,selectedField:t,selectedOperator:a,type:i})=>{const r=t.length>0?t[0].label:"",s=a.length>0?a[0].label:"",o=e&&null!=Object(d.a)(e)[r],l=-1!==Object(n.findIndex)((e=>e.label===s),I),c=i===u.a.template&&(s===h||s===E);return o&&l&&!c},F=e=>{switch(e.length>0?e[0].label:""){case y:case v:return c.d;case h:case E:return c.c;case b:case m:return c.b;default:return c.d}},A=e=>{switch(e.length>0?e[0].label:""){case v:case E:case m:return!0;default:return!1}},D=e=>Array.isArray(e)?e.length?`${e[0]}`:"":`${e}`;var N=a(148);const P=({value:e,onChangeCallback:t})=>{const[a,n]=Object(r.useState)(R(e));Object(r.useEffect)((()=>{t(L(a))}),[a,t]);const o=Object(r.useCallback)(((e,t=a)=>{const i=e.trim().toLowerCase();i&&-1===t.findIndex((e=>e.label.trim().toLowerCase()===i))&&n([...a,{label:e}])}),[a]),l=Object(r.useCallback)((e=>{n(e)}),[]);return s.a.createElement(i.EuiComboBox,{noSuggestions:!0,isClearable:!0,"data-test-subj":"is-one-of-combobox-input",selectedOptions:a,placeholder:x,onCreateOption:o,onChange:l})},R=e=>Object(N.k)(e)?e.map((e=>({label:String(e)}))):[],L=e=>e.map((e=>e.label)),B=({value:e,onChangeCallback:t})=>{const[a,n]=Object(r.useState)(q(e));Object(r.useEffect)((()=>{t(D(a))}),[a,t]);const o=Object(r.useCallback)((e=>{n(e.target.value)}),[]);return s.a.createElement(i.EuiFieldText,{className:"edit-data-provider-value",onChange:o,placeholder:k,value:D(a)})},q=e=>{var t;return Object(N.k)(e)?null!==(t=e[0])&&void 0!==t?t:"":e},z="edit-data-provider-save";l.a.div.withConfig({displayName:"HeaderContainer",componentId:"sc-1dznxok-0"})(["width:",";"],400).displayName="HeaderContainer";const $=s.a.memo((({andProviderId:e,browserFields:t,field:a,isExcluded:o,onDataProviderEdited:l,operator:u,providerId:d,timelineId:p,value:x,type:k=c.a.default})=>{const[C,D]=Object(r.useState)([{label:a}]),[N,R]=Object(r.useState)(((e,t)=>":"===t?e?[{label:v}]:[{label:y}]:"includes"===t?e?[{label:E}]:[{label:h}]:e?[{label:m}]:[{label:b}])(o,u)),[L,q]=Object(r.useState)(x),$=Object(r.useMemo)((()=>N.length>0&&(N[0].label===h||N[0].label===E)),[N]),V=Object(r.useMemo)((()=>k!==c.a.template&&N.length>0&&N[0].label!==b&&N[0].label!==m&&!$),[$,k,N]),U=Object(r.useMemo)((()=>$&&Array.isArray(L)&&!L.length),[$,L]),H=()=>{const e=document.getElementsByClassName("edit-data-provider-value");if(e.length>0)e[0].focus();else{const e=document.getElementsByClassName(z);e.length>0&&e[0].focus()}},G=Object(r.useCallback)((e=>{D(e),k===c.a.template&&q(`{${e[0].label}}`),H()}),[k]),Q=Object(r.useCallback)((e=>{R(e),H()}),[]),W=Object(r.useCallback)((e=>{q(e)}),[]),K=Object(r.useCallback)((()=>{l({andProviderId:e,excluded:A(N),field:C.length>0?C[0].label:"",id:p,operator:F(N),providerId:d,value:L,type:k})}),[l,e,N,C,p,d,L,k]);return Object(r.useEffect)((()=>((()=>{const e=void 0!==window.pageXOffset?window.pageXOffset:(document.documentElement||document.body.parentNode||document.body).scrollLeft,t=void 0!==window.pageYOffset?window.pageYOffset:(document.documentElement||document.body.parentNode||document.body).scrollTop;window.onscroll=()=>window.scrollTo(e,t)})(),()=>{window.onscroll=()=>n.noop})),[]),s.a.createElement(i.EuiPanel,{paddingSize:"s"},s.a.createElement(i.EuiFlexGroup,{direction:"column",gutterSize:"none"},s.a.createElement(i.EuiFlexItem,{grow:!0},s.a.createElement(i.EuiFormRow,{label:g},s.a.createElement(i.EuiComboBox,{autoFocus:!0,"data-test-subj":"field",isClearable:!1,onChange:G,options:M(t),placeholder:f,selectedOptions:C,singleSelection:{asPlainText:!0},fullWidth:!0}))),s.a.createElement(i.EuiFlexItem,{grow:!1},s.a.createElement(i.EuiSpacer,{size:"m"})),s.a.createElement(i.EuiFlexItem,{grow:!0},s.a.createElement(i.EuiFlexGroup,{gutterSize:"s",direction:"row",justifyContent:"spaceBetween"},s.a.createElement(i.EuiFlexItem,{grow:!0},s.a.createElement(i.EuiFormRow,{label:j},s.a.createElement(i.EuiComboBox,{"data-test-subj":"operator",isClearable:!1,onChange:Q,options:I,placeholder:w,selectedOptions:N,singleSelection:{asPlainText:!0},style:{minWidth:152}}))))),s.a.createElement(i.EuiFlexItem,{grow:!1},s.a.createElement(i.EuiSpacer,{size:"m"})),s.a.createElement(i.EuiFlexItem,{grow:!1},V&&s.a.createElement(i.EuiFormRow,{label:O},s.a.createElement(B,{onChangeCallback:W,value:x})),$&&k!==c.a.template&&s.a.createElement(i.EuiFormRow,{label:O},s.a.createElement(P,{onChangeCallback:W,value:x}))),s.a.createElement(i.EuiFlexItem,{grow:!1},s.a.createElement(i.EuiSpacer,{size:"m"})),s.a.createElement(i.EuiFlexItem,{grow:!1},k===c.a.template&&$&&s.a.createElement(s.a.Fragment,null,s.a.createElement(i.EuiCallOut,{color:"warning",iconType:"warning",size:"s",title:T(N[0].label)}),s.a.createElement(i.EuiSpacer,{size:"m"})),s.a.createElement(i.EuiFlexGroup,{justifyContent:"flexEnd",gutterSize:"none"},s.a.createElement(i.EuiFlexItem,{grow:!1},s.a.createElement(i.EuiButton,{className:z,color:"primary","data-test-subj":"save",fill:!0,isDisabled:!_({type:k,browserFields:t,selectedField:C,selectedOperator:N})||U,onClick:K,size:"m"},S))))))}));$.displayName="StatefulEditDataProvider"},function(e,t,a){"use strict";a.d(t,"a",(function(){return k}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(877),l=a(382);var c=a(5);c.i18n.translate("xpack.securitySolution.expandedValue.showTopN.showTopValues",{defaultMessage:"Show top values"}),c.i18n.translate("xpack.securitySolution.expandedValue.hideTopValues.HideTopValues",{defaultMessage:"Hide top values"});const u=c.i18n.translate("xpack.securitySolution.expandedValue.links.viewHostSummary",{defaultMessage:"View host summary"}),d=c.i18n.translate("xpack.securitySolution.expandedValue.links.viewUserSummary",{defaultMessage:"View user summary"}),p=c.i18n.translate("xpack.securitySolution.expandedValue.links.expandIpDetails",{defaultMessage:"Expand ip details"}),m=c.i18n.translate("xpack.securitySolution.expandedValue.links.viewRuleDetails",{defaultMessage:"View rule details"}),b=c.i18n.translate("xpack.securitySolution.expandedValue.links.viewPortDetails",{defaultMessage:"View port details"}),g=c.i18n.translate("xpack.securitySolution.expandedValue.links.viewRuleReference",{defaultMessage:"View rule reference"}),f=c.i18n.translate("xpack.securitySolution.expandedValue.links.viewEventReference",{defaultMessage:"View event reference"}),y=c.i18n.translate("xpack.securitySolution.expandedValue.links.viewIndicatorReference",{defaultMessage:"View indicator reference"});var h=a(188),v=a(167),E=a(395),x=a(380);a(102);const j=[{columnId:h.g,label:u},{columnId:"source.ip",fieldType:E.b,label:p},{columnId:"destination.ip",fieldType:E.b,label:p},{columnId:"signal.rule.name",label:m,linkField:"signal.rule.id"},...x.b.map((e=>({columnId:e,label:b}))),{columnId:h.m,label:g},{columnId:h.l,label:g},{columnId:h.e,label:f},{columnId:v.j,label:y},{columnId:h.p,label:d}],S=s.a.div.withConfig({displayName:"StyledContent",componentId:"sc-18lfxbd-0"})(["padding:",";width:100%;margin:0 auto;"],(({$isDetails:e})=>e?"0 8px":void 0)),k=({data:e,ecsData:t,eventId:a,header:r,isDetails:s,isDraggable:c,isTimeline:u,linkValues:d,rowRenderers:p,scopeId:m,truncate:b,asPlainText:g})=>{const f=Object(n.useMemo)((()=>{return void 0!==(e=r.id,t=r.type,a=r.linkField,j.find((n=>n.columnId===e||!(!n.fieldType||t!==n.fieldType||void 0===a&&void 0===n.linkField))))&&!u;var e,t,a}),[r.id,r.linkField,r.type,u]),y=Object(o.c)({data:e,fieldName:r.id}),h=s?"eui-textBreakWord":"eui-displayInlineBlock eui-textTruncate";return i.a.createElement(S,{className:h,$isDetails:s},((e,t,a)=>{const n=t.find((t=>t.isInstance(e,a)));return null!=n?n:(()=>{throw new Error("Unhandled Column Renderer")})()})(r.id,l.a,e).renderColumn({asPlainText:null!=g?g:f,columnName:r.id,ecsData:t,eventId:a,field:r,isDetails:s,isDraggable:c,linkValues:d,rowRenderers:p,scopeId:m,truncate:b,values:y}))}},function(e,t,a){"use strict";a.d(t,"a",(function(){return E}));var n=a(2),i=a.n(n),r=a(40),s=a(108),o=a(5);const l=o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.cancelTitle",{defaultMessage:"Cancel"}),c=o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.overwriteExceptionLabel",{defaultMessage:'Overwrite existing exception lists with conflicting "list_id"'}),u=o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.overwriteActionConnectorsLabel",{defaultMessage:'Overwrite existing connectors with conflicting action "id"'}),d=e=>o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importExceptionsFailedLabel",{values:{totalExceptions:e},defaultMessage:"Failed to import {totalExceptions} {totalExceptions, plural, =1 {exception} other {exceptions}}"}),p=e=>o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.importConnectorsFailedLabel",{values:{totalConnectors:e},defaultMessage:"Failed to import {totalConnectors} {totalConnectors, plural, =1 {connector} other {connectors}}"}),m=o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.actionConnectorsWarningButton",{defaultMessage:"Go to connectors"}),b=o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.actionConnectorsAdditionalPrivilegesError",{defaultMessage:"You need additional privileges to import rules with actions."}),g=(e,t,a)=>{const n=a.map((t=>e(t.error.message))),i=new Error(n.join(". "));return i.stack=void 0,i.name="Network errors",i.raw_network_error=t,i};var f=a(407);const y=({actionConnectorsWarnings:e,importedActionConnectorsCount:t})=>{const{http:a}=Object(f.b)().services;if(!t||!e.length)return null;const{actionPath:n,message:s,buttonLabel:l}=e[0];return i.a.createElement(r.EuiCallOut,{"data-test-subj":"actionConnectorsWarningsCallOut",size:"m",heading:"h2",iconType:"warning",title:i.a.createElement("span",{"data-test-subj":"actionConnectorsWarningsCallOutTitle"},(c=t,o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.actionConnectorsWarningTitle",{values:{totalConnectors:c},defaultMessage:"{totalConnectors} {totalConnectors, plural, =1 {connector} other {connectors}} imported"}))),color:"warning"},i.a.createElement(r.EuiFlexGroup,{direction:"column",gutterSize:"none"},i.a.createElement(r.EuiFlexItem,{"data-test-subj":"actionConnectorsWarningsCallOutMessage"},i.a.createElement(r.EuiText,{size:"xs"},s)),i.a.createElement(r.EuiFlexItem,null,i.a.createElement(r.EuiFlexGroup,{gutterSize:"none",direction:"columnReverse",alignItems:"flexEnd"},i.a.createElement(r.EuiButton,{"data-test-subj":"actionConnectorsWarningsCallOutButton",color:"warning",href:a.basePath.prepend(n)},l||m)))));var c};y.displayName="ActionConnectorWarningsComponent";const h=i.a.memo(y);h.displayName="ActionConnectorWarnings";const v=({checkBoxLabel:e,closeModal:t,description:a,errorMessage:m,failedDetailed:f,importComplete:y,importData:v,showCheckBox:E=!0,showExceptionsCheckBox:x=!1,showActionConnectorsCheckBox:j=!1,showModal:S,submitBtnText:k,subtitle:O,successMessage:w,title:T})=>{const[I,C]=Object(n.useState)(null),[M,_]=Object(n.useState)(!1),[F,A]=Object(n.useState)(!1),[D,N]=Object(n.useState)(!1),[P,R]=Object(n.useState)(!1),{addError:L,addSuccess:B}=Object(s.a)(),[q,z]=Object(n.useState)([]),[$,V]=Object(n.useState)(0),U=Object(n.useCallback)((()=>{t(),A(!1),N(!1),R(!1),z([])}),[t,A,N]),H=Object(n.useCallback)((e=>{_(!1),C(null),y(),e&&(y(),U())}),[U,y]),G=Object(n.useCallback)((async()=>{if(null!=I){_(!0);const e=new AbortController;try{const{action_connectors_warnings:t,...a}=await v({fileToImport:I[0],overwrite:F,overwriteExceptions:D,overwriteActionConnectors:P,signal:e.signal}),n=a.action_connectors_success_count;z(t),V(n),(({importResponse:e,exceptionsIncluded:t,actionConnectorsIncluded:a,successMessage:n,errorMessage:i,errorMessageDetailed:r,addError:s,addSuccess:l})=>{if(e.success)return e.success_count>0&&l(n(e.success_count)),t&&e.exceptions_success&&null!=e.exceptions_success_count&&e.exceptions_success_count>0&&l((u=e.exceptions_success_count,o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.exceptionsSuccessLabel",{values:{totalExceptions:u},defaultMessage:"Successfully imported {totalExceptions} {totalExceptions, plural, =1 {exception} other {exceptions}}."}))),void(a&&e.action_connectors_success&&null!=e.action_connectors_success_count&&e.action_connectors_success_count>0&&l((c=e.action_connectors_success_count,o.i18n.translate("xpack.securitySolution.detectionEngine.components.importRuleModal.connectorsSuccessLabel",{values:{totalConnectors:c},defaultMessage:"Successfully imported {totalConnectors} {totalConnectors, plural, =1 {connector} other {connectors}}."}))));var c,u;if(e.errors.length>0){if(a&&null!=e.action_connectors_errors&&e.action_connectors_errors.length>0){const{mappedErrors:t,numberOfActions:a}=(e=>{let t="";return{mappedErrors:e.map((e=>{const{id:a,error:n}=e;t=t&&t!==a?`${t},${a}`:a;const{status_code:i,message:r}=n||{};let s;return s=403===i?b:r,{...e,error:{...n,message:s}}})),numberOfActions:new Set(t&&[...t.split(",")]).size}})(e.action_connectors_errors);return s(g(r,e,t),{title:p(a||t.length)})}s(g(r,e,e.errors),{title:i(e.errors.length)}),t&&null!=e.exceptions_errors&&e.exceptions_errors.length>0&&s(g(r,e,e.exceptions_errors),{title:d(e.exceptions_errors.length)})}})({importResponse:a,exceptionsIncluded:x,actionConnectorsIncluded:j,successMessage:w,errorMessage:m,errorMessageDetailed:f,addError:L,addSuccess:B}),H(!(null!=t&&t.length))}catch(e){U(),L(e,{title:m(1)})}}}),[I,v,F,D,P,x,w,m,f,L,B,j,H,U]),Q=Object(n.useCallback)((()=>{U()}),[U]),W=Object(n.useCallback)((()=>{A((e=>!e))}),[]),K=Object(n.useCallback)((()=>{N((e=>!e))}),[]),Y=Object(n.useCallback)((()=>{R((e=>!e))}),[]);return i.a.createElement(i.a.Fragment,null,S&&i.a.createElement(r.EuiModal,{onClose:Q,maxWidth:"750px"},i.a.createElement(r.EuiModalHeader,null,i.a.createElement(r.EuiModalHeaderTitle,null,T)),i.a.createElement(r.EuiModalBody,null,i.a.createElement(r.EuiText,{size:"s"},i.a.createElement("h4",null,a)),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(r.EuiFilePicker,{"data-test-subj":"rule-file-picker",accept:".ndjson",id:"rule-file-picker",initialPromptText:O,onChange:e=>{C(e&&e.length>0?e:null)},display:"large",fullWidth:!0,isLoading:M}),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(h,{actionConnectorsWarnings:q,importedActionConnectorsCount:$}),i.a.createElement(r.EuiSpacer,{size:"s"}),E&&i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiCheckbox,{"data-test-subj":"importDataModalCheckboxLabel",id:"importDataModalCheckboxLabel",label:e,checked:F,onChange:W}),x&&i.a.createElement(r.EuiCheckbox,{"data-test-subj":"importDataModalExceptionsCheckboxLabel",id:"importDataModalExceptionsCheckboxLabel",label:c,checked:D,onChange:K}),j&&i.a.createElement(r.EuiCheckbox,{"data-test-subj":"importDataModalActionConnectorsCheckbox",id:"importDataModalActionConnectorsCheckbox",label:u,checked:P,onChange:Y}))),i.a.createElement(r.EuiModalFooter,null,i.a.createElement(r.EuiButtonEmpty,{onClick:Q},l),i.a.createElement(r.EuiButton,{"data-test-subj":"import-data-modal-button",onClick:G,disabled:null==I||M,fill:!0},k))))};v.displayName="ImportDataModalComponent";const E=i.a.memo(v);E.displayName="ImportDataModal"},function(e,t,a){"use strict";a.d(t,"a",(function(){return A}));var n=a(42),i=a(40),r=a(2),s=a.n(r),o=a(287),l=a(41),c=a.n(l),u=a(59),d=a(119),p=a(115),m=a(701),b=a(111),g=a(183),f=a(730),y=a(133),h=a(8),v=a(240),E=a.n(v),x=a(165),j=a(155),S=a(812),k=a(751),O=a(217),w=a(5);const T=s.a.memo((({data:e,field:t,fieldMapping:a,scripted:n})=>{const r=function(e){switch(e){case"boolean":return w.i18n.translate("xpack.securitySolution.fieldNameIcons.booleanAriaLabel",{defaultMessage:"Boolean field"});case"conflict":return w.i18n.translate("xpack.securitySolution.fieldNameIcons.conflictFieldAriaLabel",{defaultMessage:"Conflicting field"});case"date":return w.i18n.translate("xpack.securitySolution.fieldNameIcons.dateFieldAriaLabel",{defaultMessage:"Date field"});case"geo_point":return w.i18n.translate("xpack.securitySolution.fieldNameIcons.geoPointFieldAriaLabel",{defaultMessage:"Geo point field"});case"geo_shape":return w.i18n.translate("xpack.securitySolution.fieldNameIcons.geoShapeFieldAriaLabel",{defaultMessage:"Geo shape field"});case"ip":return w.i18n.translate("xpack.securitySolution.fieldNameIcons.ipAddressFieldAriaLabel",{defaultMessage:"IP address field"});case"murmur3":return w.i18n.translate("xpack.securitySolution.fieldNameIcons.murmur3FieldAriaLabel",{defaultMessage:"Murmur3 field"});case"number":return w.i18n.translate("xpack.securitySolution.fieldNameIcons.numberFieldAriaLabel",{defaultMessage:"Number field"});case"source":return w.i18n.translate("xpack.securitySolution.fieldNameIcons.sourceFieldAriaLabel",{defaultMessage:"Source field"});case"string":return w.i18n.translate("xpack.securitySolution.fieldNameIcons.stringFieldAriaLabel",{defaultMessage:"String field"});case"nested":return w.i18n.translate("xpack.securitySolution.fieldNameIcons.nestedFieldAriaLabel",{defaultMessage:"Nested field"});default:return w.i18n.translate("xpack.securitySolution.fieldNameIcons.unknownFieldAriaLabel",{defaultMessage:"Unknown field"})}}(e.type),o=a&&a.displayName?a.displayName:t,l=o!==t?`${t} (${o})`:t,c=null==a?void 0:a.isSubtypeMulti();return s.a.createElement(s.a.Fragment,null,s.a.createElement(i.EuiFlexItem,{grow:!1,className:"eventFieldsTable__fieldIcon"},s.a.createElement(k.a,{"data-test-subj":"field-type-icon",type:e.type,label:r,scripted:n})),s.a.createElement(i.EuiFlexGroup,{wrap:!0,gutterSize:"none",responsive:!1,alignItems:"flexStart","data-test-subj":"field-name-cell"},s.a.createElement(i.EuiFlexItem,{className:"eventFieldsTable__fieldName eui-textBreakAll",grow:!1},s.a.createElement(i.EuiToolTip,{position:"top",content:Object(h.isEmpty)(e.description)?l:`${e.description} ${Object(O.c)(e.example)}`,delay:"long",anchorClassName:"eui-textBreakAll"},s.a.createElement(i.EuiText,{size:"xs","data-test-subj":"field-name"},t))),c&&s.a.createElement(i.EuiToolTip,{position:"top",delay:"long",content:j.t},s.a.createElement(i.EuiBadge,{title:"",className:"eventFieldsTable__multiFieldBadge",color:"default","data-test-subj":`eventFieldsTableRow-${t}-multifieldBadge`},j.s))))}));T.displayName="FieldNameCell",c()(i.EuiPanel).withConfig({displayName:"HoverActionsContainer",componentId:"sc-172eod5-0"})(["align-items:center;display:flex;flex-direction:row;height:25px;justify-content:center;left:5px;position:absolute;top:-10px;width:30px;"]).displayName="HoverActionsContainer";const I=E()(((e,t)=>Object(h.get)(t,e)),((e,t)=>e[0].join()===t[0].join()));var C=a(105);const M=c.a.div.withConfig({displayName:"TableWrapper",componentId:"sc-ljv1sr-0"})(["display:flex;flex:1;overflow:hidden;> div{display:flex;flex-direction:column;flex:1;overflow:hidden;> .euiFlexGroup:first-of-type{flex:0;}}"]),_=c()(i.EuiInMemoryTable).withConfig({displayName:"StyledEuiInMemoryTable",componentId:"sc-ljv1sr-1"})(["flex:1;overflow:auto;overflow-x:hidden;&::-webkit-scrollbar{height:",";width:",";}&::-webkit-scrollbar-thumb{background-clip:content-box;background-color:",";border:"," solid transparent;}&::-webkit-scrollbar-corner,&::-webkit-scrollbar-track{background-color:transparent;}.eventFieldsTable__fieldIcon{padding-top:","px;}.eventFieldsTable__fieldName{line-height:",";padding:",";}.inlineActions{opacity:0;}.eventFieldsTable__tableRow{font-size:",";font-family:",";.inlineActions-popoverOpen{opacity:1;}&:hover{.inlineActions{opacity:1;}}}.eventFieldsTable__actionCell,.eventFieldsTable__fieldNameCell{align-items:flex-start;padding:",";}.eventFieldsTable__fieldValue{display:inline-block;word-break:break-all;word-wrap:break-word;white-space:pre-wrap;line-height:",";color:",";vertical-align:top;}"],(({theme:e})=>e.eui.euiScrollBar),(({theme:e})=>e.eui.euiScrollBar),(({theme:e})=>Object(o.rgba)(e.eui.euiColorDarkShade,.5)),(({theme:e})=>e.eui.euiScrollBarCorner),(({theme:e})=>1.5*parseFloat(e.eui.euiSizeXS)),(({theme:e})=>e.eui.euiLineHeight),(({theme:e})=>e.eui.euiSizeXS),(({theme:e})=>e.eui.euiFontSizeXS),(({theme:e})=>e.eui.euiCodeFontFamily),(({theme:e})=>e.eui.euiSizeXS),(({theme:e})=>e.eui.euiLineHeight),(({theme:e})=>e.eui.euiColorFullShade)),F=[25,50,100],A=s.a.memo((({browserFields:e,data:t,eventId:a,isDraggable:o,timelineTabType:l,scopeId:c,isReadOnly:h})=>{const v=Object(r.useRef)(null),E=Object(r.useMemo)((()=>Object(p.isTimelineScope)(c)?b.b.getTimelineByIdSelector():Object(p.isInTableScope)(c)?d.j.getTableByIdSelector():void 0),[c]),k=Object(p.isTimelineScope)(c)?y.b:d.q,w=Object(C.a)((t=>{var a;const{columns:n}=null!==(a=E&&E(t,c))&&void 0!==a?a:k;return Object(f.b)(n,e)})),A=Object(r.useMemo)((()=>Object(g.a)(e)),[e]),D=Object(r.useMemo)((()=>Object(n.sortBy)(["field"],t).map(((e,t)=>({...e,...A[e.field],valuesConcatenated:null!=e.values?e.values.join():"",ariaRowindex:Object(u.arrayIndexToAriaIndex)(t)})))),[t,A]),N=Object(r.useCallback)((e=>{var a;const i=(null!==(a=w.find((t=>t.id===e)))&&void 0!==a?a:{}).linkField;if(!i)return null;const r=(null!=t?t:[]).find((e=>e.field===i)),s=Object(n.getOr)(null,"originalValue",r);return Array.isArray(s)?s[0]:s}),[t,w]),P=Object(r.useCallback)((({ariaRowindex:e,field:t})=>({...null!=e?{"data-rowindex":e}:{},className:"eventFieldsTable__tableRow","data-test-subj":`event-fields-table-row-${t}`})),[]),R=Object(r.useMemo)((()=>(({browserFields:e,eventId:t,contextId:a,scopeId:n,getLinkValue:r,isDraggable:o,isReadOnly:l})=>[...l?[]:[{field:"values",name:s.a.createElement(i.EuiText,{size:"xs"},s.a.createElement("strong",null,j.a)),sortable:!1,truncateText:!1,width:"132px",render:(e,t)=>s.a.createElement(x.c,{data:{field:t.field,value:e},triggerId:x.d.DETAILS_FLYOUT,mode:x.a.INLINE,visibleCellActions:3,sourcererScopeId:Object(p.getSourcererScopeId)(n),metadata:{scopeId:n,isObjectArray:t.isObjectArray}})}],{field:"field",className:"eventFieldsTable__fieldNameCell",name:s.a.createElement(i.EuiText,{size:"xs"},s.a.createElement("strong",null,j.k)),sortable:!0,truncateText:!1,render:(e,t)=>s.a.createElement(T,{data:t,field:e,fieldMapping:void 0})},{field:"values",className:"eventFieldsTable__fieldValueCell",name:s.a.createElement(i.EuiText,{size:"xs"},s.a.createElement("strong",null,j.E)),sortable:!0,truncateText:!1,render:(n,i)=>{const l=I([i.category,"fields",i.field],e);return s.a.createElement(S.a,{contextId:a,data:i,eventId:t,fieldFromBrowserField:l,getLinkValue:r,isDraggable:o,values:n})}}])({browserFields:e,eventId:a,contextId:`event-fields-browser-for-${c}-${l}`,scopeId:c,getLinkValue:N,isDraggable:o,isReadOnly:h})),[e,a,c,l,N,o,h]),L=Object(r.useCallback)((()=>{var e,t;null===(e=v.current)||void 0===e||null===(t=e.querySelector('input[type="search"]'))||void 0===t||t.focus()}),[]),B=Object(r.useCallback)((()=>{var e;null===(e=document.querySelector(`.${m.a}`))||void 0===e||e.focus()}),[]),q=Object(r.useCallback)((e=>{Object(u.isTab)(e)?Object(O.f)({containerElement:v.current,keyboardEvent:e,onSkipFocusBeforeEventsTable:L,onSkipFocusAfterEventsTable:B}):Object(u.onKeyDownFocusHandler)({colindexAttribute:u.DATA_COLINDEX_ATTRIBUTE,containerElement:null==v?void 0:v.current,event:e,maxAriaColindex:3,maxAriaRowindex:t.length,onColumnFocused:n.noop,rowindexAttribute:u.DATA_ROWINDEX_ATTRIBUTE})}),[t,B,L]);Object(r.useEffect)((()=>{L()}),[L]);const{onTableChange:z,paginationTableProp:$}=(()=>{const[e,t]=Object(r.useState)({pageIndex:0});return{onTableChange:Object(r.useCallback)((({page:{index:e}})=>{t({pageIndex:e})}),[]),paginationTableProp:Object(r.useMemo)((()=>({...e,pageSizeOptions:F})),[e])}})();return s.a.createElement(M,{onKeyDown:q,ref:v},s.a.createElement(_,{className:O.a,items:D,itemId:"field",columns:R,onTableChange:z,pagination:$,rowProps:P,search:O.g,sorting:!1,"data-test-subj":"event-fields-browser"}))}));A.displayName="EventFieldsBrowser"},function(e,t,a){"use strict";a.d(t,"a",(function(){return m}));var n=a(2),i=a.n(n),r=a(103),s=a(656),o=a(299),l=a(151),c=a(114),u=a(457),d=a(312);const p=({combinedQueries:e,filters:t,headerChildren:a,onlyField:p,paddingSize:m,query:b,showLegend:g,setAbsoluteRangeDatePickerTarget:f=c.a.global,runtimeMappings:y,hideQueryToggle:h=!1})=>{const v=Object(r.useDispatch)(),{signalIndexName:E}=Object(o.a)(),x=(j=t,Object(n.useMemo)((()=>[...j,...Object(d.d)(!1)]),[j]));var j;const S=Object(n.useCallback)((({x:e})=>{if(!e)return;const[t,a]=e;v(Object(l.setAbsoluteRangeDatePicker)({id:f,from:new Date(t).toISOString(),to:new Date(a).toISOString()}))}),[v,f]);return i.a.createElement(s.a,{combinedQueries:e,filters:x,headerChildren:a,legendPosition:"right",onlyField:p,paddingSize:m,query:b,showLegend:g,showLinkToAlerts:null==p,showStackBy:null==p,showTotalAlertsCount:!0,signalIndexName:E,runtimeMappings:y,title:u.b,titleSize:null==p?"m":"s",updateDateRange:S,hideQueryToggle:h})};p.displayName="SignalsByCategoryComponent";const m=i.a.memo(p)},function(e,t,a){"use strict";a.d(t,"a",(function(){return L}));var n=a(42),i=a(2),r=a.n(i),s=a(103),o=a(106),l=a(105),c=a(111),u=a(40),d=a(53),p=a.n(d),m=a(41),b=a.n(m),g=a(117),f=a(638),y=a(150),h=a(484);const v=b()(u.EuiBadge).withConfig({displayName:"ProviderBadgeStyled",componentId:"sc-l32wgy-0"})([".euiToolTipAnchor{&::after{font-style:normal;content:'|';padding:0px 3px;}}&.globalFilterItem{white-space:nowrap;min-width:",";display:flex;&.globalFilterItem-isDisabled{text-decoration:line-through;font-weight:400;font-style:italic;}&.globalFilterItem-isError{box-shadow:0 1px 1px -1px rgba(152,162,179,0.2),0 3px 2px -2px rgba(152,162,179,0.2),inset 0 0 0 1px #bd271e;}}"],(({$timelineType:e})=>e===o.l.template?"140px":"none"));v.displayName="ProviderBadgeStyled";const E=b.a.div.withConfig({displayName:"ProviderFieldBadge",componentId:"sc-l32wgy-1"})(["display:block;color:#fff;padding:6px 8px;font-size:0.6em;"]),x=b()(E).withConfig({displayName:"StyledTemplateFieldBadge",componentId:"sc-l32wgy-2"})(["background:",";text-transform:uppercase;"],(({theme:e})=>e.eui.euiColorVis3_behindText)),j=b()(E).withConfig({displayName:"ConvertFieldBadge",componentId:"sc-l32wgy-3"})(["background:",";cursor:pointer;&:hover{text-decoration:underline;}"],(({theme:e})=>e.eui.euiColorDarkShade)),S=({type:e,toggleType:t})=>e!==y.a.template?r.a.createElement(j,{onClick:t},h.d):r.a.createElement(x,null,h.v),k=r.a.memo(S),O={tabIndex:-1},w=r.a.memo((({deleteProvider:e,field:t,isEnabled:a,isExcluded:s,operator:l,providerId:c,togglePopover:u,toggleType:d,displayValue:m,val:b,type:E,timelineType:x})=>{const j=Object(i.useCallback)((t=>{t.stopPropagation&&t.stopPropagation(),e()}),[e]),S=Object(i.useMemo)((()=>p()("globalFilterItem",{"globalFilterItem-isDisabled":!a,"globalFilterItem-isExcluded":s})),[a,s]),w=Object(i.useMemo)((()=>Object(n.isString)(b)&&""===b?Object(g.b)():b),[b]),T=Object(i.useMemo)((()=>s?r.a.createElement("span",null,h.p," "):null),[s]),I=Object(i.useMemo)((()=>r.a.createElement(r.a.Fragment,null,T,l!==y.b?r.a.createElement("span",{className:"field-value"},`${t}: "${"includes"===l?m:w}"`):r.a.createElement("span",{className:"field-value"},t," ",h.j))),[m,t,w,l,T]),C=Object(i.useMemo)((()=>h.u({field:t,value:`${w}`})),[t,w]);return r.a.createElement(f.a,{id:`${c}-${t}-${b}`},r.a.createElement(r.a.Fragment,null,r.a.createElement(v,{className:S,color:"hollow",title:"",iconOnClick:j,iconOnClickAriaLabel:h.s,iconType:"cross",iconSide:"right",onClick:u,onClickAriaLabel:C,closeButtonProps:O,"data-test-subj":"providerBadge",$timelineType:x},I),x===o.l.template&&l!==y.c&&r.a.createElement(k,{toggleType:d,type:E})))}));w.displayName="ProviderBadge";var T=a(0),I=a.n(T),C=a(945);const M="edit-data-provider",_="exclude-data-provider",F="enable-data-provider",A="filter-for-field-present-data-provider",D="delete-data-provider",N=b()(u.EuiPopover).withConfig({displayName:"MyEuiPopover",componentId:"sc-2zwix7-0"})(["height:100%;user-select:none;"]);N.displayName="MyEuiPopover";class provider_item_actions_ProviderItemActions extends r.a.PureComponent{constructor(...e){super(...e),I()(this,"onDataProviderEdited",(({andProviderId:e,excluded:t,field:a,id:n,operator:i,providerId:r,value:s,type:o})=>{null!=this.props.onDataProviderEdited&&this.props.onDataProviderEdited({andProviderId:e,excluded:t,field:a,id:n,operator:i,providerId:r,value:s,type:o}),this.props.closePopover()})),I()(this,"onFilterForFieldPresent",(()=>{const{andProviderId:e,field:t,timelineId:a,providerId:n,value:i,type:r}=this.props;null!=this.props.onDataProviderEdited&&this.props.onDataProviderEdited({andProviderId:e,excluded:!1,field:t,id:`${a}`,operator:y.b,providerId:n,value:i,type:r}),this.props.closePopover()}))}render(){const{andProviderId:e,browserFields:t,button:a,closePopover:n,deleteProvider:i,field:s,isEnabled:l,isExcluded:c,isLoading:d,isOpen:p,operator:m,providerId:b,timelineId:g,timelineType:f,toggleEnabledProvider:v,toggleExcludedProvider:E,toggleTypeProvider:x,value:j,type:S}=this.props,k=(({andProviderId:e,browserFields:t,deleteItem:a,field:n,isEnabled:i,isExcluded:s,isLoading:l,operator:c,onDataProviderEdited:u,onFilterForFieldPresent:d,providerId:p,timelineId:m,timelineType:b,toggleEnabled:g,toggleExcluded:f,toggleType:v,type:E,value:x})=>[{id:0,items:[{className:M,disabled:l,icon:"pencil",name:h.g,panel:1},{className:_,disabled:l,icon:s?"plusInCircle":"minusInCircle",name:s?h.o:h.i,onClick:f},{className:F,disabled:l,icon:i?"eyeClosed":"eye",name:i?h.w:h.t,onClick:g},{className:A,disabled:l,icon:"logstashFilter",name:h.k,onClick:d},b===o.l.template?{className:"convert-to-field-data-provider",disabled:l||c===y.c,icon:"visText",name:E===y.a.template?h.c:h.d,onClick:v}:{name:null},{className:D,disabled:l,icon:"trash",name:h.e,onClick:a}].filter((e=>null!=e.name))},{content:null!=t&&null!=m&&null!=u?r.a.createElement(C.a,{andProviderId:e,browserFields:t,field:n,isExcluded:s,onDataProviderEdited:u,operator:c,providerId:p,timelineId:m,value:x,type:E}):null,id:1,title:h.h,width:400}])({andProviderId:e,browserFields:t,deleteItem:i,field:s,isEnabled:l,isExcluded:c,isLoading:d,onDataProviderEdited:this.onDataProviderEdited,onFilterForFieldPresent:this.onFilterForFieldPresent,operator:m,providerId:b,timelineId:g,timelineType:f,toggleEnabled:v,toggleExcluded:E,toggleType:x,value:j,type:S});return r.a.createElement(N,{id:`popoverFor_${b}-${s}-${j}`,isOpen:p,closePopover:n,button:a,anchorPosition:"downCenter",panelPaddingSize:"none",ownFocus:!0},r.a.createElement("div",{style:{userSelect:"none"}},r.a.createElement(u.EuiContextMenu,{initialPanelId:0,panels:k,"data-test-subj":"providerActions"})))}}var P=a(227),R=a(133);const L=r.a.memo((({andProviderId:e,browserFields:t,deleteProvider:a,field:u,kqlQuery:d,isEnabled:p,isExcluded:m,isPopoverOpen:b,onDataProviderEdited:g,operator:f,providerId:h,register:v,setIsPopoverOpen:E,timelineId:x,toggleEnabledProvider:j,toggleExcludedProvider:S,toggleTypeProvider:k,displayValue:O,val:T,type:I=y.a.default,wrapperRef:C})=>{const M=Object(i.useMemo)((()=>c.b.getTimelineByIdSelector()),[]),_=Object(l.b)((e=>{var t,a;return x&&null!==(t=null===(a=M(e,x))||void 0===a?void 0:a.timelineType)&&void 0!==t?t:o.l.default})),{isLoading:F}=Object(l.a)((e=>{var t;return null!==(t=M(e,null!=x?x:""))&&void 0!==t?t:R.b})),A=Object(i.useCallback)((()=>{E(!b)}),[b,E]),D=Object(i.useCallback)((()=>{var e;E(!1),null==C||null===(e=C.current)||void 0===e||e.focus()}),[C,E]),N=Object(i.useCallback)((()=>{j(),D()}),[D,j]),L=Object(i.useCallback)((()=>{S(),D()}),[S,D]),B=Object(i.useCallback)((()=>{k(),D()}),[k,D]),[q,z]=Object(i.useState)(!1),$=Object(s.useDispatch)();Object(i.useEffect)((()=>{null!=v&&($(P.a.registerProvider({provider:{...v,and:[]}})),z(!0))}),[q,$,v,z]);const V=Object(i.useCallback)((()=>{q&&null!=v&&$(P.a.unRegisterProvider({id:v.id}))}),[q,$,v]);Object(i.useEffect)((()=>()=>{V()}),[V]);const U=Object(i.useMemo)((()=>r.a.createElement(w,{deleteProvider:F?n.noop:a,field:u,kqlQuery:d,isEnabled:p,isExcluded:m,providerId:h,togglePopover:A,toggleType:B,displayValue:null!=O?O:String(T),val:T,operator:f,type:I,timelineType:_})),[a,O,u,p,m,F,d,B,f,h,_,A,I,T]);return r.a.createElement(provider_item_actions_ProviderItemActions,{andProviderId:e,browserFields:t,button:U,closePopover:D,deleteProvider:a,field:u,kqlQuery:d,isEnabled:p,isExcluded:m,isLoading:F,isOpen:b,onDataProviderEdited:g,operator:f,providerId:h,timelineId:x,timelineType:_,toggleEnabledProvider:N,toggleExcludedProvider:L,toggleTypeProvider:B,value:T,type:I})}));L.displayName="ProviderItemBadge"},function(e,t,a){"use strict";a.d(t,"b",(function(){return A})),a.d(t,"a",(function(){return D}));var n=a(2),i=a.n(n),r=a(40),s=a(41),o=a.n(s),l=a(103),c=a(119),u=a(115),d=a(102),p=a(5);const m=p.i18n.translate("xpack.securitySolution.timeline.graphOverlay.closeAnalyzerButton",{defaultMessage:"Close analyzer"}),b=p.i18n.translate("xpack.securitySolution.timeline.graphOverlay.closeSessionButton",{defaultMessage:"Close session viewer"});var g=a(118),f=a(111),y=a(116),h=a(302),v=a(133),E=a(105),x=a(690),j=a(110),S=a(529),k=a(4),O=a(459),w=a(497),T=a(178),I=a(518),C=a(126);const M=o()(r.EuiButtonIcon).withConfig({displayName:"FullScreenButtonIcon",componentId:"sc-tyt961-0"})(["margin:4px 0 4px 0;"]),_=({fullScreen:e,globalFullScreen:t,onCloseOverlay:a,isActiveTimelines:n,timelineFullScreen:s,toggleFullScreen:o,graphEventId:l,activeTab:c})=>i.a.createElement(r.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButtonEmpty,{iconType:"cross",onClick:a,size:"xs","data-test-subj":"close-overlay"},n?c===g.d.graph?m:b:l?m:b)),!1===n&&i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiToolTip,{content:e?w.a:O.d},i.a.createElement(M,{"aria-label":Object(S.b)({globalFullScreen:t,isActiveTimelines:n,timelineFullScreen:s})?w.a:O.d,className:e?k.yb:"",color:e?"ghost":"primary","data-test-subj":"full-screen",iconType:"fullScreen",onClick:o}))));_.displayName="NavigationComponent";const F=i.a.memo(_),A=({scopeId:e})=>{const t=Object(l.useDispatch)(),a=Object(n.useMemo)((()=>Object(u.isTimelineScope)(e)?f.b.getTimelineByIdSelector():Object(u.isInTableScope)(e)?c.j.getTableByIdSelector():void 0),[e]),{globalFullScreen:r,setGlobalFullScreen:s}=Object(T.a)(),{timelineFullScreen:o,setTimelineFullScreen:d}=Object(T.c)(),p=Object(u.isTimelineScope)(e)?v.b:c.q,{graphEventId:m,sessionViewConfig:b,activeTab:y,prevActiveTab:h}=Object(E.a)((t=>{var n;return{activeTab:v.b.activeTab,prevActiveTab:v.b.prevActiveTab,...null!==(n=a&&a(t,e))&&void 0!==n?n:p}})),x=Object(u.getScopedActions)(e),j=Object(n.useCallback)((()=>{null!==document.querySelector(".euiDataGrid--fullScreen")?Object(u.isActiveTimeline)(e)?document.body.classList.add("euiDataGrid__restrictBody"):document.body.classList.add(k.pc,"euiDataGrid__restrictBody"):Object(u.isActiveTimeline)(e)?d(!1):s(!1),!1===Object(u.isActiveTimeline)(e)?x&&(t(x.updateGraphEventId({id:e,graphEventId:""})),t(x.updateSessionViewConfig({id:e,sessionViewConfig:null}))):y===g.d.graph?(x&&t(x.updateGraphEventId({id:e,graphEventId:""})),h!==g.d.session||b||t(f.a.setActiveTabTimeline({id:e,activeTab:g.d.query}))):y===g.d.session&&(Object(u.isTimelineScope)(e)&&(h!==g.d.graph||m?t(f.a.setActiveTabTimeline({id:e,activeTab:h})):t(f.a.setActiveTabTimeline({id:e,activeTab:g.d.query}))),x&&t(x.updateSessionViewConfig({id:e,sessionViewConfig:null})))}),[d,s,x,t,e,y,h,b,m]),O=Object(n.useMemo)((()=>Object(S.b)({globalFullScreen:r,isActiveTimelines:Object(u.isActiveTimeline)(e),timelineFullScreen:o})),[r,e,o]),w=Object(n.useCallback)((()=>{Object(u.isActiveTimeline)(e)?d(!o):s(!r)}),[e,d,o,s,r]),I=Object(n.useMemo)((()=>i.a.createElement(F,{fullScreen:O,globalFullScreen:r,activeTab:y,onCloseOverlay:j,isActiveTimelines:Object(u.isActiveTimeline)(e),timelineFullScreen:o,toggleFullScreen:w,graphEventId:m})),[O,r,y,j,e,o,w,m]);return{onCloseOverlay:j,Navigation:I}},D=({scopeId:e,entityType:t,height:a})=>{const{sessionView:r}=Object(d.j)().services,s=Object(n.useMemo)((()=>Object(u.isTimelineScope)(e)?f.b.getTimelineByIdSelector():Object(u.isInTableScope)(e)?c.j.getTableByIdSelector():void 0),[e]),{globalFullScreen:o}=Object(T.a)(),{timelineFullScreen:p}=Object(T.c)(),{canReadPolicyManagement:m}=Object(C.a)().endpointPrivileges,b=Object(u.isTimelineScope)(e)?v.b:c.q,{sessionViewConfig:k,activeTab:O}=Object(E.a)((t=>{var a;return{activeTab:v.b.activeTab,prevActiveTab:v.b.prevActiveTab,...null!==(a=s&&s(t,e))&&void 0!==a?a:b}})),w=Object(n.useMemo)((()=>Object(S.b)({globalFullScreen:o,isActiveTimelines:Object(u.isActiveTimeline)(e),timelineFullScreen:p})),[o,e,p]),M=Object(n.useMemo)((()=>Object(u.isActiveTimeline)(e)?j.SourcererScopeName.timeline:I.a.includes(e)?j.SourcererScopeName.detections:j.SourcererScopeName.default),[e]),{openEventDetailsPanel:_,shouldShowDetailsPanel:F,DetailsPanel:A}=(({entityType:e,isFlyoutView:t,sourcererScope:a,scopeId:r,tabType:s=g.d.query})=>{const{browserFields:o,selectedPatterns:d,runtimeMappings:p}=Object(y.d)(a),m=Object(l.useDispatch)(),b=Object(n.useMemo)((()=>Object(u.isTimelineScope)(r)?f.b.getTimelineByIdSelector():Object(u.isInTableScope)(r)?c.j.getTableByIdSelector():void 0),[r]),j=Object(n.useMemo)((()=>d.join(",")),[d]),S=Object(E.a)((e=>{var t,a;return null===(t=null!==(a=b&&b(e,r))&&void 0!==a?a:v.b)||void 0===t?void 0:t.expandedDetail})),k=Object(n.useRef)((()=>{})),O=()=>{},w=Object(n.useMemo)((()=>{var e;return!!(s&&S&&S[s]&&null!==(e=S[s])&&void 0!==e&&e.panelView)}),[S,s]),T=Object(u.getScopedActions)(r),I=Object(n.useCallback)((e=>{e&&T&&m(T.toggleDetailPanel({...e,tabType:s,id:r}))}),[T,r,m,s]),C=Object(n.useCallback)(((e,t)=>{e&&I({panelView:"eventDetail",params:{eventId:e,indexName:j}}),k.current=null!=t?t:O}),[I,j]),M=Object(n.useCallback)(((e,t)=>{I({panelView:"hostDetail",params:{hostName:e}}),k.current=null!=t?t:O}),[I]),_=Object(n.useCallback)(((e,t,a)=>{I({panelView:"networkDetail",params:{ip:e,flowTarget:t}}),k.current=null!=a?a:O}),[I]),F=Object(n.useCallback)(((e,t)=>{I({panelView:"userDetail",params:{userName:e}}),k.current=null!=t?t:O}),[I]),A=Object(n.useCallback)((()=>{var e;k.current&&k.current(),T&&m(T.toggleDetailPanel({tabType:s,id:r})),s&&null!==(e=S[s])&&void 0!==e&&e.panelView&&r===g.c.active&&w&&h.a.toggleExpandedDetail({})}),[T,s,S,r,w,m]),D=Object(n.useMemo)((()=>w?i.a.createElement(x.a,{browserFields:o,entityType:e,handleOnPanelClosed:A,isFlyoutView:t,runtimeMappings:p,tabType:s,scopeId:r}):null),[o,e,A,t,p,w,s,r]);return{openEventDetailsPanel:C,openHostDetailsPanel:M,openNetworkDetailsPanel:_,openUserDetailsPanel:F,handleOnDetailsPanelClosed:A,shouldShowDetailsPanel:w,DetailsPanel:D}})({isFlyoutView:!Object(u.isActiveTimeline)(e),entityType:t,sourcererScope:M,scopeId:e,tabType:Object(u.isActiveTimeline)(e)?O:g.d.query}),D=Object(n.useMemo)((()=>{const e=a?a-118:void 0;return null!==k?r.getSessionView({...k,loadAlertDetails:_,isFullScreen:w,height:e,canReadPolicyManagement:m}):null}),[a,k,r,_,w,m]);return{openEventDetailsPanel:_,shouldShowDetailsPanel:F,SessionView:D,DetailsPanel:A}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(2),i=a(4);a(84);var r=a(323);const s=({_id:e,_index:t,timestamp:a})=>{const{getAppUrl:s}=Object(r.a)(),o=(({alertId:e,index:t,timestamp:a})=>`${i.g}/${e}?index=${t}&timestamp=${a}`)({alertId:e,index:t,timestamp:a}),l=t.includes(i.P);return Object(n.useMemo)((()=>{if(l)return null;const e=s({path:o});return`${window.location.origin}${e}`}),[l,s,o])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return O}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(40),l=a(5),c=a(44),u=a(41),d=a.n(u),p=a(126),m=a(1046),b=a(245),g=a(107),f=a(323),y=a(274);const h=()=>{},v={bordered:!0,showIcons:!1},E={className:"effected-policies-search"},x=d.a.div.withConfig({displayName:"StyledEuiSelectable",componentId:"sc-rb0j09-0"})([".effected-policies-search{border-bottom-left-radius:0;border-bottom-right-radius:0;}.euiSelectableList{border-top-left-radius:0;border-top-right-radius:0;border-top-width:0;}"]),j=d()(o.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItemButtonGroup",componentId:"sc-rb0j09-1"})(["@media only screen and (max-width:","){align-items:center;}"],(e=>e.theme.eui.euiBreakpoints.m)),S=d()(o.EuiButtonGroup).withConfig({displayName:"StyledButtonGroup",componentId:"sc-rb0j09-2"})(["display:flex;justify-content:right;.euiButtonGroupButton{padding-right:",";}"],(e=>e.theme.eui.euiSizeL)),k=d.a.div.withConfig({displayName:"EffectivePolicyFormContainer",componentId:"sc-rb0j09-3"})([".policy-name .euiSelectableListItem__text{text-decoration:none !important;color:"," !important;}"],(e=>e.theme.eui.euiTextColor)),O=Object(r.memo)((({isGlobal:e,isPlatinumPlus:t,description:a,isLoading:n=!1,onChange:u,listProps:d,options:O,selected:w=[],disabled:T=!1,"data-test-subj":I,...C})=>{const{getAppUrl:M}=Object(f.a)(),{canReadPolicyManagement:_}=Object(p.a)().endpointPrivileges,F=Object(g.a)(I),A=Object(r.useMemo)((()=>[{id:"globalPolicy",label:l.i18n.translate("xpack.securitySolution.endpoint.effectedPolicySelect.global",{defaultMessage:"Global"}),iconType:e?"checkInCircleFilled":"empty","data-test-subj":F("global")},{id:"perPolicy",label:l.i18n.translate("xpack.securitySolution.endpoint.effectedPolicySelect.perPolicy",{defaultMessage:"Per Policy"}),iconType:e?"empty":"checkInCircleFilled","data-test-subj":F("perPolicy")}]),[F,e]),D=Object(r.useMemo)((()=>{const a=new Set(w.map((e=>e.id)));return O.map((n=>({label:n.name,className:"policy-name",prepend:s.a.createElement(o.EuiCheckbox,{id:Object(o.htmlIdGenerator)()(),onChange:h,checked:a.has(n.id),disabled:e||!t||T,"data-test-subj":`policy-${n.id}-checkbox`}),append:_?s.a.createElement(m.a,{href:M({path:Object(b.j)(n.id)}),appPath:Object(b.j)(n.id),target:"_blank","data-test-subj":F("policyLink")},s.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.effectedPolicySelect.viewPolicyLinkLabel",defaultMessage:"View policy"})):null,policy:n,checked:a.has(n.id)?"on":void 0,disabled:e||!t||T,"data-test-subj":`policy-${n.id}`}))).sort((({label:e},{label:t})=>e.localeCompare(t)))}),[_,T,M,F,e,t,O,w]),N=Object(r.useCallback)((t=>{u({isGlobal:e,selected:t.filter((e=>e.checked)).map((e=>e.policy))})}),[e,u]),P=Object(r.useCallback)((e=>{u({isGlobal:"globalPolicy"===e,selected:w})}),[u,w]),R=Object(r.useCallback)(((e,t)=>s.a.createElement(s.a.Fragment,null,t,e)),[]);return s.a.createElement(k,null,s.a.createElement(o.EuiText,{size:"xs"},s.a.createElement("h3",null,s.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.effectedPolicySelect.assignmentSectionTitle",defaultMessage:"Assignment"}))),s.a.createElement(o.EuiSpacer,{size:"xs"}),s.a.createElement(o.EuiFlexGroup,null,s.a.createElement(o.EuiFlexItem,{grow:2},s.a.createElement(o.EuiText,{size:"s"},s.a.createElement("p",null,a||l.i18n.translate("xpack.securitySolution.effectedPolicySelect.assignmentSectionDescription",{defaultMessage:"Assign globally across all policies, or assign it to specific policies."})))),s.a.createElement(j,{grow:1},s.a.createElement(o.EuiFormRow,{fullWidth:!0,isDisabled:T},s.a.createElement(S,{legend:"Global Policy Toggle",options:A,idSelected:e?"globalPolicy":"perPolicy",onChange:P,color:"primary","data-test-subj":F("byPolicyGlobalButtonGroup"),isDisabled:T})))),s.a.createElement(o.EuiSpacer,null),!e&&(n?s.a.createElement(y.a,{size:"l","data-test-subj":F("policiesLoader")}):s.a.createElement(o.EuiFormRow,{fullWidth:!0},s.a.createElement(x,null,s.a.createElement(o.EuiSelectable,i()({},C,{options:D,listProps:d||v,onChange:N,searchProps:E,searchable:!0,"data-test-subj":F("policiesSelectable")}),R)))))}));O.displayName="EffectedPolicySelect"},function(e,t,a){"use strict";a.d(t,"a",(function(){return l})),a.d(t,"b",(function(){return c}));var n=a(2),i=a.n(n),r=a(44);const s=a(5).i18n.translate("xpack.securitySolution.detectionEngine.ruleInfo.UnknownText",{defaultMessage:"Unknown"});var o=a(132);const l=({createdBy:e,createdAt:t,"data-test-subj":a})=>i.a.createElement("div",{"data-test-subj":a},i.a.createElement(r.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.ruleDetails.ruleCreationDescription",defaultMessage:"Created by: {by} on {date}",values:{by:null!=e?e:s,date:i.a.createElement(o.a,{value:null!=t?t:(new Date).toISOString(),fieldName:"createdAt"})}}));l.displayName="CreatedBy";const c=({updatedBy:e,updatedAt:t,"data-test-subj":a})=>i.a.createElement("div",{"data-test-subj":a},i.a.createElement(r.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.ruleDetails.ruleUpdateDescription",defaultMessage:"Updated by: {by} on {date}",values:{by:null!=e?e:s,date:i.a.createElement(o.a,{value:null!=t?t:(new Date).toISOString(),fieldName:"updatedAt"})}}));c.displayName="UpdatedBy"},function(e,t,a){"use strict";a.d(t,"a",(function(){return m}));var n=a(2),i=a.n(n),r=a(40),s=a(694),o=a(181),l=a(5),c=a(44),u=a(664);const d={type:"primary",id:"need-admin-for-update-rules",title:l.i18n.translate("xpack.securitySolution.detectionEngine.needAdminForUpdateCallOutBody.messageTitle",{defaultMessage:"Administration permissions required for alert migration"}),description:i.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.needAdminForUpdateCallOutBody.messageBody.messageDetail",defaultMessage:"{essence} Related documentation: {docs}",values:{essence:i.a.createElement("p",null,i.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.needAdminForUpdateCallOutBody.messageBody.essenceDescription",defaultMessage:"You are currently missing the required permissions to auto migrate your alert data. Please have your administrator visit this page one time to auto migrate your alert data."})),docs:i.a.createElement("ul",null,i.a.createElement("li",null,i.a.createElement(u.b,null)),i.a.createElement("li",null,i.a.createElement(u.d,null)))}})},p=()=>{const[{signalIndexMappingOutdated:e,hasIndexManage:t}]=Object(o.b)();return null!=e&&e&&null!=t&&!t?i.a.createElement(i.a.Fragment,null,i.a.createElement(s.b,{condition:!0,message:d}),i.a.createElement(r.EuiSpacer,{size:"l"})):null},m=Object(n.memo)(p)},function(e,t,a){"use strict";a.d(t,"a",(function(){return m})),a.d(t,"b",(function(){return b}));var n=a(2),i=a(197),r=a(213),s=a(102),o=a(125),l=a(590),c=a(893),u=a(855),d=a(1125),p=a(183);const m=({defineStepDefault:e,aboutStepDefault:t,scheduleStepDefault:a,actionsStepDefault:r})=>{const{triggersActionsUi:{actionTypeRegistry:p}}=Object(s.j)().services,{form:m}=Object(o.k)({defaultValue:e,options:{stripEmptyFields:!1},schema:l.a}),[b,g]=Object(n.useState)(e.eqlOptions),[f]=Object(o.m)({form:m}),y=Object(n.useMemo)((()=>"index"in f?{...f,eqlOptions:b}:e),[e,f,b]),h=Object(n.useMemo)((()=>Object(i.f)(y.ruleType)?c.b:c.a),[y.ruleType]),{form:v}=Object(o.k)({defaultValue:t,options:{stripEmptyFields:!1},schema:h}),[E]=Object(o.m)({form:v}),x="name"in E?E:t,{form:j}=Object(o.k)({defaultValue:a,options:{stripEmptyFields:!1},schema:u.a}),[S]=Object(o.m)({form:j}),k="interval"in S?S:a,O=Object(n.useMemo)((()=>(({actionTypeRegistry:e})=>({actions:{validations:[{validator:Object(d.a)(e)}]},responseActions:{},enabled:{},kibanaSiemAppUrl:{}}))({actionTypeRegistry:p})),[p]),{form:w}=Object(o.k)({defaultValue:r,options:{stripEmptyFields:!1},schema:O}),[T]=Object(o.m)({form:w});return{defineStepForm:m,defineStepData:y,aboutStepForm:v,aboutStepData:x,scheduleStepForm:j,scheduleStepData:k,actionsStepForm:w,actionsStepData:"actions"in T?T:r,eqlOptionsSelected:b,setEqlOptionsSelected:g}},b=({dataSourceType:e,index:t,dataViewId:a})=>{const{data:i}=Object(s.j)().services,[o,{browserFields:l,indexPatterns:c}]=Object(p.b)(t),[u,d]=Object(n.useState)(c);return Object(n.useEffect)((()=>{e!==r.a.IndexPatterns||o||d(c),e===r.a.DataView&&(async()=>{if(null!=a){const e=await i.dataViews.get(a);d(e)}})()}),[e,o,i,a,c]),{indexPattern:u,isIndexPatternLoading:o,browserFields:l}}},,function(e,t,a){"use strict";a.d(t,"a",(function(){return D}));var n=a(2),i=a.n(n),r=a(103),s=a(51),o=a(115),l=a(114),c=a(134),u=a(102),d=a(161),p=a(122),m=a(133),b=a(111),g=a(272),f=a(40),y=a(41),h=a.n(y),v=a(916),E=a(949),x=a(116),j=a(641);const S=h.a.div.withConfig({displayName:"TopNContainer",componentId:"sc-149y4ld-0"})(["min-width:600px;"]),k=h()(f.EuiButtonIcon).withConfig({displayName:"CloseButton",componentId:"sc-149y4ld-1"})(["position:absolute;right:4px;top:4px;"]),O=h()(f.EuiSuperSelect).withConfig({displayName:"ViewSelect",componentId:"sc-149y4ld-2"})(["width:170px;"]),w=h.a.div.withConfig({displayName:"TopNContent",componentId:"sc-149y4ld-3"})(["margin-top:4px;margin-right:",";.euiPanel{border:none;}"],(({theme:e})=>e.eui.euiSizeXS)),T=({combinedQueries:e,defaultView:t,deleteQuery:a,filters:r,field:s,from:o,indexPattern:l,options:c,paddingSize:u,query:d,showLegend:p,setAbsoluteRangeDatePickerTarget:m,setQuery:b,scopeId:f,to:y,toggleTopN:h})=>{const[T,I]=Object(n.useState)(t),C=Object(n.useCallback)((e=>I(e)),[I]),M=Object(g.b)({scopeId:f,view:T}),{selectedPatterns:_,runtimeMappings:F}=Object(x.d)(M);Object(n.useEffect)((()=>{I(t)}),[t]);const A=Object(n.useMemo)((()=>i.a.createElement(O,{"data-test-subj":"view-select",disabled:1===c.length,onChange:C,options:c,valueOfSelected:T})),[C,c,T]),D=Object(n.useMemo)((()=>Object(g.d)({filters:r,tableId:f,view:T})),[r,f,T]);return i.a.createElement(S,{"data-test-subj":"topN-container"},i.a.createElement(w,null,"raw"===T||"all"===T?i.a.createElement(v.a,{combinedQueries:e,deleteQuery:a,filters:D,from:o,headerChildren:A,indexPattern:l,indexNames:_,runtimeMappings:F,onlyField:s,paddingSize:u,query:d,queryType:"topN",showLegend:p,setAbsoluteRangeDatePickerTarget:m,setQuery:b,showSpacer:!1,toggleTopN:h,scopeId:f,sourcererScopeId:M,to:y,hideQueryToggle:!0}):i.a.createElement(E.a,{combinedQueries:e,filters:D,headerChildren:A,onlyField:s,paddingSize:u,query:d,showLegend:p,setAbsoluteRangeDatePickerTarget:m,runtimeMappings:F,hideQueryToggle:!0})),i.a.createElement(k,{"aria-label":j.c,"data-test-subj":"close",iconType:"cross",onClick:h}))};T.displayName="TopNComponent";const I=i.a.memo(T);var C=a(118);const M=[],_={query:"",language:"kuery"},F=Object(r.connect)((()=>{const e=p.d.globalQuerySelector(),t=p.d.globalFiltersQuerySelector(),a=b.b.getTimelineByIdSelector(),n=p.d.getTimelineSelector(),i=b.b.getKqlFilterQuerySelector();return(r,s)=>{var o,l;const c=null!==(o=a(r,C.c.active))&&void 0!==o?o:m.b,u=null!==(l=c.filters)&&void 0!==l?l:M,d=n(r),{globalFilters:p}=s;return{activeTimelineEventType:c.eventType,activeTimelineFilters:c.activeTab===C.d.query?u:M,activeTimelineFrom:d.timerange.from,activeTimelineKqlQueryExpression:c.activeTab===C.d.query?i(r,C.c.active):null,activeTimelineTo:d.timerange.to,dataProviders:c.activeTab===C.d.query?c.dataProviders:[],globalQuery:e(r),globalFilters:null!=p?p:t(r),kqlMode:c.kqlMode}}})),A=({activeTimelineEventType:e,activeTimelineFilters:t,activeTimelineFrom:a,activeTimelineKqlQueryExpression:r,activeTimelineTo:p,browserFields:m,dataProviders:b,field:f,indexPattern:y,globalFilters:h=M,globalQuery:v=_,kqlMode:E,onFilterAdded:x,paddingSize:j,showLegend:S,scopeId:k,toggleTopN:O})=>{const{uiSettings:w}=Object(u.j)().services,{from:T,deleteQuery:C,setQuery:F,to:A}=Object(c.a)(),D=Object(g.a)(Object(o.isActiveTimeline)(null!=k?k:"")?e:void 0),N=Object(n.useMemo)((()=>{var e;return Object(o.isActiveTimeline)(null!=k?k:"")?null===(e=Object(d.d)({browserFields:m,config:Object(s.getEsQueryConfig)(w),dataProviders:b,filters:t,indexPattern:y,kqlMode:E,kqlQuery:{language:"kuery",query:null!=r?r:""}}))||void 0===e?void 0:e.filterQuery:void 0}),[k,m,w,b,t,y,E,r]),P=Object(n.useMemo)((()=>Object(g.c)(k)?"alert":D[0].value),[D,k]);return i.a.createElement(I,{combinedQueries:N,"data-test-subj":"top-n",defaultView:P,deleteQuery:Object(o.isActiveTimeline)(null!=k?k:"")?void 0:C,field:f,filters:Object(o.isActiveTimeline)(null!=k?k:"")?M:h,from:Object(o.isActiveTimeline)(null!=k?k:"")?a:T,indexPattern:y,options:D,paddingSize:j,query:Object(o.isActiveTimeline)(null!=k?k:"")?_:v,showLegend:S,setAbsoluteRangeDatePickerTarget:Object(o.isActiveTimeline)(null!=k?k:"")?l.a.timeline:l.a.global,setQuery:F,scopeId:k,to:Object(o.isActiveTimeline)(null!=k?k:"")?p:A,toggleTopN:O,onFilterAdded:x})};A.displayName="StatefulTopNComponent";const D=F(i.a.memo(A))},function(e,t,a){"use strict";a.d(t,"a",(function(){return x}));var n=a(130),i=a.n(n),r=a(42),s=a(2),o=a(3),l=a(51),c=a(216),u=a(102),d=a(338),p=a(115),m=a(5);const b=m.i18n.translate("xpack.securitySolution.matrixHistogram.errorSearchDescription",{defaultMessage:"An error has occurred on matrix histogram search"}),g=m.i18n.translate("xpack.securitySolution.matrixHistogram.failSearchDescription",{defaultMessage:"Failed to run search on matrix histogram"});var f=a(108),y=a(303),h=a(4);const v=[],E=({endDate:e,errorMessage:t,filterQuery:a,histogramType:n,indexNames:m,isPtrIncluded:E,onError:x,stackByField:j,runtimeMappings:S,startDate:k,threshold:O,skip:w=!1,includeMissingData:T=!0})=>{const{data:I}=Object(u.j)().services,C=Object(s.useRef)(r.noop),M=Object(s.useRef)(new AbortController),_=Object(s.useRef)(new o.Subscription),[F,A]=Object(s.useState)(!1),{startTracking:D}=Object(y.a)(),[N,P]=Object(s.useState)({defaultIndex:m,factoryQueryType:d.i,filterQuery:Object(c.a)(a),histogramType:n,timerange:{interval:"12h",from:k,to:e},stackByField:j,runtimeMappings:S,threshold:O,...null!=E?{isPtrIncluded:E}:{},...null!=T?{includeMissingData:T}:{}}),{addError:R,addWarning:L}=Object(f.a)(),[B,q]=Object(s.useState)({data:[],inspect:{dsl:[],response:[]},refetch:C.current,totalCount:-1,buckets:[]}),z=Object(s.useCallback)((e=>{const a=async()=>{M.current=new AbortController,A(!0);const{endTracking:a}=D({name:`${h.l} matrixHistogram ${n}`});_.current=I.search.search(e,{strategy:"securitySolutionSearchStrategy",abortSignal:M.current.signal}).subscribe({next:e=>{if(Object(l.isCompleteResponse)(e)){const t=Object(r.getOr)(v,d.k[n],e.rawResponse);A(!1),q((a=>({...a,data:e.matrixHistogramData,inspect:Object(p.getInspectResponse)(e,a.inspect),refetch:C.current,totalCount:t.reduce(((e,t)=>t.doc_count+e),0),buckets:t}))),a("success"),_.current.unsubscribe()}else Object(l.isErrorResponse)(e)&&(A(!1),L(b),a("invalid"),_.current.unsubscribe())},error:e=>{A(!1),R(e,{title:null!=t?t:g}),a("error"),_.current.unsubscribe()}})};_.current.unsubscribe(),M.current.abort(),a(),C.current=a}),[I.search,n,L,R,t,D]);return Object(s.useEffect)((()=>{P((t=>{const r={...t,defaultIndex:m,filterQuery:Object(c.a)(a),histogramType:n,timerange:{interval:"12h",from:k,to:e},stackByField:j,threshold:O,...null!=E?{isPtrIncluded:E}:{}};return i()(t,r)?t:r}))}),[m,e,a,k,j,n,O,E]),Object(s.useEffect)((()=>(w||z(N),()=>{_.current.unsubscribe(),M.current.abort()})),[N,z,w]),Object(s.useEffect)((()=>{w&&(A(!1),_.current.unsubscribe(),M.current.abort())}),[w]),[F,B,Object(s.useCallback)(((e,t)=>{z({...N,timerange:{interval:"12h",from:t,to:e}})}),[N,z])]},x=e=>{const[t,a]=E({...e,includeMissingData:!0}),n=Object(s.useMemo)((()=>!e.stackByField.endsWith(".ip")),[e.stackByField]),[i,r]=E({...e,includeMissingData:!1,skip:n||void 0===e.filterQuery||e.skip}),o=Object(s.useMemo)((()=>t||i),[t,i]),l=Object(s.useMemo)((()=>{if(n)return a;const{data:e,inspect:t,totalCount:i,refetch:s,buckets:l}=a,{data:c,inspect:u,totalCount:d,refetch:p}=r,m=()=>{s(),p()};return o?{data:[],inspect:{dsl:[],response:[]},refetch:m,totalCount:-1,buckets:[]}:{data:[...e,...c],inspect:{dsl:[...t.dsl,...u.dsl],response:[...t.response,...u.response]},totalCount:i+d,refetch:m,buckets:l}}),[o,a,r,n]);return[o,l]}},function(e,t,a){"use strict";a.d(t,"g",(function(){return u})),a.d(t,"h",(function(){return p})),a.d(t,"f",(function(){return m})),a.d(t,"d",(function(){return b})),a.d(t,"e",(function(){return g})),a.d(t,"i",(function(){return f})),a.d(t,"c",(function(){return h})),a.d(t,"b",(function(){return j})),a.d(t,"a",(function(){return S}));var n=a(45),i=a(139),r=a(28),s=a(936),o=a(173),l=a(1133),c=a(1053);const u=e=>e.policyItem,d=Object(i.createSelector)(u,(e=>e.license),((e,t)=>{if(e){const a=((e,t)=>Object(r.b)(t,"platinum")?Object(s.d)(e):Object(s.e)(e))(e.inputs[0].config.policy.value,t);return{...e,inputs:[{...e.inputs[0],config:{...e.inputs[0].config,policy:{...e.inputs[0].config.policy,value:a}}}]}}return e})),p=Object(i.createSelector)(d,(e=>{if(e)return Object(l.a)(e)})),m=e=>!e.policyItem&&!e.apiError,b=e=>Object(c.e)(e)||Object(c.f)(e)||Object(c.d)(e)||Object(c.c)(e)||Object(c.b)(e),g=e=>e.license,f=Object(i.createSelector)((e=>e.location),(e=>{var t,a,i,r;return null!==(t=null===(a=Object(n.matchPath)(null!==(r=null==e?void 0:e.pathname)&&void 0!==r?r:"",{path:[o.n,o.q,o.m,o.o,o.l],exact:!0}))||void 0===a||null===(i=a.params)||void 0===i?void 0:i.policyId)&&void 0!==t?t:""})),y=Object(s.c)(),h=Object(i.createSelector)(d,(e=>{var t,a,n,i;return null!==(t=null==e||null===(a=e.inputs[0])||void 0===a||null===(n=a.config)||void 0===n||null===(i=n.policy)||void 0===i?void 0:i.value)&&void 0!==t?t:y})),v=Object(i.createSelector)(h,(e=>null==e?void 0:e.windows)),E=Object(i.createSelector)(h,(e=>null==e?void 0:e.mac)),x=Object(i.createSelector)(h,(e=>null==e?void 0:e.linux)),j=(Object(i.createSelector)(v,E,x,((e,t,a)=>({windows:{advanced:e.advanced,events:e.events,malware:e.malware,ransomware:e.ransomware,memory_protection:e.memory_protection,behavior_protection:e.behavior_protection,popup:e.popup,antivirus_registration:e.antivirus_registration,attack_surface_reduction:e.attack_surface_reduction},mac:{advanced:t.advanced,events:t.events,malware:t.malware,behavior_protection:t.behavior_protection,memory_protection:t.memory_protection,popup:t.popup},linux:{advanced:a.advanced,events:a.events,malware:a.malware,behavior_protection:a.behavior_protection,memory_protection:a.memory_protection,popup:a.popup}}))),e=>e.apiError),S=e=>e.agentStatusSummary},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(962);a(78),a(405),a(406);var i=n.default({key:"css"}),r=i.flush,s=i.hydrate,o=i.cx,l=i.merge,c=i.getRegisteredStyles,u=i.injectGlobal,d=i.keyframes,p=i.css,m=i.sheet,b=i.cache;t.cache=b,t.css=p,t.cx=o,t.flush=r,t.getRegisteredStyles=c,t.hydrate=s,t.injectGlobal=u,t.keyframes=d,t.merge=l,t.sheet=m},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(78),i=a(405),r=a(406);function s(e){return e&&e.__esModule?e:{default:e}}var o=s(n);function l(e,t){if(void 0===e.inserted[t.name])return e.insert("",t,e.sheet,!0)}function c(e,t,a){var n=[],i=r.getRegisteredStyles(e,n,a);return n.length<2?a:i+t(n)}var u=function e(t){for(var a="",n=0;n<t.length;n++){var i=t[n];if(null!=i){var r=void 0;switch(typeof i){case"boolean":break;case"object":if(Array.isArray(i))r=e(i);else for(var s in r="",i)i[s]&&s&&(r&&(r+=" "),r+=s);break;default:r=i}r&&(a&&(a+=" "),a+=r)}}return a};t.default=function(e){var t=o.default(e);t.sheet.speedy=function(e){this.isSpeedy=e},t.compat=!0;var a=function(){for(var e=arguments.length,a=new Array(e),n=0;n<e;n++)a[n]=arguments[n];var s=i.serializeStyles(a,t.registered,void 0);return r.insertStyles(t,s,!1),t.key+"-"+s.name};return{css:a,cx:function(){for(var e=arguments.length,n=new Array(e),i=0;i<e;i++)n[i]=arguments[i];return c(t.registered,a,u(n))},injectGlobal:function(){for(var e=arguments.length,a=new Array(e),n=0;n<e;n++)a[n]=arguments[n];var r=i.serializeStyles(a,t.registered);l(t,r)},keyframes:function(){for(var e=arguments.length,a=new Array(e),n=0;n<e;n++)a[n]=arguments[n];var r=i.serializeStyles(a,t.registered),s="animation-"+r.name;return l(t,{name:r.name,styles:"@keyframes "+s+"{"+r.styles+"}"}),s},hydrate:function(e){e.forEach((function(e){t.inserted[e]=!0}))},flush:function(){t.registered={},t.inserted={},t.sheet.flush()},sheet:t.sheet,cache:t,getRegisteredStyles:r.getRegisteredStyles.bind(null,t.registered),merge:c.bind(null,t.registered,a)}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(964),i=a(966),r=a(703);function s(e){return e&&e.__esModule?e:{default:e}}var o=s(n),l=s(i),c=/[A-Z]|^ms/g,u=/_EMO_([^_]+?)_([^]*?)_EMO_/g,d=function(e){return 45===e.charCodeAt(1)},p=function(e){return null!=e&&"boolean"!=typeof e},m=s(r).default((function(e){return d(e)?e:e.replace(c,"-$&").toLowerCase()})),b=function(e,t){switch(e){case"animation":case"animationName":if("string"==typeof t)return t.replace(u,(function(e,t,a){return f={name:t,styles:a,next:f},t}))}return 1===l.default[e]||d(e)||"number"!=typeof t||0===t?t:t+"px"};function g(e,t,a){if(null==a)return"";if(void 0!==a.__emotion_styles)return a;switch(typeof a){case"boolean":return"";case"object":if(1===a.anim)return f={name:a.name,styles:a.styles,next:f},a.name;if(void 0!==a.styles){var n=a.next;if(void 0!==n)for(;void 0!==n;)f={name:n.name,styles:n.styles,next:f},n=n.next;return a.styles+";"}return function(e,t,a){var n="";if(Array.isArray(a))for(var i=0;i<a.length;i++)n+=g(e,t,a[i])+";";else for(var r in a){var s=a[r];if("object"!=typeof s)null!=t&&void 0!==t[s]?n+=r+"{"+t[s]+"}":p(s)&&(n+=m(r)+":"+b(r,s)+";");else if(!Array.isArray(s)||"string"!=typeof s[0]||null!=t&&void 0!==t[s[0]]){var o=g(e,t,s);switch(r){case"animation":case"animationName":n+=m(r)+":"+o+";";break;default:n+=r+"{"+o+"}"}}else for(var l=0;l<s.length;l++)p(s[l])&&(n+=m(r)+":"+b(r,s[l])+";")}return n}(e,t,a);case"function":if(void 0!==e){var i=f,r=a(e);return f=i,g(e,t,r)}}if(null==t)return a;var s=t[a];return void 0!==s?s:a}var f,y=/label:\s*([^\s;\n{]+)\s*(;|$)/g;t.serializeStyles=function(e,t,a){if(1===e.length&&"object"==typeof e[0]&&null!==e[0]&&void 0!==e[0].styles)return e[0];var n=!0,i="";f=void 0;var r=e[0];null==r||void 0===r.raw?(n=!1,i+=g(a,t,r)):i+=r[0];for(var s=1;s<e.length;s++)i+=g(a,t,e[s]),n&&(i+=r[s]);y.lastIndex=0;for(var l,c="";null!==(l=y.exec(i));)c+="-"+l[1];return{name:o.default(i)+c,styles:i,next:f}}},function(e,t,a){"use strict";e.exports=a(965)},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e){for(var t,a=0,n=0,i=e.length;i>=4;++n,i-=4)t=1540483477*(65535&(t=255&e.charCodeAt(n)|(255&e.charCodeAt(++n))<<8|(255&e.charCodeAt(++n))<<16|(255&e.charCodeAt(++n))<<24))+(59797*(t>>>16)<<16),a=1540483477*(65535&(t^=t>>>24))+(59797*(t>>>16)<<16)^1540483477*(65535&a)+(59797*(a>>>16)<<16);switch(i){case 3:a^=(255&e.charCodeAt(n+2))<<16;case 2:a^=(255&e.charCodeAt(n+1))<<8;case 1:a=1540483477*(65535&(a^=255&e.charCodeAt(n)))+(59797*(a>>>16)<<16)}return(((a=1540483477*(65535&(a^=a>>>13))+(59797*(a>>>16)<<16))^a>>>15)>>>0).toString(36)}},function(e,t,a){"use strict";e.exports=a(967)},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default={animationIterationCount:1,aspectRatio:1,borderImageOutset:1,borderImageSlice:1,borderImageWidth:1,boxFlex:1,boxFlexGroup:1,boxOrdinalGroup:1,columnCount:1,columns:1,flex:1,flexGrow:1,flexPositive:1,flexShrink:1,flexNegative:1,flexOrder:1,gridRow:1,gridRowEnd:1,gridRowSpan:1,gridRowStart:1,gridColumn:1,gridColumnEnd:1,gridColumnSpan:1,gridColumnStart:1,msGridRow:1,msGridRowSpan:1,msGridColumn:1,msGridColumnSpan:1,fontWeight:1,lineHeight:1,opacity:1,order:1,orphans:1,tabSize:1,widows:1,zIndex:1,zoom:1,WebkitLineClamp:1,fillOpacity:1,floodOpacity:1,stopOpacity:1,strokeDasharray:1,strokeDashoffset:1,strokeMiterlimit:1,strokeOpacity:1,strokeWidth:1}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e){var t=Object.create(null);return function(a){return void 0===t[a]&&(t[a]=e(a)),t[a]}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n="undefined"!=typeof document,i=function(e,t,a){var i=e.key+"-"+t.name;(!1===a||!1===n&&void 0!==e.compat)&&void 0===e.registered[i]&&(e.registered[i]=t.styles)};t.getRegisteredStyles=function(e,t,a){var n="";return a.split(" ").forEach((function(a){void 0!==e[a]?t.push(e[a]+";"):n+=a+" "})),n},t.insertStyles=function(e,t,a){i(e,t,a);var r=e.key+"-"+t.name;if(void 0===e.inserted[t.name]){var s="",o=t;do{var l=e.insert(t===o?"."+r:"",o,e.sheet,!0);n||void 0===l||(s+=l),o=o.next}while(void 0!==o);if(!n&&0!==s.length)return s}},t.registerStyles=i},,,function(e,t,a){var n=a(549)("set",a(1027));n.placeholder=a(550),e.exports=n},function(e,t,a){e.exports=a(33)(3822)},function(e,t,a){e.exports={ary:a(975),assign:a(998),clone:a(999),curry:a(1e3),forEach:a(625),isArray:a(258),isError:a(1001),isFunction:a(629),isWeakMap:a(1004),iteratee:a(1005),keys:a(717),rearg:a(1020),toInteger:a(627),toPath:a(1022)}},function(e,t,a){var n=a(435);e.exports=function(e,t,a){return t=a?void 0:t,t=e&&null==t?e.length:t,n(e,128,void 0,void 0,void 0,void 0,t)}},function(e,t,a){e.exports=a(33)(3349)},function(e,t,a){var n=a(341),i=a(342);e.exports=function(e,t,a){var r=1&t,s=n(e);return function t(){return(this&&this!==i&&this instanceof t?s:e).apply(r?a:this,arguments)}}},function(e,t,a){var n=a(616),i=a(341),r=a(617),s=a(620),o=a(626),l=a(443),c=a(342);e.exports=function(e,t,a){var u=i(e);return function i(){for(var d=arguments.length,p=Array(d),m=d,b=o(i);m--;)p[m]=arguments[m];var g=d<3&&p[0]!==b&&p[d-1]!==b?[]:l(p,b);return(d-=g.length)<a?s(e,t,r,i.placeholder,void 0,p,g,void 0,void 0,a-d):n(this&&this!==c&&this instanceof i?u:e,this,p)}}},function(e,t){e.exports=function(e,t){for(var a=e.length,n=0;a--;)e[a]===t&&++n;return n}},function(e,t,a){var n=a(438),i=a(621),r=a(981),s=a(983);e.exports=function(e){var t=r(e),a=s[t];if("function"!=typeof a||!(t in n.prototype))return!1;if(e===a)return!0;var o=i(a);return!!o&&e===o[0]}},function(e,t,a){var n=a(982),i=Object.prototype.hasOwnProperty;e.exports=function(e){for(var t=e.name+"",a=n[t],r=i.call(n,t)?a.length:0;r--;){var s=a[r],o=s.func;if(null==o||o==e)return s.name}return t}},function(e,t){e.exports={}},function(e,t,a){var n=a(438),i=a(622),r=a(439),s=a(258),o=a(440),l=a(984),c=Object.prototype.hasOwnProperty;function u(e){if(o(e)&&!s(e)&&!(e instanceof n)){if(e instanceof i)return e;if(c.call(e,"__wrapped__"))return l(e)}return new i(e)}u.prototype=r.prototype,u.prototype.constructor=u,e.exports=u},function(e,t,a){var n=a(438),i=a(622),r=a(441);e.exports=function(e){if(e instanceof n)return e.clone();var t=new i(e.__wrapped__,e.__chain__);return t.__actions__=r(e.__actions__),t.__index__=e.__index__,t.__values__=e.__values__,t}},function(e,t,a){e.exports=a(33)(3677)},function(e,t){var a=/\{\n\/\* \[wrapped with (.+)\] \*/,n=/,? & /;e.exports=function(e){var t=e.match(a);return t?t[1].split(n):[]}},function(e,t){var a=/\{(?:\n\/\* \[wrapped with .+\] \*\/)?\n?/;e.exports=function(e,t){var n=t.length;if(!n)return e;var i=n-1;return t[i]=(n>1?"& ":"")+t[i],t=t.join(n>2?", ":" "),e.replace(a,"{\n/* [wrapped with "+t+"] */\n")}},function(e,t,a){e.exports=a(33)(3674)},function(e,t,a){var n=a(625),i=a(990),r=[["ary",128],["bind",1],["bindKey",2],["curry",8],["curryRight",16],["flip",512],["partial",32],["partialRight",64],["rearg",256]];e.exports=function(e,t){return n(r,(function(a){var n="_."+a[0];t&a[1]&&!i(e,n)&&e.push(n)})),e.sort()}},function(e,t,a){var n=a(991);e.exports=function(e,t){return!(null==e||!e.length)&&n(e,t,0)>-1}},function(e,t,a){var n=a(992),i=a(993),r=a(994);e.exports=function(e,t,a){return t==t?r(e,t,a):n(e,i,a)}},function(e,t){e.exports=function(e,t,a,n){for(var i=e.length,r=a+(n?1:-1);n?r--:++r<i;)if(t(e[r],r,e))return r;return-1}},function(e,t){e.exports=function(e){return e!=e}},function(e,t){e.exports=function(e,t,a){for(var n=a-1,i=e.length;++n<i;)if(e[n]===t)return n;return-1}},function(e,t,a){var n=a(441),i=a(442),r=Math.min;e.exports=function(e,t){for(var a=e.length,s=r(t.length,a),o=n(e);s--;){var l=t[s];e[s]=i(l,a)?o[l]:void 0}return e}},function(e,t,a){var n=a(616),i=a(341),r=a(342);e.exports=function(e,t,a,s){var o=1&t,l=i(e);return function t(){for(var i=-1,c=arguments.length,u=-1,d=s.length,p=Array(d+c),m=this&&this!==r&&this instanceof t?l:e;++u<d;)p[u]=s[u];for(;c--;)p[u++]=arguments[++i];return n(m,o?a:this,p)}}},function(e,t,a){var n=a(618),i=a(619),r=a(443),s="__lodash_placeholder__",o=128,l=Math.min;e.exports=function(e,t){var a=e[1],c=t[1],u=a|c,d=u<131,p=c==o&&8==a||c==o&&256==a&&e[7].length<=t[8]||384==c&&t[7].length<=t[8]&&8==a;if(!d&&!p)return e;1&c&&(e[2]=t[2],u|=1&a?0:4);var m=t[3];if(m){var b=e[3];e[3]=b?n(b,m,t[4]):m,e[4]=b?r(e[3],s):t[4]}return(m=t[5])&&(b=e[5],e[5]=b?i(b,m,t[6]):m,e[6]=b?r(e[5],s):t[6]),(m=t[7])&&(e[7]=m),c&o&&(e[8]=null==e[8]?t[8]:l(e[8],t[8])),null==e[9]&&(e[9]=t[9]),e[0]=t[0],e[1]=u,e}},function(e,t,a){e.exports=a(33)(3642)},function(e,t,a){var n=a(628);e.exports=function(e){return n(e,4)}},function(e,t,a){var n=a(435),i=8;function r(e,t,a){var s=n(e,i,void 0,void 0,void 0,void 0,void 0,t=a?void 0:t);return s.placeholder=r.placeholder,s}r.placeholder={},e.exports=r},function(e,t,a){var n=a(1002),i=a(440),r=a(1003);e.exports=function(e){if(!i(e))return!1;var t=n(e);return"[object Error]"==t||"[object DOMException]"==t||"string"==typeof e.message&&"string"==typeof e.name&&!r(e)}},function(e,t,a){e.exports=a(33)(355)},function(e,t,a){e.exports=a(33)(3667)},function(e,t,a){var n=a(715),i=a(440);e.exports=function(e){return i(e)&&"[object WeakMap]"==n(e)}},function(e,t,a){var n=a(628),i=a(904);e.exports=function(e){return i("function"==typeof e?e:n(e,1))}},function(e,t,a){var n=a(1007),i=a(1009),r=a(632);e.exports=function(e){var t=i(e);return 1==t.length&&t[0][2]?r(t[0][0],t[0][1]):function(a){return a===e||n(a,e,t)}}},function(e,t,a){var n=a(1008),i=a(630);e.exports=function(e,t,a,r){var s=a.length,o=s,l=!r;if(null==e)return!o;for(e=Object(e);s--;){var c=a[s];if(l&&c[2]?c[1]!==e[c[0]]:!(c[0]in e))return!1}for(;++s<o;){var u=(c=a[s])[0],d=e[u],p=c[1];if(l&&c[2]){if(void 0===d&&!(u in e))return!1}else{var m=new n;if(r)var b=r(d,p,u,e,t,m);if(!(void 0===b?i(p,d,3,r,m):b))return!1}}return!0}},function(e,t,a){e.exports=a(33)(1599)},function(e,t,a){var n=a(631),i=a(905);e.exports=function(e){for(var t=i(e),a=t.length;a--;){var r=t[a],s=e[r];t[a]=[r,s,n(s)]}return t}},function(e,t,a){var n=a(630),i=a(1011),r=a(1012),s=a(634),o=a(631),l=a(632),c=a(288);e.exports=function(e,t){return s(e)&&o(t)?l(c(e),t):function(a){var s=i(a,e);return void 0===s&&s===t?r(a,e):n(t,s,3)}}},function(e,t,a){e.exports=a(33)(1936)},function(e,t,a){var n=a(1013),i=a(1014);e.exports=function(e,t){return null!=e&&i(e,t,n)}},function(e,t){e.exports=function(e,t){return null!=e&&t in Object(e)}},function(e,t,a){var n=a(633),i=a(716),r=a(258),s=a(442),o=a(1015),l=a(288);e.exports=function(e,t,a){for(var c=-1,u=(t=n(t,e)).length,d=!1;++c<u;){var p=l(t[c]);if(!(d=null!=e&&a(e,p)))break;e=e[p]}return d||++c!=u?d:!!(u=null==e?0:e.length)&&o(u)&&s(p,u)&&(r(e)||i(e))}},function(e,t,a){e.exports=a(33)(1611)},function(e,t,a){var n=a(1017),i=a(1018),r=a(634),s=a(288);e.exports=function(e){return r(e)?n(s(e)):i(e)}},function(e,t){e.exports=function(e){return function(t){return null==t?void 0:t[e]}}},function(e,t,a){var n=a(1019);e.exports=function(e){return function(t){return n(t,e)}}},function(e,t,a){e.exports=a(33)(1652)},function(e,t,a){var n=a(435),i=a(1021)((function(e,t){return n(e,256,void 0,void 0,void 0,t)}));e.exports=i},function(e,t,a){e.exports=a(33)(3668)},function(e,t,a){var n=a(1023),i=a(441),r=a(258),s=a(1024),o=a(1025),l=a(288),c=a(1026);e.exports=function(e){return r(e)?n(e,l):s(e)?[e]:i(o(c(e)))}},function(e,t,a){e.exports=a(33)(1653)},function(e,t,a){e.exports=a(33)(820)},function(e,t,a){e.exports=a(33)(3636)},function(e,t,a){e.exports=a(33)(3638)},function(e,t,a){e.exports=a(1028)},function(e,t,a){var n=a(635);e.exports=function(e,t,a){return null==e?e:n(e,t,a)}},function(e,t,a){e.exports=a(33)(1655)},function(e,t,a){var n=a(549)("setWith",a(1031));n.placeholder=a(550),e.exports=n},function(e,t,a){e.exports=a(1032)},function(e,t,a){var n=a(635);e.exports=function(e,t,a,i){return i="function"==typeof i?i:void 0,null==e?e:n(e,t,a,i)}},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(104),i=a.n(n),r=a(40),s=a(2),o=a.n(s),l=a(41);const c=a.n(l)()(r.EuiEmptyPrompt).withConfig({displayName:"EmptyPrompt",componentId:"sc-tln1ed-0"})(["align-self:center;max-width:60em;"]);c.displayName="EmptyPrompt";const u=o.a.memo((({actions:e,message:t,title:a,...n})=>{const l=Object.keys(e),u=Object(s.useMemo)((()=>Object.values(e).filter((e=>e.label&&e.url)).map((({icon:e,label:t,target:a,url:n,descriptionTitle:i,description:s,onClick:c,fill:u=!0},d)=>null!=i||null!=s?o.a.createElement(r.EuiFlexItem,{grow:!1,style:{maxWidth:283},key:`empty-page-${l[d]}-action`},o.a.createElement(r.EuiCard,{title:null!=i&&i,description:null!=s&&s,footer:o.a.createElement(r.EuiButton,{href:n,onClick:c,iconType:e,target:a,fill:u,"data-test-subj":`empty-page-${l[d]}-action`},t)})):o.a.createElement(r.EuiFlexItem,{grow:!1,style:{maxWidth:283},key:`empty-page-${l[d]}-action`},o.a.createElement(r.EuiButton,{href:n,onClick:c,iconType:e,target:a,"data-test-subj":`empty-page-${l[d]}-action`},t))))),[e,l]);return o.a.createElement(c,i()({iconType:"logoSecurity",title:o.a.createElement(r.EuiText,null,o.a.createElement("h2",null,a)),body:t&&o.a.createElement("p",null,t),actions:o.a.createElement(r.EuiFlexGroup,{justifyContent:"center"},u)},n))}));u.displayName="EmptyPageComponent";const d=o.a.memo(u);d.displayName="EmptyPage"},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(537),r=a(105);const s=Object(i.getSelectedDataviewSelector)(),o=e=>{const t=Object(r.a)((t=>s(t,e)));return Object(n.useCallback)((e=>{const a=null==t?void 0:t.fields;return a&&a[e]}),[null==t?void 0:t.fields])}},,,function(e,t){e.exports="data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiIHN0YW5kYWxvbmU9Im5vIj8+Cjxzdmcgd2lkdGg9IjI1NnB4IiBoZWlnaHQ9IjI1NXB4IiB2aWV3Qm94PSIwIDAgMjU2IDI1NSIgdmVyc2lvbj0iMS4xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiBwcmVzZXJ2ZUFzcGVjdFJhdGlvPSJ4TWlkWU1pZCI+Cgk8Zz4KCQk8cGF0aCBkPSJNMjU1LjIxNDYxNywwLjI1NzU4MDI0NyBMMjU1LjIxNDYxNyw2My45OTM2NzkgTDE5MS42MDk2NzksMTI3LjU5ODYxNyBMMTkxLjYwOTY3OSw2My43Mjk3Nzc4IEwyNTUuMjE0NjE3LDAuMjU3NTgwMjQ3IiBmaWxsPSIjQTU5NkZGIj48L3BhdGg+CgkJPHBhdGggZD0iTTEyOC4wMDYzMjEsMC4yNTc1ODAyNDcgTDEyOC4wMDYzMjEsNjMuOTkzNjc5IEwxOTEuNjExMjU5LDEyNy41OTg2MTcgTDE5MS42MTEyNTksNjMuNzI5Nzc3OCBMMTI4LjAwNjMyMSwwLjI1NzU4MDI0NyIgZmlsbD0iIzAwMDAwMCI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0yNTUuMzQ1Nzc4LDI1NC44MDM3NTMgTDE5MS42MDk2NzksMjU0LjgwMzc1MyBMMTI4LjAwNDc0MSwxOTEuMTk4ODE1IEwxOTEuODcyLDE5MS4xOTg4MTUgTDI1NS4zNDU3NzgsMjU0LjgwMzc1MyIgZmlsbD0iI0E1OTZGRiI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0yNTUuMzQ1Nzc4LDEyNy41OTU0NTcgTDE5MS42MDk2NzksMTI3LjU5NTQ1NyBMMTI4LjAwNDc0MSwxOTEuMjAwMzk1IEwxOTEuODcyLDE5MS4yMDAzOTUgTDI1NS4zNDU3NzgsMTI3LjU5NTQ1NyIgZmlsbD0iIzAwMDAwMCI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0wLjgwMTE4NTE4NSwyNTQuOTM2NDk0IEwwLjgwMTE4NTE4NSwxOTEuMTk4ODE1IEw2NC40MDYxMjM1LDEyNy41OTM4NzcgTDY0LjQwNjEyMzUsMTkxLjQ2MjcxNiBMMC44MDExODUxODUsMjU0LjkzNjQ5NCIgZmlsbD0iI0E1OTZGRiI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0xMjguMDA5NDgxLDI1NC45MzY0OTQgTDEyOC4wMDk0ODEsMTkxLjE5ODgxNSBMNjQuNDA0NTQzMiwxMjcuNTkzODc3IEw2NC40MDQ1NDMyLDE5MS40NjI3MTYgTDEyOC4wMDk0ODEsMjU0LjkzNjQ5NCIgZmlsbD0iIzAwMDAwMCI+PC9wYXRoPgoJCTxwYXRoIGQ9Ik0wLjY3MTYwNDkzOCwwLjM4NTU4MDI0NyBMNjQuNDA3NzAzNywwLjM4NTU4MDI0NyBMMTI4LjAxMjY0Miw2My45OTA1MTg1IEw2NC4xNDUzODI3LDYzLjk5MDUxODUgTDAuNjcxNjA0OTM4LDAuMzg1NTgwMjQ3IiBmaWxsPSIjQTU5NkZGIj48L3BhdGg+CgkJPHBhdGggZD0iTTAuNjcxNjA0OTM4LDEyNy41OTM4NzcgTDY0LjQwNzcwMzcsMTI3LjU5Mzg3NyBMMTI4LjAxMjY0Miw2My45ODg5MzgzIEw2NC4xNDUzODI3LDYzLjk4ODkzODMgTDAuNjcxNjA0OTM4LDEyNy41OTM4NzciIGZpbGw9IiMwMDAwMDAiPjwvcGF0aD4KCTwvZz4KPC9zdmc+Cg=="},function(e,t,a){"use strict";var n=a(796),i=a(2);function r(e,t,a){return e[t]?e[t][0]?e[t][0][a]:e[t][a]:"contentBoxSize"===t?e.contentRect["inlineSize"===a?"width":"height"]:void 0}e.exports=function(e){void 0===e&&(e={});var t=e.onResize,a=i.useRef(void 0);a.current=t;var s=e.round||Math.round,o=i.useRef(),l=i.useState({width:void 0,height:void 0}),c=l[0],u=l[1],d=i.useRef(!1);i.useEffect((function(){return d.current=!1,function(){d.current=!0}}),[]);var p=i.useRef({width:void 0,height:void 0}),m=function(e,t){var a=i.useRef(null),n=i.useRef(null);n.current=t;var r=i.useRef(null);i.useEffect((function(){s()}));var s=i.useCallback((function(){var t=r.current,i=n.current,s=t||(i?i instanceof Element?i:i.current:null);a.current&&a.current.element===s&&a.current.subscriber===e||(a.current&&a.current.cleanup&&a.current.cleanup(),a.current={element:s,subscriber:e,cleanup:s?e(s):void 0})}),[e]);return i.useEffect((function(){return function(){a.current&&a.current.cleanup&&(a.current.cleanup(),a.current=null)}}),[]),i.useCallback((function(e){r.current=e,s()}),[s])}(i.useCallback((function(t){return o.current&&o.current.box===e.box&&o.current.round===s||(o.current={box:e.box,round:s,instance:new n.ResizeObserver((function(t){var n=t[0],i="border-box"===e.box?"borderBoxSize":"device-pixel-content-box"===e.box?"devicePixelContentBoxSize":"contentBoxSize",o=r(n,i,"inlineSize"),l=r(n,i,"blockSize"),c=o?s(o):void 0,m=l?s(l):void 0;if(p.current.width!==c||p.current.height!==m){var b={width:c,height:m};p.current.width=c,p.current.height=m,a.current?a.current(b):d.current||u(b)}}))}),o.current.instance.observe(t,{box:e.box}),function(){o.current&&o.current.instance.unobserve(t)}}),[e.box,s]),e.ref);return i.useMemo((function(){return{ref:m,width:c.width,height:c.height}}),[m,c.width,c.height])}},,function(e,t,a){"use strict";a.d(t,"d",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"f",(function(){return s})),a.d(t,"a",(function(){return o})),a.d(t,"e",(function(){return l})),a.d(t,"c",(function(){return c}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.riskScore.technicalPreviewLabel",{defaultMessage:"Technical Preview"}),r=n.i18n.translate("xpack.securitySolution.riskScore.hostsDashboardWarningPanelTitle",{defaultMessage:"No host risk score data available to display"}),s=n.i18n.translate("xpack.securitySolution.riskScore.usersDashboardWarningPanelTitle",{defaultMessage:"No user risk score data available to display"}),o=n.i18n.translate("xpack.securitySolution.riskScore.hostsDashboardWarningPanelBody",{defaultMessage:"We haven’t found any host risk score data. Check if you have any global filters in the global KQL search bar. If you have just enabled the host risk module, the risk engine might need an hour to generate host risk score data and display in this panel."}),l=n.i18n.translate("xpack.securitySolution.riskScore.usersDashboardWarningPanelBody",{defaultMessage:"We haven’t found any user risk score data. Check if you have any global filters in the global KQL search bar. If you have just enabled the user risk module, the risk engine might need an hour to generate user risk score data and display in this panel."}),c=n.i18n.translate("xpack.securitySolution.riskScore.usersDashboardRestartTooltip",{defaultMessage:"The risk score calculation might take a while to run. However, by pressing restart, you can force it to run immediately."})},,function(e,t,a){"use strict";a.d(t,"a",(function(){return L}));var n=a(40),i=a(2),r=a.n(i),s=a(129),o=a(41),l=a.n(o),c=a(103),u=a(13),d=a(119),p=a(134),m=a(17),b=a(4),g=a(176),f=a(1066),y=a(1043),h=a(951),v=a(122),E=a(161),x=a(273),j=a(923),S=a(116),k=a(110),O=a(102),w=a(105),T=a(1047),I=a(501),C=a(832),M=a(135),_=a(328),F=a(312);const{updateIsLoading:A,updateTotalCount:D}=d.h,N=e=>!!e[s.b],P=l()(n.EuiFlexGroup).withConfig({displayName:"FullWidthFlexGroupTable",componentId:"sc-ikpuyo-0"})(["overflow:hidden;margin:0;display:",";"],(({$visible:e})=>e?"flex":"none")),R=l.a.div.withConfig({displayName:"EuiDataGridContainer",componentId:"sc-ikpuyo-1"})(["ul.euiPagination__list{li.euiPagination__item:last-child{",";}}div .euiDataGridRowCell__contentByHeight{height:auto;align-self:center;}div .euiDataGridRowCell--lastColumn .euiDataGridRowCell__contentByHeight{flex-grow:0;width:100%;}div .siemEventsTable__trSupplement--summary{display:block;}width:100%;"],(({hideLastPage:e})=>e?"display:none":"")),L=({configId:e,flyoutSize:t,inputFilters:a,tableId:n=d.e.alertsOnAlertsPage,sourcererScope:s=k.SourcererScopeName.detections,isLoading:o,onRuleChange:l})=>{const{triggersActionsUi:L,uiSettings:B}=Object(O.j)().services,{from:q,to:z,setQuery:$}=Object(p.a)(),V=Object(i.useRef)(null),U=Object(c.useDispatch)(),[H]=Object(i.useState)({timelineID:n,tabType:"query",enableHostDetailsFlyout:!0,enableIpDetailsFlyout:!0,onRuleChange:l}),{browserFields:G,indexPattern:Q,runtimeMappings:W}=Object(S.d)(s),K=Object(m.b)(),Y=Object(i.useMemo)((()=>v.d.globalFiltersQuerySelector()),[]),J=Object(i.useMemo)((()=>v.d.globalQuerySelector()),[]),X=Object(w.a)(J),Z=Object(w.a)(Y),ee=Object(i.useMemo)((()=>d.j.getTableByIdSelector()),[]),te=Object(w.b)((e=>{var t;return(null!==(t=ee(e,n))&&void 0!==t?t:d.q).initialized})),ae=Object(i.useMemo)((()=>Object(I.a)(q,z)),[q,z]),ne=Object(i.useMemo)((()=>[...a,...null!=Z?Z:[],...null!=ae?ae:[]]),[a,Z,ae]),{dataTable:{graphEventId:ie,sessionViewConfig:re,viewMode:se=f.a.viewMode,columns:oe}=Object(F.f)(K)}=Object(w.b)((e=>Object(C.a)(e,n))),le=Object(i.useMemo)((()=>null!=G&&null!=Q?Object(E.d)({config:Object(u.getEsQueryConfig)(B),dataProviders:[],indexPattern:Q,browserFields:G,filters:[...ne],kqlQuery:X,kqlMode:X.language}):null),[G,X,Q,B,ne]);Object(x.a)({id:n,filterQuery:null==le?void 0:le.filterQuery,kqlError:null==le?void 0:le.kqlError,query:X,startDate:q,endDate:z});const ce=Object(i.useMemo)((()=>null!=le&&le.kqlError||null==le||!le.filterQuery?{bool:{}}:{bool:{filter:JSON.parse(null==le?void 0:le.filterQuery)}}),[null==le?void 0:le.filterQuery,null==le?void 0:le.kqlError]),ue=se===b.Jc.eventRenderedView,de=Object(i.useMemo)((()=>({border:"none",fontSize:"s",header:"underline",stripes:ue})),[ue]),pe=Object(i.useMemo)((()=>{if(ue)return{defaultHeight:"auto"}}),[ue]),me=Object(i.useMemo)((()=>oe.length?oe:Object(T.b)(K)),[oe,K]),be=Object(i.useMemo)((()=>ue?{}:G),[ue,G]),ge=Object(i.useMemo)((()=>ue?_.a:me),[me,ue]),fe=Object(i.useCallback)((({isLoading:e,totalCount:t,refresh:a})=>{U(A({id:n,isLoading:e})),U(D({id:n,totalCount:t})),V.current=a,$({id:n,loading:e,refetch:a,inspect:null})}),[U,n,V,$]),ye=Object(i.useMemo)((()=>({alertsTableConfigurationRegistry:L.alertsTableConfigurationRegistry,configurationId:e,id:`detection-engine-alert-table-${e}-${se}`,flyoutSize:t,featureIds:["siem"],query:ce,showExpandToDetails:!1,gridStyle:de,shouldHighlightRow:N,rowHeightsOptions:pe,columns:ge,browserFields:be,onUpdate:fe,runtimeMappings:W,toolbarVisibility:{showColumnSelector:!ue,showSortSelector:!ue}})),[L.alertsTableConfigurationRegistry,e,se,t,ce,de,pe,ge,be,fe,W,ue]);Object(i.useEffect)((()=>{te||U(d.h.initializeDataTableSettings({id:n,title:M.I,defaultColumns:ge.map((e=>({initialWidth:g.a,...e})))}))}),[U,n,ge,te]);const he=Object(i.useMemo)((()=>L.getAlertsStateTable(ye)),[ye,L]),{Navigation:ve}=Object(h.b)({scopeId:n}),{DetailsPanel:Ee,SessionView:xe}=Object(h.a)({entityType:"events",scopeId:n}),je=Object(i.useMemo)((()=>null!=ie&&ie.length>0||null!=re?r.a.createElement(y.a,{scopeId:n,SessionView:xe,Navigation:ve}):null),[ie,n,re,xe,ve]);return o?null:r.a.createElement("div",null,je,r.a.createElement(P,{$visible:!ie&&null==je,gutterSize:"none"},r.a.createElement(j.a.Provider,{value:H},r.a.createElement(R,{hideLastPage:!1},he))),Ee)}},function(e,t,a){"use strict";a.d(t,"a",(function(){return C}));var n=a(2),i=a.n(n),r=a(40),s=a(48),o=a(103),l=a(41),c=a.n(l),u=a(119),d=a(115),p=a(105),m=a(114),b=a(178),g=a(529),f=a(182),y=a(924),h=a(498),v=a(111),E=a(133);const x="sessionViewFullScreen",j=Object(l.css)(["display:flex;flex-direction:column;flex:1;width:100%;"]),S=c.a.div.withConfig({displayName:"OverlayContainer",componentId:"sc-jhq5kd-0"})(["",""],j),k=Object(l.css)(["background-color:"," position:fixed;top:0;bottom:2em;left:0;right:0;z-index:",";"],(({theme:e})=>`${e.eui.euiColorEmptyShade};`),s.euiThemeVars.euiZLevel3),O=c.a.div.withConfig({displayName:"FullScreenOverlayContainer",componentId:"sc-jhq5kd-1"})(["",""],k),w=c()(y.a).withConfig({displayName:"StyledResolver",componentId:"sc-jhq5kd-2"})(["height:100%;"]),T=c()(r.EuiFlexItem).withConfig({displayName:"ScrollableFlexItem",componentId:"sc-jhq5kd-3"})([""," overflow:hidden;width:100%;&.","{","}"],(({theme:e})=>`background-color: ${e.eui.euiColorEmptyShade};`),x,(({theme:e})=>`padding: 0 ${e.eui.euiSizeM}`)),I=({SessionView:e,Navigation:t,scopeId:a})=>{const s=Object(o.useDispatch)(),{globalFullScreen:l}=Object(b.a)(),{timelineFullScreen:c}=Object(b.c)(),y=Object(n.useMemo)((()=>Object(d.isInTableScope)(a)?u.j.getTableByIdSelector():Object(d.isTimelineScope)(a)?v.b.getTimelineByIdSelector():void 0),[a]),I=Object(d.isInTableScope)(a)?u.q:E.b,{graphEventId:C,sessionViewConfig:M}=Object(p.a)((e=>{var t;return null!==(t=y&&y(e,a))&&void 0!==t?t:I})),_=Object(n.useMemo)((()=>Object(g.b)({globalFullScreen:l,isActiveTimelines:Object(d.isActiveTimeline)(a),timelineFullScreen:c})),[l,a,c]);Object(n.useEffect)((()=>()=>{const e=Object(d.getScopedActions)(a);e&&s(e.updateGraphEventId({id:a,graphEventId:""})),Object(d.isActiveTimeline)(a)?s(f.c.setFullScreen({id:m.a.timeline,fullScreen:!1})):s(f.c.setFullScreen({id:m.a.global,fullScreen:!1}))}),[s,a]);const{from:F,to:A,shouldUpdate:D,selectedPatterns:N}=Object(h.a)(Object(d.isActiveTimeline)(a)),P=Object(n.useMemo)((()=>({from:F,to:A})),[F,A]),R=Object(n.useRef)(null);Object(n.useLayoutEffect)((()=>{_&&R.current?R.current.setAttribute("style",k.join("")):R.current&&R.current.setAttribute("style",j.join(""))}),[_]);const L=Object(n.useMemo)((()=>void 0!==C?i.a.createElement(w,{databaseDocumentID:C,resolverComponentInstanceID:a,indices:N,shouldUpdate:D,filters:P}):i.a.createElement(r.EuiFlexGroup,{alignItems:"center",justifyContent:"center",style:{height:"100%"}},i.a.createElement(r.EuiLoadingSpinner,{size:"xl"}))),[C,a,N,D,P]);return Object(d.isActiveTimeline)(a)||null===M?_&&!Object(d.isActiveTimeline)(a)?i.a.createElement(O,{"data-test-subj":"overlayContainer"},i.a.createElement(r.EuiHorizontalRule,{margin:"none"}),i.a.createElement(r.EuiFlexGroup,{gutterSize:"none",justifyContent:"spaceBetween"},i.a.createElement(r.EuiFlexItem,{grow:!1},t)),i.a.createElement(r.EuiHorizontalRule,{margin:"none"}),L):i.a.createElement(S,{"data-test-subj":"overlayContainer"},i.a.createElement(r.EuiHorizontalRule,{margin:"none"}),i.a.createElement(r.EuiFlexGroup,{gutterSize:"none",justifyContent:"spaceBetween"},i.a.createElement(r.EuiFlexItem,{grow:!1},t)),i.a.createElement(r.EuiHorizontalRule,{margin:"none"}),L):i.a.createElement(S,{"data-test-subj":"overlayContainer",ref:R},i.a.createElement(r.EuiFlexGroup,{alignItems:"flexStart",gutterSize:"none",direction:"column"},i.a.createElement(r.EuiHorizontalRule,{margin:"none"}),i.a.createElement(r.EuiFlexItem,{grow:!1},t),i.a.createElement(r.EuiHorizontalRule,{margin:"none"}),i.a.createElement(r.EuiSpacer,{size:"m"}),i.a.createElement(T,{grow:2,className:_?x:""},e)))},C=i.a.memo(I)},function(e,t,a){"use strict";a.d(t,"a",(function(){return m})),a.d(t,"b",(function(){return b}));var n=a(2),i=a.n(n),r=a(42),s=a(40),o=a(1280),l=a.n(o),c=a(1283),u=a(41);const d=a.n(u).a.span.withConfig({displayName:"FlagWrapper",componentId:"sc-pwsog3-0"})(["position:relative;top:1px;"]),p=e=>e&&2===e.length?e.toUpperCase().replace(/./g,(e=>String.fromCharCode(55356,56741+e.charCodeAt(0)))):null,m=Object(n.memo)((({countryCode:e,displayCountryNameOnHover:t=!1})=>{Object(n.useEffect)((()=>{t&&Object(r.isEmpty)(l.a.getNames("en"))&&l.a.registerLocale(c)}),[]);const a=p(e);return null!==a?t?i.a.createElement(s.EuiToolTip,{position:"top",content:l.a.getName(e,"en")},i.a.createElement(d,{"data-test-subj":"country-flag"},a)):i.a.createElement(d,{"data-test-subj":"country-flag"},a):null}));m.displayName="CountryFlag";const b=Object(n.memo)((({countryCode:e,displayCountryNameOnHover:t=!1})=>{const[a,o]=Object(n.useState)(!1);Object(n.useEffect)((()=>{Object(r.isEmpty)(l.a.getNames("en"))&&l.a.registerLocale(c),o(!0)}),[]);const u=p(e);return null!==u&&a?t?i.a.createElement(s.EuiToolTip,{position:"top",content:l.a.getName(e,"en")},i.a.createElement(d,{"data-test-subj":"country-flag"},u)):i.a.createElement(i.a.Fragment,null,i.a.createElement(d,{"data-test-subj":"country-flag"},u),` ${l.a.getName(e,"en")}`):null}));b.displayName="CountryFlagAndName"},function(e,t,a){"use strict";a.d(t,"b",(function(){return P})),a.d(t,"a",(function(){return R}));var n=a(42),i=a(50),r=a.n(i),s=a(62),o=a.n(s),l=a(49),c=a(5),u=a(129),d=a(3),p=a(563),m=a(118),b=a(106),g=a(530),f=a(133),y=a(164),h=a(161),v=a(115),E=a(501),x=a(209),j=a(102),S=a(4),k=a(534),O=a(286);a(410);const w=({ecs:e})=>{if(Array.isArray(e)){const t=e.reduce(((e,t)=>{const a=t.timestamp?new Date(t.timestamp):new Date;return e.includes(a.valueOf())?e:[...e,a.valueOf()]}),[]);return{from:new Date(Math.min(...t)).toISOString(),to:new Date(Math.max(...t)).toISOString()}}const t=e,a=Object(v.getField)(t,u.A),n=r.a.duration(r()().diff(o.a.parse(null!=a?a[0]:"now-1d"))),i=Object(v.getField)(t,u.sb),s=Array.isArray(i)?i[0]:i,l=r()(null!=s?s:new Date).toISOString();return{to:l,from:r()(l).subtract(n).toISOString()}},T=e=>{const t=Object(v.getField)(e,u.O);return"threshold"===t||Array.isArray(t)&&t.length>0&&"threshold"===t[0]},I=e=>{const t=Object(v.getField)(e,u.O);return"new_terms"===t||Array.isArray(t)&&t.length>0&&"new_terms"===t[0]},C=e=>null!=Object(v.getField)(e,u.Y),M=(e,t,a="Alert Ids")=>1===t.length?[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:e,params:{query:t[0]}},query:{match_phrase:{_id:t[0]}},$state:{store:l.FilterStateStore.APP_STATE}}]:[{query:{bool:{filter:{ids:{values:t}}}},meta:{alias:a,negate:!1,disabled:!1,type:"phrases",key:e,value:t.join(),params:t},$state:{store:l.FilterStateStore.APP_STATE}}],_=(e,t)=>{const a=1===t.length;return[{and:[],id:`send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${m.c.active}-alert-id-${t.join(",")}`,name:t.join(","),enabled:!0,excluded:!1,kqlQuery:"",queryMatch:{field:e,value:a?t[0]:t,operator:a?":":"includes"}}]},F=(e,t,a)=>({filters:"KqlFilter"===t?M("_id",e,a):[],dataProviders:"dataProvider"===t?_("_id",e):[]}),A=async(e,t,a,n,i)=>{try{var s,l,d,b,g,y,h,E,x,w,T,I,C,M,_,F,A,D,N,P,R,L;const c=await j.b.get().http.fetch(S.db,{method:"POST",body:JSON.stringify(Object(k.a)([e._id]))}),O=(null!==(s=null==c?void 0:c.hits.hits.reduce(((e,{_id:t,_index:a,_source:n={}})=>[...e,{...Object(k.b)(n),_id:t,_index:a,timestamp:n["@timestamp"]}]),[]))&&void 0!==s?s:[])[0],B=Object(v.getField)(O,u.G),q=Object(v.getField)(O,u.v),z=(null!==(l=null!==(d=B.filters)&&void 0!==d?d:null===(b=O.signal)||void 0===b||null===(g=b.rule)||void 0===g?void 0:g.filters)&&void 0!==l?l:[]).map((e=>null!=e.meta?e:{...e,meta:{}})),$=null!==(y=null!==(h=B.language)&&void 0!==h?h:null===(E=O.signal)||void 0===E||null===(x=E.rule)||void 0===x?void 0:x.language)&&void 0!==y?y:"kuery",V=null!==(w=null!==(T=B.query)&&void 0!==T?T:null===(I=O.signal)||void 0===I||null===(C=I.rule)||void 0===C?void 0:C.query)&&void 0!==w?w:"",U=null!==(M=null!==(_=Object(v.getField)(O,p.f))&&void 0!==_?_:null===(F=O.signal)||void 0===F||null===(A=F.rule)||void 0===A?void 0:A.index)&&void 0!==M?M:[],{thresholdFrom:H,thresholdTo:G,dataProviders:Q}=(e=>(Array.isArray(e)?e:[e]).reduce(((e,t)=>{var a,n,i,s;const l=null!==(a=Object(v.getField)(t,`${u.G}.threshold`))&&void 0!==a?a:null===(n=t.signal)||void 0===n||null===(i=n.rule)||void 0===i?void 0:i.threshold,c=Object(v.getField)(t,p.h),d=Object(v.getField)(t,p.e),b=Array.isArray(d)?d[0]:d,g=r()(b),f=((e,t)=>{const a=Object(v.getField)(e,u.A),n=Array.isArray(a)?a[0]:a,i=o.a.parse(n),s=r()(),l=r.a.duration(s.diff(i));return t.clone().subtract(l)})(t,g),y=Array.isArray(l.field)?l.field:[l.field];return{thresholdFrom:null!==(s=c.from)&&void 0!==s?s:f.toISOString(),thresholdTo:g.toISOString(),dataProviders:[...e.dataProviders,...y.reduce(((e,t,a)=>{const n=c.terms.filter((e=>e.field===t))[0].value,i=Array.isArray(n)?n[0]:n;if(!i)return e;const r=t.replace(".","-"),s={id:`send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${m.c.active}-${r}-${i}`,name:t,enabled:!0,excluded:!1,kqlQuery:"",queryMatch:{field:t,value:i,operator:":"}};return 0===a?[...e,{...s,and:[]}]:(e[0].and.push(s),e)}),[])]}}),{dataProviders:[],thresholdFrom:"",thresholdTo:""}))(O),W=await i(e),K=(null!==(D=n.filters)&&void 0!==D?D:z).concat(W?[W]:[]);return t({from:H,notes:null,timeline:{...f.b,columns:null!==(N=n.columns)&&void 0!==N?N:f.b.columns,description:`_id: ${O._id}`,filters:K,dataProviders:null!==(P=n.dataProviders)&&void 0!==P?P:Q,id:m.c.active,indexNames:U,dateRange:{start:H,end:G},eventType:"all",kqlQuery:{filterQuery:{kuery:{kind:$,expression:null!==(R=n.query)&&void 0!==R?R:V},serializedQuery:null!==(L=n.query)&&void 0!==L?L:V}}},to:G,ruleNote:a,ruleAuthor:q})}catch(a){const{toasts:n}=j.b.get().notifications;n.addError(a,{toastMessage:c.i18n.translate("xpack.securitySolution.detectionEngine.alerts.createThresholdTimelineFailure",{defaultMessage:"Failed to create timeline for document _id: {id}",values:{id:e._id}}),title:c.i18n.translate("xpack.securitySolution.detectionEngine.alerts.createThresholdTimelineFailureTitle",{defaultMessage:"Failed to create threshold alert timeline"})});const i=O.a.toISOString(),r=O.b.toISOString();return t({from:i,notes:null,timeline:{...f.b,id:m.c.active,indexNames:[],dateRange:{start:i,end:r},eventType:"all"},to:r})}},D=async(e,t,a,n,i)=>{try{var s,o,l,d,b,g,y,h,E,x,w,T,I,C,M,_,F,A,D,N,P,R;const c=await j.b.get().http.fetch(S.db,{method:"POST",body:JSON.stringify(Object(k.a)([e._id]))}),O=(null!==(s=null==c?void 0:c.hits.hits.reduce(((e,{_id:t,_index:a,_source:n={}})=>[...e,{...Object(k.b)(n),_id:t,_index:a,timestamp:n["@timestamp"]}]),[]))&&void 0!==s?s:[])[0],L=Object(v.getField)(O,u.G),B=(null!==(o=null!==(l=L.filters)&&void 0!==l?l:null===(d=O.signal)||void 0===d||null===(b=d.rule)||void 0===b?void 0:b.filters)&&void 0!==o?o:[]).map((e=>null!=e.meta?e:{...e,meta:{}})),q=null!==(g=null!==(y=L.language)&&void 0!==y?y:null===(h=O.signal)||void 0===h||null===(E=h.rule)||void 0===E?void 0:E.language)&&void 0!==g?g:"kuery",z=null!==(x=null!==(w=L.query)&&void 0!==w?w:null===(T=O.signal)||void 0===T||null===(I=T.rule)||void 0===I?void 0:I.query)&&void 0!==x?x:"",$=null!==(C=null!==(M=Object(v.getField)(O,p.f))&&void 0!==M?M:null===(_=O.signal)||void 0===_||null===(F=_.rule)||void 0===F?void 0:F.index)&&void 0!==C?C:[],{from:V,to:U,dataProviders:H}=(e=>{var t;const a=Array.isArray(e)?e[0]:e,n=Object(v.getField)(a,p.e),i=(null!==(t=Object(v.getField)(a,`${u.G}.new_terms_fields`))&&void 0!==t?t:[]).map(((e,t)=>{const n=e.replace(".","-"),i=Object(v.getField)(a,p.b)[t];return{id:`send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${m.c.active}-${n}-${i}`,name:e,enabled:!0,excluded:!1,kqlQuery:"",queryMatch:{field:e,value:i,operator:":"},and:[]}})),s=i.length?[{...i[0],and:i.slice(1)}]:[];return{from:n,to:r()().toISOString(),dataProviders:s}})(O),G=await i(e),Q=(null!==(A=n.filters)&&void 0!==A?A:B).concat(G?[G]:[]);return t({from:V,notes:null,timeline:{...f.b,columns:null!==(D=n.columns)&&void 0!==D?D:f.b.columns,description:`_id: ${O._id}`,filters:Q,dataProviders:null!==(N=n.dataProviders)&&void 0!==N?N:H,id:m.c.active,indexNames:$,dateRange:{start:V,end:U},eventType:"all",kqlQuery:{filterQuery:{kuery:{kind:q,expression:null!==(P=n.query)&&void 0!==P?P:z},serializedQuery:null!==(R=n.query)&&void 0!==R?R:z}}},to:U,ruleNote:a})}catch(a){const{toasts:n}=j.b.get().notifications;n.addError(a,{toastMessage:c.i18n.translate("xpack.securitySolution.detectionEngine.alerts.createNewTermsTimelineFailure",{defaultMessage:"Failed to create timeline for document _id: {id}",values:{id:e._id}}),title:c.i18n.translate("xpack.securitySolution.detectionEngine.alerts.createNewTermsTimelineFailureTitle",{defaultMessage:"Failed to create new terms alert timeline"})});const i=O.a.toISOString(),r=O.b.toISOString();return t({from:i,notes:null,timeline:{...f.b,id:m.c.active,indexNames:[],dateRange:{start:i,end:r},eventType:"all"},to:r})}},N=async(e,t,a,n,i)=>{try{var r,s,o,l,d,b,g,y,h,E,x,w,T,I,C,M,_,F,A,D,N,P;const c=await j.b.get().http.fetch(S.db,{method:"POST",body:JSON.stringify(Object(k.a)([e._id]))}),O=(null!==(r=null==c?void 0:c.hits.hits.reduce(((e,{_id:t,_index:a,_source:n={}})=>[...e,{...Object(k.b)(n),_id:t,_index:a,timestamp:n["@timestamp"]}]),[]))&&void 0!==r?r:[])[0],R=Object(v.getField)(O,u.G),L=(null!==(s=null!==(o=R.filters)&&void 0!==o?o:null===(l=O.signal)||void 0===l||null===(d=l.rule)||void 0===d?void 0:d.filters)&&void 0!==s?s:[]).map((e=>null!=e.meta?e:{...e,meta:{}})),B=null!==(b=null!==(g=R.language)&&void 0!==g?g:null===(y=O.signal)||void 0===y||null===(h=y.rule)||void 0===h?void 0:h.language)&&void 0!==b?b:"kuery",q=null!==(E=null!==(x=R.query)&&void 0!==x?x:null===(w=O.signal)||void 0===w||null===(T=w.rule)||void 0===T?void 0:T.query)&&void 0!==E?E:"",z=null!==(I=null!==(C=Object(v.getField)(O,p.f))&&void 0!==C?C:null===(M=O.signal)||void 0===M||null===(_=M.rule)||void 0===_?void 0:_.index)&&void 0!==I?I:[],{from:$,to:V,dataProviders:U}=(e=>{const t=Array.isArray(e)?e[0]:e,a=Object(v.getField)(t,u.bb),n=Object(v.getField)(t,u.Z),i=Object(v.getField)(t,u.cb).map((e=>{const t=e.field.replace(".","-"),a=`send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${m.c.active}-${t}-${e.value}`;return null==e.value?{id:a,name:t,enabled:!0,excluded:!0,kqlQuery:"",queryMatch:{field:e.field,value:"",operator:":*"}}:{id:a,name:t,enabled:!0,excluded:!1,kqlQuery:"",queryMatch:{field:e.field,value:e.value,operator:":"}}}));return{from:a,to:n,dataProviders:[{...i[0],and:i.slice(1)}]}})(O),H=await i(e),G=(null!==(F=n.filters)&&void 0!==F?F:L).concat(H?[H]:[]);return t({from:$,notes:null,timeline:{...f.b,columns:null!==(A=n.columns)&&void 0!==A?A:f.b.columns,description:`_id: ${O._id}`,filters:G,dataProviders:null!==(D=n.dataProviders)&&void 0!==D?D:U,id:m.c.active,indexNames:z,dateRange:{start:$,end:V},eventType:"all",kqlQuery:{filterQuery:{kuery:{kind:B,expression:null!==(N=n.query)&&void 0!==N?N:q},serializedQuery:null!==(P=n.query)&&void 0!==P?P:q}}},to:V,ruleNote:a})}catch(a){const{toasts:n}=j.b.get().notifications;n.addError(a,{toastMessage:c.i18n.translate("xpack.securitySolution.detectionEngine.alerts.createSuppressedTimelineFailure",{defaultMessage:"Failed to create timeline for document _id: {id}",values:{id:e._id}}),title:c.i18n.translate("xpack.securitySolution.detectionEngine.alerts.createSuppressedTimelineFailureTitle",{defaultMessage:"Failed to create suppressed alert timeline"})});const i=O.a.toISOString(),r=O.b.toISOString();return t({from:i,notes:null,timeline:{...f.b,id:m.c.active,indexNames:[],dateRange:{start:i,end:r},eventType:"all"},to:r})}},P=(e,t,a="dataProvider",n)=>{const i=Array.isArray(t)?t.map((e=>e._id)):[],{to:r,from:s}=w({ecs:t}),{dataProviders:o,filters:l}=F(i,a,n||`${t.length} event IDs`);e({from:s,notes:null,timeline:{...f.b,dataProviders:o,id:m.c.active,indexNames:[],dateRange:{start:s,end:r},eventType:"all",filters:l,kqlQuery:{filterQuery:{kuery:{kind:"kuery",expression:""},serializedQuery:""}}},to:r})},R=async({createTimeline:e,ecsData:t,updateTimelineIsLoading:a,searchStrategyClient:i,getExceptionFilter:r})=>{const s=Array.isArray(t)?t[0]:t,o=Object(v.getField)(s,u.F),l=Object(v.getField)(s,u.v),c=Array.isArray(o)&&o.length>0?o[0]:"",j=Object(v.getField)(s,p.g),S=Object(n.isEmpty)(j)?"":Array.isArray(j)?j[0]:j,{to:k,from:O}=w({ecs:t});if(Object(n.isEmpty)(S)){if(T(s))return A(s,e,c,{},r);if(I(s))return D(s,e,c,{},r);if(C(s))return N(s,e,c,{},r);{let{dataProviders:a,filters:i}=F([s._id],"dataProvider");if((e=>{const t=Object(v.getField)(e,u.O),a=Object(v.getField)(e,p.a);return("eql"===t||Array.isArray(t)&&"eql"===t[0])&&(null==a?void 0:a.length)>0})(s)){const e=((e,t)=>{if(!Object(n.isEmpty)(e)&&Array.isArray(t)&&t.length>1)return{dataProviders:[],filters:M(p.a,t.reduce(((e,t)=>{const a=Object(v.getField)(t,p.a),n=Array.isArray(a)?a[0]:a;return e.includes(n)?e:[...e,n]}),[]))};if(!Array.isArray(t)||1===t.length){const e=Array.isArray(t)?t[0]:t,a=Object(v.getField)(e,p.a),n=Object(v.getFieldKey)(e,p.a),i=Array.isArray(a)?a[0]:a;return{dataProviders:[{and:[],id:`send-alert-to-timeline-action-default-draggable-event-details-value-formatted-field-value-${m.c.active}-alert-id-${i}`,name:e._id,enabled:!0,excluded:!1,kqlQuery:"",queryMatch:{field:n,value:i,operator:":"}}],filters:[]}}return{filters:[],dataProviders:[]}})([s._id],t);a=e.dataProviders,i=e.filters}return e({from:O,notes:null,timeline:{...f.b,dataProviders:a,id:m.c.active,indexNames:[],dateRange:{start:O,end:k},eventType:"all",filters:i,kqlQuery:{filterQuery:{kuery:{kind:"kuery",expression:""},serializedQuery:""}}},to:k,ruleNote:c,ruleAuthor:l})}}try{var _,P;a({id:m.c.active,isLoading:!0});const[t,o]=await Promise.all([Object(x.d)(S),Object(d.lastValueFrom)(i.search({defaultIndex:[],indexName:null!==(_=s._index)&&void 0!==_?_:"",eventId:s._id,factoryQueryType:g.c.details},{strategy:"timelineSearchStrategy"}))]),u=Object(n.getOr)({},"data.getOneTimeline",t),p=null!==(P=o.data)&&void 0!==P?P:[];if(!Object(n.isEmpty)(u)){var R,L,B,q,z,$,V;const t=Object(y.g)(u),{timeline:a,notes:n}=Object(y.c)(t,!0,null!==(R=t.timelineType)&&void 0!==R?R:b.l.default),i=Object(E.d)(null!==(L=null===(B=a.kqlQuery)||void 0===B||null===(q=B.filterQuery)||void 0===q||null===(z=q.kuery)||void 0===z?void 0:z.expression)&&void 0!==L?L:"",p,a.timelineType),o=Object(E.c)(null!==($=a.filters)&&void 0!==$?$:[],p),d=Object(E.b)(null!==(V=a.dataProviders)&&void 0!==V?V:[],p,a.timelineType);return T(s)?A(s,e,c,{filters:o,query:i,dataProviders:d,columns:a.columns},r):I(s)?D(s,e,c,{filters:o,query:i,dataProviders:d,columns:a.columns},r):C(s)?N(s,e,c,{filters:o,query:i,dataProviders:d,columns:a.columns},r):e({from:O,timeline:{...a,title:"",timelineType:b.l.default,templateTimelineId:null,status:b.k.draft,dataProviders:d,eventType:"all",filters:o,dateRange:{start:O,end:k},kqlQuery:{filterQuery:{kuery:{kind:null!==(U=null===(H=a.kqlQuery)||void 0===H||null===(G=H.filterQuery)||void 0===G||null===(Q=G.kuery)||void 0===Q?void 0:Q.kind)&&void 0!==U?U:"kuery",expression:i},serializedQuery:Object(h.f)(i)}},noteIds:null!==(W=null==n?void 0:n.map((e=>e.noteId)))&&void 0!==W?W:[],show:!0},to:k,ruleNote:c,ruleAuthor:l,notes:null!=n?n:null});var U,H,G,Q,W}}catch{return a({id:m.c.active,isLoading:!1}),e({from:O,notes:null,timeline:{...f.b,id:m.c.active,indexNames:[],dateRange:{start:O,end:k},eventType:"all"},to:k})}}},,function(e,t,a){"use strict";var n=a(328);a.d(t,"b",(function(){return n.b}));var i=a(734);a.d(t,"a",(function(){return i.a}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(119),i=a(2),r=a(103),s=a(105);const{updateShowBuildingBlockAlertsFilter:o,updateShowThreatIndicatorAlertsFilter:l}=n.h,c=e=>{const t=Object(r.useDispatch)(),a=Object(i.useMemo)((()=>n.j.getTableByIdSelector()),[]),{showOnlyThreatIndicatorAlerts:c,showBuildingBlockAlerts:u}=Object(s.b)((t=>{var i,r;return null!==(i=(null!==(r=a(t,e))&&void 0!==r?r:n.q).additionalFilters)&&void 0!==i?i:n.q.additionalFilters}));return{showBuildingBlockAlerts:u,setShowBuildingBlockAlerts:Object(i.useCallback)((a=>{t(o({id:e,showBuildingBlockAlerts:a}))}),[t,e]),showOnlyThreatIndicatorAlerts:c,setShowOnlyThreatIndicatorAlerts:Object(i.useCallback)((a=>{t(l({id:e,showOnlyThreatIndicatorAlerts:a}))}),[t,e])}}},function(e,t,a){"use strict";a.d(t,"d",(function(){return l})),a.d(t,"f",(function(){return c})),a.d(t,"e",(function(){return u})),a.d(t,"b",(function(){return d})),a.d(t,"c",(function(){return p})),a.d(t,"a",(function(){return b})),a(197);var n=a(268),i=a(4),r=a(213),s=a(207),o=a(334);const l=[r.c.defineRule,r.c.aboutRule,r.c.scheduleRule,r.c.ruleActions],c={anomalyThreshold:50,index:[],indexPattern:{fields:[],title:""},machineLearningJobId:[],ruleType:"query",threatIndex:[],queryBar:{query:{query:"",language:"kuery"},filters:[],saved_id:null},threatQueryBar:{query:{query:i.U,language:"kuery"},filters:[],saved_id:null},requiredFields:[],relatedIntegrations:[],threatMapping:[],threshold:{field:[],value:"200",cardinality:{field:[],value:""}},timeline:{id:null,title:n.b},eqlOptions:{},dataSourceType:r.a.IndexPatterns,newTermsFields:[],historyWindowSize:"7d",shouldLoadQueryDynamically:!1,groupByFields:[],groupByRadioSelection:r.b.PerRuleExecution,groupByDuration:{value:5,unit:"m"},suppressionMissingFields:s.f},u={author:[],name:"",description:"",isAssociatedToEndpointList:!1,isBuildingBlock:!1,severity:{value:"low",mapping:Object(o.c)([]),isMappingChecked:!1},riskScore:{value:21,mapping:[],isMappingChecked:!1},investigationFields:[],references:[""],falsePositives:[""],license:"",ruleNameOverride:"",tags:[],timestampOverride:"",threat:[{framework:"MITRE ATT&CK",tactic:{id:"none",name:"none",reference:"none"},technique:[]}],note:"",threatIndicatorPath:void 0,timestampOverrideFallbackDisabled:void 0},d={interval:"5m",from:"1m"},p={interval:"1h",from:"5m"},m={...c.queryBar,query:{...c.queryBar.query,query:"*:*"}},b={forNormalRules:c.queryBar,forThreatMatchRules:m}},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(2),i=a(172),r=a(675),s=a(137),o=a(688),l=a(591),c=a(859);const u=`${s.Gb}.ndjson`;function d(){const e=Object(c.a)(),t=Object(l.a)();return Object(n.useCallback)((async a=>{try{Object(r.a)(a,u),e({actionType:i.b.export,summary:await Object(o.b)(a)})}catch(e){t({actionType:i.b.export,error:e})}}),[e,t])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return p}));var n=a(2),i=a.n(n),r=a(40),s=a(41),o=a.n(s),l=a(339);const c=o.a.h1.withConfig({displayName:"Header",componentId:"sc-1epdllw-0"})(["display:grid;grid-gap:12px;grid-template-columns:auto auto;align-items:center;justify-items:start;justify-content:start;"]);c.displayName="Header";const u=o.a.span.withConfig({displayName:"TitleWrapper",componentId:"sc-1epdllw-1"})(["min-width:0;max-width:100%;"]);u.displayName="TitleWrapper";const d=({title:e,badgeOptions:t})=>i.a.createElement(r.EuiTitle,{size:"l"},i.a.createElement(c,{"data-test-subj":"header-page-title"},i.a.createElement(u,null,i.a.createElement(l.b,{tooltipContent:e},e)),t&&i.a.createElement(i.a.Fragment,null,t.beta?i.a.createElement(r.EuiBetaBadge,{label:t.text,tooltipContent:t.tooltip,tooltipPosition:"bottom",size:t.size}):i.a.createElement(r.EuiBadge,{color:t.color||"hollow",title:""},t.text)))),p=i.a.memo(d)},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(204),r=a(474),s=a(957);const o=()=>{const{enableDatafeed:e,isLoading:t}=Object(s.a)(),{loading:a,jobs:o,refetch:l}=Object(r.a)(),[c,u]=Object(n.useState)(!1),d=Object(n.useCallback)((async n=>{if(a||t)return;if(!n||!n.length)return;u(!0);const r=o.filter((e=>n.includes(e.id)));await Promise.all(r.map((async t=>{var a;if(Object(i.c)(t.jobState,t.datafeedState))return!0;const n=null!==(a=t.latestTimestampMs)&&void 0!==a?a:0;await e(t,n)}))),l(),u(!1)}),[e,t,a,o,l]);return{loading:a,jobs:o,starting:c,startMlJobs:d}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"e",(function(){return l})),a.d(t,"f",(function(){return c})),a.d(t,"d",(function(){return u})),a.d(t,"c",(function(){return d})),a.d(t,"b",(function(){return p}));var n=a(45),i=a(139),r=a(173);const s=e=>e.artifacts.location,o=e=>{var t;return null===(t=e.location)||void 0===t?void 0:t.pathname},l=Object(i.createSelector)(o,(e=>null!==Object(n.matchPath)(null!=e?e:"",{path:r.n,exact:!0}))),c=Object(i.createSelector)(o,(e=>null!==Object(n.matchPath)(null!=e?e:"",{path:r.q,exact:!0}))),u=Object(i.createSelector)(o,(e=>null!==Object(n.matchPath)(null!=e?e:"",{path:r.m,exact:!0}))),d=Object(i.createSelector)(o,(e=>null!==Object(n.matchPath)(null!=e?e:"",{path:r.o,exact:!0}))),p=Object(i.createSelector)(o,(e=>null!==Object(n.matchPath)(null!=e?e:"",{path:r.l,exact:!0})))},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(2),i=a(45);const r=(e,t)=>{const a=Object(i.useHistory)();return Object(n.useCallback)((n=>{try{t&&t(n)}catch(e){throw n.preventDefault(),e}n.defaultPrevented||0===n.button&&(n.currentTarget instanceof HTMLAnchorElement&&""!==n.currentTarget.target&&"_self"!==n.currentTarget.target||n.metaKey||n.altKey||n.ctrlKey||n.shiftKey||(n.preventDefault(),Array.isArray(e)?a.push(...e):a.push(e)))}),[a,t,e])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return BlocklistsApiClient}));var n=a(163),i=a(1128),r=a(733),s=a(1381);function o(e){return{...e,entries:Object(i.b)(e.entries)}}function l(e){return{...e,entries:Object(i.a)(e.entries)}}class BlocklistsApiClient extends r.a{constructor(e){super(e,n.c,s.a,o,l)}static getInstance(e){return super.getInstance(e,n.c,s.a,o,l)}}},,function(e,t,a){"use strict";a.d(t,"d",(function(){return U})),a.d(t,"a",(function(){return H})),a.d(t,"c",(function(){return G})),a.d(t,"b",(function(){return Q}));var n=a(2),i=a.n(n),r=a(40),s=a(1419),o=a.n(s),l=a(48),c=a(5);const u=c.i18n.translate("xpack.securitySolution.flyout.documentDetails.viewRuleDetailsText",{defaultMessage:"Show rule details"}),d=c.i18n.translate("xpack.securitySolution.flyout.documentDetails.rulePreviewAboutSectionText",{defaultMessage:"About"}),p=c.i18n.translate("xpack.securitySolution.flyout.documentDetails.rulePreviewDefinitionSectionText",{defaultMessage:"Definition"}),m=c.i18n.translate("xpack.securitySolution.flyout.documentDetails.rulePreviewScheduleSectionText",{defaultMessage:"Schedule"}),b=c.i18n.translate("xpack.securitySolution.flyout.documentDetails.rulePreviewActionsSectionText",{defaultMessage:"Actions"}),g=c.i18n.translate("xpack.securitySolution.flyout.documentDetails.alertReasonTitle",{defaultMessage:"Alert reason"});var f=a(322);const y=(f.c,f.a,"securitySolutionDocumentDetailsFlyoutRulePreviewDefinitionSection"),h=(f.c,f.a,"securitySolutionDocumentDetailsFlyoutRulePreviewScheduleSection"),v=(f.c,f.a,"securitySolutionDocumentDetailsFlyoutRulePreviewActionsSection");f.c,f.a;var E=a(744),x=a(420),j=a(382);const S=o.a.div`
  overflow-x: auto;
  padding-block: ${l.euiThemeVars.euiSizeS};
`,k=o.a.div``,O=()=>{const{dataAsNestedObject:e,scopeId:t}=Object(E.b)(),a=Object(n.useMemo)((()=>null!=e?Object(x.a)({data:e,rowRenderers:j.b}):null),[e]),s=Object(n.useMemo)((()=>a&&e?a.renderRow({contextId:"event-details",data:e,isDraggable:!1,scopeId:t}):null),[a,e,t]);return e&&a?i.a.createElement(r.EuiPanel,{hasShadow:!1,"data-test-subj":"securitySolutionDocumentDetailsFlyoutAlertReasonPreviewBody"},i.a.createElement(r.EuiTitle,null,i.a.createElement("h6",null,g)),i.a.createElement(r.EuiSpacer,{size:"m"}),i.a.createElement(S,null,i.a.createElement(k,{className:"eui-displayInlineBlock"},s))):null};O.displayName="AlertReasonPreview";const w=c.i18n.translate("xpack.securitySolution.flyout.documentDetails.rulePreviewPanel",{defaultMessage:"Rule preview"}),T=c.i18n.translate("xpack.securitySolution.flyout.documentDetails.alertReasonPreviewPanel",{defaultMessage:"Alert reason preview"});var I=a(102),C=a(741),M=a(282),_=a(334),F=a(862),A=a(954);const D=({rule:e,isSuppressed:t})=>i.a.createElement("div",{"data-test-subj":"securitySolutionDocumentDetailsFlyoutRulePreviewTitle"},i.a.createElement(r.EuiTitle,null,i.a.createElement("h6",null,e.name)),t&&i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(r.EuiBadge,{"data-test-subj":"securitySolutionDocumentDetailsFlyoutRulePreviewTitleSuppressed",title:""},F.a)),i.a.createElement(r.EuiSpacer,{size:"s"}),i.a.createElement(r.EuiFlexGroup,{gutterSize:"xs",direction:"column"},i.a.createElement(r.EuiFlexItem,{"data-test-subj":"securitySolutionDocumentDetailsFlyoutRulePreviewCreatedByText"},i.a.createElement(r.EuiText,{size:"xs"},i.a.createElement(A.a,{createdBy:null==e?void 0:e.created_by,createdAt:null==e?void 0:e.created_at}))),i.a.createElement(r.EuiFlexItem,{"data-test-subj":"securitySolutionDocumentDetailsFlyoutRulePreviewUpdatedByText"},i.a.createElement(r.EuiText,{size:"xs"},i.a.createElement(A.b,{updatedBy:null==e?void 0:e.updated_by,updatedAt:null==e?void 0:e.updated_at})))));D.displayName="RulePreviewTitle";var N=a(746),P=a(745),R=a(740),L=a(528);const B=Object(n.memo)((()=>{var e,t;const{ruleId:a,indexPattern:s}=Object(E.b)(),[o,l]=Object(n.useState)(null),{rule:c,loading:u,isExistingRule:g}=Object(M.a)(null!=a?a:""),{data:x}=Object(I.j)().services;Object(n.useEffect)((()=>{null!=c&&l(c)}),[c]);const{aboutRuleData:j,defineRuleData:S,scheduleRuleData:k,ruleActionsData:O}=null!=o?Object(_.g)({rule:o,detailsView:!0}):{aboutRuleData:null,defineRuleData:null,scheduleRuleData:null,ruleActionsData:null},[w,T]=Object(n.useState)();Object(n.useEffect)((()=>{(async()=>{if(null!=(null==S?void 0:S.dataViewId)&&""!==(null==S?void 0:S.dataViewId)){const e=await x.dataViews.get(null==S?void 0:S.dataViewId);T(e.title)}})()}),[x.dataViews,null==S?void 0:S.dataViewId]);const{isSavedQueryLoading:F,savedQueryBar:A}=Object(C.a)({savedQueryId:null==o?void 0:o.saved_id,ruleType:null==o?void 0:o.type}),B=Boolean(null==O||null===(e=O.actions)||void 0===e?void 0:e.length),q=Boolean(null==O||null===(t=O.responseActions)||void 0===t?void 0:t.length),z=null!=O&&(B||q);return o?i.a.createElement(r.EuiPanel,{hasShadow:!1,"data-test-subj":"securitySolutionDocumentDetailsFlyoutRulePreviewBody",className:"eui-yScroll"},i.a.createElement(D,{rule:o,isSuppressed:!g}),i.a.createElement(r.EuiHorizontalRule,{margin:"s"}),i.a.createElement(f.b,{title:d,expanded:!0,"data-test-subj":"securitySolutionDocumentDetailsFlyoutRulePreviewAboutSection"},i.a.createElement(r.EuiText,{size:"s"},o.description),i.a.createElement(r.EuiSpacer,{size:"s"}),j&&i.a.createElement(N.b,{addPadding:!1,descriptionColumns:"single",defaultValues:j,isInPanelView:!0})),i.a.createElement(r.EuiHorizontalRule,{margin:"l"}),S&&!F&&i.a.createElement(i.a.Fragment,null,i.a.createElement(f.b,{title:p,expanded:!1,"data-test-subj":y},i.a.createElement(P.c,{addPadding:!1,descriptionColumns:"single",defaultValues:{...S,dataViewTitle:w,queryBar:null!=A?A:S.queryBar},indexPattern:s,isInPanelView:!0})),i.a.createElement(r.EuiHorizontalRule,{margin:"l"})),k&&i.a.createElement(i.a.Fragment,null,i.a.createElement(f.b,{title:m,expanded:!1,"data-test-subj":h},i.a.createElement(R.b,{addPadding:!1,descriptionColumns:"single",defaultValues:k,isInPanelView:!0})),i.a.createElement(r.EuiHorizontalRule,{margin:"l"})),z&&i.a.createElement(f.b,{title:b,expanded:!1,"data-test-subj":v},i.a.createElement(L.b,{addPadding:!1,defaultValues:O}))):u?i.a.createElement(r.EuiLoadingSpinner,{size:"l","data-test-subj":"securitySolutionDocumentDetailsFlyoutRulePreviewLoadingSpinner"}):null}));B.displayName="RulePreview";var q=a(1263),z=a(188);const $=Object(n.memo)((()=>{const{scopeId:e,eventId:t,ruleId:a}=Object(E.b)();return a?i.a.createElement(r.EuiFlyoutFooter,{"data-test-subj":"securitySolutionDocumentDetailsFlyoutRulePreviewFooter"},i.a.createElement(r.EuiFlexGroup,{justifyContent:"center"},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(q.a,{contextId:e,eventId:t,fieldName:z.n,fieldType:"string",isAggregatable:!1,isDraggable:!1,linkValue:a,value:u,openInNewTab:!0})))):null}));$.displayName="RulePreviewFooter";const V=[{id:"rule-preview",name:w,content:i.a.createElement(B,null),footer:i.a.createElement($,null)},{id:"alert-reason-preview",name:T,content:i.a.createElement(O,null)}],U="rule-preview",H="alert-reason-preview",G="document-details-preview",Q=Object(n.memo)((({path:e})=>{const t=Object(n.useMemo)((()=>e?V.find((t=>t.id===e.tab)):null),[e]);return t?i.a.createElement(r.EuiFlexGroup,{justifyContent:"spaceBetween",direction:"column",gutterSize:"none",style:{height:"100%"}},i.a.createElement(r.EuiFlexItem,{style:{marginTop:"-15px"}},t.content),i.a.createElement(r.EuiFlexItem,{grow:!1},t.footer)):null}));Q.displayName="PreviewPanel"},function(e,t,a){"use strict";a.d(t,"a",(function(){return ae}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(103),l=a(279),c=a(42),u=a(1101),d=a(534),p=a(105),m=a(708),b=a(1126),g=a(116),f=a(110),y=a(40),h=a(135);const v=s.a.createElement(s.a.Fragment,null,s.a.createElement("span",{className:"smallDot"},s.a.createElement(y.EuiIcon,{type:"dot",color:"#54b399"})),s.a.createElement("span",{className:"smallDot"},s.a.createElement(y.EuiIcon,{type:"dot",color:"#d6bf57"})),s.a.createElement("span",{className:"smallDot"},s.a.createElement(y.EuiIcon,{type:"dot",color:"#da8b45"})),s.a.createElement("span",null,s.a.createElement(y.EuiIcon,{type:"dot",color:"#e7664c"})),h.S),E=(e,t)=>{var a,n,i,r,o,l,c,u,d,p,m,b,g,f,E,x,j,S,k,O,w,T,I,C;const M=null!==(a=t.severitiesSubAggregation)&&void 0!==a&&a.buckets&&null!==(n=t.severitiesSubAggregation)&&void 0!==n&&null!==(i=n.buckets)&&void 0!==i&&i.length?(e=>{switch(e){case"low":return s.a.createElement(s.a.Fragment,null,s.a.createElement(y.EuiIcon,{type:"dot",color:"#54b399"}),h.Q);case"medium":return s.a.createElement(s.a.Fragment,null,s.a.createElement(y.EuiIcon,{type:"dot",color:"#d6bf57"}),h.R);case"high":return s.a.createElement(s.a.Fragment,null,s.a.createElement(y.EuiIcon,{type:"dot",color:"#da8b45"}),h.P);case"critical":return s.a.createElement(s.a.Fragment,null,s.a.createElement(y.EuiIcon,{type:"dot",color:"#e7664c"}),h.O)}return null})(null===(r=t.severitiesSubAggregation)||void 0===r?void 0:r.buckets[0].key.toString()):null,_=null!==(o=t.countSeveritySubAggregation)&&void 0!==o&&o.value&&(null===(l=t.countSeveritySubAggregation)||void 0===l?void 0:l.value)>1?v:M,F=_?[{title:h.N,renderer:_}]:[],A=[{title:h.K,badge:{value:t.doc_count,width:50,color:"#a83632"}}];switch(e){case"kibana.alert.rule.name":return[...F,{title:h.T,badge:{value:null!==(c=null===(u=t.usersCountAggregation)||void 0===u?void 0:u.value)&&void 0!==c?c:0}},{title:h.L,badge:{value:null!==(d=null===(p=t.hostsCountAggregation)||void 0===p?void 0:p.value)&&void 0!==d?d:0}},...A];case"host.name":return[...F,{title:h.T,badge:{value:null!==(m=null===(b=t.usersCountAggregation)||void 0===b?void 0:b.value)&&void 0!==m?m:0}},{title:h.M,badge:{value:null!==(g=null===(f=t.rulesCountAggregation)||void 0===f?void 0:f.value)&&void 0!==g?g:0}},...A];case"user.name":return[...F,{title:h.L,badge:{value:null!==(E=null===(x=t.hostsCountAggregation)||void 0===x?void 0:x.value)&&void 0!==E?E:0}},{title:h.M,badge:{value:null!==(j=null===(S=t.rulesCountAggregation)||void 0===S?void 0:S.value)&&void 0!==j?j:0}},...A];case"source.ip":return[...F,{title:h.L,badge:{value:null!==(k=null===(O=t.hostsCountAggregation)||void 0===O?void 0:O.value)&&void 0!==k?k:0}},{title:h.M,badge:{value:null!==(w=null===(T=t.rulesCountAggregation)||void 0===T?void 0:T.value)&&void 0!==w?w:0}},...A]}return[...F,{title:h.M,badge:{value:null!==(I=null===(C=t.rulesCountAggregation)||void 0===C?void 0:C.value)&&void 0!==I?I:0}},...A]};var x=a(48),j=a(517),S=a(728),k=a(137);const O=(e,t,a)=>{var n,i,r,o;switch(e){case"kibana.alert.rule.name":return Object(c.isArray)(t.key)?s.a.createElement(w,{ruleName:t.key[0],ruleDescription:null!==(n=Object(j.a)(null===(i=Object(j.a)(null===(r=t.description)||void 0===r?void 0:r.buckets))||void 0===i?void 0:i.key))&&void 0!==n?n:"",tags:null===(o=t.ruleTags)||void 0===o?void 0:o.buckets}):void 0;case"host.name":return s.a.createElement(T,{hostName:t.key,nullGroupMessage:a});case"user.name":return s.a.createElement(I,{userName:t.key,nullGroupMessage:a});case"source.ip":return s.a.createElement(C,{sourceIp:t.key,nullGroupMessage:a})}},w=s.a.memo((({ruleName:e,ruleDescription:t,tags:a})=>s.a.createElement("div",{style:{display:"table",tableLayout:"fixed",width:"100%"}},s.a.createElement(y.EuiFlexGroup,{"data-test-subj":"rule-name-group-renderer",gutterSize:"m",alignItems:"center"},s.a.createElement(y.EuiFlexItem,{grow:!1,style:{display:"contents"}},s.a.createElement(y.EuiTitle,{size:"xs"},s.a.createElement("h5",{className:"eui-textTruncate"},e.trim()))),a&&a.length>0?s.a.createElement(y.EuiFlexItem,{grow:!1},s.a.createElement(S.a,{items:a.map((e=>e.key.toString())),popoverTitle:k.pb,popoverButtonTitle:a.length.toString(),popoverButtonIcon:"tag",dataTestPrefix:"tags",renderItem:(e,t)=>s.a.createElement(y.EuiBadge,{color:"hollow",key:`${e}-${t}`,"data-test-subj":"tag"},e)})):null),s.a.createElement(y.EuiText,{size:"s"},s.a.createElement("p",{className:"eui-textTruncate"},s.a.createElement(y.EuiTextColor,{color:"subdued"},t))))));w.displayName="RuleNameGroup";const T=s.a.memo((({hostName:e,nullGroupMessage:t})=>s.a.createElement(y.EuiFlexGroup,{"data-test-subj":"host-name-group-renderer",gutterSize:"s",alignItems:"center"},s.a.createElement(y.EuiFlexItem,{grow:!1,style:{backgroundColor:x.euiThemeVars.euiColorVis1_behindText,borderRadius:"50%"}},s.a.createElement(y.EuiIcon,{type:"database",size:"l",style:{padding:4}})),s.a.createElement(y.EuiFlexItem,{grow:!1},s.a.createElement(y.EuiTitle,{size:"xs"},s.a.createElement("h5",null,e))),t&&s.a.createElement(y.EuiFlexItem,{grow:!1},s.a.createElement(y.EuiIconTip,{content:t,position:"right"})))));T.displayName="HostNameGroupContent";const I=s.a.memo((({userName:e,nullGroupMessage:t})=>{var a;const n=null!==(a=Object(j.a)(e))&&void 0!==a?a:"-";return s.a.createElement(y.EuiFlexGroup,{"data-test-subj":"user-name-group-renderer",gutterSize:"s",alignItems:"center"},s.a.createElement(y.EuiFlexItem,{grow:!1},s.a.createElement(y.EuiAvatar,{name:n,color:x.euiThemeVars.euiColorVis0})),s.a.createElement(y.EuiFlexItem,{grow:!1},s.a.createElement(y.EuiTitle,{size:"xs"},s.a.createElement("h5",null,e))),t&&s.a.createElement(y.EuiFlexItem,{grow:!1},s.a.createElement(y.EuiIconTip,{content:t,position:"right"})))}));I.displayName="UserNameGroupContent";const C=s.a.memo((({sourceIp:e,nullGroupMessage:t})=>s.a.createElement(y.EuiFlexGroup,{"data-test-subj":"source-ip-group-renderer",gutterSize:"s",alignItems:"center"},s.a.createElement(y.EuiFlexItem,{grow:!1,style:{backgroundColor:x.euiThemeVars.euiColorVis3_behindText,borderRadius:"50%"}},s.a.createElement(y.EuiIcon,{style:{padding:4},type:"ip",size:"l"})),s.a.createElement(y.EuiFlexItem,{grow:!1},s.a.createElement(y.EuiTitle,{size:"xs"},s.a.createElement("h5",null,e))),t&&s.a.createElement(y.EuiFlexItem,{grow:!1},s.a.createElement(y.EuiIconTip,{content:t,position:"right"})))));C.displayName="SourceIpGroupContent";var M=a(58),_=a(122),F=a(159),A=a(108),D=a(719),N=a(410),P=a(344),R=a(19),L=a(142),B=a(18);const q=e=>{const t=[{unitsCount:{cardinality:{field:"kibana.alert.uuid"}}}];switch(e){case"kibana.alert.rule.name":t.push({description:{terms:{field:"kibana.alert.rule.description",size:1}}},{countSeveritySubAggregation:{cardinality:{field:"kibana.alert.severity"}}},{severitiesSubAggregation:{terms:{field:"kibana.alert.severity"}}},{usersCountAggregation:{cardinality:{field:"user.name"}}},{hostsCountAggregation:{cardinality:{field:"host.name"}}},{ruleTags:{terms:{field:"kibana.alert.rule.tags"}}});break;case"host.name":t.push({rulesCountAggregation:{cardinality:{field:"kibana.alert.rule.rule_id"}}},{countSeveritySubAggregation:{cardinality:{field:"kibana.alert.severity"}}},{severitiesSubAggregation:{terms:{field:"kibana.alert.severity"}}},{usersCountAggregation:{cardinality:{field:"user.name"}}});break;case"user.name":case"source.ip":t.push({rulesCountAggregation:{cardinality:{field:"kibana.alert.rule.rule_id"}}},{countSeveritySubAggregation:{cardinality:{field:"kibana.alert.severity"}}},{severitiesSubAggregation:{terms:{field:"kibana.alert.severity"}}},{hostsCountAggregation:{cardinality:{field:"host.name"}}});break;default:t.push({rulesCountAggregation:{cardinality:{field:"kibana.alert.rule.rule_id"}}})}return t};var z=a(102),$=a(47),V=a(49),U=a(51),H=a(161),G=a(149),Q=a(134),W=a(273),K=a(391),Y=a(501),J=a(233),X=a(232);const Z=({currentAlertStatusFilterValue:e,defaultFilters:t=[],from:a,getGrouping:n,globalFilters:i,globalQuery:o,groupingLevel:c,hasIndexMaintenance:u,hasIndexWrite:d,loading:m,onGroupClose:b,pageIndex:v,pageSize:E,parentGroupingFilter:x,renderChildComponent:j,runtimeMappings:S,selectedGroup:k,setPageIndex:O,setPageSize:w,signalIndexName:T,tableId:I,to:C})=>{const{services:{uiSettings:Z}}=Object(z.j)(),{browserFields:ee,indexPattern:te}=Object(g.d)(f.SourcererScopeName.detections),ae=Object(r.useCallback)((e=>null!=ee&&null!=te?Object(H.d)({config:Object(U.getEsQueryConfig)(Z),dataProviders:[],indexPattern:te,browserFields:ee,filters:[...null!=t?t:[],...i,...e,...x?JSON.parse(x):[],...Object(Y.a)(a,C)],kqlQuery:o,kqlMode:o.language}):null),[ee,t,a,i,o,te,x,C,Z]),ne=Object(r.useMemo)((()=>{try{var e;return[Object(V.buildEsQuery)(void 0,null!=o?[o]:[],[...null!==(e=null==i?void 0:i.filter((e=>!1===e.meta.disabled)))&&void 0!==e?e:[],...null!=t?t:[],...x?JSON.parse(x):[]])]}catch(e){return[]}}),[t,i,o,x]),ie=Object(r.useMemo)((()=>`SuperUniqueValue-${Object($.v4)()}`),[]),re=Object(r.useMemo)((()=>(({additionalFilters:e,from:t,pageIndex:a,pageSize:n,runtimeMappings:i,selectedGroup:r,uniqueValue:s,to:o})=>Object(l.d)({additionalFilters:e,from:t,groupByField:r,statsAggregations:Object(l.e)([r])?[]:q(r),pageNumber:a*n,runtimeMappings:i,uniqueValue:s,size:n,sort:[{unitsCount:{order:"desc"}}],to:o}))({additionalFilters:ne,selectedGroup:k,uniqueValue:ie,from:a,runtimeMappings:S,to:C,pageSize:E,pageIndex:v})),[ne,a,v,E,S,k,C,ie]),se=Object(r.useMemo)((()=>ae([])),[ae]);Object(W.a)({id:I,filterQuery:null==se?void 0:se.filterQuery,kqlError:null==se?void 0:se.kqlError,query:o,startDate:a,endDate:C});const{data:oe,loading:le,refetch:ce,request:ue,response:de,setQuery:pe}=Object(J.a)({query:re,indexName:T,queryName:X.a.ALERTS_GROUPING,skip:Object(l.e)([k])}),me=Object(r.useRef)(null),be=Object(r.useMemo)((()=>Object(l.f)(null===me.current?k:me.current,ie,null==oe?void 0:oe.aggregations)),[null==oe?void 0:oe.aggregations,k,ie]);Object(r.useEffect)((()=>{var e,t,a,n,i;Object(l.e)([k])||(me.current=null!==(e=null==re||null===(t=re.runtime_mappings)||void 0===t||null===(a=t.groupByField)||void 0===a||null===(n=a.script)||void 0===n||null===(i=n.params)||void 0===i?void 0:i.selectedGroup)&&void 0!==e?e:"",pe(re))}),[re,k,pe]);const{deleteQuery:ge,setQuery:fe}=Object(Q.a)(),ye=Object(r.useMemo)((()=>`alerts-grouping-${Object($.v4)()}`),[]);Object(K.a)({deleteQuery:ge,loading:le,refetch:ce,request:ue,response:de,setQuery:fe,uniqueQueryId:ye});const he=Object(r.useMemo)((()=>s.a.createElement(G.b,{queryId:ye,inspectIndex:0,title:h.C})),[ye]),ve=(({currentStatus:e,showAlertStatusActions:t=!0})=>{const{addSuccess:a,addError:n,addWarning:i}=Object(A.a)(),{startTransaction:o}=Object(F.b)(),l=_.d.globalQuery(),c=Object(p.a)(l),u=Object(r.useCallback)((()=>{c.forEach((e=>e.refetch&&e.refetch()))}),[c]),{services:{telemetry:d}}=Object(M.useKibana)(),m=Object(r.useCallback)((e=>{d.reportAlertsGroupingTakeAction(e)}),[d]),b=Object(r.useCallback)(((e,t,a)=>{u()}),[u]),g=Object(r.useCallback)(((e,t)=>{u()}),[u]),f=Object(r.useCallback)(((e,t,n)=>{if(t>0)i({title:Object(R.f)(t),text:Object(R.g)(e,t)});else{let t;switch(n){case"closed":t=h.A(e);break;case"open":t=h.G(e);break;case"acknowledged":t=h.c(e)}a({title:t})}b&&b(e,t,n)}),[a,i,b]),v=Object(r.useCallback)(((e,t)=>{let a;switch(e){case"closed":a=h.z;break;case"open":a=h.F;break;case"acknowledged":a=h.b}n(t.message,{title:a}),g&&g(e,t)}),[n,g]),E=Object(r.useCallback)((async({groupNumber:e,query:t,status:a,tableId:n,selectedGroup:i})=>{o(t?{name:D.a.BULK_QUERY_STATUS_UPDATE}:{name:D.a.STATUS_UPDATE}),Object(B.h)(B.a.CLICK,B.e.groupedAlertsTakeAction({tableId:n,groupNumber:e,status:a})),m({tableId:n,groupNumber:e,status:a,groupByField:i});try{var r,s;const e=await Object(N.a)({status:a,query:t?JSON.parse(t):{}});f(null!==(r=e.updated)&&void 0!==r?r:0,null!==(s=e.version_conflicts)&&void 0!==s?s:0,a)}catch(e){v(a,e)}}),[o,m,f,v]);return Object(r.useMemo)((()=>({query:a,tableId:n,groupNumber:i,selectedGroup:r})=>{const o=[];if(t)if(e&&1===e.length){const t=e[0];t!==L.d&&o.push(s.a.createElement(y.EuiContextMenuItem,{key:"open","data-test-subj":"open-alert-status",onClick:()=>E({groupNumber:i,query:a,selectedGroup:r,status:L.d,tableId:n})},P.l)),t!==L.b&&o.push(s.a.createElement(y.EuiContextMenuItem,{key:"acknowledge","data-test-subj":"acknowledged-alert-status",onClick:()=>E({groupNumber:i,query:a,selectedGroup:r,status:L.b,tableId:n})},P.i)),t!==L.c&&o.push(s.a.createElement(y.EuiContextMenuItem,{key:"close","data-test-subj":"close-alert-status",onClick:()=>E({groupNumber:i,query:a,selectedGroup:r,status:L.c,tableId:n})},P.j))}else{const e={[L.d]:P.l,[L.b]:P.i,[L.c]:P.j};Object.keys(e).forEach((t=>o.push(s.a.createElement(y.EuiContextMenuItem,{key:t,"data-test-subj":`${t}-alert-status`,onClick:()=>E({groupNumber:i,query:a,selectedGroup:r,status:t,tableId:n})},e[t]))))}return o}),[e,E,t])})({currentStatus:e,showAlertStatusActions:d&&u}),Ee=Object(r.useCallback)(((e,a)=>{var n;return ve({groupNumber:a,query:null===(n=ae([...null!=t?t:[],...e]))||void 0===n?void 0:n.filterQuery,selectedGroup:k,tableId:I})}),[t,ae,k,I,ve]);return Object(r.useMemo)((()=>n({activePage:v,data:be,groupingLevel:c,inspectButton:he,isLoading:m||le,itemsPerPage:E,onChangeGroupsItemsPerPage:e=>w(e),onChangeGroupsPage:e=>O(e),onGroupClose:b,renderChildComponent:j,selectedGroup:k,takeActionItems:Ee})),[be,n,Ee,c,he,le,m,b,v,E,j,k,O,w])},ee=s.a.memo(Z),te=e=>{const t=Object(o.useDispatch)(),{indexPattern:a,selectedPatterns:n}=Object(g.d)(f.SourcererScopeName.detections),{services:{storage:y,telemetry:h}}=Object(z.j)(),{getStoragePageSize:v,setStoragePageSize:x}=((e,t)=>Object(r.useMemo)((()=>({getStoragePageSize:()=>e.get(`grouping-table-${t}`)||Array(3).fill(25),setStoragePageSize:a=>{e.set(`grouping-table-${t}`,a)}})),[e,t]))(y,e.tableId),{onGroupChange:j,onGroupToggle:S}=Object(r.useMemo)((()=>({onGroupChange:e=>{h.reportAlertsGroupingChanged(e)},onGroupToggle:e=>h.reportAlertsGroupingToggled({...e,tableId:e.groupingId})})),[h]),k=Object(r.useCallback)((a=>{t(Object(m.a)({tableId:e.tableId,options:a}))}),[t,e.tableId]),{getGrouping:w,selectedGroups:T,setSelectedGroups:I}=Object(l.g)({componentProps:{groupPanelRenderer:O,groupStatsRenderer:E,onGroupToggle:S,unit:b.a},defaultGroupingOptions:Object(d.c)(e.tableId),fields:a.fields,groupingId:e.tableId,maxGroupingLevels:3,onGroupChange:j,onOptionsChange:k,tracker:B.h}),C=Object(p.a)((t=>Object(u.a)()(t,e.tableId)));Object(r.useEffect)((()=>{Object(l.e)(T)&&t(Object(m.a)({activeGroups:T,tableId:e.tableId}))}),[t,e.tableId,T]),Object(r.useEffect)((()=>{null==C||Object(l.e)(C.activeGroups)||I(C.activeGroups)}),[C,I]);const[M,_]=Object(r.useState)(Array(3).fill(0)),[F,A]=Object(r.useState)(v),D=Object(r.useCallback)((()=>{_((e=>e.map((()=>0))))}),[]),N=Object(r.useCallback)(((e,t,a)=>{"index"===a&&_((a=>{const n=[...a];return n[t]=e,n})),"size"===a&&(A((a=>{const n=[...a];return n[t]=e,x(n),n})),_((e=>{const a=[...e];return a[t]=0,a})))}),[x]),P=Object(r.useRef)({defaultFilters:e.defaultFilters,globalFilters:e.globalFilters,globalQuery:e.globalQuery,selectedGroups:T});Object(r.useEffect)((()=>{const t={defaultFilters:e.defaultFilters,globalFilters:e.globalFilters,globalQuery:e.globalQuery,selectedGroups:T};Object(c.isEqual)(P.current,t)||(D(),P.current=t)}),[e.defaultFilters,e.globalFilters,e.globalQuery,D,T]);const R=Object(r.useCallback)(((t,a,n)=>{var r,o;let l;return l=t<T.length-1?e=>R(t+1,T[t+1],JSON.stringify([...e,...n?JSON.parse(n):[]])):t=>e.renderChildComponent([...t,...n?JSON.parse(n):[]]),s.a.createElement(ee,i()({},e,{getGrouping:w,groupingLevel:t,onGroupClose:()=>{return e=t,void _((t=>{const a=t.splice(e+1,t.length);return[...t,...a.map((()=>0))]}));var e},pageIndex:null!==(r=M[t])&&void 0!==r?r:0,pageSize:null!==(o=F[t])&&void 0!==o?o:25,parentGroupingFilter:n,renderChildComponent:l,selectedGroup:a,setPageIndex:e=>N(e,t,"index"),setPageSize:e=>N(e,t,"size")}))}),[w,M,F,e,T,N]);return Object(c.isEmpty)(n)?null:R(0,T[0])},ae=s.a.memo(te)},function(e,t,a){"use strict";a.d(t,"a",(function(){return h})),a.d(t,"b",(function(){return v}));var n=a(2),i=a.n(n),r=a(4),s=a(214),o=a(108),l=a(102),c=a(5);const u=c.i18n.translate("xpack.securitySolution.containers.detectionEngine.alerts.readListsPrivileges.errorDescription",{defaultMessage:"Failed to retrieve lists privileges"}),d=c.i18n.translate("xpack.securitySolution.containers.detectionEngine.alerts.detectionEnginePrivileges.errorFetching",{defaultMessage:"Failed to retreive detection engine privileges"});var p=a(141),m=a(239);var b=a(8),g=a(17),f=a(700),y=a(1070);const h=Object(n.createContext)({listPrivileges:{loading:!1,error:void 0,result:void 0},detectionEnginePrivileges:{loading:!1,error:void 0,result:void 0},endpointPrivileges:{loading:!0,...Object(f.b)()},kibanaSecuritySolutionsPrivileges:{crud:!1,read:!1}}),v=({kibanaCapabilities:e,children:t})=>{const a=!0===e[r.tc].crud,c=!0===e[r.tc].show,[v,E]=Object(n.useState)({crud:a,read:c}),x=((e=!0)=>{const t=Object(l.i)(),{lists:a}=Object(l.j)().services,{start:i,...r}=Object(s.l)(),{addError:c}=Object(o.a)(),d=Object(n.useRef)(new AbortController);return Object(n.useEffect)((()=>{const{loading:n,result:s,error:o}=r;!e||!a||n||s||o||(d.current.abort(),d.current=new AbortController,i({http:t,signal:d.current.signal}))}),[t,a,i,r,e]),Object(n.useEffect)((()=>()=>{d.current.abort()}),[]),Object(n.useEffect)((()=>{const e=r.error;null!=e&&c(e,{title:u})}),[c,r.error]),{loading:r.loading,error:r.error,result:r.result}})(c),j=((e=!0)=>{const{start:t,...a}=Object(p.a)(Object(p.d)(m.i)),{addError:i}=Object(o.a)(),r=Object(n.useRef)(new AbortController);return Object(n.useEffect)((()=>{const{loading:n,result:i,error:s}=a;!e||n||i||s||(r.current.abort(),r.current=new AbortController,t({signal:r.current.signal}))}),[t,a,e]),Object(n.useEffect)((()=>()=>{r.current.abort()}),[]),Object(n.useEffect)((()=>{const e=a.error;null!=e&&i(e,{title:d})}),[i,a.error]),a})(c),S=(()=>{var e,t;const a=Object(p.b)(),i=Object(l.f)(),r=Object(l.j)().services.fleet,s=null===(e=Object(y.b)())||void 0===e?void 0:e.fleet,o=null!==(t=null==r?void 0:r.authz)&&void 0!==t?t:null==s?void 0:s.authz,c=Object(g.b)(),[u,d]=Object(n.useState)(!1),[m,h]=Object(n.useState)([]),v=Object(n.useMemo)((()=>{const e=!u||!i;return Object.freeze({loading:e,...e||!o||Object(b.isEmpty)(i)?Object(f.b)():Object(f.a)(c,o,m)})}),[u,i,o,c,m]);return Object(n.useEffect)((()=>{(async()=>{i&&a()&&(h(null==i?void 0:i.roles),d(!0))})()}),[a,i]),v})();return Object(n.useEffect)((()=>{E((e=>e.read!==c||e.crud!==a?{read:c,crud:a}:e))}),[a,c]),i.a.createElement(h.Provider,{value:{listPrivileges:x,detectionEnginePrivileges:j,endpointPrivileges:S,kibanaSecuritySolutionsPrivileges:v}},t)}},function(e,t,a){"use strict";a.d(t,"a",(function(){return N}));var n=a(2),i=a.n(n),r=a(377),s=a(105),o=a(102),l=a(122),c=a(190),u=a(176),d=a(40),p=a(41),m=a.n(p),b=a(5);const g=b.i18n.translate("xpack.securitySolution.fieldBrowser.createFieldButton",{defaultMessage:"Create field"}),f=m()(d.EuiButton).withConfig({displayName:"StyledButton",componentId:"sc-1abg8tf-0"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeM)),y=b.i18n.translate("xpack.securitySolution.fieldBrowser.fieldName",{defaultMessage:"Name"}),h=b.i18n.translate("xpack.securitySolution.fieldBrowser.descriptionLabel",{defaultMessage:"Description"}),v=b.i18n.translate("xpack.securitySolution.fieldBrowser.categoryLabel",{defaultMessage:"Category"}),E=b.i18n.translate("xpack.securitySolution.fieldBrowser.runtimeLabel",{defaultMessage:"Runtime"}),x=b.i18n.translate("xpack.securitySolution.fieldBrowser.runtimeTitle",{defaultMessage:"Runtime Field"}),j=b.i18n.translate("xpack.securitySolution.fieldBrowser.actionsLabel",{defaultMessage:"Actions"}),S=b.i18n.translate("xpack.securitySolution.fieldBrowser.editButton",{defaultMessage:"Edit"}),k=b.i18n.translate("xpack.securitySolution.fieldBrowser.removeButton",{defaultMessage:"Remove"}),O=b.i18n.translate("xpack.securitySolution.fieldBrowser.editButtonDescription",{defaultMessage:"Edit runtime field"}),w=b.i18n.translate("xpack.securitySolution.fieldBrowser.removeButtonDescription",{defaultMessage:"Delete runtime field"});var T=a(217),I=a(117),C=a(339);const M=m()(d.EuiIcon).withConfig({displayName:"TypeIcon",componentId:"sc-1coc1q1-0"})(["margin:0 4px;position:relative;top:-1px;"]);M.displayName="TypeIcon";const _=m.a.span.withConfig({displayName:"Description",componentId:"sc-1coc1q1-1"})(["user-select:text;width:",";"],(({width:e})=>e));_.displayName="Description";const F=i.a.memo((({fieldId:e,highlight:t=""})=>i.a.createElement(d.EuiText,{size:"xs"},i.a.createElement(d.EuiHighlight,{"data-test-subj":`field-${e}-name`,search:t},e))));F.displayName="FieldName";var A=a(159),D=a(196);const N=({sourcererScope:e,editorActionsRef:t,removeColumn:a,upsertColumn:p})=>{const[m,N]=Object(n.useState)(null),{startTransaction:P}=Object(A.b)(),{indexFieldsSearch:R}=Object(r.b)(),{dataViewFieldEditor:L,data:{dataViews:B}}=Object(o.j)().services,q=Object(n.useMemo)((()=>l.e.scopeIdSelector()),[]),{missingPatterns:z,selectedDataViewId:$}=Object(s.a)((t=>q(t,e)));Object(n.useEffect)((()=>{null==$||z.length||(async e=>{const t=await B.get(e);N(t)})($)}),[$,z,B]);const V=Object(n.useCallback)((e=>{if(m&&$){const n=L.openEditor({ctx:{dataView:m},fieldName:e,onSave:async n=>{P({name:D.c.FIELD_SAVED}),await R({dataViewId:$,cleanCache:!0});for(const t of n)e&&e!==t.name&&a(e),p({columnHeaderType:c.a,id:t.name,initialWidth:u.a},0);t&&(t.current=null)}});t&&(t.current={closeEditor:()=>{t.current=null,n()}})}}),[m,$,L,t,R,a,p,P]),U=Object(n.useCallback)((e=>{m&&$&&L.openDeleteModal({ctx:{dataView:m},fieldName:e,onDelete:async()=>{P({name:D.c.FIELD_DELETED}),await R({dataViewId:$}),a(e)}})}),[m,$,L,R,a,P]),H=Object(n.useMemo)((()=>null==L?void 0:L.userPermissions.editIndexPattern()),[null==L?void 0:L.userPermissions]),G=(({isAllowed:e,loading:t,openFieldEditor:a})=>{const r=Object(n.useCallback)((({onHide:e})=>i.a.createElement(f,{iconType:t?"none":"plusInCircle","aria-label":g,"data-test-subj":"create-field",onClick:()=>{a(),e()},isLoading:t},g)),[t,a]);return e?r:void 0})({isAllowed:H&&!!$,loading:!m,openFieldEditor:V}),Q=(({hasFieldEditPermission:e,openFieldEditor:t,openDeleteFieldModal:a})=>Object(n.useCallback)((({highlight:n,onHide:r})=>{const s=e?[{name:S,description:O,type:"icon",icon:"pencil",isPrimary:!0,onClick:({name:e})=>{t(e),r()},available:({isRuntime:e})=>e,"data-test-subj":"actionEditRuntimeField"},{name:k,description:w,type:"icon",icon:"trash",color:"danger",isPrimary:!0,onClick:({name:e})=>{a(e),r()},available:({isRuntime:e})=>e,"data-test-subj":"actionDeleteRuntimeField"}]:[];return[{field:"name",name:y,render:(e,{type:t})=>i.a.createElement(d.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(d.EuiToolTip,{content:t},i.a.createElement(M,{"data-test-subj":`field-${e}-icon`,type:Object(T.d)(null!=t?t:null)}))),i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(F,{fieldId:e,highlight:n}))),sortable:!0,width:"225px"},{field:"description",name:h,render:(e,{name:t})=>{return i.a.createElement(d.EuiToolTip,{content:e},i.a.createElement(i.a.Fragment,null,i.a.createElement(d.EuiScreenReaderOnly,{"data-test-subj":"descriptionForScreenReaderOnly"},i.a.createElement("p",null,(a=t,b.i18n.translate("xpack.securitySolution.fieldBrowser.descriptionForScreenReaderOnly",{values:{field:a},defaultMessage:"Description for field {field}:"})))),i.a.createElement(C.a,null,i.a.createElement(_,{width:s.length>0?"335px":"400px","data-test-subj":`field-${t}-description`},`${null!=e?e:Object(I.e)()}`))));var a},sortable:!0,width:s.length>0?"335px":"400px"},{field:"isRuntime",name:E,render:e=>e?i.a.createElement(d.EuiHealth,{color:"success",title:x}):null,sortable:!0,width:"80px"},{field:"category",name:v,render:(e,{name:t})=>i.a.createElement(d.EuiBadge,{"data-test-subj":`field-${t}-category`},e),sortable:!0,width:"115px"},...s.length>0?[{name:j,actions:s,width:"80px"}]:[]]}),[e,t,a]))({hasFieldEditPermission:H,openFieldEditor:V,openDeleteFieldModal:U});return Object(n.useMemo)((()=>({createFieldButton:G,getFieldTableColumns:Q})),[G,Q])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return x})),a.d(t,"b",(function(){return j})),a.d(t,"c",(function(){return S}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(1134),l=a(40),c=a(102);const u=({integration:e})=>{const t=Object(c.d)(),a=e.integrationTitle,n=`${t}/${e.targetUrl}`;return i.a.createElement(l.EuiLink,{href:n,target:"_blank","data-test-subj":"integrationLink"},a)},d=i.a.memo(u);d.displayName="IntegrationLink";var p=a(736);const m=s()(l.EuiBadge).withConfig({displayName:"PaddedBadge",componentId:"sc-63ceph-0"})(["margin-left:5px;"]),b=({integration:e})=>{const{installationStatus:t}=e;if(!t.isKnown)return null;const{isInstalled:a,isEnabled:n}=t,r=a?"success":"#E0E5EE",s=a?n?p.c:p.e:p.j,o=a?n?p.b:p.d:p.i;return i.a.createElement(l.EuiToolTip,{content:s},i.a.createElement(m,{color:r,"data-test-subj":"statusBadge"},o))},g=i.a.memo(b);g.displayName="IntegrationStatusBadge";const f=s.a.span.withConfig({displayName:"VersionWarningIconContainer",componentId:"sc-8orjjk-0"})(["margin-left:5px;"]),y=({integration:e})=>{const{installationStatus:t}=e;return t.isKnown&&t.isInstalled&&t.isVersionMismatch?i.a.createElement(f,null,i.a.createElement(l.EuiIconTip,{type:"warning",color:"warning",content:p.f(t.installedVersion,e.requiredVersion)})):null},h=i.a.memo(y);h.displayName="IntegrationVersionMismatchIcon";const v=s.a.div.withConfig({displayName:"Wrapper",componentId:"sc-hszsn0-0"})(["overflow:hidden;"]),E=({integration:e})=>i.a.createElement(v,null,i.a.createElement(d,{integration:e})," ",i.a.createElement(g,{integration:e}),i.a.createElement(h,{integration:e})),x=i.a.memo(E),j=({relatedIntegrations:e})=>{const{integrations:t}=Object(o.a)(e);return i.a.createElement(i.a.Fragment,null,t.map(((e,t)=>i.a.createElement(x,{key:`${e.packageName}-${t}`,integration:e}))))},S=(e,t)=>null==t||0===t.length?[]:[{title:e,description:i.a.createElement(j,{relatedIntegrations:t})}]},function(e,t,a){"use strict";a.d(t,"a",(function(){return f}));var n=a(2),i=a.n(n),r=a(40),s=a(5),o=a(41),l=a.n(o),c=a(44),u=a(124);const d=s.i18n.translate("xpack.securitySolution.management.policiesSelector.globalEntries",{defaultMessage:"Global entries"}),p=s.i18n.translate("xpack.securitySolution.management.policiesSelector.unassignedEntries",{defaultMessage:"Unassigned entries"}),m=Object(n.memo)((({policies:e,onChangeSelection:t,defaultExcludedPolicies:a,defaultIncludedPolicies:s})=>{const{euiTheme:o}=Object(r.useEuiTheme)(),[l,m]=Object(n.useState)(!1),[g,f]=Object(n.useState)(""),[y,h]=Object(n.useState)([]),v=Object(u.a)("excludePoliciesInFilterEnabled");Object(n.useEffect)((()=>{const t=s?s.split(",").reduce(((e,t)=>({...e,[t]:!0})),{}):{},n=a?a.split(",").reduce(((e,t)=>({...e,[t]:!0})),{}):{},i=e=>t[e]?"on":n[e]?"off":void 0;h([...e.map((e=>({name:e.name,id:e.id,checked:i(e.id)}))),{name:d,id:"global",checked:i("global")},{name:p,id:"unassigned",checked:i("unassigned")}])}),[e]);const E=Object(n.useCallback)((()=>{m((e=>!e))}),[]),x=Object(n.useCallback)((()=>{m(!1)}),[]),j=Object(n.useCallback)((e=>{const t=e.target.value||"";f(t)}),[]),S=Object(n.useCallback)((e=>{if(!y[e])return;const a=[...y];switch(a[e].checked){case"on":a[e].checked=v?"off":void 0;break;case"off":a[e].checked=void 0;break;default:a[e].checked="on"}h(a),t(a)}),[y,t,v]),k=Object(n.useMemo)((()=>y.map(((e,t)=>e.name.toLowerCase().includes(g.toLowerCase())?i.a.createElement(r.EuiFilterSelectItem,{checked:e.checked,key:t,onClick:()=>S(t),"data-test-subj":`policiesSelector-popover-items-${e.id}`},e.name):null))),[y,g,S]),O=Object(n.useMemo)((()=>i.a.createElement(r.EuiFilterButton,{iconType:"arrowDown","data-test-subj":"policiesSelectorButton",onClick:E,isSelected:l,numFilters:y.length,hasActiveFilters:!!y.find((e=>"on"===e.checked)),numActiveFilters:y.filter((e=>"on"===e.checked)).length},i.a.createElement(r.EuiText,null,i.a.createElement(c.FormattedMessage,{id:"xpack.securitySolution.management.policiesSelector.label",defaultMessage:"Policies"})))),[l,y,E]);return i.a.createElement(r.EuiFlexGroup,{"data-test-subj":"policiesSelector",direction:"row",alignItems:"center",gutterSize:"l"},i.a.createElement(r.EuiFlexItem,null,i.a.createElement(r.EuiFilterGroup,null,i.a.createElement(r.EuiPopover,{button:O,isOpen:l,closePopover:x,panelPaddingSize:"none"},i.a.createElement(r.EuiPopoverTitle,{paddingSize:"s"},i.a.createElement(r.EuiFieldSearch,{"data-test-subj":"policiesSelectorSearch",compressed:!0,onChange:j,value:g})),i.a.createElement(b,{"data-test-subj":"policiesSelector-popover",className:"eui-yScroll",$_css:30*o.base},k)))))}));m.displayName="PoliciesSelector";var b=l()("div").withConfig({displayName:"_StyledDiv",componentId:"sc-gji8ln-0"})((e=>({maxHeight:e.$_css}))),g=a(126);const f=Object(n.memo)((({defaultValue:e="",onSearch:t,placeholder:a,hasPolicyFilter:o,policyList:l,defaultIncludedPolicies:c,hideRefreshButton:u=!1})=>{const{canCreateArtifactsByPolicy:d}=Object(g.a)().endpointPrivileges,[p,b]=Object(n.useState)(e),[f,y]=Object(n.useState)(c||""),h=Object(n.useCallback)((e=>{const a=e.filter((e=>"on"===e.checked)).map((e=>e.id)).join(",");y(a),t(p,a,!1)}),[t,p]),v=Object(n.useCallback)((e=>b(e.target.value)),[b]),E=Object(n.useCallback)((()=>t(p,f,!0)),[t,p,f]),x=Object(n.useCallback)((e=>{t(e,f,!1)}),[t,f]);return i.a.createElement(r.EuiFlexGroup,{"data-test-subj":"searchExceptions",direction:"row",alignItems:"center",gutterSize:"m"},i.a.createElement(r.EuiFlexItem,null,i.a.createElement(r.EuiFieldSearch,{defaultValue:e,placeholder:a,onChange:v,onSearch:x,isClearable:!0,fullWidth:!0,"data-test-subj":"searchField"})),d&&o&&l?i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(m,{policies:l,defaultIncludedPolicies:c,onChangeSelection:h})):null,u?null:i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiButton,{iconType:"refresh",onClick:E,"data-test-subj":"searchButton"},s.i18n.translate("xpack.securitySolution.management.search.button",{defaultMessage:"Refresh"}))))}));f.displayName="SearchExceptions"},,function(e,t,a){"use strict";a.d(t,"i",(function(){return n})),a.d(t,"h",(function(){return i})),a.d(t,"g",(function(){return r})),a.d(t,"f",(function(){return s})),a.d(t,"e",(function(){return o})),a.d(t,"d",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"b",(function(){return u})),a.d(t,"a",(function(){return d}));const n=e=>"UninitialisedResourceState"===e.type,i=e=>"LoadingResourceState"===e.type,r=e=>"LoadedResourceState"===e.type,s=e=>"FailedResourceState"===e.type,o=()=>({type:"UninitialisedResourceState"}),l=e=>({type:"LoadingResourceState",previousState:e}),c=e=>({type:"LoadedResourceState",data:e}),u=(e,t)=>({type:"FailedResourceState",error:e,lastLoadedState:t}),d=e=>{switch(e.type){case"LoadedResourceState":case"FailedResourceState":return e;case"UninitialisedResourceState":case"LoadingResourceState":return o()}}},,function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(119),i=a(190),r=a(176);const s=[{columnHeaderType:i.a,id:"@timestamp",initialWidth:r.b,esTypes:["date"],type:"date"},{columnHeaderType:i.a,id:"message"},{columnHeaderType:i.a,id:"host.name"},{columnHeaderType:i.a,id:"event.module"},{columnHeaderType:i.a,id:"agent.type"},{columnHeaderType:i.a,id:"event.dataset"},{columnHeaderType:i.a,id:"event.action"},{columnHeaderType:i.a,id:"user.name"},{columnHeaderType:i.a,id:"source.ip"},{columnHeaderType:i.a,id:"destination.ip"}],o={...n.q,columns:s}},function(e,t,a){"use strict";a.d(t,"a",(function(){return m}));var n=a(2),i=a(172),r=a(265),s=a(46),o=a(4),l=a(143);const c=["POST",o.eb],u=e=>Object(s.useMutation)((e=>Object(l.b)(e)),{...e,mutationKey:c});var d=a(591),p=a(860);function m(){const{mutateAsync:e}=u(),t=Object(d.a)(),a=Object(p.a)(),s=Object(r.c)(),o=null==s?void 0:s.actions.setLoadingRules;return{bulkExport:Object(n.useCallback)((async n=>{try{var r;return null==o||o({ids:null!==(r=n.ids)&&void 0!==r?r:a(i.b.export),action:i.b.export}),await e(n)}catch(e){t({actionType:i.b.export,error:e})}finally{null==o||o({ids:[],action:null})}}),[a,o,e,t])}}},,function(e,t,a){"use strict";let n;a.d(t,"a",(function(){return n})),function(e){e.alert="alert",e.asset="asset",e.enrichment="enrichment",e.event="event",e.metric="metric",e.state="state",e.pipeline_error="pipeline_error",e.signal="signal"}(n||(n={}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r}));var n=a(2);const i=a.n(n).a.createContext(void 0),r=()=>Object(n.useContext)(i)},,function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(2),i=a(42);const r=(e,t,a)=>{const n=a[e];return Array.isArray(n)?n.map((e=>Object(i.getOr)(null,t,e))).filter((e=>null!==e)):Object(i.getOr)(void 0,t,n)},s=e=>{const t=Object(n.useMemo)((()=>e),[e]),a=Object(n.useMemo)((()=>({})),[]),i=Object(n.useCallback)(((e,t)=>{a[e]=t}),[a]);return Object(n.useCallback)((e=>{let n;return n=Object.hasOwn(a,e)?a[e]:t?((e,t,a)=>{if(e&&t){if(Object.hasOwn(t,e))return t[e];{const n=(e=>{const t=(e=>{const t=RegExp("[.]","g"),a=[];let n=t.exec(e);for(;n;)a.push(n.index),n=t.exec(e);return a.reverse()})(e);return t.map((t=>[e.slice(0,t),e.slice(t+1)]))})(e);for(const[i,s]of n)if(Object.hasOwn(t,i)&&t[i]){const n=r(i,s,t);return a(e,n),n}}}})(e,t,i):void 0,Array.isArray(n)&&0===n.length?void 0:n}),[i,a,t])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(1163);Object.defineProperty(t,"createMemo",{enumerable:!0,get:function(){return n.default}});var i=a(1164);Object.defineProperty(t,"createReducerContext",{enumerable:!0,get:function(){return i.default}});var r=a(1165);Object.defineProperty(t,"createReducer",{enumerable:!0,get:function(){return r.default}});var s=a(1166);Object.defineProperty(t,"createStateContext",{enumerable:!0,get:function(){return s.default}});var o=a(544);Object.defineProperty(t,"useAsync",{enumerable:!0,get:function(){return o.default}});var l=a(545);Object.defineProperty(t,"useAsyncFn",{enumerable:!0,get:function(){return l.default}});var c=a(1167);Object.defineProperty(t,"useAsyncRetry",{enumerable:!0,get:function(){return c.default}});var u=a(1168);Object.defineProperty(t,"useAudio",{enumerable:!0,get:function(){return u.default}});var d=a(1170);Object.defineProperty(t,"useBattery",{enumerable:!0,get:function(){return d.default}});var p=a(1172);Object.defineProperty(t,"useBeforeUnload",{enumerable:!0,get:function(){return p.default}});var m=a(1173);Object.defineProperty(t,"useBoolean",{enumerable:!0,get:function(){return m.default}});var b=a(1174);Object.defineProperty(t,"useClickAway",{enumerable:!0,get:function(){return b.default}});var g=a(1175);Object.defineProperty(t,"useCookie",{enumerable:!0,get:function(){return g.default}});var f=a(1177);Object.defineProperty(t,"useCopyToClipboard",{enumerable:!0,get:function(){return f.default}});var y=a(780);Object.defineProperty(t,"useCounter",{enumerable:!0,get:function(){return y.default}});var h=a(1178);Object.defineProperty(t,"useCss",{enumerable:!0,get:function(){return h.default}});var v=a(556);Object.defineProperty(t,"useCustomCompareEffect",{enumerable:!0,get:function(){return v.default}});var E=a(1184);Object.defineProperty(t,"useDebounce",{enumerable:!0,get:function(){return E.default}});var x=a(1074);Object.defineProperty(t,"useDeepCompareEffect",{enumerable:!0,get:function(){return x.default}});var j=a(1185);Object.defineProperty(t,"useDefault",{enumerable:!0,get:function(){return j.default}});var S=a(1186);Object.defineProperty(t,"useDrop",{enumerable:!0,get:function(){return S.default}});var k=a(1187);Object.defineProperty(t,"useDropArea",{enumerable:!0,get:function(){return k.default}});var O=a(361);Object.defineProperty(t,"useEffectOnce",{enumerable:!0,get:function(){return O.default}});var w=a(1188);Object.defineProperty(t,"useEnsuredForwardedRef",{enumerable:!0,get:function(){return w.default}}),Object.defineProperty(t,"ensuredForwardRef",{enumerable:!0,get:function(){return w.ensuredForwardRef}});var T=a(447);Object.defineProperty(t,"useEvent",{enumerable:!0,get:function(){return T.default}});var I=a(1189);Object.defineProperty(t,"useError",{enumerable:!0,get:function(){return I.default}});var C=a(1190);Object.defineProperty(t,"useFavicon",{enumerable:!0,get:function(){return C.default}});var M=a(1191);Object.defineProperty(t,"useFullscreen",{enumerable:!0,get:function(){return M.default}});var _=a(1193);Object.defineProperty(t,"useGeolocation",{enumerable:!0,get:function(){return _.default}});var F=a(781);Object.defineProperty(t,"useGetSet",{enumerable:!0,get:function(){return F.default}});var A=a(1194);Object.defineProperty(t,"useGetSetState",{enumerable:!0,get:function(){return A.default}});var D=a(1195);Object.defineProperty(t,"useHarmonicIntervalFn",{enumerable:!0,get:function(){return D.default}});var N=a(1197);Object.defineProperty(t,"useHover",{enumerable:!0,get:function(){return N.default}});var P=a(782);Object.defineProperty(t,"useHoverDirty",{enumerable:!0,get:function(){return P.default}});var R=a(1198);Object.defineProperty(t,"useIdle",{enumerable:!0,get:function(){return R.default}});var L=a(1200);Object.defineProperty(t,"useIntersection",{enumerable:!0,get:function(){return L.default}});var B=a(1201);Object.defineProperty(t,"useInterval",{enumerable:!0,get:function(){return B.default}});var q=a(35);Object.defineProperty(t,"useIsomorphicLayoutEffect",{enumerable:!0,get:function(){return q.default}});var z=a(783);Object.defineProperty(t,"useKey",{enumerable:!0,get:function(){return z.default}});var $=a(1202);Object.defineProperty(t,"createBreakpoint",{enumerable:!0,get:function(){return $.default}});var V=a(784);Object.defineProperty(t,"useKeyPress",{enumerable:!0,get:function(){return V.default}});var U=a(1203);Object.defineProperty(t,"useKeyPressEvent",{enumerable:!0,get:function(){return U.default}});var H=a(785);Object.defineProperty(t,"useLatest",{enumerable:!0,get:function(){return H.default}});var G=a(786);Object.defineProperty(t,"useLifecycles",{enumerable:!0,get:function(){return G.default}});var Q=a(787);Object.defineProperty(t,"useList",{enumerable:!0,get:function(){return Q.default}});var W=a(1204);Object.defineProperty(t,"useLocalStorage",{enumerable:!0,get:function(){return W.default}});var K=a(1205);Object.defineProperty(t,"useLocation",{enumerable:!0,get:function(){return K.default}});var Y=a(1206);Object.defineProperty(t,"useLockBodyScroll",{enumerable:!0,get:function(){return Y.default}});var J=a(1207);Object.defineProperty(t,"useLogger",{enumerable:!0,get:function(){return J.default}});var X=a(1208);Object.defineProperty(t,"useLongPress",{enumerable:!0,get:function(){return X.default}});var Z=a(788);Object.defineProperty(t,"useMap",{enumerable:!0,get:function(){return Z.default}});var ee=a(1209);Object.defineProperty(t,"useMedia",{enumerable:!0,get:function(){return ee.default}});var te=a(1210);Object.defineProperty(t,"useMediaDevices",{enumerable:!0,get:function(){return te.default}});var ae=a(1211);Object.defineProperty(t,"useMediatedState",{enumerable:!0,get:function(){return ae.useMediatedState}});var ne=a(1212);Object.defineProperty(t,"useMethods",{enumerable:!0,get:function(){return ne.default}});var ie=a(1213);Object.defineProperty(t,"useMotion",{enumerable:!0,get:function(){return ie.default}});var re=a(789);Object.defineProperty(t,"useMount",{enumerable:!0,get:function(){return re.default}});var se=a(267);Object.defineProperty(t,"useMountedState",{enumerable:!0,get:function(){return se.default}});var oe=a(790);Object.defineProperty(t,"useMouse",{enumerable:!0,get:function(){return oe.default}});var le=a(1214);Object.defineProperty(t,"useMouseHovered",{enumerable:!0,get:function(){return le.default}});var ce=a(1215);Object.defineProperty(t,"useMouseWheel",{enumerable:!0,get:function(){return ce.default}});var ue=a(1216);Object.defineProperty(t,"useNetwork",{enumerable:!0,get:function(){return ue.default}});var de=a(1217);Object.defineProperty(t,"useNumber",{enumerable:!0,get:function(){return de.default}});var pe=a(10);Object.defineProperty(t,"useObservable",{enumerable:!0,get:function(){return pe.default}});var me=a(1218);Object.defineProperty(t,"useOrientation",{enumerable:!0,get:function(){return me.default}});var be=a(1219);Object.defineProperty(t,"usePageLeave",{enumerable:!0,get:function(){return be.default}});var ge=a(1220);Object.defineProperty(t,"usePermission",{enumerable:!0,get:function(){return ge.default}});var fe=a(246);Object.defineProperty(t,"usePrevious",{enumerable:!0,get:function(){return fe.default}});var ye=a(1221);Object.defineProperty(t,"usePreviousDistinct",{enumerable:!0,get:function(){return ye.default}});var he=a(1222);Object.defineProperty(t,"usePromise",{enumerable:!0,get:function(){return he.default}});var ve=a(1223);Object.defineProperty(t,"useQueue",{enumerable:!0,get:function(){return ve.default}});var Ee=a(791);Object.defineProperty(t,"useRaf",{enumerable:!0,get:function(){return Ee.default}});var xe=a(1224);Object.defineProperty(t,"useRafLoop",{enumerable:!0,get:function(){return xe.default}});var je=a(362);Object.defineProperty(t,"useRafState",{enumerable:!0,get:function(){return je.default}});var Se=a(1225);Object.defineProperty(t,"useSearchParam",{enumerable:!0,get:function(){return Se.default}});var ke=a(1226);Object.defineProperty(t,"useScratch",{enumerable:!0,get:function(){return ke.default}});var Oe=a(1232);Object.defineProperty(t,"useScroll",{enumerable:!0,get:function(){return Oe.default}});var we=a(1233);Object.defineProperty(t,"useScrolling",{enumerable:!0,get:function(){return we.default}});var Te=a(1234);Object.defineProperty(t,"useSessionStorage",{enumerable:!0,get:function(){return Te.default}});var Ie=a(360);Object.defineProperty(t,"useSetState",{enumerable:!0,get:function(){return Ie.default}});var Ce=a(1235);Object.defineProperty(t,"useShallowCompareEffect",{enumerable:!0,get:function(){return Ce.default}});var Me=a(1237);Object.defineProperty(t,"useSize",{enumerable:!0,get:function(){return Me.default}});var _e=a(1238);Object.defineProperty(t,"useSlider",{enumerable:!0,get:function(){return _e.default}});var Fe=a(1239);Object.defineProperty(t,"useSpeech",{enumerable:!0,get:function(){return Fe.default}});var Ae=a(1240);Object.defineProperty(t,"useStartTyping",{enumerable:!0,get:function(){return Ae.default}});var De=a(1241);Object.defineProperty(t,"useStateWithHistory",{enumerable:!0,get:function(){return De.useStateWithHistory}});var Ne=a(1242);Object.defineProperty(t,"useStateList",{enumerable:!0,get:function(){return Ne.default}});var Pe=a(1243);Object.defineProperty(t,"useThrottle",{enumerable:!0,get:function(){return Pe.default}});var Re=a(1244);Object.defineProperty(t,"useThrottleFn",{enumerable:!0,get:function(){return Re.default}});var Le=a(1245);Object.defineProperty(t,"useTimeout",{enumerable:!0,get:function(){return Le.default}});var Be=a(557);Object.defineProperty(t,"useTimeoutFn",{enumerable:!0,get:function(){return Be.default}});var qe=a(1246);Object.defineProperty(t,"useTitle",{enumerable:!0,get:function(){return qe.default}});var ze=a(779);Object.defineProperty(t,"useToggle",{enumerable:!0,get:function(){return ze.default}});var $e=a(1247);Object.defineProperty(t,"useTween",{enumerable:!0,get:function(){return $e.default}});var Ve=a(448);Object.defineProperty(t,"useUnmount",{enumerable:!0,get:function(){return Ve.default}});var Ue=a(1248);Object.defineProperty(t,"useUnmountPromise",{enumerable:!0,get:function(){return Ue.default}});var He=a(308);Object.defineProperty(t,"useUpdate",{enumerable:!0,get:function(){return He.default}});var Ge=a(359);Object.defineProperty(t,"useUpdateEffect",{enumerable:!0,get:function(){return Ge.default}});var Qe=a(1249);Object.defineProperty(t,"useUpsert",{enumerable:!0,get:function(){return Qe.default}});var We=a(1250);Object.defineProperty(t,"useVibrate",{enumerable:!0,get:function(){return We.default}});var Ke=a(1251);Object.defineProperty(t,"useVideo",{enumerable:!0,get:function(){return Ke.default}});var Ye=a(1252);Object.defineProperty(t,"useStateValidator",{enumerable:!0,get:function(){return Ye.default}});var Je=a(1253);Object.defineProperty(t,"useScrollbarWidth",{enumerable:!0,get:function(){return Je.useScrollbarWidth}});var Xe=a(1255);Object.defineProperty(t,"useMultiStateValidator",{enumerable:!0,get:function(){return Xe.useMultiStateValidator}});var Ze=a(1256);Object.defineProperty(t,"useWindowScroll",{enumerable:!0,get:function(){return Ze.default}});var et=a(1257);Object.defineProperty(t,"useWindowSize",{enumerable:!0,get:function(){return et.default}});var tt=a(1258);Object.defineProperty(t,"useMeasure",{enumerable:!0,get:function(){return tt.default}});var at=a(1259);Object.defineProperty(t,"useRendersCount",{enumerable:!0,get:function(){return at.useRendersCount}});var nt=a(445);Object.defineProperty(t,"useFirstMountState",{enumerable:!0,get:function(){return nt.useFirstMountState}});var it=a(1260);Object.defineProperty(t,"useSet",{enumerable:!0,get:function(){return it.default}});var rt=a(1261);Object.defineProperty(t,"createGlobalState",{enumerable:!0,get:function(){return rt.createGlobalState}});var st=a(1262);Object.defineProperty(t,"useHash",{enumerable:!0,get:function(){return st.useHash}})},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(146),r=n.__importDefault(a(556));t.default=function(e,t){r.default(e,t,i.isDeepEqual)}},function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(2),i=a(142),r=a(344),s=a(410),o=a(108),l=a(159),c=a(719);const u=({eventIds:e,currentStatus:t,query:a,setEventsLoading:u,showAlertStatusActions:d=!0,setEventsDeleted:p,onUpdateSuccess:m,onUpdateFailure:b,customBulkActions:g})=>{const{addSuccess:f,addError:y,addWarning:h}=Object(o.a)(),{startTransaction:v}=Object(l.b)(),E=Object(n.useCallback)(((e,t,a)=>{if(t>0)h({title:r.t(t),text:r.u(e,t)});else{let t;switch(a){case"closed":t=r.o(e);break;case"open":t=r.q(e);break;case"acknowledged":t=r.b(e)}f({title:t})}m&&m(e,t,a)}),[f,h,m]),x=Object(n.useCallback)(((e,t)=>{let a;switch(e){case"closed":a=r.n;break;case"open":a=r.p;break;case"acknowledged":a=r.a}y(t.message,{title:a}),b&&b(e,t)}),[y,b]),j=Object(n.useCallback)((async t=>{a?v({name:c.a.BULK_QUERY_STATUS_UPDATE}):e.length>1?v({name:c.a.BULK_STATUS_UPDATE}):v({name:c.a.STATUS_UPDATE});try{var n,i;u({eventIds:e,isLoading:!0});const o=await Object(s.a)({status:t,query:a&&JSON.parse(a),signalIds:e});if(p({eventIds:e,isDeleted:!0}),o.version_conflicts&&1===e.length)throw new Error(r.k);E(null!==(n=o.updated)&&void 0!==n?n:0,null!==(i=o.version_conflicts)&&void 0!==i?i:0,t)}catch(e){x(t,e)}finally{u({eventIds:e,isLoading:!1})}}),[u,e,a,p,E,x,v]);return Object(n.useMemo)((()=>{const n=[];d&&(t!==i.d&&n.push({key:"open","data-test-subj":"open-alert-status",onClick:()=>j(i.d),name:r.l}),t!==i.b&&n.push({key:"acknowledge","data-test-subj":"acknowledged-alert-status",onClick:()=>j(i.b),name:r.i}),t!==i.c&&n.push({key:"close","data-test-subj":"close-alert-status",onClick:()=>j(i.c),name:r.j}));const s=g?g.reduce(((t,n)=>{const i=!(!a||!n.disableOnQuery);return t.push({key:n.key,disabled:i,"data-test-subj":n["data-test-subj"],toolTipContent:i?n.disabledLabel:null,onClick:()=>n.onClick(e),name:n.label}),t}),[]):[];return[...n,...s]}),[t,g,e,j,a,d])}},function(e,t,a){"use strict";var n=a(295);a.d(t,"a",(function(){return n.a})),a.d(t,"b",(function(){return n.b}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(186),i=a(282);const r=({dataFormattedForFieldBrowser:e})=>{const t=Object(n.b)(e),{loading:a,error:r,rule:s}=Object(i.a)(t.ruleId);return{loading:a,error:r,basicAlertData:t,ruleNote:null==s?void 0:s.note}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a.n(n),r=a(165),s=a(168),o=a(798);const l=({index:e=0,score:t})=>{const a=Object(o.a)(t.severity);return i.a.createElement(r.c,{mode:r.a.HOVER_DOWN,data:{value:t.entityValue,field:t.entityName},triggerId:r.d.DEFAULT,visibleCellActions:5},i.a.createElement(i.a.Fragment,null,0!==e&&i.a.createElement(i.a.Fragment,null,",",i.a.createElement(s.i,null)),a))};l.displayName="ScoreComponent";const c=i.a.memo(l);c.displayName="Score"},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(2),i=a.n(n),r=a(40),s=a(77),o=a(102);const l=({score:e,startDate:t,endDate:a,linkName:n})=>{const{services:{ml:l,http:c}}=Object(o.j)(),u=Object(s.useMlHref)(l,c.basePath.get(),{page:"explorer",pageState:{jobIds:[e.jobId],timeRange:{from:new Date(t).toISOString(),to:new Date(a).toISOString(),mode:"absolute"},refreshInterval:{pause:!0,value:0,display:"Off"}}},[e.jobId]);return u?i.a.createElement(r.EuiLink,{href:u,target:"_blank","data-test-subj":`explorer-link-${e.jobId}`},n):null}},function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=a(5).i18n.translate("xpack.securitySolution.components.ml.anomaly.errors.anomaliesTableFetchFailureTitle",{defaultMessage:"Anomalies table fetch failure"})},function(e,t,a){"use strict";a.d(t,"b",(function(){return i})),a.d(t,"j",(function(){return r})),a.d(t,"e",(function(){return s})),a.d(t,"d",(function(){return o})),a.d(t,"a",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"g",(function(){return u})),a.d(t,"f",(function(){return d})),a.d(t,"k",(function(){return p})),a.d(t,"i",(function(){return m})),a.d(t,"h",(function(){return b}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.hostsTable.hostsTitle",{defaultMessage:"All hosts"}),r=e=>n.i18n.translate("xpack.securitySolution.hostsTable.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {host} other {hosts}}"}),s=(n.i18n.translate("xpack.securitySolution.hostsRiskTable.tableTitle",{defaultMessage:"Host risk"}),n.i18n.translate("xpack.securitySolution.hostsTable.nameTitle",{defaultMessage:"Host name"})),o=n.i18n.translate("xpack.securitySolution.hostsTable.lastSeenTitle",{defaultMessage:"Last seen"}),l=n.i18n.translate("xpack.securitySolution.hostsTable.firstLastSeenToolTip",{defaultMessage:"Relative to the selected date range"}),c=n.i18n.translate("xpack.securitySolution.hostsTable.hostRiskToolTip",{defaultMessage:"The host's risk score determines its risk classification. Risky hosts are labeled as critical or high."}),u=n.i18n.translate("xpack.securitySolution.hostsTable.osLastSeenToolTip",{defaultMessage:"Last observed operating system"}),d=n.i18n.translate("xpack.securitySolution.hostsTable.osTitle",{defaultMessage:"Operating system"}),p=n.i18n.translate("xpack.securitySolution.hostsTable.versionTitle",{defaultMessage:"Version"}),m=n.i18n.translate("xpack.securitySolution.hostsTable.rows",{values:{numRows:5},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),b=n.i18n.translate("xpack.securitySolution.hostsTable.rows",{values:{numRows:10},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return E})),a.d(t,"b",(function(){return S}));var n=a(1414),i=a.n(n),r=a(2),s=a.n(r),o=a(40),l=a(44),c=a(294),u=a(17),d=a(271),p=a(1127),m=a(202),b=a(223),g=a(191),f=a(235),y=a(320),h=a(117),v=a(142);const E="prevalence-details",x="now-30d",j=[{field:"field",name:b.u,"data-test-subj":g.u,render:e=>s.a.createElement(o.EuiText,{size:"xs"},e),width:"20%"},{field:"values",name:b.w,"data-test-subj":g.z,render:e=>s.a.createElement(o.EuiFlexGroup,{direction:"column",gutterSize:"none"},e.map((e=>s.a.createElement(o.EuiFlexItem,{key:e},s.a.createElement(o.EuiText,{size:"xs"},e))))),width:"20%"},{name:s.a.createElement(o.EuiToolTip,{content:b.q},s.a.createElement(o.EuiFlexGroup,{direction:"column",gutterSize:"none"},s.a.createElement(o.EuiFlexItem,null,b.p),s.a.createElement(o.EuiFlexItem,null,b.r))),"data-test-subj":g.r,render:e=>{const t=e.values.map((t=>Object(y.a)(e.field,`timeline-indicator-${e.field}-${t}`,t)));return e.alertCount>0?s.a.createElement(d.a,{asEmptyButton:!0,dataProviders:t,filters:[],timeRange:{kind:"absolute",from:e.from,to:e.to}},s.a.createElement(c.a,{count:e.alertCount})):Object(h.d)()},width:"10%"},{name:s.a.createElement(o.EuiToolTip,{content:b.t},s.a.createElement(o.EuiFlexGroup,{direction:"column",gutterSize:"none"},s.a.createElement(o.EuiFlexItem,null,b.s),s.a.createElement(o.EuiFlexItem,null,b.r))),"data-test-subj":g.s,render:e=>{const t=e.values.map((t=>({...Object(y.a)(e.field,`timeline-indicator-${e.field}-${t}`,t),and:[Object(y.b)("event.kind","timeline-indicator-event.kind-not-signal","signal",v.e,!0)]})));return e.docCount>0?s.a.createElement(d.a,{asEmptyButton:!0,dataProviders:t,filters:[],timeRange:{kind:"absolute",from:e.from,to:e.to},keepDataView:!0},s.a.createElement(c.a,{count:e.docCount})):Object(h.d)()},width:"10%"},{field:"hostPrevalence",name:s.a.createElement(o.EuiToolTip,{content:b.l},s.a.createElement(o.EuiFlexGroup,{direction:"column",gutterSize:"none"},s.a.createElement(o.EuiFlexItem,null,b.m),s.a.createElement(o.EuiFlexItem,null,b.v))),"data-test-subj":g.v,render:e=>s.a.createElement(o.EuiText,{size:"xs"},`${Math.round(100*e)}%`),width:"10%"},{field:"userPrevalence",name:s.a.createElement(o.EuiToolTip,{content:b.M},s.a.createElement(o.EuiFlexGroup,{direction:"column",gutterSize:"none"},s.a.createElement(o.EuiFlexItem,null,b.N),s.a.createElement(o.EuiFlexItem,null,b.v))),"data-test-subj":g.y,render:e=>s.a.createElement(o.EuiText,{size:"xs"},`${Math.round(100*e)}%`),width:"10%"}],S=()=>{const{browserFields:e,dataFormattedForFieldBrowser:t,eventId:a,investigationFields:n}=Object(f.b)(),c=Object(u.b)().isPlatinumPlus(),[d,y]=Object(r.useState)(x),[h,v]=Object(r.useState)("now"),[E,S]=Object(r.useState)((i.a.parse(x)||new Date).toISOString()),[k,O]=Object(r.useState)((i.a.parse("now")||new Date).toISOString()),{loading:w,error:T,data:I}=Object(p.a)({dataFormattedForFieldBrowser:t,investigationFields:n,interval:{from:d,to:h}}),C=Object(r.useMemo)((()=>I.map((e=>({...e,from:E,to:k})))),[I,E,k]);if(w)return s.a.createElement(o.EuiFlexGroup,{justifyContent:"spaceAround","data-test-subj":g.q},s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiLoadingSpinner,{size:"m"})));if(!a||!t||!e||T)return s.a.createElement(o.EuiEmptyPrompt,{iconType:"error",color:"danger",title:s.a.createElement("h2",null,Object(m.g)(b.n)),body:s.a.createElement("p",null,Object(m.f)(b.n)),"data-test-subj":g.t});const M=s.a.createElement(s.a.Fragment,null,s.a.createElement(o.EuiCallOut,{"data-test-subj":`${g.x}UpSell`},s.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.flyout.documentDetails.prevalenceTableAlertUpsell",defaultMessage:"Preview of a {subscription} feature showing host and user prevalence.",values:{subscription:s.a.createElement(o.EuiLink,{href:"https://www.elastic.co/pricing/",target:"_blank"},s.a.createElement(l.FormattedMessage,{id:"xpack.securitySolution.flyout.documentDetails.prevalenceTableAlertUpsellLink",defaultMessage:"Platinum"}))}})),s.a.createElement(o.EuiSpacer,{size:"s"}));return s.a.createElement(s.a.Fragment,null,!c&&M,s.a.createElement(o.EuiPanel,null,s.a.createElement(o.EuiSuperDatePicker,{start:d,end:h,onTimeChange:({start:e,end:t,isInvalid:a})=>{if(a)return;y(e),v(t);const n=i.a.parse(e);n&&n.isValid()&&S(n.toISOString());const r=i.a.parse(t);r&&r.isValid()&&O(r.toISOString())},"data-test-subj":g.p}),s.a.createElement(o.EuiSpacer,{size:"m"}),I.length>0?s.a.createElement(o.EuiInMemoryTable,{items:C,columns:j,"data-test-subj":g.x}):s.a.createElement("div",{"data-test-subj":`${g.w}Error`},b.o)))};S.displayName="PrevalenceDetails"},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(42),i=a(129),r=a(319),s=a(655);const o=({dataFormattedForFieldBrowser:e,investigationFields:t})=>{var a,o;if(!e)return{};const l=Object(s.a)(e),c=Object(n.find)({category:"event",field:"event.code"},e),u=Array.isArray(null==c?void 0:c.originalValue)?null==c||null===(a=c.originalValue)||void 0===a?void 0:a[0]:null==c?void 0:c.originalValue,d=Object(n.find)({category:"kibana",field:i.O},e),p=Array.isArray(null==d?void 0:d.originalValue)?null==d||null===(o=d.originalValue)||void 0===o?void 0:o[0]:null==d?void 0:d.originalValue;return Object(s.b)({eventCategories:l,eventCode:u,eventRuleType:p,highlightedFieldsOverride:null!=t?t:[]}).reduce(((t,a)=>{const i=e.find((e=>e.field===a.id||a.legacyId&&e.field===a.legacyId));if(!i)return t;const s=i.values;return!s||Object(n.isEmpty)(s)?t:(i.field===a.legacyId&&(a.id=a.legacyId),"agent.id"!==a.id||Object(r.b)({data:e})?{...t,[a.id]:{...a.overrideField&&{overrideField:a.overrideField},values:s}}:t)}),{})}},function(e,t,a){"use strict";a.d(t,"b",(function(){return n})),a.d(t,"a",(function(){return i}));const n=(e,t)=>Object.keys(e).map((a=>{const n=e[a].values,i=e[a].overrideField||a;return{field:i,description:{field:i,values:n,scopeId:t}}})),i=e=>Object.keys(e).reduce(((t,a)=>({...t,[a]:{terms:{[a]:e[a].values}}})),[])},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(394),r=a(115),s=a(366);const o=({entityId:e,scopeId:t})=>{const{loading:a,error:o,count:l,alertIds:c}=Object(i.a)({field:s.c,value:e,isActiveTimelines:Object(r.isActiveTimeline)(t),signalIndexName:null,includeAlertIds:!0,ignoreTimerange:!0});return Object(n.useMemo)((()=>({loading:a,error:o,data:c||[],dataCount:l||0})),[c,l,o,a])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a(366),r=a(394),s=a(115);const o=({originalEventId:e,scopeId:t})=>{const{loading:a,error:o,count:l,alertIds:c}=Object(r.a)({field:i.e,value:e,isActiveTimelines:Object(s.isActiveTimeline)(t),signalIndexName:null,includeAlertIds:!0});return Object(n.useMemo)((()=>({loading:a,error:o,data:c||[],dataCount:l||0})),[c,l,o,a])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(46),i=a(2),r=a(102),s=a(4);const o=({eventId:e})=>{const{services:{cases:t}}=Object(r.j)(),{data:a,isLoading:o,isError:l}=Object(n.useQuery)(["useFetchRelatedCases",e],(()=>t.api.getRelatedCases(e,{owner:s.i})),{keepPreviousData:!0});return Object(i.useMemo)((()=>({loading:o,error:l,data:a||[],dataCount:(null==a?void 0:a.length)||0})),[a,l,o])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(102);const i=()=>Object(n.h)().read},function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(2),i=a(42),r=a(683),s=a(124),o=a(17),l=a(261),c=a(366);const u=({getFieldsData:e,dataAsNestedObject:t,dataFormattedForFieldBrowser:a})=>{const u=Object(s.a)("insightsRelatedAlertsByProcessAncestry"),d=Object(r.a)(t||void 0),p=Object(l.a)(e(c.a)),m=Object(n.useMemo)((()=>Object(i.find)({category:"kibana",field:"kibana.alert.rule.parameters.index"},a)),[a]),b=Object(o.b)().isPlatinumPlus();return{show:u&&d&&null!=p&&null!=m&&b,...p&&{documentId:p},...m&&m.values&&{indices:m.values}}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(129);const i=({getFieldsData:e})=>{const t=e(n.Y),a=t?parseInt(t[0],10):0;return{show:Boolean(t),alertSuppressionCount:a}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(366),i=a(261);const r=({getFieldsData:e})=>{const t=Object(i.a)(e(n.e));return{show:null!=t,...t&&{originalEventId:t}}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(366),i=a(261);const r=({getFieldsData:e})=>{const t=Object(i.a)(e(n.c));return{show:null!=t,...t&&{entityId:t}}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(2),i=a(684),r=a(115);const s=({documentId:e,indices:t,scopeId:a})=>{const s=Object(r.isActiveTimeline)(a),{loading:o,error:l,alertIds:c}=Object(i.a)({isActiveTimeline:s,documentId:e,indices:t});return Object(n.useMemo)((()=>({loading:o,error:l,data:c,dataCount:(null==c?void 0:c.length)||0})),[c,l,o])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return m}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(1274),c=a.n(l);const u=o()(n.EuiFlexGroup).withConfig({displayName:"ThreatEuiFlexGroupStyles",componentId:"sc-14mwgam-0"})([".euiFlexItem{margin-bottom:0px;}"]),d=o()(n.EuiFlexItem).withConfig({displayName:"SubtechniqueFlexItem",componentId:"sc-14mwgam-1"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeM)),p=o()(n.EuiButtonEmpty).withConfig({displayName:"TechniqueLinkItem",componentId:"sc-14mwgam-2"})([".euiIcon{width:8px;height:8px;}align-self:flex-start;"]),m=({label:e,threat:t})=>{const[s,o]=Object(i.useState)([]),[l,m]=Object(i.useState)([]),[b,g]=Object(i.useState)([]);return Object(i.useEffect)((()=>{!async function(){const e=await a.e(19).then(a.bind(null,1443));g(e.subtechniques),o(e.techniques),m(e.tactics)}()}),[]),r.a.createElement(u,{direction:"column"},t.map(((e,t)=>{const a=l.find((t=>t.id===e.tactic.id));return r.a.createElement(n.EuiFlexItem,{key:`${e.tactic.name}-${t}`},r.a.createElement(n.EuiLink,{"data-test-subj":"threatTacticLink",href:e.tactic.reference,target:"_blank"},null!=a?a.label:`${e.tactic.name} (${e.tactic.id})`),r.a.createElement(n.EuiFlexGroup,{gutterSize:"none",alignItems:"flexStart",direction:"column"},e.technique&&e.technique.map(((e,t)=>{var a;const i=s.find((t=>t.id===e.id));return r.a.createElement(n.EuiFlexItem,{key:null!==(a=null==i?void 0:i.id)&&void 0!==a?a:t},r.a.createElement(p,{"data-test-subj":"threatTechniqueLink",href:e.reference,target:"_blank",iconType:c.a,size:"xs"},null!=i?i.label:`${e.name} (${e.id})`),r.a.createElement(n.EuiFlexGroup,{gutterSize:"none",alignItems:"flexStart",direction:"column"},null!=e.subtechnique&&e.subtechnique.map(((e,t)=>{var a;const n=b.find((t=>t.id===e.id));return r.a.createElement(d,{key:null!==(a=null==n?void 0:n.id)&&void 0!==a?a:t},r.a.createElement(p,{"data-test-subj":"threatSubtechniqueLink",href:e.reference,target:"_blank",iconType:c.a,size:"xs"},null!=n?n.label:`${e.name} (${e.id})`))}))))}))))})))}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r}));var n=a(2);const i=a.n(n).a.createContext(null),r=()=>{var e;return null===(e=Object(n.useContext)(i))||void 0===e?void 0:e.current}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"d",(function(){return o}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.utilityBar.additionalFiltersTitle",{defaultMessage:"Additional filters"}),r=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.utilityBar.additionalFiltersActions.showBuildingBlockTitle",{defaultMessage:"Include building block alerts"}),s=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.utilityBar.additionalFiltersActions.showOnlyThreatIndicatorAlerts",{defaultMessage:"Show only threat indicator alerts"}),o=n.i18n.translate("xpack.securitySolution.detectionEngine.alerts.utilityBar.takeActionTitle",{defaultMessage:"Take action"})},function(e,t,a){"use strict";a.d(t,"a",(function(){return b})),a.d(t,"e",(function(){return g})),a.d(t,"b",(function(){return f})),a.d(t,"d",(function(){return y})),a.d(t,"f",(function(){return h})),a.d(t,"g",(function(){return v})),a.d(t,"c",(function(){return x}));var n=a(2),i=a.n(n),r=a(5),s=a(44),o=a(40),l=a(126),c=a(102),u=a(940),d=a(574),p=a(888),m=a(575);const b=r.i18n.translate("xpack.securitySolution.eventFilters.aboutInfo",{defaultMessage:"Event filters exclude high volume or unwanted events from being written to Elasticsearch."}),g=r.i18n.translate("xpack.securitySolution.eventFilter.form.name.label",{defaultMessage:"Name"}),f=r.i18n.translate("xpack.securitySolution.eventFilter.form.description.placeholder",{defaultMessage:"Description"}),y=r.i18n.translate("xpack.securitySolution.eventFilter.form.name.error",{defaultMessage:"The name can't be empty"}),h=r.i18n.translate("xpack.securitySolution.eventFilter.form.os.label",{defaultMessage:"Select operating system"}),v=r.i18n.translate("xpack.securitySolution.eventFilter.form.rule.name",{defaultMessage:"Endpoint Event Filtering"}),E={pageTitle:r.i18n.translate("xpack.securitySolution.eventFilters.pageTitle",{defaultMessage:"Event Filters"}),pageAboutInfo:r.i18n.translate("xpack.securitySolution.eventFilters.pageAboutInfo",{defaultMessage:"Event filters exclude high volume or unwanted events from being written to Elasticsearch."}),pageAddButtonTitle:r.i18n.translate("xpack.securitySolution.eventFilters.pageAddButtonTitle",{defaultMessage:"Add event filter"}),getShowingCountLabel:e=>r.i18n.translate("xpack.securitySolution.eventFilters.showingTotal",{defaultMessage:"Showing {total} {total, plural, one {event filter} other {event filters}}",values:{total:e}}),cardActionEditLabel:r.i18n.translate("xpack.securitySolution.eventFilters.cardActionEditLabel",{defaultMessage:"Edit event filter"}),cardActionDeleteLabel:r.i18n.translate("xpack.securitySolution.eventFilters.cardActionDeleteLabel",{defaultMessage:"Delete event filter"}),flyoutCreateTitle:r.i18n.translate("xpack.securitySolution.eventFilters.flyoutCreateTitle",{defaultMessage:"Add event filter"}),flyoutEditTitle:r.i18n.translate("xpack.securitySolution.eventFilters.flyoutEditTitle",{defaultMessage:"Edit event filter"}),flyoutCreateSubmitButtonLabel:r.i18n.translate("xpack.securitySolution.eventFilters.flyoutCreateSubmitButtonLabel",{defaultMessage:"Add event filter"}),flyoutCreateSubmitSuccess:({name:e})=>r.i18n.translate("xpack.securitySolution.eventFilters.flyoutCreateSubmitSuccess",{defaultMessage:'"{name}" has been added to the event filters list.',values:{name:e}}),flyoutEditSubmitSuccess:({name:e})=>r.i18n.translate("xpack.securitySolution.eventFilters.flyoutEditSubmitSuccess",{defaultMessage:'"{name}" has been updated.',values:{name:e}}),flyoutDowngradedLicenseDocsInfo:e=>i.a.createElement(i.a.Fragment,null,i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.eventFilters.flyoutDowngradedLicenseDocsInfo",defaultMessage:"For more information, see our "}),i.a.createElement(o.EuiLink,{target:"_blank",href:`${e.eventFilters}`},i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.eventFilters.flyoutDowngradedLicenseDocsLink",defaultMessage:"Event filters documentation"}))),deleteActionSuccess:e=>r.i18n.translate("xpack.securitySolution.eventFilters.deleteSuccess",{defaultMessage:'"{itemName}" has been removed from event filters list.',values:{itemName:e}}),emptyStateTitleNoEntries:r.i18n.translate("xpack.securitySolution.eventFilters.emptyStateTitleNoEntries",{defaultMessage:"There are no event filters to display."}),emptyStateTitle:r.i18n.translate("xpack.securitySolution.eventFilters.emptyStateTitle",{defaultMessage:"Add your first event filter"}),emptyStateInfo:r.i18n.translate("xpack.securitySolution.eventFilters.emptyStateInfo",{defaultMessage:"Add an event filter to exclude high volume or unwanted events from being written to Elasticsearch."}),emptyStatePrimaryButtonLabel:r.i18n.translate("xpack.securitySolution.eventFilters.emptyStatePrimaryButtonLabel",{defaultMessage:"Add event filter"}),searchPlaceholderInfo:r.i18n.translate("xpack.securitySolution.eventFilters.searchPlaceholderInfo",{defaultMessage:"Search on the fields below: name, description, comments, value"})},x=Object(n.memo)((()=>{const{canWriteEventFilters:e}=Object(l.a)().endpointPrivileges,t=Object(c.i)(),a=d.a.getInstance(t);return i.a.createElement(u.a,{apiClient:a,ArtifactFormComponent:p.a,labels:E,"data-test-subj":"EventFiltersListPage",searchableFields:m.d,flyoutSize:"l",allowCardCreateAction:e,allowCardEditAction:e,allowCardDeleteAction:e})}));x.displayName="EventFiltersList"},function(e,t,a){"use strict";a.d(t,"a",(function(){return v}));var n=a(48),i=a(2),r=a.n(i),s=a(4),o=a(102),l=a(117),c=a(224),u=a(393),d=a(364),p=a(168),m=a(274),b=a(473),g=a(162),f=a(231),y=a(149),h=a(330);const v=r.a.memo((({contextID:e,id:t,ip:a,data:i,isDraggable:v=!1,isInDetailsSidePanel:E=!1,loading:x,flowTarget:j,startDate:S,endDate:k,isLoadingAnomaliesData:O,anomaliesData:w,narrowDateRange:T,indexPatterns:I,jobNameById:C})=>{const M=Object(g.a)(),_=Object(f.a)(M),[F]=Object(o.p)(s.B),A=i[j],D=[{title:d.i,description:Object(c.g)([`${j}.geo.city_name`,`${j}.geo.region_name`],i,e,v)},{title:d.c,description:A?Object(c.d)(A.autonomousSystem,j,e,v):Object(l.d)()}],N=[_?[...D,{title:d.j,description:r.a.createElement(b.a,{anomalies:w,startDate:S,endDate:k,isLoading:O,narrowDateRange:T,jobNameById:C})}]:D,[{title:d.d,description:r.a.createElement(u.a,{indexPatterns:I,field:`${j}.ip`,value:a,type:u.b.FIRST_SEEN})},{title:d.h,description:r.a.createElement(u.a,{indexPatterns:I,field:`${j}.ip`,value:a,type:u.b.LAST_SEEN})}],[{title:d.e,description:A&&i.host?Object(c.e)({host:i.host,isDraggable:v,ipFilter:a,contextID:e}):Object(l.d)()},{title:d.f,description:A&&i.host?Object(c.f)(i.host,a,e,v):Object(l.d)()}],[{title:d.o,description:Object(c.i)(a)},{title:d.k,description:Object(c.h)(a)}]];return r.a.createElement(y.c,null,r.a.createElement(p.g,{direction:E?"column":"row"},!E&&r.a.createElement(y.b,{queryId:t,title:d.g,inspectIndex:0}),N.map(((e,t)=>r.a.createElement(h.a,{descriptionList:e,key:t}))),x&&r.a.createElement(m.a,{overlay:!0,overlayBackground:F?n.euiDarkVars.euiPageBackgroundColor:n.euiLightVars.euiPageBackgroundColor,size:"xl"})))}));v.displayName="IpOverview"},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(113);const i=(e,t)=>t===n.g.source?[{fieldName:"source.ip",fieldValue:e}]:t===n.g.destination?[{fieldName:"destination.ip",fieldValue:e}]:[]},function(e,t,a){"use strict";a.d(t,"b",(function(){return u})),a.d(t,"a",(function(){return d}));var n=a(23),i=a(2),r=a(878),s=a(278),o=a(279),l=a(735),c=a(21);const u=({defaultGroupingOptions:e,groupingId:t,fields:a,onGroupChange:n,maxGroupingLevels:r})=>{const s=Object(i.useCallback)((e=>{n([e])}),[n]);return Object(c.jsx)(o.a,{groupingId:t,groupsSelected:["none"],"data-test-subj":"alerts-table-group-selector",onGroupChange:s,fields:a,maxGroupingLevels:r,options:e})},d=({defaultGroupingOptions:e,dispatch:t,fields:a,groupingId:u,groupingState:d,maxGroupingLevels:p=1,onGroupChange:m,onOptionsChange:b,tracker:g})=>{var f;const{activeGroups:y,options:h}=null!==(f=Object(r.b)({groups:d},u))&&void 0!==f?f:s.c,v=Object(i.useCallback)((e=>{t(r.a.updateActiveGroups({id:u,activeGroups:e}))}),[t,u]),E=Object(i.useCallback)((e=>{t(r.a.updateGroupOptions({id:u,newOptionList:e})),null==b||b(e)}),[t,u,b]),x=Object(i.useCallback)((e=>{if(y.find((t=>t===e))){const t=y.filter((t=>t!==e));return void(0===t.length?v(["none"]):v(t))}const t=Object(o.e)([e])?[e]:[...y.filter((e=>"none"!==e)),e];v(t),null==g||g(n.METRIC_TYPE.CLICK,l.a.groupChanged({groupingId:u,selected:e})),null==m||m({tableId:u,groupByField:e})}),[u,m,y,v,g]);return Object(i.useEffect)((()=>{if(0===h.length&&e.length>0)return E(e.find((e=>y.find((t=>t===e.key))))?e:[...e,...Object(o.e)(y)?[]:y.map((e=>({key:e,label:e})))]);if(Object(o.e)(y))return;const t=h.map((e=>e.key)),a=[...h];y.forEach((e=>{t.includes(e)||a.push({label:e,key:e})})),a.length!==h.length&&E(a)}),[e,h,y,E]),Object(c.jsx)(o.a,{groupingId:u,groupsSelected:y,"data-test-subj":"alerts-table-group-selector",onGroupChange:x,fields:a,maxGroupingLevels:p,options:h})}},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(139);const i=({groups:e},t)=>e[t],r=()=>Object(n.createSelector)(i,(e=>e))},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(2),i=a(365);const r=Object(i.c)(),s=()=>{const[e]=Object(n.useState)(r);return{globalKQLHeaderPortalNode:e}}},function(e,t,a){const n=a(157),i=a(292),{safeRe:r,t:s}=a(310);e.exports=(e,t)=>{if(e instanceof n)return e;if("number"==typeof e&&(e=String(e)),"string"!=typeof e)return null;let a=null;if((t=t||{}).rtl){let t;for(;(t=r[s.COERCERTL].exec(e))&&(!a||a.index+a[0].length!==e.length);)a&&t.index+t[0].length===a.index+a[0].length||(a=t),r[s.COERCERTL].lastIndex=t.index+t[1].length+t[2].length;r[s.COERCERTL].lastIndex=-1}else a=e.match(r[s.COERCE]);return null===a?null:i(`${a[2]}.${a[3]||"0"}.${a[4]||"0"}`,t)}},function(e,t,a){"use strict";a.d(t,"a",(function(){return p}));var n=a(2),i=a.n(n),r=a(41),s=a.n(r),o=a(40),l=a(77),c=a(102);const u=s()(o.EuiLink).withConfig({displayName:"StyledJobEuiLInk",componentId:"sc-ilb29r-0"})(["margin-right:",";"],(({theme:e})=>e.eui.euiSizeS)),d=({jobId:e,jobName:t})=>{const{services:{http:a,ml:n}}=Object(c.j)(),r=Object(l.useMlHref)(n,a.basePath.get(),{page:l.ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE,pageState:{jobId:[e]}},[e]);return i.a.createElement(u,{"data-test-subj":"machineLearningJobLink",href:r,target:"_blank"},i.a.createElement("span",{"data-test-subj":"machineLearningJob"},null!=t?t:e))},p=Object(n.memo)(d)},function(e,t,a){"use strict";a.d(t,"a",(function(){return S}));var n=a(42),i=a(40),r=a(2),s=a.n(r),o=a(343),l=a.n(o),c=a(839),u=a.n(c),d=a(41),p=a.n(d),m=a(69),b=a(44),g=a(129),f=a(4),y=a(125),h=a(102),v=a(852);const E=[{isSummaryOption:!0,isForEachAlertOption:!0,value:{value:"onActiveAlert",inputDisplay:v.d,"data-test-subj":"onActiveAlert",dropdownDisplay:s.a.createElement(i.EuiText,{size:"s"},s.a.createElement("p",null,s.a.createElement(b.FormattedMessage,{defaultMessage:"Per rule run",id:"xpack.securitySolution.detectionEngine.ruleNotifyWhen.onActiveAlert.label"})))}},{isSummaryOption:!0,isForEachAlertOption:!1,value:{value:"onThrottleInterval",inputDisplay:v.a,"data-test-subj":"onThrottleInterval",dropdownDisplay:s.a.createElement(i.EuiText,{size:"s"},s.a.createElement("p",null,s.a.createElement(b.FormattedMessage,{defaultMessage:"Custom frequency",id:"xpack.securitySolution.detectionEngine.ruleNotifyWhen.onThrottleInterval.label"})))}}],x=p.a.div.withConfig({displayName:"FieldErrorsContainer",componentId:"sc-kyvj3t-0"})(["p{margin-bottom:0;}"]),j=p.a.div.attrs((({className:e="",$caseIndexes:t=[]})=>({className:e}))).withConfig({displayName:"ContainerActions",componentId:"sc-kyvj3t-1"})(["",""],(({$caseIndexes:e})=>e.map((e=>`\n        div[id="${e}"].euiAccordion__childWrapper .euiAccordion__children {\n          padding: 0px;\n          .euiFlexGroup {\n            display: none;\n          }\n          .euiSpacer.euiSpacer--xl {\n            height: 0px;\n          }\n        }\n      `)))),S=({field:e,messageVariables:t,summaryMessageVariables:a})=>{const[o,c]=Object(r.useState)(null),d=Object(y.l)(),{isValid:p}=d,{triggersActionsUi:{getActionForm:b}}=Object(h.j)().services,[S,k]=Object(r.useState)(!1),O=Object(r.useMemo)((()=>Object(n.isEmpty)(e.value)?[]:e.value),[e.value]),w=Object(r.useMemo)((()=>O.reduce(((e,t,a)=>".case"===t.actionTypeId?[...e,`${a}`]:e),[])),[O]),T=Object(r.useCallback)(((t,a)=>{const i=[...O];Object(n.isEmpty)(i[a].params)&&k(!0),i[a]=l()(i[a],{id:t}),e.setValue(i)}),[e,O]),I=Object(r.useCallback)((t=>e.setValue(t)),[e]),C=Object(r.useCallback)(((t,a,n)=>{const i=()=>{e.setValue((e=>{const i=[...e];return i[n]={...i[n],params:{...i[n].params,[t]:a}},i}))};S?(setTimeout(i,0),k(!1)):i()}),[e,S]),M=Object(r.useCallback)(((t,a,i)=>{e.setValue((e=>{const r=[...e],{alertsFilter:s,...o}=r[i],l={...s};return a?l[t]=a:delete l[t],r[i]={...o,...Object(n.isEmpty)(l)?{}:{alertsFilter:l}},r}))}),[e]),_=Object(r.useCallback)(((t,a,n)=>{e.setValue((e=>{var i;const r=[...e];return r[n]={...r[n],frequency:{...null!==(i=r[n].frequency)&&void 0!==i?i:f.Pb,[t]:a}},r}))}),[e]),F=void 0!==p,A=Object(r.useMemo)((()=>b({actions:O,messageVariables:t,summaryMessageVariables:a,defaultActionGroupId:"default",setActionIdByIndex:T,setActions:I,setActionParamsProperty:C,setActionFrequencyProperty:_,setActionAlertsFilterProperty:M,featureId:m.SecurityConnectorFeatureId,producerId:g.mb.SIEM,defaultActionMessage:v.c,defaultSummaryMessage:v.e,hideActionHeader:!0,hasAlertsMappings:!0,notifyWhenSelectOptions:E,defaultRuleFrequency:f.Pb,disableErrorMessages:!F})),[O,b,t,a,_,T,C,I,M,F]);return Object(r.useEffect)((()=>{if(!1===p){const t=e.errors.map((({message:e})=>e)).join("\n");return c(t)}return c(null)}),[e.errors,p]),s.a.createElement(j,{$caseIndexes:w},o?s.a.createElement(s.a.Fragment,null,s.a.createElement(x,null,s.a.createElement(i.EuiCallOut,{title:v.b,color:"danger",iconType:"warning"},s.a.createElement(u.a,null,o))),s.a.createElement(i.EuiSpacer,null)):null,A)}},function(e,t,a){"use strict";a.d(t,"a",(function(){return n})),a.d(t,"d",(function(){return i})),a.d(t,"b",(function(){return r})),a.d(t,"c",(function(){return s}));const n={filter:"",tags:[],showCustomRules:!1,showElasticRules:!1,enabled:void 0,ruleExecutionStatus:void 0},i={field:"enabled",order:"desc"},r=1,s=20},function(e,t,a){"use strict";a.d(t,"a",(function(){return g}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(172),c=a(196),u=a(159),d=a(612),p=a(265);const m=o()(n.EuiSwitch).withConfig({displayName:"StaticSwitch",componentId:"sc-1s9ljiu-0"})([".euiSwitch__thumb,.euiSwitch__icon{transition:none;}"]);m.displayName="StaticSwitch";const b=({id:e,isDisabled:t,isLoading:a,enabled:s,startMlJobsIfNeeded:o,onChange:b})=>{const[g,f]=Object(i.useState)(!1),y=Object(p.c)(),{startTransaction:h}=Object(u.b)(),{executeBulkAction:v}=Object(d.b)({suppressSuccessToast:!y}),E=Object(i.useCallback)((async t=>{f(!0),h({name:s?c.e.DISABLE:c.e.ENABLE});const a=t.target.checked;a&&await(null==o?void 0:o());const n=await v({type:a?l.b.enable:l.b.disable,ids:[e]});null!=n&&n.attributes.results.updated.length&&(null==b||b(n.attributes.results.updated[0].enabled)),f(!1)}),[s,v,e,b,o,h]),x=Object(i.useMemo)((()=>g!==a&&a||g),[g,a]);return r.a.createElement(n.EuiFlexGroup,{alignItems:"center",justifyContent:"spaceAround",id:`rule-switch-${e}`},r.a.createElement(n.EuiFlexItem,{grow:!1},x?r.a.createElement(n.EuiLoadingSpinner,{size:"m","data-test-subj":"ruleSwitchLoader"}):r.a.createElement(m,{"data-test-subj":"ruleSwitch",showLabel:!1,label:"",disabled:t,checked:s,onChange:E})))},g=r.a.memo(b);g.displayName="RuleSwitch"},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(166);const c=o()(n.EuiPanel).withConfig({displayName:"MyPanel",componentId:"sc-j93jp7-0"})(["position:relative;"]);c.displayName="MyPanel";const u=({children:e,loading:t,title:a})=>r.a.createElement(c,{hasBorder:!0},t&&r.a.createElement(n.EuiProgress,{size:"xs",color:"accent",position:"absolute","data-test-subj":"stepPanelProgress"}),a&&r.a.createElement(l.a,{title:a}),e),d=Object(i.memo)(u)},function(e,t,a){"use strict";a.d(t,"a",(function(){return l}));var n=a(2),i=a.n(n),r=a(40),s=a(137);const o=({columnName:e,children:t})=>{const[a,o]=Object(n.useState)(!1);return i.a.createElement(r.EuiPopover,{anchorPosition:"upCenter",isOpen:a,closePopover:()=>o(!1),button:i.a.createElement(r.EuiButtonIcon,{"aria-label":s.cc(e),onClick:e=>{o(!a),e.stopPropagation()},size:"xs",color:"primary",iconType:"questionInCircle",style:{height:"auto"}})},t)},l=i.a.memo(o);l.displayName="PopoverTooltip"},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a.n(n),r=a(40);const s=({title:e,tooltipContent:t,customTooltip:a})=>i.a.createElement(r.EuiFlexGroup,{gutterSize:"none"},i.a.createElement(r.EuiFlexItem,{style:{width:"calc(100% - 20px)"}},i.a.createElement("span",{className:"eui-textTruncate"},e)),null!=a?a:i.a.createElement(r.EuiToolTip,{content:t},i.a.createElement(r.EuiIcon,{"data-test-subj":"tableHeaderIcon",size:"m",color:"subdued",type:"questionInCircle",style:{marginLeft:4}}))),o=i.a.memo(s);o.displayName="TableHeaderTooltipCell"},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(2),i=a(102);const r=()=>{const{storage:e}=Object(i.j)().services,t=Object(n.useCallback)((t=>{var a;return null!==(a=e.get(`${t}-messages`))&&void 0!==a?a:[]}),[e]),a=Object(n.useCallback)(((t,a)=>{var n;const i=null!==(n=e.get(`${t}-messages`))&&void 0!==n?n:[];e.set(`${t}-messages`,[...i,a])}),[e]),r=Object(n.useCallback)(((t,a)=>{var n;return(null!==(n=e.get(`${t}-messages`))&&void 0!==n?n:[]).filter((e=>e===a)).length>0}),[e]),s=Object(n.useCallback)(((t,a)=>{var n;const i=null!==(n=e.get(`${t}-messages`))&&void 0!==n?n:[];e.set(`${t}-messages`,[...i.filter((e=>e!==a))])}),[e]);return{getMessages:t,addMessage:a,clearAllMessages:Object(n.useCallback)((t=>e.remove(`${t}-messages`)),[e]),removeMessage:s,hasMessage:r}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(40),i=a(2),r=a.n(i),s=a(142),o=a(135);const l=({status:e=s.d,onFilterGroupChanged:t})=>{const a=[{id:"open",label:o.H,"data-test-subj":"openAlerts"},{id:"acknowledged",label:o.a,"data-test-subj":"acknowledgedAlerts"},{id:"closed",label:o.y,"data-test-subj":"closedAlerts"}],l=Object(i.useCallback)((e=>{t(e)}),[t]);return r.a.createElement(n.EuiButtonGroup,{legend:"filter status",color:"primary",options:a,idSelected:e,"data-test-subj":"alerts-table-filter-group",onChange:l})},c=r.a.memo(l)},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(2),i=a(472);const r=()=>{const[e,t,a]=Object(i.a)(),r=Object(n.useRef)(),s=Object(n.useCallback)((e=>{var t;null===(t=r.current)||void 0===t||t.call(r,e)}),[]),o=Object(n.useCallback)((()=>{var e;null===(e=r.current)||void 0===e||e.call(r,null)}),[]),l=Object(n.useCallback)((()=>(t(),new Promise((e=>{r.current=e})).finally((()=>{a()})))),[t,a]);return{isBulkDuplicateConfirmationVisible:e,showBulkDuplicateConfirmation:Object(n.useCallback)((async()=>{const e=await l();return e?s(e):o(),e}),[l,s,o]),cancelRuleDuplication:o,confirmRuleDuplication:s}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return c}));var n=a(2),i=a.n(n),r=a(40),s=a(687),o=a(935);const l=({onCancel:e,onConfirm:t,rulesCount:a})=>{const[l,c]=Object(n.useState)(s.a.withExceptions),u=Object(n.useCallback)((e=>{c(e)}),[c]),d=Object(n.useCallback)((()=>{t(l)}),[t,l]);return i.a.createElement(r.EuiConfirmModal,{title:o.c.MODAL_TITLE(a),onConfirm:d,cancelButtonText:o.c.CANCEL_BUTTON,confirmButtonText:o.c.CONTINUE_BUTTON,defaultFocusedButton:"confirm",onCancel:e},i.a.createElement(r.EuiText,null,o.c.MODAL_TEXT(a)),i.a.createElement(r.EuiSpacer,null),i.a.createElement(r.EuiRadioGroup,{options:[{id:s.a.withExceptions,label:i.a.createElement(r.EuiText,{size:"s"},o.c.DUPLICATE_EXCEPTIONS_INCLUDE_EXPIRED_EXCEPTIONS_LABEL(a),i.a.createElement(r.EuiIconTip,{content:o.c.DUPLICATE_TOOLTIP,position:"bottom"})),"data-test-subj":s.a.withExceptions},{id:s.a.withExceptionsExcludeExpiredExceptions,label:i.a.createElement(r.EuiText,{size:"s"},o.c.DUPLICATE_EXCEPTIONS_TEXT(a),i.a.createElement(r.EuiIconTip,{content:o.c.DUPLICATE_TOOLTIP,position:"bottom"})),"data-test-subj":s.a.withExceptionsExcludeExpiredExceptions},{id:s.a.withoutExceptions,label:o.c.DUPLICATE_WITHOUT_EXCEPTIONS_TEXT(a),"data-test-subj":s.a.withoutExceptions}],idSelected:l,onChange:u}))},c=i.a.memo(l);c.displayName="BulkActionDuplicateExceptionsConfirmation"},function(e,t,a){"use strict";e.exports=a(1422)},function(e,t,a){"use strict";e.exports=a(1423)},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a.n(n),r=a(422),s=a(681);const o=e=>[{headerCellRender:()=>i.a.createElement(i.a.Fragment,null,s.a),id:"default-timeline-control-column",rowCellRender:r.a,width:Object(r.c)(e)}]},function(e,t,a){"use strict";a.d(t,"a",(function(){return TrustedAppsApiClient}));var n=a(163),i=a(1128),r=a(733),s=a(1119);function o(e){return{...e,entries:Object(i.b)(e.entries)}}function l(e){return{...e,entries:Object(i.a)(e.entries,!0)}}class TrustedAppsApiClient extends r.a{constructor(e){super(e,n.n,s.b,o,l)}static getInstance(e){return super.getInstance(e,n.n,s.b,o,l)}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return r})),a.d(t,"b",(function(){return s}));var n=a(120),i=a(163);const r=["name","description","item_id","entries.value","entries.entries.value"],s={name:i.o,namespace_type:"agnostic",description:i.m,list_id:i.n,type:n.b.ENDPOINT_TRUSTED_APPS}},function(e,t,a){"use strict";a.d(t,"a",(function(){return HostIsolationExceptionsApiClient}));var n=a(163),i=a(733),r=a(937);class HostIsolationExceptionsApiClient extends i.a{constructor(e){super(e,n.i,r.a)}static getInstance(e){return super.getInstance(e,n.i,r.a)}}},,function(e,t,a){"use strict";a.d(t,"a",(function(){return J})),a.d(t,"b",(function(){return X}));var n=a(2),i=a.n(n),r=a(40),s=a(223),o=a(191),l=a(202),c=a(193),u=a(512),d=a(129),p=a(329),m=a(46),b=a(8),g=a(102),f=a(13);const y=[5,10,20],h={pageIndex:0,pageSize:y[0]},v=(e,t)=>t,E={sort:{field:"@timestamp",direction:"desc"},enableAllColumns:!0},x=(e,t)=>({...e,sort:t}),j=e=>{const{setPagination:t,pagination:a,pageSizeOptions:i}=(()=>{const[e,t]=Object(n.useReducer)(v,h);return Object(n.useMemo)((()=>({pageSizeOptions:[...y],pagination:e,setPagination:t})),[e])})(),{sorting:r,sortConfig:s,setSorting:o}=(()=>{const[e,t]=Object(n.useReducer)(x,E),a=Object(n.useMemo)((()=>[{[e.sort.field]:e.sort.direction}]),[e.sort.direction,e.sort.field]);return{sorting:e,setSorting:t,sortConfig:a}})(),{data:l,totalItemCount:c,loading:u,error:d}=(({alertIds:e,from:t,size:a,sort:i})=>{const{services:{data:r}}=Object(g.j)(),s=Object(n.useMemo)((()=>{return e=r.search,async({signal:t,alertIds:a,from:n,size:i,sort:r})=>new Promise(((s,o)=>{const l=e.search({params:{body:{query:{ids:{values:a}},from:n,size:i,sort:r,fields:["*"],_source:!1}}},{abortSignal:t}).subscribe((e=>{Object(f.isCompleteResponse)(e)?(l.unsubscribe(),s(e.rawResponse)):Object(f.isErrorResponse)(e)&&(l.unsubscribe(),o(new Error("Error while loading alerts")))}))}));var e}),[r.search]),{data:o,isLoading:l,isError:c}=Object(m.useQuery)(["useFetchAlerts",e,t,a,i],(async({signal:n})=>s({signal:n,alertIds:e,from:t,size:a,sort:i})),{keepPreviousData:!0});return Object(n.useMemo)((()=>{var e,t;const a=null==o||null===(e=o.hits)||void 0===e?void 0:e.total;return{loading:l,error:c,data:(null==o||null===(t=o.hits)||void 0===t?void 0:t.hits)||[],totalItemCount:Object(b.isNumber)(a)?a:0}}),[o,c,l])})({alertIds:e,from:a.pageIndex*a.pageSize,size:a.pageSize,sort:s});return{paginationConfig:Object(n.useMemo)((()=>({...a,pageSizeOptions:i,totalItemCount:c})),[i,a,c]),setPagination:t,setSorting:o,loading:u,data:l,sorting:r,error:d}};var S=a(249),k=a(271),O=a(135),w=a(320);const T=({tooltip:e,anchorPosition:t="top",children:a})=>i.a.createElement(r.EuiToolTip,{content:e,position:t},a),I=[{field:"@timestamp",name:s.i,truncateText:!0,dataType:"date",render:e=>{const t=Object(r.formatDate)(e,"MMM D, YYYY @ HH:mm:ss.SSS");return i.a.createElement(T,{tooltip:t},i.a.createElement("span",null,t))}},{field:d.D,name:s.g,truncateText:!0,render:e=>i.a.createElement(T,{tooltip:e},i.a.createElement("span",null,e))},{field:d.p,name:s.f,truncateText:!0,render:e=>i.a.createElement(T,{tooltip:e,anchorPosition:"left"},i.a.createElement("span",null,e))},{field:"kibana.alert.severity",name:s.h,truncateText:!0,render:e=>{const t=c.p.decode(e),a=Object(u.isRight)(t)?i.a.createElement(p.a,{value:t.right}):i.a.createElement("p",null,e);return i.a.createElement(T,{tooltip:e},a)}}],C=({title:e,loading:t,alertIds:a,scopeId:s,eventId:o,noItemsMessage:l,"data-test-subj":c})=>{const{setPagination:u,setSorting:d,data:p,loading:m,paginationConfig:b,sorting:g,error:f}=j(a||[]),y=Object(n.useCallback)((({page:e,sort:t})=>{if(e){const{index:t,size:a}=e;u({pageIndex:t,pageSize:a})}t&&d(t)}),[u,d]),h=Object(n.useMemo)((()=>p.map((e=>e.fields)).map(((e={})=>Object.keys(e).reduce(((t,a)=>{var n;return t[a]=(null==e||null===(n=e[a])||void 0===n?void 0:n[0])||(null==e?void 0:e[a]),t}),{})))),[p]),v=Boolean(a&&a.length&&a.length>=5),E=Object(n.useMemo)((()=>v?null:_(s,o,a)),[a,v,s,o]),x=Object(n.useMemo)((()=>v?M(a):null),[a,v]);return i.a.createElement(S.a,{header:{title:e,iconType:"warning",headerContent:a&&a.length&&a.length>0?i.a.createElement("div",{"data-test-subj":`${c}InvestigateInTimeline`},i.a.createElement(k.a,{dataProviders:E,filters:x,asEmptyButton:!0,iconType:"timeline"},O.h)):null},content:{error:f},expand:{expandable:!0,expandedOnFirstRender:!0},"data-test-subj":c},i.a.createElement(r.EuiBasicTable,{"data-test-subj":`${c}Table`,loading:t||m,items:h,columns:I,pagination:b,sorting:g,onChange:y,noItemsMessage:l}))},M=e=>e&&e.length?[{meta:{alias:s.d,type:"phrases",key:"_id",params:[...e],negate:!1,disabled:!1,value:e.join()},query:{bool:{should:e.map((e=>({match_phrase:{_id:e}}))),minimum_should_match:1}}}]:null,_=(e,t,a)=>a&&a.length?a.reduce(((a,n,i)=>{const r=`${e}-${t}-event.id-${i}-${n}`;return a.push(Object(w.a)("_id",r,n)),a}),[]):null;var F=a(1085);const A=({entityId:e,scopeId:t,eventId:a})=>{const{loading:n,error:r,data:c,dataCount:u}=Object(F.a)({entityId:e,scopeId:t}),d=`${u} ${Object(l.d)(u)}`;return r?null:i.a.createElement(C,{title:d,loading:n,alertIds:c,scopeId:t,eventId:a,noItemsMessage:s.y,"data-test-subj":o.d})};A.displayName="RelatedAlertsBySession";var D=a(1086);const N=({originalEventId:e,scopeId:t,eventId:a})=>{const{loading:n,error:r,data:c,dataCount:u}=Object(D.a)({originalEventId:e,scopeId:t}),d=`${u} ${Object(l.c)(u)}`;return r?null:i.a.createElement(C,{title:d,loading:n,alertIds:c,scopeId:t,eventId:a,noItemsMessage:s.z,"data-test-subj":o.e})};N.displayName="RelatedAlertsBySameSourceEvent";var P=a(123),R=a(1087);const L=[{field:"title",name:s.b,truncateText:!0,render:(e,t)=>i.a.createElement(T,{tooltip:t.title},i.a.createElement(P.a,{detailName:t.id,title:t.title},t.title))},{field:"status",name:s.c,truncateText:!0,width:"25%"}],B=({eventId:e})=>{const{loading:t,error:a,data:n,dataCount:c}=Object(R.a)({eventId:e}),u=`${c} ${Object(l.b)(c)}`;return t?i.a.createElement(r.EuiSkeletonText,{lines:1,size:"m",isLoading:t,contentAriaLabel:"Loading"}):a?null:i.a.createElement(S.a,{header:{title:u,iconType:"warning"},content:{error:a},expand:{expandable:!0,expandedOnFirstRender:!0},"data-test-subj":o.g},i.a.createElement(r.EuiInMemoryTable,{loading:t,items:n,columns:L,pagination:!0,message:s.A,"data-test-subj":o.f}))};B.displayName="RelatedCases";var q=a(1088),z=a(1089),$=a(1090),V=a(235),U=a(1091),H=a(1092),G=a(1093);const Q=({documentId:e,indices:t,scopeId:a,eventId:n})=>{const{loading:r,error:c,data:u,dataCount:d}=Object(G.a)({documentId:e,indices:t,scopeId:a}),p=`${d} ${Object(l.a)(d)}`;return c?null:i.a.createElement(C,{title:p,loading:r,alertIds:u,scopeId:a,eventId:n,noItemsMessage:s.x,"data-test-subj":o.c})};Q.displayName="RelatedAlertsByAncestry";var W=a(243),K=a(928);const Y=({dataAsNestedObject:e,alertSuppressionCount:t})=>{const a=i.a.createElement(r.EuiFlexGroup,{alignItems:"center",gutterSize:"s"},i.a.createElement(r.EuiFlexItem,null,`${t} ${Object(l.e)(t)}`),i.a.createElement(r.EuiFlexItem,null,i.a.createElement(r.EuiBetaBadge,{label:W.w,style:{verticalAlign:"middle"},size:"s","data-test-subj":o.F}))),n=t>0&&i.a.createElement("div",{"data-test-subj":`${o.h}InvestigateInTimeline`},i.a.createElement(K.a,{ecsRowData:e,buttonType:"emptyButton"}));return i.a.createElement(S.a,{header:{title:a,iconType:"layers",headerContent:n},"data-test-subj":o.h})};Y.displayName="SuppressedAlerts";const J="correlations-details",X=()=>{const{dataAsNestedObject:e,dataFormattedForFieldBrowser:t,eventId:a,getFieldsData:n,scopeId:l}=Object(V.b)(),{show:c,documentId:u,indices:d}=Object(z.a)({getFieldsData:n,dataAsNestedObject:e,dataFormattedForFieldBrowser:t}),{show:p,originalEventId:m}=Object(U.a)({getFieldsData:n}),{show:b,entityId:g}=Object(H.a)({getFieldsData:n}),f=Object(q.a)(),{show:y,alertSuppressionCount:h}=Object($.a)({getFieldsData:n}),v=c||p||b||f||y;return i.a.createElement(i.a.Fragment,null,v?i.a.createElement(r.EuiFlexGroup,{gutterSize:"l",direction:"column"},y&&i.a.createElement(r.EuiFlexItem,null,i.a.createElement(Y,{alertSuppressionCount:h,dataAsNestedObject:e})),f&&i.a.createElement(r.EuiFlexItem,null,i.a.createElement(B,{eventId:a})),p&&m&&i.a.createElement(r.EuiFlexItem,null,i.a.createElement(N,{originalEventId:m,scopeId:l,eventId:a})),b&&g&&i.a.createElement(r.EuiFlexItem,null,i.a.createElement(A,{entityId:g,scopeId:l,eventId:a})),c&&u&&d&&i.a.createElement(r.EuiFlexItem,null,i.a.createElement(Q,{documentId:u,indices:d,scopeId:l,eventId:a}))):i.a.createElement("div",{"data-test-subj":`${o.i}Error`},s.e))};X.displayName="CorrelationsDetails"},function(e,t,a){"use strict";a.d(t,"a",(function(){return h}));var n=a(40),i=a(2),r=a.n(i),s=a(129),o=a(4),l=a(102),c=a(344),u=a(8);const d=(e,t)=>e.checked?t.checked&&e.checked<=t.checked?1:-1:t.checked?1:0,p=(e,t)=>{const a=Object(u.intersection)(...e),n=Object(u.union)(...e);return Object(u.union)(n,t).map((e=>{let t={checked:void 0,"data-test-subj":"unselected-alert-tag"};return a.includes(e)?t={checked:"on","data-test-subj":"selected-alert-tag"}:n.includes(e)&&(t={checked:"mixed","data-test-subj":"mixed-alert-tag"}),{label:e,...t}})).sort(d)},m={selectableAlertTags:[],tagsToAdd:new Set,tagsToRemove:new Set},b=({alertItems:e,refresh:t,refetchQuery:a,setIsLoading:u,clearSelection:d,closePopoverMenu:b,onSubmit:g})=>{const[f]=Object(l.p)(o.w),y=Object(i.useMemo)((()=>e.map((e=>{var t,a;return null!==(t=null===(a=e.data.find((e=>e.field===s.kb)))||void 0===a?void 0:a.value)&&void 0!==t?t:[]}))),[e]),[{selectableAlertTags:h,tagsToAdd:v,tagsToRemove:E},x]=Object(i.useReducer)(((e,t)=>{switch(t.type){case"addAlertTag":{const{value:a}=t;return e.tagsToAdd.add(a),e.tagsToRemove.delete(a),e}case"removeAlertTag":{const{value:a}=t;return e.tagsToRemove.add(a),e.tagsToAdd.delete(a),e}case"setSelectableAlertTags":{const{value:a}=t;return{...e,selectableAlertTags:a}}default:return e}}),{...m,selectableAlertTags:p(y,f),tagsToAdd:new Set,tagsToRemove:new Set}),j=Object(i.useCallback)((e=>{x({type:"addAlertTag",value:e})}),[x]),S=Object(i.useCallback)((e=>{x({type:"removeAlertTag",value:e})}),[x]),k=Object(i.useCallback)((e=>{x({type:"setSelectableAlertTags",value:e})}),[x]),O=Object(i.useCallback)((async()=>{if(0===v.size&&0===E.size)return void b();const n=Array.from(v),i=Array.from(E),r=e.map((e=>e._id)),s={tags_to_add:n,tags_to_remove:i};null!=g&&(b(),await g(s,r,(()=>{a&&a(),t&&t(),d&&d()}),u))}),[b,v,E,e,a,t,d,u,g]),w=Object(i.useCallback)(((e,t,a)=>{"on"===a.checked?j(a.label):a.checked||S(a.label),k(e)}),[j,S,k]);return r.a.createElement(r.a.Fragment,null,r.a.createElement(n.EuiSelectable,{searchable:!0,searchProps:{placeholder:c.h},"aria-label":c.h,options:h,onChange:w,emptyMessage:c.f,noMatchesMessage:c.g,"data-test-subj":"alert-tags-selectable-menu"},((e,t)=>r.a.createElement("div",null,r.a.createElement(n.EuiPopoverTitle,null,t),e))),r.a.createElement(n.EuiButton,{"data-test-subj":"alert-tags-update-button",fullWidth:!0,size:"s",onClick:O},c.c))},g=Object(i.memo)(b);var f=a(58),y=a(108);const h=({refetch:e})=>{const t=(()=>{const{http:e}=Object(f.useKibana)().services,{addSuccess:t,addError:a}=Object(y.a)(),n=Object(i.useRef)(null),r=Object(i.useCallback)((e=>t(c.w(e))),[t]),s=Object(i.useCallback)((e=>{a(e.message,{title:c.v})}),[a]);return Object(i.useEffect)((()=>{let e=!1;const t=new AbortController;return n.current=async(a,n,i,c)=>{try{c(!0);const s=await(async({tags:e,ids:t,signal:a})=>l.b.get().http.fetch(o.ab,{method:"POST",body:JSON.stringify({tags:e,ids:t}),signal:a}))({tags:a,ids:n,signal:t.signal});e||(i(),c(!1),r(s.items.length))}catch(t){e||(c(!1),s(t))}},()=>{e=!0,t.abort()}}),[e,s,r]),n.current})(),a=Object(i.useCallback)((async(e,a,n,i)=>{t&&await t(e,a,n,i)}),[t]),s=[{key:"manage-alert-tags","data-test-subj":"alert-tags-context-menu-item",name:c.d,panel:1,label:c.d,disableOnQuery:!0}],u=Object(i.useMemo)((()=>r.a.createElement(n.EuiFlexGroup,{alignItems:"center",gutterSize:"s",responsive:!1},r.a.createElement(n.EuiFlexItem,{grow:!1},c.d),r.a.createElement(n.EuiFlexItem,{grow:!1},r.a.createElement(n.EuiIconTip,{content:c.e,position:"right"})))),[]),d=Object(i.useCallback)((({alertItems:t,refresh:n,setIsBulkActionsLoading:i,clearSelection:s,closePopoverMenu:o})=>r.a.createElement(g,{alertItems:t,refresh:n,refetchQuery:e,setIsLoading:i,clearSelection:s,closePopoverMenu:o,onSubmit:a})),[a,e]);return{alertTagsItems:s,alertTagsPanels:Object(i.useMemo)((()=>[{id:1,title:u,"data-test-subj":"alert-tags-context-menu-panel",renderContent:d}]),[u,d])}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return M}));var n=a(2),i=a.n(n),r=a(3),s=a(41),o=a.n(s),l=a(130),c=a.n(l),u=a(40),d=a(13),p=a(72);const m=Object(n.memo)((({indexPattern:e,isLoading:t=!1,isRefreshPaused:a,filterQuery:r,filterManager:s,filters:o,refreshInterval:l,dataTestSubj:c,displayStyle:u})=>{const d=Object(n.useCallback)((e=>{s.setFilters(e)}),[s]),m=Object(n.useMemo)((()=>[e]),[e]);return i.a.createElement(p.SearchBar,{showSubmitButton:!1,filters:o,indexPatterns:m,isLoading:t,isRefreshPaused:a,query:r,onFiltersUpdated:d,refreshInterval:l,showAutoRefreshOnly:!1,showFilterBar:!0,showDatePicker:!1,showQueryInput:!1,showSaveQuery:!1,dataTestSubj:c,displayStyle:u})}));m.displayName="FilterBar";var b=a(108),g=a(371),f=a(8);const y=({ariaLabel:e,errors:t})=>{const[a,r]=Object(n.useState)(!1),s=Object(n.useCallback)((()=>{r(!a)}),[a]),o=Object(n.useCallback)((()=>{r(!1)}),[]);return i.a.createElement(u.EuiPopover,{"data-test-subj":"eql-validation-errors-popover",button:i.a.createElement(u.EuiButtonEmpty,{"data-test-subj":"eql-validation-errors-popover-button",iconType:"error",size:"s",color:"danger","aria-label":e,onClick:s},t.length),isOpen:a,closePopover:o,anchorPosition:"downCenter"},i.a.createElement("div",{"data-test-subj":"eql-validation-errors-popover-content"},i.a.createElement(u.EuiPopoverTitle,null,g.k),t.map(((e,t)=>i.a.createElement(u.EuiText,{key:t},e)))))};var h=a(102);const v=o()(u.EuiText).withConfig({displayName:"InlineText",componentId:"sc-yylwe5-0"})(["display:inline-block;"]),E=()=>{const e=Object(h.j)().services.docLinks.links.query.eql;return i.a.createElement(u.EuiLink,{external:!0,href:e,target:"_blank"},i.a.createElement(v,{size:"xs"},g.i))},x=o()(u.EuiPanel).withConfig({displayName:"Container",componentId:"sc-x7d5ta-0"})(["border-radius:0;background:",";padding:"," ",";"],(({theme:e})=>e.eui.euiPageBackgroundColor),(({theme:e})=>e.eui.euiSizeXS),(({theme:e})=>e.eui.euiSizeS)),j=o()(u.EuiFlexGroup).withConfig({displayName:"FlexGroup",componentId:"sc-x7d5ta-1"})(["min-height:",";"],(({theme:e})=>e.eui.euiSizeXL)),S=o()(u.EuiFlexItem).withConfig({displayName:"FlexItemLeftBorder",componentId:"sc-x7d5ta-2"})(["border-left:1px solid ",";"],(({theme:e})=>e.eui.euiColorLightShade)),k=o()(u.EuiFlexItem).withConfig({displayName:"FlexItemWithMarginRight",componentId:"sc-x7d5ta-3"})(["margin-right:",";"],(({theme:e})=>e.eui.euiSizeS)),O=o()(u.EuiLoadingSpinner).withConfig({displayName:"Spinner",componentId:"sc-x7d5ta-4"})(["margin:0 ",";"],(({theme:e})=>e.eui.euiSizeS)),w={asPlainText:!0},T=({errors:e,isLoading:t,isSizeOptionDisabled:a,optionsData:r,optionsSelected:s,onOptionsChange:o})=>{var l;const[c,d]=Object(n.useState)(!1),[p,m]=Object(n.useState)(null!==(l=null==s?void 0:s.size)&&void 0!==l?l:100),b=Object(n.useRef)(),h=Object(n.useCallback)((()=>{d(!0)}),[]),v=Object(n.useCallback)((()=>{d(!1)}),[]),T=Object(n.useCallback)((e=>{o&&(e.length>0?o("eventCategoryField",e[0].label):o("eventCategoryField",void 0))}),[o]),I=Object(n.useCallback)((e=>{o&&(e.length>0?o("tiebreakerField",e[0].label):o("tiebreakerField",void 0))}),[o]),C=Object(n.useCallback)((e=>{o&&(e.length>0?o("timestampField",e[0].label):o("timestampField",void 0))}),[o]),M=Object(n.useCallback)((e=>{var t,a,n,i;o&&(m(null==e||null===(t=e.target)||void 0===t?void 0:t.value),null!==(a=b.current)&&void 0!==a&&a.cancel&&(null===(i=b.current)||void 0===i||i.cancel()),b.current=Object(f.debounce)((e=>o("size",e)),800),b.current(null==e||null===(n=e.target)||void 0===n?void 0:n.value))}),[o]),_=Object(n.useMemo)((()=>null!=(null==s?void 0:s.eventCategoryField)?[{label:null==s?void 0:s.eventCategoryField}]:void 0),[null==s?void 0:s.eventCategoryField]),F=Object(n.useMemo)((()=>null!=(null==s?void 0:s.tiebreakerField)?[{label:null==s?void 0:s.tiebreakerField}]:void 0),[null==s?void 0:s.tiebreakerField]),A=Object(n.useMemo)((()=>null!=(null==s?void 0:s.timestampField)?[{label:null==s?void 0:s.timestampField}]:void 0),[null==s?void 0:s.timestampField]);return i.a.createElement(x,null,i.a.createElement(j,{alignItems:"center",justifyContent:"spaceBetween",gutterSize:"none"},i.a.createElement(u.EuiFlexItem,null,e.length>0&&i.a.createElement(y,{ariaLabel:g.l,errors:e}),t&&i.a.createElement(O,{"data-test-subj":"eql-validation-loading",size:"m"})),!o&&i.a.createElement(u.EuiFlexItem,{grow:!1},i.a.createElement(E,null)),o&&i.a.createElement(i.a.Fragment,null,i.a.createElement(k,{grow:!1},i.a.createElement(E,null)),i.a.createElement(S,{grow:!1},i.a.createElement(u.EuiPopover,{button:i.a.createElement(u.EuiButtonIcon,{onClick:h,iconType:"controlsVertical",isDisabled:c,"aria-label":"eql settings","data-test-subj":"eql-settings-trigger"}),isOpen:c,closePopover:v,anchorPosition:"downCenter",ownFocus:!1},i.a.createElement(u.EuiPopoverTitle,null,g.j),i.a.createElement("div",{style:{width:"300px"}},!a&&i.a.createElement(u.EuiFormRow,{"data-test-subj":"eql-size-field",label:g.h,helpText:g.g},i.a.createElement(u.EuiFieldNumber,{value:p,onChange:M,min:1,max:1e4})),i.a.createElement(u.EuiFormRow,{"data-test-subj":"eql-event-category-field",label:g.b,helpText:g.a},i.a.createElement(u.EuiComboBox,{options:null==r?void 0:r.keywordFields,selectedOptions:_,singleSelection:w,onChange:T})),i.a.createElement(u.EuiFormRow,{"data-test-subj":"eql-tiebreaker-field",label:g.d,helpText:g.c},i.a.createElement(u.EuiComboBox,{options:null==r?void 0:r.nonDateFields,selectedOptions:F,singleSelection:w,onChange:I})),i.a.createElement(u.EuiFormRow,{"data-test-subj":"eql-timestamp-field",label:g.f,helpText:g.e},i.a.createElement(u.EuiComboBox,{options:null==r?void 0:r.dateFields,selectedOptions:A,singleSelection:w,onChange:C}))))))))};var I=a(750);const C=o()(u.EuiTextArea).withConfig({displayName:"TextArea",componentId:"sc-u3oqty-0"})(["display:block;border:",";border-bottom:0;box-shadow:none;min-height:",";"],(({theme:e})=>e.eui.euiBorderThin),(({theme:e})=>e.eui.euiFormControlHeight)),M=({dataTestSubj:e,field:t,isLoading:a=!1,indexPattern:s,showFilterBar:o,idAria:l,optionsData:p,optionsSelected:f,isSizeOptionDisabled:y,onOptionsChange:v,onValidityChange:E,onValiditingChange:x})=>{const{addError:j}=Object(b.a)(),[S,k]=Object(n.useState)([]),{isValidating:O,value:w,setValue:M}=t,{isValid:_,message:F,messages:A,error:D}=Object(I.c)(t),{uiSettings:N}=Object(h.j)().services,P=Object(n.useRef)(new d.FilterManager(N));Object(n.useEffect)((()=>{null!=E&&E(_)}),[_,E]),Object(n.useEffect)((()=>{k(null!=A?A:[])}),[A]),Object(n.useEffect)((()=>{D&&j(D,{title:g.m})}),[D,j]),Object(n.useEffect)((()=>{x&&x(O)}),[O,x]),Object(n.useEffect)((()=>{let e=!0;const t=new r.Subscription;return P.current.setFilters([]),t.add(P.current.getUpdates$().subscribe({next:()=>{if(e){const e=P.current.getFilters(),{filters:t}=w;c()(t,e)||M({...w,filters:e})}}})),()=>{e=!1,t.unsubscribe()}}),[w,P,M]),Object(n.useEffect)((()=>{const{filters:e}=w;c()(e,P.current.getFilters())||P.current.setFilters(e)}),[w,P]);const R=Object(n.useCallback)((e=>{const t=e.target.value;x&&x(!0),k([]),M({filters:w.filters,query:{query:t,language:"eql"},saved_id:null})}),[w,M,x]);return i.a.createElement(u.EuiFormRow,{label:t.label,labelAppend:t.labelAppend,helpText:t.helpText,error:F,isInvalid:!_&&!O,fullWidth:!0,"data-test-subj":e,describedByIds:l?[l]:void 0},i.a.createElement(i.a.Fragment,null,i.a.createElement(C,{"data-test-subj":"eqlQueryBarTextInput",fullWidth:!0,isInvalid:!_&&!O,value:w.query.query,onChange:R}),i.a.createElement(T,{errors:S,isLoading:O,isSizeOptionDisabled:y,optionsData:p,optionsSelected:f,onOptionsChange:v}),o&&i.a.createElement(i.a.Fragment,null,i.a.createElement(u.EuiSpacer,{size:"s"}),i.a.createElement(m,{"data-test-subj":"eqlFilterBar",indexPattern:s,isLoading:a,isRefreshPaused:!1,filterQuery:w.query,filterManager:P.current,filters:P.current.getFilters()||[],displayStyle:"inPage"}))))}},function(e,t,a){"use strict";a.d(t,"a",(function(){return u}));var n=a(79),i=a(1379),r=a.n(i),s=a(42),o=a(5);const l=e=>{if(!e)return"";const t=e.split(".")[1];return t?Object(s.startCase)(t):""},c=async(e,t)=>{const a=await(async(e,t)=>{var a;const n=await(null===(a=t.get(e.actionTypeId))||void 0===a?void 0:a.validateParams(e.params));if(n){const e=Object.values(n.errors);if(e.length){const t=e.filter((e=>Object(s.isString)(e)||Object(s.isArray)(e))),a=Object(s.uniq)(Object(s.flattenDeep)(t));if(a.length)return a}}return[]})(e,t),i=(e=>{const t=[];return Object.entries(e).forEach((([e,a])=>{if(Object(s.isString)(a))try{r.a.render(a,{})}catch(a){t.push((e=>o.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepRuleActions.invalidMustacheTemplateErrorMessage",{defaultMessage:"{key} is not valid mustache template",values:{key:Object(s.startCase)(e)}}))(e))}})),t})(e.params),l=Object(n.validateActionFilterQuery)(e);return[...a,...i,...l?[l]:[]]},u=(e,t=100)=>a=>{let n=!1;const i=new Promise((i=>{setTimeout((()=>{n?i():i((e=>async(...t)=>{const[{value:a,path:n}]=t,i=[];for(const t of a){const a=await c(t,e);if(a.length){const e=l(t.actionTypeId),n=a.map((e=>`*   ${e}\n`));i.push(`\n**${e}:**\n${n.join("")}`)}}if(i.length)return{code:"ERR_FIELD_FORMAT",path:n,message:`${i.join("\n")}`}})(e)(a))}),t)}));return i.cancel=()=>{n=!0},i}},function(e,t,a){"use strict";a.d(t,"a",(function(){return r}));var n=a(5),i=a(41);a.n(i).a.span.withConfig({displayName:"UnitCount",componentId:"sc-1p6k0dy-0"})(["font-size:",";font-weight:",";border-right:",";margin-right:",";padding-right:",";"],(({theme:e})=>e.eui.euiFontSizeXS),(({theme:e})=>e.eui.euiFontWeightSemiBold),(({theme:e})=>e.eui.euiBorderThin),(({theme:e})=>e.eui.euiSizeS),(({theme:e})=>e.eui.euiSizeM));const r=e=>{return t=e,n.i18n.translate("xpack.securitySolution.eventsTab.unit",{values:{totalCount:t},defaultMessage:"{totalCount, plural, =1 {alert} other {alerts}}"});var t}},function(e,t,a){"use strict";a.d(t,"a",(function(){return x}));var n=a(2),i=a(1083),r=a(1084),s=a(49),o=a(46),l=a(102),c=a(498),u=a(115),d=a(110);const p="fieldNames",m="eventKind",b="hostName",g="userName",f="hosts",y="users",h=(e,t,a,n)=>{const i=Object(s.buildEsQuery)(void 0,[],[{query:{bool:{filter:[{range:{"@timestamp":{gte:t,lte:a}}}]}},meta:{}}]);return v(i,e,n)},v=(e,t,a)=>({params:{index:a,body:{query:e,aggs:{[p]:{filters:{filters:t},aggs:{[b]:{cardinality:{field:"host.name"}},[g]:{cardinality:{field:"user.name"}},[m]:{terms:{field:"event.kind",size:10}}}},[f]:{cardinality:{field:"host.name"}},[y]:{cardinality:{field:"user.name"}}},size:0}}});var E=a(1069);const x=({interval:e,dataFormattedForFieldBrowser:t,investigationFields:a})=>{const s=Object(i.a)({dataFormattedForFieldBrowser:t,investigationFields:a}),v=Object(n.useMemo)((()=>Object(r.a)(s)),[s]),{data:x,loading:j,error:S}=(({highlightedFieldsFilters:e,interval:{from:t,to:a}})=>{const{services:{data:{search:n}}}=Object(l.j)(),{selectedPatterns:i}=Object(c.a)(Object(u.isActiveTimeline)(d.SourcererScopeName.default)),r=h(e,t,a,i),{data:s,isLoading:p,isError:m}=Object(o.useQuery)(["useFetchFieldValuePairWithAggregation",e,t,a],(()=>(async(e,t)=>{let a;return new Promise(((n,i)=>{e.search(t).subscribe({next:e=>{a=e.rawResponse},complete:()=>{n(a)},error:e=>{i(e)}})}))})(n,r)));return{loading:p,error:m,data:s}})({highlightedFieldsFilters:v,interval:e}),k=[];if(x&&x.aggregations){const e=x.aggregations[f].value,t=x.aggregations[y].value;Object.keys(x.aggregations[p].buckets).forEach((a=>{var n;const i=s[a].values,r=(null===(n=x.aggregations[p].buckets[a][m].buckets.find((e=>e.key===E.a.signal)))||void 0===n?void 0:n.doc_count)||0;let o=0;x.aggregations[p].buckets[a][m].buckets.reduce(((e,t)=>(t.key!==E.a.signal&&(o+=t.doc_count),e)),o);const l=x.aggregations[p].buckets[a][b].value,c=x.aggregations[p].buckets[a][g].value,u=e?l/e:0,d=t?c/t:0;k.push({field:a,values:i,alertCount:r,docCount:o,hostPrevalence:u,userPrevalence:d})}))}return{loading:j,error:S,data:k}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return l})),a.d(t,"b",(function(){return d}));var n=a(174);const i="included",r=e=>{switch(e.length){case 32:return"md5";case 40:return"sha1";case 64:return"sha256"}},s=(e,t)=>({field:e,value:t,type:"match",operator:i}),o=(e,t)=>({field:e,value:t,type:"match_any",operator:i}),l=(e,t=!1)=>{const a=[];return e.forEach((e=>{if(e.field.includes(n.b.HASH))(function(e,t){const a=[];if(!Array.isArray(t.value)){const i=s(`${e}${n.b.HASH}${r(t.value)}`,t.value.toLowerCase());return a.push(i),a}const i=t.value.reduce(((e,t)=>{const a=r(t);return a?{...e,[a]:[...e[a],t]}:e}),{md5:[],sha1:[],sha256:[]});return Object.entries(i).forEach((([t,i])=>{if(!i.length)return;const r=o(`${e}${n.b.HASH}${t}`,i.map((e=>e.toLowerCase())));a.push(r)})),a})(e.field.split(".")[0],e).forEach((e=>a.push(e)));else if(e.field.includes(n.b.SIGNER)){const n=function(e,t,a=!1){const n=Array.isArray(t)?o("subject_name",t):s("subject_name",t),i=[];return a&&i.push(s("trusted","true")),i.push(n),((e,t)=>({field:e,entries:t,type:"nested"}))(e,i)}(e.field,e.value,t);a.push(n)}else if((e.field.includes(n.b.EXECUTABLE)||e.field.includes(n.b.PATH))&&"wildcard"===e.type){const t=(l=e.field,c=e.value,Array.isArray(c)?o(l,c):((e,t)=>({field:e,value:t,type:"wildcard",operator:i}))(l,c));a.push(t)}else{const t=function(e,t){return Array.isArray(t)?o(e,t):s(e,t)}(e.field,e.value);a.push(t)}var l,c})),a},c=(e,t,a)=>({field:e,value:a,type:t,operator:i});function u(e){return`${e.split(".")[0]}${n.b.HASH}*`}const d=e=>{const t=(e=>e.reduce(((e,t)=>{const a=t.field;if(a.includes(n.b.HASH)&&"match"===t.type){const n=u(a);return{...e,[n]:c(n,t.type,t.value)}}if(a.includes(n.b.HASH)&&"match_any"===t.type){var i,r;const n=u(a),s=null!==(i=null===(r=e[n])||void 0===r?void 0:r.value)&&void 0!==i?i:[];return{...e,[n]:c(n,t.type,[...s,...t.value])}}if((a.includes(n.b.EXECUTABLE)||a.includes(n.b.PATH))&&("match"===t.type||"match_any"===t.type||"wildcard"===t.type))return{...e,[a]:c(a,t.type,t.value)};if(a.includes(n.b.SIGNER)&&"nested"===t.type){const n=t.entries.find((e=>"subject_name"===e.field&&("match"===e.type||"match_any"===e.type)));if(n)return{...e,[a]:c(a,n.type,n.value)}}return e}),{}))(e);return Object.values(t).reduce(((e,t)=>t?[...e,t]:e),[])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return E})),a.d(t,"b",(function(){return x}));var n=a(2),i=a.n(n),r=a(40),s=a(1410),o=a.n(s),l=a(927),c=a(943),u=a(186),d=a(336),p=a(4),m=a(110),b=a(509),g=a(348),f=a(116),y=a(175),h=a(235),v=a(191);const E="threat-intelligence-details",x=()=>{const{enrichments:e,eventFields:t,isEnrichmentsLoading:a,isEventDataLoading:s,isLoading:E,range:x,setRange:j}=(()=>{const{indexName:e,eventId:t}=Object(h.b)(),[{pageName:a}]=Object(y.a)(),i=a===p.wc.detections?m.SourcererScopeName.detections:m.SourcererScopeName.default,r=Object(f.d)(i),[s,o]=Object(g.a)({indexName:e,eventId:t,runtimeMappings:r.runtimeMappings,skip:!t}),{isAlert:l}=Object(u.b)(o),c=Object(n.useMemo)((()=>o||[]),[o]),v=Object(n.useMemo)((()=>Object(d.b)(c||[])),[c]),{result:E,loading:x,setRange:j,range:S}=Object(b.c)(v),k=Object(n.useMemo)((()=>l?Object(d.f)(c).map((e=>Object(d.g)(e))):[]),[c,l]);return{enrichments:Object(n.useMemo)((()=>x||null==E||!E.enrichments?k:Object(d.a)([...k,...E.enrichments])),[x,E,k]),eventFields:v,isEnrichmentsLoading:x,isEventDataLoading:s,isLoading:x||s,range:S,setRange:j}})();return s?i.a.createElement(r.EuiFlexGroup,{justifyContent:"spaceAround","data-test-subj":v.G},i.a.createElement(r.EuiFlexItem,{grow:!1},i.a.createElement(r.EuiLoadingSpinner,{size:"m"}))):i.a.createElement(i.a.Fragment,null,i.a.createElement(c.a,{before:null,loading:E,enrichments:e,showInvestigationTimeEnrichments:!o()(t)},i.a.createElement(i.a.Fragment,null,i.a.createElement(l.a,{setRange:j,loading:a,range:x}),i.a.createElement(r.EuiSpacer,{size:"m"}))))};x.displayName="ThreatIntelligenceDetails"},function(e,t,a){"use strict";a.d(t,"a",(function(){return c})),a.d(t,"b",(function(){return u}));var n=a(2),i=a(216),r=a(113),s=a(5);const o=s.i18n.translate("xpack.securitySolution.networkDetails.errorSearchDescription",{defaultMessage:"An error has occurred on network details search"});s.i18n.translate("xpack.securitySolution.networkDetails.failSearchDescription",{defaultMessage:"Failed to run search on network details"});var l=a(194);const c="networkDetailsQuery",u=({filterQuery:e,id:t=c,indexNames:a,ip:s,skip:u})=>{const{loading:d,result:p,search:m,refetch:b,inspect:g}=Object(l.a)({factoryQueryType:r.r.details,initialResult:{networkDetails:{}},errorMessage:o,abort:u}),f=Object(n.useMemo)((()=>({networkDetails:p.networkDetails,id:t,inspect:g,isInspected:!1,refetch:b})),[t,g,b,p.networkDetails]),y=Object(n.useMemo)((()=>({defaultIndex:a,factoryQueryType:r.r.details,filterQuery:Object(i.a)(e),ip:s})),[e,a,s]);return Object(n.useEffect)((()=>{!u&&y&&m(y)}),[y,m,u]),[d,f]}},function(e,t,a){"use strict";a.d(t,"a",(function(){return f}));var n=a(40),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(676),c=a(268),u=a(106);const d=o()(n.EuiInputPopover).withConfig({displayName:"StyledEuiInputPopover",componentId:"sc-1feu4fu-0"})([".rightArrowIcon{.euiFieldText{padding-left:12px;padding-right:40px;&[readonly]{cursor:pointer;background-size:0 100%;background-repeat:no-repeat;&:focus{background-color:",";background-image:linear-gradient( to top,",","," 2px,transparent 2px,transparent 100% );background-size:100% 100%;}}}.euiFormControlLayoutIcons{left:unset;right:12px;}}"],(({theme:e})=>e.eui.euiFormBackgroundColor),(({theme:e})=>e.eui.euiFocusRingColor),(({theme:e})=>e.eui.euiFocusRingColor)),p=e=>[{description:c.a,favorite:[],label:c.b,id:void 0,title:c.b,checked:"-1"===e?"on":void 0}],m=({isDisabled:e,hideUntitled:t=!1,timelineId:a,timelineTitle:s,timelineType:o=u.l.template,onTimelineChange:m,placeholder:b})=>{const[g,f]=Object(i.useState)(!1),y=Object(i.useCallback)((()=>{f(!1)}),[]),h=Object(i.useCallback)((()=>{f(!0)}),[]),v=Object(i.useMemo)((()=>r.a.createElement(n.EuiFieldText,{readOnly:!0,disabled:e,onFocus:h,onClick:h,value:null!=s?s:c.b,icon:"arrowDown"})),[h,e,s]),E=Object(i.useCallback)((({timelines:e,onlyFavorites:n,searchTimelineValue:i})=>[...n||""!==i?[]:p(null==a?"-1":a),...e.filter((e=>!t||""!==e.title)).map(((e,t)=>({description:e.description,favorite:e.favorite,label:e.title,id:o===u.l.template?e.templateTimelineId:e.savedObjectId,key:`${e.title}-${t}`,title:e.title,checked:[e.savedObjectId,e.templateTimelineId].includes(a)?"on":void 0})))]),[t,a,o]);return r.a.createElement(d,{id:"searchTimelinePopover",input:v,isOpen:g,closePopover:y,anchorClassName:"rightArrowIcon"},r.a.createElement(l.a,{hideUntitled:t,getSelectableOptions:E,onClosePopover:y,onTimelineChange:m,timelineType:o,placeholder:b}))},b=Object(i.memo)(m);var g=a(125);const f=({dataTestSubj:e,field:t,idAria:a,isDisabled:s=!1,placeholder:o})=>{const[l,c]=Object(i.useState)(null),[u,d]=Object(i.useState)(null),{isInvalid:p,errorMessage:m}=Object(g.i)(t);Object(i.useEffect)((()=>{const{id:e,title:a}=t.value;l!==e&&(c(e),d(a))}),[t.value,l]);const f=Object(i.useCallback)(((e,a)=>{null===a?t.setValue({id:a,title:null}):l!==a&&t.setValue({id:a,title:e})}),[t,l]);return r.a.createElement(n.EuiFormRow,{label:t.label,labelAppend:t.labelAppend,helpText:t.helpText,error:m,isInvalid:p,"data-test-subj":e,describedByIds:a?[a]:void 0},r.a.createElement(b,{isDisabled:s,hideUntitled:!0,timelineId:l,timelineTitle:u,onTimelineChange:f,placeholder:o}))}},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(2),i=a(693),r=a(185),s=a(5);const o=s.i18n.translate("xpack.securitySolution.endpoint.detections.takeAction.responseActionConsole.notSupportedTooltip",{defaultMessage:"Add the Elastic Defend integration via Elastic Agent to enable this feature"}),l=s.i18n.translate("xpack.securitySolution.endpoint.detections.takeAction.responseActionConsole.unenrolledTooltip",{defaultMessage:"Host is no longer enrolled with the Elastic Defend integration"}),c=s.i18n.translate("xpack.securitySolution.endpoint.detections.takeAction.responseActionConsole.loadingTooltip",{defaultMessage:"Loading"}),u=s.i18n.translate("xpack.securitySolution.endpoint.detections.takeAction.responseActionConsole.generalMetadataErrorTooltip",{defaultMessage:"Failed to retrieve Endpoint metadata"}),d=({endpointId:e,onClick:t})=>{const a=Object(i.d)(),{data:s,isFetching:d,error:p}=Object(i.c)(e,{enabled:Boolean(e)}),[m,b]=Object(n.useMemo)((()=>{var e,t,a;return d?[!0,c]:p&&404===(null===(e=p.body)||void 0===e?void 0:e.statusCode)?[!0,o]:p&&400===(null===(t=p.body)||void 0===t?void 0:t.statusCode)&&null!==(a=p.body)&&void 0!==a&&a.message.includes("unenrolled")||(null==s?void 0:s.host_status)===r.c.UNENROLLED?[!0,l]:p?[!0,u]:[!1,void 0]}),[s,p,d]);return{handleResponseActionsClick:Object(n.useCallback)((()=>{s&&a(s.metadata),t&&t()}),[s,t,a]),isDisabled:m,tooltip:b}}},function(e,t,a){"use strict";a.d(t,"a",(function(){return i}));var n=a(8);const i=e=>{const{id:t,revision:a,created_by:i,created_at:r,updated_by:s,updated_at:o,...l}=e,c=Object(n.cloneDeep)(l),u=c.inputs[0].config.policy.value;return[u.windows.popup.malware,u.mac.popup.malware].forEach((e=>e.message.trim())),c}},function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(2),i=a(8),r=a(1284),s=a.n(r);const o=(e,t)=>null==t?`${Object(i.capitalize)(e)}`:`${Object(i.capitalize)(e)} ${Object(i.capitalize)(t)}`,l=e=>{var t;return null!==(t=s.a.valid(s.a.coerce(e)))&&void 0!==t?t:""},c=(e,t,a)=>`app/integrations/detail/${a?`${e}-${a}`:e}/overview${t?`?integration=${t}`:""}`;var u=a(872);const d=e=>{const{data:t}=Object(u.a)({packages:[]});return Object(n.useMemo)((()=>{const a=((e,t)=>((e,t)=>e.map((e=>{if(null==t)return{related:e,installed:null,isLoaded:!1};{const a=t.find((t=>t.package_name===e.package&&(null==t?void 0:t.integration_name)===(null==e?void 0:e.integration)));return{related:e,installed:null!=a?a:null,isLoaded:!0}}})))(e,t).map((e=>(e=>{var t;const{related:a,installed:n,isLoaded:i}=e,r=a.package,u=null!==(t=a.integration)&&void 0!==t?t:null,d=a.version;if(!i){const e=o(r,u),t=l(d);return{packageName:r,integrationName:u,integrationTitle:e,requiredVersion:d,targetVersion:t,targetUrl:c(r,u,t),installationStatus:{isKnown:!1}}}if(null==n){const e=o(r,u),t=l(d);return{packageName:r,integrationName:u,integrationTitle:e,requiredVersion:d,targetVersion:t,targetUrl:c(r,u,t),installationStatus:{isKnown:!0,isInstalled:!1,isEnabled:!1,isVersionMismatch:!1,installedVersion:""}}}{var p;const e=null!==(p=n.integration_title)&&void 0!==p?p:n.package_title,t=n.package_version,a=s.a.satisfies(t,d),i=a?t:l(d);return{packageName:r,integrationName:u,integrationTitle:e,requiredVersion:d,targetVersion:i,targetUrl:c(r,u,i),installationStatus:{isKnown:!0,isInstalled:!0,isEnabled:n.is_enabled,isVersionMismatch:!a,installedVersion:t}}}})(e))).sort(((e,t)=>e.integrationTitle.localeCompare(t.integrationTitle))))(e,t);return{integrations:a,isLoaded:null!=t}}),[e,t])}},function(e,t,a){"use strict";a.d(t,"a",(function(){return y}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(40),l=a(41),c=a.n(l),u=a(44),d=a(47),p=a(107),m=a(173);const b=c.a.div.withConfig({displayName:"RootContainer",componentId:"sc-ptw6hp-0"})(["position:relative;padding-top:",";.body{min-height:",";&-content{position:relative;}}"],(({theme:e})=>e.eui.euiSizeXS),(({theme:e})=>e.eui.euiSizeXXL)),g=Object(r.memo)((({"data-test-subj":e})=>s.a.createElement(o.EuiEmptyPrompt,{"data-test-subj":e,title:s.a.createElement(u.FormattedMessage,{id:"xpack.securitySolution.endpoint.paginatedContent.noItemsFoundTitle",defaultMessage:"No items found"})})));g.displayName="DefaultNoItemsFound";const f=Object(r.memo)((({message:e,"data-test-subj":t})=>s.a.createElement(o.EuiText,{textAlign:"center","data-test-subj":t},s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(o.EuiIcon,{type:"minusInCircle",color:"danger"})," ",e,s.a.createElement(o.EuiSpacer,{size:"m"}))));f.displayName="ErrorMessage";const y=Object(r.memo)((({items:e,ItemComponent:t,itemComponentProps:a,itemId:n,onChange:l,pagination:c,loading:u,noItemsMessage:y,error:h,contentClassName:v,"data-test-subj":E,"aria-label":x,className:j,children:S})=>{const[k]=Object(r.useState)(new WeakMap),O=Object(p.a)(E),w=Object(r.useMemo)((()=>Math.ceil(((null==c?void 0:c.totalItemCount)||1)/((null==c?void 0:c.pageSize)||1))),[null==c?void 0:c.pageSize,null==c?void 0:c.totalItemCount]);Object(r.useEffect)((()=>{!u&&w>0&&w<((null==c?void 0:c.pageIndex)||0)+1&&l({pageIndex:w-1,pageSize:(null==c?void 0:c.pageSize)||0})}),[w,l,c,u]);const T=Object(r.useCallback)((e=>{if(null!=c&&c.pageIndex){var t,a;const n=Math.floor((null!==(t=null==c?void 0:c.pageIndex)&&void 0!==t?t:m.b)*(null!==(a=null==c?void 0:c.pageSize)&&void 0!==a?a:m.c)/e);l({pageSize:e,pageIndex:isNaN(n)?m.b:n})}else l({pageSize:e,pageIndex:m.b})}),[l,c]),I=Object(r.useCallback)((e=>{l({pageIndex:e,pageSize:(null==c?void 0:c.pageSize)||m.c})}),[l,null==c?void 0:c.pageSize]),C=Object(r.useMemo)((()=>{if(h)return h instanceof Error?s.a.createElement(f,{message:h.message,"data-test-subj":O("error")}):"string"==typeof h?s.a.createElement(f,{message:h,"data-test-subj":O("error")}):h;const r=t;return e.length?e.map((e=>{let t;return n?t=e[n]:k.has(e)?t=k.get(e):(t=Object(d.v4)(),k.set(e,t)),s.a.createElement(r,i()({},a(e),{key:t}))})):u?void 0:y||s.a.createElement(g,{"data-test-subj":O("noResults")})}),[t,h,O,a,n,k,e,y,u]);return s.a.createElement(b,{"data-test-subj":E,"aria-label":x,className:j},u&&s.a.createElement(o.EuiProgress,{size:"xs",color:"primary",position:"absolute","data-test-subj":O("loader")}),s.a.createElement("div",{className:"body","data-test-subj":O("body")},s.a.createElement("div",{className:`body-content ${v}`},S||C)),c&&(S||e.length>0)&&s.a.createElement("div",{"data-test-subj":O("footer")},s.a.createElement(o.EuiSpacer,{size:"l"}),s.a.createElement(o.EuiTablePagination,{activePage:c.pageIndex,itemsPerPage:c.pageSize,itemsPerPageOptions:c.pageSizeOptions,pageCount:w,showPerPageOptions:c.showPerPageOptions,onChangeItemsPerPage:T,onChangePage:I})))}));y.displayName="PaginatedContent"},,function(e,t,a){"use strict";const n=a(1138),i={codes:new Map([[100,"Continue"],[101,"Switching Protocols"],[102,"Processing"],[200,"OK"],[201,"Created"],[202,"Accepted"],[203,"Non-Authoritative Information"],[204,"No Content"],[205,"Reset Content"],[206,"Partial Content"],[207,"Multi-Status"],[300,"Multiple Choices"],[301,"Moved Permanently"],[302,"Moved Temporarily"],[303,"See Other"],[304,"Not Modified"],[305,"Use Proxy"],[307,"Temporary Redirect"],[400,"Bad Request"],[401,"Unauthorized"],[402,"Payment Required"],[403,"Forbidden"],[404,"Not Found"],[405,"Method Not Allowed"],[406,"Not Acceptable"],[407,"Proxy Authentication Required"],[408,"Request Time-out"],[409,"Conflict"],[410,"Gone"],[411,"Length Required"],[412,"Precondition Failed"],[413,"Request Entity Too Large"],[414,"Request-URI Too Large"],[415,"Unsupported Media Type"],[416,"Requested Range Not Satisfiable"],[417,"Expectation Failed"],[418,"I'm a teapot"],[422,"Unprocessable Entity"],[423,"Locked"],[424,"Failed Dependency"],[425,"Too Early"],[426,"Upgrade Required"],[428,"Precondition Required"],[429,"Too Many Requests"],[431,"Request Header Fields Too Large"],[451,"Unavailable For Legal Reasons"],[500,"Internal Server Error"],[501,"Not Implemented"],[502,"Bad Gateway"],[503,"Service Unavailable"],[504,"Gateway Time-out"],[505,"HTTP Version Not Supported"],[506,"Variant Also Negotiates"],[507,"Insufficient Storage"],[509,"Bandwidth Limit Exceeded"],[510,"Not Extended"],[511,"Network Authentication Required"]])};t.Boom=class extends Error{constructor(e,a={}){if(e instanceof Error)return t.boomify(n.clone(e),a);const{statusCode:r=500,data:s=null,ctor:o=t.Boom}=a,l=new Error(e||void 0);Error.captureStackTrace(l,o),l.data=s;const c=i.initialize(l,r);return Object.defineProperty(c,"typeof",{value:o}),a.decorate&&Object.assign(c,a.decorate),c}static[Symbol.hasInstance](e){return this===t.Boom?t.isBoom(e):this.prototype.isPrototypeOf(e)}},t.isBoom=function(e,t){return e instanceof Error&&!!e.isBoom&&(!t||e.output.statusCode===t)},t.boomify=function(e,t){return n.assert(e instanceof Error,"Cannot wrap non-Error object"),void 0!==(t=t||{}).data&&(e.data=t.data),t.decorate&&Object.assign(e,t.decorate),e.isBoom?!1===t.override||!t.statusCode&&!t.message?e:i.initialize(e,t.statusCode||e.output.statusCode,t.message):i.initialize(e,t.statusCode||500,t.message)},t.badRequest=function(e,a){return new t.Boom(e,{statusCode:400,data:a,ctor:t.badRequest})},t.unauthorized=function(e,a,i){const r=new t.Boom(e,{statusCode:401,ctor:t.unauthorized});if(!a)return r;if("string"!=typeof a)return r.output.headers["WWW-Authenticate"]=a.join(", "),r;let s=`${a}`;return(i||e)&&(r.output.payload.attributes={}),i&&("string"==typeof i?(s+=" "+n.escapeHeaderAttribute(i),r.output.payload.attributes=i):s+=" "+Object.keys(i).map((e=>{let t=i[e];return null==t&&(t=""),r.output.payload.attributes[e]=t,`${e}="${n.escapeHeaderAttribute(t.toString())}"`})).join(", ")),e?(i&&(s+=","),s+=` error="${n.escapeHeaderAttribute(e)}"`,r.output.payload.attributes.error=e):r.isMissing=!0,r.output.headers["WWW-Authenticate"]=s,r},t.paymentRequired=function(e,a){return new t.Boom(e,{statusCode:402,data:a,ctor:t.paymentRequired})},t.forbidden=function(e,a){return new t.Boom(e,{statusCode:403,data:a,ctor:t.forbidden})},t.notFound=function(e,a){return new t.Boom(e,{statusCode:404,data:a,ctor:t.notFound})},t.methodNotAllowed=function(e,a,n){const i=new t.Boom(e,{statusCode:405,data:a,ctor:t.methodNotAllowed});return"string"==typeof n&&(n=[n]),Array.isArray(n)&&(i.output.headers.Allow=n.join(", ")),i},t.notAcceptable=function(e,a){return new t.Boom(e,{statusCode:406,data:a,ctor:t.notAcceptable})},t.proxyAuthRequired=function(e,a){return new t.Boom(e,{statusCode:407,data:a,ctor:t.proxyAuthRequired})},t.clientTimeout=function(e,a){return new t.Boom(e,{statusCode:408,data:a,ctor:t.clientTimeout})},t.conflict=function(e,a){return new t.Boom(e,{statusCode:409,data:a,ctor:t.conflict})},t.resourceGone=function(e,a){return new t.Boom(e,{statusCode:410,data:a,ctor:t.resourceGone})},t.lengthRequired=function(e,a){return new t.Boom(e,{statusCode:411,data:a,ctor:t.lengthRequired})},t.preconditionFailed=function(e,a){return new t.Boom(e,{statusCode:412,data:a,ctor:t.preconditionFailed})},t.entityTooLarge=function(e,a){return new t.Boom(e,{statusCode:413,data:a,ctor:t.entityTooLarge})},t.uriTooLong=function(e,a){return new t.Boom(e,{statusCode:414,data:a,ctor:t.uriTooLong})},t.unsupportedMediaType=function(e,a){return new t.Boom(e,{statusCode:415,data:a,ctor:t.unsupportedMediaType})},t.rangeNotSatisfiable=function(e,a){return new t.Boom(e,{statusCode:416,data:a,ctor:t.rangeNotSatisfiable})},t.expectationFailed=function(e,a){return new t.Boom(e,{statusCode:417,data:a,ctor:t.expectationFailed})},t.teapot=function(e,a){return new t.Boom(e,{statusCode:418,data:a,ctor:t.teapot})},t.badData=function(e,a){return new t.Boom(e,{statusCode:422,data:a,ctor:t.badData})},t.locked=function(e,a){return new t.Boom(e,{statusCode:423,data:a,ctor:t.locked})},t.failedDependency=function(e,a){return new t.Boom(e,{statusCode:424,data:a,ctor:t.failedDependency})},t.tooEarly=function(e,a){return new t.Boom(e,{statusCode:425,data:a,ctor:t.tooEarly})},t.preconditionRequired=function(e,a){return new t.Boom(e,{statusCode:428,data:a,ctor:t.preconditionRequired})},t.tooManyRequests=function(e,a){return new t.Boom(e,{statusCode:429,data:a,ctor:t.tooManyRequests})},t.illegal=function(e,a){return new t.Boom(e,{statusCode:451,data:a,ctor:t.illegal})},t.internal=function(e,a,n=500){return i.serverError(e,a,n,t.internal)},t.notImplemented=function(e,a){return i.serverError(e,a,501,t.notImplemented)},t.badGateway=function(e,a){return i.serverError(e,a,502,t.badGateway)},t.serverUnavailable=function(e,a){return i.serverError(e,a,503,t.serverUnavailable)},t.gatewayTimeout=function(e,a){return i.serverError(e,a,504,t.gatewayTimeout)},t.badImplementation=function(e,a){const n=i.serverError(e,a,500,t.badImplementation);return n.isDeveloperError=!0,n},i.initialize=function(e,t,a){const r=parseInt(t,10);if(n.assert(!isNaN(r)&&r>=400,"First argument must be a number (400+):",t),e.isBoom=!0,e.isServer=r>=500,e.hasOwnProperty("data")||(e.data=null),e.output={statusCode:r,payload:{},headers:{}},Object.defineProperty(e,"reformat",{value:i.reformat,configurable:!0}),a||e.message||(e.reformat(),a=e.output.payload.error),a){const t=Object.getOwnPropertyDescriptor(e,"message")||Object.getOwnPropertyDescriptor(Object.getPrototypeOf(e),"message");n.assert(!t||t.configurable&&!t.get,"The error is not compatible with boom"),e.message=a+(e.message?": "+e.message:""),e.output.payload.message=e.message}return e.reformat(),e},i.reformat=function(e=!1){this.output.payload.statusCode=this.output.statusCode,this.output.payload.error=i.codes.get(this.output.statusCode)||"Unknown",500===this.output.statusCode&&!0!==e?this.output.payload.message="An internal server error occurred":this.message&&(this.output.payload.message=this.message)},i.serverError=function(e,a,n,i){return a instanceof Error&&!a.isBoom?t.boomify(a,{statusCode:n,message:e}):new t.Boom(e,{statusCode:n,data:a,ctor:i})}},function(e,t,a){"use strict";t.applyToDefaults=a(1139),t.assert=a(301),t.Bench=a(1140),t.block=a(1141),t.clone=a(539),t.contain=a(1142),t.deepEqual=a(767),t.Error=a(762),t.escapeHeaderAttribute=a(1143),t.escapeHtml=a(1144),t.escapeJson=a(1145),t.escapeRegex=a(768),t.flatten=a(1146),t.ignore=a(766),t.intersect=a(1147),t.isPromise=a(1148),t.merge=a(765),t.once=a(1149),t.reach=a(426),t.reachTemplate=a(1150),t.stringify=a(763),t.wait=a(1151)},function(e,t,a){"use strict";const n=a(301),i=a(539),r=a(765),s=a(426),o={};e.exports=function(e,t,a={}){if(n(e&&"object"==typeof e,"Invalid defaults value: must be an object"),n(!t||!0===t||"object"==typeof t,"Invalid source value: must be true, falsy or an object"),n("object"==typeof a,"Invalid options: must be an object"),!t)return null;if(a.shallow)return o.applyToDefaultsWithShallow(e,t,a);const s=i(e);if(!0===t)return s;const l=void 0!==a.nullOverride&&a.nullOverride;return r(s,t,{nullOverride:l,mergeArrays:!1})},o.applyToDefaultsWithShallow=function(e,t,a){const l=a.shallow;n(Array.isArray(l),"Invalid keys");const c=new Map,u=!0===t?null:new Set;for(let a of l){a=Array.isArray(a)?a:a.split(".");const n=s(e,a);n&&"object"==typeof n?c.set(n,u&&s(t,a)||n):u&&u.add(a)}const d=i(e,{},c);if(!u)return d;for(const e of u)o.reachCopy(d,t,e);const p=void 0!==a.nullOverride&&a.nullOverride;return r(d,t,{nullOverride:p,mergeArrays:!1})},o.reachCopy=function(e,t,a){for(const e of a){if(!(e in t))return;const a=t[e];if("object"!=typeof a||null===a)return;t=a}const n=t;let i=e;for(let e=0;e<a.length-1;++e){const t=a[e];"object"!=typeof i[t]&&(i[t]={}),i=i[t]}i[a[a.length-1]]=n}},function(e,t,a){"use strict";(function(t){const a={};e.exports=a.Bench=class{constructor(){this.ts=0,this.reset()}reset(){this.ts=a.Bench.now()}elapsed(){return a.Bench.now()-this.ts}static now(){const e=t.hrtime();return 1e3*e[0]+e[1]/1e6}}}).call(this,a(404))},function(e,t,a){"use strict";const n=a(766);e.exports=function(){return new Promise(n)}},function(e,t,a){"use strict";const n=a(301),i=a(767),r=a(768),s=a(540),o={};e.exports=function(e,t,a={}){return"object"!=typeof t&&(t=[t]),n(!Array.isArray(t)||t.length,"Values array cannot be empty"),"string"==typeof e?o.string(e,t,a):Array.isArray(e)?o.array(e,t,a):(n("object"==typeof e,"Reference must be string or an object"),o.object(e,t,a))},o.array=function(e,t,a){if(Array.isArray(t)||(t=[t]),!e.length)return!1;if(a.only&&a.once&&e.length!==t.length)return!1;let n;const i=new Map;for(const e of t)if(a.deep&&e&&"object"==typeof e){n=n||o.compare(a);let t=!1;for(const[a,r]of i.entries())if(n(a,e)){++r.allowed,t=!0;break}t||i.set(e,{allowed:1,hits:0})}else{const t=i.get(e);t?++t.allowed:i.set(e,{allowed:1,hits:0})}let r=0;for(const t of e){let e;if(a.deep&&t&&"object"==typeof t){n=n||o.compare(a);for(const[a,r]of i.entries())if(n(a,t)){e=r;break}}else e=i.get(t);if(e&&(++e.hits,++r,a.once&&e.hits>e.allowed))return!1}if(a.only&&r!==e.length)return!1;for(const e of i.values())if(e.hits!==e.allowed&&e.hits<e.allowed&&!a.part)return!1;return!!r},o.object=function(e,t,a){n(void 0===a.once,"Cannot use option once with object");const i=s.keys(e,a);if(!i.length)return!1;if(Array.isArray(t))return o.array(i,t,a);const r=Object.getOwnPropertySymbols(t).filter((e=>t.propertyIsEnumerable(e))),l=[...Object.keys(t),...r],c=o.compare(a),u=new Set(l);for(const n of i)if(u.has(n)){if(!c(t[n],e[n]))return!1;u.delete(n)}else if(a.only)return!1;return!u.size||!!a.part&&u.size<l.length},o.string=function(e,t,a){if(""===e)return 1===t.length&&""===t[0]||!a.once&&!t.some((e=>""!==e));const i=new Map,s=[];for(const e of t)if(n("string"==typeof e,"Cannot compare string reference to non-string value"),e){const t=i.get(e);t?++t.allowed:(i.set(e,{allowed:1,hits:0}),s.push(r(e)))}else if(a.once||a.only)return!1;if(!s.length)return!0;const o=new RegExp(`(${s.join("|")})`,"g"),l=e.replace(o,((e,t)=>(++i.get(t).hits,"")));if(a.only&&l)return!1;let c=!1;for(const e of i.values())if(e.hits&&(c=!0),e.hits!==e.allowed){if(e.hits<e.allowed&&!a.part)return!1;if(a.once)return!1}return!!c},o.compare=function(e){if(!e.deep)return o.shallow;const t=void 0!==e.only,a=void 0!==e.part,n={prototype:t?e.only:!!a&&!e.part,part:t?!e.only:!!a&&e.part};return(e,t)=>i(e,t,n)},o.shallow=function(e,t){return e===t}},function(e,t,a){"use strict";const n=a(301);e.exports=function(e){return n(/^[ \w\!#\$%&'\(\)\*\+,\-\.\/\:;<\=>\?@\[\]\^`\{\|\}~\"\\]*$/.test(e),"Bad attribute value ("+e+")"),e.replace(/\\/g,"\\\\").replace(/\"/g,'\\"')}},function(e,t,a){"use strict";const n={};e.exports=function(e){if(!e)return"";let t="";for(let a=0;a<e.length;++a){const i=e.charCodeAt(a);n.isSafe(i)?t+=e[a]:t+=n.escapeHtmlChar(i)}return t},n.escapeHtmlChar=function(e){const t=n.namedHtml[e];return void 0!==t?t:e>=256?"&#"+e+";":`&#x${e.toString(16).padStart(2,"0")};`},n.isSafe=function(e){return void 0!==n.safeCharCodes[e]},n.namedHtml={38:"&amp;",60:"&lt;",62:"&gt;",34:"&quot;",160:"&nbsp;",162:"&cent;",163:"&pound;",164:"&curren;",169:"&copy;",174:"&reg;"},n.safeCharCodes=function(){const e={};for(let t=32;t<123;++t)(t>=97||t>=65&&t<=90||t>=48&&t<=57||32===t||46===t||44===t||45===t||58===t||95===t)&&(e[t]=null);return e}()},function(e,t,a){"use strict";e.exports=function(e){if(!e)return"";let t;return e.replace(/[<>&\u2028\u2029]/g,(e=>(t=e.charCodeAt(0),60===t?"\\u003c":62===t?"\\u003e":38===t?"\\u0026":8232===t?"\\u2028":"\\u2029")))}},function(e,t,a){"use strict";const n={};e.exports=n.flatten=function(e,t){const a=t||[];for(let t=0;t<e.length;++t)Array.isArray(e[t])?n.flatten(e[t],a):a.push(e[t]);return a}},function(e,t,a){"use strict";const n={};e.exports=function(e,t,a={}){if(!e||!t)return a.first?null:[];const i=[],r=Array.isArray(e)?new Set(e):e,s=new Set;for(const e of t)if(n.has(r,e)&&!s.has(e)){if(a.first)return e;i.push(e),s.add(e)}return a.first?null:i},n.has=function(e,t){return"function"==typeof e.has?e.has(t):void 0!==e[t]}},function(e,t,a){"use strict";e.exports=function(e){return!!e&&"function"==typeof e.then}},function(e,t,a){"use strict";e.exports=function(e){if(e._hoekOnce)return e;let t=!1;const a=function(...a){t||(t=!0,e(...a))};return a._hoekOnce=!0,a}},function(e,t,a){"use strict";const n=a(426);e.exports=function(e,t,a){return t.replace(/{([^{}]+)}/g,((t,i)=>{const r=n(e,i,a);return null==r?"":r}))}},function(e,t,a){"use strict";e.exports=function(e,t){if("number"!=typeof e&&void 0!==e)throw new TypeError("Timeout must be a number");return new Promise((a=>setTimeout(a,e,t)))}},function(e,t,a){"use strict";e.exports=e=>encodeURIComponent(e).replace(/[!'()*]/g,(e=>`%${e.charCodeAt(0).toString(16).toUpperCase()}`))},function(e,t,a){"use strict";var n="%[a-f0-9]{2}",i=new RegExp("("+n+")|([^%]+?)","gi"),r=new RegExp("("+n+")+","gi");function s(e,t){try{return[decodeURIComponent(e.join(""))]}catch(e){}if(1===e.length)return e;t=t||1;var a=e.slice(0,t),n=e.slice(t);return Array.prototype.concat.call([],s(a),s(n))}function o(e){try{return decodeURIComponent(e)}catch(n){for(var t=e.match(i)||[],a=1;a<t.length;a++)t=(e=s(t,a).join("")).match(i)||[];return e}}e.exports=function(e){if("string"!=typeof e)throw new TypeError("Expected `encodedURI` to be of type `string`, got `"+typeof e+"`");try{return e=e.replace(/\+/g," "),decodeURIComponent(e)}catch(t){return function(e){for(var t={"%FE%FF":"��","%FF%FE":"��"},a=r.exec(e);a;){try{t[a[0]]=decodeURIComponent(a[0])}catch(e){var n=o(a[0]);n!==a[0]&&(t[a[0]]=n)}a=r.exec(e)}t["%C2"]="�";for(var i=Object.keys(t),s=0;s<i.length;s++){var l=i[s];e=e.replace(new RegExp(l,"g"),t[l])}return e}(e)}}},function(e,t,a){"use strict";e.exports=(e,t)=>{if("string"!=typeof e||"string"!=typeof t)throw new TypeError("Expected the arguments to be of type `string`");if(""===t)return[e];const a=e.indexOf(t);return-1===a?[e]:[e.slice(0,a),e.slice(a+t.length)]}},function(e,t){e.exports=function(){var e=document.getSelection();if(!e.rangeCount)return function(){};for(var t=document.activeElement,a=[],n=0;n<e.rangeCount;n++)a.push(e.getRangeAt(n));switch(t.tagName.toUpperCase()){case"INPUT":case"TEXTAREA":t.blur();break;default:t=null}return e.removeAllRanges(),function(){"Caret"===e.type&&e.removeAllRanges(),e.rangeCount||a.forEach((function(t){e.addRange(t)})),t&&t.focus()}}},function(e,t,a){e.exports=a(33)(1459)},function(e,t,a){e.exports=a(33)(2963)},function(e,t,a){e.exports=a(33)(2977)},function(e,t,a){e.exports=a(33)(2972)},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.createEpicMiddleware=void 0;var n=a(3),i=a(60),r=a(773);a(548),t.createEpicMiddleware=function(e){void 0===e&&(e={});var t,a=new(0,n.queueScheduler.constructor)(n.queueScheduler.schedulerActionCtor),s=new n.Subject,o=function(o){t=o;var l=new n.Subject,c=new n.Subject,u=l.asObservable().pipe(i.observeOn(a)),d=new r.StateObservable(c.pipe(i.observeOn(a)),t.getState());return s.pipe(i.map((function(t){var a=t(u,d,e.dependencies);if(!a)throw new TypeError('Your root Epic "'+(t.name||"<anonymous>")+"\" does not return a stream. Double check you're not missing a return statement!");return a})),i.mergeMap((function(e){return n.from(e).pipe(i.subscribeOn(a),i.observeOn(a))}))).subscribe(t.dispatch),function(e){return function(a){var n=e(a);return c.next(t.getState()),l.next(a),n}}};return o.run=function(e){s.next(e)},o}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.combineEpics=void 0;var n=a(3);t.combineEpics=function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];var a=function(){for(var t=[],a=0;a<arguments.length;a++)t[a]=arguments[a];return n.merge.apply(void 0,e.map((function(e){var a=e.apply(void 0,t);if(!a)throw new TypeError('combineEpics: one of the provided Epics "'+(e.name||"<anonymous>")+"\" does not return a stream. Double check you're not missing a return statement!");return a})))};try{Object.defineProperty(a,"name",{value:"combineEpics("+e.map((function(e){return e.name||"<anonymous>"})).join(", ")+")"})}catch(e){}return a}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.ofType=void 0;var n=a(60),i=(a(548),function(e,t){return e===t||"function"==typeof t&&e===t.toString()});t.ofType=function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];var a=e.length;return n.filter(1===a?function(t){return i(t.type,e[0])}:function(t){for(var n=0;n<a;n++)if(i(t.type,e[n]))return!0;return!1})}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e){return function(){for(var t=[],a=0;a<arguments.length;a++)t[a]=arguments[a];return n.useMemo((function(){return e.apply(void 0,t)}),t)}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e,t){var a=n.createContext(void 0);return[function(){var e=n.useContext(a);if(null==e)throw new Error("useReducerContext must be used inside a ReducerProvider.");return e},function(i){var r=i.children,s=i.initialState;return function(e,t){return n.createElement(a.Provider,e,t)}({value:n.useReducer(e,void 0!==s?s:t)},r)},a]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(359));t.default=function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];var a,n=(a=e,function(e,t){return a.reduceRight((function(t,a){return a(e)(t)}),t)});return function(e,t,a){void 0===a&&(a=function(e){return e});var s=i.useRef(a(t)),o=i.useState(s.current)[1],l=i.useCallback((function(t){return s.current=e(s.current,t),o(s.current),t}),[e]),c=i.useRef(n({getState:function(){return s.current},dispatch:function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];return c.current.apply(c,e)}},l));return r.default((function(){c.current=n({getState:function(){return s.current},dispatch:function(){for(var e=[],t=0;t<arguments.length;t++)e[t]=arguments[t];return c.current.apply(c,e)}},l)}),[l]),[s.current,c.current]}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e){var t=n.createContext(void 0);return[function(){var e=n.useContext(t);if(null==e)throw new Error("useStateContext must be used inside a StateProvider.");return e},function(a){var i=a.children,r=a.initialValue;return function(e,a){return n.createElement(t.Provider,e,a)}({value:n.useState(void 0!==r?r:e)},i)},t]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(544));t.default=function(e,t){void 0===t&&(t=[]);var a=i.useState(0),s=a[0],o=a[1],l=r.default(e,n.__spreadArrays(t,[s])),c=l.loading,u=i.useCallback((function(){c||o((function(e){return e+1}))}),n.__spreadArrays(t,[c]));return n.__assign(n.__assign({},l),{retry:u})}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34).__importDefault(a(778)).default("audio");t.default=n},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.default=function(e){for(var t=[],a=0;a<e.length;a++)t.push({start:e.start(a),end:e.end(a)});return t}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(146),r="object"==typeof navigator?navigator:void 0,s=r&&"function"==typeof r.getBattery;t.default=s?function(){var e=n.useState({isSupported:!0,fetched:!1}),t=e[0],a=e[1];return n.useEffect((function(){var e=!0,n=null,s=function(){if(e&&n){var r={isSupported:!0,fetched:!0,level:n.level,charging:n.charging,dischargingTime:n.dischargingTime,chargingTime:n.chargingTime};!i.isDeepEqual(t,r)&&a(r)}};return r.getBattery().then((function(t){e&&(n=t,i.on(n,"chargingchange",s),i.on(n,"chargingtimechange",s),i.on(n,"dischargingtimechange",s),i.on(n,"levelchange",s),s())})),function(){e=!1,n&&(i.off(n,"chargingchange",s),i.off(n,"chargingtimechange",s),i.off(n,"dischargingtimechange",s),i.off(n,"levelchange",s))}}),[]),t}:function(){return{isSupported:!1}}},function(e,t,a){"use strict";e.exports=function e(t,a){if(t===a)return!0;if(t&&a&&"object"==typeof t&&"object"==typeof a){if(t.constructor!==a.constructor)return!1;var n,i,r;if(Array.isArray(t)){if((n=t.length)!=a.length)return!1;for(i=n;0!=i--;)if(!e(t[i],a[i]))return!1;return!0}if(t.constructor===RegExp)return t.source===a.source&&t.flags===a.flags;if(t.valueOf!==Object.prototype.valueOf)return t.valueOf()===a.valueOf();if(t.toString!==Object.prototype.toString)return t.toString()===a.toString();if((n=(r=Object.keys(t)).length)!==Object.keys(a).length)return!1;for(i=n;0!=i--;)if(!Object.prototype.hasOwnProperty.call(a,r[i]))return!1;for(i=n;0!=i--;){var s=r[i];if(!("_owner"===s&&t.$$typeof||e(t[s],a[s])))return!1}return!0}return t!=t&&a!=a}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e,t){void 0===e&&(e=!0);var a=n.useCallback((function(a){if("function"!=typeof e||e())return a.preventDefault(),t&&(a.returnValue=t),t}),[e,t]);n.useEffect((function(){if(e)return window.addEventListener("beforeunload",a),function(){return window.removeEventListener("beforeunload",a)}}),[e,a])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34).__importDefault(a(779));t.default=n.default},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(146),r=["mousedown","touchstart"];t.default=function(e,t,a){void 0===a&&(a=r);var s=n.useRef(t);n.useEffect((function(){s.current=t}),[t]),n.useEffect((function(){for(var t=function(t){var a=e.current;a&&!a.contains(t.target)&&s.current(t)},n=0,r=a;n<r.length;n++){var o=r[n];i.on(document,o,t)}return function(){for(var e=0,n=a;e<n.length;e++){var r=n[e];i.off(document,r,t)}}}),[a,e])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(1176));t.default=function(e){var t=i.useState((function(){return r.default.get(e)||null})),a=t[0],n=t[1];return[a,i.useCallback((function(t,a){r.default.set(e,t,a),n(t)}),[e]),i.useCallback((function(){r.default.remove(e),n(null)}),[e])]}},function(e,t,a){var n,i,r;
/*!
 * JavaScript Cookie v2.2.1
 * https://github.com/js-cookie/js-cookie
 *
 * Copyright 2006, 2015 Klaus Hartl & Fagner Brack
 * Released under the MIT license
 */r=function(){function e(){for(var e=0,t={};e<arguments.length;e++){var a=arguments[e];for(var n in a)t[n]=a[n]}return t}function t(e){return e.replace(/(%[0-9A-Z]{2})+/g,decodeURIComponent)}return function a(n){function i(){}function r(t,a,r){if("undefined"!=typeof document){"number"==typeof(r=e({path:"/"},i.defaults,r)).expires&&(r.expires=new Date(1*new Date+864e5*r.expires)),r.expires=r.expires?r.expires.toUTCString():"";try{var s=JSON.stringify(a);/^[\{\[]/.test(s)&&(a=s)}catch(e){}a=n.write?n.write(a,t):encodeURIComponent(String(a)).replace(/%(23|24|26|2B|3A|3C|3E|3D|2F|3F|40|5B|5D|5E|60|7B|7D|7C)/g,decodeURIComponent),t=encodeURIComponent(String(t)).replace(/%(23|24|26|2B|5E|60|7C)/g,decodeURIComponent).replace(/[\(\)]/g,escape);var o="";for(var l in r)r[l]&&(o+="; "+l,!0!==r[l]&&(o+="="+r[l].split(";")[0]));return document.cookie=t+"="+a+o}}function s(e,a){if("undefined"!=typeof document){for(var i={},r=document.cookie?document.cookie.split("; "):[],s=0;s<r.length;s++){var o=r[s].split("="),l=o.slice(1).join("=");a||'"'!==l.charAt(0)||(l=l.slice(1,-1));try{var c=t(o[0]);if(l=(n.read||n)(l,c)||t(l),a)try{l=JSON.parse(l)}catch(e){}if(i[c]=l,e===c)break}catch(e){}}return e?i[e]:i}}return i.set=r,i.get=function(e){return s(e,!1)},i.getJSON=function(e){return s(e,!0)},i.remove=function(t,a){r(t,"",e(a,{expires:-1}))},i.defaults={},i.withConverter=a,i}((function(){}))},void 0===(i="function"==typeof(n=r)?n.call(t,a,t,e):n)||(e.exports=i),e.exports=r()},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=n.__importDefault(a(516)),r=a(2),s=n.__importDefault(a(267)),o=n.__importDefault(a(360));t.default=function(){var e=s.default(),t=o.default({value:void 0,error:void 0,noUserInteraction:!0}),a=t[0],n=t[1];return[a,r.useCallback((function(t){var a,r;if(e())try{if("string"!=typeof t&&"number"!=typeof t){var s=new Error("Cannot copy typeof "+typeof t+" to clipboard, must be a string");return void n({value:t,error:s,noUserInteraction:!0})}if(""===t)return s=new Error("Cannot copy empty string to clipboard."),void n({value:t,error:s,noUserInteraction:!0});r=t.toString(),a=i.default(r),n({value:r,error:void 0,noUserInteraction:a})}catch(s){n({value:r,error:s,noUserInteraction:a})}}),[])]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(1179),r=a(1180),s=a(1181),o=a(1183),l=a(2),c=n.__importDefault(a(35)),u=i.create();r.addon(u),s.addon(u);var d=0;t.default=function(e){var t=l.useMemo((function(){return"react-use-css-"+(d++).toString(36)}),[]),a=l.useMemo((function(){return new u.VSheet}),[]);return c.default((function(){var n={};return o.cssToTree(n,e,"."+t,""),a.diff(n),function(){a.diff({})}})),t}},function(e,t,a){"use strict";var n=/[A-Z]/g;t.create=function(e){var t=(e=e||{}).assign||Object.assign,a=t({raw:"",pfx:"_",client:"object"==typeof window,assign:t,stringify:JSON.stringify,kebab:function(e){return e.replace(n,"-$&").toLowerCase()},decl:function(e,t){return(e=a.kebab(e))+":"+t+";"},hash:function(e){return function(e){for(var t=5381,a=e.length;a;)t=33*t^e.charCodeAt(--a);return"_"+(t>>>0).toString(36)}(a.stringify(e))},selector:function(e,t){return e+(":"===t[0]?"":" ")+t},putRaw:function(e){a.raw+=e}},e);return a.client&&(a.sh||document.head.appendChild(a.sh=document.createElement("style")),a.putRaw=function(e){var t=a.sh.sheet;try{t.insertRule(e,t.cssRules.length)}catch(e){}}),a.put=function(e,t,n){var i,r,s="",o=[];for(i in t)(r=t[i])instanceof Object&&!(r instanceof Array)?o.push(i):s+=a.decl(i,r,e,n);s&&(s=e+"{"+s+"}",a.putRaw(n?n+"{"+s+"}":s));for(var l=0;l<o.length;l++)"@"===(i=o[l])[0]&&"@font-face"!==i?a.putAt(e,t[i],i):a.put(a.selector(e,i),t[i],n)},a.putAt=a.put,a}},function(e,t,a){"use strict";t.addon=function(e){e.client&&(document.head.appendChild(e.msh=document.createElement("style")),e.createRule=function(t,a){var n=t+"{}";a&&(n=a+"{"+n+"}");var i=a?e.msh.sheet:e.sh.sheet,r=i.insertRule(n,i.cssRules.length),s=(i.cssRules||i.rules)[r];if(s.index=r,a){var o=(s.cssRules||s.rules)[0];s.style=o.style,s.styleMap=o.styleMap}return s})}},function(e,t,a){"use strict";var n=a(1182).removeRule;t.addon=function(e){if(e.client){var t=e.kebab;a.prototype.diff=function(e){var a,n=this.decl,i=this.rule.style;for(a in n)void 0===e[a]&&i.removeProperty(a);for(a in e)e[a]!==n[a]&&i.setProperty(t(a),e[a]);this.decl=e},a.prototype.del=function(){n(this.rule)},i.prototype.diff=function(e){var t=this.tree;for(var n in t)if(void 0===e[n]){var i=t[n];for(var r in i)i[r].del()}for(var n in e)if(void 0===t[n])for(var r in e[n])(l=new a(r,n)).diff(e[n][r]),e[n][r]=l;else{var s=t[n],o=e[n];for(var r in s)o[r]||s[r].del();for(var r in o){var l;(l=s[r])?(l.diff(o[r]),o[r]=l):((l=new a(r,n)).diff(o[r]),o[r]=l)}}this.tree=e},e.VRule=a,e.VSheet=i}function a(t,a){this.rule=e.createRule(t,a),this.decl={}}function i(){this.tree={}}}},function(e,t){t.removeRule=function(e){var t=e.index,a=e.parentStyleSheet,n=a.cssRules||a.rules;for(t=Math.max(t,n.length-1);t>=0;){if(n[t]===e){a.deleteRule(t);break}t--}}},function(e,t){t.cssToTree=function e(t,a,n,i){var r,s,o={},l=!1;for(r in a)"object"!=typeof(s=a[r])&&(l=!0,o[r]=s);for(r in l&&(t[i]||(t[i]={}),t[i][n]=o),a)if("object"==typeof(s=a[r]))if("@"===r[0])e(t,s,n,r);else{var c=r.indexOf("&")>-1,u=n.split(",");if(c)for(var d=0;d<u.length;d++)u[d]=r.replace(/&/g,u[d]);else for(d=0;d<u.length;d++)u[d]=u[d]+" "+r;e(t,s,u.join(","),i)}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(557));t.default=function(e,t,a){void 0===t&&(t=0),void 0===a&&(a=[]);var n=r.default(e,t),s=n[0],o=n[1],l=n[2];return i.useEffect(l,a),[s,o]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e,t){var a=n.useState(t),i=a[0],r=a[1];return null==i?[e,r]:[i,r]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=function(){};t.default=function(e,t){void 0===e&&(e={}),void 0===t&&(t=[]);var a=e.onFiles,s=e.onText,o=e.onUri,l=i.useState(!1),c=l[0],u=l[1],d=i.useCallback(u,[]),p=i.useMemo((function(){return function(e){return function(t,a){var n=t.getData("text/uri-list");if(n)(e.onUri||r)(n,a);else if(t.files&&t.files.length)(e.onFiles||r)(Array.from(t.files),a);else if(a.clipboardData){var i=a.clipboardData.getData("text");(e.onText||r)(i,a)}}}(e)}),[a,s,o]);return i.useEffect((function(){var e=function(e){e.preventDefault(),d(!0)},t=function(e){e.preventDefault(),d(!0)},a=function(){d(!1)},n=function(){d(!1)},i=function(e){e.preventDefault(),d(!1),p(e.dataTransfer,e)},r=function(e){p(e.clipboardData,e)};return document.addEventListener("dragover",e),document.addEventListener("dragenter",t),document.addEventListener("dragleave",a),document.addEventListener("dragexit",n),document.addEventListener("drop",i),s&&document.addEventListener("paste",r),function(){document.removeEventListener("dragover",e),document.removeEventListener("dragenter",t),document.removeEventListener("dragleave",a),document.removeEventListener("dragexit",n),document.removeEventListener("drop",i),document.removeEventListener("paste",r)}}),n.__spreadArrays([p],t)),{over:c}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(267)),s=function(){};t.default=function(e){void 0===e&&(e={});var t=e.onFiles,a=e.onText,n=e.onUri,o=r.default(),l=i.useState(!1),c=l[0],u=l[1],d=i.useMemo((function(){return function(e,t){return function(a,n){var i=a.getData("text/uri-list");i?(e.onUri||s)(i,n):a.files&&a.files.length?(e.onFiles||s)(Array.from(a.files),n):a.items&&a.items.length&&a.items[0].getAsString((function(a){t&&(e.onText||s)(a,n)}))}}(e,o())}),[t,a,n]),p=i.useMemo((function(){return function(e,t){return{onDragOver:function(e){e.preventDefault()},onDragEnter:function(e){e.preventDefault(),t(!0)},onDragLeave:function(){t(!1)},onDrop:function(a){a.preventDefault(),a.persist(),t(!1),e(a.dataTransfer,a)},onPaste:function(t){t.persist(),e(t.clipboardData,t)}}}(d,u)}),[d,u]);return[p,{over:c}]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.ensuredForwardRef=void 0;var n=a(2);function i(e){var t=n.useRef(e&&e.current);return n.useEffect((function(){e&&(e.current=t.current)}),[e]),t}t.default=i,t.ensuredForwardRef=function(e){return n.forwardRef((function(t,a){var n=i(a);return e(t,n)}))}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(){var e=n.useState(null),t=e[0],a=e[1];return n.useEffect((function(){if(t)throw t}),[t]),n.useCallback((function(e){a(e)}),[])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e){n.useEffect((function(){var t=document.querySelector("link[rel*='icon']")||document.createElement("link");t.type="image/x-icon",t.rel="shortcut icon",t.href=e,document.getElementsByTagName("head")[0].appendChild(t)}),[e])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(1192)),s=n.__importDefault(a(35)),o=function(){};t.default=function(e,t,a){void 0===a&&(a={});var n=a.video,l=a.onClose,c=void 0===l?o:l,u=i.useState(t),d=u[0],p=u[1];return s.default((function(){if(t&&e.current){var a=function(){n.current.removeEventListener("webkitendfullscreen",a),c()},i=function(){if(r.default.isEnabled){var e=r.default.isFullscreen;p(e),e||c()}};if(r.default.isEnabled){try{r.default.request(e.current),p(!0)}catch(e){c(e),p(!1)}r.default.on("change",i)}else n&&n.current&&n.current.webkitEnterFullscreen?(n.current.webkitEnterFullscreen(),n.current.addEventListener("webkitendfullscreen",a),p(!0)):(c(),p(!1));return function(){if(p(!1),r.default.isEnabled)try{r.default.off("change",i),r.default.exit()}catch(e){}else n&&n.current&&n.current.webkitExitFullscreen&&(n.current.removeEventListener("webkitendfullscreen",a),n.current.webkitExitFullscreen())}}}),[t,n,e]),d}},function(e,t,a){
/*!
* screenfull
* v5.0.0 - 2019-09-09
* (c) Sindre Sorhus; MIT License
*/
!function(){"use strict";var t="undefined"!=typeof window&&void 0!==window.document?window.document:{},a=e.exports,n=function(){for(var e,a=[["requestFullscreen","exitFullscreen","fullscreenElement","fullscreenEnabled","fullscreenchange","fullscreenerror"],["webkitRequestFullscreen","webkitExitFullscreen","webkitFullscreenElement","webkitFullscreenEnabled","webkitfullscreenchange","webkitfullscreenerror"],["webkitRequestFullScreen","webkitCancelFullScreen","webkitCurrentFullScreenElement","webkitCancelFullScreen","webkitfullscreenchange","webkitfullscreenerror"],["mozRequestFullScreen","mozCancelFullScreen","mozFullScreenElement","mozFullScreenEnabled","mozfullscreenchange","mozfullscreenerror"],["msRequestFullscreen","msExitFullscreen","msFullscreenElement","msFullscreenEnabled","MSFullscreenChange","MSFullscreenError"]],n=0,i=a.length,r={};n<i;n++)if((e=a[n])&&e[1]in t){for(n=0;n<e.length;n++)r[a[0][n]]=e[n];return r}return!1}(),i={change:n.fullscreenchange,error:n.fullscreenerror},r={request:function(e){return new Promise(function(a,i){var r=function(){this.off("change",r),a()}.bind(this);this.on("change",r),e=e||t.documentElement,Promise.resolve(e[n.requestFullscreen]()).catch(i)}.bind(this))},exit:function(){return new Promise(function(e,a){if(this.isFullscreen){var i=function(){this.off("change",i),e()}.bind(this);this.on("change",i),Promise.resolve(t[n.exitFullscreen]()).catch(a)}else e()}.bind(this))},toggle:function(e){return this.isFullscreen?this.exit():this.request(e)},onchange:function(e){this.on("change",e)},onerror:function(e){this.on("error",e)},on:function(e,a){var n=i[e];n&&t.addEventListener(n,a,!1)},off:function(e,a){var n=i[e];n&&t.removeEventListener(n,a,!1)},raw:n};n?(Object.defineProperties(r,{isFullscreen:{get:function(){return Boolean(t[n.fullscreenElement])}},element:{enumerable:!0,get:function(){return t[n.fullscreenElement]}},isEnabled:{enumerable:!0,get:function(){return Boolean(t[n.fullscreenEnabled])}}}),a?e.exports=r:window.screenfull=r):a?e.exports={isEnabled:!1}:window.screenfull={isEnabled:!1}}()},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2);t.default=function(e){var t,a=i.useState({loading:!0,accuracy:null,altitude:null,altitudeAccuracy:null,heading:null,latitude:null,longitude:null,speed:null,timestamp:Date.now()}),r=a[0],s=a[1],o=!0,l=function(e){o&&s({loading:!1,accuracy:e.coords.accuracy,altitude:e.coords.altitude,altitudeAccuracy:e.coords.altitudeAccuracy,heading:e.coords.heading,latitude:e.coords.latitude,longitude:e.coords.longitude,speed:e.coords.speed,timestamp:e.timestamp})},c=function(e){return o&&s((function(t){return n.__assign(n.__assign({},t),{loading:!1,error:e})}))};return i.useEffect((function(){return navigator.geolocation.getCurrentPosition(l,c,e),t=navigator.geolocation.watchPosition(l,c,e),function(){o=!1,navigator.geolocation.clearWatch(t)}}),[]),r}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(308));t.default=function(e){void 0===e&&(e={});var t=r.default(),a=i.useRef(n.__assign({},e));return[i.useCallback((function(){return a.current}),[]),i.useCallback((function(e){e&&(Object.assign(a.current,e),t())}),[])]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(1196);t.default=function(e,t){void 0===t&&(t=0);var a=n.useRef((function(){}));n.useEffect((function(){a.current=e})),n.useEffect((function(){if(null!==t){var e=i.setHarmonicInterval((function(){return a.current()}),t);return function(){return i.clearHarmonicInterval(e)}}}),[t])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=0,i={};t.clearHarmonicInterval=function(e){var t=e.bucket,a=e.id;delete t.listeners[a];var n=!1;for(var r in t.listeners){n=!0;break}n||(clearInterval(t.timer),delete i[t.ms])},t.setHarmonicInterval=function(e,t){var a,r=n++;if(i[t])i[t].listeners[r]=e;else{var s=setInterval((function(){for(var e,a=i[t].listeners,n=!1,r=0,s=Object.values(a);r<s.length;r++){var o=s[r];try{o()}catch(t){n=!0,e=t}}if(n)throw e}),t);i[t]={ms:t,timer:s,listeners:(a={},a[r]=e,a)}}return{bucket:i[t],id:r}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34).__importStar(a(2)),i=n.useState,r=function(){};t.default=function(e){var t,a,s=i(!1),o=s[0],l=s[1];return"function"==typeof e&&(e=e(o)),[n.cloneElement(e,{onMouseEnter:(a=e.props.onMouseEnter,function(e){(a||r)(e),l(!0)}),onMouseLeave:(t=e.props.onMouseLeave,function(e){(t||r)(e),l(!1)})}),o]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(1199),r=a(146),s=["mousemove","mousedown","resize","keydown","touchstart","wheel"];t.default=function(e,t,a){void 0===e&&(e=6e4),void 0===t&&(t=!1),void 0===a&&(a=s);var o=n.useState(t),l=o[0],c=o[1];return n.useEffect((function(){for(var t,n=!0,s=l,o=function(e){n&&(s=e,c(e))},u=i.throttle(50,(function(){s&&o(!1),clearTimeout(t),t=setTimeout((function(){return o(!0)}),e)})),d=function(){document.hidden||u()},p=0;p<a.length;p++)r.on(window,a[p],u);return r.on(document,"visibilitychange",d),t=setTimeout((function(){return o(!0)}),e),function(){n=!1;for(var e=0;e<a.length;e++)r.off(window,a[e],u);r.off(document,"visibilitychange",d)}}),[e,a]),l}},function(e,t,a){"use strict";function n(e,t,a,n){var i,r=!1,s=0;function o(){i&&clearTimeout(i)}function l(){var l=this,c=Date.now()-s,u=arguments;function d(){s=Date.now(),a.apply(l,u)}r||(n&&!i&&d(),o(),void 0===n&&c>e?d():!0!==t&&(i=setTimeout(n?function(){i=void 0}:d,void 0===n?e-c:e)))}return"boolean"!=typeof t&&(n=a,a=t,t=void 0),l.cancel=function(){o(),r=!0},l}Object.defineProperty(t,"__esModule",{value:!0}),t.throttle=n,t.debounce=function(e,t,a){return void 0===a?n(e,t,!1):n(e,a,!1!==t)}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e,t){var a=n.useState(null),i=a[0],r=a[1];return n.useEffect((function(){if(e.current&&"function"==typeof IntersectionObserver){var a=new IntersectionObserver((function(e){r(e[0])}),t);return a.observe(e.current),function(){r(null),a.disconnect()}}return function(){}}),[e.current,t.threshold,t.root,t.rootMargin]),i}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e,t){var a=n.useRef((function(){}));n.useEffect((function(){a.current=e})),n.useEffect((function(){if(null!==t){var e=setInterval((function(){return a.current()}),t||0);return function(){return clearInterval(e)}}}),[t])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e){return void 0===e&&(e={laptopL:1440,laptop:1024,tablet:768}),function(){var t=n.useState(0),a=t[0],i=t[1];n.useEffect((function(){var e=function(){i(window.innerWidth)};return e(),window.addEventListener("resize",e),function(){window.removeEventListener("resize",e)}}));var r=n.useMemo((function(){return Object.entries(e).sort((function(e,t){return e[1]>=t[1]?1:-1}))}),[e]),s=r.reduce((function(e,t){var n=t[0],i=t[1];return a>=i?n:e}),r[0][0]);return s}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=n.__importDefault(a(784)),r=n.__importDefault(a(359));t.default=function(e,t,a,n){void 0===n&&(n=i.default);var s=n(e),o=s[0],l=s[1];r.default((function(){!o&&a?a(l):o&&t&&t(l)}),[o])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(146),r=function(){};t.default=function(e,t,a){if(!i.isClient)return[t,r,r];if(!e)throw new Error("useLocalStorage key may not be falsy");var s=a?a.raw?function(e){return e}:a.deserializer:JSON.parse,o=n.useState((function(){try{var n=a?a.raw?String:a.serializer:JSON.stringify,i=localStorage.getItem(e);return null!==i?s(i):(t&&localStorage.setItem(e,n(t)),t)}catch(e){return t}})),l=o[0],c=o[1],u=n.useCallback((function(t){try{var n="function"==typeof t?t(l):t;if(void 0===n)return;var i;i=a?a.raw?"string"==typeof n?n:JSON.stringify(n):a.serializer?a.serializer(n):JSON.stringify(n):JSON.stringify(n),localStorage.setItem(e,i),c(s(i))}catch(e){}}),[e,c]),d=n.useCallback((function(){try{localStorage.removeItem(e),c(void 0)}catch(e){}}),[e,c]);return[l,u,d]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(146),r=function(e){var t=window.history,a=t[e];t[e]=function(t){var n=a.apply(this,arguments),i=new Event(e.toLowerCase());return i.state=t,window.dispatchEvent(i),n}};i.isClient&&(r("pushState"),r("replaceState"));var s=function(e){var t=window.history,a=t.state,n=t.length,i=window.location;return{trigger:e,state:a,length:n,hash:i.hash,host:i.host,hostname:i.hostname,href:i.href,origin:i.origin,pathname:i.pathname,port:i.port,protocol:i.protocol,search:i.search}},o="function"==typeof Event;t.default=i.isClient&&o?function(){var e=n.useState(s("load")),t=e[0],a=e[1];return n.useEffect((function(){var e=function(){return a(s("popstate"))},t=function(){return a(s("pushstate"))},n=function(){return a(s("replacestate"))};return i.on(window,"popstate",e),i.on(window,"pushstate",t),i.on(window,"replacestate",n),function(){i.off(window,"popstate",e),i.off(window,"pushstate",t),i.off(window,"replacestate",n)}}),[]),t}:function(){return{trigger:"load",length:1}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.getClosestBody=void 0;var n=a(2);function i(e){if(!e)return null;if("BODY"===e.tagName)return e;if("IFRAME"===e.tagName){var t=e.contentDocument;return t?t.body:null}return e.offsetParent?i(e.offsetParent):null}function r(e){var t=e||window.event;return t.touches.length>1||(t.preventDefault&&t.preventDefault(),!1)}t.getClosestBody=i;var s="undefined"!=typeof window&&window.navigator&&window.navigator.platform&&/iP(ad|hone|od)/.test(window.navigator.platform),o=new Map,l="object"==typeof document?document:void 0,c=!1;t.default=l?function(e,t){void 0===e&&(e=!0);var a=n.useRef(l.body);t=t||a;var u=function(e){var t=o.get(e);t&&(1===t.counter?(o.delete(e),s?(e.ontouchmove=null,c&&(document.removeEventListener("touchmove",r),c=!1)):e.style.overflow=t.initialOverflow):o.set(e,{counter:t.counter-1,initialOverflow:t.initialOverflow}))};n.useEffect((function(){var a=i(t.current);a&&(e?function(e){var t=o.get(e);t?o.set(e,{counter:t.counter+1,initialOverflow:t.initialOverflow}):(o.set(e,{counter:1,initialOverflow:e.style.overflow}),s?c||(document.addEventListener("touchmove",r,{passive:!1}),c=!0):e.style.overflow="hidden")}(a):u(a))}),[e,t.current]),n.useEffect((function(){var e=i(t.current);if(e)return function(){u(e)}}),[])}:function(e,t){void 0===e&&(e=!0)}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=n.__importDefault(a(361)),r=n.__importDefault(a(359));t.default=function(e){for(var t=[],a=1;a<arguments.length;a++)t[a-1]=arguments[a];i.default((function(){return console.log.apply(console,n.__spreadArrays([e+" mounted"],t)),function(){return console.log(e+" unmounted")}})),r.default((function(){console.log.apply(console,n.__spreadArrays([e+" updated"],t))}))}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=function(e){(function(e){return"touches"in e})(e)&&e.touches.length<2&&e.preventDefault&&e.preventDefault()};t.default=function(e,t){var a=void 0===t?{}:t,r=a.isPreventDefault,s=void 0===r||r,o=a.delay,l=void 0===o?300:o,c=n.useRef(),u=n.useRef(),d=n.useCallback((function(t){s&&t.target&&(t.target.addEventListener("touchend",i,{passive:!1}),u.current=t.target),c.current=setTimeout((function(){return e(t)}),l)}),[e,l,s]),p=n.useCallback((function(){c.current&&clearTimeout(c.current),s&&u.current&&u.current.removeEventListener("touchend",i)}),[s]);return{onMouseDown:function(e){return d(e)},onTouchStart:function(e){return d(e)},onMouseUp:p,onMouseLeave:p,onTouchEnd:p}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(146);t.default=function(e,t){void 0===t&&(t=!1);var a=n.useState(i.isClient?function(){return window.matchMedia(e).matches}:t),r=a[0],s=a[1];return n.useEffect((function(){var t=!0,a=window.matchMedia(e),n=function(){t&&s(!!a.matches)};return a.addListener(n),s(a.matches),function(){t=!1,a.removeListener(n)}}),[e]),r}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(146),r=function(){};t.default="object"==typeof navigator&&navigator.mediaDevices?function(){var e=n.useState({}),t=e[0],a=e[1];return n.useEffect((function(){var e=!0,t=function(){navigator.mediaDevices.enumerateDevices().then((function(t){e&&a({devices:t.map((function(e){return{deviceId:e.deviceId,groupId:e.groupId,kind:e.kind,label:e.label}}))})})).catch(r)};return i.on(navigator.mediaDevices,"devicechange",t),t(),function(){e=!1,i.off(navigator.mediaDevices,"devicechange",t)}}),[]),t}:function(){return{}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.useMediatedState=void 0;var n=a(2);t.useMediatedState=function(e,t){var a=n.useRef(e),i=n.useState(t),r=i[0],s=i[1];return[r,n.useCallback((function(e){2===a.current.length?a.current(e,s):s(a.current(e))}),[r])]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e,t){var a=n.useMemo((function(){return function(t,a){var n;return(n=e(t))[a.type].apply(n,a.payload)}}),[e]),i=n.useReducer(a,t),r=i[0],s=i[1],o=n.useMemo((function(){return Object.keys(e(t)).reduce((function(e,t){return e[t]=function(){for(var e=[],a=0;a<arguments.length;a++)e[a]=arguments[a];return s({type:t,payload:e})},e}),{})}),[e,t]);return[r,o]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(146),r={acceleration:{x:null,y:null,z:null},accelerationIncludingGravity:{x:null,y:null,z:null},rotationRate:{alpha:null,beta:null,gamma:null},interval:16};t.default=function(e){void 0===e&&(e=r);var t=n.useState(e),a=t[0],s=t[1];return n.useEffect((function(){var e=function(e){var t=e.acceleration,a=e.accelerationIncludingGravity,n=e.rotationRate,i=e.interval;s({acceleration:{x:t.x,y:t.y,z:t.z},accelerationIncludingGravity:{x:a.x,y:a.y,z:a.z},rotationRate:{alpha:n.alpha,beta:n.beta,gamma:n.gamma},interval:i})};return i.on(window,"devicemotion",e),function(){i.off(window,"devicemotion",e)}}),[]),a}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=n.__importDefault(a(782)),r=n.__importDefault(a(790)),s={current:null};t.default=function(e,t){void 0===t&&(t={});var a=!!t.whenHovered,n=!!t.bound,o=i.default(e,a),l=r.default(a&&!o?s:e);return n&&(l.elX=Math.max(0,Math.min(l.elX,l.elW)),l.elY=Math.max(0,Math.min(l.elY,l.elH))),l}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(){var e=n.useState(0),t=e[0],a=e[1];return n.useEffect((function(){var e=function(e){a(e.deltaY+t)};return window.addEventListener("wheel",e,!1),function(){return window.removeEventListener("wheel",e)}})),t}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=a(146),s=function(){if("object"!=typeof navigator)return null;var e=navigator;return e.connection||e.mozConnection||e.webkitConnection},o=function(){var e=s();return e?{downlink:e.downlink,downlinkMax:e.downlinkMax,effectiveType:e.effectiveType,type:e.type,rtt:e.rtt}:{}};t.default=function(e){void 0===e&&(e={});var t=i.useState(e),a=t[0],l=t[1];return i.useEffect((function(){var e=a,t=function(t){e=n.__assign(n.__assign({},e),t),l(e)},i=s(),c=function(){t({online:!0,since:new Date})},u=function(){t({online:!1,since:new Date})},d=function(){t(o())};return r.on(window,"online",c),r.on(window,"offline",u),i&&(r.on(i,"change",d),t(n.__assign(n.__assign(n.__assign({},a),{online:navigator.onLine,since:void 0}),o()))),function(){r.off(window,"online",c),r.off(window,"offline",u),i&&r.off(i,"change",d)}}),[]),a}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34).__importDefault(a(780));t.default=n.default},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(146),r={angle:0,type:"landscape-primary"};t.default=function(e){void 0===e&&(e=r);var t=window.screen,a=n.useState(e),s=a[0],o=a[1];return n.useEffect((function(){var a=!0,n=function(){if(a){var n=t.orientation;if(n){var i=n.angle,r=n.type;o({angle:i,type:r})}else window.orientation?o({angle:"number"==typeof window.orientation?window.orientation:0,type:""}):o(e)}};return i.on(window,"orientationchange",n),n(),function(){a=!1,i.off(window,"orientationchange",n)}}),[]),s}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e,t){void 0===t&&(t=[]),n.useEffect((function(){if(e){var t=function(t){var a=(t=t||window.event).relatedTarget||t.toElement;a&&"HTML"!==a.nodeName||e()};return document.addEventListener("mouseout",t),function(){document.removeEventListener("mouseout",t)}}}),t)}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(146),r=function(){};t.default=function(e){var t=!0,a=null,s=n.useState(""),o=s[0],l=s[1],c=function(){t&&a&&l(a.state)};return n.useEffect((function(){return navigator.permissions.query(e).then((function(e){a=e,c(),i.on(a,"change",c)})).catch(r),function(){t=!1,a&&i.off(a,"change",c)}}),[]),o}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(445),r=function(e,t){return e===t};t.default=function(e,t){void 0===t&&(t=r);var a=n.useRef(),s=n.useRef(e);return i.useFirstMountState()||t(s.current,e)||(a.current=s.current,s.current=e),a.current}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(267));t.default=function(){var e=r.default();return i.useCallback((function(t){return new Promise((function(a,n){t.then((function(t){e()&&a(t)}),(function(t){e()&&n(t)}))}))}),[])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2);t.default=function(e){void 0===e&&(e=[]);var t=i.useState(e),a=t[0],r=t[1];return{add:function(e){r((function(t){return n.__spreadArrays(t,[e])}))},remove:function(){var e;return r((function(t){var a=t[0],n=t.slice(1);return e=a,n})),e},get first(){return a[0]},get last(){return a[a.length-1]},get size(){return a.length}}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e,t){void 0===t&&(t=!0);var a=n.useRef(null),i=n.useRef(!1),r=n.useRef(e);r.current=e;var s=n.useCallback((function(e){i.current&&(r.current(e),a.current=requestAnimationFrame(s))}),[]),o=n.useMemo((function(){return[function(){i.current&&(i.current=!1,a.current&&cancelAnimationFrame(a.current))},function(){i.current||(i.current=!0,a.current=requestAnimationFrame(s))},function(){return i.current}]}),[]);return n.useEffect((function(){return t&&o[1](),o[0]}),[]),o}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=function(e,t){return new URLSearchParams(e).get(t)};t.default="object"==typeof window?function(e){var t=window.location,a=n.useState((function(){return i(t.search,e)})),r=a[0],s=a[1];return n.useEffect((function(){var a=function(){s(i(t.search,e))};return window.addEventListener("popstate",a),window.addEventListener("pushstate",a),window.addEventListener("replacestate",a),function(){window.removeEventListener("popstate",a),window.removeEventListener("pushstate",a),window.removeEventListener("replacestate",a)}}),[]),r}:function(){return null}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.ScratchSensor=void 0;var n=a(34),i=a(2),r=a(1227),s=n.__importDefault(a(785)),o=function(){},l=function(e){void 0===e&&(e={});var t=e.disabled,a=s.default(e),r=i.useState({isScratching:!1}),l=r[0],c=r[1],u=i.useRef(l),d=i.useRef(!1),p=i.useRef(null),m=i.useState(null),b=m[0],g=m[1];return i.useEffect((function(){if(!t&&b){var e,i,r=function(e,t){cancelAnimationFrame(p.current),p.current=requestAnimationFrame((function(){var i=b.getBoundingClientRect(),r=i.left,s=i.top,l=r+window.scrollX,d=s+window.scrollY,p=e-l,m=t-d;c((function(e){var t=n.__assign(n.__assign({},e),{dx:p-(e.x||0),dy:m-(e.y||0),end:Date.now(),isScratching:!0});return u.current=t,(a.current.onScratch||o)(t),t}))}))},s=function(e){r(e.pageX,e.pageY)},l=function(e){r(e.changedTouches[0].pageX,e.changedTouches[0].pageY)},m=function(){d.current&&(d.current=!1,u.current=n.__assign(n.__assign({},u.current),{isScratching:!1}),(a.current.onScratchEnd||o)(u.current),c({isScratching:!1}),window.removeEventListener("mousemove",s),window.removeEventListener("touchmove",l),window.removeEventListener("mouseup",e),window.removeEventListener("touchend",i))};e=m,i=m;var g=function(t,n){if(d.current){var r=b.getBoundingClientRect(),p=r.left,m=r.top,g=p+window.scrollX,f=m+window.scrollY,y=t-g,h=n-f,v=Date.now(),E={isScratching:!0,start:v,end:v,docX:t,docY:n,x:y,y:h,dx:0,dy:0,elH:b.offsetHeight,elW:b.offsetWidth,elX:g,elY:f};u.current=E,(a.current.onScratchStart||o)(E),c(E),window.addEventListener("mousemove",s),window.addEventListener("touchmove",l),window.addEventListener("mouseup",e),window.addEventListener("touchend",i)}},f=function(e){d.current=!0,g(e.pageX,e.pageY)},y=function(e){d.current=!0,g(e.changedTouches[0].pageX,e.changedTouches[0].pageY)};return b.addEventListener("mousedown",f),b.addEventListener("touchstart",y),function(){b.removeEventListener("mousedown",f),b.removeEventListener("touchstart",y),window.removeEventListener("mousemove",s),window.removeEventListener("touchmove",l),window.removeEventListener("mouseup",e),window.removeEventListener("touchend",i),p.current&&cancelAnimationFrame(p.current),p.current=null,d.current=!1,u.current={isScratching:!1},c(u.current)}}}),[b,t,a]),[g,l]};t.ScratchSensor=function(e){e.children;var t=n.__rest(e,["children"]),a=l(t),s=a[0],o=a[1],c=r.render(e,o);return i.cloneElement(c,n.__assign(n.__assign({},c.props),{ref:function(e){c.props.ref&&("object"==typeof c.props.ref&&(c.props.ref.current=e),"function"==typeof c.props.ref&&c.props.ref(e)),s(e)}}))},t.default=l},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.hookToRenderProp=t.createEnhancer=t.render=void 0;var n=a(34),i=n.__importDefault(a(792));t.render=i.default;var r=n.__importDefault(a(1228));t.createEnhancer=r.default;var s=n.__importDefault(a(1231));t.hookToRenderProp=s.default},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.divWrapper=void 0;var n=a(34),i=n.__importStar(a(2)),r=n.__importDefault(a(1229)),s=i.createElement,o=function(e,t,a,i){var r;return s(e,t?n.__assign(((r={})[t]=i,r),a):n.__assign(n.__assign({},i),a))};t.divWrapper=function(e,t,a,n){return s("div",null,o(e,t,a,n))},t.default=function(e,t,a){void 0===a&&(a=o);var n=function(i,o,l){void 0===o&&(o=t),void 0===l&&(l=null);var c="string"==typeof i;if(c)return function(e){return n(e,i||t,o)};var u=function(t){return s(e,l,(function(e){return a(i,o,t,e)}))};return c?r.default(u):u};return n}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34).__importDefault(a(1230));t.default=function(e){return e.prototype?e:n.default(e)}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=n.__importStar(a(2));t.default=function(e){var t=function(t){function a(){return null!==t&&t.apply(this,arguments)||this}return n.__extends(a,t),a.prototype.render=function(){return e(this.props,this.context)},a}(i.Component);return t}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34).__importDefault(a(792)),i=function(e){return[e]};t.default=function(e,t){return void 0===t&&(t=i),function(a){return n.default(a,e.apply(void 0,t(a)))}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(362));t.default=function(e){var t=r.default({x:0,y:0}),a=t[0],n=t[1];return i.useEffect((function(){var t=function(){e.current&&n({x:e.current.scrollLeft,y:e.current.scrollTop})};return e.current&&e.current.addEventListener("scroll",t,{capture:!1,passive:!0}),function(){e.current&&e.current.removeEventListener("scroll",t)}}),[e]),a}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e){var t=n.useState(!1),a=t[0],i=t[1];return n.useEffect((function(){if(e.current){var t,a=function(){i(!0),clearTimeout(t),t=setTimeout((function(){i(!1)}),150)};return e.current.addEventListener("scroll",a,!1),function(){e.current&&e.current.removeEventListener("scroll",a,!1)}}return function(){}}),[e]),a}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(146);t.default=function(e,t,a){if(!i.isClient)return[t,function(){}];var r=n.useState((function(){try{var n=sessionStorage.getItem(e);return"string"!=typeof n?(sessionStorage.setItem(e,a?String(t):JSON.stringify(t)),t):a?n:JSON.parse(n||"null")}catch(e){return t}})),s=r[0],o=r[1];return n.useEffect((function(){try{var t=a?String(s):JSON.stringify(s);sessionStorage.setItem(e,t)}catch(e){}})),[s,o]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(1236),r=n.__importDefault(a(556)),s=function(e,t){return e.every((function(e,a){return i.equal(e,t[a])}))};t.default=function(e,t){r.default(e,t,s)}},function(e,t){var a=Object.keys;t.equal=function(e,t){if(e===t)return!0;if(!(e instanceof Object&&t instanceof Object))return!1;for(var n=a(e),i=n.length,r=0;r<i;r++)if(!(n[r]in t))return!1;for(r=0;r<i;r++)if(e[n[r]]!==t[n[r]])return!1;return i===a(t).length}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=n.__importStar(a(2)),r=a(146),s=i.useState,o=i.useEffect,l=i.useRef;t.default=function(e,t){var a=void 0===t?{}:t,c=a.width,u=void 0===c?1/0:c,d=a.height,p=void 0===d?1/0:d;if(!r.isClient)return["function"==typeof e?e({width:u,height:p}):e,{width:u,height:p}];var m=s({width:u,height:p}),b=m[0],g=m[1];"function"==typeof e&&(e=e(b));var f=e.props.style||{},y=l(null),h=null,v=function(){var e=y.current,t=e?{width:e.offsetWidth,height:e.offsetHeight}:{width:u,height:p};g(t)},E=function(e){e.addEventListener("resize",v),setTimeout(v,35)};return o((function(){var e=y.current;if(e){if(e.contentWindow)h=e.contentWindow,E(h);else{var t=function(){e.removeEventListener("load",t),h=e.contentWindow,E(h)};e.addEventListener("load",t)}return function(){h&&h.removeEventListener&&h.removeEventListener("resize",v)}}}),[]),f.position="relative",[i.cloneElement.apply(i,n.__spreadArrays([e,{style:f}],n.__spreadArrays([i.createElement("iframe",{ref:y,style:{background:"transparent",border:"none",height:"100%",left:0,position:"absolute",top:0,width:"100%",zIndex:-1}})],i.Children.toArray(e.props.children)))),b]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=a(146),s=n.__importDefault(a(267)),o=n.__importDefault(a(360)),l=function(){};t.default=function(e,t){void 0===t&&(t={});var a=s.default(),n=i.useRef(!1),c=i.useRef(0),u=i.useRef(0),d=o.default({isSliding:!1,value:0}),p=d[0],m=d[1];return c.current=p.value,i.useEffect((function(){if(r.isClient){var i=void 0===t.styles||t.styles,s=void 0!==t.reverse&&t.reverse;e.current&&i&&(e.current.style.userSelect="none");var o=function(){!n.current&&a()&&((t.onScrubStart||l)(),n.current=!0,m({isSliding:!0}),y())},d=function(){n.current&&a()&&((t.onScrubStop||l)(c.current),n.current=!1,m({isSliding:!1}),h())},p=function(e){o(),b(e)},b=t.vertical?function(e){return v(e.clientY)}:function(e){return v(e.clientX)},g=function(e){o(),f(e)},f=t.vertical?function(e){return v(e.changedTouches[0].clientY)}:function(e){return v(e.changedTouches[0].clientX)},y=function(){r.on(document,"mousemove",b),r.on(document,"mouseup",d),r.on(document,"touchmove",f),r.on(document,"touchend",d)},h=function(){r.off(document,"mousemove",b),r.off(document,"mouseup",d),r.off(document,"touchmove",f),r.off(document,"touchend",d)},v=function(n){cancelAnimationFrame(u.current),u.current=requestAnimationFrame((function(){if(a()&&e.current){var i=e.current.getBoundingClientRect(),r=t.vertical?i.top:i.left,o=t.vertical?i.height:i.width;if(!o)return;var c=(n-r)/o;c>1?c=1:c<0&&(c=0),s&&(c=1-c),m({value:c}),(t.onScrub||l)(c)}}))};return r.on(e.current,"mousedown",p),r.on(e.current,"touchstart",g),function(){r.off(e.current,"mousedown",p),r.off(e.current,"touchstart",g)}}}),[e,t.vertical]),p}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(789)),s=n.__importDefault(a(360)),o="object"==typeof window&&"object"==typeof window.speechSynthesis?window.speechSynthesis.getVoices():[];t.default=function(e,t){void 0===t&&(t={});var a=s.default({isPlaying:!1,lang:t.lang||"default",voice:t.voice||o[0],rate:t.rate||1,pitch:t.pitch||1,volume:t.volume||1}),n=a[0],l=a[1],c=i.useRef(null);return r.default((function(){var a=new SpeechSynthesisUtterance(e);t.lang&&(a.lang=t.lang),t.voice&&(a.voice=t.voice),a.rate=t.rate||1,a.pitch=t.pitch||1,a.volume=t.volume||1,a.onstart=function(){return l({isPlaying:!0})},a.onresume=function(){return l({isPlaying:!0})},a.onend=function(){return l({isPlaying:!1})},a.onpause=function(){return l({isPlaying:!1})},c.current=a,window.speechSynthesis.speak(c.current)})),n}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34).__importDefault(a(35));t.default=function(e){n.default((function(){var t=function(t){var a,n,i,r,s;!function(){var e=document.activeElement,t=document.body;if(!e)return!1;if(e===t)return!1;switch(e.tagName){case"INPUT":case"TEXTAREA":return!0}return e.hasAttribute("contenteditable")}()&&(n=(a=t).keyCode,i=a.metaKey,r=a.ctrlKey,s=a.altKey,!(i||r||s)&&(n>=48&&n<=57||n>=65&&n<=90))&&e(t)};return document.addEventListener("keydown",t),function(){document.removeEventListener("keydown",t)}}),[])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.useStateWithHistory=void 0;var n=a(2),i=a(445),r=a(446);t.useStateWithHistory=function(e,t,a){if(void 0===t&&(t=10),t<1)throw new Error("Capacity has to be greater than 1, got '"+t+"'");var s=i.useFirstMountState(),o=n.useState(e),l=o[0],c=o[1],u=n.useRef(null!=a?a:[]),d=n.useRef(0);return s&&(u.current.length?(u.current[u.current.length-1]!==e&&u.current.push(e),u.current.length>t&&(u.current=u.current.slice(u.current.length-t))):u.current.push(e),d.current=u.current.length&&u.current.length-1),[l,n.useCallback((function(e){c((function(a){return(e=r.resolveHookState(e))!==a&&(d.current<u.current.length-1&&(u.current=u.current.slice(0,d.current+1)),d.current=u.current.push(e)-1,u.current.length>t&&(u.current=u.current.slice(u.current.length-t))),e}))}),[l,t]),n.useMemo((function(){return{history:u.current,position:d.current,capacity:t,back:function(e){void 0===e&&(e=1),d.current&&c((function(){return d.current-=Math.min(e,d.current),u.current[d.current]}))},forward:function(e){void 0===e&&(e=1),d.current!==u.current.length-1&&c((function(){return d.current=Math.min(d.current+e,u.current.length-1),u.current[d.current]}))},go:function(e){e!==d.current&&c((function(){return d.current=e<0?Math.max(u.current.length+e,0):Math.min(u.current.length-1,e),u.current[d.current]}))}}}),[l])]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(267)),s=n.__importDefault(a(308)),o=n.__importDefault(a(359));t.default=function(e){void 0===e&&(e=[]);var t=r.default(),a=s.default(),l=i.useRef(0);o.default((function(){e.length<=l.current&&(l.current=e.length-1,a())}),[e.length]);var c=i.useMemo((function(){return{next:function(){return c.setStateAt(l.current+1)},prev:function(){return c.setStateAt(l.current-1)},setStateAt:function(n){t()&&e.length&&n!==l.current&&(l.current=n>=0?n%e.length:e.length+n%e.length,a())},setState:function(n){if(t()){var i=e.length?e.indexOf(n):-1;if(-1===i)throw new Error("State '"+n+"' is not a valid state (does not exist in state list)");l.current=i,a()}}}}),[e]);return n.__assign({state:e[l.current],currentIndex:l.current},c)}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(448));t.default=function(e,t){void 0===t&&(t=200);var a=i.useState(e),n=a[0],s=a[1],o=i.useRef(),l=i.useRef(null),c=i.useRef(0);return i.useEffect((function(){if(o.current)l.current=e,c.current=!0;else{s(e);var a=function(){c.current?(c.current=!1,s(l.current),o.current=setTimeout(a,t)):o.current=void 0};o.current=setTimeout(a,t)}}),[e]),r.default((function(){o.current&&clearTimeout(o.current)})),n}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(448));t.default=function(e,t,a){void 0===t&&(t=200);var n=i.useState(null),s=n[0],o=n[1],l=i.useRef(),c=i.useRef();return i.useEffect((function(){if(l.current)c.current=a;else{o(e.apply(void 0,a));var n=function(){c.current?(o(e.apply(void 0,c.current)),c.current=void 0,l.current=setTimeout(n,t)):l.current=void 0};l.current=setTimeout(n,t)}}),a),r.default((function(){l.current&&clearTimeout(l.current)})),s}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=n.__importDefault(a(557)),r=n.__importDefault(a(308));t.default=function(e){void 0===e&&(e=0);var t=r.default();return i.default(t,e)}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i={restoreOnUnmount:!1};t.default="undefined"!=typeof document?function(e,t){void 0===t&&(t=i);var a=n.useRef(document.title);document.title=e,n.useEffect((function(){return t&&t.restoreOnUnmount?function(){document.title=a.current}:void 0}),[])}:function(e){}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(1403),r=n.__importDefault(a(791));t.default=function(e,t,a){return void 0===e&&(e="inCirc"),void 0===t&&(t=200),void 0===a&&(a=0),(0,i.easing[e])(r.default(t,a))}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(){var e=n.useRef(!1);return n.useEffect((function(){return function(){e.current=!0}})),n.useMemo((function(){return function(t,a){return new Promise((function(n,i){t.then((function(t){e.current||n(t)}),(function(t){e.current?a?a(t):console.error("useUnmountPromise",t):i(t)}))}))}}),[])}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=n.__importDefault(a(787));t.default=function(e,t){void 0===t&&(t=[]);var a=i.default(t),r=a[0],s=a[1];return[r,n.__assign(n.__assign({},s),{upsert:function(t){s.upsert(e,t)}})]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i="object"==typeof navigator&&"vibrate"in navigator;t.default=i?function(e,t,a){void 0===e&&(e=!0),void 0===t&&(t=[1e3,1e3]),void 0===a&&(a=!0),n.useEffect((function(){var n;if(e&&(navigator.vibrate(t),a)){var i=t instanceof Array?t.reduce((function(e,t){return e+t})):t;n=setInterval((function(){navigator.vibrate(t)}),i)}return function(){e&&(navigator.vibrate(0),a&&clearInterval(n))}}),[e])}:function(){}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34).__importDefault(a(778)).default("video");t.default=n},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2);t.default=function(e,t,a){void 0===a&&(a=[void 0]);var i=n.useRef(t),r=n.useRef(e);i.current=t,r.current=e;var s=n.useState(a),o=s[0],l=s[1],c=n.useCallback((function(){i.current.length>=2?i.current(r.current,l):l(i.current(r.current))}),[l]);return n.useEffect((function(){c()}),[e]),[o,c]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.useScrollbarWidth=void 0;var n=a(1254),i=a(2);t.useScrollbarWidth=function(){var e=i.useState(n.scrollbarWidth()),t=e[0],a=e[1];return i.useEffect((function(){if(void 0===t){var e=requestAnimationFrame((function(){a(n.scrollbarWidth())}));return function(){return cancelAnimationFrame(e)}}}),[]),t}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=function(e){if("undefined"==typeof document)return 0;if(document.body&&(!document.readyState||"loading"!==document.readyState)){if(!0!==e&&"number"==typeof n.__cache)return n.__cache;var t=document.createElement("div"),a=t.style;a.display="block",a.position="absolute",a.width="100px",a.height="100px",a.left="-999px",a.top="-999px",a.overflow="scroll",document.body.insertBefore(t,null);var i=t.clientWidth;if(0!==i)return n.__cache=100-i,document.body.removeChild(t),n.__cache;document.body.removeChild(t)}};t.scrollbarWidth=n},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.useMultiStateValidator=void 0;var n=a(2);t.useMultiStateValidator=function(e,t,a){if(void 0===a&&(a=[void 0]),"object"!=typeof e)throw new Error("states expected to be an object or array, got "+typeof e);var i=n.useRef(t),r=n.useRef(e);i.current=t,r.current=e;var s=n.useState(a),o=s[0],l=s[1],c=n.useCallback((function(){i.current.length>=2?i.current(r.current,l):l(i.current(r.current))}),[l]);return n.useEffect((function(){c()}),Object.values(e)),[o,c]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=a(146),s=n.__importDefault(a(362));t.default=function(){var e=s.default({x:r.isClient?window.pageXOffset:0,y:r.isClient?window.pageYOffset:0}),t=e[0],a=e[1];return i.useEffect((function(){var e=function(){a({x:window.pageXOffset,y:window.pageYOffset})};return window.addEventListener("scroll",e,{capture:!1,passive:!0}),function(){window.removeEventListener("scroll",e)}}),[]),t}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(362)),s=a(146);t.default=function(e,t){void 0===e&&(e=1/0),void 0===t&&(t=1/0);var a=r.default({width:s.isClient?window.innerWidth:e,height:s.isClient?window.innerHeight:t}),n=a[0],o=a[1];return i.useEffect((function(){if(s.isClient){var e=function(){o({width:window.innerWidth,height:window.innerHeight})};return window.addEventListener("resize",e),function(){window.removeEventListener("resize",e)}}}),[]),n}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2),r=n.__importDefault(a(35)),s=a(146),o={x:0,y:0,width:0,height:0,top:0,left:0,bottom:0,right:0};t.default=s.isClient&&window.ResizeObserver?function(){var e=i.useState(null),t=e[0],a=e[1],n=i.useState(o),s=n[0],l=n[1],c=i.useMemo((function(){return new window.ResizeObserver((function(e){if(e[0]){var t=e[0].contentRect,a=t.x,n=t.y,i=t.width,r=t.height,s=t.top,o=t.left,c=t.bottom,u=t.right;l({x:a,y:n,width:i,height:r,top:s,left:o,bottom:c,right:u})}}))}),[]);return r.default((function(){if(t)return c.observe(t),function(){c.disconnect()}}),[t]),[a,s]}:function(){return[function(){},o]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.useRendersCount=void 0;var n=a(2);t.useRendersCount=function(){return++n.useRef(0).current}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(34),i=a(2);t.default=function(e){void 0===e&&(e=new Set);var t=i.useState(e),a=t[0],r=t[1],s=i.useMemo((function(){return{add:function(e){return r((function(t){return new Set(n.__spreadArrays(Array.from(t),[e]))}))},remove:function(e){return r((function(t){return new Set(Array.from(t).filter((function(t){return t!==e})))}))},toggle:function(e){return r((function(t){return t.has(e)?new Set(Array.from(t).filter((function(t){return t!==e}))):new Set(n.__spreadArrays(Array.from(t),[e]))}))},reset:function(){return r(e)}}}),[r]),o=n.__assign({has:i.useCallback((function(e){return a.has(e)}),[a])},s);return[a,o]}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.createGlobalState=void 0;var n=a(34),i=a(2),r=n.__importDefault(a(361)),s=n.__importDefault(a(35));function o(e){var t={state:e,setState:function(e){t.state=e,t.setters.forEach((function(e){return e(t.state)}))},setters:[]};return function(){var e=i.useState(t.state),a=e[0],n=e[1];return r.default((function(){return function(){t.setters=t.setters.filter((function(e){return e!==n}))}})),s.default((function(){t.setters.includes(n)||t.setters.push(n)})),[a,t.setState]}}t.createGlobalState=o,t.default=o},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0}),t.useHash=void 0;var n=a(34),i=a(2),r=n.__importDefault(a(786));t.useHash=function(){var e=i.useState((function(){return window.location.hash})),t=e[0],a=e[1],n=i.useCallback((function(){a(window.location.hash)}),[]);r.default((function(){window.addEventListener("hashchange",n)}),(function(){window.removeEventListener("hashchange",n)}));var s=i.useCallback((function(e){e!==t&&(window.location.hash=e)}),[t]);return[t,s]}},,function(e,t){},function(e,t,a){e.exports=a(33)(1734)},function(e,t,a){"use strict";a.d(t,"a",(function(){return s}));var n=a(0),i=a.n(n);const r="".padStart(2);class LineWriter{constructor(e="\n"){i()(this,"_indent",""),i()(this,"_lines",[]),i()(this,"_separator",void 0),this._indent="",this._lines=[],this._separator=e}addLine(e){this._lines.push(`${this._indent}${e}`)}addLineAndIndent(e){this._lines.push(`${this._indent}${e}`),this._indent=`${this._indent}${r}`}dedentAndAddLine(e){this._indent=this._indent.substr(2),this._lines.push(`${this._indent}${e}`)}indent(){this._indent=`${this._indent}${r}`}dedent(){this._indent=this._indent.substr(2)}getContent(){return this._lines.join(this._separator)}}const s=(e="\n")=>new LineWriter(e)},function(e,t,a){e.exports=a.p+"94cccf20036d014924e63d4d595e88e1.svg"},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(2),i=a(64),r=function(e,t){return r=Object.setPrototypeOf||{__proto__:[]}instanceof Array&&function(e,t){e.__proto__=t}||function(e,t){for(var a in t)Object.prototype.hasOwnProperty.call(t,a)&&(e[a]=t[a])},r(e,t)};function s(e,t){function a(){this.constructor=e}r(e,t),e.prototype=null===t?Object.create(t):(a.prototype=t.prototype,new a)}var o=function(){return o=Object.assign||function(e){for(var t,a=1,n=arguments.length;a<n;a++)for(var i in t=arguments[a])Object.prototype.hasOwnProperty.call(t,i)&&(e[i]=t[i]);return e},o.apply(this,arguments)},l={width:"100%",height:"10px",top:"0px",left:"0px",cursor:"row-resize"},c={width:"10px",height:"100%",top:"0px",left:"0px",cursor:"col-resize"},u={width:"20px",height:"20px",position:"absolute"},d={top:o(o({},l),{top:"-5px"}),right:o(o({},c),{left:void 0,right:"-5px"}),bottom:o(o({},l),{top:void 0,bottom:"-5px"}),left:o(o({},c),{left:"-5px"}),topRight:o(o({},u),{right:"-10px",top:"-10px",cursor:"ne-resize"}),bottomRight:o(o({},u),{right:"-10px",bottom:"-10px",cursor:"se-resize"}),bottomLeft:o(o({},u),{left:"-10px",bottom:"-10px",cursor:"sw-resize"}),topLeft:o(o({},u),{left:"-10px",top:"-10px",cursor:"nw-resize"})},p=function(e){function t(){var t=null!==e&&e.apply(this,arguments)||this;return t.onMouseDown=function(e){t.props.onResizeStart(e,t.props.direction)},t.onTouchStart=function(e){t.props.onResizeStart(e,t.props.direction)},t}return s(t,e),t.prototype.render=function(){return n.createElement("div",{className:this.props.className||"",style:o(o({position:"absolute",userSelect:"none"},d[this.props.direction]),this.props.replaceStyles||{}),onMouseDown:this.onMouseDown,onTouchStart:this.onTouchStart},this.props.children)},t}(n.PureComponent),m={width:"auto",height:"auto"},b=function(e,t,a){return Math.max(Math.min(e,a),t)},g=function(e,t){return Math.round(e/t)*t},f=function(e,t){return new RegExp(e,"i").test(t)},y=function(e){return Boolean(e.touches&&e.touches.length)},h=function(e,t,a){void 0===a&&(a=0);var n=t.reduce((function(a,n,i){return Math.abs(n-e)<Math.abs(t[a]-e)?i:a}),0),i=Math.abs(t[n]-e);return 0===a||i<a?t[n]:e},v=function(e){return"auto"===(e=e.toString())||e.endsWith("px")||e.endsWith("%")||e.endsWith("vh")||e.endsWith("vw")||e.endsWith("vmax")||e.endsWith("vmin")?e:e+"px"},E=function(e,t,a,n){if(e&&"string"==typeof e){if(e.endsWith("px"))return Number(e.replace("px",""));if(e.endsWith("%"))return t*(Number(e.replace("%",""))/100);if(e.endsWith("vw"))return a*(Number(e.replace("vw",""))/100);if(e.endsWith("vh"))return n*(Number(e.replace("vh",""))/100)}return e},x=["as","style","className","grid","snap","bounds","boundsByDirection","size","defaultSize","minWidth","minHeight","maxWidth","maxHeight","lockAspectRatio","lockAspectRatioExtraWidth","lockAspectRatioExtraHeight","enable","handleStyles","handleClasses","handleWrapperStyle","handleWrapperClass","children","onResizeStart","onResize","onResizeStop","handleComponent","scale","resizeRatio","snapGap"],j="__resizable_base__",S=function(e){function t(t){var a=e.call(this,t)||this;return a.ratio=1,a.resizable=null,a.parentLeft=0,a.parentTop=0,a.resizableLeft=0,a.resizableRight=0,a.resizableTop=0,a.resizableBottom=0,a.targetLeft=0,a.targetTop=0,a.appendBase=function(){if(!a.resizable||!a.window)return null;var e=a.parentNode;if(!e)return null;var t=a.window.document.createElement("div");return t.style.width="100%",t.style.height="100%",t.style.position="absolute",t.style.transform="scale(0, 0)",t.style.left="0",t.style.flex="0 0 100%",t.classList?t.classList.add(j):t.className+=j,e.appendChild(t),t},a.removeBase=function(e){var t=a.parentNode;t&&t.removeChild(e)},a.ref=function(e){e&&(a.resizable=e)},a.state={isResizing:!1,width:void 0===(a.propsSize&&a.propsSize.width)?"auto":a.propsSize&&a.propsSize.width,height:void 0===(a.propsSize&&a.propsSize.height)?"auto":a.propsSize&&a.propsSize.height,direction:"right",original:{x:0,y:0,width:0,height:0},backgroundStyle:{height:"100%",width:"100%",backgroundColor:"rgba(0,0,0,0)",cursor:"auto",opacity:0,position:"fixed",zIndex:9999,top:"0",left:"0",bottom:"0",right:"0"},flexBasis:void 0},a.onResizeStart=a.onResizeStart.bind(a),a.onMouseMove=a.onMouseMove.bind(a),a.onMouseUp=a.onMouseUp.bind(a),a}return s(t,e),Object.defineProperty(t.prototype,"parentNode",{get:function(){return this.resizable?this.resizable.parentNode:null},enumerable:!1,configurable:!0}),Object.defineProperty(t.prototype,"window",{get:function(){return this.resizable&&this.resizable.ownerDocument?this.resizable.ownerDocument.defaultView:null},enumerable:!1,configurable:!0}),Object.defineProperty(t.prototype,"propsSize",{get:function(){return this.props.size||this.props.defaultSize||m},enumerable:!1,configurable:!0}),Object.defineProperty(t.prototype,"size",{get:function(){var e=0,t=0;if(this.resizable&&this.window){var a=this.resizable.offsetWidth,n=this.resizable.offsetHeight,i=this.resizable.style.position;"relative"!==i&&(this.resizable.style.position="relative"),e="auto"!==this.resizable.style.width?this.resizable.offsetWidth:a,t="auto"!==this.resizable.style.height?this.resizable.offsetHeight:n,this.resizable.style.position=i}return{width:e,height:t}},enumerable:!1,configurable:!0}),Object.defineProperty(t.prototype,"sizeStyle",{get:function(){var e=this,t=this.props.size,a=function(t){if(void 0===e.state[t]||"auto"===e.state[t])return"auto";if(e.propsSize&&e.propsSize[t]&&e.propsSize[t].toString().endsWith("%")){if(e.state[t].toString().endsWith("%"))return e.state[t].toString();var a=e.getParentSize();return Number(e.state[t].toString().replace("px",""))/a[t]*100+"%"}return v(e.state[t])};return{width:t&&void 0!==t.width&&!this.state.isResizing?v(t.width):a("width"),height:t&&void 0!==t.height&&!this.state.isResizing?v(t.height):a("height")}},enumerable:!1,configurable:!0}),t.prototype.getParentSize=function(){if(!this.parentNode)return this.window?{width:this.window.innerWidth,height:this.window.innerHeight}:{width:0,height:0};var e=this.appendBase();if(!e)return{width:0,height:0};var t=!1,a=this.parentNode.style.flexWrap;"wrap"!==a&&(t=!0,this.parentNode.style.flexWrap="wrap"),e.style.position="relative",e.style.minWidth="100%",e.style.minHeight="100%";var n={width:e.offsetWidth,height:e.offsetHeight};return t&&(this.parentNode.style.flexWrap=a),this.removeBase(e),n},t.prototype.bindEvents=function(){this.window&&(this.window.addEventListener("mouseup",this.onMouseUp),this.window.addEventListener("mousemove",this.onMouseMove),this.window.addEventListener("mouseleave",this.onMouseUp),this.window.addEventListener("touchmove",this.onMouseMove,{capture:!0,passive:!1}),this.window.addEventListener("touchend",this.onMouseUp))},t.prototype.unbindEvents=function(){this.window&&(this.window.removeEventListener("mouseup",this.onMouseUp),this.window.removeEventListener("mousemove",this.onMouseMove),this.window.removeEventListener("mouseleave",this.onMouseUp),this.window.removeEventListener("touchmove",this.onMouseMove,!0),this.window.removeEventListener("touchend",this.onMouseUp))},t.prototype.componentDidMount=function(){if(this.resizable&&this.window){var e=this.window.getComputedStyle(this.resizable);this.setState({width:this.state.width||this.size.width,height:this.state.height||this.size.height,flexBasis:"auto"!==e.flexBasis?e.flexBasis:void 0})}},t.prototype.componentWillUnmount=function(){this.window&&this.unbindEvents()},t.prototype.createSizeForCssProperty=function(e,t){var a=this.propsSize&&this.propsSize[t];return"auto"!==this.state[t]||this.state.original[t]!==e||void 0!==a&&"auto"!==a?e:"auto"},t.prototype.calculateNewMaxFromBoundary=function(e,t){var a,n,i=this.props.boundsByDirection,r=this.state.direction,s=i&&f("left",r),o=i&&f("top",r);if("parent"===this.props.bounds){var l=this.parentNode;l&&(a=s?this.resizableRight-this.parentLeft:l.offsetWidth+(this.parentLeft-this.resizableLeft),n=o?this.resizableBottom-this.parentTop:l.offsetHeight+(this.parentTop-this.resizableTop))}else"window"===this.props.bounds?this.window&&(a=s?this.resizableRight:this.window.innerWidth-this.resizableLeft,n=o?this.resizableBottom:this.window.innerHeight-this.resizableTop):this.props.bounds&&(a=s?this.resizableRight-this.targetLeft:this.props.bounds.offsetWidth+(this.targetLeft-this.resizableLeft),n=o?this.resizableBottom-this.targetTop:this.props.bounds.offsetHeight+(this.targetTop-this.resizableTop));return a&&Number.isFinite(a)&&(e=e&&e<a?e:a),n&&Number.isFinite(n)&&(t=t&&t<n?t:n),{maxWidth:e,maxHeight:t}},t.prototype.calculateNewSizeFromDirection=function(e,t){var a=this.props.scale||1,n=this.props.resizeRatio||1,i=this.state,r=i.direction,s=i.original,o=this.props,l=o.lockAspectRatio,c=o.lockAspectRatioExtraHeight,u=o.lockAspectRatioExtraWidth,d=s.width,p=s.height,m=c||0,b=u||0;return f("right",r)&&(d=s.width+(e-s.x)*n/a,l&&(p=(d-b)/this.ratio+m)),f("left",r)&&(d=s.width-(e-s.x)*n/a,l&&(p=(d-b)/this.ratio+m)),f("bottom",r)&&(p=s.height+(t-s.y)*n/a,l&&(d=(p-m)*this.ratio+b)),f("top",r)&&(p=s.height-(t-s.y)*n/a,l&&(d=(p-m)*this.ratio+b)),{newWidth:d,newHeight:p}},t.prototype.calculateNewSizeFromAspectRatio=function(e,t,a,n){var i=this.props,r=i.lockAspectRatio,s=i.lockAspectRatioExtraHeight,o=i.lockAspectRatioExtraWidth,l=void 0===n.width?10:n.width,c=void 0===a.width||a.width<0?e:a.width,u=void 0===n.height?10:n.height,d=void 0===a.height||a.height<0?t:a.height,p=s||0,m=o||0;if(r){var g=(u-p)*this.ratio+m,f=(d-p)*this.ratio+m,y=(l-m)/this.ratio+p,h=(c-m)/this.ratio+p,v=Math.max(l,g),E=Math.min(c,f),x=Math.max(u,y),j=Math.min(d,h);e=b(e,v,E),t=b(t,x,j)}else e=b(e,l,c),t=b(t,u,d);return{newWidth:e,newHeight:t}},t.prototype.setBoundingClientRect=function(){if("parent"===this.props.bounds){var e=this.parentNode;if(e){var t=e.getBoundingClientRect();this.parentLeft=t.left,this.parentTop=t.top}}if(this.props.bounds&&"string"!=typeof this.props.bounds){var a=this.props.bounds.getBoundingClientRect();this.targetLeft=a.left,this.targetTop=a.top}if(this.resizable){var n=this.resizable.getBoundingClientRect(),i=n.left,r=n.top,s=n.right,o=n.bottom;this.resizableLeft=i,this.resizableRight=s,this.resizableTop=r,this.resizableBottom=o}},t.prototype.onResizeStart=function(e,t){if(this.resizable&&this.window){var a,n=0,i=0;if(e.nativeEvent&&function(e){return Boolean((e.clientX||0===e.clientX)&&(e.clientY||0===e.clientY))}(e.nativeEvent)?(n=e.nativeEvent.clientX,i=e.nativeEvent.clientY):e.nativeEvent&&y(e.nativeEvent)&&(n=e.nativeEvent.touches[0].clientX,i=e.nativeEvent.touches[0].clientY),this.props.onResizeStart&&this.resizable&&!1===this.props.onResizeStart(e,t,this.resizable))return;this.props.size&&(void 0!==this.props.size.height&&this.props.size.height!==this.state.height&&this.setState({height:this.props.size.height}),void 0!==this.props.size.width&&this.props.size.width!==this.state.width&&this.setState({width:this.props.size.width})),this.ratio="number"==typeof this.props.lockAspectRatio?this.props.lockAspectRatio:this.size.width/this.size.height;var r=this.window.getComputedStyle(this.resizable);if("auto"!==r.flexBasis){var s=this.parentNode;if(s){var l=this.window.getComputedStyle(s).flexDirection;this.flexDir=l.startsWith("row")?"row":"column",a=r.flexBasis}}this.setBoundingClientRect(),this.bindEvents();var c={original:{x:n,y:i,width:this.size.width,height:this.size.height},isResizing:!0,backgroundStyle:o(o({},this.state.backgroundStyle),{cursor:this.window.getComputedStyle(e.target).cursor||"auto"}),direction:t,flexBasis:a};this.setState(c)}},t.prototype.onMouseMove=function(e){var t=this;if(this.state.isResizing&&this.resizable&&this.window){if(this.window.TouchEvent&&y(e))try{e.preventDefault(),e.stopPropagation()}catch(e){}var a=this.props,n=a.maxWidth,r=a.maxHeight,s=a.minWidth,o=a.minHeight,l=y(e)?e.touches[0].clientX:e.clientX,c=y(e)?e.touches[0].clientY:e.clientY,u=this.state,d=u.direction,p=u.original,m=u.width,b=u.height,f=this.getParentSize(),v=function(e,t,a,n,i,r,s){return n=E(n,e.width,t,a),i=E(i,e.height,t,a),r=E(r,e.width,t,a),s=E(s,e.height,t,a),{maxWidth:void 0===n?void 0:Number(n),maxHeight:void 0===i?void 0:Number(i),minWidth:void 0===r?void 0:Number(r),minHeight:void 0===s?void 0:Number(s)}}(f,this.window.innerWidth,this.window.innerHeight,n,r,s,o);n=v.maxWidth,r=v.maxHeight,s=v.minWidth,o=v.minHeight;var x=this.calculateNewSizeFromDirection(l,c),j=x.newHeight,S=x.newWidth,k=this.calculateNewMaxFromBoundary(n,r);this.props.snap&&this.props.snap.x&&(S=h(S,this.props.snap.x,this.props.snapGap)),this.props.snap&&this.props.snap.y&&(j=h(j,this.props.snap.y,this.props.snapGap));var O=this.calculateNewSizeFromAspectRatio(S,j,{width:k.maxWidth,height:k.maxHeight},{width:s,height:o});if(S=O.newWidth,j=O.newHeight,this.props.grid){var w=g(S,this.props.grid[0]),T=g(j,this.props.grid[1]),I=this.props.snapGap||0;S=0===I||Math.abs(w-S)<=I?w:S,j=0===I||Math.abs(T-j)<=I?T:j}var C={width:S-p.width,height:j-p.height};m&&"string"==typeof m&&(m.endsWith("%")?S=S/f.width*100+"%":m.endsWith("vw")?S=S/this.window.innerWidth*100+"vw":m.endsWith("vh")&&(S=S/this.window.innerHeight*100+"vh")),b&&"string"==typeof b&&(b.endsWith("%")?j=j/f.height*100+"%":b.endsWith("vw")?j=j/this.window.innerWidth*100+"vw":b.endsWith("vh")&&(j=j/this.window.innerHeight*100+"vh"));var M={width:this.createSizeForCssProperty(S,"width"),height:this.createSizeForCssProperty(j,"height")};"row"===this.flexDir?M.flexBasis=M.width:"column"===this.flexDir&&(M.flexBasis=M.height),i.flushSync((function(){t.setState(M)})),this.props.onResize&&this.props.onResize(e,d,this.resizable,C)}},t.prototype.onMouseUp=function(e){var t=this.state,a=t.isResizing,n=t.direction,i=t.original;if(a&&this.resizable){var r={width:this.size.width-i.width,height:this.size.height-i.height};this.props.onResizeStop&&this.props.onResizeStop(e,n,this.resizable,r),this.props.size&&this.setState(this.props.size),this.unbindEvents(),this.setState({isResizing:!1,backgroundStyle:o(o({},this.state.backgroundStyle),{cursor:"auto"})})}},t.prototype.updateSize=function(e){this.setState({width:e.width,height:e.height})},t.prototype.renderResizer=function(){var e=this,t=this.props,a=t.enable,i=t.handleStyles,r=t.handleClasses,s=t.handleWrapperStyle,o=t.handleWrapperClass,l=t.handleComponent;if(!a)return null;var c=Object.keys(a).map((function(t){return!1!==a[t]?n.createElement(p,{key:t,direction:t,onResizeStart:e.onResizeStart,replaceStyles:i&&i[t],className:r&&r[t]},l&&l[t]?l[t]:null):null}));return n.createElement("div",{className:o,style:s},c)},t.prototype.render=function(){var e=this,t=Object.keys(this.props).reduce((function(t,a){return-1!==x.indexOf(a)||(t[a]=e.props[a]),t}),{}),a=o(o(o({position:"relative",userSelect:this.state.isResizing?"none":"auto"},this.props.style),this.sizeStyle),{maxWidth:this.props.maxWidth,maxHeight:this.props.maxHeight,minWidth:this.props.minWidth,minHeight:this.props.minHeight,boxSizing:"border-box",flexShrink:0});this.state.flexBasis&&(a.flexBasis=this.state.flexBasis);var i=this.props.as||"div";return n.createElement(i,o({ref:this.ref,style:a,className:this.props.className},t),this.state.isResizing&&n.createElement("div",{style:this.state.backgroundStyle}),this.props.children,this.renderResizer())},t.defaultProps={as:"div",onResizeStart:function(){},onResize:function(){},onResizeStop:function(){},enable:{top:!0,right:!0,bottom:!0,left:!0,topRight:!0,bottomRight:!0,bottomLeft:!0,topLeft:!0},style:{},grid:[1,1],lockAspectRatio:!1,lockAspectRatioExtraWidth:0,lockAspectRatioExtraHeight:0,scale:1,resizeRatio:1,snapGap:0},t}(n.PureComponent);t.Resizable=S},function(e,t,a){switch(window.__kbnThemeTag__){case"v8dark":return a(1270);case"v8light":return a(1272)}},function(e,t,a){var n=a(256),i=a(1271);"string"==typeof(i=i.__esModule?i.default:i)&&(i=[[e.i,i,""]]);n(i,{insert:"head",singleton:!1}),e.exports=i.locals||{}},function(e,t,a){(t=a(257)(!1)).push([e.i,".kbnFieldButton{align-items:flex-start;border-radius:6px;display:flex;font-size:14px;font-size:1rem;line-height:1.71429rem;margin-bottom:4px;padding:0 8px;transition:box-shadow .15s cubic-bezier(.694,.0482,.335,1),background-color .15s cubic-bezier(.694,.0482,.335,1)}.kbnFieldButton-isActive,.kbnFieldButton:focus-within{outline:2px solid currentColor}.kbnFieldButton-isActive:focus-visible,.kbnFieldButton:focus-within:focus-visible{outline-style:auto}.kbnFieldButton-isActive:not(:focus-visible),.kbnFieldButton:focus-within:not(:focus-visible){outline:none}.kbnFieldButton__button{align-items:flex-start;display:flex;flex-grow:1;line-height:normal;padding:8px 0;text-align:left}.kbnFieldButton__fieldIcon{flex-shrink:0;line-height:0}.kbnFieldButton__name{flex-grow:1;padding:0 8px;word-break:break-word}.kbnFieldButton__infoIcon{align-items:center;display:flex;flex-shrink:0;justify-content:center;line-height:0;min-height:16px}.kbnFieldButton__fieldAction{margin-left:8px}.kbnFieldButton__dragHandle{margin-right:8px}.kbnFieldButton__dragHandle,.kbnFieldButton__fieldAction{line-height:32px}.kbnFieldButton--xs{font-size:12px}.kbnFieldButton--xs .kbnFieldButton__button{padding:4px 0}.kbnFieldButton--xs .kbnFieldButton__fieldAction{margin-left:4px}.kbnFieldButton--xs .kbnFieldButton__dragHandle,.kbnFieldButton--xs .kbnFieldButton__fieldAction{line-height:24px}.kbnFieldButton--flushBoth{padding-left:0;padding-right:0}",""]),e.exports=t},function(e,t,a){var n=a(256),i=a(1273);"string"==typeof(i=i.__esModule?i.default:i)&&(i=[[e.i,i,""]]);n(i,{insert:"head",singleton:!1}),e.exports=i.locals||{}},function(e,t,a){(t=a(257)(!1)).push([e.i,".kbnFieldButton{align-items:flex-start;border-radius:6px;display:flex;font-size:14px;font-size:1rem;line-height:1.71429rem;margin-bottom:4px;padding:0 8px;transition:box-shadow .15s cubic-bezier(.694,.0482,.335,1),background-color .15s cubic-bezier(.694,.0482,.335,1)}.kbnFieldButton-isActive,.kbnFieldButton:focus-within{outline:2px solid currentColor}.kbnFieldButton-isActive:focus-visible,.kbnFieldButton:focus-within:focus-visible{outline-style:auto}.kbnFieldButton-isActive:not(:focus-visible),.kbnFieldButton:focus-within:not(:focus-visible){outline:none}.kbnFieldButton__button{align-items:flex-start;display:flex;flex-grow:1;line-height:normal;padding:8px 0;text-align:left}.kbnFieldButton__fieldIcon{flex-shrink:0;line-height:0}.kbnFieldButton__name{flex-grow:1;padding:0 8px;word-break:break-word}.kbnFieldButton__infoIcon{align-items:center;display:flex;flex-shrink:0;justify-content:center;line-height:0;min-height:16px}.kbnFieldButton__fieldAction{margin-left:8px}.kbnFieldButton__dragHandle{margin-right:8px}.kbnFieldButton__dragHandle,.kbnFieldButton__fieldAction{line-height:32px}.kbnFieldButton--xs{font-size:12px}.kbnFieldButton--xs .kbnFieldButton__button{padding:4px 0}.kbnFieldButton--xs .kbnFieldButton__fieldAction{margin-left:4px}.kbnFieldButton--xs .kbnFieldButton__dragHandle,.kbnFieldButton--xs .kbnFieldButton__fieldAction{line-height:24px}.kbnFieldButton--flushBoth{padding-left:0;padding-right:0}",""]),e.exports=t},function(e,t){e.exports="data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iOCIgaGVpZ2h0PSI4IiBmaWxsPSJub25lIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxwYXRoIGZpbGwtcnVsZT0iZXZlbm9kZCIgY2xpcC1ydWxlPSJldmVub2RkIiBkPSJNMSAwSDB2OGg4VjdIMVYweiIgZmlsbD0iI0QzREFFNiIvPjwvc3ZnPg=="},function(e,t,a){!function(e,t,a,n,i,r){"use strict";function s(e,t){switch(arguments.length){case 0:break;case 1:this.range(e);break;default:this.range(t).domain(e)}return this}function o(e,t){switch(arguments.length){case 0:break;case 1:"function"==typeof e?this.interpolator(e):this.range(e);break;default:this.domain(e),"function"==typeof t?this.interpolator(t):this.range(t)}return this}const l=Symbol("implicit");function c(){var e=new Map,t=[],a=[],n=l;function i(i){var r=i+"",s=e.get(r);if(!s){if(n!==l)return n;e.set(r,s=t.push(i))}return a[(s-1)%a.length]}return i.domain=function(a){if(!arguments.length)return t.slice();t=[],e=new Map;for(const n of a){const a=n+"";e.has(a)||e.set(a,t.push(n))}return i},i.range=function(e){return arguments.length?(a=Array.from(e),i):a.slice()},i.unknown=function(e){return arguments.length?(n=e,i):n},i.copy=function(){return c(t,a).unknown(n)},s.apply(i,arguments),i}function u(){var e,a,n=c().unknown(void 0),i=n.domain,r=n.range,o=0,l=1,d=!1,p=0,m=0,b=.5;function g(){var n=i().length,s=l<o,c=s?l:o,u=s?o:l;e=(u-c)/Math.max(1,n-p+2*m),d&&(e=Math.floor(e)),c+=(u-c-e*(n-p))*b,a=e*(1-p),d&&(c=Math.round(c),a=Math.round(a));var g=t.range(n).map((function(t){return c+e*t}));return r(s?g.reverse():g)}return delete n.unknown,n.domain=function(e){return arguments.length?(i(e),g()):i()},n.range=function(e){return arguments.length?([o,l]=e,o=+o,l=+l,g()):[o,l]},n.rangeRound=function(e){return[o,l]=e,o=+o,l=+l,d=!0,g()},n.bandwidth=function(){return a},n.step=function(){return e},n.round=function(e){return arguments.length?(d=!!e,g()):d},n.padding=function(e){return arguments.length?(p=Math.min(1,m=+e),g()):p},n.paddingInner=function(e){return arguments.length?(p=Math.min(1,e),g()):p},n.paddingOuter=function(e){return arguments.length?(m=+e,g()):m},n.align=function(e){return arguments.length?(b=Math.max(0,Math.min(1,e)),g()):b},n.copy=function(){return u(i(),[o,l]).round(d).paddingInner(p).paddingOuter(m).align(b)},s.apply(g(),arguments)}function d(e){var t=e.copy;return e.padding=e.paddingOuter,delete e.paddingInner,delete e.paddingOuter,e.copy=function(){return d(t())},e}function p(e){return+e}var m=[0,1];function b(e){return e}function g(e,t){return(t-=e=+e)?function(a){return(a-e)/t}:(a=isNaN(t)?NaN:.5,function(){return a});var a}function f(e,t,a){var n=e[0],i=e[1],r=t[0],s=t[1];return i<n?(n=g(i,n),r=a(s,r)):(n=g(n,i),r=a(r,s)),function(e){return r(n(e))}}function y(e,a,n){var i=Math.min(e.length,a.length)-1,r=new Array(i),s=new Array(i),o=-1;for(e[i]<e[0]&&(e=e.slice().reverse(),a=a.slice().reverse());++o<i;)r[o]=g(e[o],e[o+1]),s[o]=n(a[o],a[o+1]);return function(a){var n=t.bisect(e,a,1,i)-1;return s[n](r[n](a))}}function h(e,t){return t.domain(e.domain()).range(e.range()).interpolate(e.interpolate()).clamp(e.clamp()).unknown(e.unknown())}function v(){var e,t,n,i,r,s,o=m,l=m,c=a.interpolate,u=b;function d(){var e,t,a,n=Math.min(o.length,l.length);return u!==b&&(e=o[0],t=o[n-1],e>t&&(a=e,e=t,t=a),u=function(a){return Math.max(e,Math.min(t,a))}),i=n>2?y:f,r=s=null,g}function g(t){return null==t||isNaN(t=+t)?n:(r||(r=i(o.map(e),l,c)))(e(u(t)))}return g.invert=function(n){return u(t((s||(s=i(l,o.map(e),a.interpolateNumber)))(n)))},g.domain=function(e){return arguments.length?(o=Array.from(e,p),d()):o.slice()},g.range=function(e){return arguments.length?(l=Array.from(e),d()):l.slice()},g.rangeRound=function(e){return l=Array.from(e),c=a.interpolateRound,d()},g.clamp=function(e){return arguments.length?(u=!!e||b,d()):u!==b},g.interpolate=function(e){return arguments.length?(c=e,d()):c},g.unknown=function(e){return arguments.length?(n=e,g):n},function(a,n){return e=a,t=n,d()}}function E(){return v()(b,b)}function x(e,a,i,r){var s,o=t.tickStep(e,a,i);switch((r=n.formatSpecifier(null==r?",f":r)).type){case"s":var l=Math.max(Math.abs(e),Math.abs(a));return null!=r.precision||isNaN(s=n.precisionPrefix(o,l))||(r.precision=s),n.formatPrefix(r,l);case"":case"e":case"g":case"p":case"r":null!=r.precision||isNaN(s=n.precisionRound(o,Math.max(Math.abs(e),Math.abs(a))))||(r.precision=s-("e"===r.type));break;case"f":case"%":null!=r.precision||isNaN(s=n.precisionFixed(o))||(r.precision=s-2*("%"===r.type))}return n.format(r)}function j(e){var a=e.domain;return e.ticks=function(e){var n=a();return t.ticks(n[0],n[n.length-1],null==e?10:e)},e.tickFormat=function(e,t){var n=a();return x(n[0],n[n.length-1],null==e?10:e,t)},e.nice=function(n){null==n&&(n=10);var i,r,s=a(),o=0,l=s.length-1,c=s[o],u=s[l],d=10;for(u<c&&(r=c,c=u,u=r,r=o,o=l,l=r);d-- >0;){if((r=t.tickIncrement(c,u,n))===i)return s[o]=c,s[l]=u,a(s);if(r>0)c=Math.floor(c/r)*r,u=Math.ceil(u/r)*r;else{if(!(r<0))break;c=Math.ceil(c*r)/r,u=Math.floor(u*r)/r}i=r}return e},e}function S(e,t){var a,n=0,i=(e=e.slice()).length-1,r=e[n],s=e[i];return s<r&&(a=n,n=i,i=a,a=r,r=s,s=a),e[n]=t.floor(r),e[i]=t.ceil(s),e}function k(e){return Math.log(e)}function O(e){return Math.exp(e)}function w(e){return-Math.log(-e)}function T(e){return-Math.exp(-e)}function I(e){return isFinite(e)?+("1e"+e):e<0?0:e}function C(e){return function(t){return-e(-t)}}function M(e){var a,i,r=e(k,O),s=r.domain,o=10;function l(){return a=function(e){return e===Math.E?Math.log:10===e&&Math.log10||2===e&&Math.log2||(e=Math.log(e),function(t){return Math.log(t)/e})}(o),i=function(e){return 10===e?I:e===Math.E?Math.exp:function(t){return Math.pow(e,t)}}(o),s()[0]<0?(a=C(a),i=C(i),e(w,T)):e(k,O),r}return r.base=function(e){return arguments.length?(o=+e,l()):o},r.domain=function(e){return arguments.length?(s(e),l()):s()},r.ticks=function(e){var n,r=s(),l=r[0],c=r[r.length-1];(n=c<l)&&(m=l,l=c,c=m);var u,d,p,m=a(l),b=a(c),g=null==e?10:+e,f=[];if(!(o%1)&&b-m<g){if(m=Math.floor(m),b=Math.ceil(b),l>0){for(;m<=b;++m)for(d=1,u=i(m);d<o;++d)if(!((p=u*d)<l)){if(p>c)break;f.push(p)}}else for(;m<=b;++m)for(d=o-1,u=i(m);d>=1;--d)if(!((p=u*d)<l)){if(p>c)break;f.push(p)}2*f.length<g&&(f=t.ticks(l,c,g))}else f=t.ticks(m,b,Math.min(b-m,g)).map(i);return n?f.reverse():f},r.tickFormat=function(e,t){if(null==t&&(t=10===o?".0e":","),"function"!=typeof t&&(t=n.format(t)),e===1/0)return t;null==e&&(e=10);var s=Math.max(1,o*e/r.ticks().length);return function(e){var n=e/i(Math.round(a(e)));return n*o<o-.5&&(n*=o),n<=s?t(e):""}},r.nice=function(){return s(S(s(),{floor:function(e){return i(Math.floor(a(e)))},ceil:function(e){return i(Math.ceil(a(e)))}}))},r}function _(e){return function(t){return Math.sign(t)*Math.log1p(Math.abs(t/e))}}function F(e){return function(t){return Math.sign(t)*Math.expm1(Math.abs(t))*e}}function A(e){var t=1,a=e(_(t),F(t));return a.constant=function(a){return arguments.length?e(_(t=+a),F(t)):t},j(a)}function D(e){return function(t){return t<0?-Math.pow(-t,e):Math.pow(t,e)}}function N(e){return e<0?-Math.sqrt(-e):Math.sqrt(e)}function P(e){return e<0?-e*e:e*e}function R(e){var t=e(b,b),a=1;return t.exponent=function(t){return arguments.length?1===(a=+t)?e(b,b):.5===a?e(N,P):e(D(a),D(1/a)):a},j(t)}function L(){var e=R(v());return e.copy=function(){return h(e,L()).exponent(e.exponent())},s.apply(e,arguments),e}function B(e){return Math.sign(e)*e*e}function q(e){return new Date(e)}function z(e){return e instanceof Date?+e:+new Date(+e)}function $(e,t,a,n,i,r,s,o,l,c){var u=E(),d=u.invert,p=u.domain,m=c(".%L"),b=c(":%S"),g=c("%I:%M"),f=c("%I %p"),y=c("%a %d"),v=c("%b %d"),x=c("%B"),j=c("%Y");function k(e){return(l(e)<e?m:o(e)<e?b:s(e)<e?g:r(e)<e?f:n(e)<e?i(e)<e?y:v:a(e)<e?x:j)(e)}return u.invert=function(e){return new Date(d(e))},u.domain=function(e){return arguments.length?p(Array.from(e,z)):p().map(q)},u.ticks=function(t){var a=p();return e(a[0],a[a.length-1],null==t?10:t)},u.tickFormat=function(e,t){return null==t?k:c(t)},u.nice=function(e){var a=p();return e&&"function"==typeof e.range||(e=t(a[0],a[a.length-1],null==e?10:e)),e?p(S(a,e)):u},u.copy=function(){return h(u,$(e,t,a,n,i,r,s,o,l,c))},u}function V(){var e,t,n,i,r,s=0,o=1,l=b,c=!1;function u(t){return null==t||isNaN(t=+t)?r:l(0===n?.5:(t=(i(t)-e)*n,c?Math.max(0,Math.min(1,t)):t))}function d(e){return function(t){var a,n;return arguments.length?([a,n]=t,l=e(a,n),u):[l(0),l(1)]}}return u.domain=function(a){return arguments.length?([s,o]=a,e=i(s=+s),t=i(o=+o),n=e===t?0:1/(t-e),u):[s,o]},u.clamp=function(e){return arguments.length?(c=!!e,u):c},u.interpolator=function(e){return arguments.length?(l=e,u):l},u.range=d(a.interpolate),u.rangeRound=d(a.interpolateRound),u.unknown=function(e){return arguments.length?(r=e,u):r},function(a){return i=a,e=a(s),t=a(o),n=e===t?0:1/(t-e),u}}function U(e,t){return t.domain(e.domain()).interpolator(e.interpolator()).clamp(e.clamp()).unknown(e.unknown())}function H(){var e=R(V());return e.copy=function(){return U(e,H()).exponent(e.exponent())},o.apply(e,arguments)}function G(){var e,t,n,i,r,s,o,l=0,c=.5,u=1,d=1,p=b,m=!1;function g(e){return isNaN(e=+e)?o:(e=.5+((e=+s(e))-t)*(d*e<d*t?i:r),p(m?Math.max(0,Math.min(1,e)):e))}function f(e){return function(t){var n,i,r;return arguments.length?([n,i,r]=t,p=a.piecewise(e,[n,i,r]),g):[p(0),p(.5),p(1)]}}return g.domain=function(a){return arguments.length?([l,c,u]=a,e=s(l=+l),t=s(c=+c),n=s(u=+u),i=e===t?0:.5/(t-e),r=t===n?0:.5/(n-t),d=t<e?-1:1,g):[l,c,u]},g.clamp=function(e){return arguments.length?(m=!!e,g):m},g.interpolator=function(e){return arguments.length?(p=e,g):p},g.range=f(a.interpolate),g.rangeRound=f(a.interpolateRound),g.unknown=function(e){return arguments.length?(o=e,g):o},function(a){return s=a,e=a(l),t=a(c),n=a(u),i=e===t?0:.5/(t-e),r=t===n?0:.5/(n-t),d=t<e?-1:1,g}}function Q(){var e=R(G());return e.copy=function(){return U(e,Q()).exponent(e.exponent())},o.apply(e,arguments)}e.scaleBand=u,e.scaleDiverging=function e(){var t=j(G()(b));return t.copy=function(){return U(t,e())},o.apply(t,arguments)},e.scaleDivergingLog=function e(){var t=M(G()).domain([.1,1,10]);return t.copy=function(){return U(t,e()).base(t.base())},o.apply(t,arguments)},e.scaleDivergingPow=Q,e.scaleDivergingSqrt=function(){return Q.apply(null,arguments).exponent(.5)},e.scaleDivergingSymlog=function e(){var t=A(G());return t.copy=function(){return U(t,e()).constant(t.constant())},o.apply(t,arguments)},e.scaleIdentity=function e(t){var a;function n(e){return null==e||isNaN(e=+e)?a:e}return n.invert=n,n.domain=n.range=function(e){return arguments.length?(t=Array.from(e,p),n):t.slice()},n.unknown=function(e){return arguments.length?(a=e,n):a},n.copy=function(){return e(t).unknown(a)},t=arguments.length?Array.from(t,p):[0,1],j(n)},e.scaleImplicit=l,e.scaleLinear=function e(){var t=E();return t.copy=function(){return h(t,e())},s.apply(t,arguments),j(t)},e.scaleLog=function e(){var t=M(v()).domain([1,10]);return t.copy=function(){return h(t,e()).base(t.base())},s.apply(t,arguments),t},e.scaleOrdinal=c,e.scalePoint=function(){return d(u.apply(null,arguments).paddingInner(1))},e.scalePow=L,e.scaleQuantile=function e(){var a,n=[],i=[],r=[];function o(){var e=0,a=Math.max(1,i.length);for(r=new Array(a-1);++e<a;)r[e-1]=t.quantileSorted(n,e/a);return l}function l(e){return null==e||isNaN(e=+e)?a:i[t.bisect(r,e)]}return l.invertExtent=function(e){var t=i.indexOf(e);return t<0?[NaN,NaN]:[t>0?r[t-1]:n[0],t<r.length?r[t]:n[n.length-1]]},l.domain=function(e){if(!arguments.length)return n.slice();n=[];for(let t of e)null==t||isNaN(t=+t)||n.push(t);return n.sort(t.ascending),o()},l.range=function(e){return arguments.length?(i=Array.from(e),o()):i.slice()},l.unknown=function(e){return arguments.length?(a=e,l):a},l.quantiles=function(){return r.slice()},l.copy=function(){return e().domain(n).range(i).unknown(a)},s.apply(l,arguments)},e.scaleQuantize=function e(){var a,n=0,i=1,r=1,o=[.5],l=[0,1];function c(e){return null!=e&&e<=e?l[t.bisect(o,e,0,r)]:a}function u(){var e=-1;for(o=new Array(r);++e<r;)o[e]=((e+1)*i-(e-r)*n)/(r+1);return c}return c.domain=function(e){return arguments.length?([n,i]=e,n=+n,i=+i,u()):[n,i]},c.range=function(e){return arguments.length?(r=(l=Array.from(e)).length-1,u()):l.slice()},c.invertExtent=function(e){var t=l.indexOf(e);return t<0?[NaN,NaN]:t<1?[n,o[0]]:t>=r?[o[r-1],i]:[o[t-1],o[t]]},c.unknown=function(e){return arguments.length?(a=e,c):c},c.thresholds=function(){return o.slice()},c.copy=function(){return e().domain([n,i]).range(l).unknown(a)},s.apply(j(c),arguments)},e.scaleRadial=function e(){var t,a=E(),n=[0,1],i=!1;function r(e){var n=function(e){return Math.sign(e)*Math.sqrt(Math.abs(e))}(a(e));return isNaN(n)?t:i?Math.round(n):n}return r.invert=function(e){return a.invert(B(e))},r.domain=function(e){return arguments.length?(a.domain(e),r):a.domain()},r.range=function(e){return arguments.length?(a.range((n=Array.from(e,p)).map(B)),r):n.slice()},r.rangeRound=function(e){return r.range(e).round(!0)},r.round=function(e){return arguments.length?(i=!!e,r):i},r.clamp=function(e){return arguments.length?(a.clamp(e),r):a.clamp()},r.unknown=function(e){return arguments.length?(t=e,r):t},r.copy=function(){return e(a.domain(),n).round(i).clamp(a.clamp()).unknown(t)},s.apply(r,arguments),j(r)},e.scaleSequential=function e(){var t=j(V()(b));return t.copy=function(){return U(t,e())},o.apply(t,arguments)},e.scaleSequentialLog=function e(){var t=M(V()).domain([1,10]);return t.copy=function(){return U(t,e()).base(t.base())},o.apply(t,arguments)},e.scaleSequentialPow=H,e.scaleSequentialQuantile=function e(){var a=[],n=b;function i(e){if(null!=e&&!isNaN(e=+e))return n((t.bisect(a,e,1)-1)/(a.length-1))}return i.domain=function(e){if(!arguments.length)return a.slice();a=[];for(let t of e)null==t||isNaN(t=+t)||a.push(t);return a.sort(t.ascending),i},i.interpolator=function(e){return arguments.length?(n=e,i):n},i.range=function(){return a.map(((e,t)=>n(t/(a.length-1))))},i.quantiles=function(e){return Array.from({length:e+1},((n,i)=>t.quantile(a,i/e)))},i.copy=function(){return e(n).domain(a)},o.apply(i,arguments)},e.scaleSequentialSqrt=function(){return H.apply(null,arguments).exponent(.5)},e.scaleSequentialSymlog=function e(){var t=A(V());return t.copy=function(){return U(t,e()).constant(t.constant())},o.apply(t,arguments)},e.scaleSqrt=function(){return L.apply(null,arguments).exponent(.5)},e.scaleSymlog=function e(){var t=A(v());return t.copy=function(){return h(t,e()).constant(t.constant())},s.apply(t,arguments)},e.scaleThreshold=function e(){var a,n=[.5],i=[0,1],r=1;function o(e){return null!=e&&e<=e?i[t.bisect(n,e,0,r)]:a}return o.domain=function(e){return arguments.length?(n=Array.from(e),r=Math.min(n.length,i.length-1),o):n.slice()},o.range=function(e){return arguments.length?(i=Array.from(e),r=Math.min(n.length,i.length-1),o):i.slice()},o.invertExtent=function(e){var t=i.indexOf(e);return[n[t-1],n[t]]},o.unknown=function(e){return arguments.length?(a=e,o):a},o.copy=function(){return e().domain(n).range(i).unknown(a)},s.apply(o,arguments)},e.scaleTime=function(){return s.apply($(i.timeTicks,i.timeTickInterval,i.timeYear,i.timeMonth,i.timeWeek,i.timeDay,i.timeHour,i.timeMinute,i.timeSecond,r.timeFormat).domain([new Date(2e3,0,1),new Date(2e3,0,2)]),arguments)},e.scaleUtc=function(){return s.apply($(i.utcTicks,i.utcTickInterval,i.utcYear,i.utcMonth,i.utcWeek,i.utcDay,i.utcHour,i.utcMinute,i.utcSecond,r.utcFormat).domain([Date.UTC(2e3,0,1),Date.UTC(2e3,0,2)]),arguments)},e.tickFormat=x,Object.defineProperty(e,"__esModule",{value:!0})}(t,a(816),a(1276),a(1278),a(817),a(1279))},function(e,t,a){!function(e,t){"use strict";function a(e,t,a,n,i){var r=e*e,s=r*e;return((1-3*e+3*r-s)*t+(4-6*r+3*s)*a+(1+3*e+3*r-3*s)*n+s*i)/6}function n(e){var t=e.length-1;return function(n){var i=n<=0?n=0:n>=1?(n=1,t-1):Math.floor(n*t),r=e[i],s=e[i+1],o=i>0?e[i-1]:2*r-s,l=i<t-1?e[i+2]:2*s-r;return a((n-i/t)*t,o,r,s,l)}}function i(e){var t=e.length;return function(n){var i=Math.floor(((n%=1)<0?++n:n)*t),r=e[(i+t-1)%t],s=e[i%t],o=e[(i+1)%t],l=e[(i+2)%t];return a((n-i/t)*t,r,s,o,l)}}var r=e=>()=>e;function s(e,t){return function(a){return e+a*t}}function o(e,t){var a=t-e;return a?s(e,a>180||a<-180?a-360*Math.round(a/360):a):r(isNaN(e)?t:e)}function l(e){return 1==(e=+e)?c:function(t,a){return a-t?function(e,t,a){return e=Math.pow(e,a),t=Math.pow(t,a)-e,a=1/a,function(n){return Math.pow(e+n*t,a)}}(t,a,e):r(isNaN(t)?a:t)}}function c(e,t){var a=t-e;return a?s(e,a):r(isNaN(e)?t:e)}var u=function e(a){var n=l(a);function i(e,a){var i=n((e=t.rgb(e)).r,(a=t.rgb(a)).r),r=n(e.g,a.g),s=n(e.b,a.b),o=c(e.opacity,a.opacity);return function(t){return e.r=i(t),e.g=r(t),e.b=s(t),e.opacity=o(t),e+""}}return i.gamma=e,i}(1);function d(e){return function(a){var n,i,r=a.length,s=new Array(r),o=new Array(r),l=new Array(r);for(n=0;n<r;++n)i=t.rgb(a[n]),s[n]=i.r||0,o[n]=i.g||0,l[n]=i.b||0;return s=e(s),o=e(o),l=e(l),i.opacity=1,function(e){return i.r=s(e),i.g=o(e),i.b=l(e),i+""}}}var p=d(n),m=d(i);function b(e,t){t||(t=[]);var a,n=e?Math.min(t.length,e.length):0,i=t.slice();return function(r){for(a=0;a<n;++a)i[a]=e[a]*(1-r)+t[a]*r;return i}}function g(e){return ArrayBuffer.isView(e)&&!(e instanceof DataView)}function f(e,t){var a,n=t?t.length:0,i=e?Math.min(n,e.length):0,r=new Array(i),s=new Array(n);for(a=0;a<i;++a)r[a]=S(e[a],t[a]);for(;a<n;++a)s[a]=t[a];return function(e){for(a=0;a<i;++a)s[a]=r[a](e);return s}}function y(e,t){var a=new Date;return e=+e,t=+t,function(n){return a.setTime(e*(1-n)+t*n),a}}function h(e,t){return e=+e,t=+t,function(a){return e*(1-a)+t*a}}function v(e,t){var a,n={},i={};for(a in null!==e&&"object"==typeof e||(e={}),null!==t&&"object"==typeof t||(t={}),t)a in e?n[a]=S(e[a],t[a]):i[a]=t[a];return function(e){for(a in n)i[a]=n[a](e);return i}}var E=/[-+]?(?:\d+\.?\d*|\.?\d+)(?:[eE][-+]?\d+)?/g,x=new RegExp(E.source,"g");function j(e,t){var a,n,i,r=E.lastIndex=x.lastIndex=0,s=-1,o=[],l=[];for(e+="",t+="";(a=E.exec(e))&&(n=x.exec(t));)(i=n.index)>r&&(i=t.slice(r,i),o[s]?o[s]+=i:o[++s]=i),(a=a[0])===(n=n[0])?o[s]?o[s]+=n:o[++s]=n:(o[++s]=null,l.push({i:s,x:h(a,n)})),r=x.lastIndex;return r<t.length&&(i=t.slice(r),o[s]?o[s]+=i:o[++s]=i),o.length<2?l[0]?function(e){return function(t){return e(t)+""}}(l[0].x):function(e){return function(){return e}}(t):(t=l.length,function(e){for(var a,n=0;n<t;++n)o[(a=l[n]).i]=a.x(e);return o.join("")})}function S(e,a){var n,i=typeof a;return null==a||"boolean"===i?r(a):("number"===i?h:"string"===i?(n=t.color(a))?(a=n,u):j:a instanceof t.color?u:a instanceof Date?y:g(a)?b:Array.isArray(a)?f:"function"!=typeof a.valueOf&&"function"!=typeof a.toString||isNaN(a)?v:h)(e,a)}var k,O=180/Math.PI,w={translateX:0,translateY:0,rotate:0,skewX:0,scaleX:1,scaleY:1};function T(e,t,a,n,i,r){var s,o,l;return(s=Math.sqrt(e*e+t*t))&&(e/=s,t/=s),(l=e*a+t*n)&&(a-=e*l,n-=t*l),(o=Math.sqrt(a*a+n*n))&&(a/=o,n/=o,l/=o),e*n<t*a&&(e=-e,t=-t,l=-l,s=-s),{translateX:i,translateY:r,rotate:Math.atan2(t,e)*O,skewX:Math.atan(l)*O,scaleX:s,scaleY:o}}function I(e,t,a,n){function i(e){return e.length?e.pop()+" ":""}return function(r,s){var o=[],l=[];return r=e(r),s=e(s),function(e,n,i,r,s,o){if(e!==i||n!==r){var l=s.push("translate(",null,t,null,a);o.push({i:l-4,x:h(e,i)},{i:l-2,x:h(n,r)})}else(i||r)&&s.push("translate("+i+t+r+a)}(r.translateX,r.translateY,s.translateX,s.translateY,o,l),function(e,t,a,r){e!==t?(e-t>180?t+=360:t-e>180&&(e+=360),r.push({i:a.push(i(a)+"rotate(",null,n)-2,x:h(e,t)})):t&&a.push(i(a)+"rotate("+t+n)}(r.rotate,s.rotate,o,l),function(e,t,a,r){e!==t?r.push({i:a.push(i(a)+"skewX(",null,n)-2,x:h(e,t)}):t&&a.push(i(a)+"skewX("+t+n)}(r.skewX,s.skewX,o,l),function(e,t,a,n,r,s){if(e!==a||t!==n){var o=r.push(i(r)+"scale(",null,",",null,")");s.push({i:o-4,x:h(e,a)},{i:o-2,x:h(t,n)})}else 1===a&&1===n||r.push(i(r)+"scale("+a+","+n+")")}(r.scaleX,r.scaleY,s.scaleX,s.scaleY,o,l),r=s=null,function(e){for(var t,a=-1,n=l.length;++a<n;)o[(t=l[a]).i]=t.x(e);return o.join("")}}}var C=I((function(e){const t=new("function"==typeof DOMMatrix?DOMMatrix:WebKitCSSMatrix)(e+"");return t.isIdentity?w:T(t.a,t.b,t.c,t.d,t.e,t.f)}),"px, ","px)","deg)"),M=I((function(e){return null==e?w:(k||(k=document.createElementNS("http://www.w3.org/2000/svg","g")),k.setAttribute("transform",e),(e=k.transform.baseVal.consolidate())?T((e=e.matrix).a,e.b,e.c,e.d,e.e,e.f):w)}),", ",")",")"),_=1e-12;function F(e){return((e=Math.exp(e))+1/e)/2}var A=function e(t,a,n){function i(e,i){var r,s,o=e[0],l=e[1],c=e[2],u=i[0],d=i[1],p=i[2],m=u-o,b=d-l,g=m*m+b*b;if(g<_)s=Math.log(p/c)/t,r=function(e){return[o+e*m,l+e*b,c*Math.exp(t*e*s)]};else{var f=Math.sqrt(g),y=(p*p-c*c+n*g)/(2*c*a*f),h=(p*p-c*c-n*g)/(2*p*a*f),v=Math.log(Math.sqrt(y*y+1)-y),E=Math.log(Math.sqrt(h*h+1)-h);s=(E-v)/t,r=function(e){var n,i=e*s,r=F(v),u=c/(a*f)*(r*(n=t*i+v,((n=Math.exp(2*n))-1)/(n+1))-function(e){return((e=Math.exp(e))-1/e)/2}(v));return[o+u*m,l+u*b,c*r/F(t*i+v)]}}return r.duration=1e3*s*t/Math.SQRT2,r}return i.rho=function(t){var a=Math.max(.001,+t),n=a*a;return e(a,n,n*n)},i}(Math.SQRT2,2,4);function D(e){return function(a,n){var i=e((a=t.hsl(a)).h,(n=t.hsl(n)).h),r=c(a.s,n.s),s=c(a.l,n.l),o=c(a.opacity,n.opacity);return function(e){return a.h=i(e),a.s=r(e),a.l=s(e),a.opacity=o(e),a+""}}}var N=D(o),P=D(c);function R(e){return function(a,n){var i=e((a=t.hcl(a)).h,(n=t.hcl(n)).h),r=c(a.c,n.c),s=c(a.l,n.l),o=c(a.opacity,n.opacity);return function(e){return a.h=i(e),a.c=r(e),a.l=s(e),a.opacity=o(e),a+""}}}var L=R(o),B=R(c);function q(e){return function a(n){function i(a,i){var r=e((a=t.cubehelix(a)).h,(i=t.cubehelix(i)).h),s=c(a.s,i.s),o=c(a.l,i.l),l=c(a.opacity,i.opacity);return function(e){return a.h=r(e),a.s=s(e),a.l=o(Math.pow(e,n)),a.opacity=l(e),a+""}}return n=+n,i.gamma=a,i}(1)}var z=q(o),$=q(c);e.interpolate=S,e.interpolateArray=function(e,t){return(g(t)?b:f)(e,t)},e.interpolateBasis=n,e.interpolateBasisClosed=i,e.interpolateCubehelix=z,e.interpolateCubehelixLong=$,e.interpolateDate=y,e.interpolateDiscrete=function(e){var t=e.length;return function(a){return e[Math.max(0,Math.min(t-1,Math.floor(a*t)))]}},e.interpolateHcl=L,e.interpolateHclLong=B,e.interpolateHsl=N,e.interpolateHslLong=P,e.interpolateHue=function(e,t){var a=o(+e,+t);return function(e){var t=a(e);return t-360*Math.floor(t/360)}},e.interpolateLab=function(e,a){var n=c((e=t.lab(e)).l,(a=t.lab(a)).l),i=c(e.a,a.a),r=c(e.b,a.b),s=c(e.opacity,a.opacity);return function(t){return e.l=n(t),e.a=i(t),e.b=r(t),e.opacity=s(t),e+""}},e.interpolateNumber=h,e.interpolateNumberArray=b,e.interpolateObject=v,e.interpolateRgb=u,e.interpolateRgbBasis=p,e.interpolateRgbBasisClosed=m,e.interpolateRound=function(e,t){return e=+e,t=+t,function(a){return Math.round(e*(1-a)+t*a)}},e.interpolateString=j,e.interpolateTransformCss=C,e.interpolateTransformSvg=M,e.interpolateZoom=A,e.piecewise=function(e,t){void 0===t&&(t=e,e=S);for(var a=0,n=t.length-1,i=t[0],r=new Array(n<0?0:n);a<n;)r[a]=e(i,i=t[++a]);return function(e){var t=Math.max(0,Math.min(n-1,Math.floor(e*=n)));return r[t](e-t)}},e.quantize=function(e,t){for(var a=new Array(t),n=0;n<t;++n)a[n]=e(n/(t-1));return a},Object.defineProperty(e,"__esModule",{value:!0})}(t,a(1277))},function(e,t,a){!function(e){"use strict";function t(e,t,a){e.prototype=t.prototype=a,a.constructor=e}function a(e,t){var a=Object.create(e.prototype);for(var n in t)a[n]=t[n];return a}function n(){}var i=.7,r=1/i,s="\\s*([+-]?\\d+)\\s*",o="\\s*([+-]?\\d*\\.?\\d+(?:[eE][+-]?\\d+)?)\\s*",l="\\s*([+-]?\\d*\\.?\\d+(?:[eE][+-]?\\d+)?)%\\s*",c=/^#([0-9a-f]{3,8})$/,u=new RegExp("^rgb\\("+[s,s,s]+"\\)$"),d=new RegExp("^rgb\\("+[l,l,l]+"\\)$"),p=new RegExp("^rgba\\("+[s,s,s,o]+"\\)$"),m=new RegExp("^rgba\\("+[l,l,l,o]+"\\)$"),b=new RegExp("^hsl\\("+[o,l,l]+"\\)$"),g=new RegExp("^hsla\\("+[o,l,l,o]+"\\)$"),f={aliceblue:15792383,antiquewhite:16444375,aqua:65535,aquamarine:8388564,azure:15794175,beige:16119260,bisque:16770244,black:0,blanchedalmond:16772045,blue:255,blueviolet:9055202,brown:10824234,burlywood:14596231,cadetblue:6266528,chartreuse:8388352,chocolate:13789470,coral:16744272,cornflowerblue:6591981,cornsilk:16775388,crimson:14423100,cyan:65535,darkblue:139,darkcyan:35723,darkgoldenrod:12092939,darkgray:11119017,darkgreen:25600,darkgrey:11119017,darkkhaki:12433259,darkmagenta:9109643,darkolivegreen:5597999,darkorange:16747520,darkorchid:10040012,darkred:9109504,darksalmon:15308410,darkseagreen:9419919,darkslateblue:4734347,darkslategray:3100495,darkslategrey:3100495,darkturquoise:52945,darkviolet:9699539,deeppink:16716947,deepskyblue:49151,dimgray:6908265,dimgrey:6908265,dodgerblue:2003199,firebrick:11674146,floralwhite:16775920,forestgreen:2263842,fuchsia:16711935,gainsboro:14474460,ghostwhite:16316671,gold:16766720,goldenrod:14329120,gray:8421504,green:32768,greenyellow:11403055,grey:8421504,honeydew:15794160,hotpink:16738740,indianred:13458524,indigo:4915330,ivory:16777200,khaki:15787660,lavender:15132410,lavenderblush:16773365,lawngreen:8190976,lemonchiffon:16775885,lightblue:11393254,lightcoral:15761536,lightcyan:14745599,lightgoldenrodyellow:16448210,lightgray:13882323,lightgreen:9498256,lightgrey:13882323,lightpink:16758465,lightsalmon:16752762,lightseagreen:2142890,lightskyblue:8900346,lightslategray:7833753,lightslategrey:7833753,lightsteelblue:11584734,lightyellow:16777184,lime:65280,limegreen:3329330,linen:16445670,magenta:16711935,maroon:8388608,mediumaquamarine:6737322,mediumblue:205,mediumorchid:12211667,mediumpurple:9662683,mediumseagreen:3978097,mediumslateblue:8087790,mediumspringgreen:64154,mediumturquoise:4772300,mediumvioletred:13047173,midnightblue:1644912,mintcream:16121850,mistyrose:16770273,moccasin:16770229,navajowhite:16768685,navy:128,oldlace:16643558,olive:8421376,olivedrab:7048739,orange:16753920,orangered:16729344,orchid:14315734,palegoldenrod:15657130,palegreen:10025880,paleturquoise:11529966,palevioletred:14381203,papayawhip:16773077,peachpuff:16767673,peru:13468991,pink:16761035,plum:14524637,powderblue:11591910,purple:8388736,rebeccapurple:6697881,red:16711680,rosybrown:12357519,royalblue:4286945,saddlebrown:9127187,salmon:16416882,sandybrown:16032864,seagreen:3050327,seashell:16774638,sienna:10506797,silver:12632256,skyblue:8900331,slateblue:6970061,slategray:7372944,slategrey:7372944,snow:16775930,springgreen:65407,steelblue:4620980,tan:13808780,teal:32896,thistle:14204888,tomato:16737095,turquoise:4251856,violet:15631086,wheat:16113331,white:16777215,whitesmoke:16119285,yellow:16776960,yellowgreen:10145074};function y(){return this.rgb().formatHex()}function h(){return this.rgb().formatRgb()}function v(e){var t,a;return e=(e+"").trim().toLowerCase(),(t=c.exec(e))?(a=t[1].length,t=parseInt(t[1],16),6===a?E(t):3===a?new k(t>>8&15|t>>4&240,t>>4&15|240&t,(15&t)<<4|15&t,1):8===a?x(t>>24&255,t>>16&255,t>>8&255,(255&t)/255):4===a?x(t>>12&15|t>>8&240,t>>8&15|t>>4&240,t>>4&15|240&t,((15&t)<<4|15&t)/255):null):(t=u.exec(e))?new k(t[1],t[2],t[3],1):(t=d.exec(e))?new k(255*t[1]/100,255*t[2]/100,255*t[3]/100,1):(t=p.exec(e))?x(t[1],t[2],t[3],t[4]):(t=m.exec(e))?x(255*t[1]/100,255*t[2]/100,255*t[3]/100,t[4]):(t=b.exec(e))?I(t[1],t[2]/100,t[3]/100,1):(t=g.exec(e))?I(t[1],t[2]/100,t[3]/100,t[4]):f.hasOwnProperty(e)?E(f[e]):"transparent"===e?new k(NaN,NaN,NaN,0):null}function E(e){return new k(e>>16&255,e>>8&255,255&e,1)}function x(e,t,a,n){return n<=0&&(e=t=a=NaN),new k(e,t,a,n)}function j(e){return e instanceof n||(e=v(e)),e?new k((e=e.rgb()).r,e.g,e.b,e.opacity):new k}function S(e,t,a,n){return 1===arguments.length?j(e):new k(e,t,a,null==n?1:n)}function k(e,t,a,n){this.r=+e,this.g=+t,this.b=+a,this.opacity=+n}function O(){return"#"+T(this.r)+T(this.g)+T(this.b)}function w(){var e=this.opacity;return(1===(e=isNaN(e)?1:Math.max(0,Math.min(1,e)))?"rgb(":"rgba(")+Math.max(0,Math.min(255,Math.round(this.r)||0))+", "+Math.max(0,Math.min(255,Math.round(this.g)||0))+", "+Math.max(0,Math.min(255,Math.round(this.b)||0))+(1===e?")":", "+e+")")}function T(e){return((e=Math.max(0,Math.min(255,Math.round(e)||0)))<16?"0":"")+e.toString(16)}function I(e,t,a,n){return n<=0?e=t=a=NaN:a<=0||a>=1?e=t=NaN:t<=0&&(e=NaN),new _(e,t,a,n)}function C(e){if(e instanceof _)return new _(e.h,e.s,e.l,e.opacity);if(e instanceof n||(e=v(e)),!e)return new _;if(e instanceof _)return e;var t=(e=e.rgb()).r/255,a=e.g/255,i=e.b/255,r=Math.min(t,a,i),s=Math.max(t,a,i),o=NaN,l=s-r,c=(s+r)/2;return l?(o=t===s?(a-i)/l+6*(a<i):a===s?(i-t)/l+2:(t-a)/l+4,l/=c<.5?s+r:2-s-r,o*=60):l=c>0&&c<1?0:o,new _(o,l,c,e.opacity)}function M(e,t,a,n){return 1===arguments.length?C(e):new _(e,t,a,null==n?1:n)}function _(e,t,a,n){this.h=+e,this.s=+t,this.l=+a,this.opacity=+n}function F(e,t,a){return 255*(e<60?t+(a-t)*e/60:e<180?a:e<240?t+(a-t)*(240-e)/60:t)}t(n,v,{copy:function(e){return Object.assign(new this.constructor,this,e)},displayable:function(){return this.rgb().displayable()},hex:y,formatHex:y,formatHsl:function(){return C(this).formatHsl()},formatRgb:h,toString:h}),t(k,S,a(n,{brighter:function(e){return e=null==e?r:Math.pow(r,e),new k(this.r*e,this.g*e,this.b*e,this.opacity)},darker:function(e){return e=null==e?i:Math.pow(i,e),new k(this.r*e,this.g*e,this.b*e,this.opacity)},rgb:function(){return this},displayable:function(){return-.5<=this.r&&this.r<255.5&&-.5<=this.g&&this.g<255.5&&-.5<=this.b&&this.b<255.5&&0<=this.opacity&&this.opacity<=1},hex:O,formatHex:O,formatRgb:w,toString:w})),t(_,M,a(n,{brighter:function(e){return e=null==e?r:Math.pow(r,e),new _(this.h,this.s,this.l*e,this.opacity)},darker:function(e){return e=null==e?i:Math.pow(i,e),new _(this.h,this.s,this.l*e,this.opacity)},rgb:function(){var e=this.h%360+360*(this.h<0),t=isNaN(e)||isNaN(this.s)?0:this.s,a=this.l,n=a+(a<.5?a:1-a)*t,i=2*a-n;return new k(F(e>=240?e-240:e+120,i,n),F(e,i,n),F(e<120?e+240:e-120,i,n),this.opacity)},displayable:function(){return(0<=this.s&&this.s<=1||isNaN(this.s))&&0<=this.l&&this.l<=1&&0<=this.opacity&&this.opacity<=1},formatHsl:function(){var e=this.opacity;return(1===(e=isNaN(e)?1:Math.max(0,Math.min(1,e)))?"hsl(":"hsla(")+(this.h||0)+", "+100*(this.s||0)+"%, "+100*(this.l||0)+"%"+(1===e?")":", "+e+")")}}));const A=Math.PI/180,D=180/Math.PI,N=.96422,P=1,R=.82521,L=4/29,B=6/29,q=3*B*B,z=B*B*B;function $(e){if(e instanceof U)return new U(e.l,e.a,e.b,e.opacity);if(e instanceof J)return X(e);e instanceof k||(e=j(e));var t,a,n=W(e.r),i=W(e.g),r=W(e.b),s=H((.2225045*n+.7168786*i+.0606169*r)/P);return n===i&&i===r?t=a=s:(t=H((.4360747*n+.3850649*i+.1430804*r)/N),a=H((.0139322*n+.0971045*i+.7141733*r)/R)),new U(116*s-16,500*(t-s),200*(s-a),e.opacity)}function V(e,t,a,n){return 1===arguments.length?$(e):new U(e,t,a,null==n?1:n)}function U(e,t,a,n){this.l=+e,this.a=+t,this.b=+a,this.opacity=+n}function H(e){return e>z?Math.pow(e,1/3):e/q+L}function G(e){return e>B?e*e*e:q*(e-L)}function Q(e){return 255*(e<=.0031308?12.92*e:1.055*Math.pow(e,1/2.4)-.055)}function W(e){return(e/=255)<=.04045?e/12.92:Math.pow((e+.055)/1.055,2.4)}function K(e){if(e instanceof J)return new J(e.h,e.c,e.l,e.opacity);if(e instanceof U||(e=$(e)),0===e.a&&0===e.b)return new J(NaN,0<e.l&&e.l<100?0:NaN,e.l,e.opacity);var t=Math.atan2(e.b,e.a)*D;return new J(t<0?t+360:t,Math.sqrt(e.a*e.a+e.b*e.b),e.l,e.opacity)}function Y(e,t,a,n){return 1===arguments.length?K(e):new J(e,t,a,null==n?1:n)}function J(e,t,a,n){this.h=+e,this.c=+t,this.l=+a,this.opacity=+n}function X(e){if(isNaN(e.h))return new U(e.l,0,0,e.opacity);var t=e.h*A;return new U(e.l,Math.cos(t)*e.c,Math.sin(t)*e.c,e.opacity)}t(U,V,a(n,{brighter:function(e){return new U(this.l+18*(null==e?1:e),this.a,this.b,this.opacity)},darker:function(e){return new U(this.l-18*(null==e?1:e),this.a,this.b,this.opacity)},rgb:function(){var e=(this.l+16)/116,t=isNaN(this.a)?e:e+this.a/500,a=isNaN(this.b)?e:e-this.b/200;return new k(Q(3.1338561*(t=N*G(t))-1.6168667*(e=P*G(e))-.4906146*(a=R*G(a))),Q(-.9787684*t+1.9161415*e+.033454*a),Q(.0719453*t-.2289914*e+1.4052427*a),this.opacity)}})),t(J,Y,a(n,{brighter:function(e){return new J(this.h,this.c,this.l+18*(null==e?1:e),this.opacity)},darker:function(e){return new J(this.h,this.c,this.l-18*(null==e?1:e),this.opacity)},rgb:function(){return X(this).rgb()}}));var Z=-.14861,ee=1.78277,te=-.29227,ae=-.90649,ne=1.97294,ie=ne*ae,re=ne*ee,se=ee*te-ae*Z;function oe(e,t,a,n){return 1===arguments.length?function(e){if(e instanceof le)return new le(e.h,e.s,e.l,e.opacity);e instanceof k||(e=j(e));var t=e.r/255,a=e.g/255,n=e.b/255,i=(se*n+ie*t-re*a)/(se+ie-re),r=n-i,s=(ne*(a-i)-te*r)/ae,o=Math.sqrt(s*s+r*r)/(ne*i*(1-i)),l=o?Math.atan2(s,r)*D-120:NaN;return new le(l<0?l+360:l,o,i,e.opacity)}(e):new le(e,t,a,null==n?1:n)}function le(e,t,a,n){this.h=+e,this.s=+t,this.l=+a,this.opacity=+n}t(le,oe,a(n,{brighter:function(e){return e=null==e?r:Math.pow(r,e),new le(this.h,this.s,this.l*e,this.opacity)},darker:function(e){return e=null==e?i:Math.pow(i,e),new le(this.h,this.s,this.l*e,this.opacity)},rgb:function(){var e=isNaN(this.h)?0:(this.h+120)*A,t=+this.l,a=isNaN(this.s)?0:this.s*t*(1-t),n=Math.cos(e),i=Math.sin(e);return new k(255*(t+a*(Z*n+ee*i)),255*(t+a*(te*n+ae*i)),255*(t+a*(ne*n)),this.opacity)}})),e.color=v,e.cubehelix=oe,e.gray=function(e,t){return new U(e,0,0,null==t?1:t)},e.hcl=Y,e.hsl=M,e.lab=V,e.lch=function(e,t,a,n){return 1===arguments.length?K(e):new J(a,t,e,null==n?1:n)},e.rgb=S,Object.defineProperty(e,"__esModule",{value:!0})}(t)},function(e,t,a){!function(e){"use strict";function t(e,t){if((a=(e=t?e.toExponential(t-1):e.toExponential()).indexOf("e"))<0)return null;var a,n=e.slice(0,a);return[n.length>1?n[0]+n.slice(2):n,+e.slice(a+1)]}function a(e){return(e=t(Math.abs(e)))?e[1]:NaN}var n,i=/^(?:(.)?([<>=^]))?([+\-( ])?([$#])?(0)?(\d+)?(,)?(\.\d+)?(~)?([a-z%])?$/i;function r(e){if(!(t=i.exec(e)))throw new Error("invalid format: "+e);var t;return new s({fill:t[1],align:t[2],sign:t[3],symbol:t[4],zero:t[5],width:t[6],comma:t[7],precision:t[8]&&t[8].slice(1),trim:t[9],type:t[10]})}function s(e){this.fill=void 0===e.fill?" ":e.fill+"",this.align=void 0===e.align?">":e.align+"",this.sign=void 0===e.sign?"-":e.sign+"",this.symbol=void 0===e.symbol?"":e.symbol+"",this.zero=!!e.zero,this.width=void 0===e.width?void 0:+e.width,this.comma=!!e.comma,this.precision=void 0===e.precision?void 0:+e.precision,this.trim=!!e.trim,this.type=void 0===e.type?"":e.type+""}function o(e,a){var n=t(e,a);if(!n)return e+"";var i=n[0],r=n[1];return r<0?"0."+new Array(-r).join("0")+i:i.length>r+1?i.slice(0,r+1)+"."+i.slice(r+1):i+new Array(r-i.length+2).join("0")}r.prototype=s.prototype,s.prototype.toString=function(){return this.fill+this.align+this.sign+this.symbol+(this.zero?"0":"")+(void 0===this.width?"":Math.max(1,0|this.width))+(this.comma?",":"")+(void 0===this.precision?"":"."+Math.max(0,0|this.precision))+(this.trim?"~":"")+this.type};var l={"%":(e,t)=>(100*e).toFixed(t),b:e=>Math.round(e).toString(2),c:e=>e+"",d:function(e){return Math.abs(e=Math.round(e))>=1e21?e.toLocaleString("en").replace(/,/g,""):e.toString(10)},e:(e,t)=>e.toExponential(t),f:(e,t)=>e.toFixed(t),g:(e,t)=>e.toPrecision(t),o:e=>Math.round(e).toString(8),p:(e,t)=>o(100*e,t),r:o,s:function(e,a){var i=t(e,a);if(!i)return e+"";var r=i[0],s=i[1],o=s-(n=3*Math.max(-8,Math.min(8,Math.floor(s/3))))+1,l=r.length;return o===l?r:o>l?r+new Array(o-l+1).join("0"):o>0?r.slice(0,o)+"."+r.slice(o):"0."+new Array(1-o).join("0")+t(e,Math.max(0,a+o-1))[0]},X:e=>Math.round(e).toString(16).toUpperCase(),x:e=>Math.round(e).toString(16)};function c(e){return e}var u,d=Array.prototype.map,p=["y","z","a","f","p","n","µ","m","","k","M","G","T","P","E","Z","Y"];function m(e){var t,i,s=void 0===e.grouping||void 0===e.thousands?c:(t=d.call(e.grouping,Number),i=e.thousands+"",function(e,a){for(var n=e.length,r=[],s=0,o=t[0],l=0;n>0&&o>0&&(l+o+1>a&&(o=Math.max(1,a-l)),r.push(e.substring(n-=o,n+o)),!((l+=o+1)>a));)o=t[s=(s+1)%t.length];return r.reverse().join(i)}),o=void 0===e.currency?"":e.currency[0]+"",u=void 0===e.currency?"":e.currency[1]+"",m=void 0===e.decimal?".":e.decimal+"",b=void 0===e.numerals?c:function(e){return function(t){return t.replace(/[0-9]/g,(function(t){return e[+t]}))}}(d.call(e.numerals,String)),g=void 0===e.percent?"%":e.percent+"",f=void 0===e.minus?"−":e.minus+"",y=void 0===e.nan?"NaN":e.nan+"";function h(e){var t=(e=r(e)).fill,a=e.align,i=e.sign,c=e.symbol,d=e.zero,h=e.width,v=e.comma,E=e.precision,x=e.trim,j=e.type;"n"===j?(v=!0,j="g"):l[j]||(void 0===E&&(E=12),x=!0,j="g"),(d||"0"===t&&"="===a)&&(d=!0,t="0",a="=");var S="$"===c?o:"#"===c&&/[boxX]/.test(j)?"0"+j.toLowerCase():"",k="$"===c?u:/[%p]/.test(j)?g:"",O=l[j],w=/[defgprs%]/.test(j);function T(e){var r,o,l,c=S,u=k;if("c"===j)u=O(e)+u,e="";else{var g=(e=+e)<0||1/e<0;if(e=isNaN(e)?y:O(Math.abs(e),E),x&&(e=function(e){e:for(var t,a=e.length,n=1,i=-1;n<a;++n)switch(e[n]){case".":i=t=n;break;case"0":0===i&&(i=n),t=n;break;default:if(!+e[n])break e;i>0&&(i=0)}return i>0?e.slice(0,i)+e.slice(t+1):e}(e)),g&&0==+e&&"+"!==i&&(g=!1),c=(g?"("===i?i:f:"-"===i||"("===i?"":i)+c,u=("s"===j?p[8+n/3]:"")+u+(g&&"("===i?")":""),w)for(r=-1,o=e.length;++r<o;)if(48>(l=e.charCodeAt(r))||l>57){u=(46===l?m+e.slice(r+1):e.slice(r))+u,e=e.slice(0,r);break}}v&&!d&&(e=s(e,1/0));var T=c.length+e.length+u.length,I=T<h?new Array(h-T+1).join(t):"";switch(v&&d&&(e=s(I+e,I.length?h-u.length:1/0),I=""),a){case"<":e=c+e+u+I;break;case"=":e=c+I+e+u;break;case"^":e=I.slice(0,T=I.length>>1)+c+e+u+I.slice(T);break;default:e=I+c+e+u}return b(e)}return E=void 0===E?6:/[gprs]/.test(j)?Math.max(1,Math.min(21,E)):Math.max(0,Math.min(20,E)),T.toString=function(){return e+""},T}return{format:h,formatPrefix:function(e,t){var n=h(((e=r(e)).type="f",e)),i=3*Math.max(-8,Math.min(8,Math.floor(a(t)/3))),s=Math.pow(10,-i),o=p[8+i/3];return function(e){return n(s*e)+o}}}}function b(t){return u=m(t),e.format=u.format,e.formatPrefix=u.formatPrefix,u}b({thousands:",",grouping:[3],currency:["$",""]}),e.FormatSpecifier=s,e.formatDefaultLocale=b,e.formatLocale=m,e.formatSpecifier=r,e.precisionFixed=function(e){return Math.max(0,-a(Math.abs(e)))},e.precisionPrefix=function(e,t){return Math.max(0,3*Math.max(-8,Math.min(8,Math.floor(a(t)/3)))-a(Math.abs(e)))},e.precisionRound=function(e,t){return e=Math.abs(e),t=Math.abs(t)-e,Math.max(0,a(t)-a(e))+1},Object.defineProperty(e,"__esModule",{value:!0})}(t)},function(e,t,a){!function(e,t){"use strict";function a(e){if(0<=e.y&&e.y<100){var t=new Date(-1,e.m,e.d,e.H,e.M,e.S,e.L);return t.setFullYear(e.y),t}return new Date(e.y,e.m,e.d,e.H,e.M,e.S,e.L)}function n(e){if(0<=e.y&&e.y<100){var t=new Date(Date.UTC(-1,e.m,e.d,e.H,e.M,e.S,e.L));return t.setUTCFullYear(e.y),t}return new Date(Date.UTC(e.y,e.m,e.d,e.H,e.M,e.S,e.L))}function i(e,t,a){return{y:e,m:t,d:a,H:0,M:0,S:0,L:0}}function r(e){var r=e.dateTime,s=e.date,l=e.time,c=e.periods,u=e.days,d=e.shortDays,p=e.months,G=e.shortMonths,pe=m(c),ke=b(c),Oe=m(u),we=b(u),Te=m(d),Ie=b(d),Ce=m(p),Me=b(p),_e=m(G),Fe=b(G),Ae={a:function(e){return d[e.getDay()]},A:function(e){return u[e.getDay()]},b:function(e){return G[e.getMonth()]},B:function(e){return p[e.getMonth()]},c:null,d:N,e:N,f:q,g:J,G:Z,H:P,I:R,j:L,L:B,m:z,M:$,p:function(e){return c[+(e.getHours()>=12)]},q:function(e){return 1+~~(e.getMonth()/3)},Q:je,s:Se,S:V,u:U,U:H,V:Q,w:W,W:K,x:null,X:null,y:Y,Y:X,Z:ee,"%":xe},De={a:function(e){return d[e.getUTCDay()]},A:function(e){return u[e.getUTCDay()]},b:function(e){return G[e.getUTCMonth()]},B:function(e){return p[e.getUTCMonth()]},c:null,d:te,e:te,f:se,g:ye,G:ve,H:ae,I:ne,j:ie,L:re,m:oe,M:le,p:function(e){return c[+(e.getUTCHours()>=12)]},q:function(e){return 1+~~(e.getUTCMonth()/3)},Q:je,s:Se,S:ce,u:ue,U:de,V:me,w:be,W:ge,x:null,X:null,y:fe,Y:he,Z:Ee,"%":xe},Ne={a:function(e,t,a){var n=Te.exec(t.slice(a));return n?(e.w=Ie.get(n[0].toLowerCase()),a+n[0].length):-1},A:function(e,t,a){var n=Oe.exec(t.slice(a));return n?(e.w=we.get(n[0].toLowerCase()),a+n[0].length):-1},b:function(e,t,a){var n=_e.exec(t.slice(a));return n?(e.m=Fe.get(n[0].toLowerCase()),a+n[0].length):-1},B:function(e,t,a){var n=Ce.exec(t.slice(a));return n?(e.m=Me.get(n[0].toLowerCase()),a+n[0].length):-1},c:function(e,t,a){return Le(e,r,t,a)},d:O,e:O,f:_,g:x,G:E,H:T,I:T,j:w,L:M,m:k,M:I,p:function(e,t,a){var n=pe.exec(t.slice(a));return n?(e.p=ke.get(n[0].toLowerCase()),a+n[0].length):-1},q:S,Q:A,s:D,S:C,u:f,U:y,V:h,w:g,W:v,x:function(e,t,a){return Le(e,s,t,a)},X:function(e,t,a){return Le(e,l,t,a)},y:x,Y:E,Z:j,"%":F};function Pe(e,t){return function(a){var n,i,r,s=[],l=-1,c=0,u=e.length;for(a instanceof Date||(a=new Date(+a));++l<u;)37===e.charCodeAt(l)&&(s.push(e.slice(c,l)),null!=(i=o[n=e.charAt(++l)])?n=e.charAt(++l):i="e"===n?" ":"0",(r=t[n])&&(n=r(a,i)),s.push(n),c=l+1);return s.push(e.slice(c,l)),s.join("")}}function Re(e,r){return function(s){var o,l,c=i(1900,void 0,1);if(Le(c,e,s+="",0)!=s.length)return null;if("Q"in c)return new Date(c.Q);if("s"in c)return new Date(1e3*c.s+("L"in c?c.L:0));if(r&&!("Z"in c)&&(c.Z=0),"p"in c&&(c.H=c.H%12+12*c.p),void 0===c.m&&(c.m="q"in c?c.q:0),"V"in c){if(c.V<1||c.V>53)return null;"w"in c||(c.w=1),"Z"in c?(l=(o=n(i(c.y,0,1))).getUTCDay(),o=l>4||0===l?t.utcMonday.ceil(o):t.utcMonday(o),o=t.utcDay.offset(o,7*(c.V-1)),c.y=o.getUTCFullYear(),c.m=o.getUTCMonth(),c.d=o.getUTCDate()+(c.w+6)%7):(l=(o=a(i(c.y,0,1))).getDay(),o=l>4||0===l?t.timeMonday.ceil(o):t.timeMonday(o),o=t.timeDay.offset(o,7*(c.V-1)),c.y=o.getFullYear(),c.m=o.getMonth(),c.d=o.getDate()+(c.w+6)%7)}else("W"in c||"U"in c)&&("w"in c||(c.w="u"in c?c.u%7:"W"in c?1:0),l="Z"in c?n(i(c.y,0,1)).getUTCDay():a(i(c.y,0,1)).getDay(),c.m=0,c.d="W"in c?(c.w+6)%7+7*c.W-(l+5)%7:c.w+7*c.U-(l+6)%7);return"Z"in c?(c.H+=c.Z/100|0,c.M+=c.Z%100,n(c)):a(c)}}function Le(e,t,a,n){for(var i,r,s=0,l=t.length,c=a.length;s<l;){if(n>=c)return-1;if(37===(i=t.charCodeAt(s++))){if(i=t.charAt(s++),!(r=Ne[i in o?t.charAt(s++):i])||(n=r(e,a,n))<0)return-1}else if(i!=a.charCodeAt(n++))return-1}return n}return Ae.x=Pe(s,Ae),Ae.X=Pe(l,Ae),Ae.c=Pe(r,Ae),De.x=Pe(s,De),De.X=Pe(l,De),De.c=Pe(r,De),{format:function(e){var t=Pe(e+="",Ae);return t.toString=function(){return e},t},parse:function(e){var t=Re(e+="",!1);return t.toString=function(){return e},t},utcFormat:function(e){var t=Pe(e+="",De);return t.toString=function(){return e},t},utcParse:function(e){var t=Re(e+="",!0);return t.toString=function(){return e},t}}}var s,o={"-":"",_:" ",0:"0"},l=/^\s*\d+/,c=/^%/,u=/[\\^$*+?|[\]().{}]/g;function d(e,t,a){var n=e<0?"-":"",i=(n?-e:e)+"",r=i.length;return n+(r<a?new Array(a-r+1).join(t)+i:i)}function p(e){return e.replace(u,"\\$&")}function m(e){return new RegExp("^(?:"+e.map(p).join("|")+")","i")}function b(e){return new Map(e.map(((e,t)=>[e.toLowerCase(),t])))}function g(e,t,a){var n=l.exec(t.slice(a,a+1));return n?(e.w=+n[0],a+n[0].length):-1}function f(e,t,a){var n=l.exec(t.slice(a,a+1));return n?(e.u=+n[0],a+n[0].length):-1}function y(e,t,a){var n=l.exec(t.slice(a,a+2));return n?(e.U=+n[0],a+n[0].length):-1}function h(e,t,a){var n=l.exec(t.slice(a,a+2));return n?(e.V=+n[0],a+n[0].length):-1}function v(e,t,a){var n=l.exec(t.slice(a,a+2));return n?(e.W=+n[0],a+n[0].length):-1}function E(e,t,a){var n=l.exec(t.slice(a,a+4));return n?(e.y=+n[0],a+n[0].length):-1}function x(e,t,a){var n=l.exec(t.slice(a,a+2));return n?(e.y=+n[0]+(+n[0]>68?1900:2e3),a+n[0].length):-1}function j(e,t,a){var n=/^(Z)|([+-]\d\d)(?::?(\d\d))?/.exec(t.slice(a,a+6));return n?(e.Z=n[1]?0:-(n[2]+(n[3]||"00")),a+n[0].length):-1}function S(e,t,a){var n=l.exec(t.slice(a,a+1));return n?(e.q=3*n[0]-3,a+n[0].length):-1}function k(e,t,a){var n=l.exec(t.slice(a,a+2));return n?(e.m=n[0]-1,a+n[0].length):-1}function O(e,t,a){var n=l.exec(t.slice(a,a+2));return n?(e.d=+n[0],a+n[0].length):-1}function w(e,t,a){var n=l.exec(t.slice(a,a+3));return n?(e.m=0,e.d=+n[0],a+n[0].length):-1}function T(e,t,a){var n=l.exec(t.slice(a,a+2));return n?(e.H=+n[0],a+n[0].length):-1}function I(e,t,a){var n=l.exec(t.slice(a,a+2));return n?(e.M=+n[0],a+n[0].length):-1}function C(e,t,a){var n=l.exec(t.slice(a,a+2));return n?(e.S=+n[0],a+n[0].length):-1}function M(e,t,a){var n=l.exec(t.slice(a,a+3));return n?(e.L=+n[0],a+n[0].length):-1}function _(e,t,a){var n=l.exec(t.slice(a,a+6));return n?(e.L=Math.floor(n[0]/1e3),a+n[0].length):-1}function F(e,t,a){var n=c.exec(t.slice(a,a+1));return n?a+n[0].length:-1}function A(e,t,a){var n=l.exec(t.slice(a));return n?(e.Q=+n[0],a+n[0].length):-1}function D(e,t,a){var n=l.exec(t.slice(a));return n?(e.s=+n[0],a+n[0].length):-1}function N(e,t){return d(e.getDate(),t,2)}function P(e,t){return d(e.getHours(),t,2)}function R(e,t){return d(e.getHours()%12||12,t,2)}function L(e,a){return d(1+t.timeDay.count(t.timeYear(e),e),a,3)}function B(e,t){return d(e.getMilliseconds(),t,3)}function q(e,t){return B(e,t)+"000"}function z(e,t){return d(e.getMonth()+1,t,2)}function $(e,t){return d(e.getMinutes(),t,2)}function V(e,t){return d(e.getSeconds(),t,2)}function U(e){var t=e.getDay();return 0===t?7:t}function H(e,a){return d(t.timeSunday.count(t.timeYear(e)-1,e),a,2)}function G(e){var a=e.getDay();return a>=4||0===a?t.timeThursday(e):t.timeThursday.ceil(e)}function Q(e,a){return e=G(e),d(t.timeThursday.count(t.timeYear(e),e)+(4===t.timeYear(e).getDay()),a,2)}function W(e){return e.getDay()}function K(e,a){return d(t.timeMonday.count(t.timeYear(e)-1,e),a,2)}function Y(e,t){return d(e.getFullYear()%100,t,2)}function J(e,t){return d((e=G(e)).getFullYear()%100,t,2)}function X(e,t){return d(e.getFullYear()%1e4,t,4)}function Z(e,a){var n=e.getDay();return d((e=n>=4||0===n?t.timeThursday(e):t.timeThursday.ceil(e)).getFullYear()%1e4,a,4)}function ee(e){var t=e.getTimezoneOffset();return(t>0?"-":(t*=-1,"+"))+d(t/60|0,"0",2)+d(t%60,"0",2)}function te(e,t){return d(e.getUTCDate(),t,2)}function ae(e,t){return d(e.getUTCHours(),t,2)}function ne(e,t){return d(e.getUTCHours()%12||12,t,2)}function ie(e,a){return d(1+t.utcDay.count(t.utcYear(e),e),a,3)}function re(e,t){return d(e.getUTCMilliseconds(),t,3)}function se(e,t){return re(e,t)+"000"}function oe(e,t){return d(e.getUTCMonth()+1,t,2)}function le(e,t){return d(e.getUTCMinutes(),t,2)}function ce(e,t){return d(e.getUTCSeconds(),t,2)}function ue(e){var t=e.getUTCDay();return 0===t?7:t}function de(e,a){return d(t.utcSunday.count(t.utcYear(e)-1,e),a,2)}function pe(e){var a=e.getUTCDay();return a>=4||0===a?t.utcThursday(e):t.utcThursday.ceil(e)}function me(e,a){return e=pe(e),d(t.utcThursday.count(t.utcYear(e),e)+(4===t.utcYear(e).getUTCDay()),a,2)}function be(e){return e.getUTCDay()}function ge(e,a){return d(t.utcMonday.count(t.utcYear(e)-1,e),a,2)}function fe(e,t){return d(e.getUTCFullYear()%100,t,2)}function ye(e,t){return d((e=pe(e)).getUTCFullYear()%100,t,2)}function he(e,t){return d(e.getUTCFullYear()%1e4,t,4)}function ve(e,a){var n=e.getUTCDay();return d((e=n>=4||0===n?t.utcThursday(e):t.utcThursday.ceil(e)).getUTCFullYear()%1e4,a,4)}function Ee(){return"+0000"}function xe(){return"%"}function je(e){return+e}function Se(e){return Math.floor(+e/1e3)}function ke(t){return s=r(t),e.timeFormat=s.format,e.timeParse=s.parse,e.utcFormat=s.utcFormat,e.utcParse=s.utcParse,s}ke({dateTime:"%x, %X",date:"%-m/%-d/%Y",time:"%-I:%M:%S %p",periods:["AM","PM"],days:["Sunday","Monday","Tuesday","Wednesday","Thursday","Friday","Saturday"],shortDays:["Sun","Mon","Tue","Wed","Thu","Fri","Sat"],months:["January","February","March","April","May","June","July","August","September","October","November","December"],shortMonths:["Jan","Feb","Mar","Apr","May","Jun","Jul","Aug","Sep","Oct","Nov","Dec"]});var Oe="%Y-%m-%dT%H:%M:%S.%LZ";var we=Date.prototype.toISOString?function(e){return e.toISOString()}:e.utcFormat(Oe);var Te=+new Date("2000-01-01T00:00:00.000Z")?function(e){var t=new Date(e);return isNaN(t)?null:t}:e.utcParse(Oe);e.isoFormat=we,e.isoParse=Te,e.timeFormatDefaultLocale=ke,e.timeFormatLocale=r,Object.defineProperty(e,"__esModule",{value:!0})}(t,a(817))},function(e,t,a){"use strict";var n=a(1281),i=a(1282).remove,r={},s={},o={},l={},c={};function u(e){return String("000"+(e||"")).slice(-3)}function d(e){return o[e]}function p(e){return s[e]}function m(e){var t=u(e);return p(l[t])}function b(e){var t=u(e);return l[t]}function g(e){if("string"==typeof e){if(/^[0-9]*$/.test(e))return b(e);if(2===e.length)return e.toUpperCase();if(3===e.length)return d(e.toUpperCase())}if("number"==typeof e)return b(e)}n.forEach((function(e){var t=e;s[t[0]]=t[1],o[t[1]]=t[0],l[t[2]]=t[0],c[t[0]]=t[2]})),t.registerLocale=function(e){if(!e.locale)throw new TypeError("Missing localeData.locale");if(!e.countries)throw new TypeError("Missing localeData.countries");r[e.locale]=e.countries},t.alpha3ToAlpha2=d,t.alpha2ToAlpha3=p,t.alpha3ToNumeric=function(e){return c[d(e)]},t.alpha2ToNumeric=function(e){return c[e]},t.numericToAlpha3=m,t.numericToAlpha2=b,t.toAlpha3=function(e){if("string"==typeof e){if(/^[0-9]*$/.test(e))return m(e);if(2===e.length)return p(e.toUpperCase());if(3===e.length)return e.toUpperCase()}if("number"==typeof e)return m(e)},t.toAlpha2=g,t.getName=function(e,t){try{return r[t.toLowerCase()][g(e)]}catch(e){return}},t.getNames=function(e){var t=r[e.toLowerCase()];return void 0===t?{}:t},t.getAlpha2Code=function(e,t){try{var a,n=r[t.toLowerCase()];for(a in n)if(n.hasOwnProperty(a)&&n[a].toLowerCase()===e.toLowerCase())return a;return}catch(e){return}},t.getSimpleAlpha2Code=function(e,t){try{var a,n=r[t.toLowerCase()];for(a in n)if(n.hasOwnProperty(a)&&i(n[a].toLowerCase())===i(e.toLowerCase()))return a;return}catch(e){return}},t.getAlpha2Codes=function(){return s},t.getAlpha3Code=function(e,t){var a=this.getAlpha2Code(e,t);return a?this.toAlpha3(a):void 0},t.getSimpleAlpha3Code=function(e,t){var a=this.getSimpleAlpha2Code(e,t);return a?this.toAlpha3(a):void 0},t.getAlpha3Codes=function(){return o},t.getNumericCodes=function(){return l},t.langs=function(){return Object.keys(r)},t.isValid=function(e){if(!e)return!1;var t=e.toString().toUpperCase();return o.hasOwnProperty(t)||s.hasOwnProperty(t)||l.hasOwnProperty(t)}},function(e){e.exports=JSON.parse('[["AF","AFG","004","ISO 3166-2:AF"],["AX","ALA","248","ISO 3166-2:AX"],["AL","ALB","008","ISO 3166-2:AL"],["DZ","DZA","012","ISO 3166-2:DZ"],["AS","ASM","016","ISO 3166-2:AS"],["AD","AND","020","ISO 3166-2:AD"],["AO","AGO","024","ISO 3166-2:AO"],["AI","AIA","660","ISO 3166-2:AI"],["AQ","ATA","010","ISO 3166-2:AQ"],["AG","ATG","028","ISO 3166-2:AG"],["AR","ARG","032","ISO 3166-2:AR"],["AM","ARM","051","ISO 3166-2:AM"],["AW","ABW","533","ISO 3166-2:AW"],["AU","AUS","036","ISO 3166-2:AU"],["AT","AUT","040","ISO 3166-2:AT"],["AZ","AZE","031","ISO 3166-2:AZ"],["BS","BHS","044","ISO 3166-2:BS"],["BH","BHR","048","ISO 3166-2:BH"],["BD","BGD","050","ISO 3166-2:BD"],["BB","BRB","052","ISO 3166-2:BB"],["BY","BLR","112","ISO 3166-2:BY"],["BE","BEL","056","ISO 3166-2:BE"],["BZ","BLZ","084","ISO 3166-2:BZ"],["BJ","BEN","204","ISO 3166-2:BJ"],["BM","BMU","060","ISO 3166-2:BM"],["BT","BTN","064","ISO 3166-2:BT"],["BO","BOL","068","ISO 3166-2:BO"],["BQ","BES","535","ISO 3166-2:BQ"],["BA","BIH","070","ISO 3166-2:BA"],["BW","BWA","072","ISO 3166-2:BW"],["BV","BVT","074","ISO 3166-2:BV"],["BR","BRA","076","ISO 3166-2:BR"],["IO","IOT","086","ISO 3166-2:IO"],["BN","BRN","096","ISO 3166-2:BN"],["BG","BGR","100","ISO 3166-2:BG"],["BF","BFA","854","ISO 3166-2:BF"],["BI","BDI","108","ISO 3166-2:BI"],["KH","KHM","116","ISO 3166-2:KH"],["CM","CMR","120","ISO 3166-2:CM"],["CA","CAN","124","ISO 3166-2:CA"],["CV","CPV","132","ISO 3166-2:CV"],["KY","CYM","136","ISO 3166-2:KY"],["CF","CAF","140","ISO 3166-2:CF"],["TD","TCD","148","ISO 3166-2:TD"],["CL","CHL","152","ISO 3166-2:CL"],["CN","CHN","156","ISO 3166-2:CN"],["CX","CXR","162","ISO 3166-2:CX"],["CC","CCK","166","ISO 3166-2:CC"],["CO","COL","170","ISO 3166-2:CO"],["KM","COM","174","ISO 3166-2:KM"],["CG","COG","178","ISO 3166-2:CG"],["CD","COD","180","ISO 3166-2:CD"],["CK","COK","184","ISO 3166-2:CK"],["CR","CRI","188","ISO 3166-2:CR"],["CI","CIV","384","ISO 3166-2:CI"],["HR","HRV","191","ISO 3166-2:HR"],["CU","CUB","192","ISO 3166-2:CU"],["CW","CUW","531","ISO 3166-2:CW"],["CY","CYP","196","ISO 3166-2:CY"],["CZ","CZE","203","ISO 3166-2:CZ"],["DK","DNK","208","ISO 3166-2:DK"],["DJ","DJI","262","ISO 3166-2:DJ"],["DM","DMA","212","ISO 3166-2:DM"],["DO","DOM","214","ISO 3166-2:DO"],["EC","ECU","218","ISO 3166-2:EC"],["EG","EGY","818","ISO 3166-2:EG"],["SV","SLV","222","ISO 3166-2:SV"],["GQ","GNQ","226","ISO 3166-2:GQ"],["ER","ERI","232","ISO 3166-2:ER"],["EE","EST","233","ISO 3166-2:EE"],["ET","ETH","231","ISO 3166-2:ET"],["FK","FLK","238","ISO 3166-2:FK"],["FO","FRO","234","ISO 3166-2:FO"],["FJ","FJI","242","ISO 3166-2:FJ"],["FI","FIN","246","ISO 3166-2:FI"],["FR","FRA","250","ISO 3166-2:FR"],["GF","GUF","254","ISO 3166-2:GF"],["PF","PYF","258","ISO 3166-2:PF"],["TF","ATF","260","ISO 3166-2:TF"],["GA","GAB","266","ISO 3166-2:GA"],["GM","GMB","270","ISO 3166-2:GM"],["GE","GEO","268","ISO 3166-2:GE"],["DE","DEU","276","ISO 3166-2:DE"],["GH","GHA","288","ISO 3166-2:GH"],["GI","GIB","292","ISO 3166-2:GI"],["GR","GRC","300","ISO 3166-2:GR"],["GL","GRL","304","ISO 3166-2:GL"],["GD","GRD","308","ISO 3166-2:GD"],["GP","GLP","312","ISO 3166-2:GP"],["GU","GUM","316","ISO 3166-2:GU"],["GT","GTM","320","ISO 3166-2:GT"],["GG","GGY","831","ISO 3166-2:GG"],["GN","GIN","324","ISO 3166-2:GN"],["GW","GNB","624","ISO 3166-2:GW"],["GY","GUY","328","ISO 3166-2:GY"],["HT","HTI","332","ISO 3166-2:HT"],["HM","HMD","334","ISO 3166-2:HM"],["VA","VAT","336","ISO 3166-2:VA"],["HN","HND","340","ISO 3166-2:HN"],["HK","HKG","344","ISO 3166-2:HK"],["HU","HUN","348","ISO 3166-2:HU"],["IS","ISL","352","ISO 3166-2:IS"],["IN","IND","356","ISO 3166-2:IN"],["ID","IDN","360","ISO 3166-2:ID"],["IR","IRN","364","ISO 3166-2:IR"],["IQ","IRQ","368","ISO 3166-2:IQ"],["IE","IRL","372","ISO 3166-2:IE"],["IM","IMN","833","ISO 3166-2:IM"],["IL","ISR","376","ISO 3166-2:IL"],["IT","ITA","380","ISO 3166-2:IT"],["JM","JAM","388","ISO 3166-2:JM"],["JP","JPN","392","ISO 3166-2:JP"],["JE","JEY","832","ISO 3166-2:JE"],["JO","JOR","400","ISO 3166-2:JO"],["KZ","KAZ","398","ISO 3166-2:KZ"],["KE","KEN","404","ISO 3166-2:KE"],["KI","KIR","296","ISO 3166-2:KI"],["KP","PRK","408","ISO 3166-2:KP"],["KR","KOR","410","ISO 3166-2:KR"],["KW","KWT","414","ISO 3166-2:KW"],["KG","KGZ","417","ISO 3166-2:KG"],["LA","LAO","418","ISO 3166-2:LA"],["LV","LVA","428","ISO 3166-2:LV"],["LB","LBN","422","ISO 3166-2:LB"],["LS","LSO","426","ISO 3166-2:LS"],["LR","LBR","430","ISO 3166-2:LR"],["LY","LBY","434","ISO 3166-2:LY"],["LI","LIE","438","ISO 3166-2:LI"],["LT","LTU","440","ISO 3166-2:LT"],["LU","LUX","442","ISO 3166-2:LU"],["MO","MAC","446","ISO 3166-2:MO"],["MK","MKD","807","ISO 3166-2:MK"],["MG","MDG","450","ISO 3166-2:MG"],["MW","MWI","454","ISO 3166-2:MW"],["MY","MYS","458","ISO 3166-2:MY"],["MV","MDV","462","ISO 3166-2:MV"],["ML","MLI","466","ISO 3166-2:ML"],["MT","MLT","470","ISO 3166-2:MT"],["MH","MHL","584","ISO 3166-2:MH"],["MQ","MTQ","474","ISO 3166-2:MQ"],["MR","MRT","478","ISO 3166-2:MR"],["MU","MUS","480","ISO 3166-2:MU"],["YT","MYT","175","ISO 3166-2:YT"],["MX","MEX","484","ISO 3166-2:MX"],["FM","FSM","583","ISO 3166-2:FM"],["MD","MDA","498","ISO 3166-2:MD"],["MC","MCO","492","ISO 3166-2:MC"],["MN","MNG","496","ISO 3166-2:MN"],["ME","MNE","499","ISO 3166-2:ME"],["MS","MSR","500","ISO 3166-2:MS"],["MA","MAR","504","ISO 3166-2:MA"],["MZ","MOZ","508","ISO 3166-2:MZ"],["MM","MMR","104","ISO 3166-2:MM"],["NA","NAM","516","ISO 3166-2:NA"],["NR","NRU","520","ISO 3166-2:NR"],["NP","NPL","524","ISO 3166-2:NP"],["NL","NLD","528","ISO 3166-2:NL"],["NC","NCL","540","ISO 3166-2:NC"],["NZ","NZL","554","ISO 3166-2:NZ"],["NI","NIC","558","ISO 3166-2:NI"],["NE","NER","562","ISO 3166-2:NE"],["NG","NGA","566","ISO 3166-2:NG"],["NU","NIU","570","ISO 3166-2:NU"],["NF","NFK","574","ISO 3166-2:NF"],["MP","MNP","580","ISO 3166-2:MP"],["NO","NOR","578","ISO 3166-2:NO"],["OM","OMN","512","ISO 3166-2:OM"],["PK","PAK","586","ISO 3166-2:PK"],["PW","PLW","585","ISO 3166-2:PW"],["PS","PSE","275","ISO 3166-2:PS"],["PA","PAN","591","ISO 3166-2:PA"],["PG","PNG","598","ISO 3166-2:PG"],["PY","PRY","600","ISO 3166-2:PY"],["PE","PER","604","ISO 3166-2:PE"],["PH","PHL","608","ISO 3166-2:PH"],["PN","PCN","612","ISO 3166-2:PN"],["PL","POL","616","ISO 3166-2:PL"],["PT","PRT","620","ISO 3166-2:PT"],["PR","PRI","630","ISO 3166-2:PR"],["QA","QAT","634","ISO 3166-2:QA"],["RE","REU","638","ISO 3166-2:RE"],["RO","ROU","642","ISO 3166-2:RO"],["RU","RUS","643","ISO 3166-2:RU"],["RW","RWA","646","ISO 3166-2:RW"],["BL","BLM","652","ISO 3166-2:BL"],["SH","SHN","654","ISO 3166-2:SH"],["KN","KNA","659","ISO 3166-2:KN"],["LC","LCA","662","ISO 3166-2:LC"],["MF","MAF","663","ISO 3166-2:MF"],["PM","SPM","666","ISO 3166-2:PM"],["VC","VCT","670","ISO 3166-2:VC"],["WS","WSM","882","ISO 3166-2:WS"],["SM","SMR","674","ISO 3166-2:SM"],["ST","STP","678","ISO 3166-2:ST"],["SA","SAU","682","ISO 3166-2:SA"],["SN","SEN","686","ISO 3166-2:SN"],["RS","SRB","688","ISO 3166-2:RS"],["SC","SYC","690","ISO 3166-2:SC"],["SL","SLE","694","ISO 3166-2:SL"],["SG","SGP","702","ISO 3166-2:SG"],["SX","SXM","534","ISO 3166-2:SX"],["SK","SVK","703","ISO 3166-2:SK"],["SI","SVN","705","ISO 3166-2:SI"],["SB","SLB","090","ISO 3166-2:SB"],["SO","SOM","706","ISO 3166-2:SO"],["ZA","ZAF","710","ISO 3166-2:ZA"],["GS","SGS","239","ISO 3166-2:GS"],["SS","SSD","728","ISO 3166-2:SS"],["ES","ESP","724","ISO 3166-2:ES"],["LK","LKA","144","ISO 3166-2:LK"],["SD","SDN","729","ISO 3166-2:SD"],["SR","SUR","740","ISO 3166-2:SR"],["SJ","SJM","744","ISO 3166-2:SJ"],["SZ","SWZ","748","ISO 3166-2:SZ"],["SE","SWE","752","ISO 3166-2:SE"],["CH","CHE","756","ISO 3166-2:CH"],["SY","SYR","760","ISO 3166-2:SY"],["TW","TWN","158","ISO 3166-2:TW"],["TJ","TJK","762","ISO 3166-2:TJ"],["TZ","TZA","834","ISO 3166-2:TZ"],["TH","THA","764","ISO 3166-2:TH"],["TL","TLS","626","ISO 3166-2:TL"],["TG","TGO","768","ISO 3166-2:TG"],["TK","TKL","772","ISO 3166-2:TK"],["TO","TON","776","ISO 3166-2:TO"],["TT","TTO","780","ISO 3166-2:TT"],["TN","TUN","788","ISO 3166-2:TN"],["TR","TUR","792","ISO 3166-2:TR"],["TM","TKM","795","ISO 3166-2:TM"],["TC","TCA","796","ISO 3166-2:TC"],["TV","TUV","798","ISO 3166-2:TV"],["UG","UGA","800","ISO 3166-2:UG"],["UA","UKR","804","ISO 3166-2:UA"],["AE","ARE","784","ISO 3166-2:AE"],["GB","GBR","826","ISO 3166-2:GB"],["US","USA","840","ISO 3166-2:US"],["UM","UMI","581","ISO 3166-2:UM"],["UY","URY","858","ISO 3166-2:UY"],["UZ","UZB","860","ISO 3166-2:UZ"],["VU","VUT","548","ISO 3166-2:VU"],["VE","VEN","862","ISO 3166-2:VE"],["VN","VNM","704","ISO 3166-2:VN"],["VG","VGB","092","ISO 3166-2:VG"],["VI","VIR","850","ISO 3166-2:VI"],["WF","WLF","876","ISO 3166-2:WF"],["EH","ESH","732","ISO 3166-2:EH"],["YE","YEM","887","ISO 3166-2:YE"],["ZM","ZMB","894","ISO 3166-2:ZM"],["ZW","ZWE","716","ISO 3166-2:ZW"],["XK","XKX","","ISO 3166-2:XK"]]')},function(e,t){t.remove=function(e){return e.replace(/[^\u0000-\u007e]/g,(function(e){return n[e]||e}))};for(var a=[{base:" ",chars:" "},{base:"0",chars:"߀"},{base:"A",chars:"ⒶＡÀÁÂẦẤẪẨÃĀĂẰẮẴẲȦǠÄǞẢÅǺǍȀȂẠẬẶḀĄȺⱯ"},{base:"AA",chars:"Ꜳ"},{base:"AE",chars:"ÆǼǢ"},{base:"AO",chars:"Ꜵ"},{base:"AU",chars:"Ꜷ"},{base:"AV",chars:"ꜸꜺ"},{base:"AY",chars:"Ꜽ"},{base:"B",chars:"ⒷＢḂḄḆɃƁ"},{base:"C",chars:"ⒸＣꜾḈĆCĈĊČÇƇȻ"},{base:"D",chars:"ⒹＤḊĎḌḐḒḎĐƊƉᴅꝹ"},{base:"Dh",chars:"Ð"},{base:"DZ",chars:"DZDŽ"},{base:"Dz",chars:"DzDž"},{base:"E",chars:"ɛⒺＥÈÉÊỀẾỄỂẼĒḔḖĔĖËẺĚȄȆẸỆȨḜĘḘḚƐƎᴇ"},{base:"F",chars:"ꝼⒻＦḞƑꝻ"},{base:"G",chars:"ⒼＧǴĜḠĞĠǦĢǤƓꞠꝽꝾɢ"},{base:"H",chars:"ⒽＨĤḢḦȞḤḨḪĦⱧⱵꞍ"},{base:"I",chars:"ⒾＩÌÍÎĨĪĬİÏḮỈǏȈȊỊĮḬƗ"},{base:"J",chars:"ⒿＪĴɈȷ"},{base:"K",chars:"ⓀＫḰǨḲĶḴƘⱩꝀꝂꝄꞢ"},{base:"L",chars:"ⓁＬĿĹĽḶḸĻḼḺŁȽⱢⱠꝈꝆꞀ"},{base:"LJ",chars:"LJ"},{base:"Lj",chars:"Lj"},{base:"M",chars:"ⓂＭḾṀṂⱮƜϻ"},{base:"N",chars:"ꞤȠⓃＮǸŃÑṄŇṆŅṊṈƝꞐᴎ"},{base:"NJ",chars:"NJ"},{base:"Nj",chars:"Nj"},{base:"O",chars:"ⓄＯÒÓÔỒỐỖỔÕṌȬṎŌṐṒŎȮȰÖȪỎŐǑȌȎƠỜỚỠỞỢỌỘǪǬØǾƆƟꝊꝌ"},{base:"OE",chars:"Œ"},{base:"OI",chars:"Ƣ"},{base:"OO",chars:"Ꝏ"},{base:"OU",chars:"Ȣ"},{base:"P",chars:"ⓅＰṔṖƤⱣꝐꝒꝔ"},{base:"Q",chars:"ⓆＱꝖꝘɊ"},{base:"R",chars:"ⓇＲŔṘŘȐȒṚṜŖṞɌⱤꝚꞦꞂ"},{base:"S",chars:"ⓈＳẞŚṤŜṠŠṦṢṨȘŞⱾꞨꞄ"},{base:"T",chars:"ⓉＴṪŤṬȚŢṰṮŦƬƮȾꞆ"},{base:"Th",chars:"Þ"},{base:"TZ",chars:"Ꜩ"},{base:"U",chars:"ⓊＵÙÚÛŨṸŪṺŬÜǛǗǕǙỦŮŰǓȔȖƯỪỨỮỬỰỤṲŲṶṴɄ"},{base:"V",chars:"ⓋＶṼṾƲꝞɅ"},{base:"VY",chars:"Ꝡ"},{base:"W",chars:"ⓌＷẀẂŴẆẄẈⱲ"},{base:"X",chars:"ⓍＸẊẌ"},{base:"Y",chars:"ⓎＹỲÝŶỸȲẎŸỶỴƳɎỾ"},{base:"Z",chars:"ⓏＺŹẐŻŽẒẔƵȤⱿⱫꝢ"},{base:"a",chars:"ⓐａẚàáâầấẫẩãāăằắẵẳȧǡäǟảåǻǎȁȃạậặḁąⱥɐɑ"},{base:"aa",chars:"ꜳ"},{base:"ae",chars:"æǽǣ"},{base:"ao",chars:"ꜵ"},{base:"au",chars:"ꜷ"},{base:"av",chars:"ꜹꜻ"},{base:"ay",chars:"ꜽ"},{base:"b",chars:"ⓑｂḃḅḇƀƃɓƂ"},{base:"c",chars:"ｃⓒćĉċčçḉƈȼꜿↄ"},{base:"d",chars:"ⓓｄḋďḍḑḓḏđƌɖɗƋᏧԁꞪ"},{base:"dh",chars:"ð"},{base:"dz",chars:"dzdž"},{base:"e",chars:"ⓔｅèéêềếễểẽēḕḗĕėëẻěȅȇẹệȩḝęḙḛɇǝ"},{base:"f",chars:"ⓕｆḟƒ"},{base:"ff",chars:"ff"},{base:"fi",chars:"fi"},{base:"fl",chars:"fl"},{base:"ffi",chars:"ffi"},{base:"ffl",chars:"ffl"},{base:"g",chars:"ⓖｇǵĝḡğġǧģǥɠꞡꝿᵹ"},{base:"h",chars:"ⓗｈĥḣḧȟḥḩḫẖħⱨⱶɥ"},{base:"hv",chars:"ƕ"},{base:"i",chars:"ⓘｉìíîĩīĭïḯỉǐȉȋịįḭɨı"},{base:"j",chars:"ⓙｊĵǰɉ"},{base:"k",chars:"ⓚｋḱǩḳķḵƙⱪꝁꝃꝅꞣ"},{base:"l",chars:"ⓛｌŀĺľḷḹļḽḻſłƚɫⱡꝉꞁꝇɭ"},{base:"lj",chars:"lj"},{base:"m",chars:"ⓜｍḿṁṃɱɯ"},{base:"n",chars:"ⓝｎǹńñṅňṇņṋṉƞɲʼnꞑꞥлԉ"},{base:"nj",chars:"nj"},{base:"o",chars:"ⓞｏòóôồốỗổõṍȭṏōṑṓŏȯȱöȫỏőǒȍȏơờớỡởợọộǫǭøǿꝋꝍɵɔᴑ"},{base:"oe",chars:"œ"},{base:"oi",chars:"ƣ"},{base:"oo",chars:"ꝏ"},{base:"ou",chars:"ȣ"},{base:"p",chars:"ⓟｐṕṗƥᵽꝑꝓꝕρ"},{base:"q",chars:"ⓠｑɋꝗꝙ"},{base:"r",chars:"ⓡｒŕṙřȑȓṛṝŗṟɍɽꝛꞧꞃ"},{base:"s",chars:"ⓢｓśṥŝṡšṧṣṩșşȿꞩꞅẛʂ"},{base:"ss",chars:"ß"},{base:"t",chars:"ⓣｔṫẗťṭțţṱṯŧƭʈⱦꞇ"},{base:"th",chars:"þ"},{base:"tz",chars:"ꜩ"},{base:"u",chars:"ⓤｕùúûũṹūṻŭüǜǘǖǚủůűǔȕȗưừứữửựụṳųṷṵʉ"},{base:"v",chars:"ⓥｖṽṿʋꝟʌ"},{base:"vy",chars:"ꝡ"},{base:"w",chars:"ⓦｗẁẃŵẇẅẘẉⱳ"},{base:"x",chars:"ⓧｘẋẍ"},{base:"y",chars:"ⓨｙỳýŷỹȳẏÿỷẙỵƴɏỿ"},{base:"z",chars:"ⓩｚźẑżžẓẕƶȥɀⱬꝣ"}],n={},i=0;i<a.length;i+=1)for(var r=a[i].chars,s=0;s<r.length;s+=1)n[r[s]]=a[i].base;t.replacementList=a,t.diacriticsMap=n},function(e){e.exports=JSON.parse('{"locale":"en","countries":{"AF":"Afghanistan","AL":"Albania","DZ":"Algeria","AS":"American Samoa","AD":"Andorra","AO":"Angola","AI":"Anguilla","AQ":"Antarctica","AG":"Antigua and Barbuda","AR":"Argentina","AM":"Armenia","AW":"Aruba","AU":"Australia","AT":"Austria","AZ":"Azerbaijan","BS":"Bahamas","BH":"Bahrain","BD":"Bangladesh","BB":"Barbados","BY":"Belarus","BE":"Belgium","BZ":"Belize","BJ":"Benin","BM":"Bermuda","BT":"Bhutan","BO":"Bolivia","BA":"Bosnia and Herzegovina","BW":"Botswana","BV":"Bouvet Island","BR":"Brazil","IO":"British Indian Ocean Territory","BN":"Brunei Darussalam","BG":"Bulgaria","BF":"Burkina Faso","BI":"Burundi","KH":"Cambodia","CM":"Cameroon","CA":"Canada","CV":"Cape Verde","KY":"Cayman Islands","CF":"Central African Republic","TD":"Chad","CL":"Chile","CN":"China","CX":"Christmas Island","CC":"Cocos (Keeling) Islands","CO":"Colombia","KM":"Comoros","CG":"Congo","CD":"Congo, the Democratic Republic of the","CK":"Cook Islands","CR":"Costa Rica","CI":"Cote D\'Ivoire","HR":"Croatia","CU":"Cuba","CY":"Cyprus","CZ":"Czech Republic","DK":"Denmark","DJ":"Djibouti","DM":"Dominica","DO":"Dominican Republic","EC":"Ecuador","EG":"Egypt","SV":"El Salvador","GQ":"Equatorial Guinea","ER":"Eritrea","EE":"Estonia","ET":"Ethiopia","FK":"Falkland Islands (Malvinas)","FO":"Faroe Islands","FJ":"Fiji","FI":"Finland","FR":"France","GF":"French Guiana","PF":"French Polynesia","TF":"French Southern Territories","GA":"Gabon","GM":"Gambia","GE":"Georgia","DE":"Germany","GH":"Ghana","GI":"Gibraltar","GR":"Greece","GL":"Greenland","GD":"Grenada","GP":"Guadeloupe","GU":"Guam","GT":"Guatemala","GN":"Guinea","GW":"Guinea-Bissau","GY":"Guyana","HT":"Haiti","HM":"Heard Island and Mcdonald Islands","VA":"Holy See (Vatican City State)","HN":"Honduras","HK":"Hong Kong","HU":"Hungary","IS":"Iceland","IN":"India","ID":"Indonesia","IR":"Iran, Islamic Republic of","IQ":"Iraq","IE":"Ireland","IL":"Israel","IT":"Italy","JM":"Jamaica","JP":"Japan","JO":"Jordan","KZ":"Kazakhstan","KE":"Kenya","KI":"Kiribati","KP":"North Korea","KR":"South Korea","KW":"Kuwait","KG":"Kyrgyzstan","LA":"Lao People\'s Democratic Republic","LV":"Latvia","LB":"Lebanon","LS":"Lesotho","LR":"Liberia","LY":"Libya","LI":"Liechtenstein","LT":"Lithuania","LU":"Luxembourg","MO":"Macao","MG":"Madagascar","MW":"Malawi","MY":"Malaysia","MV":"Maldives","ML":"Mali","MT":"Malta","MH":"Marshall Islands","MQ":"Martinique","MR":"Mauritania","MU":"Mauritius","YT":"Mayotte","MX":"Mexico","FM":"Micronesia, Federated States of","MD":"Moldova, Republic of","MC":"Monaco","MN":"Mongolia","MS":"Montserrat","MA":"Morocco","MZ":"Mozambique","MM":"Myanmar","NA":"Namibia","NR":"Nauru","NP":"Nepal","NL":"Netherlands","NC":"New Caledonia","NZ":"New Zealand","NI":"Nicaragua","NE":"Niger","NG":"Nigeria","NU":"Niue","NF":"Norfolk Island","MK":"North Macedonia, Republic of","MP":"Northern Mariana Islands","NO":"Norway","OM":"Oman","PK":"Pakistan","PW":"Palau","PS":"Palestinian Territory, Occupied","PA":"Panama","PG":"Papua New Guinea","PY":"Paraguay","PE":"Peru","PH":"Philippines","PN":"Pitcairn","PL":"Poland","PT":"Portugal","PR":"Puerto Rico","QA":"Qatar","RE":"Reunion","RO":"Romania","RU":"Russian Federation","RW":"Rwanda","SH":"Saint Helena","KN":"Saint Kitts and Nevis","LC":"Saint Lucia","PM":"Saint Pierre and Miquelon","VC":"Saint Vincent and the Grenadines","WS":"Samoa","SM":"San Marino","ST":"Sao Tome and Principe","SA":"Saudi Arabia","SN":"Senegal","SC":"Seychelles","SL":"Sierra Leone","SG":"Singapore","SK":"Slovakia","SI":"Slovenia","SB":"Solomon Islands","SO":"Somalia","ZA":"South Africa","GS":"South Georgia and the South Sandwich Islands","ES":"Spain","LK":"Sri Lanka","SD":"Sudan","SR":"Suriname","SJ":"Svalbard and Jan Mayen","SZ":"Swaziland","SE":"Sweden","CH":"Switzerland","SY":"Syrian Arab Republic","TW":"Taiwan","TJ":"Tajikistan","TZ":"Tanzania, United Republic of","TH":"Thailand","TL":"Timor-Leste","TG":"Togo","TK":"Tokelau","TO":"Tonga","TT":"Trinidad and Tobago","TN":"Tunisia","TR":"Turkey","TM":"Turkmenistan","TC":"Turks and Caicos Islands","TV":"Tuvalu","UG":"Uganda","UA":"Ukraine","AE":"United Arab Emirates","GB":"United Kingdom","US":"United States of America","UM":"United States Minor Outlying Islands","UY":"Uruguay","UZ":"Uzbekistan","VU":"Vanuatu","VE":"Venezuela","VN":"Viet Nam","VG":"Virgin Islands, British","VI":"Virgin Islands, U.S.","WF":"Wallis and Futuna","EH":"Western Sahara","YE":"Yemen","ZM":"Zambia","ZW":"Zimbabwe","AX":"Åland Islands","BQ":"Bonaire, Sint Eustatius and Saba","CW":"Curaçao","GG":"Guernsey","IM":"Isle of Man","JE":"Jersey","ME":"Montenegro","BL":"Saint Barthélemy","MF":"Saint Martin (French part)","RS":"Serbia","SX":"Sint Maarten (Dutch part)","SS":"South Sudan","XK":"Kosovo"}}')},function(e,t,a){const n=a(310),i=a(326),r=a(157),s=a(559),o=a(292),l=a(678),c=a(1285),u=a(1286),d=a(1287),p=a(1288),m=a(1289),b=a(1290),g=a(1291),f=a(192),y=a(1292),h=a(1293),v=a(577),E=a(1294),x=a(1295),j=a(462),S=a(578),k=a(836),O=a(837),w=a(489),T=a(396),I=a(838),C=a(1103),M=a(463),_=a(205),F=a(464),A=a(1299),D=a(1300),N=a(1301),P=a(1302),R=a(1303),L=a(579),B=a(1304),q=a(1305),z=a(1306),$=a(1307),V=a(1308);e.exports={parse:o,valid:l,clean:c,inc:u,diff:d,major:p,minor:m,patch:b,prerelease:g,compare:f,rcompare:y,compareLoose:h,compareBuild:v,sort:E,rsort:x,gt:j,lt:S,eq:k,neq:O,gte:w,lte:T,cmp:I,coerce:C,Comparator:M,Range:_,satisfies:F,toComparators:A,maxSatisfying:D,minSatisfying:N,minVersion:P,validRange:R,outside:L,gtr:B,ltr:q,intersects:z,simplifyRange:$,subset:V,SemVer:r,re:n.re,src:n.src,tokens:n.t,SEMVER_SPEC_VERSION:i.SEMVER_SPEC_VERSION,RELEASE_TYPES:i.RELEASE_TYPES,compareIdentifiers:s.compareIdentifiers,rcompareIdentifiers:s.rcompareIdentifiers}},function(e,t,a){const n=a(292);e.exports=(e,t)=>{const a=n(e.trim().replace(/^[=v]+/,""),t);return a?a.version:null}},function(e,t,a){const n=a(157);e.exports=(e,t,a,i,r)=>{"string"==typeof a&&(r=i,i=a,a=void 0);try{return new n(e instanceof n?e.version:e,a).inc(t,i,r).version}catch(e){return null}}},function(e,t,a){const n=a(292);e.exports=(e,t)=>{const a=n(e,null,!0),i=n(t,null,!0),r=a.compare(i);if(0===r)return null;const s=r>0,o=s?a:i,l=s?i:a,c=!!o.prerelease.length;if(l.prerelease.length&&!c)return l.patch||l.minor?o.patch?"patch":o.minor?"minor":"major":"major";const u=c?"pre":"";return a.major!==i.major?u+"major":a.minor!==i.minor?u+"minor":a.patch!==i.patch?u+"patch":"prerelease"}},function(e,t,a){const n=a(157);e.exports=(e,t)=>new n(e,t).major},function(e,t,a){const n=a(157);e.exports=(e,t)=>new n(e,t).minor},function(e,t,a){const n=a(157);e.exports=(e,t)=>new n(e,t).patch},function(e,t,a){const n=a(292);e.exports=(e,t)=>{const a=n(e,t);return a&&a.prerelease.length?a.prerelease:null}},function(e,t,a){const n=a(192);e.exports=(e,t,a)=>n(t,e,a)},function(e,t,a){const n=a(192);e.exports=(e,t)=>n(e,t,!0)},function(e,t,a){const n=a(577);e.exports=(e,t)=>e.sort(((e,a)=>n(e,a,t)))},function(e,t,a){const n=a(577);e.exports=(e,t)=>e.sort(((e,a)=>n(a,e,t)))},function(e,t,a){"use strict";const n=a(1297),i=Symbol("max"),r=Symbol("length"),s=Symbol("lengthCalculator"),o=Symbol("allowStale"),l=Symbol("maxAge"),c=Symbol("dispose"),u=Symbol("noDisposeOnSet"),d=Symbol("lruList"),p=Symbol("cache"),m=Symbol("updateAgeOnGet"),b=()=>1,g=(e,t,a)=>{const n=e[p].get(t);if(n){const t=n.value;if(f(e,t)){if(h(e,n),!e[o])return}else a&&(e[m]&&(n.value.now=Date.now()),e[d].unshiftNode(n));return t.value}},f=(e,t)=>{if(!t||!t.maxAge&&!e[l])return!1;const a=Date.now()-t.now;return t.maxAge?a>t.maxAge:e[l]&&a>e[l]},y=e=>{if(e[r]>e[i])for(let t=e[d].tail;e[r]>e[i]&&null!==t;){const a=t.prev;h(e,t),t=a}},h=(e,t)=>{if(t){const a=t.value;e[c]&&e[c](a.key,a.value),e[r]-=a.length,e[p].delete(a.key),e[d].removeNode(t)}};class Entry{constructor(e,t,a,n,i){this.key=e,this.value=t,this.length=a,this.now=n,this.maxAge=i||0}}const v=(e,t,a,n)=>{let i=a.value;f(e,i)&&(h(e,a),e[o]||(i=void 0)),i&&t.call(n,i.value,i.key,e)};e.exports=class LRUCache{constructor(e){if("number"==typeof e&&(e={max:e}),e||(e={}),e.max&&("number"!=typeof e.max||e.max<0))throw new TypeError("max must be a non-negative number");this[i]=e.max||1/0;const t=e.length||b;if(this[s]="function"!=typeof t?b:t,this[o]=e.stale||!1,e.maxAge&&"number"!=typeof e.maxAge)throw new TypeError("maxAge must be a number");this[l]=e.maxAge||0,this[c]=e.dispose,this[u]=e.noDisposeOnSet||!1,this[m]=e.updateAgeOnGet||!1,this.reset()}set max(e){if("number"!=typeof e||e<0)throw new TypeError("max must be a non-negative number");this[i]=e||1/0,y(this)}get max(){return this[i]}set allowStale(e){this[o]=!!e}get allowStale(){return this[o]}set maxAge(e){if("number"!=typeof e)throw new TypeError("maxAge must be a non-negative number");this[l]=e,y(this)}get maxAge(){return this[l]}set lengthCalculator(e){"function"!=typeof e&&(e=b),e!==this[s]&&(this[s]=e,this[r]=0,this[d].forEach((e=>{e.length=this[s](e.value,e.key),this[r]+=e.length}))),y(this)}get lengthCalculator(){return this[s]}get length(){return this[r]}get itemCount(){return this[d].length}rforEach(e,t){t=t||this;for(let a=this[d].tail;null!==a;){const n=a.prev;v(this,e,a,t),a=n}}forEach(e,t){t=t||this;for(let a=this[d].head;null!==a;){const n=a.next;v(this,e,a,t),a=n}}keys(){return this[d].toArray().map((e=>e.key))}values(){return this[d].toArray().map((e=>e.value))}reset(){this[c]&&this[d]&&this[d].length&&this[d].forEach((e=>this[c](e.key,e.value))),this[p]=new Map,this[d]=new n,this[r]=0}dump(){return this[d].map((e=>!f(this,e)&&{k:e.key,v:e.value,e:e.now+(e.maxAge||0)})).toArray().filter((e=>e))}dumpLru(){return this[d]}set(e,t,a){if((a=a||this[l])&&"number"!=typeof a)throw new TypeError("maxAge must be a number");const n=a?Date.now():0,o=this[s](t,e);if(this[p].has(e)){if(o>this[i])return h(this,this[p].get(e)),!1;const s=this[p].get(e).value;return this[c]&&(this[u]||this[c](e,s.value)),s.now=n,s.maxAge=a,s.value=t,this[r]+=o-s.length,s.length=o,this.get(e),y(this),!0}const m=new Entry(e,t,o,n,a);return m.length>this[i]?(this[c]&&this[c](e,t),!1):(this[r]+=m.length,this[d].unshift(m),this[p].set(e,this[d].head),y(this),!0)}has(e){if(!this[p].has(e))return!1;const t=this[p].get(e).value;return!f(this,t)}get(e){return g(this,e,!0)}peek(e){return g(this,e,!1)}pop(){const e=this[d].tail;return e?(h(this,e),e.value):null}del(e){h(this,this[p].get(e))}load(e){this.reset();const t=Date.now();for(let a=e.length-1;a>=0;a--){const n=e[a],i=n.e||0;if(0===i)this.set(n.k,n.v);else{const e=i-t;e>0&&this.set(n.k,n.v,e)}}}prune(){this[p].forEach(((e,t)=>g(this,t,!1)))}}},function(e,t,a){"use strict";function n(e){var t=this;if(t instanceof n||(t=new n),t.tail=null,t.head=null,t.length=0,e&&"function"==typeof e.forEach)e.forEach((function(e){t.push(e)}));else if(arguments.length>0)for(var a=0,i=arguments.length;a<i;a++)t.push(arguments[a]);return t}function i(e,t,a){var n=t===e.head?new o(a,null,t,e):new o(a,t,t.next,e);return null===n.next&&(e.tail=n),null===n.prev&&(e.head=n),e.length++,n}function r(e,t){e.tail=new o(t,e.tail,null,e),e.head||(e.head=e.tail),e.length++}function s(e,t){e.head=new o(t,null,e.head,e),e.tail||(e.tail=e.head),e.length++}function o(e,t,a,n){if(!(this instanceof o))return new o(e,t,a,n);this.list=n,this.value=e,t?(t.next=this,this.prev=t):this.prev=null,a?(a.prev=this,this.next=a):this.next=null}e.exports=n,n.Node=o,n.create=n,n.prototype.removeNode=function(e){if(e.list!==this)throw new Error("removing node which does not belong to this list");var t=e.next,a=e.prev;return t&&(t.prev=a),a&&(a.next=t),e===this.head&&(this.head=t),e===this.tail&&(this.tail=a),e.list.length--,e.next=null,e.prev=null,e.list=null,t},n.prototype.unshiftNode=function(e){if(e!==this.head){e.list&&e.list.removeNode(e);var t=this.head;e.list=this,e.next=t,t&&(t.prev=e),this.head=e,this.tail||(this.tail=e),this.length++}},n.prototype.pushNode=function(e){if(e!==this.tail){e.list&&e.list.removeNode(e);var t=this.tail;e.list=this,e.prev=t,t&&(t.next=e),this.tail=e,this.head||(this.head=e),this.length++}},n.prototype.push=function(){for(var e=0,t=arguments.length;e<t;e++)r(this,arguments[e]);return this.length},n.prototype.unshift=function(){for(var e=0,t=arguments.length;e<t;e++)s(this,arguments[e]);return this.length},n.prototype.pop=function(){if(this.tail){var e=this.tail.value;return this.tail=this.tail.prev,this.tail?this.tail.next=null:this.head=null,this.length--,e}},n.prototype.shift=function(){if(this.head){var e=this.head.value;return this.head=this.head.next,this.head?this.head.prev=null:this.tail=null,this.length--,e}},n.prototype.forEach=function(e,t){t=t||this;for(var a=this.head,n=0;null!==a;n++)e.call(t,a.value,n,this),a=a.next},n.prototype.forEachReverse=function(e,t){t=t||this;for(var a=this.tail,n=this.length-1;null!==a;n--)e.call(t,a.value,n,this),a=a.prev},n.prototype.get=function(e){for(var t=0,a=this.head;null!==a&&t<e;t++)a=a.next;if(t===e&&null!==a)return a.value},n.prototype.getReverse=function(e){for(var t=0,a=this.tail;null!==a&&t<e;t++)a=a.prev;if(t===e&&null!==a)return a.value},n.prototype.map=function(e,t){t=t||this;for(var a=new n,i=this.head;null!==i;)a.push(e.call(t,i.value,this)),i=i.next;return a},n.prototype.mapReverse=function(e,t){t=t||this;for(var a=new n,i=this.tail;null!==i;)a.push(e.call(t,i.value,this)),i=i.prev;return a},n.prototype.reduce=function(e,t){var a,n=this.head;if(arguments.length>1)a=t;else{if(!this.head)throw new TypeError("Reduce of empty list with no initial value");n=this.head.next,a=this.head.value}for(var i=0;null!==n;i++)a=e(a,n.value,i),n=n.next;return a},n.prototype.reduceReverse=function(e,t){var a,n=this.tail;if(arguments.length>1)a=t;else{if(!this.tail)throw new TypeError("Reduce of empty list with no initial value");n=this.tail.prev,a=this.tail.value}for(var i=this.length-1;null!==n;i--)a=e(a,n.value,i),n=n.prev;return a},n.prototype.toArray=function(){for(var e=new Array(this.length),t=0,a=this.head;null!==a;t++)e[t]=a.value,a=a.next;return e},n.prototype.toArrayReverse=function(){for(var e=new Array(this.length),t=0,a=this.tail;null!==a;t++)e[t]=a.value,a=a.prev;return e},n.prototype.slice=function(e,t){(t=t||this.length)<0&&(t+=this.length),(e=e||0)<0&&(e+=this.length);var a=new n;if(t<e||t<0)return a;e<0&&(e=0),t>this.length&&(t=this.length);for(var i=0,r=this.head;null!==r&&i<e;i++)r=r.next;for(;null!==r&&i<t;i++,r=r.next)a.push(r.value);return a},n.prototype.sliceReverse=function(e,t){(t=t||this.length)<0&&(t+=this.length),(e=e||0)<0&&(e+=this.length);var a=new n;if(t<e||t<0)return a;e<0&&(e=0),t>this.length&&(t=this.length);for(var i=this.length,r=this.tail;null!==r&&i>t;i--)r=r.prev;for(;null!==r&&i>e;i--,r=r.prev)a.push(r.value);return a},n.prototype.splice=function(e,t,...a){e>this.length&&(e=this.length-1),e<0&&(e=this.length+e);for(var n=0,r=this.head;null!==r&&n<e;n++)r=r.next;var s=[];for(n=0;r&&n<t;n++)s.push(r.value),r=this.removeNode(r);for(null===r&&(r=this.tail),r!==this.head&&r!==this.tail&&(r=r.prev),n=0;n<a.length;n++)r=i(this,r,a[n]);return s},n.prototype.reverse=function(){for(var e=this.head,t=this.tail,a=e;null!==a;a=a.prev){var n=a.prev;a.prev=a.next,a.next=n}return this.head=t,this.tail=e,this};try{a(1298)(n)}catch(e){}},function(e,t,a){"use strict";e.exports=function(e){e.prototype[Symbol.iterator]=function*(){for(let e=this.head;e;e=e.next)yield e.value}}},function(e,t,a){const n=a(205);e.exports=(e,t)=>new n(e,t).set.map((e=>e.map((e=>e.value)).join(" ").trim().split(" ")))},function(e,t,a){const n=a(157),i=a(205);e.exports=(e,t,a)=>{let r=null,s=null,o=null;try{o=new i(t,a)}catch(e){return null}return e.forEach((e=>{o.test(e)&&(r&&-1!==s.compare(e)||(r=e,s=new n(r,a)))})),r}},function(e,t,a){const n=a(157),i=a(205);e.exports=(e,t,a)=>{let r=null,s=null,o=null;try{o=new i(t,a)}catch(e){return null}return e.forEach((e=>{o.test(e)&&(r&&1!==s.compare(e)||(r=e,s=new n(r,a)))})),r}},function(e,t,a){const n=a(157),i=a(205),r=a(462);e.exports=(e,t)=>{e=new i(e,t);let a=new n("0.0.0");if(e.test(a))return a;if(a=new n("0.0.0-0"),e.test(a))return a;a=null;for(let t=0;t<e.set.length;++t){const i=e.set[t];let s=null;i.forEach((e=>{const t=new n(e.semver.version);switch(e.operator){case">":0===t.prerelease.length?t.patch++:t.prerelease.push(0),t.raw=t.format();case"":case">=":s&&!r(t,s)||(s=t);break;case"<":case"<=":break;default:throw new Error(`Unexpected operation: ${e.operator}`)}})),!s||a&&!r(a,s)||(a=s)}return a&&e.test(a)?a:null}},function(e,t,a){const n=a(205);e.exports=(e,t)=>{try{return new n(e,t).range||"*"}catch(e){return null}}},function(e,t,a){const n=a(579);e.exports=(e,t,a)=>n(e,t,">",a)},function(e,t,a){const n=a(579);e.exports=(e,t,a)=>n(e,t,"<",a)},function(e,t,a){const n=a(205);e.exports=(e,t,a)=>(e=new n(e,a),t=new n(t,a),e.intersects(t,a))},function(e,t,a){const n=a(464),i=a(192);e.exports=(e,t,a)=>{const r=[];let s=null,o=null;const l=e.sort(((e,t)=>i(e,t,a)));for(const e of l)n(e,t,a)?(o=e,s||(s=e)):(o&&r.push([s,o]),o=null,s=null);s&&r.push([s,null]);const c=[];for(const[e,t]of r)e===t?c.push(e):t||e!==l[0]?t?e===l[0]?c.push(`<=${t}`):c.push(`${e} - ${t}`):c.push(`>=${e}`):c.push("*");const u=c.join(" || "),d="string"==typeof t.raw?t.raw:String(t);return u.length<d.length?u:t}},function(e,t,a){const n=a(205),i=a(463),{ANY:r}=i,s=a(464),o=a(192),l=[new i(">=0.0.0-0")],c=[new i(">=0.0.0")],u=(e,t,a)=>{if(e===t)return!0;if(1===e.length&&e[0].semver===r){if(1===t.length&&t[0].semver===r)return!0;e=a.includePrerelease?l:c}if(1===t.length&&t[0].semver===r){if(a.includePrerelease)return!0;t=c}const n=new Set;let i,u,m,b,g,f,y;for(const t of e)">"===t.operator||">="===t.operator?i=d(i,t,a):"<"===t.operator||"<="===t.operator?u=p(u,t,a):n.add(t.semver);if(n.size>1)return null;if(i&&u){if(m=o(i.semver,u.semver,a),m>0)return null;if(0===m&&(">="!==i.operator||"<="!==u.operator))return null}for(const e of n){if(i&&!s(e,String(i),a))return null;if(u&&!s(e,String(u),a))return null;for(const n of t)if(!s(e,String(n),a))return!1;return!0}let h=!(!u||a.includePrerelease||!u.semver.prerelease.length)&&u.semver,v=!(!i||a.includePrerelease||!i.semver.prerelease.length)&&i.semver;h&&1===h.prerelease.length&&"<"===u.operator&&0===h.prerelease[0]&&(h=!1);for(const e of t){if(y=y||">"===e.operator||">="===e.operator,f=f||"<"===e.operator||"<="===e.operator,i)if(v&&e.semver.prerelease&&e.semver.prerelease.length&&e.semver.major===v.major&&e.semver.minor===v.minor&&e.semver.patch===v.patch&&(v=!1),">"===e.operator||">="===e.operator){if(b=d(i,e,a),b===e&&b!==i)return!1}else if(">="===i.operator&&!s(i.semver,String(e),a))return!1;if(u)if(h&&e.semver.prerelease&&e.semver.prerelease.length&&e.semver.major===h.major&&e.semver.minor===h.minor&&e.semver.patch===h.patch&&(h=!1),"<"===e.operator||"<="===e.operator){if(g=p(u,e,a),g===e&&g!==u)return!1}else if("<="===u.operator&&!s(u.semver,String(e),a))return!1;if(!e.operator&&(u||i)&&0!==m)return!1}return!(i&&f&&!u&&0!==m||u&&y&&!i&&0!==m||v||h)},d=(e,t,a)=>{if(!e)return t;const n=o(e.semver,t.semver,a);return n>0?e:n<0||">"===t.operator&&">="===e.operator?t:e},p=(e,t,a)=>{if(!e)return t;const n=o(e.semver,t.semver,a);return n<0?e:n>0||"<"===t.operator&&"<="===e.operator?t:e};e.exports=(e,t,a={})=>{if(e===t)return!0;e=new n(e,a),t=new n(t,a);let i=!1;e:for(const n of e.set){for(const e of t.set){const t=u(n,e,a);if(i=i||null!==t,t)continue e}if(i)return!1}return!0}},function(e,t,a){e.exports=a(33)(1937)},function(e,t,a){e.exports=a(33)(3704)},function(e,t,a){"use strict";e.exports=function(e){var t=this;this.Parser=function(a){return n(a,Object.assign({},t.data("settings"),e,{extensions:t.data("micromarkExtensions")||[],mdastExtensions:t.data("fromMarkdownExtensions")||[]}))}};var n=a(1312)},function(e,t,a){"use strict";e.exports=a(1313)},function(e,t,a){"use strict";e.exports=function(e,t,a){return"string"!=typeof t&&(a=t,t=void 0),function(e){var t=e||{},a=function(e,t){for(var a=-1;++a<t.length;)m(e,t[a]);return e}({canContainEols:["emphasis","fragment","heading","paragraph","strong"],enter:{autolink:f(M),autolinkProtocol:j,autolinkEmail:j,atxHeading:f(T),blockQuote:f((function(){return{type:"blockquote",children:[]}})),characterEscape:j,characterReference:j,codeFenced:f(w),codeFencedFenceInfo:y,codeFencedFenceMeta:y,codeIndented:f(w,y),codeText:f((function(){return{type:"inlineCode",value:""}}),y),codeTextData:j,data:j,codeFlowValue:j,definition:f((function(){return{type:"definition",identifier:"",label:null,title:null,url:""}})),definitionDestinationString:y,definitionLabelString:y,definitionTitleString:y,emphasis:f((function(){return{type:"emphasis",children:[]}})),hardBreakEscape:f(I),hardBreakTrailing:f(I),htmlFlow:f(C,y),htmlFlowData:j,htmlText:f(C,y),htmlTextData:j,image:f((function(){return{type:"image",title:null,url:"",alt:null}})),label:y,link:f(M),listItem:f((function(e){return{type:"listItem",spread:e._spread,checked:null,children:[]}})),listItemValue:function(e){b("expectingFirstListItemValue")&&(this.stack[this.stack.length-2].start=parseInt(this.sliceSerialize(e),10),u("expectingFirstListItemValue"))},listOrdered:f(_,(function(){u("expectingFirstListItemValue",!0)})),listUnordered:f(_),paragraph:f((function(){return{type:"paragraph",children:[]}})),reference:function(){u("referenceType","collapsed")},referenceString:y,resourceDestinationString:y,resourceTitleString:y,setextHeading:f(T),strong:f((function(){return{type:"strong",children:[]}})),thematicBreak:f((function(){return{type:"thematicBreak"}}))},exit:{atxHeading:v(),atxHeadingSequence:function(e){this.stack[this.stack.length-1].depth||(this.stack[this.stack.length-1].depth=this.sliceSerialize(e).length)},autolink:v(),autolinkEmail:function(e){S.call(this,e),this.stack[this.stack.length-1].url="mailto:"+this.sliceSerialize(e)},autolinkProtocol:function(e){S.call(this,e),this.stack[this.stack.length-1].url=this.sliceSerialize(e)},blockQuote:v(),characterEscapeValue:S,characterReferenceMarkerHexadecimal:O,characterReferenceMarkerNumeric:O,characterReferenceValue:function(e){var t,a,n=this.sliceSerialize(e),i=b("characterReferenceType");i?(t=o(n,"characterReferenceMarkerNumeric"===i?10:16),u("characterReferenceType")):t=d(n),(a=this.stack.pop()).value+=t,a.position.end=g(e.end)},codeFenced:v((function(){var e=this.resume();this.stack[this.stack.length-1].value=e.replace(/^(\r?\n|\r)|(\r?\n|\r)$/g,""),u("flowCodeInside")})),codeFencedFence:function(){b("flowCodeInside")||(this.buffer(),u("flowCodeInside",!0))},codeFencedFenceInfo:function(){var e=this.resume();this.stack[this.stack.length-1].lang=e},codeFencedFenceMeta:function(){var e=this.resume();this.stack[this.stack.length-1].meta=e},codeFlowValue:S,codeIndented:v((function(){var e=this.resume();this.stack[this.stack.length-1].value=e})),codeText:v((function(){var e=this.resume();this.stack[this.stack.length-1].value=e})),codeTextData:S,data:S,definition:v(),definitionDestinationString:function(){var e=this.resume();this.stack[this.stack.length-1].url=e},definitionLabelString:function(e){var t=this.resume();this.stack[this.stack.length-1].label=t,this.stack[this.stack.length-1].identifier=s(this.sliceSerialize(e)).toLowerCase()},definitionTitleString:function(){var e=this.resume();this.stack[this.stack.length-1].title=e},emphasis:v(),hardBreakEscape:v(k),hardBreakTrailing:v(k),htmlFlow:v((function(){var e=this.resume();this.stack[this.stack.length-1].value=e})),htmlFlowData:S,htmlText:v((function(){var e=this.resume();this.stack[this.stack.length-1].value=e})),htmlTextData:S,image:v((function(){var e=this.stack[this.stack.length-1];b("inReference")?(e.type+="Reference",e.referenceType=b("referenceType")||"shortcut",delete e.url,delete e.title):(delete e.identifier,delete e.label,delete e.referenceType),u("referenceType")})),label:function(){var e=this.stack[this.stack.length-1],t=this.resume();this.stack[this.stack.length-1].label=t,u("inReference",!0),"link"===this.stack[this.stack.length-1].type?this.stack[this.stack.length-1].children=e.children:this.stack[this.stack.length-1].alt=t},labelText:function(e){this.stack[this.stack.length-2].identifier=s(this.sliceSerialize(e)).toLowerCase()},lineEnding:function(e){var t=this.stack[this.stack.length-1];if(b("atHardBreak"))return t.children[t.children.length-1].position.end=g(e.end),void u("atHardBreak");!b("setextHeadingSlurpLineEnding")&&a.canContainEols.indexOf(t.type)>-1&&(j.call(this,e),S.call(this,e))},link:v((function(){var e=this.stack[this.stack.length-1];b("inReference")?(e.type+="Reference",e.referenceType=b("referenceType")||"shortcut",delete e.url,delete e.title):(delete e.identifier,delete e.label,delete e.referenceType),u("referenceType")})),listItem:v(),listOrdered:v(),listUnordered:v(),paragraph:v(),referenceString:function(e){var t=this.resume();this.stack[this.stack.length-1].label=t,this.stack[this.stack.length-1].identifier=s(this.sliceSerialize(e)).toLowerCase(),u("referenceType","full")},resourceDestinationString:function(){var e=this.resume();this.stack[this.stack.length-1].url=e},resourceTitleString:function(){var e=this.resume();this.stack[this.stack.length-1].title=e},resource:function(){u("inReference")},setextHeading:v((function(){u("setextHeadingSlurpLineEnding")})),setextHeadingLineSequence:function(e){this.stack[this.stack.length-1].depth=61===this.sliceSerialize(e).charCodeAt(0)?1:2},setextHeadingText:function(){u("setextHeadingSlurpLineEnding",!0)},strong:v(),thematicBreak:v()}},t.mdastExtensions||[]),l={};return function(e){for(var t,n=[{type:"root",children:[]}],s=[],o=[],l=-1,d={stack:n,tokenStack:s,config:a,enter:h,exit:E,buffer:y,resume:x,setData:u,getData:b};++l<e.length;)"listOrdered"!==e[l][1].type&&"listUnordered"!==e[l][1].type||("enter"===e[l][0]?o.push(l):l=c(e,o.pop(l),l));for(l=-1;++l<e.length;)t=a[e[l][0]],r.call(t,e[l][1].type)&&t[e[l][1].type].call(i({sliceSerialize:e[l][2].sliceSerialize},d),e[l][1]);if(s.length)throw new Error("Cannot close document, a token (`"+s[s.length-1].type+"`, "+p({start:s[s.length-1].start,end:s[s.length-1].end})+") is still open");return n[0].position={start:g(e.length?e[0][1].start:{line:1,column:1,offset:0}),end:g(e.length?e[e.length-2][1].end:{line:1,column:1,offset:0})},n[0]};function c(e,t,a){for(var n,i,r,s,o,l,c,u=t-1,d=-1,p=!1;++u<=a;)if("listUnordered"===(o=e[u])[1].type||"listOrdered"===o[1].type||"blockQuote"===o[1].type?("enter"===o[0]?d++:d--,c=void 0):"lineEndingBlank"===o[1].type?"enter"===o[0]&&(!n||c||d||l||(l=u),c=void 0):"linePrefix"===o[1].type||"listItemValue"===o[1].type||"listItemMarker"===o[1].type||"listItemPrefix"===o[1].type||"listItemPrefixWhitespace"===o[1].type||(c=void 0),!d&&"enter"===o[0]&&"listItemPrefix"===o[1].type||-1===d&&"exit"===o[0]&&("listUnordered"===o[1].type||"listOrdered"===o[1].type)){if(n){for(i=u,r=void 0;i--;)if("lineEnding"===(s=e[i])[1].type||"lineEndingBlank"===s[1].type){if("exit"===s[0])continue;r&&(e[r][1].type="lineEndingBlank",p=!0),s[1].type="lineEnding",r=i}else if("linePrefix"!==s[1].type&&"blockQuotePrefix"!==s[1].type&&"blockQuotePrefixWhitespace"!==s[1].type&&"blockQuoteMarker"!==s[1].type&&"listItemIndent"!==s[1].type)break;l&&(!r||l<r)&&(n._spread=!0),n.end=g(r?e[r][1].start:o[1].end),e.splice(r||u,0,["exit",n,o[2]]),u++,a++}"listItemPrefix"===o[1].type&&(n={type:"listItem",_spread:!1,start:g(o[1].start)},e.splice(u,0,["enter",n,o[2]]),u++,a++,l=void 0,c=!0)}return e[t][1]._spread=p,a}function u(e,t){l[e]=t}function b(e){return l[e]}function g(e){return{line:e.line,column:e.column,offset:e.offset}}function f(e,t){return function(a){h.call(this,e(a),a),t&&t.call(this,a)}}function y(){this.stack.push({type:"fragment",children:[]})}function h(e,t){return this.stack[this.stack.length-1].children.push(e),this.stack.push(e),this.tokenStack.push(t),e.position={start:g(t.start)},e}function v(e){return function(t){e&&e.call(this,t),E.call(this,t)}}function E(e){var t=this.stack.pop(),a=this.tokenStack.pop();if(!a)throw new Error("Cannot close `"+e.type+"` ("+p({start:e.start,end:e.end})+"): it’s not open");if(a.type!==e.type)throw new Error("Cannot close `"+e.type+"` ("+p({start:e.start,end:e.end})+"): a different token (`"+a.type+"`, "+p({start:a.start,end:a.end})+") is open");return t.position.end=g(e.end),t}function x(){return n(this.stack.pop())}function j(e){var t=this.stack[this.stack.length-1].children,a=t[t.length-1];a&&"text"===a.type||((a={type:"text",value:""}).position={start:g(e.start)},this.stack[this.stack.length-1].children.push(a)),this.stack.push(a)}function S(e){var t=this.stack.pop();t.value+=this.sliceSerialize(e),t.position.end=g(e.end)}function k(){u("atHardBreak",!0)}function O(e){u("characterReferenceType",e.type)}function w(){return{type:"code",lang:null,meta:null,value:""}}function T(){return{type:"heading",depth:void 0,children:[]}}function I(){return{type:"break"}}function C(){return{type:"html",value:""}}function M(){return{type:"link",title:null,url:"",children:[]}}function _(e){return{type:"list",ordered:"listOrdered"===e.type,start:null,spread:e._spread,children:[]}}}(a)(u(l(a).document().write(c()(e,t,!0))))};var n=a(1314),i=a(369),r=a(840),s=a(580),o=a(1315),l=a(1316),c=a(1355),u=a(1356),d=a(845),p=a(1357);function m(e,t){var a,n;for(a in t)n=r.call(e,a)?e[a]:e[a]={},"canContainEols"===a?e[a]=[].concat(n,t[a]):Object.assign(n,t[a])}},function(e,t,a){"use strict";function n(e){return e&&(e.value||e.alt||e.title||"children"in e&&i(e.children)||"length"in e&&i(e))||""}function i(e){for(var t=[],a=-1;++a<e.length;)t[a]=n(e[a]);return t.join("")}e.exports=n},function(e,t,a){"use strict";var n=a(465);e.exports=function(e,t){var a=parseInt(e,t);return a<9||11===a||a>13&&a<32||a>126&&a<160||a>55295&&a<57344||a>64975&&a<65008||65535==(65535&a)||65534==(65535&a)||a>1114111?"�":n(a)}},function(e,t,a){"use strict";var n=a(1317),i=a(1318),r=a(1319),s=a(843),o=a(1322),l=a(1323),c=a(581),u=a(1326);e.exports=function(e){var t={defined:[],constructs:o([u].concat(c((e||{}).extensions))),content:a(n),document:a(i),flow:a(r),string:a(s.string),text:a(s.text)};return t;function a(e){return function(a){return l(t,e,a)}}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(147),i=a(154);t.tokenize=function(e){var t,a=e.attempt(this.parser.constructs.contentInitial,(function(t){if(null!==t)return e.enter("lineEnding"),e.consume(t),e.exit("lineEnding"),i(e,a,"linePrefix");e.consume(t)}),(function(t){return e.enter("paragraph"),r(t)}));return a;function r(a){var n=e.enter("chunkText",{contentType:"text",previous:t});return t&&(t.next=n),t=n,s(a)}function s(t){return null===t?(e.exit("chunkText"),e.exit("paragraph"),void e.consume(t)):n(t)?(e.consume(t),e.exit("chunkText"),r):(e.consume(t),s)}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(147),i=a(154),r=a(466),s={tokenize:function(e,t,a){return i(e,e.attempt(this.parser.constructs.document,t,a),"linePrefix",this.parser.constructs.disable.null.indexOf("codeIndented")>-1?void 0:4)}},o={tokenize:function(e,t,a){return i(e,e.lazy(this.parser.constructs.flow,t,a),"linePrefix",this.parser.constructs.disable.null.indexOf("codeIndented")>-1?void 0:4)}};t.tokenize=function(e){var t,a,i,l=this,c=[],u=0,d={tokenize:function(e,n){var i=0;return t={},u;function u(n){return i<c.length?(l.containerState=c[i][1],e.attempt(c[i][0].continuation,d,p)(n)):a.currentConstruct&&a.currentConstruct.concrete?(t.flowContinue=!0,g(n)):(l.interrupt=a.currentConstruct&&a.currentConstruct.interruptible,l.containerState={},e.attempt(s,b,g)(n))}function d(e){return i++,l.containerState._closeFlow?b(e):u(e)}function p(t){return a.currentConstruct&&a.currentConstruct.lazy?(l.containerState={},e.attempt(s,b,e.attempt(o,b,e.check(r,b,m)))(t)):b(t)}function m(e){return i=c.length,t.lazy=!0,t.flowContinue=!0,g(e)}function b(e){return t.flowEnd=!0,g(e)}function g(e){return t.continued=i,l.interrupt=l.containerState=void 0,n(e)}},partial:!0};return p;function p(t){return u<c.length?(l.containerState=c[u][1],e.attempt(c[u][0].continuation,m,b)(t)):b(t)}function m(e){return u++,p(e)}function b(n){return t&&t.flowContinue?f(n):(l.interrupt=a&&a.currentConstruct&&a.currentConstruct.interruptible,l.containerState={},e.attempt(s,g,f)(n))}function g(e){return c.push([l.currentConstruct,l.containerState]),l.containerState=void 0,b(e)}function f(t){return null===t?(E(0,!0),void e.consume(t)):(a=a||l.parser.flow(l.now()),e.enter("chunkFlow",{contentType:"flow",previous:i,_tokenizer:a}),y(t))}function y(t){return null===t?(v(e.exit("chunkFlow")),f(t)):n(t)?(e.consume(t),v(e.exit("chunkFlow")),e.check(d,h)):(e.consume(t),y)}function h(e){return E(t.continued,t&&t.flowEnd),u=0,p(e)}function v(e){i&&(i.next=e),i=e,a.lazy=t&&t.lazy,a.defineSkip(e.start),a.write(l.sliceStream(e))}function E(t,n){var r=c.length;for(a&&n&&(a.write([null]),i=a=void 0);r-- >t;)l.containerState=c[r][1],c[r][0].exit.call(l,e);c.length=t}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(1320),i=a(154),r=a(466);t.tokenize=function(e){var t=this,a=e.attempt(r,(function(n){if(null!==n)return e.enter("lineEndingBlank"),e.consume(n),e.exit("lineEndingBlank"),t.currentConstruct=void 0,a;e.consume(n)}),e.attempt(this.parser.constructs.flowInitial,s,i(e,e.attempt(this.parser.constructs.flow,s,e.attempt(n,s)),"linePrefix")));return a;function s(n){if(null!==n)return e.enter("lineEnding"),e.consume(n),e.exit("lineEnding"),t.currentConstruct=void 0,a;e.consume(n)}}},function(e,t,a){"use strict";var n=a(147),i=a(467),r=a(842),s=a(154),o={tokenize:function(e,t){var a;return function(t){return e.enter("content"),a=e.enter("chunkContent",{contentType:"content"}),i(t)};function i(t){return null===t?r(t):n(t)?e.check(l,s,r)(t):(e.consume(t),i)}function r(a){return e.exit("chunkContent"),e.exit("content"),t(a)}function s(t){return e.consume(t),e.exit("chunkContent"),a=a.next=e.enter("chunkContent",{contentType:"content",previous:a}),i}},resolve:function(e){return r(e),e},interruptible:!0,lazy:!0},l={tokenize:function(e,t,a){var r=this;return function(t){return e.enter("lineEnding"),e.consume(t),e.exit("lineEnding"),s(e,o,"linePrefix")};function o(s){return null===s||n(s)?a(s):r.parser.constructs.disable.null.indexOf("codeIndented")>-1||i(r.events,"linePrefix")<4?e.interrupt(r.parser.constructs.flow,a,t)(s):t(s)}},partial:!0};e.exports=o},function(e,t,a){"use strict";var n=[].splice;e.exports=n},function(e,t,a){"use strict";var n=a(840),i=a(251),r=a(581);function s(e,t){var a,i,s,l;for(a in t)for(l in i=n.call(e,a)?e[a]:e[a]={},s=t[a])i[l]=o(r(s[l]),n.call(i,l)?i[l]:[])}function o(e,t){for(var a=-1,n=[];++a<e.length;)("after"===e[a].add?t:n).push(e[a]);return i(t,0,0,n),t}e.exports=function(e){for(var t={},a=-1;++a<e.length;)s(t,e[a]);return t}},function(e,t,a){"use strict";var n=a(369),i=a(147),r=a(582),s=a(251),o=a(581),l=a(583),c=a(1324),u=a(315),d=a(1325);e.exports=function(e,t,a){var p=a?u(a):{line:1,column:1,offset:0},m={},b=[],g=[],f=[],y={consume:function(e){i(e)?(p.line++,p.column=1,p.offset+=-3===e?2:1,w()):-1!==e&&(p.column++,p.offset++),p._bufferIndex<0?p._index++:(p._bufferIndex++,p._bufferIndex===g[p._index].length&&(p._bufferIndex=-1,p._index++)),h.previous=e},enter:function(e,t){var a=t||{};return a.type=e,a.start=x(),h.events.push(["enter",a,h]),f.push(a),a},exit:function(e){var t=f.pop();return t.end=x(),h.events.push(["exit",t,h]),t},attempt:k((function(e,t){O(e,t.from)})),check:k(S),interrupt:k(S,{interrupt:!0}),lazy:k(S,{lazy:!0})},h={previous:null,events:[],parser:e,sliceStream:E,sliceSerialize:function(e){return c(E(e))},now:x,defineSkip:function(e){m[e.line]=e.column,w()},write:function(e){return g=r(g,e),function(){for(var e,t;p._index<g.length;)if("string"==typeof(t=g[p._index]))for(e=p._index,p._bufferIndex<0&&(p._bufferIndex=0);p._index===e&&p._bufferIndex<t.length;)j(t.charCodeAt(p._bufferIndex));else j(t)}(),null!==g[g.length-1]?[]:(O(t,0),h.events=l(b,h.events,h),h.events)}},v=t.tokenize.call(h,y);return t.resolveAll&&b.push(t),p._index=0,p._bufferIndex=-1,h;function E(e){return d(g,e)}function x(){return u(p)}function j(e){v=v(e)}function S(e,t){t.restore()}function k(e,t){return function(a,i,r){var s,l,c,u;return a.tokenize||"length"in a?d(o(a)):function(e){return e in a||null in a?d(a.null?o(a[e]).concat(o(a.null)):a[e])(e):r(e)};function d(e){return s=e,m(e[l=0])}function m(e){return function(a){var i,r,s,o,l;return i=x(),r=h.previous,s=h.currentConstruct,o=h.events.length,l=Array.from(f),u={restore:function(){p=i,h.previous=r,h.currentConstruct=s,h.events.length=o,f=l,w()},from:o},c=e,e.partial||(h.currentConstruct=e),e.name&&h.parser.constructs.disable.null.indexOf(e.name)>-1?g():e.tokenize.call(t?n({},h,t):h,y,b,g)(a)}}function b(t){return e(c,u),i}function g(e){return u.restore(),++l<s.length?m(s[l]):r}}}function O(e,t){e.resolveAll&&b.indexOf(e)<0&&b.push(e),e.resolve&&s(h.events,t,h.events.length-t,e.resolve(h.events.slice(t),h)),e.resolveTo&&(h.events=e.resolveTo(h.events,h))}function w(){p.line in m&&p.column<2&&(p.column=m[p.line],p.offset+=m[p.line]-1)}}},function(e,t,a){"use strict";var n=a(465);e.exports=function(e){for(var t,a,i,r=-1,s=[];++r<e.length;){if("string"==typeof(t=e[r]))a=t;else if(-5===t)a="\r";else if(-4===t)a="\n";else if(-3===t)a="\r\n";else if(-2===t)a="\t";else if(-1===t){if(i)continue;a=" "}else a=n(t);i=-2===t,s.push(a)}return s.join("")}},function(e,t,a){"use strict";e.exports=function(e,t){var a,n=t.start._index,i=t.start._bufferIndex,r=t.end._index,s=t.end._bufferIndex;return n===r?a=[e[n].slice(i,s)]:(a=e.slice(n,r),i>-1&&(a[0]=a[0].slice(i)),s>0&&a.push(e[r].slice(0,s))),a}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(843),i=a(1327),r=a(1333),s=a(1335),o=a(1336),l=a(1338),c=a(1340),u=a(1341),d=a(1342),p=a(1343),m=a(1344),b=a(1345),g=a(1346),f=a(1349),y=a(585),h=a(1350),v=a(1351),E=a(1352),x=a(1353),j=a(1354),S=a(851),k={42:x,43:x,45:x,48:x,49:x,50:x,51:x,52:x,53:x,54:x,55:x,56:x,57:x,62:s},O={91:p},w={"-2":u,"-1":u,32:u},T={35:b,42:S,45:[j,S],60:g,61:j,95:S,96:c,126:c},I={38:l,92:o},C={"-5":E,"-4":E,"-3":E,33:h,38:l,42:i,60:[r,f],91:v,92:[m,o],93:y,95:i,96:d},M={null:[i,n.resolver]};t.contentInitial=O,t.disable={null:[]},t.document=k,t.flow=T,t.flowInitial=w,t.insideSpan=M,t.string=I,t.text=C},function(e,t,a){"use strict";var n=a(582),i=a(251),r=a(1328),s=a(1332),o=a(583),l=a(315),c={name:"attention",tokenize:function(e,t){var a,n=r(this.previous);return function(t){return e.enter("attentionSequence"),a=t,i(t)};function i(s){var o,l,c,u;return s===a?(e.consume(s),i):(o=e.exit("attentionSequence"),c=!(l=r(s))||2===l&&n,u=!n||2===n&&l,o._open=42===a?c:c&&(n||!u),o._close=42===a?u:u&&(l||!c),t(s))}},resolveAll:function(e,t){for(var a,r,c,u,d,p,m,b,g=-1;++g<e.length;)if("enter"===e[g][0]&&"attentionSequence"===e[g][1].type&&e[g][1]._close)for(a=g;a--;)if("exit"===e[a][0]&&"attentionSequence"===e[a][1].type&&e[a][1]._open&&t.sliceSerialize(e[a][1]).charCodeAt(0)===t.sliceSerialize(e[g][1]).charCodeAt(0)){if((e[a][1]._close||e[g][1]._open)&&(e[g][1].end.offset-e[g][1].start.offset)%3&&!((e[a][1].end.offset-e[a][1].start.offset+e[g][1].end.offset-e[g][1].start.offset)%3))continue;u={type:(p=e[a][1].end.offset-e[a][1].start.offset>1&&e[g][1].end.offset-e[g][1].start.offset>1?2:1)>1?"strongSequence":"emphasisSequence",start:s(l(e[a][1].end),-p),end:l(e[a][1].end)},d={type:p>1?"strongSequence":"emphasisSequence",start:l(e[g][1].start),end:s(l(e[g][1].start),p)},c={type:p>1?"strongText":"emphasisText",start:l(e[a][1].end),end:l(e[g][1].start)},r={type:p>1?"strong":"emphasis",start:l(u.start),end:l(d.end)},e[a][1].end=l(u.start),e[g][1].start=l(d.end),m=[],e[a][1].end.offset-e[a][1].start.offset&&(m=n(m,[["enter",e[a][1],t],["exit",e[a][1],t]])),m=n(m,[["enter",r,t],["enter",u,t],["exit",u,t],["enter",c,t]]),m=n(m,o(t.parser.constructs.insideSpan.null,e.slice(a+1,g),t)),m=n(m,[["exit",c,t],["enter",d,t],["exit",d,t],["exit",r,t]]),e[g][1].end.offset-e[g][1].start.offset?(b=2,m=n(m,[["enter",e[g][1],t],["exit",e[g][1],t]])):b=0,i(e,a-1,g-a+3,m),g=a+m.length-b-2;break}for(g=-1;++g<e.length;)"attentionSequence"===e[g][1].type&&(e[g][1].type="data");return e}};e.exports=c},function(e,t,a){"use strict";var n=a(252),i=a(1329),r=a(1331);e.exports=function(e){return null===e||n(e)||r(e)?1:i(e)?2:void 0}},function(e,t,a){"use strict";var n=a(1330),i=a(253)(n);e.exports=i},function(e,t,a){"use strict";e.exports=/[!-\/:-@\[-`\{-~\xA1\xA7\xAB\xB6\xB7\xBB\xBF\u037E\u0387\u055A-\u055F\u0589\u058A\u05BE\u05C0\u05C3\u05C6\u05F3\u05F4\u0609\u060A\u060C\u060D\u061B\u061E\u061F\u066A-\u066D\u06D4\u0700-\u070D\u07F7-\u07F9\u0830-\u083E\u085E\u0964\u0965\u0970\u09FD\u0A76\u0AF0\u0C77\u0C84\u0DF4\u0E4F\u0E5A\u0E5B\u0F04-\u0F12\u0F14\u0F3A-\u0F3D\u0F85\u0FD0-\u0FD4\u0FD9\u0FDA\u104A-\u104F\u10FB\u1360-\u1368\u1400\u166E\u169B\u169C\u16EB-\u16ED\u1735\u1736\u17D4-\u17D6\u17D8-\u17DA\u1800-\u180A\u1944\u1945\u1A1E\u1A1F\u1AA0-\u1AA6\u1AA8-\u1AAD\u1B5A-\u1B60\u1BFC-\u1BFF\u1C3B-\u1C3F\u1C7E\u1C7F\u1CC0-\u1CC7\u1CD3\u2010-\u2027\u2030-\u2043\u2045-\u2051\u2053-\u205E\u207D\u207E\u208D\u208E\u2308-\u230B\u2329\u232A\u2768-\u2775\u27C5\u27C6\u27E6-\u27EF\u2983-\u2998\u29D8-\u29DB\u29FC\u29FD\u2CF9-\u2CFC\u2CFE\u2CFF\u2D70\u2E00-\u2E2E\u2E30-\u2E4F\u2E52\u3001-\u3003\u3008-\u3011\u3014-\u301F\u3030\u303D\u30A0\u30FB\uA4FE\uA4FF\uA60D-\uA60F\uA673\uA67E\uA6F2-\uA6F7\uA874-\uA877\uA8CE\uA8CF\uA8F8-\uA8FA\uA8FC\uA92E\uA92F\uA95F\uA9C1-\uA9CD\uA9DE\uA9DF\uAA5C-\uAA5F\uAADE\uAADF\uAAF0\uAAF1\uABEB\uFD3E\uFD3F\uFE10-\uFE19\uFE30-\uFE52\uFE54-\uFE61\uFE63\uFE68\uFE6A\uFE6B\uFF01-\uFF03\uFF05-\uFF0A\uFF0C-\uFF0F\uFF1A\uFF1B\uFF1F\uFF20\uFF3B-\uFF3D\uFF3F\uFF5B\uFF5D\uFF5F-\uFF65]/},function(e,t,a){"use strict";var n=a(253)(/\s/);e.exports=n},function(e,t,a){"use strict";e.exports=function(e,t){return e.column+=t,e.offset+=t,e._bufferIndex+=t,e}},function(e,t,a){"use strict";var n=a(584),i=a(468),r=a(1334),s=a(844),o={name:"autolink",tokenize:function(e,t,a){var o=1;return function(t){return e.enter("autolink"),e.enter("autolinkMarker"),e.consume(t),e.exit("autolinkMarker"),e.enter("autolinkProtocol"),l};function l(t){return n(t)?(e.consume(t),c):r(t)?p(t):a(t)}function c(e){return 43===e||45===e||46===e||i(e)?u(e):p(e)}function u(t){return 58===t?(e.consume(t),d):(43===t||45===t||46===t||i(t))&&o++<32?(e.consume(t),u):p(t)}function d(t){return 62===t?(e.exit("autolinkProtocol"),f(t)):32===t||60===t||s(t)?a(t):(e.consume(t),d)}function p(t){return 64===t?(e.consume(t),o=0,m):r(t)?(e.consume(t),p):a(t)}function m(e){return i(e)?b(e):a(e)}function b(t){return 46===t?(e.consume(t),o=0,m):62===t?(e.exit("autolinkProtocol").type="autolinkEmail",f(t)):g(t)}function g(t){return(45===t||i(t))&&o++<63?(e.consume(t),45===t?g:b):a(t)}function f(a){return e.enter("autolinkMarker"),e.consume(a),e.exit("autolinkMarker"),e.exit("autolink"),t}}};e.exports=o},function(e,t,a){"use strict";var n=a(253)(/[#-'*+\--9=?A-Z^-~]/);e.exports=n},function(e,t,a){"use strict";var n=a(237),i=a(154),r={name:"blockQuote",tokenize:function(e,t,a){var i=this;return function(t){return 62===t?(i.containerState.open||(e.enter("blockQuote",{_container:!0}),i.containerState.open=!0),e.enter("blockQuotePrefix"),e.enter("blockQuoteMarker"),e.consume(t),e.exit("blockQuoteMarker"),r):a(t)};function r(a){return n(a)?(e.enter("blockQuotePrefixWhitespace"),e.consume(a),e.exit("blockQuotePrefixWhitespace"),e.exit("blockQuotePrefix"),t):(e.exit("blockQuotePrefix"),t(a))}},continuation:{tokenize:function(e,t,a){return i(e,e.attempt(r,t,a),"linePrefix",this.parser.constructs.disable.null.indexOf("codeIndented")>-1?void 0:4)}},exit:function(e){e.exit("blockQuote")}};e.exports=r},function(e,t,a){"use strict";var n=a(1337),i={name:"characterEscape",tokenize:function(e,t,a){return function(t){return e.enter("characterEscape"),e.enter("escapeMarker"),e.consume(t),e.exit("escapeMarker"),i};function i(i){return n(i)?(e.enter("characterEscapeValue"),e.consume(i),e.exit("characterEscapeValue"),e.exit("characterEscape"),t):a(i)}}};e.exports=i},function(e,t,a){"use strict";var n=a(253)(/[!-/:-@[-`{-~]/);e.exports=n},function(e,t,a){"use strict";var n=a(845),i=a(468),r=a(846),s=a(1339);function o(e){return e&&"object"==typeof e&&"default"in e?e:{default:e}}var l=o(n),c={name:"characterReference",tokenize:function(e,t,a){var n,o,c=this,u=0;return function(t){return e.enter("characterReference"),e.enter("characterReferenceMarker"),e.consume(t),e.exit("characterReferenceMarker"),d};function d(t){return 35===t?(e.enter("characterReferenceMarkerNumeric"),e.consume(t),e.exit("characterReferenceMarkerNumeric"),p):(e.enter("characterReferenceValue"),n=31,o=i,m(t))}function p(t){return 88===t||120===t?(e.enter("characterReferenceMarkerHexadecimal"),e.consume(t),e.exit("characterReferenceMarkerHexadecimal"),e.enter("characterReferenceValue"),n=6,o=s,m):(e.enter("characterReferenceValue"),n=7,o=r,m(t))}function m(r){var s;return 59===r&&u?(s=e.exit("characterReferenceValue"),o!==i||l.default(c.sliceSerialize(s))?(e.enter("characterReferenceMarker"),e.consume(r),e.exit("characterReferenceMarker"),e.exit("characterReference"),t):a(r)):o(r)&&u++<n?(e.consume(r),m):a(r)}}};e.exports=c},function(e,t,a){"use strict";var n=a(253)(/[\dA-Fa-f]/);e.exports=n},function(e,t,a){"use strict";var n=a(147),i=a(252),r=a(467),s=a(154),o={name:"codeFenced",tokenize:function(e,t,a){var o,l=this,c={tokenize:function(e,t,a){var i=0;return s(e,(function(t){return e.enter("codeFencedFence"),e.enter("codeFencedFenceSequence"),r(t)}),"linePrefix",this.parser.constructs.disable.null.indexOf("codeIndented")>-1?void 0:4);function r(t){return t===o?(e.consume(t),i++,r):i<d?a(t):(e.exit("codeFencedFenceSequence"),s(e,l,"whitespace")(t))}function l(i){return null===i||n(i)?(e.exit("codeFencedFence"),t(i)):a(i)}},partial:!0},u=r(this.events,"linePrefix"),d=0;return function(t){return e.enter("codeFenced"),e.enter("codeFencedFence"),e.enter("codeFencedFenceSequence"),o=t,p(t)};function p(t){return t===o?(e.consume(t),d++,p):(e.exit("codeFencedFenceSequence"),d<3?a(t):s(e,m,"whitespace")(t))}function m(t){return null===t||n(t)?y(t):(e.enter("codeFencedFenceInfo"),e.enter("chunkString",{contentType:"string"}),b(t))}function b(t){return null===t||i(t)?(e.exit("chunkString"),e.exit("codeFencedFenceInfo"),s(e,g,"whitespace")(t)):96===t&&t===o?a(t):(e.consume(t),b)}function g(t){return null===t||n(t)?y(t):(e.enter("codeFencedFenceMeta"),e.enter("chunkString",{contentType:"string"}),f(t))}function f(t){return null===t||n(t)?(e.exit("chunkString"),e.exit("codeFencedFenceMeta"),y(t)):96===t&&t===o?a(t):(e.consume(t),f)}function y(a){return e.exit("codeFencedFence"),l.interrupt?t(a):h(a)}function h(t){return null===t?E(t):n(t)?(e.enter("lineEnding"),e.consume(t),e.exit("lineEnding"),e.attempt(c,E,u?s(e,h,"linePrefix",u+1):h)):(e.enter("codeFlowValue"),v(t))}function v(t){return null===t||n(t)?(e.exit("codeFlowValue"),h(t)):(e.consume(t),v)}function E(a){return e.exit("codeFenced"),t(a)}},concrete:!0};e.exports=o},function(e,t,a){"use strict";var n=a(147),i=a(251),r=a(467),s=a(154),o={name:"codeIndented",tokenize:function(e,t,a){return e.attempt(l,i,a);function i(a){return null===a?t(a):n(a)?e.attempt(l,i,t)(a):(e.enter("codeFlowValue"),r(a))}function r(t){return null===t||n(t)?(e.exit("codeFlowValue"),i(t)):(e.consume(t),r)}},resolve:function(e,t){var a={type:"codeIndented",start:e[0][1].start,end:e[e.length-1][1].end};return i(e,0,0,[["enter",a,t]]),i(e,e.length,0,[["exit",a,t]]),e}},l={tokenize:function(e,t,a){var i=this;return s(e,(function o(l){return n(l)?(e.enter("lineEnding"),e.consume(l),e.exit("lineEnding"),s(e,o,"linePrefix",5)):r(i.events,"linePrefix")<4?a(l):t(l)}),"linePrefix",5)},partial:!0};e.exports=o},function(e,t,a){"use strict";var n=a(147),i={name:"codeText",tokenize:function(e,t,a){var i,r,s=0;return function(t){return e.enter("codeText"),e.enter("codeTextSequence"),o(t)};function o(t){return 96===t?(e.consume(t),s++,o):(e.exit("codeTextSequence"),l(t))}function l(t){return null===t?a(t):96===t?(r=e.enter("codeTextSequence"),i=0,u(t)):32===t?(e.enter("space"),e.consume(t),e.exit("space"),l):n(t)?(e.enter("lineEnding"),e.consume(t),e.exit("lineEnding"),l):(e.enter("codeTextData"),c(t))}function c(t){return null===t||32===t||96===t||n(t)?(e.exit("codeTextData"),l(t)):(e.consume(t),c)}function u(a){return 96===a?(e.consume(a),i++,u):i===s?(e.exit("codeTextSequence"),e.exit("codeText"),t(a)):(r.type="codeTextData",c(a))}},resolve:function(e){var t,a,n=e.length-4,i=3;if(!("lineEnding"!==e[i][1].type&&"space"!==e[i][1].type||"lineEnding"!==e[n][1].type&&"space"!==e[n][1].type))for(t=i;++t<n;)if("codeTextData"===e[t][1].type){e[n][1].type=e[i][1].type="codeTextPadding",i+=2,n-=2;break}for(t=i-1,n++;++t<=n;)void 0===a?t!==n&&"lineEnding"!==e[t][1].type&&(a=t):t!==n&&"lineEnding"!==e[t][1].type||(e[a][1].type="codeTextData",t!==a+2&&(e[a][1].end=e[t-1][1].end,e.splice(a+2,t-a-2),n-=t-a-2,t=a+2),a=void 0);return e},previous:function(e){return 96!==e||"characterEscape"===this.events[this.events.length-1][1].type}};e.exports=i},function(e,t,a){"use strict";var n=a(147),i=a(252),r=a(580),s=a(847),o=a(848),l=a(154),c=a(849),u=a(850),d={name:"definition",tokenize:function(e,t,a){var i,u=this;return function(t){return e.enter("definition"),o.call(u,e,d,a,"definitionLabel","definitionLabelMarker","definitionLabelString")(t)};function d(t){return i=r(u.sliceSerialize(u.events[u.events.length-1][1]).slice(1,-1)),58===t?(e.enter("definitionMarker"),e.consume(t),e.exit("definitionMarker"),c(e,s(e,e.attempt(p,l(e,m,"whitespace"),l(e,m,"whitespace")),a,"definitionDestination","definitionDestinationLiteral","definitionDestinationLiteralMarker","definitionDestinationRaw","definitionDestinationString"))):a(t)}function m(r){return null===r||n(r)?(e.exit("definition"),u.parser.defined.indexOf(i)<0&&u.parser.defined.push(i),t(r)):a(r)}}},p={tokenize:function(e,t,a){return function(t){return i(t)?c(e,r)(t):a(t)};function r(t){return 34===t||39===t||40===t?u(e,l(e,s,"whitespace"),a,"definitionTitle","definitionTitleMarker","definitionTitleString")(t):a(t)}function s(e){return null===e||n(e)?t(e):a(e)}},partial:!0};e.exports=d},function(e,t,a){"use strict";var n=a(147),i={name:"hardBreakEscape",tokenize:function(e,t,a){return function(t){return e.enter("hardBreakEscape"),e.enter("escapeMarker"),e.consume(t),i};function i(i){return n(i)?(e.exit("escapeMarker"),e.exit("hardBreakEscape"),t(i)):a(i)}}};e.exports=i},function(e,t,a){"use strict";var n=a(147),i=a(252),r=a(237),s=a(251),o=a(154),l={name:"headingAtx",tokenize:function(e,t,a){var s=this,l=0;return function(t){return e.enter("atxHeading"),e.enter("atxHeadingSequence"),c(t)};function c(n){return 35===n&&l++<6?(e.consume(n),c):null===n||i(n)?(e.exit("atxHeadingSequence"),s.interrupt?t(n):u(n)):a(n)}function u(a){return 35===a?(e.enter("atxHeadingSequence"),d(a)):null===a||n(a)?(e.exit("atxHeading"),t(a)):r(a)?o(e,u,"whitespace")(a):(e.enter("atxHeadingText"),p(a))}function d(t){return 35===t?(e.consume(t),d):(e.exit("atxHeadingSequence"),u(t))}function p(t){return null===t||35===t||i(t)?(e.exit("atxHeadingText"),u(t)):(e.consume(t),p)}},resolve:function(e,t){var a,n,i=e.length-2,r=3;return"whitespace"===e[r][1].type&&(r+=2),i-2>r&&"whitespace"===e[i][1].type&&(i-=2),"atxHeadingSequence"===e[i][1].type&&(r===i-1||i-4>r&&"whitespace"===e[i-2][1].type)&&(i-=r+1===i?2:4),i>r&&(a={type:"atxHeadingText",start:e[r][1].start,end:e[i][1].end},n={type:"chunkText",start:e[r][1].start,end:e[i][1].end,contentType:"text"},s(e,r,i-r+1,[["enter",a,t],["enter",n,t],["exit",n,t],["exit",a,t]])),e}};e.exports=l},function(e,t,a){"use strict";var n=a(584),i=a(468),r=a(147),s=a(252),o=a(237),l=a(465),c=a(1347),u=a(1348),d=a(466),p={name:"htmlFlow",tokenize:function(e,t,a){var d,p,b,g,f,y=this;return function(t){return e.enter("htmlFlow"),e.enter("htmlFlowData"),e.consume(t),h};function h(i){return 33===i?(e.consume(i),v):47===i?(e.consume(i),j):63===i?(e.consume(i),d=3,y.interrupt?t:$):n(i)?(e.consume(i),b=l(i),p=!0,S):a(i)}function v(i){return 45===i?(e.consume(i),d=2,E):91===i?(e.consume(i),d=5,b="CDATA[",g=0,x):n(i)?(e.consume(i),d=4,y.interrupt?t:$):a(i)}function E(n){return 45===n?(e.consume(n),y.interrupt?t:$):a(n)}function x(n){return n===b.charCodeAt(g++)?(e.consume(n),g===b.length?y.interrupt?t:N:x):a(n)}function j(t){return n(t)?(e.consume(t),b=l(t),S):a(t)}function S(n){return null===n||47===n||62===n||s(n)?47!==n&&p&&u.indexOf(b.toLowerCase())>-1?(d=1,y.interrupt?t(n):N(n)):c.indexOf(b.toLowerCase())>-1?(d=6,47===n?(e.consume(n),k):y.interrupt?t(n):N(n)):(d=7,y.interrupt?a(n):p?w(n):O(n)):45===n||i(n)?(e.consume(n),b+=l(n),S):a(n)}function k(n){return 62===n?(e.consume(n),y.interrupt?t:N):a(n)}function O(t){return o(t)?(e.consume(t),O):A(t)}function w(t){return 47===t?(e.consume(t),A):58===t||95===t||n(t)?(e.consume(t),T):o(t)?(e.consume(t),w):A(t)}function T(t){return 45===t||46===t||58===t||95===t||i(t)?(e.consume(t),T):I(t)}function I(t){return 61===t?(e.consume(t),C):o(t)?(e.consume(t),I):w(t)}function C(t){return null===t||60===t||61===t||62===t||96===t?a(t):34===t||39===t?(e.consume(t),f=t,M):o(t)?(e.consume(t),C):(f=void 0,_(t))}function M(t){return t===f?(e.consume(t),F):null===t||r(t)?a(t):(e.consume(t),M)}function _(t){return null===t||34===t||39===t||60===t||61===t||62===t||96===t||s(t)?I(t):(e.consume(t),_)}function F(e){return 47===e||62===e||o(e)?w(e):a(e)}function A(t){return 62===t?(e.consume(t),D):a(t)}function D(t){return o(t)?(e.consume(t),D):null===t||r(t)?N(t):a(t)}function N(t){return 45===t&&2===d?(e.consume(t),L):60===t&&1===d?(e.consume(t),B):62===t&&4===d?(e.consume(t),V):63===t&&3===d?(e.consume(t),$):93===t&&5===d?(e.consume(t),z):!r(t)||6!==d&&7!==d?null===t||r(t)?P(t):(e.consume(t),N):e.check(m,V,P)(t)}function P(t){return e.exit("htmlFlowData"),R(t)}function R(t){return null===t?U(t):r(t)?(e.enter("lineEnding"),e.consume(t),e.exit("lineEnding"),R):(e.enter("htmlFlowData"),N(t))}function L(t){return 45===t?(e.consume(t),$):N(t)}function B(t){return 47===t?(e.consume(t),b="",q):N(t)}function q(t){return 62===t&&u.indexOf(b.toLowerCase())>-1?(e.consume(t),V):n(t)&&b.length<8?(e.consume(t),b+=l(t),q):N(t)}function z(t){return 93===t?(e.consume(t),$):N(t)}function $(t){return 62===t?(e.consume(t),V):N(t)}function V(t){return null===t||r(t)?(e.exit("htmlFlowData"),U(t)):(e.consume(t),V)}function U(a){return e.exit("htmlFlow"),t(a)}},resolveTo:function(e){for(var t=e.length;t--&&("enter"!==e[t][0]||"htmlFlow"!==e[t][1].type););return t>1&&"linePrefix"===e[t-2][1].type&&(e[t][1].start=e[t-2][1].start,e[t+1][1].start=e[t-2][1].start,e.splice(t-2,2)),e},concrete:!0},m={tokenize:function(e,t,a){return function(n){return e.exit("htmlFlowData"),e.enter("lineEndingBlank"),e.consume(n),e.exit("lineEndingBlank"),e.attempt(d,t,a)}},partial:!0};e.exports=p},function(e,t,a){"use strict";e.exports=["address","article","aside","base","basefont","blockquote","body","caption","center","col","colgroup","dd","details","dialog","dir","div","dl","dt","fieldset","figcaption","figure","footer","form","frame","frameset","h1","h2","h3","h4","h5","h6","head","header","hr","html","iframe","legend","li","link","main","menu","menuitem","nav","noframes","ol","optgroup","option","p","param","section","source","summary","table","tbody","td","tfoot","th","thead","title","tr","track","ul"]},function(e,t,a){"use strict";e.exports=["pre","script","style","textarea"]},function(e,t,a){"use strict";var n=a(584),i=a(468),r=a(147),s=a(252),o=a(237),l=a(154),c={name:"htmlText",tokenize:function(e,t,a){var c,u,d,p,m=this;return function(t){return e.enter("htmlText"),e.enter("htmlTextData"),e.consume(t),b};function b(t){return 33===t?(e.consume(t),g):47===t?(e.consume(t),I):63===t?(e.consume(t),w):n(t)?(e.consume(t),_):a(t)}function g(t){return 45===t?(e.consume(t),f):91===t?(e.consume(t),u="CDATA[",d=0,x):n(t)?(e.consume(t),O):a(t)}function f(t){return 45===t?(e.consume(t),y):a(t)}function y(t){return null===t||62===t?a(t):45===t?(e.consume(t),h):v(t)}function h(e){return null===e||62===e?a(e):v(e)}function v(t){return null===t?a(t):45===t?(e.consume(t),E):r(t)?(p=v,B(t)):(e.consume(t),v)}function E(t){return 45===t?(e.consume(t),z):v(t)}function x(t){return t===u.charCodeAt(d++)?(e.consume(t),d===u.length?j:x):a(t)}function j(t){return null===t?a(t):93===t?(e.consume(t),S):r(t)?(p=j,B(t)):(e.consume(t),j)}function S(t){return 93===t?(e.consume(t),k):j(t)}function k(t){return 62===t?z(t):93===t?(e.consume(t),k):j(t)}function O(t){return null===t||62===t?z(t):r(t)?(p=O,B(t)):(e.consume(t),O)}function w(t){return null===t?a(t):63===t?(e.consume(t),T):r(t)?(p=w,B(t)):(e.consume(t),w)}function T(e){return 62===e?z(e):w(e)}function I(t){return n(t)?(e.consume(t),C):a(t)}function C(t){return 45===t||i(t)?(e.consume(t),C):M(t)}function M(t){return r(t)?(p=M,B(t)):o(t)?(e.consume(t),M):z(t)}function _(t){return 45===t||i(t)?(e.consume(t),_):47===t||62===t||s(t)?F(t):a(t)}function F(t){return 47===t?(e.consume(t),z):58===t||95===t||n(t)?(e.consume(t),A):r(t)?(p=F,B(t)):o(t)?(e.consume(t),F):z(t)}function A(t){return 45===t||46===t||58===t||95===t||i(t)?(e.consume(t),A):D(t)}function D(t){return 61===t?(e.consume(t),N):r(t)?(p=D,B(t)):o(t)?(e.consume(t),D):F(t)}function N(t){return null===t||60===t||61===t||62===t||96===t?a(t):34===t||39===t?(e.consume(t),c=t,P):r(t)?(p=N,B(t)):o(t)?(e.consume(t),N):(e.consume(t),c=void 0,L)}function P(t){return t===c?(e.consume(t),R):null===t?a(t):r(t)?(p=P,B(t)):(e.consume(t),P)}function R(e){return 62===e||47===e||s(e)?F(e):a(e)}function L(t){return null===t||34===t||39===t||60===t||61===t||96===t?a(t):62===t||s(t)?F(t):(e.consume(t),L)}function B(t){return e.exit("htmlTextData"),e.enter("lineEnding"),e.consume(t),e.exit("lineEnding"),l(e,q,"linePrefix",m.parser.constructs.disable.null.indexOf("codeIndented")>-1?void 0:4)}function q(t){return e.enter("htmlTextData"),p(t)}function z(n){return 62===n?(e.consume(n),e.exit("htmlTextData"),e.exit("htmlText"),t):a(n)}}};e.exports=c},function(e,t,a){"use strict";var n={name:"labelStartImage",tokenize:function(e,t,a){var n=this;return function(t){return e.enter("labelImage"),e.enter("labelImageMarker"),e.consume(t),e.exit("labelImageMarker"),i};function i(t){return 91===t?(e.enter("labelMarker"),e.consume(t),e.exit("labelMarker"),e.exit("labelImage"),r):a(t)}function r(e){return 94===e&&"_hiddenFootnoteSupport"in n.parser.constructs?a(e):t(e)}},resolveAll:a(585).resolveAll};e.exports=n},function(e,t,a){"use strict";var n={name:"labelStartLink",tokenize:function(e,t,a){var n=this;return function(t){return e.enter("labelLink"),e.enter("labelMarker"),e.consume(t),e.exit("labelMarker"),e.exit("labelLink"),i};function i(e){return 94===e&&"_hiddenFootnoteSupport"in n.parser.constructs?a(e):t(e)}},resolveAll:a(585).resolveAll};e.exports=n},function(e,t,a){"use strict";var n=a(154),i={name:"lineEnding",tokenize:function(e,t){return function(a){return e.enter("lineEnding"),e.consume(a),e.exit("lineEnding"),n(e,t,"linePrefix")}}};e.exports=i},function(e,t,a){"use strict";var n=a(846),i=a(237),r=a(467),s=a(841),o=a(154),l=a(466),c=a(851),u={name:"list",tokenize:function(e,t,a){var o=this,u=r(o.events,"linePrefix"),p=0;return function(t){var i=o.containerState.type||(42===t||43===t||45===t?"listUnordered":"listOrdered");if("listUnordered"===i?!o.containerState.marker||t===o.containerState.marker:n(t)){if(o.containerState.type||(o.containerState.type=i,e.enter(i,{_container:!0})),"listUnordered"===i)return e.enter("listItemPrefix"),42===t||45===t?e.check(c,a,b)(t):b(t);if(!o.interrupt||49===t)return e.enter("listItemPrefix"),e.enter("listItemValue"),m(t)}return a(t)};function m(t){return n(t)&&++p<10?(e.consume(t),m):(!o.interrupt||p<2)&&(o.containerState.marker?t===o.containerState.marker:41===t||46===t)?(e.exit("listItemValue"),b(t)):a(t)}function b(t){return e.enter("listItemMarker"),e.consume(t),e.exit("listItemMarker"),o.containerState.marker=o.containerState.marker||t,e.check(l,o.interrupt?a:g,e.attempt(d,y,f))}function g(e){return o.containerState.initialBlankLine=!0,u++,y(e)}function f(t){return i(t)?(e.enter("listItemPrefixWhitespace"),e.consume(t),e.exit("listItemPrefixWhitespace"),y):a(t)}function y(a){return o.containerState.size=u+s(o.sliceStream(e.exit("listItemPrefix"))),t(a)}},continuation:{tokenize:function(e,t,a){var n=this;return n.containerState._closeFlow=void 0,e.check(l,(function(a){return n.containerState.furtherBlankLines=n.containerState.furtherBlankLines||n.containerState.initialBlankLine,o(e,t,"listItemIndent",n.containerState.size+1)(a)}),(function(a){return n.containerState.furtherBlankLines||!i(a)?(n.containerState.furtherBlankLines=n.containerState.initialBlankLine=void 0,r(a)):(n.containerState.furtherBlankLines=n.containerState.initialBlankLine=void 0,e.attempt(p,t,r)(a))}));function r(i){return n.containerState._closeFlow=!0,n.interrupt=void 0,o(e,e.attempt(u,t,a),"linePrefix",n.parser.constructs.disable.null.indexOf("codeIndented")>-1?void 0:4)(i)}}},exit:function(e){e.exit(this.containerState.type)}},d={tokenize:function(e,t,a){var n=this;return o(e,(function(e){return i(e)||!r(n.events,"listItemPrefixWhitespace")?a(e):t(e)}),"listItemPrefixWhitespace",n.parser.constructs.disable.null.indexOf("codeIndented")>-1?void 0:5)},partial:!0},p={tokenize:function(e,t,a){var n=this;return o(e,(function(e){return r(n.events,"listItemIndent")===n.containerState.size?t(e):a(e)}),"listItemIndent",n.containerState.size+1)},partial:!0};e.exports=u},function(e,t,a){"use strict";var n=a(147),i=a(315),r=a(154),s={name:"setextUnderline",tokenize:function(e,t,a){for(var i,s,o=this,l=o.events.length;l--;)if("lineEnding"!==o.events[l][1].type&&"linePrefix"!==o.events[l][1].type&&"content"!==o.events[l][1].type){s="paragraph"===o.events[l][1].type;break}return function(t){return o.lazy||!o.interrupt&&!s?a(t):(e.enter("setextHeadingLine"),e.enter("setextHeadingLineSequence"),i=t,c(t))};function c(t){return t===i?(e.consume(t),c):(e.exit("setextHeadingLineSequence"),r(e,u,"lineSuffix")(t))}function u(i){return null===i||n(i)?(e.exit("setextHeadingLine"),t(i)):a(i)}},resolveTo:function(e,t){for(var a,n,r,s,o=e.length;o--;)if("enter"===e[o][0]){if("content"===e[o][1].type){a=o;break}"paragraph"===e[o][1].type&&(n=o)}else"content"===e[o][1].type&&e.splice(o,1),r||"definition"!==e[o][1].type||(r=o);return s={type:"setextHeading",start:i(e[n][1].start),end:i(e[e.length-1][1].end)},e[n][1].type="setextHeadingText",r?(e.splice(n,0,["enter",s,t]),e.splice(r+1,0,["exit",e[a][1],t]),e[a][1].end=i(e[r][1].end)):e[a][1]=s,e.push(["exit",s,t]),e}};e.exports=s},function(e,t,a){"use strict";var n=/[\0\t\n\r]/g;e.exports=function(){var e,t=!0,a=1,i="";return function(r,s,o){var l,c,u,d,p,m=[];for(r=i+r.toString(s),u=0,i="",t&&(65279===r.charCodeAt(0)&&u++,t=void 0);u<r.length;){if(n.lastIndex=u,d=(l=n.exec(r))?l.index:r.length,p=r.charCodeAt(d),!l){i=r.slice(u);break}if(10===p&&u===d&&e)m.push(-3),e=void 0;else if(e&&(m.push(-5),e=void 0),u<d&&(m.push(r.slice(u,d)),a+=d-u),0===p)m.push(65533),a++;else if(9===p)for(c=4*Math.ceil(a/4),m.push(-2);a++<c;)m.push(-1);else 10===p?(m.push(-4),a=1):(e=!0,a=1);u=d+1}return o&&(e&&m.push(-5),i&&m.push(i),m.push(null)),m}}},function(e,t,a){"use strict";var n=a(842);e.exports=function(e){for(;!n(e););return e}},function(e,t,a){e.exports=a(33)(3706)},function(e,t,a){e.exports=a(33)(2050)},function(e,t,a){e.exports=a(33)(1622)},function(e,t,a){const n=a(1361);e.exports=function(e){if(e.allowedElements&&e.disallowedElements)throw new TypeError("Only one of `allowedElements` and `disallowedElements` should be defined");if(e.allowedElements||e.disallowedElements||e.allowElement)return e=>{n(e,"element",t)};function t(t,a,n){const i=t,r=n;let s;if(e.allowedElements?s=!e.allowedElements.includes(i.tagName):e.disallowedElements&&(s=e.disallowedElements.includes(i.tagName)),!s&&e.allowElement&&"number"==typeof a&&(s=!e.allowElement(i,a,r)),s&&"number"==typeof a)return e.unwrapDisallowed&&i.children?r.children.splice(a,1,...i.children):r.children.splice(a,1),a}}},function(e,t,a){e.exports=a(33)(362)},function(e,t){const a=["http","https","mailto","tel"];e.exports=function(e){const t=(e||"").trim(),n=t.charAt(0);if("#"===n||"/"===n)return t;const i=t.indexOf(":");if(-1===i)return t;let r=-1;for(;++r<a.length;){const e=a[r];if(i===e.length&&t.slice(0,e.length).toLowerCase()===e)return t}return r=t.indexOf("?"),-1!==r&&i>r?t:(r=t.indexOf("#"),-1!==r&&i>r?t:"javascript:void(0)")}},function(e,t,a){"use strict";const n=a(2),i=a(1400),r=a(1364),s=a(1365),o=a(1366),l=a(1367),c=a(1368),u=a(1369);t.hastToReact=b,t.hastChildrenToReact=m;const d={}.hasOwnProperty,p=new Set(["table","thead","tbody","tfoot","tr"]);function m(e,t){const a=[];let n,i=-1;for(;++i<t.children.length;)n=t.children[i],"element"===n.type?a.push(b(e,n,i,t)):"text"===n.type?"element"===t.type&&p.has(t.tagName)&&"\n"===n.value||a.push(n.value):"raw"!==n.type||e.options.skipHtml||a.push(n.value);return a}function b(e,t,a,s){const o=e.options,l=e.schema,c=t.tagName,u={};let p,b=l;if("html"===l.space&&"svg"===c&&(b=r,e.schema=b),t.properties)for(p in t.properties)d.call(t.properties,p)&&f(u,p,t.properties[p],e);"ol"!==c&&"ul"!==c||e.listDepth++;const y=m(e,t);"ol"!==c&&"ul"!==c||e.listDepth--,e.schema=l;const h=t.position||{start:{line:null,column:null,offset:null},end:{line:null,column:null,offset:null}},v=o.components&&d.call(o.components,c)?o.components[c]:c,E="string"==typeof v||v===n.Fragment;if(!i.isValidElementType(v))throw new TypeError(`Component for name \`${c}\` not defined or is not renderable`);if(u.key=[c,h.start.line,h.start.column,a].join("-"),"a"===c&&o.linkTarget&&(u.target="function"==typeof o.linkTarget?o.linkTarget(u.href,t.children,u.title):o.linkTarget),"a"===c&&o.transformLinkUri&&(u.href=o.transformLinkUri(u.href,t.children,u.title)),E||"code"!==c||"element"!==s.type||"pre"===s.tagName||(u.inline=!0),E||"h1"!==c&&"h2"!==c&&"h3"!==c&&"h4"!==c&&"h5"!==c&&"h6"!==c||(u.level=parseInt(c.charAt(1),10)),"img"===c&&o.transformImageUri&&(u.src=o.transformImageUri(u.src,u.alt,u.title)),!E&&"li"===c&&"element"===s.type){const e=function(e){let t=-1;for(;++t<e.children.length;){const a=e.children[t];if("element"===a.type&&"input"===a.tagName)return a}return null}(t);u.checked=e&&e.properties?Boolean(e.properties.checked):null,u.index=g(s,t),u.ordered="ol"===s.tagName}var x;return E||"ol"!==c&&"ul"!==c||(u.ordered="ol"===c,u.depth=e.listDepth),"td"!==c&&"th"!==c||(u.align&&(u.style||(u.style={}),u.style.textAlign=u.align,delete u.align),E||(u.isHeader="th"===c)),E||"tr"!==c||"element"!==s.type||(u.isHeader=Boolean("thead"===s.tagName)),o.sourcePos&&(u["data-sourcepos"]=[(x=h).start.line,":",x.start.column,"-",x.end.line,":",x.end.column].map((e=>String(e))).join("")),!E&&o.rawSourcePos&&(u.sourcePosition=t.position),!E&&o.includeElementIndex&&(u.index=g(s,t),u.siblingCount=g(s)),E||(u.node=t),y.length>0?n.createElement(v,u,y):n.createElement(v,u)}function g(e,t){let a=-1,n=0;for(;++a<e.children.length&&e.children[a]!==t;)"element"===e.children[a].type&&n++;return n}function f(e,t,a,n){const i=s(n.schema,t);let r=a;null!=r&&r==r&&(r&&"object"==typeof r&&"length"in r&&(r=(i.commaSeparated?c:l).stringify(r)),"style"===i.property&&"string"==typeof r&&(r=function(e){const t={};try{u(e,(function(e,a){const n="-ms-"===e.slice(0,4)?`ms-${e.slice(4)}`:e;t[n.replace(/-([a-z])/g,y)]=a}))}catch(e){}return t}(r)),i.space&&i.property?e[d.call(o,i.property)?o[i.property]:i.property]=r:i.attribute&&(e[i.attribute]=r))}function y(e,t){return t.toUpperCase()}},function(e,t,a){e.exports=a(33)(3768)},function(e,t,a){e.exports=a(33)(1633)},function(e,t,a){e.exports=a(33)(3770)},function(e,t,a){e.exports=a(33)(1634)},function(e,t,a){e.exports=a(33)(1635)},function(e,t,a){e.exports=a(33)(3771)},function(e,t,a){e.exports=a(33)(2046)},function(e,t,a){switch(window.__kbnThemeTag__){case"v8dark":return a(1372);case"v8light":return a(1374)}},function(e,t,a){var n=a(256),i=a(1373);"string"==typeof(i=i.__esModule?i.default:i)&&(i=[[e.i,i,""]]);n(i,{insert:"head",singleton:!1}),e.exports=i.locals||{}},function(e,t,a){(t=a(257)(!1)).push([e.i,".kbnOverlayMountWrapper{display:flex;flex-direction:column;height:100%;overflow:hidden}",""]),e.exports=t},function(e,t,a){var n=a(256),i=a(1375);"string"==typeof(i=i.__esModule?i.default:i)&&(i=[[e.i,i,""]]);n(i,{insert:"head",singleton:!1}),e.exports=i.locals||{}},function(e,t,a){(t=a(257)(!1)).push([e.i,".kbnOverlayMountWrapper{display:flex;flex-direction:column;height:100%;overflow:hidden}",""]),e.exports=t},function(e,t,a){var n;e.exports=function e(t,a,i){function r(o,l){if(!a[o]){if(!t[o]){if(!l&&"function"==typeof n&&n)return n(o,!0);if(s)return s(o,!0);throw new Error("Cannot find module '"+o+"'")}var c=a[o]={exports:{}};t[o][0].call(c.exports,(function(e){return r(t[o][1][e]||e)}),c,c.exports,e,t,a,i)}return a[o].exports}for(var s="function"==typeof n&&n,o=0;o<i.length;o++)r(i[o]);return r}({1:[function(e,t,a){(function(n,i,r,s,o,l,c,u,d){"use strict";function p(e,t){return function(e,t){var a;if(void 0===(a="passthrough"!==t.algorithm?y.createHash(t.algorithm):new f).write&&(a.write=a.update,a.end=a.update),g(t,a).dispatch(e),a.update||a.end(""),a.digest)return a.digest("buffer"===t.encoding?void 0:t.encoding);var n=a.read();return"buffer"===t.encoding?n:n.toString(t.encoding)}(e,t=m(e,t))}function m(e,t){if((t=t||{}).algorithm=t.algorithm||"sha1",t.encoding=t.encoding||"hex",t.excludeValues=!!t.excludeValues,t.algorithm=t.algorithm.toLowerCase(),t.encoding=t.encoding.toLowerCase(),t.ignoreUnknown=!0===t.ignoreUnknown,t.respectType=!1!==t.respectType,t.respectFunctionNames=!1!==t.respectFunctionNames,t.respectFunctionProperties=!1!==t.respectFunctionProperties,t.unorderedArrays=!0===t.unorderedArrays,t.unorderedSets=!1!==t.unorderedSets,t.unorderedObjects=!1!==t.unorderedObjects,t.replacer=t.replacer||void 0,t.excludeKeys=t.excludeKeys||void 0,void 0===e)throw new Error("Object argument required.");for(var a=0;a<h.length;++a)h[a].toLowerCase()===t.algorithm.toLowerCase()&&(t.algorithm=h[a]);if(-1===h.indexOf(t.algorithm))throw new Error('Algorithm "'+t.algorithm+'"  not supported. supported values: '+h.join(", "));if(-1===v.indexOf(t.encoding)&&"passthrough"!==t.algorithm)throw new Error('Encoding "'+t.encoding+'"  not supported. supported values: '+v.join(", "));return t}function b(e){return"function"==typeof e&&null!=/^function\s+\w*\s*\(\s*\)\s*{\s+\[native code\]\s+}$/i.exec(Function.prototype.toString.call(e))}function g(e,t,a){a=a||[];var n=function(e){return t.update?t.update(e,"utf8"):t.write(e,"utf8")};return{dispatch:function(t){e.replacer&&(t=e.replacer(t));var a=typeof t;return null===t&&(a="null"),this["_"+a](t)},_object:function(t){var i=Object.prototype.toString.call(t),s=/\[object (.*)\]/i.exec(i);s=(s=s?s[1]:"unknown:["+i+"]").toLowerCase();var o;if((o=a.indexOf(t))>=0)return this.dispatch("[CIRCULAR:"+o+"]");if(a.push(t),void 0!==r&&r.isBuffer&&r.isBuffer(t))return n("buffer:"),n(t);if("object"===s||"function"===s){var l=Object.keys(t);e.unorderedObjects&&(l=l.sort()),!1===e.respectType||b(t)||l.splice(0,0,"prototype","__proto__","constructor"),e.excludeKeys&&(l=l.filter((function(t){return!e.excludeKeys(t)}))),n("object:"+l.length+":");var c=this;return l.forEach((function(a){c.dispatch(a),n(":"),e.excludeValues||c.dispatch(t[a]),n(",")}))}if(!this["_"+s]){if(e.ignoreUnknown)return n("["+s+"]");throw new Error('Unknown object type "'+s+'"')}this["_"+s](t)},_array:function(t,i){i=void 0!==i?i:!1!==e.unorderedArrays;var r=this;if(n("array:"+t.length+":"),!i||t.length<=1)return t.forEach((function(e){return r.dispatch(e)}));var s=[],o=t.map((function(t){var n=new f,i=a.slice();return g(e,n,i).dispatch(t),s=s.concat(i.slice(a.length)),n.read().toString()}));return a=a.concat(s),o.sort(),this._array(o,!1)},_date:function(e){return n("date:"+e.toJSON())},_symbol:function(e){return n("symbol:"+e.toString())},_error:function(e){return n("error:"+e.toString())},_boolean:function(e){return n("bool:"+e.toString())},_string:function(e){n("string:"+e.length+":"),n(e.toString())},_function:function(t){n("fn:"),b(t)?this.dispatch("[native]"):this.dispatch(t.toString()),!1!==e.respectFunctionNames&&this.dispatch("function-name:"+String(t.name)),e.respectFunctionProperties&&this._object(t)},_number:function(e){return n("number:"+e.toString())},_xml:function(e){return n("xml:"+e.toString())},_null:function(){return n("Null")},_undefined:function(){return n("Undefined")},_regexp:function(e){return n("regex:"+e.toString())},_uint8array:function(e){return n("uint8array:"),this.dispatch(Array.prototype.slice.call(e))},_uint8clampedarray:function(e){return n("uint8clampedarray:"),this.dispatch(Array.prototype.slice.call(e))},_int8array:function(e){return n("uint8array:"),this.dispatch(Array.prototype.slice.call(e))},_uint16array:function(e){return n("uint16array:"),this.dispatch(Array.prototype.slice.call(e))},_int16array:function(e){return n("uint16array:"),this.dispatch(Array.prototype.slice.call(e))},_uint32array:function(e){return n("uint32array:"),this.dispatch(Array.prototype.slice.call(e))},_int32array:function(e){return n("uint32array:"),this.dispatch(Array.prototype.slice.call(e))},_float32array:function(e){return n("float32array:"),this.dispatch(Array.prototype.slice.call(e))},_float64array:function(e){return n("float64array:"),this.dispatch(Array.prototype.slice.call(e))},_arraybuffer:function(e){return n("arraybuffer:"),this.dispatch(new Uint8Array(e))},_url:function(e){return n("url:"+e.toString())},_map:function(t){n("map:");var a=Array.from(t);return this._array(a,!1!==e.unorderedSets)},_set:function(t){n("set:");var a=Array.from(t);return this._array(a,!1!==e.unorderedSets)},_blob:function(){if(e.ignoreUnknown)return n("[blob]");throw Error('Hashing Blob objects is currently not supported\n(see https://github.com/puleos/object-hash/issues/26)\nUse "options.replacer" or "options.ignoreUnknown"\n')},_domwindow:function(){return n("domwindow")},_process:function(){return n("process")},_timer:function(){return n("timer")},_pipe:function(){return n("pipe")},_tcp:function(){return n("tcp")},_udp:function(){return n("udp")},_tty:function(){return n("tty")},_statwatcher:function(){return n("statwatcher")},_securecontext:function(){return n("securecontext")},_connection:function(){return n("connection")},_zlib:function(){return n("zlib")},_context:function(){return n("context")},_nodescript:function(){return n("nodescript")},_httpparser:function(){return n("httpparser")},_dataview:function(){return n("dataview")},_signal:function(){return n("signal")},_fsevent:function(){return n("fsevent")},_tlswrap:function(){return n("tlswrap")}}}function f(){return{buf:"",write:function(e){this.buf+=e},end:function(e){this.buf+=e},read:function(){return this.buf}}}var y=e("crypto");(a=t.exports=p).sha1=function(e){return p(e)},a.keys=function(e){return p(e,{excludeValues:!0,algorithm:"sha1",encoding:"hex"})},a.MD5=function(e){return p(e,{algorithm:"md5",encoding:"hex"})},a.keysMD5=function(e){return p(e,{algorithm:"md5",encoding:"hex",excludeValues:!0})};var h=y.getHashes?y.getHashes().slice():["sha1","md5"];h.push("passthrough");var v=["buffer","hex","binary","base64"];a.writeToStream=function(e,t,a){return void 0===a&&(a=t,t={}),g(t=m(e,t),a).dispatch(e)}}).call(this,e("lYpoI2"),"undefined"!=typeof self?self:"undefined"!=typeof window?window:{},e("buffer").Buffer,arguments[3],arguments[4],arguments[5],arguments[6],"/fake_e8180ef5.js","/")},{buffer:3,crypto:5,lYpoI2:10}],2:[function(e,t,a){(function(e,t,n,i,r,s,o,l,c){var u="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";!function(e){"use strict";function t(e){var t=e.charCodeAt(0);return t===n||t===l?62:t===i||t===c?63:t<r?-1:t<r+10?t-r+26+26:t<o+26?t-o:t<s+26?t-s+26:void 0}var a="undefined"!=typeof Uint8Array?Uint8Array:Array,n="+".charCodeAt(0),i="/".charCodeAt(0),r="0".charCodeAt(0),s="a".charCodeAt(0),o="A".charCodeAt(0),l="-".charCodeAt(0),c="_".charCodeAt(0);e.toByteArray=function(e){function n(e){c[d++]=e}var i,r,s,o,l,c;if(e.length%4>0)throw new Error("Invalid string. Length must be a multiple of 4");var u=e.length;l="="===e.charAt(u-2)?2:"="===e.charAt(u-1)?1:0,c=new a(3*e.length/4-l),s=l>0?e.length-4:e.length;var d=0;for(i=0,r=0;i<s;i+=4,r+=3)n((16711680&(o=t(e.charAt(i))<<18|t(e.charAt(i+1))<<12|t(e.charAt(i+2))<<6|t(e.charAt(i+3))))>>16),n((65280&o)>>8),n(255&o);return 2===l?n(255&(o=t(e.charAt(i))<<2|t(e.charAt(i+1))>>4)):1===l&&(n((o=t(e.charAt(i))<<10|t(e.charAt(i+1))<<4|t(e.charAt(i+2))>>2)>>8&255),n(255&o)),c},e.fromByteArray=function(e){function t(e){return u.charAt(e)}function a(e){return t(e>>18&63)+t(e>>12&63)+t(e>>6&63)+t(63&e)}var n,i,r,s=e.length%3,o="";for(n=0,r=e.length-s;n<r;n+=3)o+=a(i=(e[n]<<16)+(e[n+1]<<8)+e[n+2]);switch(s){case 1:o+=t((i=e[e.length-1])>>2),o+=t(i<<4&63),o+="==";break;case 2:o+=t((i=(e[e.length-2]<<8)+e[e.length-1])>>10),o+=t(i>>4&63),o+=t(i<<2&63),o+="="}return o}}(void 0===a?this.base64js={}:a)}).call(this,e("lYpoI2"),"undefined"!=typeof self?self:"undefined"!=typeof window?window:{},e("buffer").Buffer,arguments[3],arguments[4],arguments[5],arguments[6],"/node_modules/gulp-browserify/node_modules/base64-js/lib/b64.js","/node_modules/gulp-browserify/node_modules/base64-js/lib")},{buffer:3,lYpoI2:10}],3:[function(e,t,a){(function(t,n,i,r,s,o,l,c,u){function i(e,t,a){if(!(this instanceof i))return new i(e,t,a);var n,r,s,o=typeof e;if("base64"===t&&"string"===o)for(e=function(e){return e.trim?e.trim():e.replace(/^\s+|\s+$/g,"")}(e);e.length%4!=0;)e+="=";if("number"===o)n=M(e);else if("string"===o)n=i.byteLength(e,t);else{if("object"!==o)throw new Error("First argument needs to be a number, array or string.");n=M(e.length)}if(i._useTypedArrays?r=i._augment(new Uint8Array(n)):((r=this).length=n,r._isBuffer=!0),i._useTypedArrays&&"number"==typeof e.byteLength)r._set(e);else if(function(e){return _(e)||i.isBuffer(e)||e&&"object"==typeof e&&"number"==typeof e.length}(e))for(s=0;s<n;s++)i.isBuffer(e)?r[s]=e.readUInt8(s):r[s]=e[s];else if("string"===o)r.write(e,0,t);else if("number"===o&&!i._useTypedArrays&&!a)for(s=0;s<n;s++)r[s]=0;return r}function d(e,t,a,n){a=Number(a)||0;var r=e.length-a;n?(n=Number(n))>r&&(n=r):n=r;var s=t.length;q(s%2==0,"Invalid hex string"),n>s/2&&(n=s/2);for(var o=0;o<n;o++){var l=parseInt(t.substr(2*o,2),16);q(!isNaN(l),"Invalid hex string"),e[a+o]=l}return i._charsWritten=2*o,o}function p(e,t,a,n){return i._charsWritten=N(A(t),e,a,n)}function m(e,t,a,n){return i._charsWritten=N(function(e){for(var t=[],a=0;a<e.length;a++)t.push(255&e.charCodeAt(a));return t}(t),e,a,n)}function b(e,t,a,n){return i._charsWritten=N(D(t),e,a,n)}function g(e,t,a,n){return i._charsWritten=N(function(e){for(var t,a,n,i=[],r=0;r<e.length;r++)a=(t=e.charCodeAt(r))>>8,n=t%256,i.push(n),i.push(a);return i}(t),e,a,n)}function f(e,t,a){var n="";a=Math.min(e.length,a);for(var i=t;i<a;i++)n+=String.fromCharCode(e[i]);return n}function y(e,t,a,n){n||(q("boolean"==typeof a,"missing or invalid endian"),q(null!=t,"missing offset"),q(t+1<e.length,"Trying to read beyond buffer length"));var i,r=e.length;if(!(t>=r))return a?(i=e[t],t+1<r&&(i|=e[t+1]<<8)):(i=e[t]<<8,t+1<r&&(i|=e[t+1])),i}function h(e,t,a,n){n||(q("boolean"==typeof a,"missing or invalid endian"),q(null!=t,"missing offset"),q(t+3<e.length,"Trying to read beyond buffer length"));var i,r=e.length;if(!(t>=r))return a?(t+2<r&&(i=e[t+2]<<16),t+1<r&&(i|=e[t+1]<<8),i|=e[t],t+3<r&&(i+=e[t+3]<<24>>>0)):(t+1<r&&(i=e[t+1]<<16),t+2<r&&(i|=e[t+2]<<8),t+3<r&&(i|=e[t+3]),i+=e[t]<<24>>>0),i}function v(e,t,a,n){if(n||(q("boolean"==typeof a,"missing or invalid endian"),q(null!=t,"missing offset"),q(t+1<e.length,"Trying to read beyond buffer length")),!(t>=e.length)){var i=y(e,t,a,!0);return 32768&i?-1*(65535-i+1):i}}function E(e,t,a,n){if(n||(q("boolean"==typeof a,"missing or invalid endian"),q(null!=t,"missing offset"),q(t+3<e.length,"Trying to read beyond buffer length")),!(t>=e.length)){var i=h(e,t,a,!0);return 2147483648&i?-1*(4294967295-i+1):i}}function x(e,t,a,n){return n||(q("boolean"==typeof a,"missing or invalid endian"),q(t+3<e.length,"Trying to read beyond buffer length")),$.read(e,t,a,23,4)}function j(e,t,a,n){return n||(q("boolean"==typeof a,"missing or invalid endian"),q(t+7<e.length,"Trying to read beyond buffer length")),$.read(e,t,a,52,8)}function S(e,t,a,n,i){i||(q(null!=t,"missing value"),q("boolean"==typeof n,"missing or invalid endian"),q(null!=a,"missing offset"),q(a+1<e.length,"trying to write beyond buffer length"),R(t,65535));var r=e.length;if(!(a>=r))for(var s=0,o=Math.min(r-a,2);s<o;s++)e[a+s]=(t&255<<8*(n?s:1-s))>>>8*(n?s:1-s)}function k(e,t,a,n,i){i||(q(null!=t,"missing value"),q("boolean"==typeof n,"missing or invalid endian"),q(null!=a,"missing offset"),q(a+3<e.length,"trying to write beyond buffer length"),R(t,4294967295));var r=e.length;if(!(a>=r))for(var s=0,o=Math.min(r-a,4);s<o;s++)e[a+s]=t>>>8*(n?s:3-s)&255}function O(e,t,a,n,i){i||(q(null!=t,"missing value"),q("boolean"==typeof n,"missing or invalid endian"),q(null!=a,"missing offset"),q(a+1<e.length,"Trying to write beyond buffer length"),L(t,32767,-32768)),a>=e.length||S(e,t>=0?t:65535+t+1,a,n,i)}function w(e,t,a,n,i){i||(q(null!=t,"missing value"),q("boolean"==typeof n,"missing or invalid endian"),q(null!=a,"missing offset"),q(a+3<e.length,"Trying to write beyond buffer length"),L(t,2147483647,-2147483648)),a>=e.length||k(e,t>=0?t:4294967295+t+1,a,n,i)}function T(e,t,a,n,i){i||(q(null!=t,"missing value"),q("boolean"==typeof n,"missing or invalid endian"),q(null!=a,"missing offset"),q(a+3<e.length,"Trying to write beyond buffer length"),B(t,34028234663852886e22,-34028234663852886e22)),a>=e.length||$.write(e,t,a,n,23,4)}function I(e,t,a,n,i){i||(q(null!=t,"missing value"),q("boolean"==typeof n,"missing or invalid endian"),q(null!=a,"missing offset"),q(a+7<e.length,"Trying to write beyond buffer length"),B(t,17976931348623157e292,-17976931348623157e292)),a>=e.length||$.write(e,t,a,n,52,8)}function C(e,t,a){return"number"!=typeof e?a:(e=~~e)>=t?t:e>=0||(e+=t)>=0?e:0}function M(e){return(e=~~Math.ceil(+e))<0?0:e}function _(e){return(Array.isArray||function(e){return"[object Array]"===Object.prototype.toString.call(e)})(e)}function F(e){return e<16?"0"+e.toString(16):e.toString(16)}function A(e){for(var t=[],a=0;a<e.length;a++){var n=e.charCodeAt(a);if(n<=127)t.push(e.charCodeAt(a));else{var i=a;n>=55296&&n<=57343&&a++;for(var r=encodeURIComponent(e.slice(i,a+1)).substr(1).split("%"),s=0;s<r.length;s++)t.push(parseInt(r[s],16))}}return t}function D(e){return z.toByteArray(e)}function N(e,t,a,n){for(var i=0;i<n&&!(i+a>=t.length||i>=e.length);i++)t[i+a]=e[i];return i}function P(e){try{return decodeURIComponent(e)}catch(e){return String.fromCharCode(65533)}}function R(e,t){q("number"==typeof e,"cannot write a non-number as a number"),q(e>=0,"specified a negative value for writing an unsigned value"),q(e<=t,"value is larger than maximum value for type"),q(Math.floor(e)===e,"value has a fractional component")}function L(e,t,a){q("number"==typeof e,"cannot write a non-number as a number"),q(e<=t,"value larger than maximum allowed value"),q(e>=a,"value smaller than minimum allowed value"),q(Math.floor(e)===e,"value has a fractional component")}function B(e,t,a){q("number"==typeof e,"cannot write a non-number as a number"),q(e<=t,"value larger than maximum allowed value"),q(e>=a,"value smaller than minimum allowed value")}function q(e,t){if(!e)throw new Error(t||"Failed assertion")}var z=e("base64-js"),$=e("ieee754");a.Buffer=i,a.SlowBuffer=i,a.INSPECT_MAX_BYTES=50,i.poolSize=8192,i._useTypedArrays=function(){try{var e=new ArrayBuffer(0),t=new Uint8Array(e);return t.foo=function(){return 42},42===t.foo()&&"function"==typeof t.subarray}catch(e){return!1}}(),i.isEncoding=function(e){switch(String(e).toLowerCase()){case"hex":case"utf8":case"utf-8":case"ascii":case"binary":case"base64":case"raw":case"ucs2":case"ucs-2":case"utf16le":case"utf-16le":return!0;default:return!1}},i.isBuffer=function(e){return!(null==e||!e._isBuffer)},i.byteLength=function(e,t){var a;switch(e+="",t||"utf8"){case"hex":a=e.length/2;break;case"utf8":case"utf-8":a=A(e).length;break;case"ascii":case"binary":case"raw":a=e.length;break;case"base64":a=D(e).length;break;case"ucs2":case"ucs-2":case"utf16le":case"utf-16le":a=2*e.length;break;default:throw new Error("Unknown encoding")}return a},i.concat=function(e,t){if(q(_(e),"Usage: Buffer.concat(list, [totalLength])\nlist should be an Array."),0===e.length)return new i(0);if(1===e.length)return e[0];var a;if("number"!=typeof t)for(t=0,a=0;a<e.length;a++)t+=e[a].length;var n=new i(t),r=0;for(a=0;a<e.length;a++){var s=e[a];s.copy(n,r),r+=s.length}return n},i.prototype.write=function(e,t,a,n){if(isFinite(t))isFinite(a)||(n=a,a=void 0);else{var i=n;n=t,t=a,a=i}t=Number(t)||0;var r,s=this.length-t;switch(a?(a=Number(a))>s&&(a=s):a=s,n=String(n||"utf8").toLowerCase()){case"hex":r=d(this,e,t,a);break;case"utf8":case"utf-8":r=p(this,e,t,a);break;case"ascii":r=m(this,e,t,a);break;case"binary":r=function(e,t,a,n){return m(e,t,a,n)}(this,e,t,a);break;case"base64":r=b(this,e,t,a);break;case"ucs2":case"ucs-2":case"utf16le":case"utf-16le":r=g(this,e,t,a);break;default:throw new Error("Unknown encoding")}return r},i.prototype.toString=function(e,t,a){var n,i=this;if(e=String(e||"utf8").toLowerCase(),t=Number(t)||0,(a=void 0!==a?Number(a):a=i.length)===t)return"";switch(e){case"hex":n=function(e,t,a){var n=e.length;(!t||t<0)&&(t=0),(!a||a<0||a>n)&&(a=n);for(var i="",r=t;r<a;r++)i+=F(e[r]);return i}(i,t,a);break;case"utf8":case"utf-8":n=function(e,t,a){var n="",i="";a=Math.min(e.length,a);for(var r=t;r<a;r++)e[r]<=127?(n+=P(i)+String.fromCharCode(e[r]),i=""):i+="%"+e[r].toString(16);return n+P(i)}(i,t,a);break;case"ascii":n=f(i,t,a);break;case"binary":n=function(e,t,a){return f(e,t,a)}(i,t,a);break;case"base64":n=function(e,t,a){return 0===t&&a===e.length?z.fromByteArray(e):z.fromByteArray(e.slice(t,a))}(i,t,a);break;case"ucs2":case"ucs-2":case"utf16le":case"utf-16le":n=function(e,t,a){for(var n=e.slice(t,a),i="",r=0;r<n.length;r+=2)i+=String.fromCharCode(n[r]+256*n[r+1]);return i}(i,t,a);break;default:throw new Error("Unknown encoding")}return n},i.prototype.toJSON=function(){return{type:"Buffer",data:Array.prototype.slice.call(this._arr||this,0)}},i.prototype.copy=function(e,t,a,n){var r=this;if(a||(a=0),n||0===n||(n=this.length),t||(t=0),n!==a&&0!==e.length&&0!==r.length){q(n>=a,"sourceEnd < sourceStart"),q(t>=0&&t<e.length,"targetStart out of bounds"),q(a>=0&&a<r.length,"sourceStart out of bounds"),q(n>=0&&n<=r.length,"sourceEnd out of bounds"),n>this.length&&(n=this.length),e.length-t<n-a&&(n=e.length-t+a);var s=n-a;if(s<100||!i._useTypedArrays)for(var o=0;o<s;o++)e[o+t]=this[o+a];else e._set(this.subarray(a,a+s),t)}},i.prototype.slice=function(e,t){var a=this.length;if(e=C(e,a,0),t=C(t,a,a),i._useTypedArrays)return i._augment(this.subarray(e,t));for(var n=t-e,r=new i(n,void 0,!0),s=0;s<n;s++)r[s]=this[s+e];return r},i.prototype.get=function(e){return console.log(".get() is deprecated. Access using array indexes instead."),this.readUInt8(e)},i.prototype.set=function(e,t){return console.log(".set() is deprecated. Access using array indexes instead."),this.writeUInt8(e,t)},i.prototype.readUInt8=function(e,t){if(t||(q(null!=e,"missing offset"),q(e<this.length,"Trying to read beyond buffer length")),!(e>=this.length))return this[e]},i.prototype.readUInt16LE=function(e,t){return y(this,e,!0,t)},i.prototype.readUInt16BE=function(e,t){return y(this,e,!1,t)},i.prototype.readUInt32LE=function(e,t){return h(this,e,!0,t)},i.prototype.readUInt32BE=function(e,t){return h(this,e,!1,t)},i.prototype.readInt8=function(e,t){if(t||(q(null!=e,"missing offset"),q(e<this.length,"Trying to read beyond buffer length")),!(e>=this.length))return 128&this[e]?-1*(255-this[e]+1):this[e]},i.prototype.readInt16LE=function(e,t){return v(this,e,!0,t)},i.prototype.readInt16BE=function(e,t){return v(this,e,!1,t)},i.prototype.readInt32LE=function(e,t){return E(this,e,!0,t)},i.prototype.readInt32BE=function(e,t){return E(this,e,!1,t)},i.prototype.readFloatLE=function(e,t){return x(this,e,!0,t)},i.prototype.readFloatBE=function(e,t){return x(this,e,!1,t)},i.prototype.readDoubleLE=function(e,t){return j(this,e,!0,t)},i.prototype.readDoubleBE=function(e,t){return j(this,e,!1,t)},i.prototype.writeUInt8=function(e,t,a){a||(q(null!=e,"missing value"),q(null!=t,"missing offset"),q(t<this.length,"trying to write beyond buffer length"),R(e,255)),t>=this.length||(this[t]=e)},i.prototype.writeUInt16LE=function(e,t,a){S(this,e,t,!0,a)},i.prototype.writeUInt16BE=function(e,t,a){S(this,e,t,!1,a)},i.prototype.writeUInt32LE=function(e,t,a){k(this,e,t,!0,a)},i.prototype.writeUInt32BE=function(e,t,a){k(this,e,t,!1,a)},i.prototype.writeInt8=function(e,t,a){a||(q(null!=e,"missing value"),q(null!=t,"missing offset"),q(t<this.length,"Trying to write beyond buffer length"),L(e,127,-128)),t>=this.length||(e>=0?this.writeUInt8(e,t,a):this.writeUInt8(255+e+1,t,a))},i.prototype.writeInt16LE=function(e,t,a){O(this,e,t,!0,a)},i.prototype.writeInt16BE=function(e,t,a){O(this,e,t,!1,a)},i.prototype.writeInt32LE=function(e,t,a){w(this,e,t,!0,a)},i.prototype.writeInt32BE=function(e,t,a){w(this,e,t,!1,a)},i.prototype.writeFloatLE=function(e,t,a){T(this,e,t,!0,a)},i.prototype.writeFloatBE=function(e,t,a){T(this,e,t,!1,a)},i.prototype.writeDoubleLE=function(e,t,a){I(this,e,t,!0,a)},i.prototype.writeDoubleBE=function(e,t,a){I(this,e,t,!1,a)},i.prototype.fill=function(e,t,a){if(e||(e=0),t||(t=0),a||(a=this.length),"string"==typeof e&&(e=e.charCodeAt(0)),q("number"==typeof e&&!isNaN(e),"value is not a number"),q(a>=t,"end < start"),a!==t&&0!==this.length){q(t>=0&&t<this.length,"start out of bounds"),q(a>=0&&a<=this.length,"end out of bounds");for(var n=t;n<a;n++)this[n]=e}},i.prototype.inspect=function(){for(var e=[],t=this.length,n=0;n<t;n++)if(e[n]=F(this[n]),n===a.INSPECT_MAX_BYTES){e[n+1]="...";break}return"<Buffer "+e.join(" ")+">"},i.prototype.toArrayBuffer=function(){if("undefined"!=typeof Uint8Array){if(i._useTypedArrays)return new i(this).buffer;for(var e=new Uint8Array(this.length),t=0,a=e.length;t<a;t+=1)e[t]=this[t];return e.buffer}throw new Error("Buffer.toArrayBuffer not supported in this browser")};var V=i.prototype;i._augment=function(e){return e._isBuffer=!0,e._get=e.get,e._set=e.set,e.get=V.get,e.set=V.set,e.write=V.write,e.toString=V.toString,e.toLocaleString=V.toString,e.toJSON=V.toJSON,e.copy=V.copy,e.slice=V.slice,e.readUInt8=V.readUInt8,e.readUInt16LE=V.readUInt16LE,e.readUInt16BE=V.readUInt16BE,e.readUInt32LE=V.readUInt32LE,e.readUInt32BE=V.readUInt32BE,e.readInt8=V.readInt8,e.readInt16LE=V.readInt16LE,e.readInt16BE=V.readInt16BE,e.readInt32LE=V.readInt32LE,e.readInt32BE=V.readInt32BE,e.readFloatLE=V.readFloatLE,e.readFloatBE=V.readFloatBE,e.readDoubleLE=V.readDoubleLE,e.readDoubleBE=V.readDoubleBE,e.writeUInt8=V.writeUInt8,e.writeUInt16LE=V.writeUInt16LE,e.writeUInt16BE=V.writeUInt16BE,e.writeUInt32LE=V.writeUInt32LE,e.writeUInt32BE=V.writeUInt32BE,e.writeInt8=V.writeInt8,e.writeInt16LE=V.writeInt16LE,e.writeInt16BE=V.writeInt16BE,e.writeInt32LE=V.writeInt32LE,e.writeInt32BE=V.writeInt32BE,e.writeFloatLE=V.writeFloatLE,e.writeFloatBE=V.writeFloatBE,e.writeDoubleLE=V.writeDoubleLE,e.writeDoubleBE=V.writeDoubleBE,e.fill=V.fill,e.inspect=V.inspect,e.toArrayBuffer=V.toArrayBuffer,e}}).call(this,e("lYpoI2"),"undefined"!=typeof self?self:"undefined"!=typeof window?window:{},e("buffer").Buffer,arguments[3],arguments[4],arguments[5],arguments[6],"/node_modules/gulp-browserify/node_modules/buffer/index.js","/node_modules/gulp-browserify/node_modules/buffer")},{"base64-js":2,buffer:3,ieee754:11,lYpoI2:10}],4:[function(e,t,a){(function(a,n,i,r,s,o,l,c,u){i=e("buffer").Buffer;var d=4,p=new i(d);p.fill(0);var m=8;t.exports={hash:function(e,t,a,n){return i.isBuffer(e)||(e=new i(e)),function(e,t,a){for(var n=new i(t),r=a?n.writeInt32BE:n.writeInt32LE,s=0;s<e.length;s++)r.call(n,e[s],4*s,!0);return n}(t(function(e,t){if(e.length%d!=0){var a=e.length+(d-e.length%d);e=i.concat([e,p],a)}for(var n=[],r=t?e.readInt32BE:e.readInt32LE,s=0;s<e.length;s+=d)n.push(r.call(e,s));return n}(e,n),e.length*m),a,n)}}}).call(this,e("lYpoI2"),"undefined"!=typeof self?self:"undefined"!=typeof window?window:{},e("buffer").Buffer,arguments[3],arguments[4],arguments[5],arguments[6],"/node_modules/gulp-browserify/node_modules/crypto-browserify/helpers.js","/node_modules/gulp-browserify/node_modules/crypto-browserify")},{buffer:3,lYpoI2:10}],5:[function(e,t,a){(function(t,n,i,r,s,o,l,c,u){function d(e,t){var a=f[e=e||"sha1"],n=[];return a||p("algorithm:",e,"is not yet supported"),{update:function(e){return i.isBuffer(e)||(e=new i(e)),n.push(e),e.length,this},digest:function(e){var r=i.concat(n),s=t?function(e,t,a){i.isBuffer(t)||(t=new i(t)),i.isBuffer(a)||(a=new i(a)),t.length>y?t=e(t):t.length<y&&(t=i.concat([t,h],y));for(var n=new i(y),r=new i(y),s=0;s<y;s++)n[s]=54^t[s],r[s]=92^t[s];var o=e(i.concat([n,a]));return e(i.concat([r,o]))}(a,t,r):a(r);return n=null,e?s.toString(e):s}}}function p(){var e=[].slice.call(arguments).join(" ");throw new Error([e,"we accept pull requests","http://github.com/dominictarr/crypto-browserify"].join("\n"))}i=e("buffer").Buffer;var m=e("./sha"),b=e("./sha256"),g=e("./rng"),f={sha1:m,sha256:b,md5:e("./md5")},y=64,h=new i(y);h.fill(0),a.createHash=function(e){return d(e)},a.createHmac=function(e,t){return d(e,t)},a.randomBytes=function(e,t){if(!t||!t.call)return new i(g(e));try{t.call(this,void 0,new i(g(e)))}catch(e){t(e)}},function(e,t){for(var a in e)t(e[a],a)}(["createCredentials","createCipher","createCipheriv","createDecipher","createDecipheriv","createSign","createVerify","createDiffieHellman","pbkdf2"],(function(e){a[e]=function(){p("sorry,",e,"is not implemented yet")}}))}).call(this,e("lYpoI2"),"undefined"!=typeof self?self:"undefined"!=typeof window?window:{},e("buffer").Buffer,arguments[3],arguments[4],arguments[5],arguments[6],"/node_modules/gulp-browserify/node_modules/crypto-browserify/index.js","/node_modules/gulp-browserify/node_modules/crypto-browserify")},{"./md5":6,"./rng":7,"./sha":8,"./sha256":9,buffer:3,lYpoI2:10}],6:[function(e,t,a){(function(a,n,i,r,s,o,l,c,u){function d(e,t){e[t>>5]|=128<<t%32,e[14+(t+64>>>9<<4)]=t;for(var a=1732584193,n=-271733879,i=-1732584194,r=271733878,s=0;s<e.length;s+=16){var o=a,l=n,c=i,u=r;a=m(a,n,i,r,e[s+0],7,-680876936),r=m(r,a,n,i,e[s+1],12,-389564586),i=m(i,r,a,n,e[s+2],17,606105819),n=m(n,i,r,a,e[s+3],22,-1044525330),a=m(a,n,i,r,e[s+4],7,-176418897),r=m(r,a,n,i,e[s+5],12,1200080426),i=m(i,r,a,n,e[s+6],17,-1473231341),n=m(n,i,r,a,e[s+7],22,-45705983),a=m(a,n,i,r,e[s+8],7,1770035416),r=m(r,a,n,i,e[s+9],12,-1958414417),i=m(i,r,a,n,e[s+10],17,-42063),n=m(n,i,r,a,e[s+11],22,-1990404162),a=m(a,n,i,r,e[s+12],7,1804603682),r=m(r,a,n,i,e[s+13],12,-40341101),i=m(i,r,a,n,e[s+14],17,-1502002290),a=b(a,n=m(n,i,r,a,e[s+15],22,1236535329),i,r,e[s+1],5,-165796510),r=b(r,a,n,i,e[s+6],9,-1069501632),i=b(i,r,a,n,e[s+11],14,643717713),n=b(n,i,r,a,e[s+0],20,-373897302),a=b(a,n,i,r,e[s+5],5,-701558691),r=b(r,a,n,i,e[s+10],9,38016083),i=b(i,r,a,n,e[s+15],14,-660478335),n=b(n,i,r,a,e[s+4],20,-405537848),a=b(a,n,i,r,e[s+9],5,568446438),r=b(r,a,n,i,e[s+14],9,-1019803690),i=b(i,r,a,n,e[s+3],14,-187363961),n=b(n,i,r,a,e[s+8],20,1163531501),a=b(a,n,i,r,e[s+13],5,-1444681467),r=b(r,a,n,i,e[s+2],9,-51403784),i=b(i,r,a,n,e[s+7],14,1735328473),a=g(a,n=b(n,i,r,a,e[s+12],20,-1926607734),i,r,e[s+5],4,-378558),r=g(r,a,n,i,e[s+8],11,-2022574463),i=g(i,r,a,n,e[s+11],16,1839030562),n=g(n,i,r,a,e[s+14],23,-35309556),a=g(a,n,i,r,e[s+1],4,-1530992060),r=g(r,a,n,i,e[s+4],11,1272893353),i=g(i,r,a,n,e[s+7],16,-155497632),n=g(n,i,r,a,e[s+10],23,-1094730640),a=g(a,n,i,r,e[s+13],4,681279174),r=g(r,a,n,i,e[s+0],11,-358537222),i=g(i,r,a,n,e[s+3],16,-722521979),n=g(n,i,r,a,e[s+6],23,76029189),a=g(a,n,i,r,e[s+9],4,-640364487),r=g(r,a,n,i,e[s+12],11,-421815835),i=g(i,r,a,n,e[s+15],16,530742520),a=f(a,n=g(n,i,r,a,e[s+2],23,-995338651),i,r,e[s+0],6,-198630844),r=f(r,a,n,i,e[s+7],10,1126891415),i=f(i,r,a,n,e[s+14],15,-1416354905),n=f(n,i,r,a,e[s+5],21,-57434055),a=f(a,n,i,r,e[s+12],6,1700485571),r=f(r,a,n,i,e[s+3],10,-1894986606),i=f(i,r,a,n,e[s+10],15,-1051523),n=f(n,i,r,a,e[s+1],21,-2054922799),a=f(a,n,i,r,e[s+8],6,1873313359),r=f(r,a,n,i,e[s+15],10,-30611744),i=f(i,r,a,n,e[s+6],15,-1560198380),n=f(n,i,r,a,e[s+13],21,1309151649),a=f(a,n,i,r,e[s+4],6,-145523070),r=f(r,a,n,i,e[s+11],10,-1120210379),i=f(i,r,a,n,e[s+2],15,718787259),n=f(n,i,r,a,e[s+9],21,-343485551),a=y(a,o),n=y(n,l),i=y(i,c),r=y(r,u)}return Array(a,n,i,r)}function p(e,t,a,n,i,r){return y(function(e,t){return e<<t|e>>>32-t}(y(y(t,e),y(n,r)),i),a)}function m(e,t,a,n,i,r,s){return p(t&a|~t&n,e,t,i,r,s)}function b(e,t,a,n,i,r,s){return p(t&n|a&~n,e,t,i,r,s)}function g(e,t,a,n,i,r,s){return p(t^a^n,e,t,i,r,s)}function f(e,t,a,n,i,r,s){return p(a^(t|~n),e,t,i,r,s)}function y(e,t){var a=(65535&e)+(65535&t);return(e>>16)+(t>>16)+(a>>16)<<16|65535&a}var h=e("./helpers");t.exports=function(e){return h.hash(e,d,16)}}).call(this,e("lYpoI2"),"undefined"!=typeof self?self:"undefined"!=typeof window?window:{},e("buffer").Buffer,arguments[3],arguments[4],arguments[5],arguments[6],"/node_modules/gulp-browserify/node_modules/crypto-browserify/md5.js","/node_modules/gulp-browserify/node_modules/crypto-browserify")},{"./helpers":4,buffer:3,lYpoI2:10}],7:[function(e,t,a){(function(e,a,n,i,r,s,o,l,c){!function(){var e,a;e=function(e){for(var t,a=new Array(e),n=0;n<e;n++)0==(3&n)&&(t=4294967296*Math.random()),a[n]=t>>>((3&n)<<3)&255;return a},this.crypto&&crypto.getRandomValues&&(a=function(e){var t=new Uint8Array(e);return crypto.getRandomValues(t),t}),t.exports=a||e}()}).call(this,e("lYpoI2"),"undefined"!=typeof self?self:"undefined"!=typeof window?window:{},e("buffer").Buffer,arguments[3],arguments[4],arguments[5],arguments[6],"/node_modules/gulp-browserify/node_modules/crypto-browserify/rng.js","/node_modules/gulp-browserify/node_modules/crypto-browserify")},{buffer:3,lYpoI2:10}],8:[function(e,t,a){(function(a,n,i,r,s,o,l,c,u){function d(e,t){e[t>>5]|=128<<24-t%32,e[15+(t+64>>9<<4)]=t;for(var a=Array(80),n=1732584193,i=-271733879,r=-1732584194,s=271733878,o=-1009589776,l=0;l<e.length;l+=16){for(var c=n,u=i,d=r,f=s,y=o,h=0;h<80;h++){a[h]=h<16?e[l+h]:g(a[h-3]^a[h-8]^a[h-14]^a[h-16],1);var v=b(b(g(n,5),p(h,i,r,s)),b(b(o,a[h]),m(h)));o=s,s=r,r=g(i,30),i=n,n=v}n=b(n,c),i=b(i,u),r=b(r,d),s=b(s,f),o=b(o,y)}return Array(n,i,r,s,o)}function p(e,t,a,n){return e<20?t&a|~t&n:e<40?t^a^n:e<60?t&a|t&n|a&n:t^a^n}function m(e){return e<20?1518500249:e<40?1859775393:e<60?-1894007588:-899497514}function b(e,t){var a=(65535&e)+(65535&t);return(e>>16)+(t>>16)+(a>>16)<<16|65535&a}function g(e,t){return e<<t|e>>>32-t}var f=e("./helpers");t.exports=function(e){return f.hash(e,d,20,!0)}}).call(this,e("lYpoI2"),"undefined"!=typeof self?self:"undefined"!=typeof window?window:{},e("buffer").Buffer,arguments[3],arguments[4],arguments[5],arguments[6],"/node_modules/gulp-browserify/node_modules/crypto-browserify/sha.js","/node_modules/gulp-browserify/node_modules/crypto-browserify")},{"./helpers":4,buffer:3,lYpoI2:10}],9:[function(e,t,a){(function(a,n,i,r,s,o,l,c,u){var d=e("./helpers"),p=function(e,t){var a=(65535&e)+(65535&t);return(e>>16)+(t>>16)+(a>>16)<<16|65535&a},m=function(e,t){return e>>>t|e<<32-t},b=function(e,t){return e>>>t},g=function(e,t,a){return e&t^~e&a},f=function(e,t,a){return e&t^e&a^t&a},y=function(e){return m(e,2)^m(e,13)^m(e,22)},h=function(e){return m(e,6)^m(e,11)^m(e,25)},v=function(e){return m(e,7)^m(e,18)^b(e,3)},E=function(e){return m(e,17)^m(e,19)^b(e,10)},x=function(e,t){var a,n,i,r,s,o,l,c,u,d,m=new Array(1116352408,1899447441,3049323471,3921009573,961987163,1508970993,2453635748,2870763221,3624381080,310598401,607225278,1426881987,1925078388,2162078206,2614888103,3248222580,3835390401,4022224774,264347078,604807628,770255983,1249150122,1555081692,1996064986,2554220882,2821834349,2952996808,3210313671,3336571891,3584528711,113926993,338241895,666307205,773529912,1294757372,1396182291,1695183700,1986661051,2177026350,2456956037,2730485921,2820302411,3259730800,3345764771,3516065817,3600352804,4094571909,275423344,430227734,506948616,659060556,883997877,958139571,1322822218,1537002063,1747873779,1955562222,2024104815,2227730452,2361852424,2428436474,2756734187,3204031479,3329325298),b=new Array(1779033703,3144134277,1013904242,2773480762,1359893119,2600822924,528734635,1541459225),x=new Array(64);e[t>>5]|=128<<24-t%32,e[15+(t+64>>9<<4)]=t;for(var j=0;j<e.length;j+=16){a=b[0],n=b[1],i=b[2],r=b[3],s=b[4],o=b[5],l=b[6],c=b[7];for(var S=0;S<64;S++)x[S]=S<16?e[S+j]:p(p(p(E(x[S-2]),x[S-7]),v(x[S-15])),x[S-16]),u=p(p(p(p(c,h(s)),g(s,o,l)),m[S]),x[S]),d=p(y(a),f(a,n,i)),c=l,l=o,o=s,s=p(r,u),r=i,i=n,n=a,a=p(u,d);b[0]=p(a,b[0]),b[1]=p(n,b[1]),b[2]=p(i,b[2]),b[3]=p(r,b[3]),b[4]=p(s,b[4]),b[5]=p(o,b[5]),b[6]=p(l,b[6]),b[7]=p(c,b[7])}return b};t.exports=function(e){return d.hash(e,x,32,!0)}}).call(this,e("lYpoI2"),"undefined"!=typeof self?self:"undefined"!=typeof window?window:{},e("buffer").Buffer,arguments[3],arguments[4],arguments[5],arguments[6],"/node_modules/gulp-browserify/node_modules/crypto-browserify/sha256.js","/node_modules/gulp-browserify/node_modules/crypto-browserify")},{"./helpers":4,buffer:3,lYpoI2:10}],10:[function(e,t,a){(function(e,a,n,i,r,s,o,l,c){function u(){}(e=t.exports={}).nextTick=function(){var e="undefined"!=typeof window&&window.setImmediate,t="undefined"!=typeof window&&window.postMessage&&window.addEventListener;if(e)return function(e){return window.setImmediate(e)};if(t){var a=[];return window.addEventListener("message",(function(e){var t=e.source;(t===window||null===t)&&"process-tick"===e.data&&(e.stopPropagation(),a.length>0)&&a.shift()()}),!0),function(e){a.push(e),window.postMessage("process-tick","*")}}return function(e){setTimeout(e,0)}}(),e.title="browser",e.browser=!0,e.env={},e.argv=[],e.on=u,e.addListener=u,e.once=u,e.off=u,e.removeListener=u,e.removeAllListeners=u,e.emit=u,e.binding=function(e){throw new Error("process.binding is not supported")},e.cwd=function(){return"/"},e.chdir=function(e){throw new Error("process.chdir is not supported")}}).call(this,e("lYpoI2"),"undefined"!=typeof self?self:"undefined"!=typeof window?window:{},e("buffer").Buffer,arguments[3],arguments[4],arguments[5],arguments[6],"/node_modules/gulp-browserify/node_modules/process/browser.js","/node_modules/gulp-browserify/node_modules/process")},{buffer:3,lYpoI2:10}],11:[function(e,t,a){(function(e,t,n,i,r,s,o,l,c){a.read=function(e,t,a,n,i){var r,s,o=8*i-n-1,l=(1<<o)-1,c=l>>1,u=-7,d=a?i-1:0,p=a?-1:1,m=e[t+d];for(d+=p,r=m&(1<<-u)-1,m>>=-u,u+=o;u>0;r=256*r+e[t+d],d+=p,u-=8);for(s=r&(1<<-u)-1,r>>=-u,u+=n;u>0;s=256*s+e[t+d],d+=p,u-=8);if(0===r)r=1-c;else{if(r===l)return s?NaN:1/0*(m?-1:1);s+=Math.pow(2,n),r-=c}return(m?-1:1)*s*Math.pow(2,r-n)},a.write=function(e,t,a,n,i,r){var s,o,l,c=8*r-i-1,u=(1<<c)-1,d=u>>1,p=23===i?Math.pow(2,-24)-Math.pow(2,-77):0,m=n?0:r-1,b=n?1:-1,g=t<0||0===t&&1/t<0?1:0;for(t=Math.abs(t),isNaN(t)||t===1/0?(o=isNaN(t)?1:0,s=u):(s=Math.floor(Math.log(t)/Math.LN2),t*(l=Math.pow(2,-s))<1&&(s--,l*=2),(t+=s+d>=1?p/l:p*Math.pow(2,1-d))*l>=2&&(s++,l/=2),s+d>=u?(o=0,s=u):s+d>=1?(o=(t*l-1)*Math.pow(2,i),s+=d):(o=t*Math.pow(2,d-1)*Math.pow(2,i),s=0));i>=8;e[a+m]=255&o,m+=b,o/=256,i-=8);for(s=s<<i|o,c+=i;c>0;e[a+m]=255&s,m+=b,s/=256,c-=8);e[a+m-b]|=128*g}}).call(this,e("lYpoI2"),"undefined"!=typeof self?self:"undefined"!=typeof window?window:{},e("buffer").Buffer,arguments[3],arguments[4],arguments[5],arguments[6],"/node_modules/ieee754/index.js","/node_modules/ieee754")},{buffer:3,lYpoI2:10}]},{},[1])(1)},,function(e,t,a){e.exports=a.p+"94cccf20036d014924e63d4d595e88e1.svg"},function(e,t,a){var n,i,r,s;
/*!
 * mustache.js - Logic-less {{mustache}} templates with JavaScript
 * http://github.com/janl/mustache.js
 */s=function(e){var t=Object.prototype.toString,a=Array.isArray||function(e){return"[object Array]"===t.call(e)};function n(e){return"function"==typeof e}function i(e){return e.replace(/[\-\[\]{}()*+?.,\\\^$|#\s]/g,"\\$&")}function r(e,t){return null!=e&&"object"==typeof e&&t in e}var s=RegExp.prototype.test,o=/\S/;var l={"&":"&amp;","<":"&lt;",">":"&gt;",'"':"&quot;","'":"&#39;","/":"&#x2F;","`":"&#x60;","=":"&#x3D;"},c=/\s*/,u=/\s+/,d=/\s*=/,p=/\s*\}/,m=/#|\^|\/|>|\{|&|=|!/;function b(e){this.string=e,this.tail=e,this.pos=0}function g(e,t){this.view=e,this.cache={".":this.view},this.parent=t}function f(){this.cache={}}b.prototype.eos=function(){return""===this.tail},b.prototype.scan=function(e){var t=this.tail.match(e);if(!t||0!==t.index)return"";var a=t[0];return this.tail=this.tail.substring(a.length),this.pos+=a.length,a},b.prototype.scanUntil=function(e){var t,a=this.tail.search(e);switch(a){case-1:t=this.tail,this.tail="";break;case 0:t="";break;default:t=this.tail.substring(0,a),this.tail=this.tail.substring(a)}return this.pos+=t.length,t},g.prototype.push=function(e){return new g(e,this)},g.prototype.lookup=function(e){var t,a=this.cache;if(a.hasOwnProperty(e))t=a[e];else{for(var i,s,o=this,l=!1;o;){if(e.indexOf(".")>0)for(t=o.view,i=e.split("."),s=0;null!=t&&s<i.length;)s===i.length-1&&(l=r(t,i[s])),t=t[i[s++]];else t=o.view[e],l=r(o.view,e);if(l)break;o=o.parent}a[e]=t}return n(t)&&(t=t.call(this.view)),t},f.prototype.clearCache=function(){this.cache={}},f.prototype.parse=function(t,n){var r=this.cache,l=r[t];return null==l&&(l=r[t]=function(t,n){if(!t)return[];var r,l,g,f,y=[],h=[],v=[],E=!1,x=!1;function j(){if(E&&!x)for(;v.length;)delete h[v.pop()];else v=[];E=!1,x=!1}function S(e){if("string"==typeof e&&(e=e.split(u,2)),!a(e)||2!==e.length)throw new Error("Invalid tags: "+e);r=new RegExp(i(e[0])+"\\s*"),l=new RegExp("\\s*"+i(e[1])),g=new RegExp("\\s*"+i("}"+e[1]))}S(n||e.tags);for(var k,O,w,T,I,C,M=new b(t);!M.eos();){if(k=M.pos,w=M.scanUntil(r))for(var _=0,F=w.length;_<F;++_)f=T=w.charAt(_),function(e,t){return s.call(e,t)}(o,f)?x=!0:v.push(h.length),h.push(["text",T,k,k+1]),k+=1,"\n"===T&&j();if(!M.scan(r))break;if(E=!0,O=M.scan(m)||"name",M.scan(c),"="===O?(w=M.scanUntil(d),M.scan(d),M.scanUntil(l)):"{"===O?(w=M.scanUntil(g),M.scan(p),M.scanUntil(l),O="&"):w=M.scanUntil(l),!M.scan(l))throw new Error("Unclosed tag at "+M.pos);if(I=[O,w,k,M.pos],h.push(I),"#"===O||"^"===O)y.push(I);else if("/"===O){if(!(C=y.pop()))throw new Error('Unopened section "'+w+'" at '+k);if(C[1]!==w)throw new Error('Unclosed section "'+C[1]+'" at '+k)}else"name"===O||"{"===O||"&"===O?x=!0:"="===O&&S(w)}if(C=y.pop())throw new Error('Unclosed section "'+C[1]+'" at '+M.pos);return function(e){for(var t,a=[],n=a,i=[],r=0,s=e.length;r<s;++r)switch((t=e[r])[0]){case"#":case"^":n.push(t),i.push(t),n=t[4]=[];break;case"/":i.pop()[5]=t[2],n=i.length>0?i[i.length-1][4]:a;break;default:n.push(t)}return a}(function(e){for(var t,a,n=[],i=0,r=e.length;i<r;++i)(t=e[i])&&("text"===t[0]&&a&&"text"===a[0]?(a[1]+=t[1],a[3]=t[3]):(n.push(t),a=t));return n}(h))}(t,n)),l},f.prototype.render=function(e,t,a){var n=this.parse(e),i=t instanceof g?t:new g(t);return this.renderTokens(n,i,a,e)},f.prototype.renderTokens=function(e,t,a,n){for(var i,r,s,o="",l=0,c=e.length;l<c;++l)s=void 0,"#"===(r=(i=e[l])[0])?s=this.renderSection(i,t,a,n):"^"===r?s=this.renderInverted(i,t,a,n):">"===r?s=this.renderPartial(i,t,a,n):"&"===r?s=this.unescapedValue(i,t):"name"===r?s=this.escapedValue(i,t):"text"===r&&(s=this.rawValue(i)),void 0!==s&&(o+=s);return o},f.prototype.renderSection=function(e,t,i,r){var s=this,o="",l=t.lookup(e[1]);if(l){if(a(l))for(var c=0,u=l.length;c<u;++c)o+=this.renderTokens(e[4],t.push(l[c]),i,r);else if("object"==typeof l||"string"==typeof l||"number"==typeof l)o+=this.renderTokens(e[4],t.push(l),i,r);else if(n(l)){if("string"!=typeof r)throw new Error("Cannot use higher-order sections without the original template");null!=(l=l.call(t.view,r.slice(e[3],e[5]),(function(e){return s.render(e,t,i)})))&&(o+=l)}else o+=this.renderTokens(e[4],t,i,r);return o}},f.prototype.renderInverted=function(e,t,n,i){var r=t.lookup(e[1]);if(!r||a(r)&&0===r.length)return this.renderTokens(e[4],t,n,i)},f.prototype.renderPartial=function(e,t,a){if(a){var i=n(a)?a(e[1]):a[e[1]];return null!=i?this.renderTokens(this.parse(i),t,a,i):void 0}},f.prototype.unescapedValue=function(e,t){var a=t.lookup(e[1]);if(null!=a)return a},f.prototype.escapedValue=function(t,a){var n=a.lookup(t[1]);if(null!=n)return e.escape(n)},f.prototype.rawValue=function(e){return e[1]},e.name="mustache.js",e.version="2.3.2",e.tags=["{{","}}"];var y=new f;return e.clearCache=function(){return y.clearCache()},e.parse=function(e,t){return y.parse(e,t)},e.render=function(e,t,n){if("string"!=typeof e)throw new TypeError('Invalid template! Template should be a "string" but "'+(a(i=e)?"array":typeof i)+'" was given as the first argument for mustache#render(template, view, partials)');var i;return y.render(e,t,n)},e.to_html=function(t,a,i,r){var s=e.render(t,a,i);if(!n(r))return s;r(s)},e.escape=function(e){return String(e).replace(/[&<>"'`=\/]/g,(function(e){return l[e]}))},e.Scanner=b,e.Context=g,e.Writer=f,e},t&&"string"!=typeof t.nodeName?s(t):(i=[t],void 0===(r="function"==typeof(n=s)?n.apply(t,i):n)||(e.exports=r))},function(e,t,a){"use strict";a.d(t,"c",(function(){return d})),a.d(t,"b",(function(){return p})),a.d(t,"a",(function(){return m}));var n=a(2),i=a(45),r=a(103),s=a(163),o=a(173),l=a(245),c=a(1426),u=a(4);function d(e){return Object(r.useSelector)((t=>e(t[o.u][o.v])))}function p(e){const t=d(c.c),a=Object(i.useHistory)(),r=d(c.j),{state:o}=Object(i.useLocation)(),u=Object(n.useCallback)((a=>e===s.n?Object(l.k)(r,{...t,...a}):e===s.f?Object(l.l)(r,{...t,...a}):e===s.c?Object(l.i)(r,{...t,...a}):Object(l.m)(r,{...t,...a})),[e,t,r]);return Object(n.useCallback)((e=>a.push(u(e),o)),[u,a,o])}const m=()=>window.location.pathname.includes(u.Vb)&&window.location.pathname.includes("/settings")},function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"b",(function(){return o}));var n=a(120),i=a(163);const r=n.b.ENDPOINT_BLOCKLISTS,s={name:i.d,namespace_type:"agnostic",description:i.b,list_id:i.c,type:r},o=["name","description","item_id","entries.value","entries.entries.value","comments.comment"]},function(e,t,a){"use strict";a.d(t,"b",(function(){return fn})),a.d(t,"a",(function(){return yn}));var n=a(2),i=a.n(n),r=a(171),s=a(1069),o=a(261),l=a(144),c=a(41),u=a.n(c),d=a(40),p=(a(21),a(220)),m=a(8),b=a(952),g=a(42),f=a(247),y=a(115),h=a(165),v=a(188),E=a(906),x=a(217),j=a(289);const S=()=>{const{closeFlyout:e}=Object(r.c)(),{eventId:t,browserFields:a,dataFormattedForFieldBrowser:s,scopeId:o}=Object(l.b)(),c=Object(n.useMemo)((()=>{const e=Object(g.find)({field:v.o,category:"kibana"},s);return e&&Object(x.b)({eventId:t,contextId:o,scopeId:o,browserFields:a||{},item:e})}),[a,s,t,o]);return c&&(u=c)&&Array.isArray(u.values)?i.a.createElement(h.c,{data:{field:v.o,value:c.values[0]},mode:f.b.HOVER_RIGHT,triggerId:j.b.DEFAULT,visibleCellActions:5,sourcererScopeId:Object(y.getSourcererScopeId)(o),metadata:{scopeId:o}},i.a.createElement(E.a,{eventId:t,contextId:o,enrichedFieldInfo:c,scopeId:o,handleOnEventClosed:e})):null;var u};S.displayName="DocumentStatus";var k=a(309),O=a(476),w=a(155),T=a(1063);const I=()=>({promptContextId:void 0});var C=a(129),M=a(5);const _=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.expandDetailButton",{defaultMessage:"Expand details"}),F=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.collapseDetailButton",{defaultMessage:"Collapse details"}),A=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.headerTitle",{defaultMessage:"Event details"}),D=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.severityTitle",{defaultMessage:"Severity"}),N=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.riskScoreTitle",{defaultMessage:"Risk score"}),P=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.ruleSummaryText",{defaultMessage:"Show rule summary"}),R=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.alertReasonDetailsText",{defaultMessage:"Show full reason"}),L=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.aboutTitle",{defaultMessage:"About"}),B=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.ruleDescriptionTitle",{defaultMessage:"Rule description"}),q=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.previewRuleDetailsText",{defaultMessage:"Preview rule details"}),z=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.previewAlertReasonDetailsText",{defaultMessage:"Preview alert reason"}),$=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.documentDescriptionTitle",{defaultMessage:"Document description"}),V=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.alertReasonTitle",{defaultMessage:"Alert reason"}),U=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.documentReasonTitle",{defaultMessage:"Document reason"}),H=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.investigationSectionTitle",{defaultMessage:"Investigation"}),G=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.highlightedFieldsTitle",{defaultMessage:"Highlighted fields"}),Q=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.highlightedFields.fieldColumn",{defaultMessage:"Field"}),W=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.highlightedFields.valueColumn",{defaultMessage:"Value"}),K=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.entitiesTitle",{defaultMessage:"Entities"}),Y=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.entitiesNoDataMessage",{defaultMessage:"Host and user information are unavailable for this alert"}),J=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.threatIntelligenceTitle",{defaultMessage:"Threat intelligence"}),X=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.insightsTitle",{defaultMessage:"Insights"}),Z=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.correlationsTitle",{defaultMessage:"Correlations"}),ee=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.correlations.error",{defaultMessage:"No correlations data available"}),te=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.prevalenceTitle",{defaultMessage:"Prevalence"}),ae=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.prevalenceNoData",{defaultMessage:"No prevalence data available."}),ne=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.overviewTab.threatIntelligence.threatMatch",{defaultMessage:"threat match detected"}),ie=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.overviewTab.threatIntelligence.threatMatches",{defaultMessage:"threat matches detected"}),re=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.overviewTab.threatIntelligence.threatEnrichment",{defaultMessage:"field enriched with threat intelligence"}),se=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.overviewTab.threatIntelligence.threatEnrichments",{defaultMessage:"fields enriched with threat intelligence"}),oe=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.overviewTab.prevalenceRowText",{defaultMessage:"is uncommon"}),le=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.visualizationsTitle",{defaultMessage:"Visualizations"}),ce=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.analyzerPreviewTitle",{defaultMessage:"Analyzer preview"}),ue=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.share",{defaultMessage:"Share Alert"}),de=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.investigationGuideTitle",{defaultMessage:"Investigation guide"}),pe=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.investigationGuideButton",{defaultMessage:"Show investigation guide"}),me=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.investigationGuideNoData",{defaultMessage:"There’s no investigation guide for this rule."}),be=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.sessionPreview.title",{defaultMessage:"Session viewer preview"}),ge=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.sessionPreview.processText",{defaultMessage:"started"}),fe=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.sessionPreview.timeText",{defaultMessage:"at"}),ye=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.sessionPreview.ruleText",{defaultMessage:"with rule"}),he=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.sessionPreview.commandText",{defaultMessage:"by"}),ve=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.responseSectionTitle",{defaultMessage:"Response"}),Ee=M.i18n.translate("xpack.securitySolution.flyout.response.empty",{defaultMessage:"There are no response actions defined for this event."}),xe=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.technicalPreviewTitle",{defaultMessage:"Technical preview"}),je=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.technicalPreviewMessage",{defaultMessage:"This functionality is in technical preview and may be changed or removed completely in a future release. Elastic will take a best effort approach to fix any issues, but features in technical preview are not subject to the support SLA of official GA features."});var Se=a(329),ke=a(191),Oe=a(322);const we=(Oe.c,Oe.a,"securitySolutionDocumentDetailsFlyoutInvestigationSection"),Te=(Oe.c,Oe.a,"securitySolutionDocumentDetailsFlyoutInvestigationGuide"),Ie=`${Te}Button`,Ce=`${Te}Loading`,Me=`${Te}NoData`,_e="securitySolutionDocumentDetailsFlyoutInsightsEntities",Fe=`${_e}NoData`,Ae="securitySolutionDocumentDetailsFlyoutEntitiesUserOverview",De=`${Ae}Link`,Ne=`${Ae}Domain`,Pe=`${Ae}LastSeen`,Re=`${Ae}RiskLevel`,Le="securitySolutionDocumentDetailsFlyoutEntitiesHostOverview",Be=`${Le}Link`,qe=`${Le}OsFamily`,ze=`${Le}LastSeen`,$e=`${Le}RiskLevel`,Ve="securitySolutionDocumentDetailsFlyoutTechnicalPreviewIcon",Ue="securitySolutionDocumentDetailsFlyoutInsightsThreatIntelligence",He="securitySolutionDocumentDetailsFlyoutInsightsCorrelations",Ge="securitySolutionDocumentDetailsFlyoutInsightsPrevalence",Qe="securitySolutionDocumentDetailsAnalyzerPreview",We="securitySolutionDocumentDetailsSessionPreview",Ke=(Oe.c,Oe.a,`${ke.A}Empty`),Ye=e=>"low"===e||"medium"===e||"high"===e||"critical"===e,Je=Object(n.memo)((()=>{const{getFieldsData:e,scopeId:t}=Object(l.b)(),a=e(C.U);if(!a)return null;let n;if("string"==typeof a&&Ye(a))n=a;else{if(!(Array.isArray(a)&&a.length>0&&Ye(a[0])))return null;n=a[0]}return i.a.createElement(d.EuiFlexGroup,{alignItems:"center",direction:"row",gutterSize:"xs"},i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(d.EuiTitle,{size:"xxs","data-test-subj":"securitySolutionAlertDetailsFlyoutHeaderSeverityTitle"},i.a.createElement("h5",null,`${D}:`))),i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(h.c,{data:{field:C.U,value:n},mode:f.b.HOVER_RIGHT,triggerId:j.b.DEFAULT,visibleCellActions:5,sourcererScopeId:Object(y.getSourcererScopeId)(t),metadata:{scopeId:t}},i.a.createElement(Se.a,{value:n}))))}));Je.displayName="DocumentSeverity";const Xe=Object(n.memo)((()=>{const{getFieldsData:e}=Object(l.b)(),t=e(C.q);if(!t)return null;let a;if("string"==typeof t)a=t;else{if(!(Array.isArray(t)&&t.length>0))return null;a=t[0]}return i.a.createElement(d.EuiFlexGroup,{alignItems:"center",direction:"row",gutterSize:"xs"},i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(d.EuiTitle,{size:"xxs","data-test-subj":"securitySolutionAlertDetailsFlyoutHeaderRiskScoreTitle"},i.a.createElement("h5",null,`${N}:`))),i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement("span",{"data-test-subj":"securitySolutionAlertDetailsFlyoutHeaderRiskScoreValue"},a)))}));Xe.displayName="RiskScore";var Ze=a(186),et=a(132),tt=a(1383);const at=({alertUrl:e})=>i.a.createElement(d.EuiCopy,{textToCopy:e},(t=>i.a.createElement(d.EuiButtonEmpty,{onClick:()=>{t();const a=new URLSearchParams(window.location.search),n=`${e}&${tt.a}=${a.get(tt.a)}`;Object(d.copyToClipboard)(n)},iconType:"share","data-test-subj":"securitySolutionAlertDetailsFlyoutHeaderShareButton"},ue)));at.displayName="ShareButton";const nt=Object(n.memo)((({flyoutIsExpandable:e})=>{const{dataFormattedForFieldBrowser:t,eventId:a,indexName:r}=Object(l.b)(),{isAlert:s,ruleName:o,timestamp:c}=Object(Ze.b)(t),u=Object(b.a)({_id:a,_index:r,timestamp:c}),g=s&&u,{showAssistant:f,promptContextId:y}=(({dataFormattedForFieldBrowser:e,isAlert:t})=>{const{hasAssistantPrivilege:a}=Object(k.a)(),i=a?p.j:I,r=Object(n.useCallback)((async()=>Object(O.d)(null!=e?e:[])),[e]),{promptContextId:s}=i(t?"alert":"event",t?w.e:w.i,t?Object(w.d)(w.A):Object(w.h)(w.A),r,null,t?T.a[T.b].suggestedUserPrompt:T.a[T.d].suggestedUserPrompt,t?w.f:w.j);return{showAssistant:a&&null!==s,promptContextId:s||""}})({dataFormattedForFieldBrowser:t,isAlert:s});return i.a.createElement(i.a.Fragment,null,(g||f)&&i.a.createElement(it,{direction:"row",justifyContent:"flexEnd",gutterSize:"none",$_css:e?"-44px":"-28px"},f&&i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(p.g,{conversationId:s?w.e:w.i,promptContextId:y})),g&&i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(at,{alertUrl:u}))),i.a.createElement(d.EuiSpacer,{size:"s"}),i.a.createElement(d.EuiTitle,{size:"s"},i.a.createElement("h4",{"data-test-subj":"securitySolutionDocumentDetailsFlyoutHeaderTitle"},s&&!Object(m.isEmpty)(o)?o:A)),i.a.createElement(d.EuiSpacer,{size:"s"}),i.a.createElement(d.EuiFlexGroup,{direction:"row",gutterSize:s?"m":"none"},i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(S,null)),i.a.createElement(d.EuiFlexItem,{grow:!1},c&&i.a.createElement(et.c,{value:new Date(c)}))),i.a.createElement(d.EuiSpacer,{size:"s"}),i.a.createElement(d.EuiFlexGroup,{direction:"row",gutterSize:"m"},i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(Je,null)),i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(Xe,null))))}));nt.displayName="HeaderTitle";var it=u()(d.EuiFlexGroup).withConfig({displayName:"_StyledEuiFlexGroup",componentId:"sc-1o1gyrb-0"})(["margin-top:",";padding:0 25px;"],(e=>e.$_css)),rt=a(260);const st=Object(n.memo)((()=>{const{closeLeftPanel:e,openLeftPanel:t,panels:a}=Object(r.c)(),s=null!=a.left,{eventId:o,indexName:c,scopeId:u}=Object(l.b)(),p=Object(n.useCallback)((()=>{t({id:rt.d,params:{id:o,indexName:c,scopeId:u}})}),[o,t,c,u]),m=Object(n.useCallback)((()=>e()),[e]);return s?i.a.createElement(d.EuiButtonEmpty,{iconSide:"left",onClick:m,iconType:"arrowEnd","data-test-subj":"securitySolutionDocumentDetailsFlyoutHeaderCollapseDetailButton"},F):i.a.createElement(d.EuiButtonEmpty,{iconSide:"left",onClick:p,iconType:"arrowStart","data-test-subj":"securitySolutionDocumentDetailsFlyoutHeaderExpandDetailButton"},_)}));st.displayName="ExpandDetailButton";const ot=Object(n.memo)((({flyoutIsExpandable:e,selectedTabId:t,setSelectedTabId:a,tabs:n})=>{const r=n.map(((e,n)=>i.a.createElement(d.EuiTab,{onClick:()=>{return t=e.id,a(t);var t},isSelected:e.id===t,key:n,"data-test-subj":e["data-test-subj"]},e.name)));return i.a.createElement(lt,{hasBorder:!0,$_css:e?"-24px":"0px"},e&&i.a.createElement(ct,null,i.a.createElement(st,null)),i.a.createElement(d.EuiSpacer,{size:"xs"}),i.a.createElement(nt,{flyoutIsExpandable:e}),i.a.createElement(d.EuiSpacer,{size:"m"}),i.a.createElement(ut,{size:"l",expand:!0},r))}));ot.displayName="PanelHeader";var lt=u()(d.EuiFlyoutHeader).withConfig({displayName:"_StyledEuiFlyoutHeader",componentId:"sc-12lntih-0"})(["margin-bottom:",";"],(e=>e.$_css)),ct=u()("div").withConfig({displayName:"_StyledDiv",componentId:"sc-12lntih-1"})(["margin-top:-24px;margin-left:-8px;"]),ut=u()(d.EuiTabs).withConfig({displayName:"_StyledEuiTabs",componentId:"sc-12lntih-2"})(["margin-bottom:-25px;"]);const dt=M.i18n.translate("xpack.securitySolution.flyout.documentErrorTitle",{defaultMessage:"document information"}),pt=M.i18n.translate("xpack.securitySolution.flyout.documentErrorMessage",{defaultMessage:"the document fields and values"});var mt=a(202),bt=a(930);const gt=Object(n.memo)((()=>{const{searchHit:e}=Object(l.b)();return e?i.a.createElement(bt.a,{rawEventData:e}):i.a.createElement(d.EuiEmptyPrompt,{iconType:"error",color:"danger",title:i.a.createElement("h2",null,Object(mt.g)(dt)),body:i.a.createElement("p",null,Object(mt.f)(pt)),"data-test-subj":"securitySolutionDocumentDetailsFlyoutJsonTabError"})}));gt.displayName="JsonTab";var ft=a(255);const yt=()=>{var e,t,a,s;const{openLeftPanel:o}=Object(r.c)(),{eventId:c,indexName:u,scopeId:p,searchHit:m}=Object(l.b)(),b=m?Object(ft.a)(m.fields):void 0,g=null==b||null===(e=b.kibana)||void 0===e||null===(t=e.alert)||void 0===t||null===(a=t.rule)||void 0===a||null===(s=a.parameters)||void 0===s?void 0:s[0].response_actions,f=Object(n.useCallback)((()=>{o({id:rt.d,path:{tab:rt.e},params:{id:c,indexName:u,scopeId:p}})}),[c,u,o,p]);return i.a.createElement(i.a.Fragment,null,g?i.a.createElement(d.EuiButton,{onClick:f,iconType:"documentation","data-test-subj":"securitySolutionDocumentDetailsFlyoutResponseButton"},ve):i.a.createElement("div",{"data-test-subj":Ke},Ee))};yt.displayName="ResponseButton";const ht=({expanded:e=!1})=>i.a.createElement(Oe.b,{expanded:e,title:ve,"data-test-subj":"securitySolutionDocumentDetailsFlyoutResponseSection"},i.a.createElement(yt,null));ht.displayName="ResponseSection";var vt=a(1084),Et=a(282),xt=a(889),jt=a(507);const St=({value:e})=>{const{scopeId:t,eventId:a,indexName:s}=Object(l.b)(),{openLeftPanel:o}=Object(r.c)(),c=Object(n.useCallback)((()=>{o({id:rt.d,path:{tab:rt.b,subTab:jt.a},params:{id:a,indexName:s,scopeId:t}})}),[a,s,o,t]);return i.a.createElement(d.EuiLink,{onClick:c,"data-test-subj":"securitySolutionDocumentDetailsFlyoutHighlightedFieldsLinkedCell"},e)},kt=({values:e,field:t})=>i.a.createElement(i.a.Fragment,null,null!=e&&e.map(((e,a)=>i.a.createElement(d.EuiFlexItem,{grow:!1,key:`${a}-${e}`,"data-test-subj":`${e}-securitySolutionDocumentDetailsFlyoutHighlightedFieldsCell`},t===v.g||t===v.p?i.a.createElement(St,{value:e}):t===v.a?i.a.createElement(xt.b,{endpointAgentId:String(null!=e?e:""),"data-test-subj":"securitySolutionDocumentDetailsFlyoutHighlightedFieldsAgentStatusCell"}):i.a.createElement("span",{"data-test-subj":"securitySolutionDocumentDetailsFlyoutHighlightedFieldsBasicCell"},e)))));var Ot=a(1083);const wt=[{field:"field",name:Q,"data-test-subj":"fieldCell",width:"50%"},{field:"description",name:W,"data-test-subj":"valueCell",width:"50%",render:e=>i.a.createElement(h.c,{data:{field:e.field,value:e.values},mode:h.a.HOVER_RIGHT,triggerId:h.d.DEFAULT,visibleCellActions:5,sourcererScopeId:Object(y.getSourcererScopeId)(e.scopeId),metadata:{scopeId:e.scopeId}},i.a.createElement(kt,{values:e.values,field:e.field}))}],Tt=()=>{var e;const{dataFormattedForFieldBrowser:t,scopeId:a}=Object(l.b)(),{ruleId:r}=Object(Ze.b)(t),{rule:s}=Object(Et.a)(r),o=Object(Ot.a)({dataFormattedForFieldBrowser:t,investigationFields:null!==(e=null==s?void 0:s.investigation_fields)&&void 0!==e?e:[]}),c=Object(n.useMemo)((()=>Object(vt.b)(o,a)),[o,a]);return t&&0!==c.length?i.a.createElement(d.EuiFlexGroup,{direction:"column",gutterSize:"s"},i.a.createElement(d.EuiFlexItem,{"data-test-subj":"securitySolutionDocumentDetailsFlyoutHighlightedFieldsTitle"},i.a.createElement(d.EuiTitle,{size:"xxs"},i.a.createElement("h5",null,G))),i.a.createElement(d.EuiFlexItem,{"data-test-subj":"securitySolutionDocumentDetailsFlyoutHighlightedFieldsDetails"},i.a.createElement(d.EuiPanel,{hasBorder:!0,hasShadow:!1},i.a.createElement(d.EuiInMemoryTable,{items:c,columns:wt,compressed:!0})))):null};var It=a(1077);const Ct=()=>{const{openLeftPanel:e}=Object(r.c)(),{eventId:t,indexName:a,scopeId:s,dataFormattedForFieldBrowser:o}=Object(l.b)(),{loading:c,error:u,basicAlertData:p,ruleNote:m}=Object(It.a)({dataFormattedForFieldBrowser:o}),b=Object(n.useCallback)((()=>{e({id:rt.d,path:{tab:rt.c},params:{id:t,indexName:a,scopeId:s}})}),[t,a,e,s]);return!o||u?null:c?i.a.createElement(d.EuiFlexGroup,{justifyContent:"spaceAround","data-test-subj":Ce},i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(d.EuiLoadingSpinner,{size:"m"}))):i.a.createElement(d.EuiFlexGroup,{direction:"column",gutterSize:"s"},i.a.createElement(d.EuiFlexItem,{"data-test-subj":Te},i.a.createElement(d.EuiTitle,{size:"xxs"},i.a.createElement("h5",null,de))),i.a.createElement(d.EuiFlexItem,null,p.ruleId&&m?i.a.createElement(d.EuiButton,{onClick:b,iconType:"documentation","data-test-subj":Ie},pe):i.a.createElement("div",{"data-test-subj":Me},me)))};Ct.displayName="InvestigationGuideButton";const Mt=({expanded:e=!0})=>i.a.createElement(Oe.b,{expanded:e,title:H,"data-test-subj":we},i.a.createElement(Ct,null),i.a.createElement(d.EuiSpacer,{size:"m"}),i.a.createElement(Tt,null));Mt.displayName="InvestigationSection";var _t=a(1057);const Ft=()=>{const{dataFormattedForFieldBrowser:e,scopeId:t,eventId:a,indexName:s}=Object(l.b)(),{isAlert:o,ruleDescription:c,ruleName:u,ruleId:p}=Object(Ze.b)(e),{openPreviewPanel:b}=Object(r.c)(),g=Object(n.useCallback)((()=>{const e={tab:_t.d};b({id:_t.c,path:e,params:{id:a,indexName:s,scopeId:t,banner:{title:q,backgroundColor:"warning",textColor:"warning"},ruleId:p}})}),[a,b,s,t,p]),f=Object(n.useMemo)((()=>!Object(m.isEmpty)(u)&&!Object(m.isEmpty)(p)&&i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(d.EuiButtonEmpty,{size:"s",iconType:"expand",onClick:g,iconSide:"right","data-test-subj":"securitySolutionDocumentDetailsFlyoutRuleSummaryButton"},P))),[u,g,p]);if(!e)return null;const y=c&&c.length>0;return i.a.createElement(d.EuiFlexGroup,{direction:"column",gutterSize:"s"},i.a.createElement(d.EuiFlexItem,{"data-test-subj":"securitySolutionDocumentDetailsFlyoutDescriptionTitle"},i.a.createElement(d.EuiTitle,{size:"xxs"},o?i.a.createElement(d.EuiFlexGroup,{justifyContent:"spaceBetween",alignItems:"center"},i.a.createElement(d.EuiFlexItem,null,i.a.createElement("h5",null,B)),f):i.a.createElement("h5",null,$))),i.a.createElement(d.EuiFlexItem,{"data-test-subj":"securitySolutionDocumentDetailsFlyoutDescriptionDetails"},y?c:"-"))};Ft.displayName="Description";const At=()=>{const{eventId:e,indexName:t,scopeId:a,dataFormattedForFieldBrowser:s,getFieldsData:c}=Object(l.b)(),{isAlert:u}=Object(Ze.b)(s),p=Object(o.a)(c(C.p)),{openPreviewPanel:m}=Object(r.c)(),b=Object(n.useCallback)((()=>{m({id:_t.c,path:{tab:_t.a},params:{id:e,indexName:t,scopeId:a,banner:{title:z,backgroundColor:"warning",textColor:"warning"}}})}),[e,m,t,a]),g=Object(n.useMemo)((()=>i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(d.EuiButtonEmpty,{size:"s",iconType:"expand",onClick:b,iconSide:"right","data-test-subj":"securitySolutionDocumentDetailsFlyoutReasonDetailsPreviewButton"},R))),[b]);return s?i.a.createElement(d.EuiFlexGroup,{direction:"column",gutterSize:"s"},i.a.createElement(d.EuiFlexItem,{"data-test-subj":"securitySolutionDocumentDetailsFlyoutReasonTitle"},i.a.createElement(d.EuiTitle,{size:"xxs"},i.a.createElement("h5",null,u?i.a.createElement(d.EuiFlexGroup,{justifyContent:"spaceBetween",alignItems:"center"},i.a.createElement(d.EuiFlexItem,null,i.a.createElement("h5",null,V)),g):U))),i.a.createElement(d.EuiFlexItem,{"data-test-subj":"securitySolutionDocumentDetailsFlyoutReasonDetails"},p)):null};At.displayName="Reason";var Dt=a(929);const Nt=()=>{const{searchHit:e}=Object(l.b)(),t=Object(n.useMemo)((()=>Object(Dt.a)(e)),[e]);return t&&t[0]?i.a.createElement(d.EuiFlexGroup,{direction:"column",gutterSize:"s"},i.a.createElement(d.EuiFlexItem,{"data-test-subj":"securitySolutionAlertDetailsFlyoutMitreAttackTitle"},i.a.createElement(d.EuiTitle,{size:"xxs"},i.a.createElement("h5",null,t[0].title))),i.a.createElement(d.EuiFlexItem,{"data-test-subj":"securitySolutionAlertDetailsFlyoutMitreAttackDetails"},t[0].description)):null};Nt.displayName="MitreAttack";const Pt=({expanded:e=!0})=>i.a.createElement(Oe.b,{expanded:e,title:L,"data-test-subj":"securitySolutionDocumentDetailsFlyoutAboutSection"},i.a.createElement(Ft,null),i.a.createElement(d.EuiSpacer,{size:"m"}),i.a.createElement(At,null),i.a.createElement(d.EuiSpacer,{size:"m"}),i.a.createElement(Nt,null));Pt.displayName="AboutSection";var Rt=a(249),Lt=a(1092),Bt=a(1085),qt=a(294);const zt=({loading:e=!1,error:t=!1,icon:a,value:n,text:r,color:s,"data-test-subj":o})=>{const l=`${o}Loading`;if(e)return i.a.createElement(d.EuiSkeletonText,{lines:1,size:"m",isLoading:e,contentAriaLabel:"Loading","data-test-subj":l});if(t)return null;const c=`${o}Icon`,u=`${o}Value`,p=`${o}Color`;return i.a.createElement(d.EuiFlexGroup,{gutterSize:"none",justifyContent:"spaceBetween",alignItems:"center"},i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(d.EuiButtonIcon,{"data-test-subj":c,"aria-label":"entity-icon",color:"text",display:"empty",iconType:a,size:"s"})),i.a.createElement($t,{"data-test-subj":u},n&&i.a.createElement(qt.a,{count:n})," ",r),s&&i.a.createElement(d.EuiFlexItem,{grow:!1,"data-test-subj":p},i.a.createElement(d.EuiHealth,{color:s})))};zt.displayName="InsightsSummaryRow";var $t=u()(d.EuiFlexItem).withConfig({displayName:"_StyledEuiFlexItem",componentId:"sc-d1tnhz-0"})(["word-break:break-word;display:-webkit-box;-webkit-line-clamp:1;-webkit-box-orient:vertical;overflow:hidden;"]);const Vt=({entityId:e,scopeId:t})=>{const{loading:a,error:n,dataCount:r}=Object(Bt.a)({entityId:e,scopeId:t}),s=Object(mt.d)(r);return i.a.createElement(zt,{loading:a,error:n,icon:"warning",value:r,text:s,"data-test-subj":"securitySolutionDocumentDetailsFlyoutInsightsCorrelationsRelatedAlertsBySession",key:`correlation-row-${s}`})};Vt.displayName="RelatedAlertsBySession";var Ut=a(1091),Ht=a(1086);const Gt=({originalEventId:e,scopeId:t})=>{const{loading:a,error:n,dataCount:r}=Object(Ht.a)({originalEventId:e,scopeId:t}),s=Object(mt.c)(r);return i.a.createElement(zt,{loading:a,error:n,icon:"warning",value:r,text:s,"data-test-subj":"securitySolutionDocumentDetailsFlyoutInsightsCorrelationsRelatedAlertsBySameSourceEvent",key:`correlation-row-${s}`})};Gt.displayName="RelatedAlertsBySameSourceEvent";var Qt=a(1093);const Wt=({documentId:e,indices:t,scopeId:a})=>{const{loading:n,error:r,dataCount:s}=Object(Qt.a)({documentId:e,indices:t,scopeId:a}),o=Object(mt.a)(s);return i.a.createElement(zt,{loading:n,error:r,icon:"warning",value:s,text:o,"data-test-subj":"securitySolutionDocumentDetailsFlyoutInsightsCorrelationsRelatedAlertsByAncestry",key:`correlation-row-${o}`})};Wt.displayName="RelatedAlertsByAncestry";var Kt=a(1089),Yt=a(243);const Jt=({alertSuppressionCount:e})=>i.a.createElement(d.EuiFlexGroup,{gutterSize:"s",alignItems:"center"},i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(zt,{loading:!1,error:!1,icon:"layers",value:e,text:Object(mt.e)(e),"data-test-subj":"securitySolutionDocumentDetailsFlyoutInsightsCorrelationsSupressedAlerts",key:"correlation-row-suppressed-alerts"})),i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(d.EuiBetaBadge,{label:Yt.w,size:"s",iconType:"beaker",tooltipContent:je,tooltipPosition:"bottom","data-test-subj":"securitySolutionDocumentDetailsFlyoutSupressedAlertsTechnicalPreview"})));Jt.displayName="SuppressedAlerts";var Xt=a(1090),Zt=a(1087);const ea=({eventId:e})=>{const{loading:t,error:a,dataCount:n}=Object(Zt.a)({eventId:e}),r=Object(mt.b)(n);return i.a.createElement(zt,{loading:t,error:a,icon:"warning",value:n,text:r,"data-test-subj":"securitySolutionDocumentDetailsFlyoutInsightsCorrelationsRelatedCases",key:`correlation-row-${r}`})};ea.displayName="RelatedCases";var ta=a(1088),aa=a(1122);const na=()=>{const{dataAsNestedObject:e,dataFormattedForFieldBrowser:t,eventId:a,indexName:s,getFieldsData:o,scopeId:c}=Object(l.b)(),{openLeftPanel:u}=Object(r.c)(),p=Object(n.useCallback)((()=>{u({id:rt.d,path:{tab:rt.b,subTab:aa.a},params:{id:a,indexName:s,scopeId:c}})}),[a,u,s,c]),{show:m,documentId:b,indices:g}=Object(Kt.a)({getFieldsData:o,dataAsNestedObject:e,dataFormattedForFieldBrowser:t}),{show:f,originalEventId:y}=Object(Ut.a)({getFieldsData:o}),{show:h,entityId:v}=Object(Lt.a)({getFieldsData:o}),E=Object(ta.a)(),{show:x,alertSuppressionCount:j}=Object(Xt.a)({getFieldsData:o}),S=m||f||h||E||x;return i.a.createElement(Rt.a,{header:{title:Z,callback:p,iconType:"arrowStart"},"data-test-subj":He},S?i.a.createElement(d.EuiFlexGroup,{direction:"column",gutterSize:"none"},x&&i.a.createElement(Jt,{alertSuppressionCount:j}),E&&i.a.createElement(ea,{eventId:a}),f&&y&&i.a.createElement(Gt,{originalEventId:y,scopeId:c}),h&&v&&i.a.createElement(Vt,{entityId:v,scopeId:c}),m&&b&&g&&i.a.createElement(Wt,{documentId:b,indices:g,scopeId:c})):i.a.createElement("div",{"data-test-subj":`${He}Error`},ee))};na.displayName="CorrelationsOverview";var ia=a(1127),ra=a(1082);const sa=()=>{const{eventId:e,indexName:t,browserFields:a,dataFormattedForFieldBrowser:s,scopeId:o,investigationFields:c}=Object(l.b)(),{openLeftPanel:u}=Object(r.c)(),p=Object(n.useCallback)((()=>{u({id:rt.d,path:{tab:rt.b,subTab:ra.a},params:{id:e,indexName:t,scopeId:o}})}),[e,u,t,o]),{loading:m,error:b,data:g}=Object(ia.a)({dataFormattedForFieldBrowser:s,investigationFields:c,interval:{from:"now-30d",to:"now"}}),f=Object(n.useMemo)((()=>g.filter((e=>isFinite(e.hostPrevalence)&&e.hostPrevalence>0&&e.hostPrevalence<.1))),[g]);return e&&a&&s?i.a.createElement(Rt.a,{header:{title:te,callback:p,iconType:"arrowStart"},content:{loading:m,error:b},"data-test-subj":Ge},i.a.createElement(d.EuiFlexGroup,{direction:"column",gutterSize:"none"},f.length>0?f.map((e=>i.a.createElement(zt,{icon:"warning",text:`${e.field}, ${e.values} ${oe}`,"data-test-subj":`${Ge}${e.field}`}))):i.a.createElement("div",{"data-test-subj":`${Ge}Error`},ae))):null};sa.displayName="PrevalenceOverview";var oa=a(336),la=a(509),ca=a(167),ua=a(1129);const da=()=>{const{eventId:e,indexName:t,scopeId:a,dataFormattedForFieldBrowser:s}=Object(l.b)(),{openLeftPanel:o}=Object(r.c)(),c=Object(n.useCallback)((()=>{o({id:rt.d,path:{tab:rt.b,subTab:ua.a},params:{id:e,indexName:t,scopeId:a}})}),[e,o,t,a]),{loading:u,error:p,threatMatchesCount:b,threatEnrichmentsCount:g}=(({dataFormattedForFieldBrowser:e})=>{const{isAlert:t}=Object(Ze.b)(e),a=Object(n.useMemo)((()=>Object(oa.b)(e||[])),[e]),i=Object(n.useMemo)((()=>t?Object(oa.f)(e||[]).map((e=>Object(oa.g)(e))):[]),[e,t]),{result:r,loading:s}=Object(la.c)(a),o=Object(n.useMemo)((()=>s||null==r||!r.enrichments?i:Object(oa.a)([...i,...r.enrichments])),[s,r,i]),{[ca.c.IndicatorMatchRule]:l,[ca.c.InvestigationTime]:c}=Object(m.groupBy)(o,"matched.type");return{loading:s,error:!e,threatMatches:l,threatMatchesCount:(l||[]).length,threatEnrichments:c,threatEnrichmentsCount:(c||[]).length}})({dataFormattedForFieldBrowser:s}),f=!e||!s||p;return i.a.createElement(Rt.a,{header:{title:J,callback:c,iconType:"arrowStart"},"data-test-subj":Ue},i.a.createElement(d.EuiFlexGroup,{direction:"column",gutterSize:"none","data-test-subj":`${Ue}Container`},i.a.createElement(zt,{loading:u,error:f,icon:"warning",value:b,text:b<=1?ne:ie,"data-test-subj":Ue}),i.a.createElement(zt,{loading:u,error:f,icon:"warning",value:g,text:g<=1?re:se,"data-test-subj":Ue})))};da.displayName="ThreatIntelligenceOverview",a(180);var pa=a(393),ma=a(113),ba=a(117),ga=a(224),fa=a(168),ya=a(330),ha=a(212),va=a(116),Ea=a(134),xa=a(284),ja=a(663),Sa=a(926);const ka=({hostName:e})=>{const{eventId:t,indexName:a,scopeId:s}=Object(l.b)(),{openLeftPanel:o}=Object(r.c)(),c=Object(n.useCallback)((()=>{o({id:rt.d,path:{tab:rt.b,subTab:jt.a},params:{id:t,indexName:a,scopeId:s}})}),[t,o,a,s]),{from:u,to:p}=Object(Ea.a)(),{selectedPatterns:m}=Object(va.d)(),b=Object(n.useMemo)((()=>({from:u,to:p})),[u,p]),f=Object(n.useMemo)((()=>e?Object(ma.D)([e]):void 0),[e]),{data:y,isAuthorized:h}=Object(xa.c)({filterQuery:f,riskEntity:ma.w.host,skip:null==e,timerange:b}),[v,{hostDetails:E}]=Object(ja.b)({hostName:e,indexNames:m,startDate:u,endDate:p}),x=Object(n.useMemo)((()=>[{title:Sa.c,description:i.a.createElement(ga.a,{rowItems:Object(g.getOr)([],"host.os.family",E),attrName:"host.os.family",idPrefix:"flyout-host-entity-overview",isDraggable:!1})}]),[E]),j=Object(n.useMemo)((()=>[{title:Sa.k,description:i.a.createElement(pa.a,{indexPatterns:m,field:"host.name",value:e,type:pa.b.LAST_SEEN})}]),[e,m]),{euiTheme:S}=Object(d.useEuiTheme)(),k=Object(d.useEuiFontSize)("xs").fontSize,[O]=Object(n.useMemo)((()=>{const e=y&&y.length>0?y[0]:void 0;return[{title:i.a.createElement(i.a.Fragment,null,Sa.f,i.a.createElement(d.EuiIconTip,{title:xe,size:"m",type:"iInCircle",content:je,position:"bottom",iconProps:{className:"eui-alignTop"},"data-test-subj":Ve})),description:i.a.createElement(i.a.Fragment,null,e?i.a.createElement(ha.b,{severity:e.host.risk.calculated_level}):Object(ba.d)())}]}),[y]);return i.a.createElement(d.EuiFlexGroup,{direction:"column",gutterSize:"s","data-test-subj":Le},i.a.createElement(d.EuiFlexItem,null,i.a.createElement(d.EuiFlexGroup,{gutterSize:"m"},i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(d.EuiIcon,{type:"storage"})),i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(Oa,{"data-test-subj":Be,onClick:c,$_css:k,$_css2:S.font.weight.bold},e)))),i.a.createElement(d.EuiFlexItem,null,i.a.createElement(d.EuiFlexGroup,null,i.a.createElement(d.EuiFlexItem,null,i.a.createElement(ya.a,{dataTestSubj:qe,descriptionList:x})),i.a.createElement(d.EuiFlexItem,null,h?i.a.createElement(fa.d,{"data-test-subj":$e,listItems:[O]}):i.a.createElement(ya.a,{dataTestSubj:ze,descriptionList:j})))))};ka.displayName="HostEntityOverview";var Oa=u()(d.EuiLink).withConfig({displayName:"_StyledEuiLink",componentId:"sc-1176cvl-0"})(["font-size:",";font-weight:",";"],(e=>e.$_css),(e=>e.$_css2)),wa=a(925),Ta=a(386);const Ia=({userName:e})=>{const{eventId:t,indexName:a,scopeId:s}=Object(l.b)(),{openLeftPanel:o}=Object(r.c)(),c=Object(n.useCallback)((()=>{o({id:rt.d,path:{tab:rt.b,subTab:jt.a},params:{id:t,indexName:a,scopeId:s}})}),[t,o,a,s]),{from:u,to:p}=Object(Ea.a)(),{selectedPatterns:m}=Object(va.d)(),b=Object(n.useMemo)((()=>({from:u,to:p})),[u,p]),f=Object(n.useMemo)((()=>e?Object(ma.E)([e]):void 0),[e]),[y,{userDetails:h}]=Object(Ta.b)({endDate:p,userName:e,indexNames:m,startDate:u}),{data:v,isAuthorized:E}=Object(xa.c)({filterQuery:f,riskEntity:ma.w.user,timerange:b}),x=Object(n.useMemo)((()=>[{title:wa.h,description:i.a.createElement(ga.a,{rowItems:Object(g.getOr)([],"user.domain",h),attrName:"domain",idPrefix:"flyout-user-entity-overview",isDraggable:!1})}]),[h]),j=Object(n.useMemo)((()=>[{title:wa.f,description:i.a.createElement(pa.a,{indexPatterns:m,field:"user.name",value:e,type:pa.b.LAST_SEEN})}]),[e,m]),{euiTheme:S}=Object(d.useEuiTheme)(),k=Object(d.useEuiFontSize)("xs").fontSize,[O]=Object(n.useMemo)((()=>{const e=v&&v.length>0?v[0]:void 0;return[{title:i.a.createElement(i.a.Fragment,null,wa.j,i.a.createElement(d.EuiIconTip,{title:xe,size:"m",type:"iInCircle",content:je,position:"bottom",iconProps:{className:"eui-alignTop"},"data-test-subj":Ve})),description:i.a.createElement(i.a.Fragment,null,e?i.a.createElement(ha.b,{severity:e.user.risk.calculated_level}):Object(ba.d)())}]}),[v]);return i.a.createElement(d.EuiFlexGroup,{direction:"column",gutterSize:"s","data-test-subj":Ae},i.a.createElement(d.EuiFlexItem,null,i.a.createElement(d.EuiFlexGroup,{gutterSize:"m"},i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(d.EuiIcon,{type:"user"})),i.a.createElement(d.EuiFlexItem,{grow:!1},i.a.createElement(Ca,{"data-test-subj":De,onClick:c,$_css:k,$_css2:S.font.weight.bold},e)))),i.a.createElement(d.EuiFlexItem,null,i.a.createElement(d.EuiFlexGroup,null,i.a.createElement(d.EuiFlexItem,null,i.a.createElement(ya.a,{dataTestSubj:Ne,descriptionList:x})),i.a.createElement(d.EuiFlexItem,null,E?i.a.createElement(fa.d,{"data-test-subj":Re,listItems:[O]}):i.a.createElement(ya.a,{dataTestSubj:Pe,descriptionList:j})))))};Ia.displayName="UserEntityOverview";var Ca=u()(d.EuiLink).withConfig({displayName:"_StyledEuiLink",componentId:"sc-rt0e8b-0"})(["font-size:",";font-weight:",";"],(e=>e.$_css),(e=>e.$_css2));const Ma=()=>{const{eventId:e,getFieldsData:t,indexName:a,scopeId:s}=Object(l.b)(),{openLeftPanel:c}=Object(r.c)(),u=Object(o.a)(t("host.name")),p=Object(o.a)(t("user.name")),m=Object(n.useCallback)((()=>{c({id:rt.d,path:{tab:rt.b,subTab:jt.a},params:{id:e,indexName:a,scopeId:s}})}),[e,c,a,s]);return e&&a&&s?i.a.createElement(i.a.Fragment,null,i.a.createElement(Rt.a,{header:{title:K,callback:m,iconType:"arrowStart"},"data-test-subj":_e},p||u?i.a.createElement(d.EuiFlexGroup,{direction:"column",gutterSize:"s"},p&&i.a.createElement(d.EuiFlexItem,null,i.a.createElement(Ia,{userName:p})),i.a.createElement(d.EuiSpacer,{size:"s"}),u&&i.a.createElement(d.EuiFlexItem,null,i.a.createElement(ka,{hostName:u}))):i.a.createElement("div",{"data-test-subj":Fe},Y))):null};Ma.displayName="EntitiesOverview";const _a=({expanded:e=!1})=>i.a.createElement(Oe.b,{title:X,expanded:e,"data-test-subj":"securitySolutionDocumentDetailsFlyoutInsights"},i.a.createElement(Ma,null),i.a.createElement(d.EuiSpacer,{size:"s"}),i.a.createElement(da,null),i.a.createElement(d.EuiSpacer,{size:"s"}),i.a.createElement(na,null),i.a.createElement(d.EuiSpacer,{size:"s"}),i.a.createElement(sa,null));_a.displayName="InsightsSection";var Fa=a(103),Aa=a(119),Da=a(44),Na=a(159),Pa=a(500),Ra=a(196),La=a(12),Ba=a(683);const qa=(e,t,a,n,i)=>{const r=e.find((e=>e.id===t.parent));if(i===n&&r)return{id:"ancestor",label:"...",children:[a],isExpanded:!0};if(n<0||i<0||i>=n||!r)return a;const s={id:r.id,label:r.name,children:[a],isExpanded:!0};return qa(e,r,s,n,i+1)},za=(e,t,a,n,i)=>{const r=e.filter((e=>e.parent===t.id));if(i===n&&r.length>0)return[{id:"descendant",label:"...",isExpanded:!1}];if(a<0||n<0||i<0||i>=n||!r||0===r.length)return;const s=[];return r.forEach(((t,r)=>{r<a&&s.push({id:t.id,label:t.name,children:za(e,t,a,n,i+1),isExpanded:!1}),r===a&&s.push({id:"more-child",label:"..."})})),s};var $a=a(366),Va=a(684);const Ua=()=>{var e;const[t,a]=Object(n.useState)({}),{dataFormattedForFieldBrowser:r,scopeId:s}=Object(l.b)(),o=Object(g.find)({category:"kibana",field:$a.a},r),c=o&&Array.isArray(o.values)?o.values[0]:"",u=Object(g.find)({category:"kibana",field:$a.f},r),p=null!==(e=null==u?void 0:u.values)&&void 0!==e?e:[],{statsNodes:m}=Object(Va.a)({isActiveTimeline:Object(y.isActiveTimeline)(s),documentId:c,indices:p});Object(n.useEffect)((()=>{m&&0!==m.length&&a({statsNodes:m})}),[m,a]);const b=Object(n.useMemo)((()=>{var e;return((e,t=3,a=3,n=3)=>{if(0===e.length)return[];const r=e[0],s={id:r.id,label:i.a.createElement("b",{},r.name),children:za(e,r,t,n,0),isExpanded:!0,icon:i.a.createElement(d.EuiToken,{iconType:"tokenConstant"})};return[qa(e,r,s,a,0)]})(null!==(e=t.statsNodes)&&void 0!==e?e:[],3,3,3)}),[t.statsNodes]);return o&&u&&b&&0!==b.length?i.a.createElement("div",{"data-test-subj":Qe},i.a.createElement(d.EuiTreeView,{items:b,display:"compressed","aria-label":ce,showExpansionArrows:!0})):null};Ua.displayName="AnalyzerPreview";const Ha="timeline-1",Ga=()=>{const{dataAsNestedObject:e}=Object(l.b)(),t=Object(Ba.a)(e||void 0),a=Object(Fa.useDispatch)(),{startTransaction:r}=Object(Na.b)(),{investigateInTimelineAlertClick:s}=Object(Pa.a)({ecsRowData:e}),o=Object(n.useCallback)((()=>{s(),r({name:Ra.a.OPEN_ANALYZER});const t=Object(y.getScopedActions)(Ha);t&&e&&a(t.updateGraphEventId({id:Ha,graphEventId:e._id})),a(Object(La.setActiveTabTimeline)({id:Ha,activeTab:Aa.f.graph}))}),[e,a,s,r]);return i.a.createElement(Rt.a,{header:{title:ce,iconType:"timeline",...t&&{callback:o}},"data-test-subj":Qe},t?i.a.createElement(Ua,null):i.a.createElement("div",{"data-test-subj":`${Qe}Error`},i.a.createElement(Da.FormattedMessage,{id:"xpack.securitySolution.flyout.analyzerPreviewError",defaultMessage:"You can only visualize events triggered by hosts configured with the Elastic Defend integration or any {sysmon} data from {winlogbeat}. Refer to {link} for more information.",values:{sysmon:i.a.createElement(d.EuiMark,null,"sysmon"),winlogbeat:i.a.createElement(d.EuiMark,null,"winlogbeat"),link:i.a.createElement(d.EuiLink,{href:"https://www.elastic.co/guide/en/security/current/visual-event-analyzer.html",target:"_blank"},i.a.createElement(Da.FormattedMessage,{id:"xpack.securitySolution.flyout.documentDetails.analyzerPreviewErrorLink",defaultMessage:"Visual event analyzer"}))}})))};Ga.displayName="AnalyzerPreviewContainer";var Qa=a(17);const Wa=e=>{const t=Object(o.a)(e("process.entry_leader.user.name")),a=Object(o.a)(e("process.entry_leader.user.id"));return t||(a?"0"===a?"root":`uid: ${a}`:"unknown")};var Ka=a(1263);const Ya=({text:e,children:t})=>i.a.createElement(i.a.Fragment,null,e&&i.a.createElement(i.a.Fragment,null," ",i.a.createElement("span",null,e)," "),t),Ja=()=>{const{eventId:e,scopeId:t}=Object(l.b)(),{processName:a,userName:r,startAt:s,ruleName:c,ruleId:u,workdir:p,command:m}=(()=>{const{getFieldsData:e}=Object(l.b)();return Object(n.useMemo)((()=>({userName:Wa(e),processName:Object(o.a)(e("process.entry_leader.name")),startAt:Object(o.a)(e("process.entry_leader.start")),ruleName:Object(o.a)(e(C.D)),ruleId:Object(o.a)(e(C.S)),workdir:Object(o.a)(e("process.group_leader.working_directory")),command:Object(o.a)(e("process.command_line"))})),[e])})(),{euiTheme:b}=Object(d.useEuiTheme)(),g=Object(n.useMemo)((()=>({fontWeight:b.font.weight.bold})),[b.font.weight.bold]),f=Object(n.useMemo)((()=>a&&i.a.createElement(Ya,{text:ge},i.a.createElement("span",{style:g},a))),[g,a]),y=Object(n.useMemo)((()=>s&&i.a.createElement(Ya,{text:fe},i.a.createElement(et.c,{value:new Date(s)}))),[s]),h=Object(n.useMemo)((()=>c&&u&&i.a.createElement(Ya,{text:ye},i.a.createElement(Ka.a,{contextId:t,eventId:e,fieldName:v.n,fieldType:"string",isAggregatable:!1,isDraggable:!1,linkValue:u,value:c}))),[c,u,t,e]),E=Object(n.useMemo)((()=>m&&i.a.createElement(Ya,{text:he},i.a.createElement(d.EuiCode,null,p," ",m))),[m,p]);return i.a.createElement(Xa,{"data-test-subj":We},i.a.createElement(Ya,null,i.a.createElement(d.EuiIcon,{type:"user"})," ",i.a.createElement("span",{style:g},r)),f,y,h,E)};var Xa=u()("div").withConfig({displayName:"_StyledDiv",componentId:"sc-1ntbke2-0"})(["line-height:1.5;"]);const Za="timeline-1",en=()=>{const{dataAsNestedObject:e,getFieldsData:t}=Object(l.b)(),a=(({getFieldsData:e})=>{const t=Object(o.a)(e("_id")),a=Object(o.a)(e("kibana.alert.ancestors.index"))||Object(o.a)(e("_index")),n=Object(o.a)(e("process.entry_leader.entity_id")),i=Object(o.a)(e("process.entry_leader.start")),r=Object(o.a)(e("process.entity_id")),s=Object(o.a)(e("kibana.alert.original_time"))||Object(o.a)(e("timestamp"));return a&&n&&i?{index:a,sessionEntityId:n,sessionStartTime:i,...r&&{jumpToEntityId:r},...s&&{jumpToCursor:s},...t&&{investigatedAlertId:t}}:null})({getFieldsData:t}),r=Object(Qa.b)().isEnterprise(),s=a&&r,c=Object(Fa.useDispatch)(),{startTransaction:u}=Object(Na.b)(),p=Object(y.getScopedActions)(Za),{investigateInTimelineAlertClick:m}=Object(Pa.a)({ecsRowData:e}),b=Object(n.useCallback)((()=>{m(),u({name:Ra.a.OPEN_SESSION_VIEW}),null!==a&&(c(Object(La.setActiveTabTimeline)({id:Za,activeTab:Aa.f.session})),p&&c(p.updateSessionViewConfig({id:Za,sessionViewConfig:a})))}),[c,m,p,a,u]),{euiTheme:g}=Object(d.useEuiTheme)(),f=r?a?null:i.a.createElement("div",{"data-test-subj":`${We}Error`},i.a.createElement(Da.FormattedMessage,{id:"xpack.securitySolution.flyout.sessionPreviewError",defaultMessage:"You can only view Linux session details if you’ve enabled the {setting} setting in your Elastic Defend integration policy. Refer to {link} for more information.",values:{setting:i.a.createElement(tn,{$_css:g.font.weight.bold},i.a.createElement(Da.FormattedMessage,{id:"xpack.securitySolution.flyout.documentDetails.sessionPreviewErrorSetting",defaultMessage:"Include session data"})),link:i.a.createElement(d.EuiLink,{href:"https://www.elastic.co/guide/en/security/current/session-view.html#enable-session-view",target:"_blank"},i.a.createElement(Da.FormattedMessage,{id:"xpack.securitySolution.flyout.documentDetails.sessionPreviewErrorLink",defaultMessage:"Enable Session View data"}))}})):i.a.createElement("div",{"data-test-subj":`${We}UpSell`},i.a.createElement(Da.FormattedMessage,{id:"xpack.securitySolution.flyout.sessionPreviewUpsell",defaultMessage:"This feature requires an {subscription}",values:{subscription:i.a.createElement(d.EuiLink,{href:"https://www.elastic.co/pricing/",target:"_blank"},i.a.createElement(Da.FormattedMessage,{id:"xpack.securitySolution.flyout.documentDetails.sessionPreviewUpsellLink",defaultMessage:"Enterprise subscription"}))}}));return i.a.createElement(Rt.a,{header:{title:be,iconType:"timeline",...s&&{callback:b}},"data-test-subj":We},s?i.a.createElement(Ja,null):f)};var tn=u()("span").withConfig({displayName:"_StyledSpan",componentId:"sc-57k4y-0"})(["font-weight:",";"],(e=>e.$_css));const an=({expanded:e=!1})=>i.a.createElement(Oe.b,{expanded:e,title:le,"data-test-subj":"securitySolutionDocumentDetailsVisualizationsTitle"},i.a.createElement(en,null),i.a.createElement(d.EuiSpacer,null),i.a.createElement(Ga,null));an.displayName="VisualizationsSection";const nn=Object(n.memo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(Pt,null),i.a.createElement(d.EuiHorizontalRule,{margin:"l"}),i.a.createElement(Mt,null),i.a.createElement(d.EuiHorizontalRule,{margin:"l"}),i.a.createElement(an,null),i.a.createElement(d.EuiHorizontalRule,{margin:"l"}),i.a.createElement(_a,null),i.a.createElement(d.EuiHorizontalRule,{margin:"l"}),i.a.createElement(ht,null))));nn.displayName="OverviewTab";var rn=a(142),sn=a(948);const on=Object(n.memo)((()=>{const{browserFields:e,dataFormattedForFieldBrowser:t,eventId:a}=Object(l.b)();return e&&a&&t?i.a.createElement(sn.a,{browserFields:e,data:t,eventId:a,isDraggable:!1,timelineTabType:rn.g.query,scopeId:"alert-details-flyout",isReadOnly:!1}):i.a.createElement(d.EuiEmptyPrompt,{iconType:"error",color:"danger",title:i.a.createElement("h2",null,Object(mt.g)(dt)),body:i.a.createElement("p",null,Object(mt.f)(pt)),"data-test-subj":"securitySolutionAlertDetailsFlyoutTableTabError"})}));on.displayName="TableTab";const ln=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.overviewTab",{defaultMessage:"Overview"}),cn=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.tableTab",{defaultMessage:"Table"}),un=M.i18n.translate("xpack.securitySolution.flyout.documentDetails.jsonTab",{defaultMessage:"JSON"}),dn=[{id:"overview","data-test-subj":"securitySolutionDocumentDetailsFlyoutOverviewTab",name:ln,content:i.a.createElement(nn,null)},{id:"table","data-test-subj":"securitySolutionDocumentDetailsFlyoutTableTab",name:cn,content:i.a.createElement(on,null)},{id:"json","data-test-subj":"securitySolutionDocumentDetailsFlyoutJsonTab",name:un,content:i.a.createElement(gt,null)}],pn=({selectedTabId:e,tabs:t})=>{const a=Object(n.useMemo)((()=>{var a;return null===(a=t.find((t=>t.id===e)))||void 0===a?void 0:a.content}),[e,t]);return i.a.createElement(d.EuiFlyoutBody,{"data-test-subj":"securitySolutionDocumentDetailsFlyoutBody"},a)};pn.displayName="PanelContent";var mn=a(867),bn=a(573);const gn=()=>{const{closeFlyout:e,openRightPanel:t}=Object(r.c)(),{eventId:a,indexName:s,dataFormattedForFieldBrowser:o,dataAsNestedObject:c,refetchFlyoutData:u,scopeId:d}=Object(l.b)(),{isHostIsolationPanelOpen:p,showHostIsolationPanel:m}=Object(bn.a)(),b=Object(n.useCallback)((e=>{m(e),t({id:"document-details-isolate-host",params:{id:a,indexName:s,scopeId:d,isolateAction:e}})}),[a,s,t,d,m]);return o&&c?i.a.createElement(mn.b,{detailsData:o,detailsEcsData:c,handleOnEventClosed:e,isHostIsolationPanelOpen:p,isReadOnly:!1,loadingEventDetails:!1,onAddIsolationStatusClick:b,scopeId:d,refetchFlyoutData:u}):null},fn="document-details-right",yn=Object(n.memo)((({path:e})=>{const{openRightPanel:t}=Object(r.c)(),{eventId:a,getFieldsData:c,indexName:u,scopeId:d}=Object(l.b)(),p=Object(o.a)(c("event.kind"))===s.a.signal,m=p?dn:dn.filter((e=>"overview"!==e.id)),b=Object(n.useMemo)((()=>{var t;const a=m[0].id;return e&&null!==(t=m.map((e=>e.id)).find((t=>t===e.tab)))&&void 0!==t?t:a}),[e,m]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(ot,{flyoutIsExpandable:p,tabs:m,selectedTabId:b,setSelectedTabId:e=>{t({id:fn,path:{tab:e},params:{id:a,indexName:u,scopeId:d}})}}),i.a.createElement(pn,{tabs:m,selectedTabId:b}),i.a.createElement(gn,null))}));yn.displayName="RightPanel"},function(e,t,a){"use strict";a.d(t,"a",(function(){return l})),a.d(t,"b",(function(){return c}));var n=a(2),i=a(56);const r="popstate";var s=a(1409),o=a.n(s);const l=a(221).a.eventFlyout,c=()=>{const e=Object(n.useRef)(null),t=Object(n.useCallback)((t=>{var a;t&&(null===(a=e.current)||void 0===a||a.openFlyout(t))}),[e]),a=((e,t,a=!0)=>{Object(n.useEffect)((()=>{const a=new URLSearchParams(window.location.search).get(e);if(!a)return;const n=Object(i.decode)(a);n&&t(n)}),[e,t]);const s=Object(n.useCallback)((t=>{const a=new URLSearchParams(window.location.search);if(t){const n=Object(i.encode)(t);a.set(e,n)}else a.delete(e);const n=a.toString(),r=n.length>0?`?${n}`:"";if(window.location.search===r)return;const s=`${window.location.pathname}${window.location.hash}${r}`;window.history.replaceState({path:s},"",s)}),[e]);return Object(n.useEffect)((()=>{const e=()=>{s(void 0)};return a&&window.addEventListener(r,e),()=>{e(),a&&window.removeEventListener(r,e)}}),[a,s]),s})(l,t),s=Object(n.useCallback)((e=>a(e?{...e,preview:o()(e.preview)}:void 0)),[a]);return[e,s]}},,,,,function(e,t,a){"use strict";a.d(t,"f",(function(){return i})),a.d(t,"g",(function(){return r})),a.d(t,"b",(function(){return s})),a.d(t,"a",(function(){return o})),a.d(t,"d",(function(){return l})),a.d(t,"c",(function(){return c})),a.d(t,"e",(function(){return u})),a.d(t,"i",(function(){return d})),a.d(t,"h",(function(){return p}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.usersTable.title",{defaultMessage:"Users"}),r=n.i18n.translate("xpack.securitySolution.usersTable.userNameTitle",{defaultMessage:"User name"}),s=n.i18n.translate("xpack.securitySolution.usersTable.lastSeenTitle",{defaultMessage:"Last seen"}),o=n.i18n.translate("xpack.securitySolution.usersTable.domainTitle",{defaultMessage:"Domain"}),l=n.i18n.translate("xpack.securitySolution.usersTable.rows",{values:{numRows:5},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),c=n.i18n.translate("xpack.securitySolution.usersTable.rows",{values:{numRows:10},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),u=e=>n.i18n.translate("xpack.securitySolution.usersTable.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {user} other {users}}"}),d=n.i18n.translate("xpack.securitySolution.usersTable.userRiskToolTip",{defaultMessage:"The user's risk score determines its risk classification. Risky users are labeled as critical or high."}),p=n.i18n.translate("xpack.securitySolution.usersTable.riskTitle",{defaultMessage:"User risk classification"})},function(e,t,a){e.exports=a(33)(1220)},,function(e,t,a){"use strict";a.d(t,"f",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"b",(function(){return o})),a.d(t,"e",(function(){return l})),a.d(t,"d",(function(){return c}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.users.pageTitle",{defaultMessage:"Users"}),r=n.i18n.translate("xpack.securitySolution.users.navigation.allUsersTitle",{defaultMessage:"All users"}),s=n.i18n.translate("xpack.securitySolution.users.navigation.authenticationsTitle",{defaultMessage:"Authentications"}),o=n.i18n.translate("xpack.securitySolution.users.navigation.anomaliesTitle",{defaultMessage:"Anomalies"}),l=n.i18n.translate("xpack.securitySolution.users.navigation.riskTitle",{defaultMessage:"User risk"}),c=n.i18n.translate("xpack.securitySolution.users.navigation.eventsTitle",{defaultMessage:"Events"});n.i18n.translate("xpack.securitySolution.users.navigation.userScoreOverTimeTitle",{defaultMessage:"User risk score over time"}),n.i18n.translate("xpack.securitySolution.hosts.navigaton.hostRisk.viewDashboardButtonLabel",{defaultMessage:"View source dashboard"})},function(e,t,a){"use strict";var n=a(1055);a.d(t,"a",(function(){return n.a}))},,,,,function(e,t,a){"use strict";e.exports=function(e,t){return t||(t={}),"string"!=typeof(e=e&&e.__esModule?e.default:e)?e:(/^['"].*['"]$/.test(e)&&(e=e.slice(1,-1)),t.hash&&(e+=t.hash),/["'() \t\n]/.test(e)||t.needQuotes?'"'.concat(e.replace(/"/g,'\\"').replace(/\n/g,"\\n"),'"'):e)}},function(e,t,a){e.exports=a.p+"1cbd62546f764080f7071e03889e9de3.svg"},,,,,,,,,,,function(e,t,a){e.exports=a(33)(3663)},function(e,t,a){var n=a(717),i=a(715),r=a(716),s=a(258),o=a(1389),l=a(1411),c=a(1412),u=a(1413),d=Object.prototype.hasOwnProperty;e.exports=function(e){if(null==e)return!0;if(o(e)&&(s(e)||"string"==typeof e||"function"==typeof e.splice||l(e)||u(e)||r(e)))return!e.length;var t=i(e);if("[object Map]"==t||"[object Set]"==t)return!e.size;if(c(e))return!n(e).length;for(var a in e)if(d.call(e,a))return!1;return!0}},function(e,t,a){e.exports=a(33)(1216)},function(e,t,a){e.exports=a(33)(1219)},function(e,t,a){e.exports=a(33)(1610)},function(e,t,a){e.exports=a(33)(169)},,,,,function(e,t,a){"use strict";e.exports=a(1420)},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(1421);a(104),a(2),a(1115),a(21),a(406),a(405),a(1116);var i=n.default.bind();["a","abbr","address","area","article","aside","audio","b","base","bdi","bdo","big","blockquote","body","br","button","canvas","caption","cite","code","col","colgroup","data","datalist","dd","del","details","dfn","dialog","div","dl","dt","em","embed","fieldset","figcaption","figure","footer","form","h1","h2","h3","h4","h5","h6","head","header","hgroup","hr","html","i","iframe","img","input","ins","kbd","keygen","label","legend","li","link","main","map","mark","marquee","menu","menuitem","meta","meter","nav","noscript","object","ol","optgroup","option","output","p","param","picture","pre","progress","q","rp","rt","ruby","s","samp","script","section","select","small","source","span","strong","style","sub","summary","sup","table","tbody","td","textarea","tfoot","th","thead","time","title","tr","track","u","ul","var","video","wbr","circle","clipPath","defs","ellipse","foreignObject","g","image","line","linearGradient","mask","path","pattern","polygon","polyline","radialGradient","rect","stop","svg","text","tspan"].forEach((function(e){i[e]=i(e)})),t.default=i},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(104),i=a(2),r=a(1115),s=a(21),o=a(406),l=a(405),c=a(1116);function u(e){return e&&e.__esModule?e:{default:e}}function d(e){if(e&&e.__esModule)return e;var t=Object.create(null);return e&&Object.keys(e).forEach((function(a){if("default"!==a){var n=Object.getOwnPropertyDescriptor(e,a);Object.defineProperty(t,a,n.get?n:{enumerable:!0,get:function(){return e[a]}})}})),t.default=e,Object.freeze(t)}var p=d(i),m=u(r).default,b=function(e){return"theme"!==e},g=function(e){return"string"==typeof e&&e.charCodeAt(0)>96?m:b},f=function(e,t,a){var n;if(t){var i=t.shouldForwardProp;n=e.__emotion_forwardProp&&i?function(t){return e.__emotion_forwardProp(t)&&i(t)}:i}return"function"!=typeof n&&a&&(n=e.__emotion_forwardProp),n},y="undefined"!=typeof document,h=function(e){var t=e.cache,a=e.serialized,n=e.isStringTag;o.registerStyles(t,a,n);var i=c.useInsertionEffectAlwaysWithSyncFallback((function(){return o.insertStyles(t,a,n)}));if(!y&&void 0!==i){for(var r,s=a.name,l=a.next;void 0!==l;)s+=" "+l.name,l=l.next;return p.createElement("style",((r={})["data-emotion"]=t.key+" "+s,r.dangerouslySetInnerHTML={__html:i},r.nonce=t.sheet.nonce,r))}return null};t.default=function e(t,a){var i,r,c=t.__emotion_real===t,u=c&&t.__emotion_base||t;void 0!==a&&(i=a.label,r=a.target);var d=f(t,a,c),m=d||g(u),b=!m("as");return function(){var y=arguments,v=c&&void 0!==t.__emotion_styles?t.__emotion_styles.slice(0):[];if(void 0!==i&&v.push("label:"+i+";"),null==y[0]||void 0===y[0].raw)v.push.apply(v,y);else{v.push(y[0][0]);for(var E=y.length,x=1;x<E;x++)v.push(y[x],y[0][x])}var j=s.withEmotionCache((function(e,t,a){var n=b&&e.as||u,i="",c=[],f=e;if(null==e.theme){for(var y in f={},e)f[y]=e[y];f.theme=p.useContext(s.ThemeContext)}"string"==typeof e.className?i=o.getRegisteredStyles(t.registered,c,e.className):null!=e.className&&(i=e.className+" ");var E=l.serializeStyles(v.concat(c),t.registered,f);i+=t.key+"-"+E.name,void 0!==r&&(i+=" "+r);var x=b&&void 0===d?g(n):m,j={};for(var S in e)b&&"as"===S||x(S)&&(j[S]=e[S]);return j.className=i,j.ref=a,p.createElement(p.Fragment,null,p.createElement(h,{cache:t,serialized:E,isStringTag:"string"==typeof n}),p.createElement(n,j))}));return j.displayName=void 0!==i?i:"Styled("+("string"==typeof u?u:u.displayName||u.name||"Component")+")",j.defaultProps=t.defaultProps,j.__emotion_real=j,j.__emotion_base=u,j.__emotion_styles=v,j.__emotion_forwardProp=d,Object.defineProperty(j,"toString",{value:function(){return"."+r}}),j.withComponent=function(t,i){return e(t,n({},a,i,{shouldForwardProp:f(j,i,!0)})).apply(void 0,v)},j}}},function(e,t,a){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var n=a(703);function i(e){return e&&e.__esModule?e:{default:e}}var r=/^((children|dangerouslySetInnerHTML|key|ref|autoFocus|defaultValue|defaultChecked|innerHTML|suppressContentEditableWarning|suppressHydrationWarning|valueLink|abbr|accept|acceptCharset|accessKey|action|allow|allowUserMedia|allowPaymentRequest|allowFullScreen|allowTransparency|alt|async|autoComplete|autoPlay|capture|cellPadding|cellSpacing|challenge|charSet|checked|cite|classID|className|cols|colSpan|content|contentEditable|contextMenu|controls|controlsList|coords|crossOrigin|data|dateTime|decoding|default|defer|dir|disabled|disablePictureInPicture|download|draggable|encType|enterKeyHint|form|formAction|formEncType|formMethod|formNoValidate|formTarget|frameBorder|headers|height|hidden|high|href|hrefLang|htmlFor|httpEquiv|id|inputMode|integrity|is|keyParams|keyType|kind|label|lang|list|loading|loop|low|marginHeight|marginWidth|max|maxLength|media|mediaGroup|method|min|minLength|multiple|muted|name|nonce|noValidate|open|optimum|pattern|placeholder|playsInline|poster|preload|profile|radioGroup|readOnly|referrerPolicy|rel|required|reversed|role|rows|rowSpan|sandbox|scope|scoped|scrolling|seamless|selected|shape|size|sizes|slot|span|spellCheck|src|srcDoc|srcLang|srcSet|start|step|style|summary|tabIndex|target|title|translate|type|useMap|value|width|wmode|wrap|about|datatype|inlist|prefix|property|resource|typeof|vocab|autoCapitalize|autoCorrect|autoSave|color|incremental|fallback|inert|itemProp|itemScope|itemType|itemID|itemRef|on|option|results|security|unselectable|accentHeight|accumulate|additive|alignmentBaseline|allowReorder|alphabetic|amplitude|arabicForm|ascent|attributeName|attributeType|autoReverse|azimuth|baseFrequency|baselineShift|baseProfile|bbox|begin|bias|by|calcMode|capHeight|clip|clipPathUnits|clipPath|clipRule|colorInterpolation|colorInterpolationFilters|colorProfile|colorRendering|contentScriptType|contentStyleType|cursor|cx|cy|d|decelerate|descent|diffuseConstant|direction|display|divisor|dominantBaseline|dur|dx|dy|edgeMode|elevation|enableBackground|end|exponent|externalResourcesRequired|fill|fillOpacity|fillRule|filter|filterRes|filterUnits|floodColor|floodOpacity|focusable|fontFamily|fontSize|fontSizeAdjust|fontStretch|fontStyle|fontVariant|fontWeight|format|from|fr|fx|fy|g1|g2|glyphName|glyphOrientationHorizontal|glyphOrientationVertical|glyphRef|gradientTransform|gradientUnits|hanging|horizAdvX|horizOriginX|ideographic|imageRendering|in|in2|intercept|k|k1|k2|k3|k4|kernelMatrix|kernelUnitLength|kerning|keyPoints|keySplines|keyTimes|lengthAdjust|letterSpacing|lightingColor|limitingConeAngle|local|markerEnd|markerMid|markerStart|markerHeight|markerUnits|markerWidth|mask|maskContentUnits|maskUnits|mathematical|mode|numOctaves|offset|opacity|operator|order|orient|orientation|origin|overflow|overlinePosition|overlineThickness|panose1|paintOrder|pathLength|patternContentUnits|patternTransform|patternUnits|pointerEvents|points|pointsAtX|pointsAtY|pointsAtZ|preserveAlpha|preserveAspectRatio|primitiveUnits|r|radius|refX|refY|renderingIntent|repeatCount|repeatDur|requiredExtensions|requiredFeatures|restart|result|rotate|rx|ry|scale|seed|shapeRendering|slope|spacing|specularConstant|specularExponent|speed|spreadMethod|startOffset|stdDeviation|stemh|stemv|stitchTiles|stopColor|stopOpacity|strikethroughPosition|strikethroughThickness|string|stroke|strokeDasharray|strokeDashoffset|strokeLinecap|strokeLinejoin|strokeMiterlimit|strokeOpacity|strokeWidth|surfaceScale|systemLanguage|tableValues|targetX|targetY|textAnchor|textDecoration|textRendering|textLength|to|transform|u1|u2|underlinePosition|underlineThickness|unicode|unicodeBidi|unicodeRange|unitsPerEm|vAlphabetic|vHanging|vIdeographic|vMathematical|values|vectorEffect|version|vertAdvY|vertOriginX|vertOriginY|viewBox|viewTarget|visibility|widths|wordSpacing|writingMode|x|xHeight|x1|x2|xChannelSelector|xlinkActuate|xlinkArcrole|xlinkHref|xlinkRole|xlinkShow|xlinkTitle|xlinkType|xmlBase|xmlns|xmlnsXlink|xmlLang|xmlSpace|y|y1|y2|yChannelSelector|z|zoomAndPan|for|class|autofocus)|(([Dd][Aa][Tt][Aa]|[Aa][Rr][Ii][Aa]|x)-.*))$/,s=i(n).default((function(e){return r.test(e)||111===e.charCodeAt(0)&&110===e.charCodeAt(1)&&e.charCodeAt(2)<91}));t.default=s},function(e,t,a){"use strict";function n(e){if(e&&e.__esModule)return e;var t=Object.create(null);return e&&Object.keys(e).forEach((function(a){if("default"!==a){var n=Object.getOwnPropertyDescriptor(e,a);Object.defineProperty(t,a,n.get?n:{enumerable:!0,get:function(){return e[a]}})}})),t.default=e,Object.freeze(t)}Object.defineProperty(t,"__esModule",{value:!0});var i=n(a(2)),r="undefined"!=typeof document,s=!!i.useInsertionEffect&&i.useInsertionEffect,o=r&&s||function(e){return e()},l=s||i.useLayoutEffect;t.useInsertionEffectAlwaysWithSyncFallback=o,t.useInsertionEffectWithLayoutFallback=l},function(e,t,a){"use strict";a.d(t,"h",(function(){return i})),a.d(t,"a",(function(){return r})),a.d(t,"c",(function(){return s})),a.d(t,"g",(function(){return o})),a.d(t,"b",(function(){return l})),a.d(t,"d",(function(){return c})),a.d(t,"e",(function(){return u})),a.d(t,"f",(function(){return d}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.hosts.pageTitle",{defaultMessage:"Hosts"}),r=n.i18n.translate("xpack.securitySolution.hosts.navigation.allHostsTitle",{defaultMessage:"All hosts"}),s=n.i18n.translate("xpack.securitySolution.hosts.navigation.authenticationsTitle",{defaultMessage:"Authentications"}),o=n.i18n.translate("xpack.securitySolution.hosts.navigation.uncommonProcessesTitle",{defaultMessage:"Uncommon processes"}),l=n.i18n.translate("xpack.securitySolution.hosts.navigation.anomaliesTitle",{defaultMessage:"Anomalies"}),c=n.i18n.translate("xpack.securitySolution.hosts.navigation.eventsTitle",{defaultMessage:"Events"}),u=n.i18n.translate("xpack.securitySolution.hosts.navigation.hostRiskTitle",{defaultMessage:"Host risk"}),d=n.i18n.translate("xpack.securitySolution.hosts.navigation.sessionsTitle",{defaultMessage:"Sessions"});n.i18n.translate("xpack.securitySolution.hosts.navigaton.matrixHistogram.errorFetchingEventsData",{defaultMessage:"Failed to query events data"}),n.i18n.translate("xpack.securitySolution.hosts.navigaton.hostRisk.viewDashboardButtonLabel",{defaultMessage:"View source dashboard"})},function(e,t,a){"use strict";a.d(t,"h",(function(){return i})),a.d(t,"d",(function(){return r})),a.d(t,"b",(function(){return s})),a.d(t,"g",(function(){return o})),a.d(t,"f",(function(){return l})),a.d(t,"e",(function(){return c})),a.d(t,"a",(function(){return u})),a.d(t,"c",(function(){return d}));var n=a(5);const i=n.i18n.translate("xpack.securitySolution.network.pageTitle",{defaultMessage:"Network"}),r=n.i18n.translate("xpack.securitySolution.network.navigation.flowsTitle",{defaultMessage:"Flows"}),s=n.i18n.translate("xpack.securitySolution.network.navigation.dnsTitle",{defaultMessage:"DNS"}),o=n.i18n.translate("xpack.securitySolution.network.navigation.usersTitle",{defaultMessage:"Users"}),l=n.i18n.translate("xpack.securitySolution.network.navigation.tlsTitle",{defaultMessage:"TLS"}),c=n.i18n.translate("xpack.securitySolution.network.navigation.httpTitle",{defaultMessage:"HTTP"}),u=n.i18n.translate("xpack.securitySolution.network.navigation.anomaliesTitle",{defaultMessage:"Anomalies"}),d=n.i18n.translate("xpack.securitySolution.network.navigation.eventsTitle",{defaultMessage:"Events"})},function(e,t,a){"use strict";var n=a(960);a.d(t,"a",(function(){return n.a})),a.d(t,"b",(function(){return n.b})),a.d(t,"i",(function(){return n.g})),a.d(t,"j",(function(){return n.i}));var i=a(1053);a.d(t,"c",(function(){return i.a})),a.d(t,"d",(function(){return i.b})),a.d(t,"e",(function(){return i.c})),a.d(t,"f",(function(){return i.d})),a.d(t,"g",(function(){return i.e})),a.d(t,"h",(function(){return i.f}))},,function(e,t,a){"use strict";a.d(t,"a",(function(){return s})),a.d(t,"c",(function(){return o})),a.d(t,"d",(function(){return l})),a.d(t,"e",(function(){return c})),a.d(t,"g",(function(){return u})),a.d(t,"h",(function(){return d})),a.d(t,"b",(function(){return p})),a.d(t,"f",(function(){return m}));var n=a(40),i=a(41),r=a.n(i);const s="siemEventsTable",o=r.a.div.withConfig({displayName:"FullScreenContainer",componentId:"sc-1a6qah7-0"})(["height:",";flex:1 1 auto;display:flex;width:100%;"],(({$isFullScreen:e})=>e?"100%":void 0)),l=r()(n.EuiFlexGroup).withConfig({displayName:"FullWidthFlexGroupTable",componentId:"sc-1a6qah7-1"})(["overflow:hidden;margin:0;display:",";"],(({$visible:e})=>e?"flex":"none")),c=r()(n.EuiFlexItem).withConfig({displayName:"ScrollableFlexItem",componentId:"sc-1a6qah7-2"})(["overflow:auto;"]),u=(r()(n.EuiFlexGroup).withConfig({displayName:"FullWidthFlexGroup",componentId:"sc-1a6qah7-3"})(["overflow:hidden;margin:0;min-height:490px;display:",";"],(({$visible:e=!0})=>e?"flex":"none")),r()(n.EuiFlexGroup).withConfig({displayName:"UpdatedFlexGroup",componentId:"sc-1a6qah7-4"})([""," ",";display:inline-flex;z-index:",";",""],(({$hasRightOffset:e,theme:t,position:a})=>"relative"===a?`margin-right: ${t.eui.euiSizeXS}; margin-left: `:e&&"absolute"===a?`margin-right: ${t.eui.euiSizeXL};`:`margin-right: ${t.eui.euiSizeXS};`),(({position:e})=>"absolute"===e?"position: absolute":"display: flex; justify-content:center; align-items:center"),(({theme:e})=>e.eui.euiZLevel1-3),(({$hasRightOffset:e,theme:t,position:a})=>"relative"===a?"right: 0;":e&&"absolute"===a?`right: ${t.eui.euiSizeXL};`:`right: ${t.eui.euiSizeL};`))),d=r()(n.EuiFlexItem).withConfig({displayName:"UpdatedFlexItem",componentId:"sc-1a6qah7-5"})(["",""],(({$show:e})=>e?"":"visibility: hidden;")),p=r.a.div.attrs((({className:e=""})=>({className:`securitySolutionTimeline__container ${e}`}))).withConfig({displayName:"EventsContainerLoading",componentId:"sc-1a6qah7-6"})(["position:relative;width:100%;overflow:hidden;flex:1;display:flex;flex-direction:column;"]),m=r()(n.EuiPanel).withConfig({displayName:"StyledEuiPanel",componentId:"sc-1a6qah7-7"})(["display:flex;flex-direction:column;position:relative;width:100%;",""],(({$isFullScreen:e})=>e&&"\n    border: 0;\n    box-shadow: none;\n    padding-top: 0;\n    padding-bottom: 0;\n"))},,,,function(e,t,a){"use strict";a.d(t,"b",(function(){return o})),a.d(t,"c",(function(){return b})),a.d(t,"a",(function(){return d}));var n=a(936),i=a(960),r=a(504),s=a(1133);const o=e=>{const t={coreStart:e};return e=>a=>async o=>{a(o),(async({coreStart:e},{dispatch:t,getState:a},o)=>{const l=e.http,c=a();if("userChangedUrl"===o.type&&Object(i.f)(c)&&Object(i.d)(c)){const e=Object(i.i)(c);let a;try{a=(await Object(r.e)(l,e)).item,""===a.inputs[0].config.policy.value.windows.popup.malware.message&&(a.inputs[0].config.policy.value.windows.popup.malware.message=n.a,a.inputs[0].config.policy.value.mac.popup.malware.message=n.a,a.inputs[0].config.policy.value.linux.popup.malware.message=n.a),""===a.inputs[0].config.policy.value.windows.popup.ransomware.message&&(a.inputs[0].config.policy.value.windows.popup.ransomware.message=n.a),""===a.inputs[0].config.policy.value.windows.popup.memory_protection.message&&(a.inputs[0].config.policy.value.windows.popup.memory_protection.message=n.b),""===a.inputs[0].config.policy.value.mac.popup.memory_protection.message&&(a.inputs[0].config.policy.value.mac.popup.memory_protection.message=n.b),""===a.inputs[0].config.policy.value.linux.popup.memory_protection.message&&(a.inputs[0].config.policy.value.linux.popup.memory_protection.message=n.b),""===a.inputs[0].config.policy.value.windows.popup.behavior_protection.message&&(a.inputs[0].config.policy.value.windows.popup.behavior_protection.message=n.b),""===a.inputs[0].config.policy.value.mac.popup.behavior_protection.message&&(a.inputs[0].config.policy.value.mac.popup.behavior_protection.message=n.b),""===a.inputs[0].config.policy.value.linux.popup.behavior_protection.message&&(a.inputs[0].config.policy.value.linux.popup.behavior_protection.message=n.b)}catch(e){return void t({type:"serverFailedToReturnPolicyDetailsData",payload:e.body||e})}if(t({type:"serverReturnedPolicyDetailsData",payload:{policyItem:a}}),a.policy_id){const{results:e}=await Object(r.d)(l,a.policy_id);t({type:"serverReturnedPolicyDetailsAgentSummaryData",payload:{agentStatusSummary:e}})}}else if("userClickedPolicyDetailsSaveButton"===o.type){const{id:e}=Object(i.g)(c),a=Object(i.h)(c);let n;try{n=await Object(r.f)(l,e,a).catch((t=>t.response&&409===t.response.status?Object(r.e)(l,e).then((t=>{const n=t.item;return n.inputs[0].config.policy=a.inputs[0].config.policy,Object(r.f)(l,e,Object(s.a)(n))})):Promise.reject(t)))}catch(e){return void t({type:"serverReturnedPolicyDetailsUpdateFailure",payload:{success:!1,error:e.body||e}})}t({type:"serverReturnedUpdatedPolicyDetailsData",payload:{policyItem:n.item,updateStatus:{success:!0}}})}})(t,e,o)}};var l=a(933),c=a(245),u=a(173);const d=()=>({policyItem:void 0,isLoading:!1,agentStatusSummary:{error:0,events:0,offline:0,online:0,total:0,other:0,all:0,active:0},artifacts:{location:{page:u.b,pageSize:u.c,show:void 0,filter:""}}}),p=(e,t)=>({...e,inputs:e.inputs.map((e=>({...e,config:e.config&&{...e.config,policy:{...e.config.policy,value:t}}})))}),m=(e=d(),t)=>{if("serverReturnedPolicyDetailsData"===t.type||"serverReturnedUpdatedPolicyDetailsData"===t.type)return{...e,...t.payload,isLoading:!1};if("serverFailedToReturnPolicyDetailsData"===t.type)return{...e,isLoading:!1,apiError:t.payload};if("serverReturnedPolicyDetailsAgentSummaryData"===t.type)return{...e,...t.payload};if("serverReturnedPolicyDetailsUpdateFailure"===t.type)return{...e,isLoading:!1,updateStatus:t.payload};if("userClickedPolicyDetailsSaveButton"===t.type)return{...e,isLoading:!0,updateApiError:void 0};if("licenseChanged"===t.type)return{...e,license:t.payload};if("userChangedUrl"===t.type){const a={...e,location:t.payload,artifacts:{...e.artifacts,location:Object(c.b)(Object(l.parse)(t.payload.search.slice(1)))}},n=Object(i.d)(a),r=Object(i.d)(e),s=Object(i.e)(a);return n?r?a:{...a,isLoading:!0}:{...d(),location:t.payload,license:s}}if("userChangedPolicyConfig"===t.type){if(!e.policyItem)return e;const a={...e,policyItem:{...e.policyItem}},n={...Object(i.c)(e)};return a.policyItem.inputs[0].config.policy.value=n,Object.entries(t.payload.policyConfig).forEach((([e,t])=>{n[e]={...n[e],...t}})),a}if("userChangedAntivirusRegistration"===t.type){if(e.policyItem){const a=Object(i.c)(e);return{...e,policyItem:p(e.policyItem,{...a,windows:{...a.windows,antivirus_registration:{enabled:t.payload.enabled}}})}}return e}if("userChangedCredentialHardening"===t.type){if(e.policyItem){const a=Object(i.c)(e);return{...e,policyItem:p(e.policyItem,{...a,windows:{...a.windows,attack_surface_reduction:{credential_hardening:{enabled:t.payload.enabled}}}})}}return e}return e},b=(e=d(),t)=>[m].reduce(((e,a)=>a(e,t)),e)},,function(e,t,a){"use strict";a.d(t,"b",(function(){return g})),a.d(t,"a",(function(){return f}));var n=a(46),i=a(2),r=a(25),s=a(126),o=a(102),l=a(65),c=a(143),u=a(857),d=a(650),p=a(856);const m=["POST",l.EPM_API_ROUTES.BULK_INSTALL_PATTERN],b=["POST",l.EPM_API_ROUTES.INSTALL_FROM_REGISTRY_PATTERN],g=()=>{const e=Object(o.j)(),t=Object(s.a)().endpointPrivileges.canAccessFleet,{mutate:a}=(e=>{const t=Object(d.b)(),a=Object(u.b)(),i=Object(p.b)();return Object(n.useMutation)((e=>Object(c.c)(e)),{...e,mutationKey:m,onSettled:(...e)=>{const n=e[0],s=null==n?void 0:n.items.find((e=>e.name===r.b));s&&"result"in s&&"installed"===s.result.status&&(t(),a(),i())}})})(),{mutate:l}=(e=>{const t=Object(d.b)(),a=Object(u.b)(),i=Object(p.b)();return Object(n.useMutation)((e=>Object(c.o)(e)),{...e,mutationKey:b,onSettled:(...e)=>{const{packageName:n}=e[2];n===r.b&&(t(),a(),i())}})})();Object(i.useEffect)((()=>{t&&(async()=>{var t;await(null===(t=e.services.fleet)||void 0===t?void 0:t.isInitialized());const n=o.b.getKibanaVersion().includes("-SNAPSHOT")||"main"===o.b.getKibanaBranch(),i=o.b.getPrebuiltRulesPackageVersion(),s=["endpoint",r.b];null!=i&&(l({packageName:r.b,packageVersion:i,prerelease:n,force:!0}),s.splice(s.indexOf(r.b),1)),a({packages:s,prerelease:n})})()}),[a,t,e.services.fleet,l])},f=()=>Object(n.useIsMutating)({predicate:({options:{mutationKey:e},state:{variables:t}})=>e===m?t.packages.includes(r.b):e===b&&t.packageName===r.b})>0},,,,,,,function(e,t,a){"use strict";a.d(t,"a",(function(){return j}));var n=a(2),i=a(103),r=a(13),s=a(119),o=a(161),l=a(102),c=a(4),u=a(116),d=a(660),p=a(832),m=a(164),b=a(111),g=a(242),f=a(135),y=a(118),h=a(106),v=a(1045);const{setEventsLoading:E,setSelected:x}=s.h,j=({localFilters:e,tableId:t,from:a,to:j,scopeId:S})=>{const[k,O]=Object(n.useState)(!1),{browserFields:w,dataViewId:T,runtimeMappings:I,indexPattern:C,selectedPatterns:M}=Object(u.d)(S),_=Object(i.useDispatch)(),{uiSettings:F}=Object(l.j)().services,{filters:A,dataTable:{selectAll:D,totalCount:N,sort:P,selectedEventIds:R}=s.q}=Object(i.useSelector)((e=>Object(p.a)(e,t))),L=Object(n.useMemo)((()=>Object(r.getEsQueryConfig)(F)),[F]),B=P.map((({columnId:e,columnType:t,esTypes:a,sortDirection:n})=>({field:e,direction:n,esTypes:null!=a?a:[],type:t}))),q=Object(n.useMemo)((()=>[...e,...A]),[e,A]),z=Object(o.d)({config:L,dataProviders:[],indexPattern:C,filters:q,kqlQuery:{query:"",language:"kuery"},browserFields:w,kqlMode:"filter"}),$=Object(n.useMemo)((()=>z?z.filterQuery:""),[z]),[,,V]=Object(d.b)({dataViewId:T,endDate:j,startDate:a,id:t,fields:["_id","timestamp"],sort:B,indexNames:M,filterQuery:$,runtimeMappings:I,limit:Math.min(c.o,N),timerangeKind:"absolute"});Object(n.useEffect)((()=>{D&&N>c.o?O(!0):O(!1)}),[D,N]);const U=Object(g.a)({timelineId:y.c.active,timelineType:h.l.default}),H=Object(n.useCallback)((e=>_(b.a.updateIsLoading(e))),[_]),G=Object(n.useCallback)((({timeline:e,ruleNote:t,timeline:{filters:n}})=>{var i;U(),H({id:y.c.active,isLoading:!1}),Object(m.b)(_)({duplicate:!0,from:a,id:y.c.active,notes:[],timeline:{...e,indexNames:null!==(i=e.indexNames)&&void 0!==i?i:[],show:!0,filters:n},to:j,ruleNote:t})()}),[_,H,U,a,j]),Q=Object(n.useCallback)((e=>{Object(v.b)(G,e.map((e=>e.ecs)),"KqlFilter"),_(x({id:t,isSelectAllChecked:!1,isSelected:!1,eventIds:R}))}),[_,G,R,t]),W=Object(n.useCallback)(((e,a,n,i)=>{if(!e)return;if(a||D)return t===s.e.alertsOnAlertsPage?n(!0):_(E({id:t,isLoading:!0,eventIds:Object.keys(R)})),void V((e=>{Q(e.events),t===s.e.alertsOnAlertsPage?(n(!1),i()):_(E({id:t,isLoading:!1,eventIds:Object.keys(R)}))}));Q(e),i()}),[_,R,t,V,D,Q]),K=Object(n.useMemo)((()=>k?`${f.D} ( max ${c.o} )`:f.D),[k]);return Object(n.useMemo)((()=>({label:K,key:"add-bulk-to-timeline","data-test-subj":"investigate-bulk-in-timeline",disableOnQuery:k,onClick:W})),[k,K,W])}},function(e,t,a){"use strict";a.d(t,"b",(function(){return c})),a.d(t,"a",(function(){return d}));var n=a(2),i=a.n(n),r=a(40),s=a(1447),o=a(1054),l=a(102);let c;!function(e){e.overview="details",e.activityLog="activity_log"}(c||(c={}));const u=Object(n.memo)((({tab:e,isSelected:t})=>{const{getAppUrl:a}=Object(l.c)(),n=Object(o.a)(e.route);return i.a.createElement(r.EuiTab,{href:a({path:e.route}),onClick:n,isSelected:t,key:e.id,"data-test-subj":`endpoint-details-flyout-tab-${e.id}`},e.name)}));u.displayName="EndpointDetailsTab";const d=Object(n.memo)((({hostname:e,isHostInfoLoading:t,show:a,tabs:o})=>{const l=Object(n.useMemo)((()=>o.find((e=>e.id===a))),[o,a]),c=o.map((e=>i.a.createElement(u,{key:e.id,tab:e,isSelected:e.id===(null==l?void 0:l.id)})));return i.a.createElement(i.a.Fragment,null,i.a.createElement(s.a,{hostname:e,isHostInfoLoading:t,hasBorder:!0},i.a.createElement(r.EuiTabs,{bottomBorder:!1,style:{marginBottom:"-25px"}},c)),i.a.createElement(r.EuiFlyoutBody,{"data-test-subj":`endpoint${"details"===(null==l?void 0:l.id)?"Details":"ActivityLog"}FlyoutBody`},null==l?void 0:l.content))}));d.displayName="EndpointDetailsFlyoutTabs"},,,,,function(e,t,a){"use strict";a.d(t,"a",(function(){return m}));var n=a(2),i=a.n(n),r=a(40),s=a(5),o=a(245),l=a(1054),c=a(884),u=a(527),d=a(323);const p=Object(n.memo)((({endpointId:e})=>{var t;const{getAppUrl:a}=Object(d.a)(),{show:p,...m}=Object(c.b)(u.uiQueryParams),b=Object(n.useMemo)((()=>Object(o.d)({name:"endpointDetails",...m,selected_endpoint:e})),[m,e]),g=Object(l.a)(b),f=Object(n.useMemo)((()=>({title:s.i18n.translate("xpack.securitySolution.endpoint.policyResponse.backLinkTitle",{defaultMessage:"Endpoint details"}),href:a({path:b}),onClick:g})),[g,a,b]);return i.a.createElement("div",null,i.a.createElement(r.EuiButtonEmpty,{flush:"both","data-test-subj":"flyoutSubHeaderBackButton",iconType:"arrowLeft",size:"xs",href:null!==(t=null==f?void 0:f.href)&&void 0!==t?t:"",onClick:null==f?void 0:f.onClick},null==f?void 0:f.title))}));p.displayName="BackToEndpointDetailsFlyoutSubHeader";const m=Object(n.memo)((({children:e,endpointId:t,hasBorder:a=!1,hostname:n,isHostInfoLoading:s})=>i.a.createElement(r.EuiFlyoutHeader,{hasBorder:a},t&&i.a.createElement(p,{endpointId:t}),s?i.a.createElement(r.EuiSkeletonText,{lines:1}):i.a.createElement(r.EuiToolTip,{content:n,anchorClassName:"eui-textTruncate"},i.a.createElement(r.EuiTitle,{size:"s"},i.a.createElement("h2",{style:{overflow:"hidden",textOverflow:"ellipsis"},"data-test-subj":"endpointDetailsFlyoutTitle"},n))),e)));m.displayName="EndpointDetailsFlyoutHeader"},,,,,,,,,function(e,t,a){switch(window.__kbnThemeTag__){case"v8dark":return a(1457);case"v8light":return a(1459)}},function(e,t,a){var n=a(256),i=a(1458);"string"==typeof(i=i.__esModule?i.default:i)&&(i=[[e.i,i,""]]);n(i,{insert:"head",singleton:!1}),e.exports=i.locals||{}},function(e,t,a){(t=a(257)(!1)).push([e.i,'.kbnSolutionNav__flyout{background-color:#141519}.kbnSolutionNav{background:linear-gradient(160deg,#3437414d,#3437414d 32px,#f000 0),linear-gradient(175deg,#3437414d,#3437414d 16px,#f000 0);display:flex;flex-direction:column;height:100%;overflow-x:hidden;overflow-y:auto;scrollbar-color:#98a2b380 #0000;scrollbar-width:thin}.kbnSolutionNav::-webkit-scrollbar{height:16px;width:16px}.kbnSolutionNav::-webkit-scrollbar-thumb{background-clip:content-box;background-color:#98a2b380;border:6px solid #0000;border-radius:16px}.kbnSolutionNav::-webkit-scrollbar-corner,.kbnSolutionNav::-webkit-scrollbar-track{background-color:#0000}.kbnSolutionNav:focus{outline:none}.kbnSolutionNav[tabindex="0"]:focus:focus-visible{outline-style:auto}@media only screen and (min-width:768px) and (max-width:991px){.kbnSolutionNav{padding:24px;width:248px}}@media only screen and (min-width:992px) and (max-width:1199px){.kbnSolutionNav{padding:24px;width:248px}}@media only screen and (min-width:1200px){.kbnSolutionNav{padding:24px;width:248px}}.kbnSolutionNav .kbnSolutionNav__avatar{margin-right:16px}.kbnSolutionNav--hidden{opacity:0;pointer-events:none}@media screen and (prefers-reduced-motion:no-preference){.kbnSolutionNav--hidden{transition:opacity .15s cubic-bezier(.694,.0482,.335,1)}}',""]),e.exports=t},function(e,t,a){var n=a(256),i=a(1460);"string"==typeof(i=i.__esModule?i.default:i)&&(i=[[e.i,i,""]]);n(i,{insert:"head",singleton:!1}),e.exports=i.locals||{}},function(e,t,a){(t=a(257)(!1)).push([e.i,'.kbnSolutionNav__flyout{background-color:#fafbfd}.kbnSolutionNav{background:linear-gradient(160deg,#d3dae64d,#d3dae64d 32px,#f000 0),linear-gradient(175deg,#d3dae64d,#d3dae64d 16px,#f000 0);display:flex;flex-direction:column;height:100%;overflow-x:hidden;overflow-y:auto;scrollbar-color:#69707d80 #0000;scrollbar-width:thin}.kbnSolutionNav::-webkit-scrollbar{height:16px;width:16px}.kbnSolutionNav::-webkit-scrollbar-thumb{background-clip:content-box;background-color:#69707d80;border:6px solid #0000;border-radius:16px}.kbnSolutionNav::-webkit-scrollbar-corner,.kbnSolutionNav::-webkit-scrollbar-track{background-color:#0000}.kbnSolutionNav:focus{outline:none}.kbnSolutionNav[tabindex="0"]:focus:focus-visible{outline-style:auto}@media only screen and (min-width:768px) and (max-width:991px){.kbnSolutionNav{padding:24px;width:248px}}@media only screen and (min-width:992px) and (max-width:1199px){.kbnSolutionNav{padding:24px;width:248px}}@media only screen and (min-width:1200px){.kbnSolutionNav{padding:24px;width:248px}}.kbnSolutionNav .kbnSolutionNav__avatar{margin-right:16px}.kbnSolutionNav--hidden{opacity:0;pointer-events:none}@media screen and (prefers-reduced-motion:no-preference){.kbnSolutionNav--hidden{transition:opacity .15s cubic-bezier(.694,.0482,.335,1)}}',""]),e.exports=t},function(e,t,a){switch(window.__kbnThemeTag__){case"v8dark":return a(1462);case"v8light":return a(1464)}},function(e,t,a){var n=a(256),i=a(1463);"string"==typeof(i=i.__esModule?i.default:i)&&(i=[[e.i,i,""]]);n(i,{insert:"head",singleton:!1}),e.exports=i.locals||{}},function(e,t,a){var n=a(257),i=a(1397),r=a(1398);t=n(!1);var s=i(r);t.push([e.i,".kbnSolutionAvatar{box-shadow:0 .7px 1.4px rgba(0,0,0,.175),0 1.9px 4px rgba(0,0,0,.125),0 4.5px 10px rgba(0,0,0,.125)}.kbnSolutionAvatar--xxl{background:#1d1e24 url("+s+") no-repeat;background-size:cover,125%;border-radius:100px;box-shadow:0 .9px 4px -1px #0003,0 2.6px 8px -1px #00000026,0 5.7px 12px -1px rgba(0,0,0,.125),0 15px 15px -1px #0000001a;display:inline-block;height:100px;line-height:100px;text-align:center;width:100px}",""]),e.exports=t},function(e,t,a){var n=a(256),i=a(1465);"string"==typeof(i=i.__esModule?i.default:i)&&(i=[[e.i,i,""]]);n(i,{insert:"head",singleton:!1}),e.exports=i.locals||{}},function(e,t,a){var n=a(257),i=a(1397),r=a(1398);t=n(!1);var s=i(r);t.push([e.i,".kbnSolutionAvatar{box-shadow:0 .7px 1.4px #00000012,0 1.9px 4px #0000000d,0 4.5px 10px #0000000d}.kbnSolutionAvatar--xxl{background:#fff url("+s+") no-repeat;background-size:cover,125%;border-radius:100px;box-shadow:0 .9px 4px -1px #00000014,0 2.6px 8px -1px #0000000f,0 5.7px 12px -1px #0000000d,0 15px 15px -1px #0000000a;display:inline-block;height:100px;line-height:100px;text-align:center;width:100px}",""]),e.exports=t},function(e,t,a){switch(window.__kbnThemeTag__){case"v8dark":return a(1467);case"v8light":return a(1469)}},function(e,t,a){var n=a(256),i=a(1468);"string"==typeof(i=i.__esModule?i.default:i)&&(i=[[e.i,i,""]]);n(i,{insert:"head",singleton:!1}),e.exports=i.locals||{}},function(e,t,a){(t=a(257)(!1)).push([e.i,".kbnSolutionNavCollapseButton{left:232px;opacity:0;position:absolute;top:24px;z-index:2}@media screen and (prefers-reduced-motion:no-preference){.kbnSolutionNavCollapseButton{transition:opacity .15s,left .15s,background .15s}}.kbnSolutionNavCollapseButton:focus,.kbnSolutionNavCollapseButton:hover{transition-delay:0s!important}.kbnSolutionNavCollapseButton:focus,.kbnSolutionNavCollapseButton:hover,.kbnSolutionNav__sidebar:hover .kbnSolutionNavCollapseButton{left:224px;opacity:1}.kbnSolutionNav__sidebar:hover .kbnSolutionNavCollapseButton{transition-delay:.7s}.kbnSolutionNavCollapseButton:not(.kbnSolutionNavCollapseButton-isCollapsed){background-color:#1d1e24!important}.kbnSolutionNavCollapseButton-isCollapsed{align-items:flex-start;border-radius:0;bottom:0;height:100%;left:0!important;opacity:1!important;padding-top:32px;right:auto;top:0;transition-delay:0s!important;width:40px}",""]),e.exports=t},function(e,t,a){var n=a(256),i=a(1470);"string"==typeof(i=i.__esModule?i.default:i)&&(i=[[e.i,i,""]]);n(i,{insert:"head",singleton:!1}),e.exports=i.locals||{}},function(e,t,a){(t=a(257)(!1)).push([e.i,".kbnSolutionNavCollapseButton{left:232px;opacity:0;position:absolute;top:24px;z-index:2}@media screen and (prefers-reduced-motion:no-preference){.kbnSolutionNavCollapseButton{transition:opacity .15s,left .15s,background .15s}}.kbnSolutionNavCollapseButton:focus,.kbnSolutionNavCollapseButton:hover{transition-delay:0s!important}.kbnSolutionNavCollapseButton:focus,.kbnSolutionNavCollapseButton:hover,.kbnSolutionNav__sidebar:hover .kbnSolutionNavCollapseButton{left:224px;opacity:1}.kbnSolutionNav__sidebar:hover .kbnSolutionNavCollapseButton{transition-delay:.7s}.kbnSolutionNavCollapseButton:not(.kbnSolutionNavCollapseButton-isCollapsed){background-color:#fff!important}.kbnSolutionNavCollapseButton-isCollapsed{align-items:flex-start;border-radius:0;bottom:0;height:100%;left:0!important;opacity:1!important;padding-top:32px;right:auto;top:0;transition-delay:0s!important;width:40px}",""]),e.exports=t},function(e,t,a){e.exports=a.p+"baad30acfe492601d08a0e839c9bb3f5.svg"},,,,,,,,,,,,function(e,t,a){"use strict";a.d(t,"a",(function(){return n}));const n=(e,t,a)=>{const n=t.indexOf(e),i=[...t];n>=0?i.splice(n,1):i.push(e),a(i)}},function(e,t,a){"use strict";a.d(t,"a",(function(){return m}));var n=a(2),i=a.n(n),r=a(103),s=a(171),o=a(119),l=a(58),c=a(4),u=a(1382),d=a(877);const p=({columnHeaders:e,controlColumn:t,data:a,disabled:p,index:m,isEventViewer:b,loadingEventIds:g,onRowSelected:f,onRuleChange:y,pageRowIndex:h,rowIndex:v,selectedEventIds:E,showCheckboxes:x,tabType:j,tableId:S,setEventsLoading:k,setEventsDeleted:O,width:w,refetch:T})=>{const{data:I,ecs:C,_id:M,_index:_}=null!=a?a:{},{openFlyout:F}=Object(s.c)(),A=Object(r.useDispatch)(),[D]=Object(l.useUiSetting$)(c.lb),N=Object(n.useMemo)((()=>I&&e.map((e=>{var t;return null!==(t=Object(d.b)({data:I,fieldName:e.id}))&&void 0!==t?t:[]})).join(" ")),[e,I]),P=Object(n.useCallback)((()=>{const e={panelView:"eventDetail",params:{eventId:null!=M?M:"",indexName:null!=_?_:""}};D&&S!==o.e.rulePreview?F({right:{id:u.b,params:{id:M,indexName:_,scopeId:S}}}):A(o.h.toggleDetailPanel({...e,tabType:j,id:S}))}),[A,M,_,D,F,j,S]),R=t.rowCellRender;return I&&C&&M?i.a.createElement(i.a.Fragment,null,R&&i.a.createElement(R,{ariaRowindex:h+1,checked:Object.keys(E).includes(M),columnId:t.id||"",columnValues:N||"",data:I,"data-test-subj":"actions",disabled:p,ecsData:C,eventId:M,index:m,isEventViewer:b,loadingEventIds:g,onEventDetailsPanelOpened:P,onRowSelected:f,onRuleChange:y,rowIndex:v,showCheckboxes:x,tabType:j,timelineId:S,width:w,setEventsLoading:k,setEventsDeleted:O,refetch:T})):i.a.createElement("span",{"data-test-subj":"noData"})},m=i.a.memo(p)},function(e,t,a){"use strict";var n=a(1118);a.d(t,"a",(function(){return n.a}))},function(e,t,a){"use strict";a.d(t,"a",(function(){return o}));var n=a(2),i=a.n(n),r=a(103),s=a(17);const o=Object(n.memo)((({children:e})=>{const t=Object(r.useDispatch)();return Object(n.useEffect)((()=>{var e;const a=null===(e=s.a.getLicenseInformation$())||void 0===e?void 0:e.subscribe((e=>{t({type:"licenseChanged",payload:e})}));return()=>null==a?void 0:a.unsubscribe()}),[t]),i.a.createElement(i.a.Fragment,null,e)}));o.displayName="CurrentLicense"},,,,,function(e,t,a){"use strict";a.d(t,"a",(function(){return V}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(40),l=a(53),c=a.n(l),u=(a(1456),a(44)),d=a(5),p=(a(1461),a(21));const m=e=>{const{className:t,size:a,...n}=e,r={};return(e=>void 0===e.iconType)(e)&&(r.iconType=`logo${e.name.replace(/\s+/g,"")}`),Object(p.jsx)(o.EuiAvatar,i()({className:c()("kbnSolutionAvatar",{[`kbnSolutionAvatar--${a}`]:a},t),size:"xxl"===a?"xl":a,iconSize:a,color:"plain"},n,r))};a(1466);const b=d.i18n.translate("sharedUXPackages.solutionNav.collapsibleLabel",{defaultMessage:"Collapse side navigation"}),g=d.i18n.translate("sharedUXPackages.solutionNav.openLabel",{defaultMessage:"Open side navigation"}),f=({className:e,isCollapsed:t,...a})=>{const n=c()("kbnSolutionNavCollapseButton",{"kbnSolutionNavCollapseButton-isCollapsed":t},e);return Object(p.jsx)(o.EuiButtonIcon,i()({className:n,size:"s",color:"text",iconType:t?"menuRight":"menuLeft","aria-label":t?g:b,title:t?g:b},a))},y=(e,t)=>e.map((e=>(e.tabIndex=t?-1:void 0,e.items=e.items&&y(e.items,t),e))),h=Object(o.htmlIdGenerator)("SolutionNav"),v=({children:e,headingProps:t,icon:a,isOpenOnDesktop:n=!1,items:l,mobileBreakpoints:b=["xs","s"],closeFlyoutButtonPosition:g="outside",name:v,onCollapse:E,canBeCollapsed:x=!0,...j})=>{const S=Object(o.useIsWithinBreakpoints)(b),k=Object(o.useIsWithinBreakpoints)(["m"]),O=Object(o.useIsWithinMinBreakpoint)("l"),[w,T]=Object(r.useState)(!1),I=O&&!n&&x,C=!!e,M=c()("kbnSolutionNav",{"kbnSolutionNav--hidden":I}),_=(null==t?void 0:t.id)||h("heading"),F=(null==t?void 0:t.element)||"h2",A=Object(p.jsx)(o.EuiTitle,{size:"xs",id:_,"data-test-subj":null==t?void 0:t["data-test-subj"]},Object(p.jsx)(F,null,a&&Object(p.jsx)(m,{className:"kbnSolutionNav__avatar",iconType:a,name:v}),Object(p.jsx)("strong",null,Object(p.jsx)(u.FormattedMessage,{id:"sharedUXPackages.solutionNav.mobileTitleText",defaultMessage:"{solutionName} {menuText}",values:{solutionName:v||"Navigation",menuText:S?d.i18n.translate("sharedUXPackages.solutionNav.menuText",{defaultMessage:"menu"}):""}})))),D=Object(r.useMemo)((()=>C?e:l?Object(p.jsx)(o.EuiSideNav,i()({"aria-labelledby":_,"aria-hidden":I,items:y(l,I),mobileBreakpoints:[]},j)):null),[e,_,C,I,l,j]);return Object(p.jsx)(s.a.Fragment,null,S&&Object(p.jsx)(o.EuiCollapsibleNavGroup,{className:M,paddingSize:"none",background:"none",title:A,titleElement:"span",isCollapsible:x,initialIsOpen:!1},Object(p.jsx)(o.EuiPanel,{color:"transparent",paddingSize:"s"},D)),k&&Object(p.jsx)(s.a.Fragment,null,(w||!x)&&Object(p.jsx)(o.EuiFlyout,{ownFocus:!1,outsideClickCloses:!0,onClose:()=>T(!1),side:"left",size:248,closeButtonPosition:g,className:"kbnSolutionNav__flyout",hideCloseButton:!x},Object(p.jsx)("div",{className:M},A,Object(p.jsx)(o.EuiSpacer,{size:"l"}),D)),x&&Object(p.jsx)(f,{isCollapsed:!0,onClick:()=>{T(!w)}})),O&&Object(p.jsx)(s.a.Fragment,null,Object(p.jsx)("div",{className:M},A,Object(p.jsx)(o.EuiSpacer,{size:"l"}),D),x&&Object(p.jsx)(f,{isCollapsed:!n,onClick:E})))};var E=a(180);const x="solutionNavIsCollapsed",j=e=>{const t=t=>{var a;const n=Object(o.useIsWithinBreakpoints)(["m"]),s=Object(o.useIsWithinMinBreakpoint)("l"),[l,u]=Object(r.useState)(!JSON.parse(String(localStorage.getItem(x)))),{solutionNav:d,children:m,...b}=t,{euiTheme:g}=Object(o.useEuiTheme)(),{canBeCollapsed:f=!0}=d,y=n||f&&s&&!l,h=(e=>Object(E.css)("flex:0 1 0;overflow:hidden;",o.euiCanAnimate,"{transition:min-width ",e.animation.fast," ",e.animation.resistance,";}",""))(g),j=c()({"kbnSolutionNav__sidebar--shrink":y},null===(a=t.pageSideBarProps)||void 0===a?void 0:a.className,h),S=Object(p.jsx)(v,i()({isOpenOnDesktop:l,onCollapse:()=>{u(!l),localStorage.setItem(x,JSON.stringify(l))}},d)),k={paddingSize:"none",...t.pageSideBarProps,minWidth:y?g.size.xxl:void 0,className:j};return Object(p.jsx)(e,i()({},b,{pageSideBar:S,pageSideBarProps:k}),m)};var a;return t.displayName=`WithSolutionNavBar(${a=e,a.displayName||a.name||"UnnamedComponent"})`,t};a(10);const S=s.a.createContext(null),k={name:"36bnqj",styles:"display:flex;flex:1"},O=({children:e,navigateToUrl:t,currentAppId:a})=>{const n=Object(r.useRef)(null),i=Object(r.useCallback)((e=>(({event:e,container:t,navigateToUrl:a,currentAppId:n})=>{if(!t||!n)return;const i=((e,t)=>{let a=e;do{var n,i;if("a"===(null===(n=a)||void 0===n?void 0:n.tagName.toLowerCase()))return a;const e=null===(i=a)||void 0===i?void 0:i.parentElement;if(!e||e===document.body||e===t)break;a=e}while(parent||parent!==document.body||parent!==t)})(e.target,t);if(!i)return;const r=i.href,s=""===i.target||"_self"===i.target,o=0===e.button;r&&s&&o&&!e.defaultPrevented&&!(e=>e.metaKey||e.altKey||e.ctrlKey||e.shiftKey)(e)&&(e.preventDefault(),a(i.href))})({event:e,currentAppId:a,navigateToUrl:t,container:n.current})),[a,t]);return Object(p.jsx)("div",{onClick:i,ref:n,css:k},e)},w=({children:e})=>Object(p.jsx)(O,function(){const e=Object(r.useContext)(S);if(!e)throw new Error("RedirectAppLinksContext is missing.  Ensure your component or React root is wrapped with RedirectAppLinksProvider.");return e}(),e);var T=a(1471),I=a.n(T);const C=d.i18n.translate("sharedUXPackages.card.noData.noPermission.title",{defaultMessage:"Contact your administrator"}),M=d.i18n.translate("sharedUXPackages.card.noData.noPermission.description",{defaultMessage:"This integration is not yet enabled. Your administrator has the required permissions to turn it on."}),_=d.i18n.translate("sharedUXPackages.card.noData.title",{defaultMessage:"Add Elastic Agent"}),F=d.i18n.translate("sharedUXPackages.card.noData.description",{defaultMessage:"Use Elastic Agent for a simple, unified way to collect data from your machines."}),A=()=>Object(p.jsx)(o.EuiImage,{size:"fullWidth",style:{width:"max(100%, 360px)",height:240,objectFit:"cover",background:"aliceblue"},url:I.a,alt:""}),D=({title:e,description:t,canAccessFleet:a,button:n,...r})=>Object(p.jsx)(o.EuiCard,i()({css:{maxWidth:400,marginInline:"auto"},paddingSize:"l",title:a?Object(p.jsx)(o.EuiScreenReaderOnly,null,Object(p.jsx)("span",null,e||_)):Object(p.jsx)(o.EuiTextColor,{color:"default"},C),description:a?t||F:Object(p.jsx)(o.EuiTextColor,{color:"default"},M),footer:(()=>{if(a)return n&&"string"!=typeof n?n:Object(p.jsx)(o.EuiButton,{fill:!0},n||e||_)})(),isDisabled:!a,image:Object(p.jsx)(A,null)},r)),N=s.a.createContext(null),P=({href:e,category:t,description:a,...n})=>{const{canAccessFleet:s,addBasePath:o}=function(){const e=Object(r.useContext)(N);if(!e)throw new Error("NoDataCard Context is missing.  Ensure your component or React root is wrapped with NoDataCardContext.");return e}(),l=Object(r.useMemo)((()=>{if(e)return e;const a="/app/integrations/browse";return o(t?`${a}/${t}`:a)}),[o,e,t]);return Object(p.jsx)(w,null,Object(p.jsx)(D,i()({},n,{href:l,canAccessFleet:s,description:a})))},R=({action:e})=>{const t=Object.keys(e);if(1!==t.length)return null;const a=t[0],n="elasticAgent"===a?"empty-page-agent-action":`empty-page-${a}-action`;return Object(p.jsx)(P,i()({key:n},e[a]))},L=({solution:e,logo:t,action:a,docsLink:n,pageTitle:i,className:r})=>{const s=i||d.i18n.translate("sharedUXPackages.noDataPage.welcomeTitle",{defaultMessage:"Welcome to Elastic {solution}!",values:{solution:e}}),l=Object(p.jsx)(o.EuiLink,{href:n,target:"_blank"},Object(p.jsx)(u.FormattedMessage,{id:"sharedUXPackages.noDataPage.intro.link",defaultMessage:"learn more"})),b=Object(p.jsx)(u.FormattedMessage,{id:"sharedUXPackages.noDataPage.intro",defaultMessage:"Add your data to get started, or {link} about {solution}.",values:{solution:e,link:l}});return Object(p.jsx)(o.EuiPageTemplate.Section,{alignment:"center",grow:!0,className:c()("kbnNoDataPageContents",r),"data-test-subj":"kbnNoDataPage"},Object(p.jsx)(o.EuiText,{textAlign:"center"},Object(p.jsx)(m,{name:e,iconType:t||`logo${e}`,size:"xxl"}),Object(p.jsx)(o.EuiSpacer,{size:"l"}),Object(p.jsx)("h1",null,s),Object(p.jsx)(o.EuiTextColor,{color:"subdued"},Object(p.jsx)("p",null,b))),Object(p.jsx)(o.EuiSpacer,{size:"xxl"}),Object(p.jsx)(R,{action:a}))},B=e=>{const{className:t,noDataConfig:a,pageSideBar:n,pageSideBarProps:r,...s}=e;if(!a)return null;let l;n&&(l=Object(p.jsx)(o.EuiPageTemplate.Sidebar,r,n));const u=((e,t)=>c()("kbnPageTemplate","",t||""))(0,t);return Object(p.jsx)(o.EuiPageTemplate,i()({className:u,restrictWidth:950,panelled:!1,offset:0,minHeight:0},s),l,Object(p.jsx)(L,a))},q=j(B),z=({className:e,pageHeader:t,children:a,isEmptyState:n,pageSideBar:s,pageSideBarProps:l,...u})=>{let d;const[m,b]=Object(r.useState)();if(Object(r.useEffect)((()=>{const e=document.querySelector('[data-test-subj="kibanaChrome"]');if(e){const t=e.querySelector('[data-test-subj="headerGlobalNav"]');b((null==t?void 0:t.offsetTop)+(null==t?void 0:t.offsetHeight))}}),[]),n&&t&&!a){const{iconType:e,pageTitle:n,description:i,rightSideItems:r}=t,s=n?Object(p.jsx)("h1",null,n):void 0,l=i?Object(p.jsx)("p",null,i):void 0;a=Object(p.jsx)(o.EuiPageTemplate.EmptyPrompt,{iconType:e,iconColor:"",title:s,body:l,actions:r})}else t&&(d=Object(p.jsx)(o.EuiPageTemplate.Header,t));let g;if(s){const e={...l};m&&(e.sticky={offset:m}),g=Object(p.jsx)(o.EuiPageTemplate.Sidebar,e,s)}const f=((e,t)=>c()("kbnPageTemplate","",t||""))(0,e);return Object(p.jsx)(o.EuiPageTemplate,i()({className:f,offset:0,minHeight:0},u),g,d,a)},$=j(z),V=Object.assign((({className:e,children:t,solutionNav:a,noDataConfig:n,...r})=>n&&a?Object(p.jsx)(q,{"data-test-subj":r["data-test-subj"],className:e,noDataConfig:n,solutionNav:a}):n?Object(p.jsx)(B,{"data-test-subj":r["data-test-subj"],className:e,noDataConfig:n}):a?Object(p.jsx)($,i()({className:e,solutionNav:a,children:t},r)):Object(p.jsx)(z,i()({className:e,children:t},r))),{Sidebar:o.EuiPageTemplate.Sidebar,Header:o.EuiPageTemplate.Header,Section:o.EuiPageTemplate.Section,BottomBar:o.EuiPageTemplate.BottomBar,EmptyPrompt:o.EuiPageTemplate.EmptyPrompt})},function(e,t,a){"use strict";a.d(t,"a",(function(){return De}));var n=a(104),i=a.n(n),r=a(2),s=a.n(r),o=a(40),l=a(5),c=a(490),u=a(174),d=a(8),p=a(107),m=a(44),b=a(41),g=a.n(b),f=a(347);const y={type:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailType",{defaultMessage:"Type"}),os:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailOS",{defaultMessage:"Operating system"})},h=Object(r.memo)((({children:e,"data-test-subj":t})=>s.a.createElement(o.EuiTitle,{size:"xxs","data-test-subj":t},s.a.createElement("h5",null,e))));h.displayName="SettingCardHeader";const v=Object(r.memo)((({type:e,supportedOss:t,osRestriction:a,dataTestSubj:n,rightCorner:i,children:l})=>{const c=Object(r.useContext)(b.ThemeContext).eui.euiPanelPaddingModifiers.paddingMedium,u=Object(p.a)(n);return s.a.createElement(o.EuiPanel,{"data-test-subj":u(),hasBorder:!0,hasShadow:!1,paddingSize:"none"},s.a.createElement(o.EuiFlexGroup,{direction:"row",gutterSize:"none",alignItems:"center",style:{padding:`${c} ${c} 0 ${c}`}},s.a.createElement(o.EuiFlexItem,{grow:1},s.a.createElement(h,null,y.type),s.a.createElement(o.EuiText,{size:"s","data-test-subj":u("type")},e)),s.a.createElement(o.EuiFlexItem,{grow:2},s.a.createElement(h,null,y.os),s.a.createElement(o.EuiFlexGroup,{direction:"row",gutterSize:"s",alignItems:"center","data-test-subj":u("osValueContainer")},s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiText,{size:"s","data-test-subj":u("osValues")},t.map((e=>f.a[e])).join(", ")," ")),a&&s.a.createElement(o.EuiFlexItem,{grow:!1,"data-test-subj":u("osRestriction")},s.a.createElement(o.EuiFlexGroup,{direction:"row",gutterSize:"xs"},s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiTextColor,{color:"subdued"},s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.details.antivirusRegistration.osRestriction",defaultMessage:"Restrictions"}))),s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiIconTip,{type:"warning",color:"warning",content:a,anchorProps:{"data-test-subj":u("osRestrictionTooltipIcon")}})))))),s.a.createElement(o.EuiShowFor,{sizes:["m","l","xl"]},s.a.createElement(o.EuiFlexItem,{grow:3},s.a.createElement(o.EuiFlexGroup,{direction:"row",gutterSize:"none",justifyContent:"flexEnd"},s.a.createElement(o.EuiFlexItem,{grow:!1,"data-test-subj":u("rightCornerContainer")},i)))),s.a.createElement(o.EuiShowFor,{sizes:i?["s","xs"]:[]},s.a.createElement(o.EuiFlexItem,{"data-test-subj":u("rightCornerContainer")},i))),s.a.createElement(o.EuiHorizontalRule,{margin:"m"}),s.a.createElement("div",{style:{padding:`0 ${c} ${c} ${c}`}},l))}));v.displayName="SettingCard";const E=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.antivirusRegistration.type",{defaultMessage:"Register as antivirus"}),x=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.antivirusRegistration.explanation",{defaultMessage:"Toggle on to register Elastic as an official Antivirus solution for Windows OS. This will also disable Windows Defender."}),j=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.antivirusRegistration.type",{defaultMessage:"Register as antivirus"}),S=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.antivirusRegistration.notRegisteredLabel",{defaultMessage:"Do not register as antivirus"}),k=Object(r.memo)((({policy:e,onChange:t,mode:a,"data-test-subj":n})=>{const i=Object(p.a)(n),m=!Object(c.a)(),b=e.windows.antivirus_registration.enabled,g="edit"===a,f=b?j:S,y=Object(r.useCallback)((a=>{const n=Object(d.cloneDeep)(e);n.windows.antivirus_registration.enabled=a.target.checked,t({isValid:!0,updatedPolicy:n})}),[t,e]);return m?s.a.createElement(v,{type:E,supportedOss:[u.c.WINDOWS],dataTestSubj:i(),osRestriction:l.i18n.translate("xpack.securitySolution.endpoint.policy.details.av.windowsServerNotSupported",{defaultMessage:"Windows Server operating systems unsupported because Antivirus registration requires Windows Security Center, which is not included in Windows Server operating systems."})},g&&s.a.createElement(o.EuiText,{size:"s"},x),s.a.createElement(o.EuiSpacer,{size:"s"}),g?s.a.createElement(o.EuiSwitch,{label:f,checked:b,onChange:y,"data-test-subj":i("switch")}):s.a.createElement("div",{"data-test-subj":i("value")},f)):null}));k.displayName="AntivirusRegistrationCard";var O=a(117),w=a(185);const T={[u.c.WINDOWS]:w.e.windows,[u.c.LINUX]:w.e.linux,[u.c.MAC]:w.e.mac},I=Object(r.memo)((({policy:e,onChange:t,mode:a,os:n,options:i,selection:c,supplementalOptions:u,"data-test-subj":m})=>{const g=Object(p.a)(m),f="edit"===a,y=Object(r.useContext)(b.ThemeContext),E=i.length,x=T[n],j=Object(r.useMemo)((()=>{const e=u?u.map((e=>e.protectionField)):[];return Object.entries(c).filter((([t,a])=>!e.includes(t)&&a)).length}),[c,u]);return s.a.createElement(v,{type:l.i18n.translate("xpack.securitySolution.endpoint.policy.details.eventCollection",{defaultMessage:"Event collection"}),supportedOss:[n],rightCorner:s.a.createElement(o.EuiText,{size:"s",color:"subdued","data-test-subj":g("selectedCount")},l.i18n.translate("xpack.securitySolution.endpoint.policy.details.eventCollectionsEnabled",{defaultMessage:"{selected} / {total} event collections enabled",values:{selected:j,total:E}})),dataTestSubj:g()},s.a.createElement(h,null,l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.eventingEvents",{defaultMessage:"Events"})),s.a.createElement(o.EuiSpacer,{size:"s"}),s.a.createElement("div",{"data-test-subj":g("options")},i.map((({name:n,protectionField:i})=>{const r=`${x}.events.${String(i)}`;return s.a.createElement(C,{label:n,key:r,keyPath:r,policy:e,onChange:t,mode:a,"data-test-subj":g(i)})})),0===j&&!f&&s.a.createElement("div",null,Object(O.e)())),u&&u.map((({title:n,description:i,name:r,uncheckedName:l,protectionField:c,tooltipText:u,beta:p,indented:m,isDisabled:b})=>{const v=`${x}.events.${String(c)}`,E=Object(d.get)(e,v),j=c;return f||E?s.a.createElement("div",{key:String(c),style:m?{paddingLeft:y.eui.euiSizeL}:{},"data-test-subj":g(`${j}Container`)},n&&s.a.createElement(s.a.Fragment,null,s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(h,{"data-test-subj":g(`${j}Title`)},n)),i&&s.a.createElement(s.a.Fragment,null,s.a.createElement(o.EuiSpacer,{size:"s"}),s.a.createElement(o.EuiText,{size:"xs",color:"subdued","data-test-subj":g(`${j}Description`)},i)),s.a.createElement(o.EuiFlexGroup,{direction:"row",gutterSize:"xs",alignItems:"center"},s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiSpacer,{size:"s"}),s.a.createElement(C,{label:r,unCheckedLabel:l,key:v,keyPath:v,policy:e,onChange:t,mode:a,disabled:!!b&&b(e),"data-test-subj":g(j)})),u&&s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiIconTip,{position:"right",content:u,anchorProps:{"data-test-subj":g(`${j}TooltipIcon`)}})),p&&s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiBetaBadge,{label:"beta",size:"s","data-test-subj":g(`${j}Badge`)})))):null})))}));I.displayName="EventCollectionCard";const C=Object(r.memo)((({policy:e,onChange:t,label:a,unCheckedLabel:n,mode:i,keyPath:l,disabled:c,"data-test-subj":u})=>{const p=Object(d.get)(e,l),m="edit"===i,b=p?a:n||a,g=Object(r.useCallback)((a=>{const n=Object(d.cloneDeep)(e);Object(d.set)(n,l,a.target.checked),t({isValid:!0,updatedPolicy:n})}),[l,t,e]);return m?s.a.createElement(o.EuiCheckbox,{key:l,id:l,label:b,"data-test-subj":u,checked:p,onChange:g,disabled:c}):p?s.a.createElement("div",{"data-test-subj":u},b):null}));C.displayName="EventCheckbox";const M=[{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.linux.events.file",{defaultMessage:"File"}),protectionField:"file"},{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.linux.events.network",{defaultMessage:"Network"}),protectionField:"network"},{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.linux.events.process",{defaultMessage:"Process"}),protectionField:"process"}],_=[{id:"sessionDataSection",title:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.linux.events.session_data.title",{defaultMessage:"Session data"}),description:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.linux.events.session_data.description",{defaultMessage:"Turn this on to capture the extended process data required for Session View. Session View provides you a visual representation of session and process execution data. Session View data is organized according to the Linux process model to help you investigate process, user, and service activity on your Linux infrastructure."}),name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.linux.events.session_dataChecked",{defaultMessage:"Collect session data"}),uncheckedName:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.linux.events.session_dataUnChecked",{defaultMessage:"Do not collect session data"}),protectionField:"session_data",isDisabled:e=>!e.linux.events.process},{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.linux.events.tty_ioChecked",{defaultMessage:"Capture terminal output"}),uncheckedName:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.linux.events.tty_ioUnChecked",{defaultMessage:"Do not capture terminal output"}),protectionField:"tty_io",tooltipText:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.linux.events.tty_io.tooltip",{defaultMessage:"Turn this on to collect terminal (tty) output. Terminal output appears in Session View, and you can view it separately to see what commands were executed and how they were typed, provided the terminal is in echo mode. Only works on hosts that support ebpf."}),indented:!0,isDisabled:e=>!e.linux.events.session_data}],F=Object(r.memo)((e=>{const t=Object(r.useMemo)((()=>"edit"===e.mode?_:_.map((e=>"sessionDataSection"===e.id?{...e,description:void 0}:e))),[e.mode]);return s.a.createElement(I,i()({},e,{os:u.c.LINUX,selection:e.policy.linux.events,supplementalOptions:t,options:M}))}));F.displayName="LinuxEventCollectionCard";const A=[{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.mac.events.file",{defaultMessage:"File"}),protectionField:"file"},{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.mac.events.process",{defaultMessage:"Process"}),protectionField:"process"},{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.mac.events.network",{defaultMessage:"Network"}),protectionField:"network"}],D=Object(r.memo)((e=>s.a.createElement(I,i()({},e,{os:u.c.MAC,selection:e.policy.mac.events,options:A}))));D.displayName="MacEventCollectionCard";const N=[{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.windows.events.credentialAccess",{defaultMessage:"Credential Access"}),protectionField:"credential_access"},{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.windows.events.dllDriverLoad",{defaultMessage:"DLL and Driver Load"}),protectionField:"dll_and_driver_load"},{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.windows.events.dns",{defaultMessage:"DNS"}),protectionField:"dns"},{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.windows.events.file",{defaultMessage:"File"}),protectionField:"file"},{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.windows.events.network",{defaultMessage:"Network"}),protectionField:"network"},{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.windows.events.process",{defaultMessage:"Process"}),protectionField:"process"},{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.windows.events.registry",{defaultMessage:"Registry"}),protectionField:"registry"},{name:l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.windows.events.security",{defaultMessage:"Security"}),protectionField:"security"}],P=Object(r.memo)((e=>s.a.createElement(I,i()({},e,{os:u.c.WINDOWS,selection:e.policy.windows.events,options:N}))));P.displayName="WindowsEventCollectionCard";var R=a(17);const L=g.a.div.withConfig({displayName:"LockedPolicyDiv",componentId:"sc-sl8jse-0"})([".euiCard__betaBadgeWrapper{.euiCard__betaBadge{width:auto;}}.lockedCardDescription{padding:0 33.3%;}"]),B=Object(r.memo)((({title:e,"data-test-subj":t})=>{const a=Object(p.a)(t);return s.a.createElement(L,null,s.a.createElement(o.EuiCard,{"data-test-subj":a(),betaBadgeProps:{"data-test-subj":a("badge"),label:l.i18n.translate("xpack.securitySolution.endpoint.policy.details.platinum",{defaultMessage:"Platinum"})},isDisabled:!0,icon:s.a.createElement(o.EuiIcon,{size:"xl",type:"lock"}),title:s.a.createElement("h3",{"data-test-subj":a("title")},s.a.createElement("strong",null,e)),description:!1},s.a.createElement(o.EuiFlexGroup,{className:"lockedCardDescription",direction:"column",gutterSize:"none"},s.a.createElement(o.EuiText,null,s.a.createElement(o.EuiFlexItem,null,s.a.createElement("h4",null,s.a.createElement(o.EuiTextColor,{color:"subdued"},s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.details.upgradeToPlatinum",defaultMessage:"Upgrade to Elastic Platinum"})))),s.a.createElement(o.EuiFlexItem,null,s.a.createElement("p",null,s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.details.lockedCardUpgradeMessage",defaultMessage:"To turn on this protection, you must upgrade your license to Platinum, start a free 30-day trial, or spin up a {cloudDeploymentLink} on AWS, GCP, or Azure.",values:{cloudDeploymentLink:s.a.createElement(o.EuiLink,{href:"https://www.elastic.co/cloud/",target:"_blank","data-test-subj":a("cloudLink")},s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.details.cloudDeploymentLInk",defaultMessage:"cloud deployment"}))}})))))))}));B.displayName="SettingLockedCard";const q=[u.c.WINDOWS],z=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.attack_surface_reduction",{defaultMessage:"Attack Surface Reduction"}),$=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.attackSurfaceReduction.type",{defaultMessage:"Attack surface reduction"}),V=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.credentialHardening.toggleEnabled",{defaultMessage:"Credential hardening enabled"}),U=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.credentialHardening.toggleDisabled",{defaultMessage:"Credential hardening disabled"}),H=Object(r.memo)((({policy:e,onChange:t,mode:a,"data-test-subj":n})=>{const i=Object(R.b)().isPlatinumPlus(),l=Object(p.a)(n),u=!Object(c.a)(),m=e.windows.attack_surface_reduction.credential_hardening.enabled,b="edit"===a,g=m?V:U,f=Object(r.useCallback)((a=>{const n=Object(d.cloneDeep)(e);n.windows.attack_surface_reduction.credential_hardening.enabled=a.target.checked,t({isValid:!0,updatedPolicy:n})}),[t,e]);return u?i?s.a.createElement(v,{type:$,supportedOss:q,dataTestSubj:l()},b?s.a.createElement(o.EuiSwitch,{label:g,checked:m,onChange:f,"data-test-subj":l("enableDisableSwitch")}):s.a.createElement("span",{"data-test-subj":l("valueLabel")},g)):s.a.createElement(B,{title:z,"data-test-subj":l("locked")}):null}));H.displayName="AttackSurfaceReductionCard";var G=a(1046),Q=a(36);const W=Object(r.memo)((({"data-test-subj":e})=>{const t=Object(p.a)(e);return s.a.createElement(o.EuiCallOut,{iconType:"iInCircle","data-test-subj":t()},s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.details.detectionRulesMessage",defaultMessage:"View {detectionRulesLink}. Prebuilt rules are tagged “Elastic” on the Detection Rules page.",values:{detectionRulesLink:s.a.createElement(G.a,{appId:Q.APP_UI_ID,deepLinkId:Q.SecurityPageName.rules,"data-test-subj":t("link")},s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.details.detectionRulesLink",defaultMessage:"related detection rules"}))}}))}));W.displayName="RelatedDetectionRulesCallout";var K=a(102);const Y=l.i18n.translate("xpack.securitySolution.endpoint.policyDetail.useReputationService",{defaultMessage:"Use reputation service"}),J=l.i18n.translate("xpack.securitySolution.endpoint.policyDetail.doNotUseReputationService",{defaultMessage:"Don't use reputation service"}),X=s.a.memo((({policy:e,onChange:t,mode:a,protection:n,"data-test-subj":i})=>{var c;const u="edit"===a,{cloud:b}=Object(K.j)().services,g=null!==(c=null==b?void 0:b.isCloudEnabled)&&void 0!==c&&c,f=Object(p.a)(i),y=e.windows.behavior_protection.mode!==w.f.off,v=e.windows.behavior_protection.reputation_service&&y,E=Object(r.useCallback)((a=>{const n=Object(d.cloneDeep)(e);n.windows.behavior_protection.reputation_service=a.target.checked,n.mac.behavior_protection.reputation_service=a.target.checked,n.linux.behavior_protection.reputation_service=a.target.checked,t({isValid:!0,updatedPolicy:n})}),[e,t]),x=v?Y:J;return g?s.a.createElement("div",{"data-test-subj":f()},s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(h,null,s.a.createElement(o.EuiFlexGroup,{gutterSize:"xs"},s.a.createElement(o.EuiFlexItem,{grow:!1,"data-test-subj":f("label")},s.a.createElement(o.EuiText,{size:"s"},s.a.createElement("h4",null,s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyDetailsConfig.reputationService",defaultMessage:"Reputation service"})))),s.a.createElement(o.EuiFlexItem,{grow:!1,"data-test-subj":f("tooltipIcon")},s.a.createElement(o.EuiIconTip,{position:"right","data-test-subj":f("tooltip"),content:s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyDetailsConfig.reputationServiceTooltip",defaultMessage:"This option enables/disables the Reputation Service feature in Endpoint. When the option is ON, Endpoint will reach out to a Cloud API for additional malware analysis. When it's OFF, Endpoint will not reach out to the Cloud API."})})))),s.a.createElement(o.EuiSpacer,{size:"s"}),u?s.a.createElement(o.EuiCheckbox,{"data-test-subj":f("checkbox"),id:`${n}ReputationServiceCheckbox}`,onChange:E,checked:v,disabled:!y,label:l.i18n.translate("xpack.securitySolution.endpoint.policyDetail.reputationService",{defaultMessage:"Reputation service"})}):s.a.createElement(s.a.Fragment,null,x)):null}));X.displayName="ReputationService";const Z=Object.freeze({malware:"7.11+",ransomware:"7.12+",memory_protection:"7.15+",behavior_protection:"7.15+"}),ee=l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.userNotification",{defaultMessage:"User notification"}),te=l.i18n.translate("xpack.securitySolution.endpoint.policyDetail.notifyUser",{defaultMessage:"Notify user"}),ae=l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.notificationMessage",{defaultMessage:"Notification message"}),ne=l.i18n.translate("xpack.securitySolution.endpoint.policyDetailsConfig.customizeUserNotification",{defaultMessage:"Customize notification message"}),ie=s.a.memo((({policy:e,onChange:t,mode:a,protection:n,osList:i,"data-test-subj":c})=>{const u=Object(R.b)().isPlatinumPlus(),b=Object(p.a)(c),g="edit"===a,f=e.windows[n].mode,y=e.windows.popup[n].enabled,v=e.windows.popup[n].message,E=Object(r.useCallback)((a=>{const r=Object(d.cloneDeep)(e);for(const e of i)("windows"===e||"mac"===e||"linux"===e)&&(r[e].popup[n].enabled=a.target.checked);t({isValid:!0,updatedPolicy:r})}),[e,t,i,n]),x=Object(r.useCallback)((a=>{const r=Object(d.cloneDeep)(e);for(const e of i)("windows"===e||"mac"===e||"linux"===e)&&(r[e].popup[n].message=a.target.value);t({isValid:!0,updatedPolicy:r})}),[e,t,i,n]),j=Object(r.useCallback)((e=>"memory_protection"===e?l.i18n.translate("xpack.securitySolution.endpoint.policyDetail.memoryProtectionTooltip",{defaultMessage:"memory threat"}):"behavior_protection"===e?l.i18n.translate("xpack.securitySolution.endpoint.policyDetail.behaviorProtectionTooltip",{defaultMessage:"malicious behavior"}):e),[]),S=Object(r.useCallback)((e=>"memory_protection"===e||"behavior_protection"===n?l.i18n.translate("xpack.securitySolution.endpoint.policyDetail.rule",{defaultMessage:"rule"}):l.i18n.translate("xpack.securitySolution.endpoint.policyDetail.filename",{defaultMessage:"filename"})),[n]);return u?s.a.createElement("div",{"data-test-subj":b()},s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(h,{"data-test-subj":b("title")},ee),s.a.createElement(re,{protection:n,"data-test-subj":b("supportedVersion")}),s.a.createElement(o.EuiSpacer,{size:"s"}),g?s.a.createElement(o.EuiCheckbox,{"data-test-subj":b("checkbox"),id:`${n}UserNotificationCheckbox}`,onChange:E,checked:y,disabled:!g||f===w.f.off,label:te}):s.a.createElement(s.a.Fragment,null,te),y&&(g?s.a.createElement(s.a.Fragment,null,s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(o.EuiFlexGroup,{gutterSize:"xs"},s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiText,{size:"s","data-test-subj":b("customMessageTitle")},s.a.createElement("h4",null,ne))),s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiIconTip,{position:"right","data-test-subj":b("tooltipInfo"),anchorProps:{"data-test-subj":b("tooltipIcon")},content:s.a.createElement(s.a.Fragment,null,s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyDetailsConfig.notifyUserTooltip.a",defaultMessage:"Selecting the user notification option will display a notification to the host user when { protectionName } is prevented or detected.",values:{protectionName:j(n)}}),s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyDetailsConfig.notifyUserTooltip.c",defaultMessage:" The user notification can be customized in the text box below. Bracketed tags can be used to dynamically populate the applicable action (such as prevented or detected) and the { bracketText }.",values:{bracketText:S(n)}}))}))),s.a.createElement(o.EuiSpacer,{size:"xs"}),s.a.createElement(o.EuiTextArea,{placeholder:l.i18n.translate("xpack.securitySolution.endpoint.policyDetails.userNotification.placeholder",{defaultMessage:"Input your custom notification message"}),value:v,onChange:x,fullWidth:!0,disabled:!g,"data-test-subj":b("customMessage")})):s.a.createElement(s.a.Fragment,null,s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(o.EuiText,{size:"s"},s.a.createElement("h4",null,ae)),s.a.createElement(o.EuiSpacer,{size:"xs"}),s.a.createElement(s.a.Fragment,null,v||Object(O.e)())))):null}));ie.displayName="NotifyUserOption";const re=s.a.memo((({protection:e,"data-test-subj":t})=>{const a=Object(r.useMemo)((()=>Z[e]),[e]);return a?s.a.createElement(o.EuiText,{color:"subdued",size:"xs","data-test-subj":t},s.a.createElement("i",null,s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyDetails.supportedVersion",defaultMessage:"Agent version {version}",values:{version:a}}))):null}));re.displayName="SupportedVersionForProtectionNotice";const se=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.detect",{defaultMessage:"Detect"}),oe=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.prevent",{defaultMessage:"Prevent"}),le=Object(r.memo)((({policy:e,protection:t,osList:a,mode:n,onChange:i,"data-test-subj":l})=>{const c="edit"===n,u=Object(p.a)(l),d=Object(r.useMemo)((()=>[{id:w.f.detect,label:se,flexGrow:1},{id:w.f.prevent,label:oe,flexGrow:5}]),[]),b=Object(r.useMemo)((()=>{const a=d.find((a=>a.id===e.windows[t].mode));return a?a.label:oe}),[e.windows,t,d]);return s.a.createElement("div",{"data-test-subj":u()},s.a.createElement(h,null,s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyDetailsConfig.protectionLevel",defaultMessage:"Protection level"})),s.a.createElement(o.EuiSpacer,{size:"xs"}),s.a.createElement(o.EuiFlexGroup,null,c?d.map((({label:r,id:l,flexGrow:c})=>s.a.createElement(o.EuiFlexItem,{grow:c,key:l},s.a.createElement(ce,{policy:e,onChange:i,mode:n,protection:t,protectionMode:l,osList:a,label:r,"data-test-subj":u(`${l}Radio`)})))):s.a.createElement(s.a.Fragment,null,b)))}));le.displayName="DetectPreventProtectionLevel";const ce=s.a.memo((({protection:e,protectionMode:t,osList:a,label:n,onChange:i,policy:l,mode:c,"data-test-subj":u})=>{const p=l.windows[e].mode,m=Object(R.b)().isPlatinumPlus(),b="edit"===c,g=Object(r.useMemo)((()=>`${a.join("-")}-${e}-${t}`),[a,e,t]),f=Object(r.useCallback)((()=>{const n=Object(d.cloneDeep)(l);for(const i of a)("windows"===i||"mac"===i||"linux"===i)&&(n[i][e].mode=t),m&&("windows"===i||"mac"===i||"linux"===i)&&(t===w.f.prevent?n[i].popup[e].enabled=!0:n[i].popup[e].enabled=!1);i({isValid:!0,updatedPolicy:n})}),[m,i,a,l,e,t]);return s.a.createElement(o.EuiRadio,{label:n,id:g,checked:p===t,onChange:f,disabled:!b||p===w.f.off,"data-test-subj":u})}));ce.displayName="ProtectionRadio";const ue=s.a.memo((({protection:e,protectionLabel:t,osList:a,additionalOnSwitchChange:n,onChange:i,policy:c,mode:u,"data-test-subj":m})=>{const b=Object(p.a)(m),g=Object(R.b)().isPlatinumPlus(),f="edit"===u,y=(c&&c.windows[e].mode)!==w.f.off,h=Object(r.useMemo)((()=>l.i18n.translate("xpack.securitySolution.endpoint.policy.details.protectionsEnabled",{defaultMessage:"{protectionLabel} {mode, select, true {enabled} false {disabled}}",values:{protectionLabel:t,mode:y}})),[t,y]),v=Object(r.useCallback)((t=>{const r=Object(d.cloneDeep)(c);if(!1===t.target.checked)for(const n of a)("windows"===n||"mac"===n||"linux"===n)&&(r[n][e].mode=w.f.off),g&&(("windows"===n||"mac"===n||"linux"===n)&&(r[n].popup[e].enabled=t.target.checked),"behavior_protection"===e&&(r.windows.behavior_protection.reputation_service=!1,r.mac.behavior_protection.reputation_service=!1,r.linux.behavior_protection.reputation_service=!1));else for(const n of a)("windows"===n||"mac"===n||"linux"===n)&&(r[n][e].mode=w.f.prevent),g&&("behavior_protection"===e&&(r.windows.behavior_protection.reputation_service=!0,r.mac.behavior_protection.reputation_service=!0,r.linux.behavior_protection.reputation_service=!0),("windows"===n||"mac"===n||"linux"===n)&&(r[n].popup[e].enabled=t.target.checked));i({isValid:!0,updatedPolicy:n?n({value:t.target.checked,policyConfigData:r,protectionOsList:a}):r})}),[c,i,n,a,g,e]);return f?s.a.createElement(o.EuiSwitch,{label:h,labelProps:{"data-test-subj":b("label")},checked:y,onChange:v,"data-test-subj":b()}):s.a.createElement("span",{"data-test-subj":b()},h)}));ue.displayName="ProtectionSettingCardSwitch";const de=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.behavior",{defaultMessage:"Malicious Behavior"}),pe=[w.e.windows,w.e.mac,w.e.linux],me=Object(r.memo)((({policy:e,onChange:t,mode:a,"data-test-subj":n})=>{const i=Object(R.b)().isPlatinumPlus(),r=Object(p.a)(n),d=!Object(c.a)(),m="behavior_protection",b=l.i18n.translate("xpack.securitySolution.endpoint.policy.protections.behavior",{defaultMessage:"Malicious behavior protections"});return d?i?s.a.createElement(v,{type:l.i18n.translate("xpack.securitySolution.endpoint.policy.details.behavior_protection",{defaultMessage:"Malicious behavior"}),supportedOss:[u.c.WINDOWS,u.c.MAC,u.c.LINUX],dataTestSubj:r(),rightCorner:s.a.createElement(ue,{policy:e,onChange:t,mode:a,protection:m,protectionLabel:b,osList:pe,"data-test-subj":r("enableDisableSwitch")})},s.a.createElement(le,{policy:e,onChange:t,mode:a,protection:m,osList:pe,"data-test-subj":r("protectionLevel")}),s.a.createElement(X,{policy:e,onChange:t,mode:a,protection:m,"data-test-subj":r("reputationService")}),s.a.createElement(ie,{policy:e,onChange:t,mode:a,protection:m,osList:pe,"data-test-subj":r("notifyUser")}),s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(W,{"data-test-subj":r("rulesCallout")})):s.a.createElement(B,{title:de,"data-test-subj":r("locked")}):null}));me.displayName="BehaviourProtectionCard";const be=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.memory",{defaultMessage:"Memory Threat"}),ge=[w.e.windows,w.e.mac,w.e.linux],fe=Object(r.memo)((({policy:e,onChange:t,mode:a,"data-test-subj":n})=>{const i=Object(R.b)().isPlatinumPlus(),r=Object(p.a)(n),d=!Object(c.a)(),m="memory_protection",b=l.i18n.translate("xpack.securitySolution.endpoint.policy.protections.memory",{defaultMessage:"Memory threat protections"});return d?i?s.a.createElement(v,{type:l.i18n.translate("xpack.securitySolution.endpoint.policy.details.memory_protection",{defaultMessage:"Memory threat"}),supportedOss:[u.c.WINDOWS,u.c.MAC,u.c.LINUX],dataTestSubj:r(),rightCorner:s.a.createElement(ue,{policy:e,onChange:t,mode:a,protection:m,protectionLabel:b,osList:ge,"data-test-subj":r("enableDisableSwitch")})},s.a.createElement(le,{policy:e,onChange:t,mode:a,protection:m,osList:ge,"data-test-subj":r("protectionLevel")}),s.a.createElement(ie,{policy:e,onChange:t,mode:a,protection:m,osList:ge,"data-test-subj":r("notifyUser")}),s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(W,{"data-test-subj":r("rulesCallout")})):s.a.createElement(B,{title:be,"data-test-subj":r("locked")}):null}));fe.displayName="MemoryProtectionCard";const ye=[w.e.windows],he=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.ransomware",{defaultMessage:"Ransomware"}),ve=s.a.memo((({policy:e,onChange:t,mode:a,"data-test-subj":n})=>{const i=Object(R.b)().isPlatinumPlus(),r=!Object(c.a)(),d=Object(p.a)(n),m="ransomware",b=l.i18n.translate("xpack.securitySolution.endpoint.policy.protections.ransomware",{defaultMessage:"Ransomware protections"});return r?i?s.a.createElement(v,{type:l.i18n.translate("xpack.securitySolution.endpoint.policy.details.ransomware",{defaultMessage:"Ransomware"}),supportedOss:[u.c.WINDOWS],dataTestSubj:d(),rightCorner:s.a.createElement(ue,{policy:e,onChange:t,mode:a,protection:m,protectionLabel:b,osList:ye,"data-test-subj":d("enableDisableSwitch")})},s.a.createElement(le,{protection:m,osList:ye,onChange:t,policy:e,mode:a,"data-test-subj":d("protectionLevel")}),s.a.createElement(ie,{policy:e,onChange:t,mode:a,protection:m,osList:ye,"data-test-subj":d("notifyUser")}),s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(W,{"data-test-subj":d("rulesCallout")})):s.a.createElement(B,{title:he,"data-test-subj":d("locked")}):null}));ve.displayName="RansomwareProtectionCard";const Ee=l.i18n.translate("xpack.securitySolution.endpoint.policy.protections.blocklistEnabled",{defaultMessage:"Blocklist enabled"}),xe=l.i18n.translate("xpack.securitySolution.endpoint.policy.protections.blocklistDisabled",{defaultMessage:"Blocklist disabled"}),je=({value:e,policyConfigData:t,protectionOsList:a})=>{for(const n of a)t[n].malware.blocklist=e;return t},Se=[w.e.windows,w.e.mac,w.e.linux],ke=s.a.memo((({policy:e,onChange:t,mode:a="edit","data-test-subj":n})=>{const i=Object(p.a)(n),r=!Object(c.a)(),d="malware",m=l.i18n.translate("xpack.securitySolution.endpoint.policy.protections.malware",{defaultMessage:"Malware protections"});return r?s.a.createElement(v,{type:l.i18n.translate("xpack.securitySolution.endpoint.policy.details.malware",{defaultMessage:"Malware"}),supportedOss:[u.c.WINDOWS,u.c.MAC,u.c.LINUX],dataTestSubj:i(),rightCorner:s.a.createElement(ue,{protection:d,protectionLabel:m,osList:Se,additionalOnSwitchChange:je,policy:e,onChange:t,mode:a,"data-test-subj":i("enableDisableSwitch")})},s.a.createElement(le,{policy:e,onChange:t,mode:a,protection:d,osList:Se,"data-test-subj":i("protectionLevel")}),s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(Oe,{policy:e,onChange:t,mode:a,"data-test-subj":i("blocklist")}),s.a.createElement(ie,{policy:e,onChange:t,mode:a,protection:d,osList:Se,"data-test-subj":i("notifyUser")}),s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(W,{"data-test-subj":i("rulesCallout")})):null}));ke.displayName="MalwareProtectionsCard";const Oe=Object(r.memo)((({policy:e,onChange:t,mode:a,"data-test-subj":n})=>{const i=Object(p.a)(n),l=e.windows.malware.blocklist,c="off"===e.windows.malware.mode,u="edit"===a,b=l?Ee:xe,g=Object(r.useCallback)((a=>{const n=a.target.checked,i=Object(d.cloneDeep)(e);je({value:n,policyConfigData:i,protectionOsList:Se}),t({isValid:!0,updatedPolicy:i})}),[t,e]);return s.a.createElement(o.EuiFlexGroup,{gutterSize:"xs","data-test-subj":i()},s.a.createElement(o.EuiFlexItem,{grow:!1},u?s.a.createElement(o.EuiSwitch,{label:b,checked:l,onChange:g,disabled:c,"data-test-subj":i("enableDisableSwitch")}):s.a.createElement(s.a.Fragment,null,b)),s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiIconTip,{position:"right",content:s.a.createElement(s.a.Fragment,null,s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyDetailsConfig.blocklistTooltip",defaultMessage:"Enables or disables the blocklist associated with this policy. The blocklist is a collection hashes, paths, or signers which extends the list of processes the endpoint considers malicious. See the blocklist tab for entry details."}))})))}));Oe.displayName="EnableDisableBlocklist";const we=[{key:"linux.advanced.agent.connection_delay",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.agent.connection_delay",{defaultMessage:"How long to wait for agent connectivity before sending first policy reply, in seconds. Default: 60."})},{key:"linux.advanced.artifacts.global.base_url",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.artifacts.global.base_url",{defaultMessage:"Base URL from which to download global artifact manifests. Default: https://artifacts.security.elastic.co."})},{key:"linux.advanced.artifacts.global.manifest_relative_url",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.artifacts.global.manifest_relative_url",{defaultMessage:"Relative URL from which to download global artifact manifests. Default: /downloads/endpoint/manifest/artifacts-<version>.zip."})},{key:"linux.advanced.artifacts.global.public_key",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.artifacts.global.public_key",{defaultMessage:"PEM-encoded public key used to verify the global artifact manifest signature."})},{key:"linux.advanced.artifacts.global.interval",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.artifacts.global.interval",{defaultMessage:"Interval between global artifact manifest download attempts, in seconds. Default: 3600."})},{key:"linux.advanced.artifacts.user.public_key",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.artifacts.user.public_key",{defaultMessage:"PEM-encoded public key used to verify the user artifact manifest signature."})},{key:"linux.advanced.elasticsearch.delay",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.elasticsearch.delay",{defaultMessage:"Delay for sending events to Elasticsearch, in seconds. Default: 120."})},{key:"linux.advanced.elasticsearch.tls.verify_peer",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.elasticsearch.tls.verify_peer",{defaultMessage:"Whether to verify the certificates presented by the peer. Default: true."})},{key:"linux.advanced.elasticsearch.tls.verify_hostname",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.elasticsearch.tls.verify_hostname",{defaultMessage:"Whether to verify the hostname of the peer is what's in the certificate. Default: true."})},{key:"linux.advanced.elasticsearch.tls.ca_cert",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.elasticsearch.tls.ca_cert",{defaultMessage:"PEM-encoded certificate for Elasticsearch certificate authority."})},{key:"linux.advanced.logging.file",first_supported_version:"7.11",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.logging.file",{defaultMessage:"A supplied value will override the log level configured for logs that are saved to disk and streamed to Elasticsearch. It is recommended Fleet be used to change this logging in most circumstances. Allowed values are error, warning, info, debug, and trace."})},{key:"linux.advanced.logging.syslog",first_supported_version:"7.11",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.logging.syslog",{defaultMessage:"A supplied value will configure logging to syslog. Allowed values are error, warning, info, debug, and trace."})},{key:"linux.advanced.tty_io.max_kilobytes_per_process",first_supported_version:"8.5",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.tty_io.max_kilobytes_per_process",{defaultMessage:"The maximum kilobytes of terminal output to record for a single process. Default: 512"})},{key:"linux.advanced.tty_io.max_kilobytes_per_event",first_supported_version:"8.5",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.tty_io.max_kilobytes_per_event",{defaultMessage:"The maximum kilobytes of terminal output to record in a single event. Default: 512"})},{key:"linux.advanced.capture_env_vars",first_supported_version:"8.6",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.capture_env_vars",{defaultMessage:"The list of environment variables to capture (up to five), separated by commas."})},{key:"linux.advanced.tty_io.max_event_interval_seconds",first_supported_version:"8.5",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.tty_io.max_event_interval_seconds",{defaultMessage:"The maximum amount of time (seconds) to batch terminal output in a single event. Default: 30"})},{key:"mac.advanced.agent.connection_delay",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.agent.connection_delay",{defaultMessage:"How long to wait for agent connectivity before sending first policy reply, in seconds. Default: 60."})},{key:"mac.advanced.artifacts.global.base_url",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.artifacts.global.base_url",{defaultMessage:"URL from which to download global artifact manifests."})},{key:"mac.advanced.artifacts.global.manifest_relative_url",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.artifacts.global.manifest_relative_url",{defaultMessage:"Relative URL from which to download global artifact manifests. Default: /downloads/endpoint/manifest/artifacts-<version>.zip."})},{key:"mac.advanced.artifacts.global.public_key",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.artifacts.global.public_key",{defaultMessage:"PEM-encoded public key used to verify the global artifact manifest signature."})},{key:"mac.advanced.artifacts.global.interval",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.artifacts.global.interval",{defaultMessage:"Interval between global artifact manifest download attempts, in seconds. Default: 3600."})},{key:"mac.advanced.artifacts.user.public_key",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.artifacts.user.public_key",{defaultMessage:"PEM-encoded public key used to verify the user artifact manifest signature."})},{key:"mac.advanced.elasticsearch.delay",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.elasticsearch.delay",{defaultMessage:"Delay for sending events to Elasticsearch, in seconds. Default: 120."})},{key:"mac.advanced.elasticsearch.tls.verify_peer",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.elasticsearch.tls.verify_peer",{defaultMessage:"Whether to verify the certificates presented by the peer. Default: true."})},{key:"mac.advanced.elasticsearch.tls.verify_hostname",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.elasticsearch.tls.verify_hostname",{defaultMessage:"Whether to verify the hostname of the peer is what's in the certificate. Default: true."})},{key:"mac.advanced.elasticsearch.tls.ca_cert",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.elasticsearch.tls.ca_cert",{defaultMessage:"PEM-encoded certificate for Elasticsearch certificate authority."})},{key:"mac.advanced.logging.file",first_supported_version:"7.11",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.logging.file",{defaultMessage:"A supplied value will override the log level configured for logs that are saved to disk and streamed to Elasticsearch. It is recommended Fleet be used to change this logging in most circumstances. Allowed values are error, warning, info, debug, and trace."})},{key:"mac.advanced.logging.syslog",first_supported_version:"7.11",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.logging.syslog",{defaultMessage:"A supplied value will configure logging to syslog. Allowed values are error, warning, info, debug, and trace."})},{key:"mac.advanced.malware.quarantine",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.malware.quarantine",{defaultMessage:"Whether quarantine should be enabled when malware prevention is enabled. Default: true."})},{key:"mac.advanced.malware.threshold",first_supported_version:"7.11",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.malware.threshold",{defaultMessage:"The threshold that should be used for evaluating malware. Allowed values are normal, conservative, and aggressive. Default: normal."})},{key:"mac.advanced.kernel.connect",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.kernel.connect",{defaultMessage:"Whether to connect to the kernel driver. Default: true."})},{key:"mac.advanced.kernel.process",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.kernel.process",{defaultMessage:"A value of 'false' overrides other config settings that would enable kernel process events. Default: true."})},{key:"mac.advanced.kernel.filewrite",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.kernel.filewrite",{defaultMessage:"A value of 'false' overrides other config settings that would enable kernel file write events. Default: true."})},{key:"mac.advanced.kernel.network",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.kernel.network",{defaultMessage:"A value of 'false' overrides other config settings that would enable kernel network events. Default: true."})},{key:"mac.advanced.harden.self_protect",first_supported_version:"7.11",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.harden.self_protect",{defaultMessage:"Enables self-protection on macOS. Default: true."})},{key:"windows.advanced.agent.connection_delay",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.agent.connection_delay",{defaultMessage:"How long to wait for agent connectivity before sending first policy reply, in seconds. Default: 60."})},{key:"windows.advanced.artifacts.global.base_url",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.artifacts.global.base_url",{defaultMessage:"URL from which to download global artifact manifests."})},{key:"windows.advanced.artifacts.global.manifest_relative_url",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.artifacts.global.manifest_relative_url",{defaultMessage:"Relative URL from which to download global artifact manifests. Default: /downloads/endpoint/manifest/artifacts-<version>.zip."})},{key:"windows.advanced.artifacts.global.public_key",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.artifacts.global.public_key",{defaultMessage:"PEM-encoded public key used to verify the global artifact manifest signature."})},{key:"windows.advanced.artifacts.global.interval",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.artifacts.global.interval",{defaultMessage:"Interval between global artifact manifest download attempts, in seconds. Default: 3600."})},{key:"windows.advanced.artifacts.user.public_key",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.artifacts.user.public_key",{defaultMessage:"PEM-encoded public key used to verify the user artifact manifest signature."})},{key:"windows.advanced.elasticsearch.delay",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.elasticsearch.delay",{defaultMessage:"Delay for sending events to Elasticsearch, in seconds. Default: 120."})},{key:"windows.advanced.elasticsearch.tls.verify_peer",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.elasticsearch.tls.verify_peer",{defaultMessage:"Whether to verify the certificates presented by the peer. Default: true."})},{key:"windows.advanced.elasticsearch.tls.verify_hostname",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.elasticsearch.tls.verify_hostname",{defaultMessage:"Whether to verify the hostname of the peer is what's in the certificate. Default: true."})},{key:"windows.advanced.elasticsearch.tls.ca_cert",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.elasticsearch.tls.ca_cert",{defaultMessage:"PEM-encoded certificate for Elasticsearch certificate authority."})},{key:"windows.advanced.logging.file",first_supported_version:"7.11",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.logging.file",{defaultMessage:"A supplied value will override the log level configured for logs that are saved to disk and streamed to Elasticsearch. It is recommended Fleet be used to change this logging in most circumstances. Allowed values are error, warning, info, debug, and trace."})},{key:"windows.advanced.logging.debugview",first_supported_version:"7.11",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.logging.debugview",{defaultMessage:"A supplied value will configure logging to Debugview (a Sysinternals tool). Allowed values are error, warning, info, debug, and trace."})},{key:"windows.advanced.malware.quarantine",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.malware.quarantine",{defaultMessage:"Whether quarantine should be enabled when malware prevention is enabled. Default: true."})},{key:"windows.advanced.malware.threshold",first_supported_version:"7.11",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.malware.threshold",{defaultMessage:"The threshold that should be used for evaluating malware. Allowed values are normal, conservative, and aggressive. Default: normal."})},{key:"windows.advanced.kernel.connect",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.connect",{defaultMessage:"Whether to connect to the kernel driver. Default: true."})},{key:"windows.advanced.kernel.process",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.process",{defaultMessage:"A value of 'false' overrides other config settings that would enable kernel process events. Default: true."})},{key:"windows.advanced.kernel.filewrite",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.filewrite",{defaultMessage:"A value of 'false' overrides other config settings that would enable kernel file write events. Default: true."})},{key:"windows.advanced.kernel.network",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.network",{defaultMessage:"A value of 'false' overrides other config settings that would enable kernel network events. Default: true."})},{key:"windows.advanced.kernel.fileopen",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.fileopen",{defaultMessage:"A value of 'false' overrides other config settings that would enable kernel file open events. Default: true."})},{key:"windows.advanced.kernel.asyncimageload",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.asyncimageload",{defaultMessage:"A value of 'false' overrides other config settings that would enable kernel async image load events. Default: true."})},{key:"windows.advanced.kernel.syncimageload",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.syncimageload",{defaultMessage:"A value of 'false' overrides other config settings that would enable kernel sync image load events. Default: true."})},{key:"windows.advanced.kernel.registry",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.registry",{defaultMessage:"A value of 'false' overrides other config settings that would enable kernel registry events. Default: true."})},{key:"windows.advanced.kernel.fileaccess",first_supported_version:"7.15",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.fileaccess",{defaultMessage:"Report limited file access (read) events. Paths are not user-configurable. Default value is true."})},{key:"windows.advanced.kernel.registryaccess",first_supported_version:"7.15",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.registryaccess",{defaultMessage:"Report limited registry access (queryvalue, savekey) events. Paths are not user-configurable. Default value is true."})},{key:"windows.advanced.diagnostic.enabled",first_supported_version:"7.11",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.diagnostic.enabled",{defaultMessage:"A value of 'false' disables running diagnostic features on Endpoint. Default: true."})},{key:"linux.advanced.diagnostic.enabled",first_supported_version:"7.12",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.diagnostic.enabled",{defaultMessage:"A value of 'false' disables running diagnostic features on Endpoint. Default: true."})},{key:"mac.advanced.diagnostic.enabled",first_supported_version:"7.12",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.diagnostic.enabled",{defaultMessage:"A value of 'false' disables running diagnostic features on Endpoint. Default: true."})},{key:"windows.advanced.alerts.cloud_lookup",first_supported_version:"7.12",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.alerts.cloud_lookup",{defaultMessage:"A value of 'false' disables cloud lookup for Windows alerts. Default: true."})},{key:"mac.advanced.alerts.cloud_lookup",first_supported_version:"7.12",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.alerts.cloud_lookup",{defaultMessage:"A value of 'false' disables cloud lookup for Mac alerts. Default: true."})},{key:"windows.advanced.ransomware.mbr",first_supported_version:"7.12",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.ransomware.mbr",{defaultMessage:"A value of 'false' disables Ransomware MBR protection. Default: true."})},{key:"windows.advanced.ransomware.canary",first_supported_version:"7.14",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.ransomware.canary",{defaultMessage:"A value of 'false' disables Ransomware canary protection. Default: true."})},{key:"windows.advanced.memory_protection.shellcode",first_supported_version:"7.15",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.memory_protection.shellcode",{defaultMessage:"Enable shellcode injection detection as a part of memory protection. Default: true."})},{key:"windows.advanced.memory_protection.memory_scan",first_supported_version:"7.15",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.memory_protection.memory_scan",{defaultMessage:"Enable scanning for malicious memory regions as a part of memory protection. Default: true."})},{key:"linux.advanced.malware.quarantine",first_supported_version:"7.14",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.malware.quarantine",{defaultMessage:"Whether quarantine should be enabled when malware prevention is enabled. Default: true."})},{key:"windows.advanced.memory_protection.shellcode_collect_sample",first_supported_version:"7.15",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.memory_protection.shellcode_collect_sample",{defaultMessage:"Collect 4MB of memory surrounding detected shellcode regions. Default: false. Enabling this value may significantly increase the amount of data stored in Elasticsearch."})},{key:"windows.advanced.memory_protection.memory_scan_collect_sample",first_supported_version:"7.15",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.memory_protection.memory_scan_collect_sample",{defaultMessage:"Collect 4MB of memory surrounding detected malicious memory regions. Default: false. Enabling this value may significantly increase the amount of data stored in Elasticsearch."})},{key:"windows.advanced.memory_protection.shellcode_enhanced_pe_parsing",first_supported_version:"7.15",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.memory_protection.shellcode_enhanced_pe_parsing",{defaultMessage:"Attempt to identify and extract PE metadata from injected shellcode, including Authenticode signatures and version resource information. Default: true."})},{key:"mac.advanced.memory_protection.memory_scan_collect_sample",first_supported_version:"7.16",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.memory_protection.memory_scan_collect_sample",{defaultMessage:"Collect 4MB of memory surrounding detected malicious memory regions. Default: false. Enabling this value may significantly increase the amount of data stored in Elasticsearch."})},{key:"mac.advanced.memory_protection.memory_scan",first_supported_version:"7.16",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.memory_protection.memory_scan",{defaultMessage:"Enable scanning for malicious memory regions as a part of memory protection. Default: true."})},{key:"linux.advanced.memory_protection.memory_scan_collect_sample",first_supported_version:"7.16",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.memory_protection.memory_scan_collect_sample",{defaultMessage:"Collect 4MB of memory surrounding detected malicious memory regions. Default: false. Enabling this value may significantly increase the amount of data stored in Elasticsearch."})},{key:"linux.advanced.memory_protection.memory_scan",first_supported_version:"7.16",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.memory_protection.memory_scan",{defaultMessage:"Enable scanning for malicious memory regions as a part of memory protection. Default: true."})},{key:"linux.advanced.artifacts.user.ca_cert",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.artifacts.user.ca_cert",{defaultMessage:"PEM-encoded certificate for Fleet Server certificate authority."})},{key:"windows.advanced.artifacts.user.ca_cert",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.artifacts.user.ca_cert",{defaultMessage:"PEM-encoded certificate for Fleet Server certificate authority."})},{key:"mac.advanced.artifacts.user.ca_cert",first_supported_version:"7.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.artifacts.user.ca_cert",{defaultMessage:"PEM-encoded certificate for Fleet Server certificate authority."})},{key:"windows.advanced.events.etw",first_supported_version:"8.1",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.etw",{defaultMessage:"Enable collection of ETW events. Default: true"})},{key:"windows.advanced.diagnostic.rollback_telemetry_enabled",first_supported_version:"8.1",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.diagnostic.rollback_telemetry_enabled",{defaultMessage:"Enable diagnostic rollback telemetry. Default: true"})},{key:"mac.advanced.kernel.network_extension.enable_content_filtering",first_supported_version:"8.1",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.kernel.network_extension.enable_content_filtering",{defaultMessage:"Enable or disable the network content filter, this will enable/disable network eventing. Host isolation will fail if this option is disabled. Default: true"})},{key:"mac.advanced.kernel.network_extension.enable_packet_filtering",first_supported_version:"8.1",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.kernel.network_extension.enable_packet_filtering",{defaultMessage:"Enable or disable the network packet filter. Host isolation will fail if this option is disabled. Default: true"})},{key:"windows.advanced.memory_protection.shellcode_trampoline_detection",first_supported_version:"8.1",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.memory_protection.shellcode_trampoline_detection",{defaultMessage:"Enable trampoline-based shellcode injection detection as a part of memory protection. Default: true"})},{key:"linux.advanced.kernel.capture_mode",first_supported_version:"8.2",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.kernel.capture_mode",{defaultMessage:"Allows users to control whether kprobes or ebpf are used to gather data. Options are kprobe, ebpf, or auto. Auto uses ebpf if possible, otherwise uses kprobe. Default: auto"})},{key:"linux.advanced.event_filter.default",first_supported_version:"8.3",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.event_filter.default",{defaultMessage:"Download default event filter rules from Elastic.  Default: true"})},{key:"mac.advanced.event_filter.default",first_supported_version:"8.3",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.event_filter.default",{defaultMessage:"Download default event filter rules from Elastic.  Default: true"})},{key:"windows.advanced.event_filter.default",first_supported_version:"8.3",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.event_filter.default",{defaultMessage:"Download default event filter rules from Elastic.  Default: true"})},{key:"windows.advanced.utilization_limits.cpu",first_supported_version:"8.3",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.utilization_limits.cpu",{defaultMessage:"The percentage of the aggregate system CPU to restrict Endpoint to. The range is 20-100%. Anything under 20 gets ignored and causes a policy warning.  Default: 100"})},{key:"linux.advanced.utilization_limits.cpu",first_supported_version:"8.3",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.utilization_limits.cpu",{defaultMessage:"The percentage of the aggregate system CPU to restrict Endpoint to. The range is 20-100%. Anything under 20 gets ignored and causes a policy warning.  Default: 50"})},{key:"windows.advanced.alerts.rollback.self_healing.enabled",first_supported_version:"8.4",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.alerts.rollback.self_healing.enabled",{defaultMessage:"Self-healing erases attack artifacts when prevention alerts are triggered. Warning: data loss can occur. Default: false"}),license:"platinum"},{key:"linux.advanced.fanotify.ignore_unknown_filesystems",first_supported_version:"8.4",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.fanotify.ignore_unknown_filesystems",{defaultMessage:'Whether fanotify should ignore unknown filesystems. When true, only CI tested filesystems will be marked by default; additional filesystems can be added or removed with "monitored_filesystems" and "ignored_filesystems", respectively. When false, only an internally curated list of filesystems will be ignored, all others will be marked; additional filesystems can be ignored via "ignored_filesystems". "monitored_filesystems" is ignored when "ignore_unknown_filesystems" is false. Default: true'})},{key:"linux.advanced.fanotify.monitored_filesystems",first_supported_version:"8.4",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.fanotify.monitored_filesystems",{defaultMessage:'Additional filesystems for fanotify to monitor. The format is a comma separated list of filesystem names as they appear in "/proc/filesystems", e.g. "jfs,ufs,ramfs". It is recommended to avoid network-backed filesystems. When "ignore_unknown_filesystems" is false, this option is ignored. When "ignore_unknown_filesystems" is true, parsed entries of this option are monitored by fanotify unless overridden by entries in "ignored_filesystems" or internally known bad filesystems.'})},{key:"linux.advanced.fanotify.ignored_filesystems",first_supported_version:"8.4",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.fanotify.ignored_filesystems",{defaultMessage:'Additional filesystems for fanotify to ignore. The format is a comma separated list of filesystem names as they appear in "/proc/filesystems", e.g. "ext4,tmpfs". When "ignore_unknown_filesystems" is false, parsed entries of this option supplement internally known bad filesystems to be ignored. When "ignore_unknown_filesystems" is true, parsed entries of this option override entries in "monitored_filesystems" and internally CI tested filesystems.'})},{key:"windows.advanced.memory_protection.context_manipulation_detection",first_supported_version:"8.4",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.memory_protection.context_manipulation_detection",{defaultMessage:"Detect injection based on thread context manipulation (e.g. `SetThreadContext`) as a part of memory protection. Default: true"})},{key:"windows.advanced.kernel.image_and_process_file_timestamp",first_supported_version:"8.4",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.image_and_process_file_timestamp",{defaultMessage:"Collect executable/dll timestamps for process and async image load events. Default: true"})},{key:"linux.advanced.host_isolation.allowed",first_supported_version:"8.6.1",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.host_isolation.allowed",{defaultMessage:"A value of false disallows host isolation activity on Linux endpoints, regardless of whether host isolation is supported. Note that if a host is currently not isolated, it will refuse to isolate, and likewise, a host will refuse to release if it is currently isolated. A value of true will allow Linux endpoints to isolate if supported. Default: true"})},{key:"mac.advanced.capture_env_vars",first_supported_version:"8.7",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.capture_env_vars",{defaultMessage:"The list of environment variables to capture (up to five), separated by commas."})},{key:"linux.advanced.events.disable_fd_kprobes",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.events.disable_fd_kprobes",{defaultMessage:"When only process events are being collected, this option will disable file descriptor tracking probes. This can be used to reduce Endpoint processing at the expense of missing fchdir based working directory changes. This only applies if the capture_mode is kprobe or if auto resolves tracefs (kprobe) probes. ebpf based event collection ignores this setting. Default is false."})},{key:"windows.advanced.events.callstacks.emit_in_events",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.callstacks.emit_in_events",{defaultMessage:"If set, callstacks will be included in regular events where they are collected. Otherwise, they are only included in events that trigger behavioral protection rules. Note that setting this may significantly increase data volumes. Default: false"})},{key:"windows.advanced.events.callstacks.process",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.callstacks.process",{defaultMessage:"Collect callstacks during process events?  Default: true"})},{key:"windows.advanced.events.callstacks.image_load",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.callstacks.image_load",{defaultMessage:"Collect callstacks during image/library load events?  Default: true"})},{key:"windows.advanced.events.callstacks.file",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.callstacks.file",{defaultMessage:"Collect callstacks during file events?  Default: true"})},{key:"windows.advanced.events.callstacks.registry",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.callstacks.registry",{defaultMessage:"Collect callstacks during registry events?  Default: true"})},{key:"windows.advanced.artifacts.global.proxy_url",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.artifacts.global.proxy_url",{defaultMessage:"Proxy server to use when downloading global artifact manifests. Default: none"})},{key:"windows.advanced.artifacts.global.proxy_disable",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.artifacts.global.proxy_disable",{defaultMessage:"If the proxy setting should be used when downloading global artifact manifests. Default: false"})},{key:"windows.advanced.artifacts.user.proxy_url",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.artifacts.user.proxy_url",{defaultMessage:"Proxy server to use when downloading user artifact manifests. Default: none"})},{key:"windows.advanced.artifacts.user.proxy_disable",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.artifacts.user.proxy_disable",{defaultMessage:"If the proxy setting should be used when downloading user artifact manifests. Default: false"})},{key:"mac.advanced.artifacts.global.proxy_url",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.artifacts.global.proxy_url",{defaultMessage:"Proxy server to use when downloading global artifact manifests. Default: none"})},{key:"mac.advanced.artifacts.global.proxy_disable",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.artifacts.global.proxy_disable",{defaultMessage:"If the proxy setting should be used when downloading global artifact manifests. Default: false"})},{key:"mac.advanced.artifacts.user.proxy_url",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.artifacts.user.proxy_url",{defaultMessage:"Proxy server to use when downloading user artifact manifests. Default: none"})},{key:"mac.advanced.artifacts.user.proxy_disable",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.mac.advanced.artifacts.user.proxy_disable",{defaultMessage:"If the proxy setting should be used when downloading user artifact manifests. Default: false"})},{key:"linux.advanced.artifacts.global.proxy_url",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.artifacts.global.proxy_url",{defaultMessage:"Proxy server to use when downloading global artifact manifests. Default: none"})},{key:"linux.advanced.artifacts.global.proxy_disable",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.artifacts.global.proxy_disable",{defaultMessage:"If the proxy setting should be used when downloading global artifact manifests. Default: false"})},{key:"linux.advanced.artifacts.user.proxy_url",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.artifacts.user.proxy_url",{defaultMessage:"Proxy server to use when downloading user artifact manifests. Default: none"})},{key:"linux.advanced.artifacts.user.proxy_disable",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.linux.advanced.artifacts.user.proxy_disable",{defaultMessage:"If the proxy setting should be used when downloading user artifact manifests. Default: false"})},{key:"windows.advanced.events.api",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.api",{defaultMessage:"Controls whether API events are enabled. Set to false to disable API event collection. Default: true"})},{key:"windows.advanced.alerts.rollback.self_healing.registry_enabled",first_supported_version:"8.8",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.alerts.rollback.self_healing.registry_enabled",{defaultMessage:"Enables self-healing of registry based malware artifacts. Requires rollback.self_healing.enabled to also be enabled. Default: true"})},{key:"windows.advanced.events.callstacks.include_network_images",first_supported_version:"8.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.events.callstacks.include_network_images",{defaultMessage:"Should executables and DLLs on network shares be parsed for call stack symbols?  This may cause Endpoint to hang on some networks. Default: true"})},{key:"windows.advanced.kernel.ppl.harden_images",first_supported_version:"8.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.ppl.harden_images",{defaultMessage:"Mitigate attacks like PPLFault by preventing Protected Process Light (PPL) processes from loading DLLs over the network. Default: true"})},{key:"windows.advanced.kernel.ppl.harden_am_images",first_supported_version:"8.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.kernel.ppl.harden_am_images",{defaultMessage:'Apply the windows.advanced.kernel.ppl.harden_images mitigation to Anti-Malware PPL as well. Disable this if third-party Anti-Malware is blocked from loading DLLs over the network. If this happens, there will be Event ID 8 events in the "Microsoft-Windows-Security-Mitigations/Kernel Mode" event log. Default: true'})},{key:"windows.advanced.malware.networkshare",first_supported_version:"8.9",documentation:l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.windows.advanced.malware.networkshare",{defaultMessage:"Controls whether malware protection is applied to network drives. Default: true"})}],Te=l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.calloutTitle",{defaultMessage:"Proceed with caution!"}),Ie=l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.warningMessage",{defaultMessage:"This section contains policy values that support advanced use cases. If not configured\n    properly, these values can cause unpredictable behavior. Please consult documentation\n    carefully or contact support before editing these values."}),Ce=l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.hide",{defaultMessage:"Hide"}),Me=l.i18n.translate("xpack.securitySolution.endpoint.policy.advanced.show",{defaultMessage:"Show"}),_e=Object(r.memo)((({policy:e,mode:t,onChange:a,"data-test-subj":n})=>{const i=Object(p.a)(n),[l,c]=Object(r.useState)(!1),u=Object(R.b)().isPlatinumPlus(),b="edit"===t,g=Object(r.useCallback)((()=>{c((e=>!e))}),[]),f=Object(r.useCallback)((t=>{const n=Object(d.cloneDeep)(e);!function(e,t,a){let n=e;for(let e=0;e<a.length-1;e++)n[a[e]]||(n[a[e]]={}),n=n[a[e]];if(n[a[a.length-1]]=t,""===t||void 0===t){n=e;for(let t=a.length;t>=0;t--){const i=a.slice(0,t);for(let e=0;e<i.length-1;e++)n=n[i[e]];if(void 0!==n[i[i.length-1]]&&""!==n[i[i.length-1]]&&0!==Object.keys(n[i[i.length-1]]).length)break;"advanced"===i[i.length-1]?n[i[i.length-1]]=void 0:delete n[i[i.length-1]],n=e}}}(n,t.target.value,t.target.name.split(".")),a({isValid:!0,updatedPolicy:n})}),[a,e]);return s.a.createElement("div",{"data-test-subj":i()},s.a.createElement(o.EuiButtonEmpty,{"data-test-subj":i("showButton"),onClick:g},s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.advanced.showHideButtonLabel",defaultMessage:"{action} advanced settings",values:{action:l?Ce:Me}})),s.a.createElement(o.EuiSpacer,{size:"l"}),l&&s.a.createElement("div",null,b&&s.a.createElement(s.a.Fragment,null,s.a.createElement(o.EuiCallOut,{title:Te,color:"warning",iconType:"warning","data-test-subj":i("warning")},s.a.createElement("p",null,Ie)),s.a.createElement(o.EuiSpacer,null)),s.a.createElement(o.EuiText,{size:"xs",color:"subdued"},s.a.createElement("h4",null,s.a.createElement(m.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.advanced",defaultMessage:"Advanced settings"}))),s.a.createElement(o.EuiPanel,{"data-test-subj":i("settings"),paddingSize:"s"},we.map((({key:t,documentation:a,first_supported_version:n,last_supported_version:r,license:l},c)=>{if(!u&&"platinum"===l)return s.a.createElement(s.a.Fragment,{key:t});const d=t.split("."),p=function(e,t){let a=e;for(let e=0;e<t.length-1;e++){if(!a[t[e]])return"";a=a[t[e]]}return a[t[t.length-1]]}(e,d);return s.a.createElement(o.EuiFormRow,{key:t,fullWidth:!0,"data-test-subj":i(`${t}-container`),label:s.a.createElement(o.EuiFlexGroup,{responsive:!1},s.a.createElement(o.EuiFlexItem,{grow:!0,"data-test-subj":i(`${t}-label`)},t),a&&s.a.createElement(o.EuiFlexItem,{grow:!1},s.a.createElement(o.EuiIconTip,{content:a,position:"right",anchorProps:{"data-test-subj":i(`${t}-tooltipIcon`)}}))),labelAppend:s.a.createElement(o.EuiText,{size:"xs","data-test-subj":i(`${t}-versionInfo`)},r?`${n}-${r}`:`${n}+`)},b?s.a.createElement(o.EuiFieldText,{"data-test-subj":t,fullWidth:!0,name:t,value:p,onChange:f}):s.a.createElement(o.EuiText,{size:"xs","data-test-subj":i(`${t}-viewValue`)},p||Object(O.e)()))})))))}));_e.displayName="AdvancedSection";const Fe=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.protections",{defaultMessage:"Protections"}),Ae=l.i18n.translate("xpack.securitySolution.endpoint.policy.details.settings",{defaultMessage:"Settings"}),De=Object(r.memo)((e=>{const t=Object(p.a)(e["data-test-subj"]),a=Object(c.a)();return s.a.createElement("div",{"data-test-subj":t()},s.a.createElement(Ne,null,Fe),s.a.createElement(o.EuiSpacer,{size:"s"}),a&&s.a.createElement(s.a.Fragment,null,s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(a,null),s.a.createElement(o.EuiSpacer,{size:"l"})),!a&&s.a.createElement(s.a.Fragment,null,s.a.createElement(ke,i()({},e,{"data-test-subj":t("malware")})),s.a.createElement(o.EuiSpacer,{size:"l"}),s.a.createElement(ve,i()({},e,{"data-test-subj":t("ransomware")})),s.a.createElement(o.EuiSpacer,{size:"l"}),s.a.createElement(fe,i()({},e,{"data-test-subj":t("memory")})),s.a.createElement(o.EuiSpacer,{size:"l"}),s.a.createElement(me,i()({},e,{"data-test-subj":t("behaviour")})),s.a.createElement(o.EuiSpacer,{size:"l"}),s.a.createElement(H,i()({},e,{"data-test-subj":t("attackSurface")})),s.a.createElement(o.EuiSpacer,{size:"l"})),s.a.createElement(Ne,null,Ae),s.a.createElement(o.EuiSpacer,{size:"s"}),s.a.createElement(P,i()({},e,{"data-test-subj":t("windowsEvents")})),s.a.createElement(o.EuiSpacer,{size:"l"}),s.a.createElement(D,i()({},e,{"data-test-subj":t("macEvents")})),s.a.createElement(o.EuiSpacer,{size:"l"}),s.a.createElement(F,i()({},e,{"data-test-subj":t("linuxEvents")})),s.a.createElement(o.EuiSpacer,{size:"l"}),s.a.createElement(k,i()({},e,{"data-test-subj":t("antivirusRegistration")})),s.a.createElement(o.EuiSpacer,{size:"m"}),s.a.createElement(_e,i()({},e,{"data-test-subj":t("advancedSection")})))}));De.displayName="PolicySettingsForm";const Ne=Object(r.memo)((({children:e})=>s.a.createElement(o.EuiText,{size:"xs",color:"subdued"},s.a.createElement("h4",null,e))));Ne.displayName="FormSectionTitle"},,,function(e,t,a){"use strict";a.d(t,"a",(function(){return F}));var n=a(2),i=a.n(n),r=a(40),s=a(44),o=a(102),l=a(132),c=a(46),u=a(215),d=a(41),p=a.n(d),m=a(185),b=a(0),g=a.n(b),f=a(5);const y=Object.freeze(new Map([["logging",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.logging",{defaultMessage:"Logging"})],["streaming",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.streaming",{defaultMessage:"Streaming"})],["malware",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.malware",{defaultMessage:"Malware"})],["events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.events",{defaultMessage:"Events"})],["memory_protection",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.memory_protection",{defaultMessage:"Memory Threat"})],["behavior_protection",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.behavior_protection",{defaultMessage:"Malicious Behavior"})]])),h=Object.freeze(new Map([["configure_dns_events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.configure_dns_events",{defaultMessage:"Configure DNS Events"})],["configure_elasticsearch_connection",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.configure_elasticsearch_connection",{defaultMessage:"Configure Elasticsearch Connection"})],["configure_file_events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.configure_file_events",{defaultMessage:"Configure File Events"})],["configure_imageload_events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.configure_imageload_events",{defaultMessage:"Configure Image Load Events"})],["configure_kernel",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.configure_kernel",{defaultMessage:"Configure Kernel"})],["configure_logging",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.configure_logging",{defaultMessage:"Configure Logging"})],["configure_malware",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.configure_malware",{defaultMessage:"Configure Malware"})],["configure_network_events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.configure_network_events",{defaultMessage:"Configure Network Events"})],["configure_process_events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.configure_process_events",{defaultMessage:"Configure Process Events"})],["configure_registry_events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.configure_registry_events",{defaultMessage:"Configure Registry Events"})],["configure_security_events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.configure_security_events",{defaultMessage:"Configure Security Events"})],["connect_kernel",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.connect_kernel",{defaultMessage:"Connect Kernel"})],["detect_async_image_load_events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.detect_async_image_load_events",{defaultMessage:"Detect Async Image Load Events"})],["detect_file_open_events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.detect_file_open_events",{defaultMessage:"Detect File Open Events"})],["detect_file_write_events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.detect_file_write_events",{defaultMessage:"Detect File Write Events"})],["detect_network_events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.detect_network_events",{defaultMessage:"Detect Network Events"})],["detect_process_events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.detect_process_events",{defaultMessage:"Detect Process Events"})],["detect_registry_events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.detect_registry_events",{defaultMessage:"Detect Registry Events"})],["detect_sync_image_load_events",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.detect_sync_image_load_events",{defaultMessage:"Detect Sync Image Load Events"})],["download_global_artifacts",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.download_global_artifacts",{defaultMessage:"Download Global Artifacts"})],["download_user_artifacts",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.download_user_artifacts",{defaultMessage:"Download User Artifacts"})],["load_config",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.load_config",{defaultMessage:"Load Config"})],["load_malware_model",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.load_malware_model",{defaultMessage:"Load Malware Model"})],["read_elasticsearch_config",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.read_elasticsearch_config",{defaultMessage:"Read Elasticsearch Config"})],["read_events_config",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.read_events_config",{defaultMessage:"Read Events Config"})],["read_kernel_config",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.read_kernel_config",{defaultMessage:"Read Kernel Config"})],["read_logging_config",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.read_logging_config",{defaultMessage:"Read Logging Config"})],["read_malware_config",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.read_malware_config",{defaultMessage:"Read Malware Config"})],["workflow",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.workflow",{defaultMessage:"Workflow"})],["full_disk_access",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.full_disk_access",{defaultMessage:"Full Disk Access"})],["macos_system_ext",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.macos_system_ext",{defaultMessage:"Permissions required"})],["linux_deadlock",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.linux_deadlock",{defaultMessage:"Disabled to avoid potential system deadlock"})]])),v=Object.freeze(new Map([[m.b.success,f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.success",{defaultMessage:"Success"})],[m.b.warning,f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.warning",{defaultMessage:"Warning"})],[m.b.failure,f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.failed",{defaultMessage:"Failed"})],[m.b.unsupported,f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.unsupported",{defaultMessage:"Unsupported"})]])),E=Object.freeze(new Map([["full_disk_access",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.description.full_disk_access",{defaultMessage:"You must enable full disk access for Elastic Endpoint on your machine."})],["macos_system_ext",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.description.macos_system_ext",{defaultMessage:"You must enable the Mac system extension for Elastic Endpoint on your machine."})],["linux_deadlock",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.description.linux_deadlock",{defaultMessage:"Malware protection was disabled to avoid a potential system deadlock. To resolve this issue, the file systems causing this need to be identified in integration policy advanced settings (linux.advanced.fanotify.ignored_filesystems). Learn more in our"})]])),x=Object.freeze(new Map([["full_disk_access",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.link.text.full_disk_access",{defaultMessage:" Learn more."})],["macos_system_ext",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.link.text.macos_system_ext",{defaultMessage:" Learn more."})],["linux_deadlock",f.i18n.translate("xpack.securitySolution.endpoint.details.policyResponse.link.text.linux_deadlock",{defaultMessage:" troubleshooting docs."})]])),j="Disabled due to potential system deadlock",S=new Set(["load_malware_model","configure_malware"]);function k(e,t){return"macos"===e&&"connect_kernel"===t.name&&t.status===m.b.failure}function O(e,t){return"linux"===e&&S.has(t.name)&&t.message===j}class policy_response_friendly_names_PolicyResponseActionFormatter{constructor(e,t,a=""){var n;g()(this,"key",void 0),g()(this,"title",void 0),g()(this,"description",void 0),g()(this,"hasError",void 0),g()(this,"errorTitle",void 0),g()(this,"errorDescription",void 0),g()(this,"status",void 0),g()(this,"linkText",void 0),this.policyResponseAppliedAction=e,this.docLinks=t,this.os=a,this.key=e.name,this.title=null!==(n=h.get(this.errorKey||this.key))&&void 0!==n?n:this.key.replace(/_/g," ").replace(/\b(\w)/g,(e=>e.toUpperCase())),this.hasError=e.status===m.b.failure||e.status===m.b.warning,this.description=E.get(this.key)||e.message,this.errorDescription=E.get(this.errorKey||this.key)||this.policyResponseAppliedAction.message,this.errorTitle=this.errorDescription?this.title:e.name,this.status=v.get(e.status),this.linkText=x.get(this.errorKey||this.key)}get linkUrl(){return this.docLinks[this.errorKey]}get isGeneric(){return e=this.os,t=this.policyResponseAppliedAction,!!("macos"===e&&"full_disk_access"===t.name||k(this.os,this.policyResponseAppliedAction)||O(this.os,this.policyResponseAppliedAction));var e,t}get errorKey(){return k(this.os,this.policyResponseAppliedAction)?"macos_system_ext":O(this.os,this.policyResponseAppliedAction)?"linux_deadlock":this.policyResponseAppliedAction.name}}const w=p()(r.EuiCallOut).withConfig({displayName:"StyledEuiCallout",componentId:"sc-1hzi5tn-0"})(["padding:",";"],(({theme:e})=>e.eui.euiSizeS)),T=p()(r.EuiText).withConfig({displayName:"StyledEuiText",componentId:"sc-1hzi5tn-1"})(["white-space:break-spaces;text-align:left;line-height:inherit;"]),I=Object(n.memo)((({policyResponseActionFormatter:e})=>e.hasError?i.a.createElement(w,{title:e.errorTitle,color:"danger",iconType:"warning","data-test-subj":"endpointPolicyResponseErrorCallOut"},i.a.createElement(T,{size:"s","data-test-subj":"endpointPolicyResponseMessage"},e.errorDescription,e.linkText&&e.linkUrl&&i.a.createElement(r.EuiLink,{target:"_blank",href:e.linkUrl,"data-test-subj":"endpointPolicyResponseErrorCallOutLink"},e.linkText))):i.a.createElement(T,{size:"xs","data-test-subj":"endpointPolicyResponseMessage"},e.description||e.title)));I.displayName="PolicyResponseActionItem";const C=p()(r.EuiTreeView).withConfig({displayName:"StyledEuiTreeView",componentId:"sc-1krv2vw-0"})([".policy-response-action-item-expanded{height:auto;padding-top:",";padding-bottom:",";.euiTreeView__nodeLabel{width:100%;}}.policyResponseStatusHealth{padding-top:5px;}.euiTreeView__node--expanded{max-height:none !important;.policy-response-action-expanded + div{.euiTreeView__node{max-height:none !important;}}}.euiTreeView__node{max-height:none !important;.euiNotificationBadge{margin-right:5px;}.euiTreeView__nodeLabel{.euiText{font-size:",";}}}"],(({theme:e})=>e.eui.euiSizeS),(({theme:e})=>e.eui.euiSizeS),(({theme:e})=>e.eui.euiFontSize)),M=Object(n.memo)((({hostOs:e,policyResponseConfig:t,policyResponseActions:a,policyResponseAttentionCount:l})=>{const{docLinks:c}=Object(o.j)().services,u=Object(n.useCallback)(((e,t)=>e===m.b.success?i.a.createElement(r.EuiHealth,{color:"success","data-test-subj":"endpointPolicyResponseStatusSuccessHealth",className:"policyResponseStatusHealth"}):e===m.b.unsupported?i.a.createElement(r.EuiHealth,{color:"subdued","data-test-subj":"endpointPolicyResponseStatusSuccessHealth",className:"policyResponseStatusHealth"}):i.a.createElement(r.EuiNotificationBadge,{"data-test-subj":"endpointPolicyResponseStatusAttentionHealth"},t)),[]),d=Object(n.useCallback)((t=>t.map((t=>{const n=a.find((e=>e.name===t)),s=new policy_response_friendly_names_PolicyResponseActionFormatter(n||{},c.links.securitySolution.policyResponseTroubleshooting,e);return{label:i.a.createElement(r.EuiText,{color:n.status!==m.b.success&&n.status!==m.b.unsupported?"danger":"default","data-test-subj":"endpointPolicyResponseAction"},s.title),id:t,className:n.status!==m.b.success&&n.status!==m.b.unsupported?"policy-response-action-expanded":"",icon:u(n.status,n.status!==m.b.success?1:0),children:[{label:i.a.createElement(I,{policyResponseActionFormatter:s}),id:`action_message_${t}`,isExpanded:!0,className:"policy-response-action-item-expanded"}]}}))),[c.links.securitySolution.policyResponseTroubleshooting,u,a,e]),p=Object(n.useCallback)((()=>Object.entries(t).map((([e,t])=>{const a=l.get(e);return{label:i.a.createElement(r.EuiText,{color:a?"danger":"default",size:"s","data-test-subj":"endpointPolicyResponseConfig"},(n=e,y.has(n)||y.set(n,n.replace(/_/g," ").replace(/\b(\w)/g,(e=>e.toUpperCase()))),y.get(n))),id:e,icon:a?i.a.createElement(r.EuiNotificationBadge,{"data-test-subj":"endpointPolicyResponseStatusAttentionHealth"},a):i.a.createElement(r.EuiHealth,{color:"success","data-test-subj":"endpointPolicyResponseStatusSuccessHealth",className:"policyResponseStatusHealth"}),children:d(t.concerned_actions)};var n}))),[d,l,t]),b=Object(n.useCallback)((()=>{let e=0;for(const t of l.values())e+=t;return[{label:i.a.createElement(r.EuiText,{color:e?"danger":"default",size:"s","data-test-subj":"endpointPolicyResponseTitle"},i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyResponse.title",defaultMessage:"Policy Response"})),id:"policyResponse",icon:e?i.a.createElement(r.EuiNotificationBadge,{"data-test-subj":"endpointPolicyResponseStatusHealth"},e):void 0,children:p()}]}),[p,l])();return i.a.createElement(C,{items:b,showExpansionArrows:!0,"aria-label":"policyResponseTreeView","aria-labelledby":"policyResponseTreeView"})}));M.displayName="PolicyResponse";var _=a(693);const F=Object(n.memo)((({endpointId:e,showRevisionMessage:t=!0,onShowNeedsAttentionBadge:a})=>{var d,p,b;const{data:g,isLoading:f,isFetching:y,isError:h}=function(e,t){const a=Object(o.i)();return Object(c.useQuery)(["getEndpointPolicyResponse",e],(()=>a.get(u.g,{version:"2023-10-31",query:{agentId:e}})),void 0)}(e),{data:v}=Object(_.c)(e),{docLinks:E}=Object(o.j)().services,[x,j]=Object(n.useState)(),[S,k]=Object(n.useState)(),[O,w]=Object(n.useState)(new Map);Object(n.useEffect)((()=>{!g||f||y||h||(j(g.policy_response.Endpoint.policy.applied.response.configurations),k(g.policy_response.Endpoint.policy.applied.actions),w((e=>{var t;const a=new Map;return void 0!==(null==e||null===(t=e.response)||void 0===t?void 0:t.configurations)&&void 0!==(null==e?void 0:e.actions)&&Object.entries(e.response.configurations).map((([t,n])=>{let i=0;for(const t of n.concerned_actions){var r;const a=null===(r=e.actions.find((e=>e.name===t)))||void 0===r?void 0:r.status;a!==m.b.failure&&a!==m.b.warning||(i+=1)}return a.set(t,i)})),a})(g.policy_response.Endpoint.policy.applied)))}),[g,f,y,h]),Object(n.useEffect)((()=>{if(a)for(const e of O.values())if(e)return void a(!0)}),[O,a]);const T=Object(n.useMemo)((()=>x||S?null==S?void 0:S.reduce(((e,t)=>{const a=new policy_response_friendly_names_PolicyResponseActionFormatter(t,E.links.securitySolution.policyResponseTroubleshooting,null==v?void 0:v.metadata.host.os.name.toLowerCase());return a.isGeneric&&a.hasError&&e.push(a),e}),[]):[]),[E.links.securitySolution.policyResponseTroubleshooting,S,x,null==v?void 0:v.metadata.host.os.name]);return i.a.createElement(i.a.Fragment,null,t&&i.a.createElement(i.a.Fragment,null,i.a.createElement(r.EuiText,{size:"xs",color:"subdued","data-test-subj":"endpointPolicyResponseTimestamp"},i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyResponse.appliedOn",defaultMessage:"Revision {rev} applied on {date}",values:{rev:null!==(d=null==g?void 0:g.policy_response.Endpoint.policy.applied.endpoint_policy_version)&&void 0!==d?d:"",date:i.a.createElement(l.d,{value:null!==(p=null==g?void 0:g.policy_response["@timestamp"])&&void 0!==p?p:""})}})),i.a.createElement(r.EuiSpacer,{size:"s"})),h&&i.a.createElement(r.EuiEmptyPrompt,{title:i.a.createElement(s.FormattedMessage,{id:"xpack.securitySolution.endpoint.details.noPolicyResponse",defaultMessage:"No policy response available"})}),f&&i.a.createElement(r.EuiLoadingSpinner,{size:"m"}),void 0!==x&&void 0!==S&&i.a.createElement(i.a.Fragment,null,i.a.createElement(M,{hostOs:null!==(b=null==v?void 0:v.metadata.host.os.name.toLowerCase())&&void 0!==b?b:"",policyResponseConfig:x,policyResponseActions:S,policyResponseAttentionCount:O}),i.a.createElement(r.EuiSpacer,{size:"m"}),null==T?void 0:T.map((e=>i.a.createElement(i.a.Fragment,{key:e.key},i.a.createElement(I,{policyResponseActionFormatter:e}),i.a.createElement(r.EuiSpacer,{size:"m"}))))))}));F.displayName="PolicyResponse"},,,function(e,t,a){"use strict";a.d(t,"a",(function(){return d}));var n=a(666),i=a(1432),r=a(173),s=a(527),o=a(215),l=a(1064);const c=()=>({hosts:[],pageSize:10,pageIndex:0,total:0,sortDirection:o.h,sortField:o.i,loading:!1,error:void 0,location:void 0,policyItems:[],selectedPolicyId:void 0,policyItemsLoading:!1,endpointPackageInfo:Object(l.e)(),nonExistingPolicies:{},agentPolicies:{},endpointsExist:!0,patterns:[],patternsError:void 0,isAutoRefreshEnabled:!0,autoRefreshInterval:r.a,agentsWithEndpointsTotal:0,agentsWithEndpointsTotalError:void 0,endpointsTotal:0,endpointsTotalError:void 0,isolationRequestState:Object(l.e)(),endpointPendingActions:Object(l.c)(new Map),metadataTransformStats:Object(l.e)()}),u=n.combineReducers,d=(r.v,Object(i.a)(),r.t,c(),u({[r.v]:i.c,[r.t]:(e=c(),t)=>{if("serverReturnedEndpointList"===t.type){const{data:a,total:n,page:i,pageSize:r,sortDirection:s,sortField:o}=t.payload;return{...e,hosts:a,total:n,pageIndex:i,pageSize:r,sortField:o,sortDirection:s,loading:!1,error:void 0}}if("serverFailedToReturnEndpointList"===t.type)return{...e,error:t.payload,loading:!1};if("serverReturnedEndpointNonExistingPolicies"===t.type)return{...e,nonExistingPolicies:{...e.nonExistingPolicies,...t.payload}};if("serverReturnedEndpointAgentPolicies"===t.type)return{...e,agentPolicies:{...e.agentPolicies,...t.payload}};if("serverReturnedMetadataPatterns"===t.type)return{...e,patterns:t.payload,patternsError:void 0};if("serverFailedToReturnMetadataPatterns"===t.type)return{...e,patternsError:t.payload};if("endpointPendingActionsStateChanged"===t.type)return((e,t)=>Object(s.isOnEndpointPage)(e)?{...e,endpointPendingActions:t.payload}:e)(e,t);if("serverReturnedPoliciesForOnboarding"===t.type)return{...e,policyItems:t.payload.policyItems,policyItemsLoading:!1};if("serverFailedToReturnPoliciesForOnboarding"===t.type)return{...e,error:t.payload,policyItemsLoading:!1};if("userSelectedEndpointPolicy"===t.type)return{...e,selectedPolicyId:t.payload.selectedPolicyId};if("serverCancelledEndpointListLoading"===t.type)return{...e,loading:!1};if("serverCancelledPolicyItemsLoading"===t.type)return{...e,policyItemsLoading:!1};if("endpointPackageInfoStateChanged"===t.type)return((e,t)=>({...e,endpointPackageInfo:t.payload}))(e,t);if("serverReturnedEndpointExistValue"===t.type)return{...e,endpointsExist:t.payload};if("serverReturnedAgenstWithEndpointsTotal"===t.type)return{...e,agentsWithEndpointsTotal:t.payload,agentsWithEndpointsTotalError:void 0};if("serverFailedToReturnAgenstWithEndpointsTotal"===t.type)return{...e,agentsWithEndpointsTotalError:t.payload};if("serverReturnedEndpointsTotal"===t.type)return{...e,endpointsTotal:t.payload,endpointsTotalError:void 0};if("serverFailedToReturnEndpointsTotal"===t.type)return{...e,endpointsTotalError:t.payload};var a,n;if("userUpdatedEndpointListRefreshOptions"===t.type)return{...e,isAutoRefreshEnabled:null!==(a=t.payload.isAutoRefreshEnabled)&&void 0!==a?a:e.isAutoRefreshEnabled,autoRefreshInterval:null!==(n=t.payload.autoRefreshInterval)&&void 0!==n?n:e.autoRefreshInterval};if("endpointIsolationRequestStateChange"===t.type)return((e,t)=>({...e,isolationRequestState:t.payload}))(e,t);if("userChangedUrl"===t.type){const a={...e,location:t.payload},n=Object(s.isOnEndpointPage)(a)&&!Object(s.hasSelectedEndpoint)(a),i=Object(s.isOnEndpointPage)(e)&&!Object(s.hasSelectedEndpoint)(e),r=Object(s.isOnEndpointPage)(a)&&Object(s.hasSelectedEndpoint)(a),o=Object(s.isOnEndpointPage)(e)&&Object(s.hasSelectedEndpoint)(e),c={location:t.payload,error:void 0};if("isolate"===Object(s.uiQueryParams)(a).show||Object(l.i)(Object(s.getCurrentIsolationRequestState)(a))||(c.isolationRequestState=Object(l.e)()),n){if(!i)return{...e,...c,loading:!0,policyItemsLoading:!0}}else if(r)return o||i?{...e,...c,detailsLoading:!0}:{...e,...c,loading:!0,policyItemsLoading:!0};return{...e,...c,endpointsExist:!0}}return"metadataTransformStatsChanged"===t.type?((e,t)=>({...e,metadataTransformStats:t.payload}))(e,t):e}}))},,,function(e,t,a){"use strict";a.d(t,"a",(function(){return j}));var n=a(119),i=a(2),r=a.n(i),s=a(41),o=a.n(s),l=a(124),c=a(149),u=a(1428),d=a(40),p=a(14),m=a(5),b=a(4);const g=new p.Storage(localStorage),f=o.a.div.withConfig({displayName:"ContainerEuiSelectable",componentId:"sc-134jgj0-0"})(["width:300px;.euiSelectableListItem__text{white-space:pre-wrap !important;line-height:normal;}"]),y=m.i18n.translate("xpack.securitySolution.selector.summaryView.gridView.label",{defaultMessage:"Grid view"}),h=m.i18n.translate("xpack.securitySolution.selector.summaryView.eventRendererView.label",{defaultMessage:"Event rendered view"}),v=({viewSelected:e,onViewChange:t})=>{const[a,n]=Object(i.useState)(!1),s=Object(i.useCallback)((()=>n((e=>!e))),[]),o=Object(i.useCallback)((()=>n(!1)),[]),l=Object(i.useCallback)((e=>{var a,i;const r=e.filter((e=>"on"===e.checked));var s,o;g.set(b.f,null!==(a=null===(i=r[0])||void 0===i?void 0:i.key)&&void 0!==a?a:"gridView"),r.length>0&&t(null!==(s=null===(o=r[0])||void 0===o?void 0:o.key)&&void 0!==s?s:"gridView"),n(!1)}),[t]),c=Object(i.useMemo)((()=>r.a.createElement(d.EuiButtonEmpty,{iconType:"arrowDown",iconSide:"right",iconSize:"s",onClick:s,size:"xs",flush:"both",style:{fontWeight:"normal"}},"gridView"===e?y:h)),[s,e]),u=Object(i.useMemo)((()=>[{label:y,"data-test-subj":"gridView",key:"gridView",checked:"gridView"===e?"on":void 0,meta:[{text:m.i18n.translate("xpack.securitySolution.selector.summaryView.options.default.description",{defaultMessage:"View as tabular data with the ability to group and sort by specific fields"})}]},{label:h,"data-test-subj":"eventRenderedView",key:"eventRenderedView",checked:"eventRenderedView"===e?"on":void 0,meta:[{text:m.i18n.translate("xpack.securitySolution.selector.summaryView.options.summaryView.description",{defaultMessage:"View a rendering of the event flow for each alert"})}]}]),[e]),p=Object(i.useCallback)((e=>r.a.createElement(r.a.Fragment,null,r.a.createElement(d.EuiTitle,{size:"xxs"},r.a.createElement("h6",null,e.label)),r.a.createElement(d.EuiTextColor,{color:"subdued"},r.a.createElement("small",null,e.meta[0].text)))),[]),v=Object(i.useMemo)((()=>({rowHeight:80,showIcons:!0})),[]);return r.a.createElement(d.EuiPopover,{panelPaddingSize:"none",button:c,isOpen:a,closePopover:o},r.a.createElement(f,null,r.a.createElement(d.EuiSelectable,{options:u,onChange:l,renderOption:p,searchable:!1,height:160,listProps:v,singleSelection:!0},(e=>e))))},E=r.a.memo(v),x=o.a.span.withConfig({displayName:"TitleText",componentId:"sc-fudkl1-0"})(["margin-right:12px;"]),j=({tableView:e,loading:t,tableId:a,title:s,onViewChange:o,additionalFilters:d,hasRightOffset:p,showInspect:m=!0,position:b="absolute",additionalMenuOptions:g=[]})=>{const f="gridView"===e?"baseline":"center",y=Object(i.useMemo)((()=>r.a.createElement(x,{"data-test-subj":"title"},s)),[s]),h=Object(l.a)("tGridEventRenderedViewEnabled"),v=Object(i.useMemo)((()=>g.length?g.map(((e,a)=>r.a.createElement(u.h,{grow:!1,$show:!t,key:a},e))):null),[g,t]);return r.a.createElement(u.g,{alignItems:f,"data-test-subj":"events-viewer-updated",gutterSize:"m",component:"span",justifyContent:"flexEnd",direction:"row",$hasRightOffset:p,position:b},m?r.a.createElement(u.h,{grow:!1,$show:!t},r.a.createElement(c.b,{title:y,queryId:a})):null,r.a.createElement(u.h,{grow:!1,$show:!t},d),h&&[n.e.alertsOnRuleDetailsPage,n.e.alertsOnAlertsPage].includes(a)&&r.a.createElement(u.h,{grow:!1,$show:!t,"data-test-subj":"summary-view-selector"},r.a.createElement(E,{viewSelected:e,onViewChange:o})),v)}},function(e,t,a){"use strict";a.d(t,"a",(function(){return S}));var n=a(122),i=a(173),r=a(1432),s=a(3),o=a(489),l=a.n(o),c=a(215),u=a(759),d=a(1384),p=a(934),m=a(1064),b=a(504),g=a(527);const f=console.error,y=(e,t)=>{async function a(e){var a;const n=null!==(a=Object(g.endpointPackageVersion)(e))&&void 0!==a?a:"",i=n.includes("-")?n.substring(0,n.indexOf("-")):n,r=l()(i,"1.2.0")?c.u:c.A,o=t.data.search.search({indices:[r],onlyCheckIfIndicesExist:!1},{strategy:c.k});return[{title:r,fields:(await Object(s.firstValueFrom)(o)).indexFields}]}return t=>n=>async i=>{n(i);const{getState:r,dispatch:s}=t;return await async function(e,t,a){if(Object(g.getIsEndpointPackageInfoUninitialized)(e)){t({type:"endpointPackageInfoStateChanged",payload:Object(m.d)(Object(m.a)(Object(g.endpointPackageInfo)(e)))});try{const e=await Object(b.c)(a.http);t({type:"endpointPackageInfoStateChanged",payload:Object(m.c)(e)})}catch(e){f(e),t({type:"endpointPackageInfoStateChanged",payload:Object(m.b)(e)})}}}(r(),s,e),"userChangedUrl"!==i.type&&"appRequestedEndpointList"!==i.type||!Object(g.isOnEndpointPage)(r())||await async function({store:e,coreStart:t,fetchIndexPatterns:a}){const{getState:n,dispatch:i}=e,{page_index:r,page_size:s,sort_field:o,sort_direction:l}=Object(g.uiQueryParams)(n());let u;try{const a=Object(g.searchBarQuery)(n());u=await t.http.get(c.q,{version:"2023-10-31",query:{page:r,pageSize:s,kuery:a.query,sortField:o,sortDirection:l}}),i({type:"serverReturnedEndpointList",payload:u}),x(e),async function({store:e,hosts:t,http:a}){const{getState:n,dispatch:i}=e;try{const e=await h(a,t,Object(g.nonExistingPolicies)(n()));void 0!==(null==e?void 0:e.packagePolicy)&&i({type:"serverReturnedEndpointNonExistingPolicies",payload:e.packagePolicy}),void 0!==(null==e?void 0:e.agentPolicy)&&i({type:"serverReturnedEndpointAgentPolicies",payload:e.agentPolicy})}catch(e){f(e)}}({http:t.http,hosts:u.data,store:e})}catch(e){i({type:"serverFailedToReturnEndpointList",payload:e})}if(0===Object(g.patterns)(n()).length)try{const e=await a(n());void 0!==e&&i({type:"serverReturnedMetadataPatterns",payload:e})}catch(e){i({type:"serverFailedToReturnMetadataPatterns",payload:e})}if(u&&0===u.data.length){const e=t.http;if(await v(e))return;i({type:"serverReturnedEndpointExistValue",payload:!1});try{i({type:"serverReturnedPoliciesForOnboarding",payload:{policyItems:(await Object(p.a)(e,{query:{perPage:50,page:1}})).items}})}catch(e){var d;i({type:"serverFailedToReturnPoliciesForOnboarding",payload:null!==(d=e.body)&&void 0!==d?d:e})}}else i({type:"serverCancelledPolicyItemsLoading"}),i({type:"serverReturnedEndpointExistValue",payload:!0})}({coreStart:e,store:t,fetchIndexPatterns:a}),"endpointIsolationRequest"===i.type?E(t,i):"loadMetadataTransformStats"===i.type?async function(e,t){const{getState:a,dispatch:n}=t;if(!e||!a||!n)return;const i=a();if(!Object(g.isMetadataTransformStatsLoading)(i)){n({type:"metadataTransformStatsChanged",payload:Object(m.d)(Object(m.a)(Object(g.getMetadataTransformStats)(i)))});try{const t=await e.get(c.t,{version:"2023-10-31"});n({type:"metadataTransformStatsChanged",payload:Object(m.c)(t.transforms)})}catch(e){n({type:"metadataTransformStatsChanged",payload:Object(m.b)(e)})}}}(e.http,t):void 0}},h=async(e,t,a)=>{if(0===t.length)return;const n=[...new Set(t.reduce(((e,t)=>{const n=t.metadata.Endpoint.policy.applied.id;return a[n]||e.push(n),e}),[]))];if(0===n.length)return;const i=(await Object(b.b)(e,n)).items.reduce(((e,t)=>(e.packagePolicy[t.id]=!0,e.agentPolicy[t.id]=t.policy_id,e)),{packagePolicy:{},agentPolicy:{}}),r=n.reduce(((e,t)=>i.packagePolicy[t]?(e.agentPolicy[t]=i.agentPolicy[t],e):(e.packagePolicy[t]=!0,e)),{packagePolicy:{},agentPolicy:{}});return 0!==Object.keys(r.packagePolicy).length||0!==Object.keys(r.agentPolicy).length?r:void 0},v=async e=>{try{return await(async e=>{try{return(await e.get(c.q,{version:"2023-10-31",query:{page:0,pageSize:1}})).total}catch(e){f("error while trying to check for total endpoints"),f(e)}return 0})(e)>0}catch(e){f("error while trying to check if endpoints exist"),f(e)}return!1},E=async({getState:e,dispatch:t},a)=>{const n=e();if(!Object(g.getIsIsolationRequestPending)(n)){t({type:"endpointIsolationRequestStateChange",payload:Object(m.d)(Object(m.a)(Object(g.getCurrentIsolationRequestState)(n)))});try{let e;e="unisolate"===a.payload.type?await Object(u.b)(a.payload.data):await Object(u.a)(a.payload.data),t({type:"endpointIsolationRequestStateChange",payload:Object(m.c)(e)})}catch(e){var i;t({type:"endpointIsolationRequestStateChange",payload:Object(m.b)(null!==(i=e.body)&&void 0!==i?i:e)})}}},x=async({getState:e,dispatch:t})=>{const a=e(),n=Object(g.listData)(a),i=new Set;for(const e of n)i.add(e.metadata.elastic.agent.id);if(0!==i.size)try{const{data:e}=await Object(d.a)(Array.from(i)),a=new Map;for(const t of e)a.set(t.agent_id,t.pending_actions);t({type:"endpointPendingActionsStateChanged",payload:Object(m.c)(a)})}catch(e){f(e)}},j=e=>t=>t[i.u][e],S=(e,t)=>[Object(n.f)(j(i.v),Object(r.b)(e,t)),Object(n.f)(j(i.t),y(e,t))]},,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,function(e,t,a){switch(window.__kbnThemeTag__){case"v8dark":return a(1616);case"v8light":return a(1618)}},function(e,t,a){var n=a(256),i=a(1617);"string"==typeof(i=i.__esModule?i.default:i)&&(i=[[e.i,i,""]]);n(i,{insert:"head",singleton:!1}),e.exports=i.locals||{}},function(e,t,a){(t=a(257)(!1)).push([e.i,"[class*=options_list_popover_footer--OptionsListPopoverFooter],[data-test-subj=optionsListControl__sortingOptionsButton],[id^=control-popover] .euiPopoverTitle{display:none}.filter-group__wrapper .euiFlexGroup.controlGroup{min-height:34px}.filter-group__wrapper .euiFormControlLayout.euiFormControlLayout--group.controlFrame__formControlLayout{height:34px}.filter-group__wrapper .euiFormControlLayout.euiFormControlLayout--group.controlFrame__formControlLayout .euiFormLabel.controlFrame__formControlLayoutLabel,.filter-group__wrapper .euiText.errorEmbeddableCompact__button{padding:8px}.filter-group__wrapper .euiText.errorEmbeddableCompact__button .euiLink{display:flex;gap:8px}",""]),e.exports=t},function(e,t,a){var n=a(256),i=a(1619);"string"==typeof(i=i.__esModule?i.default:i)&&(i=[[e.i,i,""]]);n(i,{insert:"head",singleton:!1}),e.exports=i.locals||{}},function(e,t,a){(t=a(257)(!1)).push([e.i,"[class*=options_list_popover_footer--OptionsListPopoverFooter],[data-test-subj=optionsListControl__sortingOptionsButton],[id^=control-popover] .euiPopoverTitle{display:none}.filter-group__wrapper .euiFlexGroup.controlGroup{min-height:34px}.filter-group__wrapper .euiFormControlLayout.euiFormControlLayout--group.controlFrame__formControlLayout{height:34px}.filter-group__wrapper .euiFormControlLayout.euiFormControlLayout--group.controlFrame__formControlLayout .euiFormLabel.controlFrame__formControlLayoutLabel,.filter-group__wrapper .euiText.errorEmbeddableCompact__button{padding:8px}.filter-group__wrapper .euiText.errorEmbeddableCompact__button .euiLink{display:flex;gap:8px}",""]),e.exports=t},function(e,t,a){"use strict";const n=a(1621);e.exports=(e,t={})=>{if(!Number.isFinite(e))throw new TypeError("Expected a finite number");t.colonNotation&&(t.compact=!1,t.formatSubMilliseconds=!1,t.separateMilliseconds=!1,t.verbose=!1),t.compact&&(t.secondsDecimalDigits=0,t.millisecondsDecimalDigits=0);const a=[],i=(e,n,i,r)=>{if(!(0!==a.length&&t.colonNotation||0!==e||t.colonNotation&&"m"===i))return;let s,o;if(r=(r||e||"0").toString(),t.colonNotation){s=a.length>0?":":"",o="";const e=r.includes(".")?r.split(".")[0].length:r.length,t=a.length>0?2:1;r="0".repeat(Math.max(0,t-e))+r}else s="",o=t.verbose?" "+(l=n,1===e?l:`${l}s`):i;var l;a.push(s+r+o)};if(("number"==typeof t.secondsDecimalDigits?t.secondsDecimalDigits:1)<1){const t=1e3-e%1e3;t<500&&(e+=t)}if(e>=59950&&!t.separateMilliseconds&&!t.formatSubMilliseconds){const t=60-e%60;t<=50&&(e+=t)}const r=n(e);if(i(Math.trunc(r.days/365),"year","y"),i(r.days%365,"day","d"),i(r.hours,"hour","h"),i(r.minutes,"minute","m"),t.separateMilliseconds||t.formatSubMilliseconds||e<1e3)if(i(r.seconds,"second","s"),t.formatSubMilliseconds)i(r.milliseconds,"millisecond","ms"),i(r.microseconds,"microsecond","µs"),i(r.nanoseconds,"nanosecond","ns");else{const e=r.milliseconds+r.microseconds/1e3+r.nanoseconds/1e6,a="number"==typeof t.millisecondsDecimalDigits?t.millisecondsDecimalDigits:0,n=e>=1?Math.round(e):Math.ceil(e),s=a?e.toFixed(a):n;i(parseFloat(s,10),"millisecond","ms",s)}else{const a=e/1e3%60,n="number"==typeof t.secondsDecimalDigits?t.secondsDecimalDigits:1,r=a.toFixed(n),s=t.keepDecimalsOnWholeSeconds?r:r.replace(/\.0+$/,"");i(parseFloat(s,10),"second","s",s)}return 0===a.length?"0"+(t.verbose?" milliseconds":"ms"):t.compact?a[0]:"number"==typeof t.unitCount?a.slice(0,Math.max(t.unitCount,1)).join(" "):t.colonNotation?a.join(""):a.join(" ")}},function(e,t,a){"use strict";e.exports=e=>{if("number"!=typeof e)throw new TypeError("Expected a number");const t=e>0?Math.floor:Math.ceil;return{days:t(e/864e5),hours:t(e/36e5)%24,minutes:t(e/6e4)%60,seconds:t(e/1e3)%60,milliseconds:t(e)%1e3,microseconds:t(1e3*e)%1e3,nanoseconds:t(1e6*e)%1e3}}},function(e,t,a){e.exports=a.p+"ae37f7e28b2ba3954b127510d84d3ac5.svg"},function(e,t,a){!function(t){"use strict";const a="(0?\\d+|0x[a-f0-9]+)",n={fourOctet:new RegExp(`^${a}\\.${a}\\.${a}\\.${a}$`,"i"),threeOctet:new RegExp(`^${a}\\.${a}\\.${a}$`,"i"),twoOctet:new RegExp(`^${a}\\.${a}$`,"i"),longValue:new RegExp(`^${a}$`,"i")},i=new RegExp("^0[0-7]+$","i"),r=new RegExp("^0x[a-f0-9]+$","i"),s="%[0-9a-z]{1,}",o="(?:[0-9a-f]+::?)+",l={zoneIndex:new RegExp(s,"i"),native:new RegExp(`^(::)?(${o})?([0-9a-f]+)?(::)?(${s})?$`,"i"),deprecatedTransitional:new RegExp(`^(?:::)(${a}\\.${a}\\.${a}\\.${a}(${s})?)$`,"i"),transitional:new RegExp(`^((?:${o})|(?:::)(?:${o})?)${a}\\.${a}\\.${a}\\.${a}(${s})?$`,"i")};function c(e,t){if(e.indexOf("::")!==e.lastIndexOf("::"))return null;let a,n,i=0,r=-1,s=(e.match(l.zoneIndex)||[])[0];for(s&&(s=s.substring(1),e=e.replace(/%.+$/,""));(r=e.indexOf(":",r+1))>=0;)i++;if("::"===e.substr(0,2)&&i--,"::"===e.substr(-2,2)&&i--,i>t)return null;for(n=t-i,a=":";n--;)a+="0:";return":"===(e=e.replace("::",a))[0]&&(e=e.slice(1)),":"===e[e.length-1]&&(e=e.slice(0,-1)),{parts:t=function(){const t=e.split(":"),a=[];for(let e=0;e<t.length;e++)a.push(parseInt(t[e],16));return a}(),zoneId:s}}function u(e,t,a,n){if(e.length!==t.length)throw new Error("ipaddr: cannot match CIDR for objects with different lengths");let i,r=0;for(;n>0;){if(i=a-n,i<0&&(i=0),e[r]>>i!=t[r]>>i)return!1;n-=a,r+=1}return!0}function d(e){if(r.test(e))return parseInt(e,16);if("0"===e[0]&&!isNaN(parseInt(e[1],10))){if(i.test(e))return parseInt(e,8);throw new Error(`ipaddr: cannot parse ${e} as octal`)}return parseInt(e,10)}function p(e,t){for(;e.length<t;)e=`0${e}`;return e}const m={};m.IPv4=function(){function e(e){if(4!==e.length)throw new Error("ipaddr: ipv4 octet count should be 4");let t,a;for(t=0;t<e.length;t++)if(a=e[t],!(0<=a&&a<=255))throw new Error("ipaddr: ipv4 octet should fit in 8 bits");this.octets=e}return e.prototype.SpecialRanges={unspecified:[[new e([0,0,0,0]),8]],broadcast:[[new e([255,255,255,255]),32]],multicast:[[new e([224,0,0,0]),4]],linkLocal:[[new e([169,254,0,0]),16]],loopback:[[new e([127,0,0,0]),8]],carrierGradeNat:[[new e([100,64,0,0]),10]],private:[[new e([10,0,0,0]),8],[new e([172,16,0,0]),12],[new e([192,168,0,0]),16]],reserved:[[new e([192,0,0,0]),24],[new e([192,0,2,0]),24],[new e([192,88,99,0]),24],[new e([198,51,100,0]),24],[new e([203,0,113,0]),24],[new e([240,0,0,0]),4]]},e.prototype.kind=function(){return"ipv4"},e.prototype.match=function(e,t){let a;if(void 0===t&&(a=e,e=a[0],t=a[1]),"ipv4"!==e.kind())throw new Error("ipaddr: cannot match ipv4 address with non-ipv4 one");return u(this.octets,e.octets,8,t)},e.prototype.prefixLengthFromSubnetMask=function(){let e=0,t=!1;const a={0:8,128:7,192:6,224:5,240:4,248:3,252:2,254:1,255:0};let n,i,r;for(n=3;n>=0;n-=1){if(i=this.octets[n],!(i in a))return null;if(r=a[i],t&&0!==r)return null;8!==r&&(t=!0),e+=r}return 32-e},e.prototype.range=function(){return m.subnetMatch(this,this.SpecialRanges)},e.prototype.toByteArray=function(){return this.octets.slice(0)},e.prototype.toIPv4MappedAddress=function(){return m.IPv6.parse(`::ffff:${this.toString()}`)},e.prototype.toNormalizedString=function(){return this.toString()},e.prototype.toString=function(){return this.octets.join(".")},e}(),m.IPv4.broadcastAddressFromCIDR=function(e){try{const t=this.parseCIDR(e),a=t[0].toByteArray(),n=this.subnetMaskFromPrefixLength(t[1]).toByteArray(),i=[];let r=0;for(;r<4;)i.push(parseInt(a[r],10)|255^parseInt(n[r],10)),r++;return new this(i)}catch(e){throw new Error("ipaddr: the address does not have IPv4 CIDR format")}},m.IPv4.isIPv4=function(e){return null!==this.parser(e)},m.IPv4.isValid=function(e){try{return new this(this.parser(e)),!0}catch(e){return!1}},m.IPv4.isValidFourPartDecimal=function(e){return!(!m.IPv4.isValid(e)||!e.match(/^(0|[1-9]\d*)(\.(0|[1-9]\d*)){3}$/))},m.IPv4.networkAddressFromCIDR=function(e){let t,a,n,i,r;try{for(t=this.parseCIDR(e),n=t[0].toByteArray(),r=this.subnetMaskFromPrefixLength(t[1]).toByteArray(),i=[],a=0;a<4;)i.push(parseInt(n[a],10)&parseInt(r[a],10)),a++;return new this(i)}catch(e){throw new Error("ipaddr: the address does not have IPv4 CIDR format")}},m.IPv4.parse=function(e){const t=this.parser(e);if(null===t)throw new Error("ipaddr: string is not formatted like an IPv4 Address");return new this(t)},m.IPv4.parseCIDR=function(e){let t;if(t=e.match(/^(.+)\/(\d+)$/)){const e=parseInt(t[2]);if(e>=0&&e<=32){const a=[this.parse(t[1]),e];return Object.defineProperty(a,"toString",{value:function(){return this.join("/")}}),a}}throw new Error("ipaddr: string is not formatted like an IPv4 CIDR range")},m.IPv4.parser=function(e){let t,a,i;if(t=e.match(n.fourOctet))return function(){const e=t.slice(1,6),n=[];for(let t=0;t<e.length;t++)a=e[t],n.push(d(a));return n}();if(t=e.match(n.longValue)){if(i=d(t[1]),i>4294967295||i<0)throw new Error("ipaddr: address outside defined range");return function(){const e=[];let t;for(t=0;t<=24;t+=8)e.push(i>>t&255);return e}().reverse()}return(t=e.match(n.twoOctet))?function(){const e=t.slice(1,4),a=[];if(i=d(e[1]),i>16777215||i<0)throw new Error("ipaddr: address outside defined range");return a.push(d(e[0])),a.push(i>>16&255),a.push(i>>8&255),a.push(255&i),a}():(t=e.match(n.threeOctet))?function(){const e=t.slice(1,5),a=[];if(i=d(e[2]),i>65535||i<0)throw new Error("ipaddr: address outside defined range");return a.push(d(e[0])),a.push(d(e[1])),a.push(i>>8&255),a.push(255&i),a}():null},m.IPv4.subnetMaskFromPrefixLength=function(e){if((e=parseInt(e))<0||e>32)throw new Error("ipaddr: invalid IPv4 prefix length");const t=[0,0,0,0];let a=0;const n=Math.floor(e/8);for(;a<n;)t[a]=255,a++;return n<4&&(t[n]=Math.pow(2,e%8)-1<<8-e%8),new this(t)},m.IPv6=function(){function e(e,t){let a,n;if(16===e.length)for(this.parts=[],a=0;a<=14;a+=2)this.parts.push(e[a]<<8|e[a+1]);else{if(8!==e.length)throw new Error("ipaddr: ipv6 part count should be 8 or 16");this.parts=e}for(a=0;a<this.parts.length;a++)if(n=this.parts[a],!(0<=n&&n<=65535))throw new Error("ipaddr: ipv6 part should fit in 16 bits");t&&(this.zoneId=t)}return e.prototype.SpecialRanges={unspecified:[new e([0,0,0,0,0,0,0,0]),128],linkLocal:[new e([65152,0,0,0,0,0,0,0]),10],multicast:[new e([65280,0,0,0,0,0,0,0]),8],loopback:[new e([0,0,0,0,0,0,0,1]),128],uniqueLocal:[new e([64512,0,0,0,0,0,0,0]),7],ipv4Mapped:[new e([0,0,0,0,0,65535,0,0]),96],rfc6145:[new e([0,0,0,0,65535,0,0,0]),96],rfc6052:[new e([100,65435,0,0,0,0,0,0]),96],"6to4":[new e([8194,0,0,0,0,0,0,0]),16],teredo:[new e([8193,0,0,0,0,0,0,0]),32],reserved:[[new e([8193,3512,0,0,0,0,0,0]),32]]},e.prototype.isIPv4MappedAddress=function(){return"ipv4Mapped"===this.range()},e.prototype.kind=function(){return"ipv6"},e.prototype.match=function(e,t){let a;if(void 0===t&&(a=e,e=a[0],t=a[1]),"ipv6"!==e.kind())throw new Error("ipaddr: cannot match ipv6 address with non-ipv6 one");return u(this.parts,e.parts,16,t)},e.prototype.prefixLengthFromSubnetMask=function(){let e=0,t=!1;const a={0:16,32768:15,49152:14,57344:13,61440:12,63488:11,64512:10,65024:9,65280:8,65408:7,65472:6,65504:5,65520:4,65528:3,65532:2,65534:1,65535:0};let n,i;for(let r=7;r>=0;r-=1){if(n=this.parts[r],!(n in a))return null;if(i=a[n],t&&0!==i)return null;16!==i&&(t=!0),e+=i}return 128-e},e.prototype.range=function(){return m.subnetMatch(this,this.SpecialRanges)},e.prototype.toByteArray=function(){let e;const t=[],a=this.parts;for(let n=0;n<a.length;n++)e=a[n],t.push(e>>8),t.push(255&e);return t},e.prototype.toFixedLengthString=function(){const e=function(){const e=[];for(let t=0;t<this.parts.length;t++)e.push(p(this.parts[t].toString(16),4));return e}.call(this).join(":");let t="";return this.zoneId&&(t=`%${this.zoneId}`),e+t},e.prototype.toIPv4Address=function(){if(!this.isIPv4MappedAddress())throw new Error("ipaddr: trying to convert a generic ipv6 address to ipv4");const e=this.parts.slice(-2),t=e[0],a=e[1];return new m.IPv4([t>>8,255&t,a>>8,255&a])},e.prototype.toNormalizedString=function(){const e=function(){const e=[];for(let t=0;t<this.parts.length;t++)e.push(this.parts[t].toString(16));return e}.call(this).join(":");let t="";return this.zoneId&&(t=`%${this.zoneId}`),e+t},e.prototype.toRFC5952String=function(){const e=/((^|:)(0(:|$)){2,})/g,t=this.toNormalizedString();let a,n=0,i=-1;for(;a=e.exec(t);)a[0].length>i&&(n=a.index,i=a[0].length);return i<0?t:`${t.substring(0,n)}::${t.substring(n+i)}`},e.prototype.toString=function(){return this.toNormalizedString().replace(/((^|:)(0(:|$))+)/,"::")},e}(),m.IPv6.isIPv6=function(e){return null!==this.parser(e)},m.IPv6.isValid=function(e){if("string"==typeof e&&-1===e.indexOf(":"))return!1;try{const t=this.parser(e);return new this(t.parts,t.zoneId),!0}catch(e){return!1}},m.IPv6.parse=function(e){const t=this.parser(e);if(null===t.parts)throw new Error("ipaddr: string is not formatted like an IPv6 Address");return new this(t.parts,t.zoneId)},m.IPv6.parseCIDR=function(e){let t,a,n;if((a=e.match(/^(.+)\/(\d+)$/))&&(t=parseInt(a[2]),t>=0&&t<=128))return n=[this.parse(a[1]),t],Object.defineProperty(n,"toString",{value:function(){return this.join("/")}}),n;throw new Error("ipaddr: string is not formatted like an IPv6 CIDR range")},m.IPv6.parser=function(e){let t,a,n,i,r,s;if(n=e.match(l.deprecatedTransitional))return this.parser(`::ffff:${n[1]}`);if(l.native.test(e))return c(e,8);if((n=e.match(l.transitional))&&(s=n[6]||"",t=c(n[1].slice(0,-1)+s,6),t.parts)){for(r=[parseInt(n[2]),parseInt(n[3]),parseInt(n[4]),parseInt(n[5])],a=0;a<r.length;a++)if(i=r[a],!(0<=i&&i<=255))return null;return t.parts.push(r[0]<<8|r[1]),t.parts.push(r[2]<<8|r[3]),{parts:t.parts,zoneId:t.zoneId}}return null},m.fromByteArray=function(e){const t=e.length;if(4===t)return new m.IPv4(e);if(16===t)return new m.IPv6(e);throw new Error("ipaddr: the binary input is neither an IPv6 nor IPv4 address")},m.isValid=function(e){return m.IPv6.isValid(e)||m.IPv4.isValid(e)},m.parse=function(e){if(m.IPv6.isValid(e))return m.IPv6.parse(e);if(m.IPv4.isValid(e))return m.IPv4.parse(e);throw new Error("ipaddr: the address has neither IPv6 nor IPv4 format")},m.parseCIDR=function(e){try{return m.IPv6.parseCIDR(e)}catch(t){try{return m.IPv4.parseCIDR(e)}catch(e){throw new Error("ipaddr: the address has neither IPv6 nor IPv4 CIDR format")}}},m.process=function(e){const t=this.parse(e);return"ipv6"===t.kind()&&t.isIPv4MappedAddress()?t.toIPv4Address():t},m.subnetMatch=function(e,t,a){let n,i,r,s;for(i in null==a&&(a="unicast"),t)if(Object.prototype.hasOwnProperty.call(t,i))for(r=t[i],!r[0]||r[0]instanceof Array||(r=[r]),n=0;n<r.length;n++)if(s=r[n],e.kind()===s[0].kind()&&e.match.apply(e,s))return i;return a},e.exports?e.exports=m:t.ipaddr=m}(this)},,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,function(e,t,a){"use strict";a.r(t),a.d(t,"subPluginClasses",(function(){return HU}));var n=a(2),i=a.n(n),r=a(71),s=a(4),o=a(103),l=a(63),c=a(363),u=a(199),d=a(118),p=a(169),m=a(102),b=a(111),g=a(116),f=a(110),y=a(1095),h=a(222),v=a(245),E=a(219),x=a(42),j=a(105),S=a(131),k=a(12);const O=(e,t)=>{const a=Object(o.useDispatch)(),{formatUrl:i}=Object(p.m)(S.a.timelines),r=Object(j.b)(b.b.selectInsertTimeline),s=Object(n.useCallback)(((a,n,r)=>{let s=`[${a}](${i(Object(p.l)(null!=n?n:"",r),{absolute:!0,skipSearch:!0})})`;Object(x.isEmpty)(e)||(s=`${e} ${s}`),t(s)}),[e,t,i]);return Object(n.useEffect)((()=>{null!=r&&null!=e&&(a(b.a.showTimeline({id:r.timelineId,show:!1})),s(r.timelineTitle,r.timelineSavedObjectId,r.graphEventId),a(Object(k.setInsertTimeline)(null)))}),[r,a,s,e]),{handleOnTimelineChange:s}};var w=a(942),T=a(690),I=a(233),C=a(232),M=a(534);const _=e=>{const{selectedPatterns:t}=Object(g.d)(f.SourcererScopeName.detections),a=Object(n.useMemo)((()=>Object(M.a)(e)),[e]),{loading:i,data:r}=Object(I.a)({query:a,indexName:t[0],queryName:C.a.CASES});return[i,Object(n.useMemo)((()=>{var e;return null!==(e=null==r?void 0:r.hits.hits.reduce(((e,{_id:t,_index:a,_source:n})=>({...e,[t]:{...Object(M.b)(n),_id:t,_index:a,timestamp:n["@timestamp"]}})),{}))&&void 0!==e?e:{}}),[null==r?void 0:r.hits.hits])]},F=()=>{const{browserFields:e,runtimeMappings:t}=Object(g.d)(f.SourcererScopeName.detections);return i.a.createElement(T.a,{browserFields:e,entityType:"events",isFlyoutView:!0,runtimeMappings:t,scopeId:d.c.casePage})},A=()=>{const{cases:e}=Object(m.j)().services,{getAppUrl:t,navigateTo:a}=Object(m.l)(),r=Object(m.h)(),g=Object(o.useDispatch)(),{formatUrl:f,search:x}=Object(p.m)(s.wc.rules),j=Object(n.useCallback)((e=>f(Object(p.i)(null!=e?e:"",x))),[f,x]),S=Object(n.useCallback)(((e,t)=>{g(b.a.toggleDetailPanel({panelView:"eventDetail",id:d.c.casePage,params:{eventId:e,indexName:t}}))}),[g]),k=Object(n.useCallback)((()=>{g(b.a.createTimeline({id:d.c.casePage,columns:[],dataViewId:null,indexNames:[],expandedDetail:{},show:!1}))}),[g]),T=Object(n.useRef)(null),{activeStep:I,endTourStep:C,isTourShown:M}=Object(c.b)(),A=Object(n.useMemo)((()=>I===u.a.viewCase&&M(u.b.alertsCases)),[I,M]);return Object(n.useEffect)((()=>{A&&C(u.b.alertsCases)}),[C,A]),i.a.createElement(h.a,{noPadding:!0},i.a.createElement(y.a.Provider,{value:T},e.ui.getCases({basePath:s.r,owner:[s.i],features:{metrics:[l.CaseMetricsFeature.ALERTS_COUNT,l.CaseMetricsFeature.ALERTS_USERS,l.CaseMetricsFeature.ALERTS_HOSTS,l.CaseMetricsFeature.CONNECTORS,l.CaseMetricsFeature.LIFESPAN],alerts:{isExperimental:!1}},refreshRef:T,onComponentInitialized:k,actionsNavigation:{href:e=>t({path:Object(v.d)({name:"endpointActivityLog",selected_endpoint:e})}),onClick:(e,t)=>(t&&t.preventDefault(),a({path:Object(v.d)({name:"endpointActivityLog",selected_endpoint:e})}))},ruleDetailsNavigation:{href:j,onClick:async(e,t)=>(t&&t.preventDefault(),a({deepLinkId:s.wc.rules,path:Object(p.i)(null!=e?e:"")}))},showAlertDetails:S,timelineIntegration:{editor_plugins:{parsingPlugin:w.a,processingPluginRenderer:w.c,uiPlugin:w.b},hooks:{useInsertTimeline:O},ui:{renderTimelineDetailsPanel:F}},useFetchAlertData:_,permissions:r})),i.a.createElement(E.a,{pageName:s.wc.case}))},D=i.a.memo(A),N=({children:e,...t})=>{const{services:{securityLayout:{getPluginWrapper:a}}}=Object(m.j)(),n=a();return i.a.createElement(n,t,e)},P=[{path:s.r,component:()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:"case"},i.a.createElement(D,null)))}];var R=a(119),L=a(714),B=a(45),q=a(264),z=a(526),$=a(5);const V=$.i18n.translate("xpack.securitySolution.alerts.badge.readOnly.tooltip",{defaultMessage:"Unable to update alerts"});var U=a(40),H=a(41),G=a.n(H),Q=a(59),W=a(1048),K=a(124),Y=a(114),J=a(134),X=a(384),Z=a(201),ee=a(423),te=a(138),ae=a(151);const ne=$.i18n.translate("xpack.securitySolution.detectionEngine.noApiIntegrationKeyCallOutTitle",{defaultMessage:"API integration key required"}),ie=$.i18n.translate("xpack.securitySolution.detectionEngine.noApiIntegrationKeyCallOutMsg",{defaultMessage:"A new encryption key is generated for saved objects each time you start Kibana. Without a persistent key, you cannot delete or modify rules after Kibana restarts. To set a persistent key, add the xpack.encryptedSavedObjects.encryptionKey setting with any text value of 32 or more characters to the kibana.yml file."}),re=$.i18n.translate("xpack.securitySolution.detectionEngine.dismissNoApiIntegrationKeyButton",{defaultMessage:"Dismiss"}),se=()=>{const[e,t]=Object(n.useState)(!0),a=Object(n.useCallback)((()=>t(!1)),[t]);return e?i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiCallOut,{title:ne,color:"danger",iconType:"warning"},i.a.createElement("p",null,ie),i.a.createElement(U.EuiButton,{color:"danger",onClick:a},re)),i.a.createElement(U.EuiSpacer,{size:"l"})):null},oe=Object(n.memo)(se);var le=a(181),ce=a(1033),ue=a(586);const de=({needsListsIndex:e,needsSignalsIndex:t})=>{const a=Object(m.j)().services.docLinks,r=Object(n.useMemo)((()=>({detections:{icon:"documents",label:ue.c,url:`${a.links.siem.detectionsReq}`,target:"_blank"}})),[a]),s=((e,t)=>t&&e?ue.f(ue.h):t?ue.f(ue.i):e?ue.f(ue.g):ue.f(""))(e,t);return i.a.createElement(ce.a,{actions:r,"data-test-subj":"no_index",message:s,title:ue.j})},pe=i.a.memo(de);var me=a(695);const be=i.a.memo((()=>{const e=Object(m.j)().services.docLinks,t=Object(n.useMemo)((()=>({detectionUnauthenticated:{icon:"documents",label:ue.c,url:`${e.links.siem.detectionsReq}`,target:"_blank"}})),[e]);return i.a.createElement(ce.a,{actions:t,message:ue.l,"data-test-subj":"no_index",title:ue.m})}));be.displayName="DetectionEngineUserUnauthenticated";var ge=a(123),fe=a(178),ye=a(861),he=a(148),ve=a(312),Ee=a(680);const xe=({category:e,page:t,setting:a})=>`${t}.${e}.${a}`,je=e=>"string"!=typeof e||Object(x.isEmpty)(e.trim()),Se="alerts",ke="table",Oe="treemap",we="stack-by-0",Te="stack-by-1",Ie="view";var Ce=a(521);const Me=$.i18n.translate("xpack.securitySolution.components.chartSelect.selectAChartAriaLabel",{defaultMessage:"Select a chart"}),_e=$.i18n.translate("xpack.securitySolution.components.chartSelect.tableOption",{defaultMessage:"Table"}),Fe=$.i18n.translate("xpack.securitySolution.components.chartSelect.trendOption",{defaultMessage:"Trend"}),Ae=$.i18n.translate("xpack.securitySolution.components.chartSelect.treemapOption",{defaultMessage:"Treemap"}),De=$.i18n.translate("xpack.securitySolution.components.chartSelect.chartsOption",{defaultMessage:"Charts"}),Ne=$.i18n.translate("xpack.securitySolution.components.chartSelect.tableOptionTitle",{defaultMessage:"Counts"}),Pe=$.i18n.translate("xpack.securitySolution.components.chartSelect.chartsOptionTitle",{defaultMessage:"Summary"}),Re=$.i18n.translate("xpack.securitySolution.components.chartSelect.legendTitle",{defaultMessage:"Select a tab"}),Le="table",Be="trend",qe="treemap",ze="charts",$e=e=>{const t={"data-test-subj":e,icon:"visTable",name:_e};switch(e){case Le:return t;case Be:return{"data-test-subj":e,icon:"visBarVerticalStacked",name:Fe};case qe:return{"data-test-subj":e,icon:"grid",name:Ae};case ze:return{"data-test-subj":e,icon:"visPie",name:De};default:return t}};var Ve=a(149);const Ue=$.i18n.translate("xpack.securitySolution.components.chartSettingsPopover.ariaLabel",{defaultMessage:"Chart settings"}),He=({initialPanelId:e,isPopoverOpen:t,panels:a,setIsPopoverOpen:r})=>{const s=Object(n.useCallback)((()=>r((e=>!e))),[r]),o=Object(n.useCallback)((()=>r(!1)),[r]),l=Object(n.useMemo)((()=>i.a.createElement(U.EuiButtonIcon,{"aria-label":Ue,color:"text",iconType:"boxesHorizontal",onClick:s,size:"xs"})),[s]);return i.a.createElement(U.EuiPopover,{anchorPosition:"downCenter",button:l,className:Ve.a,closePopover:o,isOpen:t,panelPaddingSize:"none"},i.a.createElement(U.EuiContextMenu,{initialPanelId:e,panels:a}))};He.displayName="ChartSettingsPopoverComponent";const Ge=i.a.memo(He);var Qe=a(561),We=a(920);const Ke="default-initial-panel",Ye=({defaultStackByField:e,defaultStackByField1:t,onReset:a=x.noop,queryId:r,setStackBy:s,setStackByField1:o})=>{const l=Object(n.useCallback)((()=>{a(),s(e),null!=o&&o(t)}),[e,t,a,s,o]),{defaultInitialPanelId:c,defaultMenuItems:u,isPopoverOpen:d,setIsPopoverOpen:p}=(({onResetStackByFields:e,queryId:t})=>{const[a,i]=Object(n.useState)(!1),{handleClick:r}=Object(Qe.a)({queryId:t}),s=Object(n.useMemo)((()=>[{id:Ke,items:[{icon:"inspect",name:We.a,onClick:()=>{i(!1),r()}},{name:We.b,onClick:()=>{i(!1),e()}}]}]),[r,e]);return{defaultInitialPanelId:Ke,defaultMenuItems:s,isPopoverOpen:a,setIsPopoverOpen:i}})({onResetStackByFields:l,queryId:r});return i.a.createElement(Ge,{initialPanelId:c,isPopoverOpen:d,panels:u,setIsPopoverOpen:p})};Ye.displayName="ChartContextMenuComponent";const Je=i.a.memo(Ye),Xe=G()(U.EuiIcon).withConfig({displayName:"ChartTypeIcon",componentId:"sc-1h1vv4p-0"})(["margin-right:",";"],(({theme:e})=>e.eui.euiSizeS)),Ze=["charts","trend","table","treemap"],et=({alertViewSelection:e,setAlertViewSelection:t})=>{const[a,r]=Object(n.useState)(!1),s=Object(n.useCallback)((()=>r(!1)),[]),o=Object(n.useCallback)((()=>r((e=>!e))),[]),l=Object(n.useMemo)((()=>{const t=$e(e);return i.a.createElement(U.EuiButton,{"aria-label":Me,className:"kbnToolbarButton",color:"text","data-test-subj":"chartSelect",iconSide:"right",iconType:"arrowDown",onClick:o},i.a.createElement(Xe,{type:t.icon}),i.a.createElement("span",null,t.name))}),[e,o]),c=Object(K.a)("alertsPageChartsEnabled"),u=Object(n.useMemo)((()=>Ze.map((e=>(e=>{const t={id:ze,"data-test-subj":`chart-select-${ze}`,label:Pe,value:ze};switch(e){case Le:return{id:Le,"data-test-subj":`chart-select-${Le}`,label:Ne,value:Le};case Be:return{id:Be,"data-test-subj":`chart-select-${Be}`,label:Fe,value:Be};case qe:return{id:qe,"data-test-subj":`chart-select-${qe}`,label:Ae,value:qe};default:return t}})(e)))),[]),d=Object(n.useMemo)((()=>(({alertViewSelection:e,closePopover:t,setAlertViewSelection:a,isAlertsPageChartsEnabled:n})=>[{id:0,items:[{...$e("table"),onClick:()=>{t(),a("table")}},{...$e("trend"),onClick:()=>{t(),a("trend")}},{...$e("treemap"),onClick:()=>{t(),a("treemap")}},...n?[{...$e("charts"),onClick:()=>{t(),a("charts")}}]:[]]}])({alertViewSelection:e,closePopover:s,setAlertViewSelection:t,isAlertsPageChartsEnabled:c})),[e,s,t,c]);return i.a.createElement(i.a.Fragment,null,c?i.a.createElement(U.EuiButtonGroup,{name:"chart-select",legend:Re,options:u,idSelected:e,onChange:e=>t(e),buttonSize:"compressed",color:"primary","data-test-subj":"chart-select-tabs"}):i.a.createElement(U.EuiPopover,{anchorPosition:"downLeft",button:l,closePopover:s,isOpen:a,panelPaddingSize:"none"},i.a.createElement(U.EuiContextMenu,{initialPanelId:0,panels:d})))};et.displayName="ChartSelectComponent";const tt=i.a.memo(et);var at=a(129),nt=a(47),it=a(8);const rt=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByGrouping.chartTitle",{defaultMessage:"Top alerts by"}),st=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByGrouping.noItemsFoundMessage",{defaultMessage:"No items found"}),ot=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByGrouping.otherGroup",{defaultMessage:"Other"}),lt=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByGrouping.hostNameLabel",{defaultMessage:"host"}),ct=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByGrouping.userNameLabel",{defaultMessage:"user"}),ut=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByGrouping.destinationLabel",{defaultMessage:"destination"}),dt=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByGrouping.sourceLabel",{defaultMessage:"source"}),pt=e=>e>0&&e<.01?"<1%":`${(Math.round(1e3*e)/10).toString()}%`,mt={"host.name":lt,"user.name":ct,"source.ip":dt,"destination.ip":ut};var bt=a(49),gt=a(391),ft=a(218);const yt=$.i18n.translate("xpack.securitySolution.detectionResponse.alertsByStatus.donut.criticalLabel",{defaultMessage:"Critical"}),ht=$.i18n.translate("xpack.securitySolution.detectionResponse.alertsByStatus.donut.highLabel",{defaultMessage:"High"}),vt=$.i18n.translate("xpack.securitySolution.detectionResponse.alertsByStatus.donut.mediumLabel",{defaultMessage:"Medium"}),Et=$.i18n.translate("xpack.securitySolution.detectionResponse.alertsByStatus.donut.lowLabel",{defaultMessage:"Low"}),xt=$.i18n.translate("xpack.securitySolution.detectionResponse.alertsByStatus.status.acknowledged",{defaultMessage:"Acknowledged"}),jt=$.i18n.translate("xpack.securitySolution.detectionResponse.status.open",{defaultMessage:"Open"}),St=$.i18n.translate("xpack.securitySolution.detectionResponse.status.closed",{defaultMessage:"Closed"}),kt=$.i18n.translate("xpack.securitySolution.detectionResponse.status.inProgress",{defaultMessage:"In progress"}),Ot=$.i18n.translate("xpack.securitySolution.detectionResponse.alerts",{defaultMessage:"Alerts"}),wt=$.i18n.translate("xpack.securitySolution.detectionResponse.alertsBySeverity",{defaultMessage:"Alerts by Severity"}),Tt=($.i18n.translate("xpack.securitySolution.detectionResponse.updating",{defaultMessage:"Updating..."}),$.i18n.translate("xpack.securitySolution.detectionResponse.updated",{defaultMessage:"Updated"}),$.i18n.translate("xpack.securitySolution.detectionResponse.casesByStatusSectionTitle",{defaultMessage:"Cases"})),It=$.i18n.translate("xpack.securitySolution.detectionResponse.casesByStatusSectionTooltip",{defaultMessage:"The cases table is not filterable via the SIEM global KQL search."}),Ct=$.i18n.translate("xpack.securitySolution.detectionResponse.viewCases",{defaultMessage:"View cases"}),Mt=$.i18n.translate("xpack.securitySolution.detectionResponse.ruleAlertsSectionTitle",{defaultMessage:"Open alerts by rule"}),_t=$.i18n.translate("xpack.securitySolution.detectionResponse.hostAlertsSectionTitle",{defaultMessage:"Hosts by alert severity"}),Ft=$.i18n.translate("xpack.securitySolution.detectionResponse.userAlertsSectionTitle",{defaultMessage:"Users by alert severity"}),At=$.i18n.translate("xpack.securitySolution.detectionResponse.caseSectionTitle",{defaultMessage:"Recently created cases"}),Dt=$.i18n.translate("xpack.securitySolution.detectionResponse.caseSectionTooltip",{defaultMessage:"The recently created cases table is not filterable via the SIEM global KQL search."}),Nt=$.i18n.translate("xpack.securitySolution.detectionResponse.noRuleAlerts",{defaultMessage:"No alerts to display"}),Pt=$.i18n.translate("xpack.securitySolution.detectionResponse.noRecentCases",{defaultMessage:"No cases to display"}),Rt=$.i18n.translate("xpack.securitySolution.detectionResponse.ruleAlertsColumnRuleName",{defaultMessage:"Rule name"}),Lt=$.i18n.translate("xpack.securitySolution.detectionResponse.ruleAlertsColumnLastAlert",{defaultMessage:"Last alert"}),Bt=$.i18n.translate("xpack.securitySolution.detectionResponse.ruleAlertsColumnAlertCount",{defaultMessage:"Alert count"}),qt=$.i18n.translate("xpack.securitySolution.detectionResponse.ruleAlertsColumnSeverity",{defaultMessage:"Severity"}),zt=$.i18n.translate("xpack.securitySolution.detectionResponse.openRuleDetailTooltip",{defaultMessage:"Open rule detail"}),$t=$.i18n.translate("xpack.securitySolution.detectionResponse.openCaseDetailTooltip",{defaultMessage:"Open case detail"}),Vt=$.i18n.translate("xpack.securitySolution.detectionResponse.openHostDetailTooltip",{defaultMessage:"Open host detail"}),Ut=$.i18n.translate("xpack.securitySolution.detectionResponse.openUserDetailTooltip",{defaultMessage:"Open user detail"}),Ht=$.i18n.translate("xpack.securitySolution.detectionResponse.openAllAlertsButton",{defaultMessage:"View all open alerts"}),Gt=$.i18n.translate("xpack.securitySolution.detectionResponse.viewRecentCases",{defaultMessage:"View recent cases"}),Qt=$.i18n.translate("xpack.securitySolution.detectionResponse.hostAlertsHostName",{defaultMessage:"Host name"}),Wt=$.i18n.translate("xpack.securitySolution.detectionResponse.userAlertsUserName",{defaultMessage:"User name"}),Kt=$.i18n.translate("xpack.securitySolution.detectionResponse.caseColumnName",{defaultMessage:"Name"}),Yt=$.i18n.translate("xpack.securitySolution.detectionResponse.caseColumnTime",{defaultMessage:"Time"}),Jt=$.i18n.translate("xpack.securitySolution.detectionResponse.caseColumnCreatedBy",{defaultMessage:"Created by"}),Xt=$.i18n.translate("xpack.securitySolution.detectionResponse.caseColumnStatus",{defaultMessage:"Status"}),Zt=$.i18n.translate("xpack.securitySolution.detectionResponse.errorMessage",{defaultMessage:"Error fetching case data"}),ea=$.i18n.translate("xpack.securitySolution.detectionResponse.hostSectionTooltip",{defaultMessage:"Maximum of 100 hosts. Please consult Alerts page for further information."}),ta=$.i18n.translate("xpack.securitySolution.detectionResponse.userSectionTooltip",{defaultMessage:"Maximum of 100 users. Please consult Alerts page for further information."}),aa=$.i18n.translate("xpack.securitySolution.detectionResponse.investigateInTimeline",{defaultMessage:"Investigate in Timeline"}),na=$.i18n.translate("xpack.securitySolution.detectionResponse.openInAlertsSeverity",{defaultMessage:"Severity"}),ia=$.i18n.translate("xpack.securitySolution.detectionResponse.openInAlertsStatus",{defaultMessage:"Status"}),ra=$.i18n.translate("xpack.securitySolution.detectionResponse.openInAlertsRuleName",{defaultMessage:"Rule name"}),sa=$.i18n.translate("xpack.securitySolution.detectionResponse.openInAlertsHostName",{defaultMessage:"Host name"}),oa=$.i18n.translate("xpack.securitySolution.detectionResponse.openInAlertsUserName",{defaultMessage:"Username"}),la={critical:yt,high:ht,medium:vt,low:Et},ca=({additionalFilters:e=[],from:t,to:a,entityFilter:n})=>({size:0,query:{bool:{filter:[...e,{range:{"@timestamp":{gte:t,lte:a}}},...n?[{term:{[n.field]:n.value}}]:[]]}},aggs:{alertsByStatus:{terms:{field:"kibana.alert.workflow_status"},aggs:{statusBySeverity:{terms:{field:"kibana.alert.severity"}}}}}});var ua=a(725),da=a(499);const pa=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.severity.severityDonutTitle",{defaultMessage:"Severity levels"}),ma=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.severity.unknown",{defaultMessage:"Unknown"}),ba=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.severity.severityTableLevelColumn",{defaultMessage:"Levels"}),ga=e=>{var t;return null!==(t=da.b[e.toLocaleLowerCase()])&&void 0!==t?t:ua.b},fa=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByType.alertTypeChartTitle",{defaultMessage:"Alerts by type"}),ya=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByType.alertRuleChartTitle",{defaultMessage:"Alerts by name"}),ha=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByType.typeColumn",{defaultMessage:"Type"}),va=($.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByType.preventions",{defaultMessage:"Preventions"}),$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByType.detections",{defaultMessage:"Detections"}),$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByType.prevention",{defaultMessage:"Prevention"})),Ea=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByType.detection",{defaultMessage:"Detection"}),xa={Detection:"#D36086",Prevention:"#54B399"},ja={Detection:Ea,Prevention:va},Sa=e=>(e=>Object(it.has)(e,"aggregations.statusBySeverity"))(e)?(e=>{var t,a,n;const i=null!==(t=null==e||null===(a=e.aggregations)||void 0===a||null===(n=a.statusBySeverity)||void 0===n?void 0:n.buckets)&&void 0!==t?t:[];return 0===i.length?[]:i.map((e=>{var t;return{key:e.key,value:e.doc_count,label:null!==(t=la[e.key])&&void 0!==t?t:ma}}))})(e):(e=>Object(it.has)(e,"aggregations.alertsByType"))(e)?(e=>{var t,a,n;const i=null!==(t=null==e||null===(a=e.aggregations)||void 0===a||null===(n=a.alertsByType)||void 0===n?void 0:n.buckets)&&void 0!==t?t:[];return 0===i.length?[]:i.flatMap((e=>{var t,a;const n=null!==(t=null===(a=e.ruleByEventType)||void 0===a?void 0:a.buckets)&&void 0!==t?t:[];return((e,t,a)=>{const n=a.find((e=>"denied"===e.key));if(!n)return[{rule:e,type:"Detection",value:t,color:xa.Detection}];const i=[];return n.doc_count<t&&i.push({rule:e,type:"Detection",value:t-n.doc_count,color:xa.Detection}),i.push({rule:e,type:"Prevention",value:n.doc_count,color:xa.Prevention}),i})(e.key,e.doc_count,n)}))})(e):(e=>Object(it.has)(e,"aggregations.alertsByRule"))(e)?(e=>{var t,a,n;const i=null!==(t=null==e||null===(a=e.aggregations)||void 0===a||null===(n=a.alertsByRule)||void 0===n?void 0:n.buckets)&&void 0!==t?t:[];return 0===i.length?[]:i.map((e=>({rule:e.key,type:"Detection",value:e.doc_count,color:xa.Detection})))})(e):(e=>Object(it.has)(e,"aggregations.alertsByGrouping"))(e)?(e=>{var t,a,n,i,r,s,o,l,c;const u=null!==(t=null==e||null===(a=e.aggregations)||void 0===a||null===(n=a.alertsByGrouping)||void 0===n?void 0:n.buckets)&&void 0!==t?t:[],d=null!==(i=null==e||null===(r=e.aggregations)||void 0===r||null===(s=r.missingFields)||void 0===s?void 0:s.doc_count)&&void 0!==i?i:0;if(0===u.length&&0===d)return[];const p=null!==(o=null==e||null===(l=e.aggregations)||void 0===l||null===(c=l.alertsByGrouping)||void 0===c?void 0:c.sum_other_doc_count)&&void 0!==o?o:0,m=u.reduce(((e,t)=>e+t.doc_count),0)+p+d,b=u.map((e=>({key:e.key,value:e.doc_count,percentage:e.doc_count/m,percentageLabel:pt(e.doc_count/m),label:e.key})));return p>0&&b.push({key:"Other",value:p,percentage:p/m,percentageLabel:pt(p/m),label:ot}),d>0&&b.push({key:"-",value:d,percentage:d/m,percentageLabel:pt(d/m),label:"-"}),b})(e):(e=>Object(it.has)(e,"aggregations.severities")&&Object(it.has)(e,"aggregations.topRule")&&Object(it.has)(e,"aggregations.topGrouping"))(e)?(e=>{var t,a,n,i,r,s,o,l,c,u,d,p,m;const b={rule:null,group:null,severities:[]};b.rule=null!==(t=null==e||null===(a=e.aggregations)||void 0===a||null===(n=a.topRule)||void 0===n||null===(i=n.buckets)||void 0===i||null===(r=i.at(0))||void 0===r?void 0:r.key)&&void 0!==t?t:null,b.group=null!==(s=null==e||null===(o=e.aggregations)||void 0===o||null===(l=o.topGrouping)||void 0===l||null===(c=l.buckets)||void 0===c||null===(u=c.at(0))||void 0===u?void 0:u.key)&&void 0!==s?s:null;const g=null!==(d=null==e||null===(p=e.aggregations)||void 0===p||null===(m=p.severities)||void 0===m?void 0:m.buckets)&&void 0!==d?d:[];return g.length>0?(b.severities=g.map((e=>{var t;return{key:e.key,value:e.doc_count,label:null!==(t=la[e.key])&&void 0!==t?t:ma}})),[b]):[]})(e):[],ka=({additionalFilters:e=[],from:t,to:a,entityFilter:n,runtimeMappings:i,aggregations:r})=>({size:0,query:{bool:{filter:[...e,{range:{"@timestamp":{gte:t,lte:a}}},...n?[{term:{[n.field]:n.value}}]:[]]}},aggs:r,runtime_mappings:i}),Oa=({aggregations:e,uniqueQueryId:t,entityFilter:a,query:i,filters:r,runtimeMappings:s,signalIndexName:o,skip:l=!1})=>{const{to:c,from:u,deleteQuery:d,setQuery:p}=Object(J.a)(),[m,b]=Object(n.useState)(Date.now()),[g,f]=Object(n.useState)([]),y=Object(n.useMemo)((()=>{try{var e;return[Object(bt.buildEsQuery)(void 0,null!=i?[i]:[],null!==(e=null==r?void 0:r.filter((e=>!1===e.meta.disabled)))&&void 0!==e?e:[])]}catch(e){return[]}}),[i,r]),{data:h,loading:v,refetch:E,request:x,response:j,setQuery:S}=Object(I.a)({query:ka({from:u,to:c,entityFilter:a,additionalFilters:y,runtimeMappings:s,aggregations:e}),indexName:o,skip:l,queryName:C.a.COUNT});Object(n.useEffect)((()=>{S(ka({from:u,to:c,entityFilter:a,additionalFilters:y,runtimeMappings:s,aggregations:e}))}),[S,u,c,a,y,s,e]),Object(n.useEffect)((()=>{f(null==h?[]:Sa(h)),b(Date.now())}),[h]);const k=Object(n.useCallback)((()=>{!l&&E&&E()}),[l,E]);return Object(gt.a)({deleteQuery:d,loading:v,response:j,setQuery:p,refetch:k,request:x,uniqueQueryId:t}),{items:g,isLoading:v,updatedAt:m}};var wa=a(294);const Ta=$.i18n.translate("xpack.securitySolution.components.chartCollapse.topRule",{defaultMessage:"Top alerted rule: "}),Ia=$.i18n.translate("xpack.securitySolution.components.chartCollapse.topGroup",{defaultMessage:"Top alerted"}),Ca=$.i18n.translate("xpack.securitySolution.components.chartCollapse.noResultMessage",{defaultMessage:"None"}),Ma=G()(U.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-7qk19-0"})(["margin-top:",";@media only screen and (min-width:",");"],(({theme:e})=>e.eui.euiSizeXS),(({theme:e})=>e.eui.euiBreakpoints.l)),_a=G()(U.EuiFlexItem).withConfig({displayName:"SeverityWrapper",componentId:"sc-7qk19-1"})(["min-width:380px;"]),Fa=G()(U.EuiText).withConfig({displayName:"StyledEuiText",componentId:"sc-7qk19-2"})(["border-left:1px solid ",";padding-left:",";max-width:250px;"],(({theme:e})=>e.eui.euiColorLightShade),(({theme:e})=>e.eui.euiSizeL)),Aa=({groupBySelection:e,filters:t,query:a,signalIndexName:r,runtimeMappings:s})=>{const o=Object(n.useMemo)((()=>`detectioin-alerts-collapsed-chart-${Object(nt.v4)()}`),[]),l=Object(n.useMemo)((()=>(e=>({severities:{terms:{field:at.U,min_doc_count:0}},topRule:{terms:{field:at.D,size:1}},topGrouping:{terms:{field:e,size:1}}}))(e)),[e]),{items:c,isLoading:u}=Oa({aggregations:l,filters:t,query:a,signalIndexName:r,runtimeMappings:s,uniqueQueryId:o}),d=Object(n.useMemo)((()=>(e=>null==e?void 0:e.every((e=>Object(it.has)(e,"rule")&&Object(it.has)(e,"group")&&Object(it.has)(e,"severities"))))(c)?c:[]),[c]),p=Object(n.useMemo)((()=>{var e,t;return null!==(e=null===(t=d.at(0))||void 0===t?void 0:t.rule)&&void 0!==e?e:Ca}),[d]),m=Object(n.useMemo)((()=>{var e,t;return null!==(e=null===(t=d.at(0))||void 0===t?void 0:t.group)&&void 0!==e?e:Ca}),[d]),b=Object(n.useMemo)((()=>{var e,t;const a=null!==(e=null===(t=d.at(0))||void 0===t?void 0:t.severities)&&void 0!==e?e:[];return Object.keys(da.b).map((e=>{const t=a.find((t=>t.key===e));return t?{key:t.key,label:t.label,value:t.value}:{key:e,label:Object(it.capitalize)(e),value:0}}))}),[d]),g=Object(n.useMemo)((()=>mt[e]),[e]);return i.a.createElement(Ve.c,null,!u&&i.a.createElement(Ma,{alignItems:"center","data-test-subj":"chart-collapse",wrap:!0},i.a.createElement(_a,{grow:!1},i.a.createElement(U.EuiFlexGroup,{"data-test-subj":"chart-collapse-severities"},b.map((e=>i.a.createElement(U.EuiFlexItem,{key:e.key,grow:!1},i.a.createElement(U.EuiHealth,{color:ga(e.key)},i.a.createElement(U.EuiText,{size:"xs"},`${e.label}: `,i.a.createElement(wa.a,{count:e.value||0})))))))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(Fa,{size:"xs",className:"eui-textTruncate","data-test-subj":"chart-collapse-top-rule"},i.a.createElement("strong",null,Ta),p)),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceBetween",alignItems:"center"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(Fa,{size:"xs",className:"eui-textTruncate","data-test-subj":"chart-collapse-top-group"},i.a.createElement("strong",null,`${Ia} ${g}: `),m)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(Ve.b,{isDisabled:!1,queryId:o,title:"chart collapse"}))))))};Aa.displayName="ChartCollapse";var Da=a(57),Na=a(297),Pa=a(424),Ra=a(739);const La=({riskScore:e,colorPalette:t})=>{const a=Math.min(100,t.length);return t[Object(x.clamp)(0,a,e)]};var Ba=a(517);const qa=({buckets:e,maxRiskSubAggregations:t,stackByField0:a})=>e.flatMap((e=>(({bucket:e,maxRiskSubAggregations:t})=>{var a,n,i;return null!==(a=null===(n=e.stackByField1)||void 0===n||null===(i=n.buckets)||void 0===i?void 0:i.map((t=>{var a,n;return{doc_count:e.doc_count,key:null!==(a=e.key_as_string)&&void 0!==a?a:e.key,maxRiskSubAggregation:e.maxRiskSubAggregation,stackByField1Key:null!==(n=t.key_as_string)&&void 0!==n?n:Object(Ba.a)(t.key),stackByField1DocCount:t.doc_count}})))&&void 0!==a?a:[]})({bucket:e,maxRiskSubAggregations:t})));var za=a(153);const $a=$.i18n.translate("xpack.securitySolution.components.alertsTreemap.noDataLabel",{defaultMessage:"No data to display"}),Va=e=>$.i18n.translate("xpack.securitySolution.components.alertsTreemap.noDataReasonLabel",{values:{stackByField1:e},defaultMessage:"The {stackByField1} field was not present in any groups"}),Ua=({baseLabel:e,riskScore:t})=>null!=t?`${e} ${(e=>$.i18n.translate("xpack.securitySolution.components.alertsTreemap.riskLabel",{values:{riskScore:e},defaultMessage:"(Risk {riskScore})"}))(t)}`:e,Ha=({bucket:e,colorPalette:t,maxRiskSubAggregations:a,showColor:n,stackByField0:i})=>{var r,s,o,l;return{color:n?La({riskScore:null!==(r=a[null!==(s=Object(Ba.a)(e.key))&&void 0!==s?s:""])&&void 0!==r?r:0,colorPalette:t}):void 0,count:e.doc_count,dataProviderId:Object(za.i)(`draggable-legend-item-treemap-${i}-${e.key}-${Object(nt.v4)()}`),render:()=>{var t,a,n;return Ua({baseLabel:null!==(t=null!==(a=e.key_as_string)&&void 0!==a?a:Object(Ba.a)(e.key))&&void 0!==t?t:"",riskScore:null===(n=e.maxRiskSubAggregation)||void 0===n?void 0:n.value})},field:i,value:null!==(o=null!==(l=e.key_as_string)&&void 0!==l?l:Object(Ba.a)(e.key))&&void 0!==o?o:0}},Ga=({colorPalette:e,flattenedBucket:{key:t,stackByField1Key:a,stackByField1DocCount:n},maxRiskSubAggregations:i,stackByField0:r,stackByField1:s})=>{var o,l;return{color:La({riskScore:null!==(o=i[null!==(l=Object(Ba.a)(t))&&void 0!==l?l:""])&&void 0!==o?o:0,colorPalette:e}),count:n,dataProviderId:Object(za.i)(`draggable-legend-item-treemap-${t}-${a}-${Object(nt.v4)()}`),render:()=>`${a}`,field:`${s}`,value:`${a}`}},Qa=({buckets:e,maxItems:t})=>{var a;return null!==(a=null==e?void 0:e.slice(0,t))&&void 0!==a?a:[]},Wa=e=>e.reduce(((e,t)=>{var a,n,i;return{...e,[null!==(a=Object(Ba.a)(t.key))&&void 0!==a?a:""]:null!==(n=null===(i=t.maxRiskSubAggregation)||void 0===i?void 0:i.value)&&void 0!==n?n:void 0}}),{}),Ka=e=>{const t=e.flat(2);return{groupByField0:t.length>0&&"groupByRollup"in t[0]&&null!=t[0].groupByRollup?`${t[0].groupByRollup}`:"",groupByField1:t.length>1&&"groupByRollup"in t[1]&&null!=t[1].groupByRollup?`${t[1].groupByRollup}`:""}},Ya=e=>null!=e&&""!==e.trim(),Ja=e=>`${e}`,Xa=e=>e.key,Za=G()(U.EuiText).withConfig({displayName:"NoDataLabel",componentId:"sc-17b7hy-0"})(["text-align:center;"]),en=({reason:e})=>i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},i.a.createElement(U.EuiFlexItem,{grow:!0},i.a.createElement(Za,{color:"subdued","data-test-subj":"noDataLabel",size:"xs"},$a),null!=e&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement(Za,{color:"subdued","data-test-subj":"reasonLabel",size:"xs"},e))));en.displayName="NoDataComponent";const tn=i.a.memo(en),an=G.a.div.withConfig({displayName:"LegendContainer",componentId:"sc-1evqobh-0"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeS)),nn=G()(U.EuiFlexItem).withConfig({displayName:"ChartFlexItem",componentId:"sc-1evqobh-1"})(["min-height:",";"],(({$minChartHeight:e})=>`${e}px`)),rn=({addFilter:e,data:t,maxBuckets:a,minChartHeight:r=240,stackByField0:s,stackByField1:o})=>{var l,c,u;const{theme:d,baseTheme:p}=Object(Na.i)(),m=Object(n.useMemo)((()=>{var e,t;return null!==(e=null==d||null===(t=d.background)||void 0===t?void 0:t.color)&&void 0!==e?e:p.background.color}),[null==d||null===(l=d.background)||void 0===l?void 0:l.color,p.background.color]),b=Object(n.useMemo)((()=>({partition:{fillLabel:{valueFont:{fontWeight:700}},idealFontSizeJump:1.15,maxFontSize:16,minFontSize:4,sectorLineStroke:m,sectorLineWidth:1.5}})),[m]),g=Object(n.useMemo)((()=>{var e,n;return Qa({buckets:null===(e=t.aggregations)||void 0===e||null===(n=e.stackByField0)||void 0===n?void 0:n.buckets,maxItems:a})}),[null===(c=t.aggregations)||void 0===c||null===(u=c.stackByField0)||void 0===u?void 0:u.buckets,a]),f=Object(n.useMemo)((()=>Wa(g)),[g]),y=Object(n.useMemo)((()=>qa({buckets:g,maxRiskSubAggregations:f,stackByField0:s})),[g,f,s]),h=Object(n.useMemo)((()=>Array(101).fill(0).map(((e,t)=>t>=Ra.e?Ra.a:t>=Ra.f?Ra.b:t>=Ra.g?Ra.d:Ra.c))),[]),v=Object(n.useMemo)((()=>0===y.length?(({buckets:e,colorPalette:t,maxRiskSubAggregations:a,stackByField0:n})=>e.map((e=>Ha({bucket:e,colorPalette:t,maxRiskSubAggregations:a,showColor:!0,stackByField0:n}))))({buckets:g,colorPalette:h,maxRiskSubAggregations:f,stackByField0:s}):(({buckets:e,colorPalette:t,flattenedBuckets:a,maxRiskSubAggregations:n,stackByField0:i,stackByField1:r})=>{const s=(({buckets:e,colorPalette:t,maxRiskSubAggregations:a,stackByField0:n})=>e.reduce(((e,i)=>{var r;return{...e,[null!==(r=Object(Ba.a)(i.key))&&void 0!==r?r:""]:[Ha({bucket:i,colorPalette:t,maxRiskSubAggregations:a,showColor:!1,stackByField0:n})]}}),{}))({buckets:e,colorPalette:t,maxRiskSubAggregations:n,stackByField0:i}),o=a.reduce(((e,a)=>{var s,o,l;return{...e,[null!==(s=Object(Ba.a)(a.key))&&void 0!==s?s:""]:[...null!==(o=e[null!==(l=Object(Ba.a)(a.key))&&void 0!==l?l:""])&&void 0!==o?o:[],Ga({colorPalette:t,flattenedBucket:a,maxRiskSubAggregations:n,stackByField0:i,stackByField1:r})]}}),s);return e.reduce(((e,t)=>{var a;return[...e,...o[null!==(a=Object(Ba.a)(t.key))&&void 0!==a?a:""]]}),[])})({buckets:g,colorPalette:h,flattenedBuckets:y,maxRiskSubAggregations:f,stackByField0:s,stackByField1:o})),[g,h,y,f,s,o]),E=Object(n.useCallback)((t=>{const{groupByField0:a,groupByField1:n}=Ka(t);null==e||Object(x.isEmpty)(a.trim())||e({field:s,value:a}),null==e||Object(x.isEmpty)(null==o?void 0:o.trim())||Object(x.isEmpty)(n.trim())||e({field:`${o}`,value:n})}),[e,s,o]),j=Object(n.useMemo)((()=>Ya(o)?(({colorPalette:e,layer0FillColor:t,maxRiskSubAggregations:a})=>[{fillLabel:{valueFormatter:Ja},groupByRollup:Xa,nodeLabel:e=>Ua({baseLabel:e,riskScore:a[e]}),shape:{fillColor:t}},{fillLabel:{valueFormatter:Ja},groupByRollup:e=>e.stackByField1Key,nodeLabel:e=>`${e}`,shape:{fillColor:(t,n,i)=>{var r,s;const o=null!==(r=(e=>{const t=e.length-2;return t>0?e[t].value:void 0})(i.path))&&void 0!==r?r:"";return La({riskScore:null!==(s=a[o])&&void 0!==s?s:0,colorPalette:e})}}}])({colorPalette:h,layer0FillColor:m,maxRiskSubAggregations:f}):(({colorPalette:e,maxRiskSubAggregations:t})=>[{fillLabel:{valueFormatter:Ja},groupByRollup:Xa,nodeLabel:e=>Ua({baseLabel:e,riskScore:t[e]}),shape:{fillColor:a=>{var n;return La({riskScore:null!==(n=t[a])&&void 0!==n?n:0,colorPalette:e})}}}])({colorPalette:h,maxRiskSubAggregations:f})),[h,m,f,o]),S=Object(n.useMemo)((()=>Ya(o)?e=>e.stackByField1DocCount:e=>e.doc_count),[o]),k=Ya(o)?y:g;return 0===g.length?i.a.createElement(tn,null):i.a.createElement("div",{"data-test-subj":"alerts-treemap"},i.a.createElement(U.EuiFlexGroup,{gutterSize:"none"},i.a.createElement(nn,{grow:!0,$minChartHeight:r},null==o||Object(x.isEmpty)(o)||0!==k.length?i.a.createElement(Da.Chart,null,i.a.createElement(Da.Settings,{baseTheme:p,showLegend:!1,theme:[b,d],onElementClick:E}),i.a.createElement(Da.Partition,{data:k,id:"spec_1",layers:j,layout:Da.PartitionLayout.treemap,valueAccessor:S})):i.a.createElement(tn,{reason:Va(o)})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(an,null,v.length>0&&i.a.createElement(Pa.a,{className:"eui-yScroll",height:r,legendItems:v,minWidth:300})))))},sn=i.a.memo(rn);var on=a(646),ln=a(483);const cn=G()(U.EuiFlexItem).withConfig({displayName:"ChartOptionsFlexItem",componentId:"sc-vvwo8c-0"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeS)),un=({chartOptionsContextMenu:e,setStackByField0:t,setStackByField0ComboboxInputRef:a,setStackByField1:n,setStackByField1ComboboxInputRef:r,stackByField0:s,stackByField0ComboboxRef:o,stackByField1:l,stackByField1ComboboxRef:c,stackByWidth:u,uniqueQueryId:d,useLensCompatibleFields:p})=>i.a.createElement(U.EuiFlexGroup,{alignItems:"flexStart","data-test-subj":"fieldSelection",gutterSize:"none"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(on.b,{"aria-label":ln.a,ref:o,"data-test-subj":"groupBy",onSelect:t,prepend:ln.a,selected:s,inputRef:a,width:u,useLensCompatibleFields:p}),i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement(on.b,{"aria-label":ln.b,ref:c,"data-test-subj":"groupByTop",onSelect:n,prepend:ln.b,selected:null!=l?l:"",inputRef:r,width:u,useLensCompatibleFields:p})),i.a.createElement(U.EuiFlexItem,{grow:!1},null!=e&&i.a.createElement(cn,{grow:!1},e(d))));un.displayName="FieldSelectionComponent";const dn=i.a.memo(un);var pn=a(166);const mn=({stackByField1:e,stackByField1Size:t})=>null==e||Object(x.isEmpty)(e.trim())?{}:{stackByField1:{terms:{field:e,order:{_count:"desc"},size:t}}},bn=({additionalFilters:e=[],from:t,runtimeMappings:a,stackByField0:n,stackByField0Size:i=1e3,stackByField1:r,stackByField1Size:s=1e3,riskSubAggregationField:o,to:l})=>({size:0,aggs:{stackByField0:{terms:{field:n,order:{_count:"desc"},size:i},aggs:{...mn({stackByField1:r,stackByField1Size:s}),maxRiskSubAggregation:{max:{field:o}}}}},query:{bool:{filter:[...e,{range:{"@timestamp":{gte:t,lte:l}}}]}},runtime_mappings:a}),gn=({addFilter:e,alignHeader:t,chartOptionsContextMenu:a,inspectTitle:r,isPanelExpanded:s,filters:o,height:l=374,query:c,riskSubAggregationField:u,runtimeMappings:d,setIsPanelExpanded:p,setStackByField0:m,setStackByField0ComboboxInputRef:b,setStackByField1:g,setStackByField1ComboboxInputRef:f,signalIndexName:y,stackByField0:h,stackByField0ComboboxRef:v,stackByField1:E,stackByField1ComboboxRef:x,stackByWidth:j,title:S})=>{const{to:k,from:O,deleteQuery:w,setQuery:T}=Object(J.a)(),M=Object(n.useMemo)((()=>`alerts-treemap-${Object(nt.v4)()}`),[]),_=Object(n.useMemo)((()=>{try{var e;return[Object(bt.buildEsQuery)(void 0,null!=c?[c]:[],null!==(e=null==o?void 0:o.filter((e=>!1===e.meta.disabled)))&&void 0!==e?e:[])]}catch(e){return[]}}),[c,o]),{data:F,loading:A,refetch:D,request:N,response:P,setQuery:R}=Object(I.a)({query:bn({additionalFilters:_,from:O,riskSubAggregationField:u,runtimeMappings:d,stackByField0:h,stackByField1:E,to:k}),skip:!s,indexName:y,queryName:C.a.TREE_MAP});return Object(n.useEffect)((()=>{R(bn({additionalFilters:_,from:O,riskSubAggregationField:u,runtimeMappings:d,stackByField0:h,stackByField1:E,to:k}))}),[_,O,u,d,R,h,E,k]),Object(gt.a)({deleteQuery:w,loading:A,response:P,setQuery:T,refetch:D,request:N,uniqueQueryId:M}),i.a.createElement(Ve.c,null,i.a.createElement(on.a,{className:"eui-yScroll","data-test-subj":"treemapPanel",hasBorder:!0,height:s?l:64,$overflowY:s?"auto":"hidden",$toggleStatus:!0},i.a.createElement(pn.a,{alignHeader:t,hideSubtitle:!0,id:M,inspectTitle:r,outerDirection:"row",showInspectButton:null==a,title:S,titleSize:"s",toggleQuery:p,toggleStatus:s},s&&i.a.createElement(dn,{chartOptionsContextMenu:a,setStackByField0:m,setStackByField0ComboboxInputRef:b,setStackByField1:g,setStackByField1ComboboxInputRef:f,stackByField0:h,stackByField0ComboboxRef:v,stackByField1:E,stackByField1ComboboxRef:x,stackByWidth:j,uniqueQueryId:M})),A&&s?i.a.createElement(U.EuiProgress,{color:"accent","data-test-subj":"progress",position:"absolute",size:"xs"}):i.a.createElement(i.a.Fragment,null,null!=F&&s&&i.a.createElement(sn,{addFilter:e,data:F,maxBuckets:1e3,stackByField0:h,stackByField1:E}))))};gn.displayName="AlertsTreemapPanelComponent";const fn=i.a.memo(gn),yn=()=>{const e=Object(n.useRef)(null),[t,a]=Object(n.useState)(null),i=Object(n.useCallback)((()=>{var a;null===(a=e.current)||void 0===a||a.clearSearchValue(),null!=t&&(t.value="")}),[t]);return{comboboxRef:e,onReset:i,setComboboxInputRef:a}};var hn=a(656);const vn=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.chartsTitle",{defaultMessage:"Charts"}),En=1e3,xn={statusBySeverity:{terms:{field:at.U}}},jn={alertsByType:{terms:{field:at.D,size:En},aggs:{ruleByEventType:{terms:{field:"event.type",size:En}}}}},Sn={alertsByRule:{terms:{field:at.D,size:En}}};var kn=a(724),On=a(723),wn=a(121);const Tn=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.count.countTableColumnTitle",{defaultMessage:"Count of records"}),In=$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.count.countTableTitle",{defaultMessage:"Count"}),Cn=({fieldName:e,topN:t})=>$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.count.columnLabel",{values:{fieldName:e,topN:t},defaultMessage:"Top {topN} values of {fieldName}"});var Mn=a(135);const _n=G()(U.EuiLoadingSpinner).withConfig({displayName:"StyledEuiLoadingSpinner",componentId:"sc-1jn2elx-0"})(["margin:auto;"]),Fn=({data:e,isLoading:t,addFilter:a})=>{const r=Object(n.useMemo)((()=>[{field:"key",name:ba,"data-test-subj":"severityTable-severity",render:e=>i.a.createElement(U.EuiHealth,{color:da.b[e],textSize:"xs"},i.a.createElement(wn.b,{isDraggable:!1,field:at.U,hideTopN:!0,id:`alert-severity-draggable-${e}`,value:Object(it.capitalize)(e),queryValue:e,tooltipContent:null}))},{field:"value",name:In,sortable:!0,dataType:"number","data-test-subj":"severityTable-alertCount",width:"45%",render:e=>i.a.createElement(U.EuiText,{grow:!1,size:"xs"},i.a.createElement(wa.a,{count:e}))}]),[]),s=Object(n.useMemo)((()=>e?e.reduce((function(e,t){return e+t.value}),0):0),[e]),o=Object(n.useCallback)((e=>ga(e)),[]),l=Object(n.useCallback)((e=>{a&&a({field:at.U,value:e.toLowerCase()})}),[a]);return i.a.createElement(U.EuiFlexGroup,{gutterSize:"s","data-test-subj":"severity-level-chart"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiInMemoryTable,{"data-test-subj":"severity-level-table",columns:r,items:e,loading:t,sorting:{sort:{field:"value",direction:"desc"}}})),i.a.createElement(U.EuiFlexItem,{"data-test-subj":"severity-level-donut"},t?i.a.createElement(_n,{size:"l"}):i.a.createElement(kn.a,{data:e,fillColor:o,height:150,label:Mn.U,title:i.a.createElement(On.a,{count:s}),totalCount:s,onPartitionClick:l})))};Fn.displayName="SeverityLevelChart";const An=({filters:e,query:t,signalIndexName:a,runtimeMappings:r,addFilter:s,skip:o})=>{const l=Object(n.useMemo)((()=>`alerts-summary-severity-donut-${Object(nt.v4)()}`),[]),{items:c,isLoading:u}=Oa({aggregations:xn,filters:e,query:t,signalIndexName:a,runtimeMappings:r,skip:o,uniqueQueryId:l}),d=Object(n.useMemo)((()=>(e=>null==e?void 0:e.every((e=>Object(it.has)(e,"key"))))(c)?c:[]),[c]);return i.a.createElement(Ve.c,null,i.a.createElement(U.EuiPanel,{hasBorder:!0,hasShadow:!1,"data-test-subj":"severty-level-panel"},i.a.createElement(pn.a,{id:l,inspectTitle:pa,outerDirection:"row",title:pa,titleSize:"xs",hideSubtitle:!0}),i.a.createElement(Fn,{data:d,isLoading:u,addFilter:s})))};An.displayName="SeverityLevelPanel";var Dn=a(165);const Nn=G.a.div.withConfig({displayName:"Wrapper",componentId:"sc-1jqzjbv-0"})(["margin-top:-",";"],(({theme:e})=>e.eui.euiSizeM)),Pn=G.a.div.withConfig({displayName:"TableWrapper",componentId:"sc-1jqzjbv-1"})(["height:178px;"]),Rn=G()(U.EuiColorPaletteDisplay).withConfig({displayName:"StyledEuiColorPaletteDisplay",componentId:"sc-1jqzjbv-2"})(["border:none;border-radius:0;"]),Ln=({data:e,isLoading:t})=>{const a=Object(K.a)("alertTypeEnabled"),r=Object(n.useMemo)((()=>(e=>[{field:"rule",name:Mn.r,"data-test-subj":"detectionsTable-rule",truncateText:!0,render:e=>i.a.createElement(U.EuiText,{size:"xs",className:"eui-textTruncate"},i.a.createElement(wn.b,{isDraggable:!1,field:at.D,hideTopN:!0,id:`alert-detection-draggable-${e}`,value:e,queryValue:e,tooltipContent:null,truncate:!0}))},...e?[{field:"type",name:ha,"data-test-subj":"detectionsTable-type",truncateText:!0,render:e=>i.a.createElement(U.EuiHealth,{color:xa[e]},i.a.createElement(U.EuiText,{grow:!1,size:"xs"},i.a.createElement(Dn.c,{mode:Dn.a.HOVER_DOWN,visibleCellActions:4,showActionTooltips:!0,triggerId:Dn.d.DEFAULT,data:{value:"denied",field:"event.type"},sourcererScopeId:f.SourcererScopeName.detections,metadata:{negateFilters:"Detection"===e}},ja[e]))),width:"30%"}]:[],{field:"value",name:In,dataType:"number",sortable:!0,"data-test-subj":"detectionsTable-count",render:e=>i.a.createElement(U.EuiText,{grow:!1,size:"xs"},i.a.createElement(wa.a,{count:e})),width:"22%"}])(a)),[a]),s=Object(n.useMemo)((()=>e.reduce(((e,t)=>("Detection"===t.type&&(e.Detection+=t.value),"Prevention"===t.type&&(e.Prevention+=t.value),e)),{Detection:0,Prevention:0})),[e]),o=Object(n.useMemo)((()=>Object.keys(s).reduce(((e,t)=>{const a=e.length>0?e[e.length-1].stop:0;if(s[t]){const n={stop:a+(s[t]||0),color:xa[t]};e.push(n)}return e}),[])),[s]);return i.a.createElement(Nn,{"data-test-subj":"alerts-by-type"},a&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiFlexGroup,{gutterSize:"xs","data-test-subj":"alerts-by-type-palette-display"},Object.keys(s).map((e=>i.a.createElement(U.EuiFlexItem,{key:e,grow:!1},i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"xs"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiHealth,{className:"eui-alignMiddle",color:xa[e]},i.a.createElement(U.EuiText,{size:"xs"},i.a.createElement("h4",null,`${e}:`)))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiText,{size:"xs"},i.a.createElement(wa.a,{count:s[e]||0}))))))),i.a.createElement(U.EuiSpacer,{size:"xs"})),i.a.createElement(U.EuiSpacer,{size:"xs"}),i.a.createElement(Rn,{size:"xs",palette:o})),i.a.createElement(U.EuiSpacer,{size:"xs"}),i.a.createElement(Pn,{className:"eui-yScroll"},i.a.createElement(U.EuiInMemoryTable,{"data-test-subj":"alerts-by-type-table",columns:r,items:e,loading:t,sorting:{sort:{field:"value",direction:"desc"}},pagination:{pageSize:25,showPerPageOptions:!1}})))};Ln.displayName="AlertsByType";const Bn=({filters:e,query:t,signalIndexName:a,runtimeMappings:r,skip:s})=>{const o=Object(K.a)("alertTypeEnabled"),l=Object(n.useMemo)((()=>`alerts-summary-alert_by_type-${Object(nt.v4)()}`),[]),{items:c,isLoading:u}=Oa({aggregations:o?jn:Sn,filters:e,query:t,signalIndexName:a,runtimeMappings:r,skip:s,uniqueQueryId:l}),d=Object(n.useMemo)((()=>(e=>null==e?void 0:e.every((e=>Object(it.has)(e,"type"))))(c)?c:[]),[c]);return i.a.createElement(Ve.c,null,i.a.createElement(U.EuiPanel,{hasBorder:!0,hasShadow:!1,"data-test-subj":"alerts-by-type-panel"},i.a.createElement(pn.a,{id:l,inspectTitle:o?fa:ya,outerDirection:"row",title:o?fa:ya,titleSize:"xs",hideSubtitle:!0}),i.a.createElement(Ln,{data:d,isLoading:u})))};Bn.displayName="AlertsByTypePanel";const qn=G.a.div.withConfig({displayName:"ProgressWrapper",componentId:"sc-inoj9t-0"})(["height:160px;"]),zn=G()(U.EuiHorizontalRule).withConfig({displayName:"StyledEuiHorizontalRule",componentId:"sc-inoj9t-1"})(["margin-top:0;margin-bottom:",";"],(({theme:e})=>e.eui.euiSizeS)),$n=G()(U.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-inoj9t-2"})(["margin-top:-",";"],(({theme:e})=>e.eui.euiSizeM)),Vn=G()(U.EuiProgress).withConfig({displayName:"StyledEuiProgress",componentId:"sc-inoj9t-3"})(["margin-bottom:",";"],(({theme:e})=>e.eui.euiSizeS)),Un=G.a.div.withConfig({displayName:"DataStatsWrapper",componentId:"sc-inoj9t-4"})(["width:250px;"]),Hn=({data:e,isLoading:t,addFilter:a,groupBySelection:r})=>{const[s,o]=Object(n.useState)(!1),[l,c]=(e=>{const{total:t,nonEmpty:a}=e.reduce(((e,t)=>(e.total+=t.value,"-"!==t.key&&(e.nonEmpty+=t.value),e)),{total:0,nonEmpty:0});return[a,pt(0===t?0:a/t)]})(e),u=i.a.createElement(U.EuiButtonIcon,{color:"text",iconType:"iInCircle","aria-label":"info",size:"xs",onClick:()=>o(!s)}),d=i.a.createElement(Un,null,i.a.createElement(U.EuiPopoverTitle,null,(m=c,$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByGrouping.dataStatsTitle",{values:{percent:m},defaultMessage:"This field exists in {percent} of alerts."}))),i.a.createElement(U.EuiText,{size:"s"},(p=r,$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByGrouping.dataStatsMessage",{values:{groupbySelection:p},defaultMessage:"To see alerts without {groupbySelection} you can filter in by "})),i.a.createElement(U.EuiLink,{color:"primary",onClick:()=>{o(!1),a&&a({field:r,value:null,negate:!0})}},(e=>$.i18n.translate("xpack.securitySolution.detectionEngine.alerts.alertsByGrouping.nonEmptyFilter",{values:{groupBySelection:e},defaultMessage:"NOT {groupBySelection}: exists"}))(r))));var p,m;return i.a.createElement(i.a.Fragment,null,i.a.createElement($n,{alignItems:"center",gutterSize:"xs"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiText,{size:"s","data-test-subj":"alerts-progress-bar-title"},i.a.createElement("h5",null,r))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiPopover,{button:u,isOpen:s,closePopover:()=>o(!1),anchorPosition:"rightCenter",panelPaddingSize:"s"},d))),t?i.a.createElement(Vn,{size:"xs",color:"primary"}):i.a.createElement(i.a.Fragment,null,i.a.createElement(zn,null),i.a.createElement(qn,{"data-test-subj":"progress-bar",className:"eui-yScroll"},0===l?i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiText,{size:"s",textAlign:"center","data-test-subj":"empty-proress-bar"},st),i.a.createElement(U.EuiSpacer,{size:"l"})):i.a.createElement(i.a.Fragment,null,e.map((e=>{return"-"!==e.key&&i.a.createElement("div",{key:`${e.key}`,"data-test-subj":`progress-bar-${e.key}`},i.a.createElement(U.EuiProgress,{valueText:i.a.createElement(U.EuiText,{size:"xs",color:"default"},i.a.createElement("strong",null,e.percentageLabel)),max:1,color:"vis9",size:"s",value:e.percentage,label:"Other"===e.key?e.label:(t=e.key,i.a.createElement(wn.b,{isDraggable:!1,field:r,hideTopN:!0,id:`top-alerts-${t}`,value:t,queryValue:t,tooltipContent:null},i.a.createElement(U.EuiText,{size:"xs",className:"eui-textTruncate"},t)))}),i.a.createElement(U.EuiSpacer,{size:"s"}));var t}))),i.a.createElement(U.EuiSpacer,{size:"s"}))))};Hn.displayName="AlertsProgressBar";const Gn=["host.name","user.name","source.ip","destination.ip"],Qn=({filters:e,query:t,signalIndexName:a,runtimeMappings:r,skip:s,groupBySelection:o,setGroupBySelection:l,addFilter:c})=>{const u=Object(n.useMemo)((()=>`alerts-summary-top-alerts-${Object(nt.v4)()}`),[]),d=Gn.map((e=>({value:e,label:e}))),p=Object(n.useMemo)((()=>{return{alertsByGrouping:{terms:{field:e=o,size:10}},missingFields:{missing:{field:e}}};var e}),[o]),m=Object(n.useCallback)((e=>{l(e)}),[l]),{items:b,isLoading:g}=Oa({aggregations:p,filters:e,query:t,signalIndexName:a,runtimeMappings:r,skip:s,uniqueQueryId:u}),f=Object(n.useMemo)((()=>(e=>null==e?void 0:e.every((e=>Object(it.has)(e,"percentage"))))(b)?b:[]),[b]);return i.a.createElement(Ve.c,null,i.a.createElement(U.EuiPanel,{hasBorder:!0,hasShadow:!1,"data-test-subj":"alerts-progress-bar-panel"},i.a.createElement(pn.a,{id:u,inspectTitle:`${rt} ${o}`,outerDirection:"row",title:rt,titleSize:"xs",hideSubtitle:!0},i.a.createElement(on.b,{"data-test-subj":"stackByComboBox",selected:o,onSelect:m,prepend:"",width:150,dropDownoptions:d})),i.a.createElement(Hn,{data:f,isLoading:g,groupBySelection:o,addFilter:c})))};Qn.displayName="AlertsProgressBarPanel";var Wn=a(177);const Kn=G()(U.EuiFlexGroup).withConfig({displayName:"StyledFlexGroup",componentId:"sc-1p6f4e6-0"})(["@media only screen and (min-width:",");"],(({theme:e})=>e.eui.euiBreakpoints.l)),Yn=G()(U.EuiFlexItem).withConfig({displayName:"StyledFlexItem",componentId:"sc-1p6f4e6-1"})(["min-width:355px;"]),Jn=({alignHeader:e,filters:t,addFilter:a,panelHeight:r,query:s,runtimeMappings:o,signalIndexName:l,title:c=vn,isExpanded:u,setIsExpanded:d,groupBySelection:p,setGroupBySelection:m})=>{const b=Object(K.a)("alertsPageChartsEnabled"),{toggleStatus:g,setToggleStatus:f}=Object(Wn.a)("detections-alerts-charts"),y=Object(n.useCallback)((e=>{b&&d?d(e):f(e)}),[f,d,b]),h=Object(n.useMemo)((()=>b?!u:!g),[b,u,g]),v=Object(n.useMemo)((()=>!(!b||!u)||!(b||!g)),[b,u,g]);return i.a.createElement(on.a,{$toggleStatus:b&&void 0!==u?u:g,"data-test-subj":"alerts-charts-panel",hasBorder:!0,height:r},i.a.createElement(pn.a,{alignHeader:e,outerDirection:"row",title:c,titleSize:"s",hideSubtitle:!0,showInspectButton:!1,toggleStatus:b?u:g,toggleQuery:y}),v&&i.a.createElement(Kn,{"data-test-subj":"alerts-charts-container",className:"eui-yScroll",wrap:!0,gutterSize:"m"},i.a.createElement(Yn,null,i.a.createElement(An,{filters:t,query:s,signalIndexName:l,runtimeMappings:o,skip:h,addFilter:a})),i.a.createElement(Yn,null,i.a.createElement(Bn,{filters:t,query:s,signalIndexName:l,runtimeMappings:o,skip:h})),i.a.createElement(Yn,null,i.a.createElement(Qn,{filters:t,query:s,signalIndexName:l,runtimeMappings:o,skip:h,groupBySelection:p,setGroupBySelection:m,addFilter:a}))))};Jn.displayName="AlertsSummaryChartsPanel";const Xn=1e3,Zn=({additionalFilters:e=[],from:t,runtimeMappings:a,stackByField0:n,stackByField1:i,to:r})=>({size:0,aggs:{stackByField0:{terms:{field:n,order:{_count:"desc"},size:Xn},aggs:{...mn({stackByField1:i,stackByField1Size:1e3})}}},query:{bool:{filter:[...e,{range:{"@timestamp":{gte:t,lte:r}}}]}},runtime_mappings:a});var ei=a(230);const ti=Object(nt.v4)(),ai=Object(nt.v4)(),ni=Object(nt.v4)(),ii=Object(nt.v4)(),ri=[{columnId:ai,isTransposed:!1,width:362},{columnId:ni,isTransposed:!1}],si=[{columnId:ii,isTransposed:!1}],oi=[ai],li=(e="kibana.alert.rule.name",t)=>{const a=!Object(it.isEmpty)(null==t?void 0:t.breakdownField),n=null!=t&&t.breakdownField&&a?null==t?void 0:t.breakdownField:e,i=a?[...oi,ii,ni]:[...oi,ni],r={[ai]:{label:Object(ei.o)(e),dataType:"string",operationType:"terms",scale:"ordinal",sourceField:e,isBucketed:!0,params:{size:1e3,orderBy:{type:"column",columnId:ni},orderDirection:"desc",otherBucket:!0,missingBucket:!1,parentFormat:{id:"terms"},include:[],exclude:[],includeIsRegex:!1,excludeIsRegex:!1}},[ni]:{label:Object(ei.g)(n),dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:n,params:{emptyAsNull:!0}},...null!=t&&t.breakdownField&&a?(s=null==t?void 0:t.breakdownField,{[ii]:{label:Object(ei.o)(s),dataType:"string",operationType:"terms",scale:"ordinal",sourceField:s,isBucketed:!0,params:{size:1e3,orderBy:{type:"column",columnId:ni},orderDirection:"desc",otherBucket:!0,missingBucket:!1,parentFormat:{id:"terms"},include:[],exclude:[],includeIsRegex:!1,excludeIsRegex:!1}}}):{}};var s;return{title:"Alerts",description:"",visualizationType:"lnsDatatable",state:{visualization:{columns:a?[...ri,...si]:ri,layerId:ti,layerType:"data"},query:{query:"",language:"kuery"},filters:null!=t&&t.filters?t.filters:[],datasourceStates:{formBased:{layers:{[ti]:{columns:i.reduce(((e,t)=>(t&&r[t]&&(e[t]=r[t]),e)),{}),columnOrder:i,sampling:1,incompleteColumns:{}}}},textBased:{layers:{}}},internalReferences:[],adHocDataViews:{}},references:[{type:"index-pattern",id:"{dataViewId}",name:`indexpattern-datasource-layer-${ti}`}]}};var ci=a(403),ui=a(55),di=a.n(ui);const pi=G.a.div.withConfig({displayName:"Wrapper",componentId:"sc-13jp899-0"})(["margin-top:-",";"],(({theme:e})=>e.eui.euiSizeS)),mi=({data:e,loading:t,stackByField0:a,stackByField1:r})=>{var o,l;const[c]=Object(m.p)(s.O),u=Object(n.useMemo)((()=>Object(x.isEmpty)(null==r?void 0:r.trim())?(({defaultNumberFormat:e,stackByField0:t})=>[{"data-test-subj":"stackByField0Key",field:"key",name:t,render:function(e){return i.a.createElement(wn.b,{isDraggable:!1,field:t,hideTopN:!0,id:`alert-count-draggable-stackByField0-${t}-${e}`,value:e,tooltipContent:null})},truncateText:!1},{"data-test-subj":"doc_count",dataType:"number",field:"doc_count",name:Tn,render:t=>di()(t).format(e),sortable:!0,textOnly:!0}])({defaultNumberFormat:c,stackByField0:a}):(({defaultNumberFormat:e,stackByField0:t,stackByField1:a})=>[{"data-test-subj":"stackByField0Key",field:"key",name:Cn({fieldName:t,topN:Xn}),render:function(e){return i.a.createElement(wn.b,{isDraggable:!1,field:t,hideTopN:!0,id:`alert-count-draggable-stackByField0-${t}-${a}-${e}`,value:e,tooltipContent:null})},truncateText:!1},{"data-test-subj":"stackByField1Key",field:"stackByField1Key",name:Cn({fieldName:null!=a?a:"",topN:1e3}),render:function(e){return i.a.createElement(wn.b,{isDraggable:!1,field:null!=a?a:"",hideTopN:!0,id:`alert-count-draggable-stackByField1-${t}-${a}-${e}`,value:e,tooltipContent:null})},truncateText:!1},{"data-test-subj":"stackByField1DocCount",dataType:"number",field:"stackByField1DocCount",name:Tn,render:t=>di()(t).format(e),sortable:!0,textOnly:!0}])({defaultNumberFormat:c,stackByField0:a,stackByField1:r})),[c,a,r]),d=Object(n.useMemo)((()=>{var t,a;return Qa({buckets:null===(t=e.aggregations)||void 0===t||null===(a=t.stackByField0)||void 0===a?void 0:a.buckets,maxItems:Xn})}),[null===(o=e.aggregations)||void 0===o||null===(l=o.stackByField0)||void 0===l?void 0:l.buckets]),p=Object(n.useMemo)((()=>Wa(d)),[d]),b=Object(n.useMemo)((()=>Object(x.isEmpty)(null==r?void 0:r.trim())?d:qa({buckets:d,maxRiskSubAggregations:p,stackByField0:a})),[d,p,a,r]);return i.a.createElement(pi,{"data-test-subj":"alertsCountTable",className:"eui-yScroll"},i.a.createElement(U.EuiInMemoryTable,{isSelectable:!1,columns:u,items:b,loading:t,sorting:!0}))};mi.displayName="AlertsCountComponent";const bi=i.a.memo(mi),gi=({alertsData:e,extraActions:t,extraOptions:a,getLensAttributes:n,height:r,id:s,inspectTitle:o,isChartEmbeddablesEnabled:l,isLoadingAlerts:c,scopeId:u,stackByField0:d,stackByField1:p,timerange:m})=>l?i.a.createElement(ci.a,{"data-test-subj":"embeddable-alerts-count",extraActions:t,extraOptions:a,getLensAttributes:n,height:r,id:s,inspectTitle:o,scopeId:u,stackByField:d,timerange:m}):null!=e?i.a.createElement(bi,{data:e,loading:c,stackByField0:d,stackByField1:p}):null,fi=i.a.memo(gi),yi="detections-alerts-count",hi=Object(n.memo)((({alignHeader:e,chartOptionsContextMenu:t,extraActions:a,filters:r,inspectTitle:s,panelHeight:o,query:l,runtimeMappings:c,setStackByField0:u,setStackByField0ComboboxInputRef:d,setStackByField1:p,setStackByField1ComboboxInputRef:m,signalIndexName:b,stackByField0:g,stackByField0ComboboxRef:y,stackByField1:h,stackByField1ComboboxRef:v,stackByWidth:E,title:x=In,isExpanded:j,setIsExpanded:S})=>{const{to:k,from:O,deleteQuery:w,setQuery:T}=Object(J.a)(),M=Object(K.a)("chartEmbeddablesEnabled"),_=Object(K.a)("alertsPageChartsEnabled"),F=Object(n.useMemo)((()=>`${yi}-${Object(nt.v4)()}`),[]),A=Object(n.useMemo)((()=>{try{var e;return[Object(bt.buildEsQuery)(void 0,null!=l?[l]:[],null!==(e=null==r?void 0:r.filter((e=>!1===e.meta.disabled)))&&void 0!==e?e:[])]}catch(e){return[]}}),[l,r]),{toggleStatus:D,setToggleStatus:N}=Object(Wn.a)(yi),P=Object(n.useCallback)((e=>{_&&S?S(e):N(e)}),[N,S,_]),R=Object(n.useMemo)((()=>_?!j:!D),[_,j,D]),L=Object(n.useMemo)((()=>({from:O,to:k})),[O,k]),B=Object(n.useMemo)((()=>({breakdownField:h,filters:r})),[r,h]),{loading:q,data:z,setQuery:$,response:V,request:H,refetch:G}=Object(I.a)({query:Zn({stackByField0:g,stackByField1:h,from:O,to:k,additionalFilters:A,runtimeMappings:c}),indexName:b,skip:R||M,queryName:C.a.COUNT});Object(n.useEffect)((()=>{$(Zn({additionalFilters:A,from:O,runtimeMappings:c,stackByField0:g,stackByField1:h,to:k}))}),[A,O,c,$,g,h,k]),Object(gt.a)({deleteQuery:w,loading:q,refetch:G,request:H,response:V,setQuery:T,uniqueQueryId:F});const Q=Object(n.useMemo)((()=>_?j:D),[_,D,j]);return i.a.createElement(Ve.c,{show:_?j:D},i.a.createElement(on.a,{$toggleStatus:_&&void 0!==j?j:D,"data-test-subj":"alertsCountPanel",hasBorder:!0,height:o},i.a.createElement(pn.a,{alignHeader:e,id:F,inspectTitle:s,outerDirection:"row",title:x,titleSize:"s",hideSubtitle:!0,showInspectButton:null==t,toggleStatus:_?j:D,toggleQuery:P},i.a.createElement(dn,{chartOptionsContextMenu:M?void 0:t,setStackByField0:u,setStackByField0ComboboxInputRef:d,setStackByField1:p,setStackByField1ComboboxInputRef:m,stackByField0:g,stackByField0ComboboxRef:y,stackByField1:h,stackByField1ComboboxRef:v,stackByWidth:E,uniqueQueryId:F,useLensCompatibleFields:M})),Q&&(q?i.a.createElement(U.EuiProgress,{color:"accent","data-test-subj":"progress",position:"absolute",size:"xs"}):i.a.createElement(fi,{alertsData:z,"data-test-subj":"embeddable-count-table",extraActions:a,extraOptions:B,getLensAttributes:li,height:218,id:`${F}-embeddable`,inspectTitle:s,isChartEmbeddablesEnabled:M,isLoadingAlerts:q,scopeId:f.SourcererScopeName.detections,stackByField0:g,stackByField1:h,stackByField:g,timerange:L}))))}));hi.displayName="AlertsCountPanel";var vi=a(919);const Ei=375,xi=G()(U.EuiFlexItem).withConfig({displayName:"FullHeightFlexItem",componentId:"sc-1ap19zo-0"})(["height:100%;"]),ji=G.a.div.withConfig({displayName:"ChartSelectContainer",componentId:"sc-1ap19zo-1"})(["margin-left:",";"],(({theme:e})=>e.eui.euiSizeS)),Si=({addFilter:e,alertsDefaultFilters:t,isLoadingIndexPattern:a,query:r,runtimeMappings:s,signalIndexName:o,updateDateRangeCallback:l})=>{const{toggleStatus:c,setToggleStatus:u}=Object(Wn.a)("detection-alerts-charts-panel"),d=Object(K.a)("alertsPageChartsEnabled"),{alertViewSelection:p,countTableStackBy0:m,countTableStackBy1:b,groupBySelection:g,isTreemapPanelExpanded:f,riskChartStackBy0:y,riskChartStackBy1:h,setAlertViewSelection:v,setCountTableStackBy0:E,setCountTableStackBy1:x,setGroupBySelection:j,setIsTreemapPanelExpanded:S,setRiskChartStackBy0:k,setRiskChartStackBy1:O,setTrendChartStackBy:w,trendChartStackBy:T}=(()=>{const e=Object(K.a)("alertsPageChartsEnabled"),[t,a]=Object(Ee.a)({defaultValue:e?ze:Be,key:xe({category:Ie,page:Se,setting:"alert-view-selection"}),isInvalidDefault:je}),[n,i]=Object(Ee.a)({defaultValue:"host.name",key:xe({category:Ie,page:Se,setting:"group-by"}),isInvalidDefault:je}),[r,s]=Object(Ee.a)({defaultValue:!0,key:xe({category:Oe,page:Se,setting:"expand"})}),[o,l]=Object(Ee.a)({defaultValue:Ce.a,key:xe({category:Oe,page:Se,setting:we}),isInvalidDefault:je}),[c,u]=Object(Ee.a)({defaultValue:Ce.b,key:xe({category:Oe,page:Se,setting:Te})}),[d,p]=Object(Ee.a)({defaultValue:Ce.a,key:xe({category:ke,page:Se,setting:we}),isInvalidDefault:je}),[m,b]=Object(Ee.a)({defaultValue:Ce.b,key:xe({category:ke,page:Se,setting:Te})}),[g,f]=Object(Ee.a)({defaultValue:Ce.a,key:xe({category:"trend",page:Se,setting:"stack-by"}),isInvalidDefault:je});return{alertViewSelection:t,countTableStackBy0:d,countTableStackBy1:m,groupBySelection:n,isTreemapPanelExpanded:r,riskChartStackBy0:o,riskChartStackBy1:c,setAlertViewSelection:a,setCountTableStackBy0:p,setCountTableStackBy1:b,setGroupBySelection:i,setIsTreemapPanelExpanded:s,setRiskChartStackBy0:l,setRiskChartStackBy1:u,setTrendChartStackBy:f,trendChartStackBy:g}})(),I=Object(n.useCallback)((e=>{w(e),E(e),k(e)}),[E,k,w]),C=Object(n.useCallback)((e=>{x(e),O(e)}),[x,O]),{comboboxRef:M,onReset:_,setComboboxInputRef:F}=yn(),{comboboxRef:A,onReset:D,setComboboxInputRef:N}=yn(),P=Object(n.useCallback)((()=>{_(),D()}),[_,D]),R=Object(n.useCallback)((()=>{P(),I(Ce.a),null!=C&&C(Ce.b)}),[P,I,C]),L=Object(n.useMemo)((()=>[Object(vi.b)({callback:R,order:5})]),[R]),B=Object(n.useCallback)((e=>i.a.createElement(Je,{defaultStackByField:Ce.a,defaultStackByField1:Ce.b,onReset:P,queryId:e,setStackBy:I,setStackByField1:C})),[P,I,C]),q=Object(n.useMemo)((()=>d?c?i.a.createElement(ji,null,i.a.createElement(tt,{alertViewSelection:p,setAlertViewSelection:v})):i.a.createElement(Aa,{groupBySelection:g,filters:t,query:r,signalIndexName:o,runtimeMappings:s}):i.a.createElement(ji,null,i.a.createElement(tt,{alertViewSelection:p,setAlertViewSelection:v}))),[p,v,d,c,g,t,r,o,s]);return i.a.createElement("div",{"data-test-subj":"chartPanels"},"trend"===p&&i.a.createElement(xi,{grow:2},a?i.a.createElement(U.EuiSkeletonText,{lines:10,"data-test-subj":"trendLoadingSpinner"}):i.a.createElement(hn.a,{alignHeader:"flexStart",chartHeight:240,chartOptionsContextMenu:B,comboboxRef:M,defaultStackByOption:T,extraActions:L,filters:t,inspectTitle:Fe,onFieldSelected:I,panelHeight:Ei,query:r,runtimeMappings:s,setComboboxInputRef:F,showCountsInLegend:!0,showGroupByPlaceholder:!1,showTotalAlertsCount:!1,signalIndexName:o,stackByLabel:ln.a,title:q,titleSize:"s",updateDateRange:l,isExpanded:c,setIsExpanded:u})),"table"===p&&i.a.createElement(xi,{grow:1},a?i.a.createElement(U.EuiSkeletonText,{lines:10,"data-test-subj":"tableLoadingSpinner"}):i.a.createElement(hi,{alignHeader:"flexStart",chartOptionsContextMenu:B,extraActions:L,filters:t,inspectTitle:d?Ne:_e,panelHeight:Ei,query:r,runtimeMappings:s,setStackByField0:I,setStackByField0ComboboxInputRef:F,setStackByField1:C,setStackByField1ComboboxInputRef:N,signalIndexName:o,stackByField0:m,stackByField0ComboboxRef:M,stackByField1:b,stackByField1ComboboxRef:A,title:q,isExpanded:c,setIsExpanded:u})),"treemap"===p&&i.a.createElement(xi,{grow:1},a?i.a.createElement(U.EuiSkeletonText,{lines:10,"data-test-subj":"treemapLoadingSpinner"}):i.a.createElement(fn,{addFilter:e,alignHeader:"flexStart",chartOptionsContextMenu:B,height:Ei,inspectTitle:Ae,isPanelExpanded:d?c:f,filters:t,query:r,riskSubAggregationField:"kibana.alert.risk_score",setIsPanelExpanded:d?u:S,setStackByField0:I,setStackByField0ComboboxInputRef:F,setStackByField1:C,setStackByField1ComboboxInputRef:N,signalIndexName:o,stackByField0:y,stackByField0ComboboxRef:M,stackByField1:h,stackByField1ComboboxRef:A,title:q})),d&&"charts"===p&&i.a.createElement(xi,{grow:1},a?i.a.createElement(U.EuiSkeletonText,{lines:10,"data-test-subj":"chartsLoadingSpinner"}):i.a.createElement(Jn,{alignHeader:"flexStart",addFilter:e,filters:t,query:r,panelHeight:Ei,signalIndexName:o,title:q,runtimeMappings:s,isExpanded:c,setIsExpanded:u,groupBySelection:g,setGroupBySelection:j})))},ki=i.a.memo(Si);var Oi=a(1377),wi=a(955),Ti=a(696),Ii=a(698),Ci=a(335),Mi=a(416),_i=a(1112),Fi=a(1058),Ai=a(1042),Di=a(104),Ni=a.n(Di);const Pi="filter-group__items",Ri="filter-group__loading",Li="filter-group__add-control",Bi="filter-group__save",qi="filter-group__save-popover",zi="filter-group--changed-banner",$i="filter-group__discard",Vi={BTN:"filter-group__context",MENU:"filter-group__context-menu",RESET:"filter-group__context--reset",EDIT:"filter-group__context--edit",DISCARD:"filter-group__context--discard"},Ui={hideExclude:!0,hideSort:!0,hidePanelTitles:!0,placeholder:"",ignoreParentSettings:{ignoreValidations:!0}},Hi=G()(U.EuiButton).withConfig({displayName:"FilterGroupLoadingButton",componentId:"sc-10d8hps-0"})(["height:34px;"]),Gi=()=>i.a.createElement(Hi,{color:"text"},i.a.createElement(U.EuiLoadingChart,{className:"filter-group__loading","data-test-subj":Ri}));var Qi=a(93),Wi=a(94),Ki=a(73),Yi=a(160),Ji=a(221);const Xi=e=>e.map((({title:e,fieldName:t,selectedOptions:a=[],existsSelected:n=!1,exclude:i=!1})=>({title:null!=e?e:t,selectedOptions:a,fieldName:t,existsSelected:n,exclude:i})));var Zi=a(514);const er=e=>{const t=(e=>{const t=e.panels;return Object.values(t).sort(((e,t)=>e.order-t.order))})(e);return t.map((e=>{const{explicitInput:{fieldName:t,selectedOptions:a,title:n,existsSelected:i,exclude:r,hideActionBar:s}}=e;return{fieldName:t,selectedOptions:null!=a?a:[],title:n,existsSelected:null!=i&&i,exclude:null!=r&&r,hideActionBar:null!=s&&s}}))},tr=e=>{const{controls:t,defaultControls:a}=e,n=t.reduce(((e,t)=>(e[t.fieldName]=t,e)),{}),i=a.reduce(((e,t)=>(e[t.fieldName]=t,e)),{});return[...a.filter((e=>e.persist)).map((e=>{var t;return{...e,...null!==(t=n[e.fieldName])&&void 0!==t?t:{}}})),...t.filter((e=>{var t;return!(null!==(t=i[e.fieldName])&&void 0!==t&&t.persist)})).map((e=>{var t;return{...null!==(t=i[e.fieldName])&&void 0!==t?t:{},...e}}))]},ar=(...e)=>(t,a)=>{if(t.length!==a.length)return!1;const n=t.map((t=>Object(it.pick)(t,e))),i=a.map((t=>Object(it.pick)(t,e)));return Object(it.isEqual)(n,i)};a(1615);var nr=a(266),ir=a(14);const rr=Object(n.createContext)(void 0),sr=()=>{const e=Object(n.useContext)(rr);if(!e)throw new Error("FilterContext should only be used inside FilterGroup Wrapper");return e},or=$.i18n.translate("xpack.securitySolution.filtersGroup.pendingChanges",{defaultMessage:"Save pending changes"}),lr=$.i18n.translate("xpack.securitySolution.filtersGroup.contextMenu.editControls",{defaultMessage:"Edit Controls"}),cr=$.i18n.translate("xpack.securitySolution.filtersGroup.contextMenu.addControls",{defaultMessage:"Add Controls"}),ur=($.i18n.translate("xpack.securitySolution.filtersGroup.contextMenu.saveControls",{defaultMessage:"Save Controls"}),$.i18n.translate("xpack.securitySolution.filtersGroup.discardChanges",{defaultMessage:"Discard Changes"})),dr=$.i18n.translate("xpack.securitySolution.filterGroup.groupMenuTitle",{defaultMessage:"Filter group menu"}),pr=$.i18n.translate("xpack.securitySolution.filterGroup.filtersChangedBanner",{defaultMessage:"Filter Controls have changed"}),mr=$.i18n.translate("xpack.securitySolution.filterGroup.filtersChangedTitle",{defaultMessage:"New filter controls on this page are different from what you have previously saved. You can either save the changes or discard them. \n       Navigating away will automatically discard these changes"}),br=$.i18n.translate("xpack.securitySolution.filterGroup.contextMenu.resetTooltip",{defaultMessage:"Reset Controls to factory settings"}),gr=$.i18n.translate("xpack.securitySolution.filterGroup.contextMenu.reset",{defaultMessage:"Reset Controls"}),fr=$.i18n.translate("xpack.securitySolution.filtersGroup.contextMenu.saveChanges",{defaultMessage:"Save Changes"}),yr=$.i18n.translate("xpack.securitySolution.filtersGroup.contextMenu.revertChanges",{defaultMessage:"Revert Changes"}),hr=$.i18n.translate("xpack.securitySolution.filtersGroup.contextMenu.addControls.maxLimit",{defaultMessage:"Maximum of 4 controls can be added."}),vr=$.i18n.translate("xpack.securitySolution.filtersGroup.urlParam.arrayError",{defaultMessage:"Page filter URL Params must be an array"}),Er=()=>{const[e,t]=Object(n.useState)(!1),{isViewMode:a,controlGroupInputUpdates:r,controlGroup:s,switchToViewMode:o,switchToEditMode:l,initialControls:c,dataViewId:u,setShowFiltersChangedBanner:d,discardChangesHandler:p}=sr(),m=Object(n.useCallback)((()=>{t((e=>!e))}),[]),b=Object(n.useCallback)((e=>()=>{"function"==typeof e&&e(),m()}),[m]),g=Object(n.useCallback)((async()=>{if(r){null==s||s.updateInput({panels:{}});for(let e=0;e<c.length;e++){const t=c[e];await(null==s?void 0:s.addOptionsListControl({controlId:String(e),...Ui,dataViewId:null!=u?u:"",...t}))}o(),d(!1)}}),[r,s,c,u,o,d]),f=Object(n.useMemo)((()=>i.a.createElement(U.EuiContextMenuItem,{key:"reset",icon:"eraser","aria-label":gr,onClick:b(g),"data-test-subj":Vi.RESET,toolTipContent:br},gr)),[b,g]),y=Object(n.useMemo)((()=>i.a.createElement(U.EuiContextMenuItem,{key:"edit",icon:a?"pencil":"minusInCircle","aria-label":a?lr:ur,onClick:b(a?l:p),"data-test-subj":a?Vi.EDIT:Vi.DISCARD},a?lr:ur)),[b,a,l,p]),h=Object(n.useMemo)((()=>[f,y]),[f,y]);return i.a.createElement(U.EuiPopover,{id:Vi.MENU,button:i.a.createElement(U.EuiButtonIcon,{"aria-label":dr,display:"empty",size:"s",iconType:"boxesHorizontal",onClick:m,"data-test-subj":Vi.BTN}),isOpen:e,closePopover:m,panelPaddingSize:"none",anchorPosition:"downLeft",panelProps:{"data-test-subj":Vi.MENU}},i.a.createElement(U.EuiContextMenuPanel,{items:h}))},xr=({onClick:e,...t})=>{const{isDisabled:a}=t;return i.a.createElement(U.EuiToolTip,{content:a?hr:cr},i.a.createElement(U.EuiButtonIcon,Ni()({size:"s",iconSize:"m",display:"base","aria-label":a?hr:cr,"data-test-subj":Li,onClick:e},t,{iconType:"plusInCircle"})))},jr=({onClick:e})=>{const{hasPendingChanges:t,openPendingChangesPopover:a,closePendingChangesPopover:n,pendingChangesPopoverOpen:r}=sr();return i.a.createElement(U.EuiPopover,{button:i.a.createElement(U.EuiButtonIcon,{"aria-label":fr,size:"s",iconSize:"m",display:"base",color:"primary",iconType:"save","data-test-subj":Bi,onClick:e,onFocus:a,onBlur:n,onMouseOver:a,onMouseOut:n,disabled:!t}),isOpen:r,anchorPosition:"upCenter",panelPaddingSize:"none",closePopover:n,panelProps:{"data-test-subj":qi}},i.a.createElement("div",{style:{maxWidth:"200px"}},i.a.createElement(U.EuiCallOut,{title:or,color:"warning",iconType:"alert",size:"s"})))},Sr=({saveChangesHandler:e,discardChangesHandler:t})=>i.a.createElement(U.EuiFlexGroup,{alignItems:"center",justifyContent:"center",gutterSize:"s"},i.a.createElement(U.EuiFlexItem,{grow:!0},i.a.createElement(U.EuiCallOut,{"data-test-subj":zi,title:pr,iconType:"iInCircle"},i.a.createElement("p",null,mr),i.a.createElement(U.EuiButton,{"data-test-subj":"filter-group__save",color:"primary",onClick:e},fr),i.a.createElement(U.EuiButtonEmpty,{"data-test-subj":$i,onClick:t},yr))));var kr=a(161);const Or=G.a.div.attrs((e=>({className:e.className}))).withConfig({displayName:"FilterWrapper",componentId:"sc-n9v3gv-0"})(["& .euiFilterButton-hasActiveFilters{font-weight:400;}& .controlGroup{min-height:40px;}"]),wr=(Tr=e=>{const{dataViewId:t,onFilterChange:a,timeRange:r,filters:l,query:c,chainingSystem:u,initialControls:d,spaceId:p,onInit:m}=e,b=Object(n.useRef)(),g=Object(n.useRef)(),f=Object(n.useMemo)((()=>d.reduce(((e,t)=>(e[t.fieldName]=t,e)),{})),[d]),[y,h]=Object(n.useState)(),v=Object(n.useMemo)((()=>`${s.i}.${p}.${Ji.a.pageFilter}`),[p]),E=Object(n.useRef)(),{isViewMode:x,hasPendingChanges:j,pendingChangesPopoverOpen:S,closePendingChangesPopover:k,openPendingChangesPopover:O,switchToViewMode:w,switchToEditMode:T,setHasPendingChanges:I}=(({controlGroup:e,initialMode:t=Ki.ViewMode.VIEW})=>{const[a,i]=Object(n.useState)(t),[r,s]=Object(n.useState)(!1),[o,l]=Object(n.useState)(!1);Object(n.useEffect)((()=>{e&&e.getInput().viewMode!==a&&e.updateInput({viewMode:a})}),[e,a]),Object(n.useEffect)((()=>{l(r)}),[r]);const c=Object(n.useCallback)((()=>{l(!1)}),[]),u=Object(n.useCallback)((()=>{r&&l(!0)}),[r]),d=Object(n.useCallback)((()=>{null==e||e.updateInput({viewMode:Ki.ViewMode.EDIT}),i(Ki.ViewMode.EDIT)}),[e]),p=Object(n.useCallback)((()=>{null==e||e.updateInput({viewMode:Ki.ViewMode.VIEW}),s(!1),i(Ki.ViewMode.VIEW)}),[e]);return{isViewMode:a===Ki.ViewMode.VIEW,hasPendingChanges:r,pendingChangesPopoverOpen:o,closePendingChangesPopover:c,openPendingChangesPopover:u,switchToEditMode:d,switchToViewMode:p,setHasPendingChanges:s}})({controlGroup:y}),{controlGroupInput:C,setControlGroupInput:M,getStoredControlGroupInput:_}=(({storageKey:e,shouldSync:t})=>{const a=Object(n.useRef)(new ir.Storage(localStorage)),[i,r]=Object(n.useState)((()=>{var t;return null!==(t=a.current.get(e))&&void 0!==t?t:void 0}));return Object(n.useEffect)((()=>{t&&i&&a.current.set(e,i)}),[t,i,e]),{controlGroupInput:i,setControlGroupInput:r,getStoredControlGroupInput:()=>{var t;return null!==(t=a.current.get(e))&&void 0!==t?t:void 0}}})({storageKey:v,shouldSync:x}),[F,A]=Object(n.useState)(),[D,N]=Object(n.useState)(!1),P=Object(n.useRef)(!1);Object(Yi.b)(Ji.a.pageFilter,(e=>{if(e)try{if(!Array.isArray(e))throw new Error(vr);const t=_();if(t){const a=er(t);Object(it.isEqualWith)(a,e,ar("fieldName","title"))||(N(!0),T())}A(e)}catch(e){console.error(e),A([])}else A([])})),Object(n.useEffect)((()=>()=>{[b.current,g.current].forEach((e=>{e&&e.unsubscribe()}))}),[]);const{filters:R,query:L}=Object(n.useMemo)((()=>{const[e,t]=Object(kr.i)({config:{},queries:c?[c]:[],filters:null!=l?l:[],indexPattern:{fields:[],title:""}});return t?{filters:[],query:void 0}:{filters:l,query:c}}),[l,c]);Object(n.useEffect)((()=>{null==y||y.updateInput({filters:R,query:L,timeRange:r,chainingSystem:u})}),[r,u,y,L,R]);const B=Object(n.useCallback)((e=>{var t;Object(it.isEqual)(_(),e)||(Object(it.isEqual)(e.panels,null===(t=_())||void 0===t?void 0:t.panels)||x||I(!0),M(e))}),[M,_,x,I]),q=Object(n.useCallback)((({filters:e,embeddableLoaded:t})=>{const n=Object.values(t).every((e=>Boolean(null==e||e)));Object(it.isEqual)(E.current,e)||n&&(a&&a(null!=e?e:[]),E.current=null!=e?e:[])}),[a]),z=Object(n.useMemo)((()=>Object(it.debounce)(q,0)),[q]);Object(n.useEffect)((()=>{if(y)return b.current=y.getOutput$().subscribe({next:z}),g.current=y.getInput$().subscribe({next:B}),()=>{[b.current,g.current].forEach((e=>{e&&e.unsubscribe()}))}}),[y,z,B]);const $=Object(n.useCallback)((e=>{e&&(m&&m(e),h(e))}),[m]),V=Object(n.useCallback)((()=>{const e=null!=F?F:[];let t=[];const a=_();a&&(t=er(a));let n=(({controlsWithPriority:e,defaultControlsObj:t})=>{const a=e.find((e=>!Object(it.isEmpty)(e)));return null==a?void 0:a.map((e=>e.fieldName in t?{...t[e.fieldName],...e}:e))})({controlsWithPriority:[e,t],defaultControlsObj:f});return n&&0!==n.length?(n=n.map((e=>{var t,a;return{fieldName:e.fieldName,title:e.title,selectedOptions:null!==(t=e.selectedOptions)&&void 0!==t?t:[],existsSelected:null!==(a=e.existsSelected)&&void 0!==a&&a,exclude:e.exclude}})),tr({controls:n,defaultControls:d})):d}),[F,d,_,f]),H=Object(n.useCallback)((e=>"number"!==e.type),[]),G=Object(n.useCallback)((async(e,{addOptionsListControl:a})=>{const n={...e,defaultControlWidth:"small",viewMode:Ki.ViewMode.VIEW,timeRange:r,filters:l,query:c,chainingSystem:u},i=V();return P.current=!0,i.forEach(((e,i)=>{a(n,{controlId:String(i),...Ui,dataViewId:null!=t?t:"",...e})})),{initialInput:n,settings:{showAddButton:!1,staticDataViewId:null!=t?t:"",editorConfig:{hideWidthSettings:!0,hideDataViewSelector:!0,hideAdditionalSettings:!0}},fieldFilterPredicate:H}}),[t,r,l,u,c,V,H]);(({controlGroupInput:e})=>{const t=Object(o.useDispatch)(),a=Object(n.useMemo)((()=>{if(e)return er(e)}),[e]);Object(n.useEffect)((()=>{a&&(null==e?void 0:e.viewMode)===Ki.ViewMode.VIEW&&t(Object(Zi.updateUrlParam)({key:Ji.a.pageFilter,value:Xi(a)}))}),[a,t,e])})({controlGroupInput:C});const Q=Object(n.useCallback)((()=>{var e;j&&(null==y||y.updateInput({panels:null===(e=_())||void 0===e?void 0:e.panels})),w(),N(!1)}),[y,w,_,j]),W=Object(n.useCallback)((async()=>{if(!y)return;const e=er(y.getInput()),a=tr({controls:e,defaultControls:d});if(!Object(it.isEqualWith)(a,e,ar("fieldName"))){null==y||y.updateInput({panels:{}});for(const e of a)await(null==y?void 0:y.addOptionsListControl({title:e.title,...Ui,dataViewId:null!=t?t:"",selectedOptions:e.selectedOptions,...e}))}}),[y,t,d]),K=Object(n.useCallback)((async()=>{await W(),w(),N(!1)}),[w,W]),Y=Object(n.useCallback)(((e,t)=>{let a=e;var n;return t===Qi.OPTIONS_LIST_CONTROL&&(a={...e,...Ui},e.fieldName in f&&(a={...a,...f[e.fieldName],title:null!==(n=e.title)&&void 0!==n?n:a.title})),a}),[f]),J=Object(n.useCallback)((()=>{null==y||y.openAddDataControlFlyout({controlInputTransform:Y})}),[y,Y]);return i.a.createElement(rr.Provider,{value:{dataViewId:null!=t?t:"",initialControls:d,isViewMode:x,controlGroup:y,controlGroupInputUpdates:C,hasPendingChanges:j,pendingChangesPopoverOpen:S,setHasPendingChanges:I,switchToEditMode:T,switchToViewMode:w,openPendingChangesPopover:O,closePendingChangesPopover:k,setShowFiltersChangedBanner:N,saveChangesHandler:K,discardChangesHandler:Q}},i.a.createElement(Or,{className:"filter-group__wrapper"},i.a.createElement(U.EuiFlexGroup,{alignItems:"center",justifyContent:"center",gutterSize:"s"},Array.isArray(F)?i.a.createElement(U.EuiFlexItem,{grow:!0,"data-test-subj":Pi},i.a.createElement(Wi.ControlGroupRenderer,{ref:$,getCreationOptions:G}),y?null:i.a.createElement(Gi,null)):null,x||D?null:i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(xr,{onClick:J,isDisabled:C&&Object.values(C.panels).length>=4})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(jr,{onClick:K}))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(Er,null))),D?i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,{size:"l"}),i.a.createElement(Sr,{saveChangesHandler:K,discardChangesHandler:Q})):null))},Ir=i.a.createElement(Gi,null),e=>{const t=Object(nr.a)();return t?i.a.createElement(Tr,Ni()({},e,{spaceId:t})):null!=Ir?Ir:i.a.createElement(U.EuiButton,{color:"text"},i.a.createElement(U.EuiLoadingSpinner,{"data-test-subj":"filter-group__loading"}))});var Tr,Ir;const Cr="security_solution_alerts_dv",Mr=e=>{const{onFilterChange:t,...a}=e,{indexPattern:{title:r},dataViewId:o}=Object(g.d)(f.SourcererScopeName.detections),[l,c]=Object(n.useState)(!0),{services:{dataViews:u}}=Object(m.j)();Object(n.useEffect)((()=>((async()=>{const{timeFieldName:e="@timestamp"}=await u.get(null!=o?o:"");await u.create({id:Cr,name:"Security Solution Alerts DataView",title:r,allowNoIndex:!0,timeFieldName:e}),c(!1)})(),()=>u.clearInstanceCache())),[r,u,o]);const[d]=Object(n.useState)(s.F),p=Object(n.useCallback)((e=>{if(!t)return;const a=e.map((e=>({...e,meta:{...e.meta,disabled:!1}})));t(a)}),[t]);return l?i.a.createElement(U.EuiFlexItem,{grow:!0},i.a.createElement(Gi,null)):i.a.createElement(wr,Ni()({dataViewId:Cr,onFilterChange:p,initialControls:d},a))},_r=(e,t)=>Object(it.isEqual)(e,t),Fr=i.a.memo(Mr,_r),Ar=G.a.div.withConfig({displayName:"StyledFullHeightContainer",componentId:"sc-7qbqfc-0"})(["display:flex;flex-direction:column;flex:1 1 auto;"]),Dr=({clearEventsLoading:e,clearEventsDeleted:t})=>{const a=Object(o.useDispatch)(),r=Object(n.useRef)(null),l=Object(n.useMemo)((()=>R.j.getTableByIdSelector()),[]),c=Object(j.b)((e=>{var t;return(null!==(t=l(e,R.e.alertsOnAlertsPage))&&void 0!==t?t:R.q).graphEventId})),u=Object(j.b)((e=>{var t;return(null!==(t=l(e,R.e.alertsOnAlertsPage))&&void 0!==t?t:R.q).isLoading})),d=Object(n.useMemo)((()=>te.d.globalFiltersQuerySelector()),[]),b=Object(n.useMemo)((()=>te.d.globalQuerySelector()),[]),y=Object(j.a)(b),v=Object(j.a)(d),{to:E,from:k}=Object(J.a)(),{globalFullScreen:O}=Object(fe.a)(),[{loading:w,isAuthenticated:T,hasEncryptionKey:I,signalIndexName:C,canUserREAD:M,hasIndexRead:_,hasIndexWrite:F,hasIndexMaintenance:A}]=Object(le.b)(),{loading:D,needsConfiguration:N}=Object(me.a)(),P=Object(K.a)("alertsPageFiltersEnabled"),[L,B]=Object(n.useState)([]),q=Object(j.b)((e=>{var t;return(null!==(t=l(e,R.e.alertsOnAlertsPage))&&void 0!==t?t:R.q).updated})),[z,$]=Object(n.useState)(),[V,H]=Object(n.useState)(),{indexPattern:G,runtimeMappings:ne,loading:ie}=Object(g.d)(f.SourcererScopeName.detections),{formatUrl:re}=Object(p.m)(S.a.rules),{showBuildingBlockAlerts:se,showOnlyThreatIndicatorAlerts:ce}=Object(W.a)(R.e.alertsOnAlertsPage),de=w||D,{application:{navigateToUrl:Ee},timelines:xe,data:je}=Object(m.j)().services,{filterManager:Se}=je.query,ke=Object(n.useMemo)((()=>[...v,...Object(ve.d)(se),...Object(ve.e)(ce)]),[se,ce,v]),Oe=Object(n.useMemo)((()=>{var e;return P?z:Object(ve.a)(null!==(e=L[0])&&void 0!==e?e:"open")}),[L,z,P]);Object(n.useEffect)((()=>{V&&(u||V.reload())}),[u,V]);const we=Object(n.useCallback)((({field:e,value:t,negate:a})=>{Se.addFilters([{meta:{alias:null,disabled:!1,negate:null!=a&&a},...null!=t?{query:{match_phrase:{[e]:t}}}:{exists:{field:e}}}])}),[Se]),Te=Object(n.useCallback)((({x:e})=>{if(!e)return;const[t,n]=e;a(Object(ae.setAbsoluteRangeDatePicker)({id:Y.a.global,from:new Date(t).toISOString(),to:new Date(n).toISOString()}))}),[a]),Ie=Object(n.useCallback)((e=>{e.preventDefault(),Ee(re(Object(Z.e)()))}),[re,Ee]),Ce=Object(n.useMemo)((()=>[...ke,...null!=Oe?Oe:[]]),[ke,Oe]),Me=Object(n.useMemo)((()=>[...Object(ve.d)(se),...Object(ve.e)(ce),...null!=Oe?Oe:[]]),[se,ce,Oe]),{signalIndexNeedsInit:_e,pollForSignalIndex:Fe}=Object(Oi.a)(),Ae=Object(n.useCallback)((()=>{Object(he.j)(r.current)}),[r]),De=Object(n.useCallback)((()=>{Object(he.m)()}),[]),Ne=Object(n.useCallback)((e=>{Object(Q.isTab)(e)&&Object(he.l)({containerElement:r.current,keyboardEvent:e,onSkipFocusBeforeEventsTable:Ae,onSkipFocusAfterEventsTable:De})}),[r,Ae,De]),Pe=Object(n.useCallback)((e=>{if($(e),e.length){const a=e.find((e=>"kibana.alert.workflow_status"===e.meta.key));if(a){var t;const e=a.meta.params?a.meta.params:[null===(t=a.query)||void 0===t?void 0:t.match_phrase["kibana.alert.workflow_status"]];B(e)}else B([])}}),[]),Re=Object(n.useCallback)((a=>{const n=R.e.alertsOnAlertsPage;e({id:n}),t({id:n}),B([a])}),[e,t,B]),Le=Object(n.useMemo)((()=>!!P&&!Array.isArray(z)),[z,P]),Be=Object(n.useMemo)((()=>de||Le),[de,Le]),qe=Object(n.useMemo)((()=>ie||Le),[ie,Le]),ze=Object(n.useMemo)((()=>Be||de),[Be,de]),$e=Object(n.useMemo)((()=>{var e;return P?i.a.createElement(Fr,{onFilterChange:Pe,filters:ke,query:y,timeRange:{from:k,to:E,mode:"absolute"},chainingSystem:"HIERARCHICAL",onInit:H}):i.a.createElement(U.EuiFlexGroup,{alignItems:"center",justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(_i.a,{status:null!==(e=L[0])&&void 0!==e?e:"open",onFilterGroupChanged:Re})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},i.a.createElement(U.EuiFlexItem,{grow:!1},q&&xe.getLastUpdated({updatedAt:q||Date.now(),showUpdating:ze})))))}),[ke,P,L,Re,Pe,ze,k,y,xe,E,q]),Ve=Object(n.useCallback)((e=>i.a.createElement(Ai.a,{configId:s.e.ALERTS_PAGE,flyoutSize:"m",inputFilters:[...Me,...e],tableId:R.e.alertsOnAlertsPage,isLoading:Be})),[Me,Be]);return de?i.a.createElement(h.a,null,i.a.createElement(Ci.a,{border:!0,title:ue.k,isLoading:de}),i.a.createElement(U.EuiFlexGroup,{justifyContent:"center",alignItems:"center"},i.a.createElement(U.EuiLoadingSpinner,{size:"xl"}))):null==T||T||de?!de&&_e||N?i.a.createElement(h.a,null,i.a.createElement(Ci.a,{border:!0,title:ue.k}),i.a.createElement(pe,{needsSignalsIndex:_e,needsListsIndex:N})):i.a.createElement(i.a.Fragment,null,null!=I&&!I&&i.a.createElement(oe,null),i.a.createElement(wi.a,null),i.a.createElement(Ti.a,null),_e||!1!==_&&!1!==M?!_e&&_&&M?i.a.createElement(Ar,{onKeyDown:Ne,ref:r},i.a.createElement(U.EuiWindowEvent,{event:"resize",handler:x.noop}),i.a.createElement(X.a,{show:Object(he.n)({globalFullScreen:O,graphEventId:c})},i.a.createElement(ee.a,{id:Y.a.global,pollForSignalIndex:Fe,indexPattern:G})),i.a.createElement(h.a,{noPadding:O,"data-test-subj":"detectionsAlertsPage"},i.a.createElement(ye.a,{show:!O},i.a.createElement(Ci.a,{title:ue.k},i.a.createElement(ge.l,{onClick:Ie,deepLinkId:S.a.rules,"data-test-subj":"manage-alert-detection-rules",fill:!0},ue.b)),i.a.createElement(U.EuiHorizontalRule,{margin:"none"}),i.a.createElement(U.EuiSpacer,{size:"l"}),$e,i.a.createElement(U.EuiSpacer,{size:"l"}),i.a.createElement(ki,{addFilter:we,alertsDefaultFilters:Ce,isLoadingIndexPattern:qe,query:y,runtimeMappings:ne,signalIndexName:C,updateDateRangeCallback:Te}),i.a.createElement(U.EuiSpacer,{size:"l"})),i.a.createElement(Fi.a,{currentAlertStatusFilterValue:L,defaultFilters:Me,from:k,globalFilters:v,globalQuery:y,hasIndexMaintenance:null!=A&&A,hasIndexWrite:null!=F&&F,loading:Be,renderChildComponent:Ve,runtimeMappings:ne,signalIndexName:C,tableId:R.e.alertsOnAlertsPage,to:E}))):i.a.createElement(Mi.a,null):i.a.createElement(Ii.a,{pageName:ue.k.toLowerCase(),docLinkSelector:e=>e.siem.privileges})):i.a.createElement(h.a,null,i.a.createElement(Ci.a,{border:!0,title:ue.k}),i.a.createElement(be,null))},Nr=Object(o.connect)(null,(e=>({clearSelected:({id:t})=>e(R.h.clearSelected({id:t})),clearEventsLoading:({id:t})=>e(R.h.clearEventsLoading({id:t})),clearEventsDeleted:({id:t})=>e(R.h.clearEventsDeleted({id:t}))})))(i.a.memo(Dr)),Pr=$.i18n.translate("xpack.securitySolution.badge.readOnly.text",{defaultMessage:"Read only"});var Rr=a(285);function Lr(e){const{hasKibanaREAD:t,hasKibanaCRUD:a}=Object(Rr.a)(),i=Object(m.j)().services.chrome;Object(n.useEffect)((()=>(t&&!a&&i.setBadge({text:Pr,tooltip:e,iconType:"glasses"}),()=>{i.setBadge()})),[i,t,a,e])}var Br=a(50),qr=a.n(Br),zr=a(56),$r=a(58),Vr=a(122),Ur=a(1382);const Hr=({index:e,alertId:t,isSecurityFlyoutEnabled:a},n)=>{if(!a)return Object(zr.encode)({panelView:"eventDetail",params:{eventId:t,indexName:e}});if(n)return n;const i=Object(zr.encode)((({index:e,eventId:t,scopeId:a})=>({right:{id:Ur.b,params:{id:t,indexName:e,scopeId:a}},left:void 0,preview:[]}))({index:e,eventId:t,scopeId:"alerts-page"}));return i};var Gr=a(1383);const Qr=()=>{var e;const{alertId:t}=Object(B.useParams)(),{search:a}=Object(B.useLocation)(),r=new URLSearchParams(a),l=r.get("timestamp"),c=null!==(e=r.get("index"))&&void 0!==e?e:`.internal${s.v}-default`,u=Object(n.useMemo)((()=>Vr.d.inputsSelector()),[]),d=Object(o.useSelector)(u),{linkTo:p,timerange:m}=d.global,{linkTo:b,timerange:g}=d.timeline,f=null!=l?l:m.from,y=qr()(null!=l?l:m.to).add("5","minutes"),h=Object(zr.encode)({global:{[Ji.a.timerange]:{kind:"absolute",from:f,to:y},linkTo:p},timeline:{[Ji.a.timerange]:g,linkTo:b}}),v=Object(zr.encode)({language:"kuery",query:`_id: ${t}`}),E={fieldName:at.jb,title:"Status",selectedOptions:[],existsSelected:!1},x=Object(zr.encode)(Xi([E])),j=r.get(Gr.a),[S]=Object($r.useUiSetting$)(s.lb),k=new URLSearchParams({[Ji.a.appQuery]:v,[Ji.a.timerange]:h,[Ji.a.pageFilter]:x,[Ji.a.eventFlyout]:Hr({index:c,alertId:t,isSecurityFlyoutEnabled:S},j)}),O=`${s.d}?${k.toString()}`;return i.a.createElement(B.Redirect,{to:O})},Wr=()=>i.a.createElement(r.TrackApplicationView,{viewId:s.wc.alerts},i.a.createElement(Nr,null),i.a.createElement(E.a,{pageName:s.wc.alerts})),Kr=()=>(Lr(V),i.a.createElement(q.c,null,i.a.createElement(q.a,{path:s.d,exact:!0,component:Wr}),i.a.createElement(q.a,{path:`${s.g}/:alertId`,component:Qr}),i.a.createElement(q.a,{component:z.a}))),Yr=i.a.memo(Kr),Jr=[{path:s.Y,render:({location:e})=>e.pathname===s.Y?i.a.createElement(B.Redirect,{to:{...e,pathname:s.d}}):i.a.createElement(B.Redirect,{to:{...e,pathname:e.pathname.replace(s.Y,"")}})},{path:s.d,component:()=>i.a.createElement(N,null,i.a.createElement(Yr,null))}],Xr=[R.e.alertsOnRuleDetailsPage,R.e.alertsOnAlertsPage];var Zr=a(198),es=a(120),ts=a(214),as=a(244);const ns=G.a.a.withConfig({displayName:"InvisibleAnchor",componentId:"sc-1v7ri7a-0"})(["display:none;"]),is=({blob:e,name:t,onDownload:a})=>{const r=Object(n.useRef)(null);return Object(n.useEffect)((()=>{if(e&&null!=r&&r.current){if("function"==typeof window.navigator.msSaveOrOpenBlob)window.navigator.msSaveBlob(e);else{const a=window.URL.createObjectURL(e);r.current.href=a,r.current.download=null!=t?t:"download.txt",r.current.click(),window.URL.revokeObjectURL(a)}a&&a()}}),[e,t,a]),i.a.createElement(ns,{ref:r})};var rs=a(108),ss=a(729),os=a(692),ls=a(742),cs=a(287);const us=G.a.div.withConfig({displayName:"MarkdownContainer",componentId:"sc-zuly7q-0"})(["max-height:200px;overflow-y:auto;&::-webkit-scrollbar{height:",";width:",";}&::-webkit-scrollbar-thumb{background-clip:content-box;background-color:",";border:"," solid transparent;}&::-webkit-scrollbar-corner,&::-webkit-scrollbar-track{background-color:transparent;}"],(({theme:e})=>e.eui.euiScrollBar),(({theme:e})=>e.eui.euiScrollBar),(({theme:e})=>Object(cs.rgba)(e.eui.euiColorDarkShade,.5)),(({theme:e})=>e.eui.euiScrollBarCorner)),ds=({cancelText:e,confirmText:t,contentText:a,onClose:n,onCancel:r,onConfirm:s,references:o=[],showModal:l,titleText:c})=>l?i.a.createElement(U.EuiConfirmModal,{maxWidth:460,title:c,onCancel:r,onConfirm:s,cancelButtonText:e,confirmButtonText:t,buttonColor:"danger",defaultFocusedButton:"confirm","data-test-subj":"referenceErrorModal"},i.a.createElement("p",null,a),i.a.createElement(us,null,i.a.createElement(U.EuiListGroup,{gutterSize:"none",showToolTips:!0},o.map(((e,t)=>i.a.createElement(U.EuiListGroupItem,{key:`${t}-${e}`,label:e})))))):null;ds.displayName="ReferenceErrorModalComponent";const ps=i.a.memo(ds);ps.displayName="ReferenceErrorModal";var ms=a(143),bs=a(688),gs=a(226),fs=a(418);const ys={contentText:"",rulesReferences:[],isLoading:!1,listId:"",listNamespaceType:"single"},hs=[{field:"created_at",label:ss.V,defaultOrder:"desc"}],vs=i.a.memo((()=>{const[{loading:e,canUserCRUD:t,canUserREAD:a}]=Object(le.b)(),{loading:r}=Object(me.a)(),s=e||r,{services:{http:o,notifications:l,timelines:c,application:{navigateToApp:u}}}=Object(m.j)(),{exportExceptionList:d,deleteExceptionList:p,duplicateExceptionList:b}=Object(ts.c)(o),[g,f]=Object(n.useState)(!1),[y,h]=Object(n.useState)(ys),[v,E]=Object(n.useState)(),[x,j]=Object(n.useState)(as.i.LOADING),[S,k,O,w,T,I,C]=Object(ts.g)({errorMessage:ss.n,filterOptions:{...v,types:[es.b.DETECTION,es.b.ENDPOINT]},http:o,namespaceTypes:["single","agnostic"],notifications:l,hideLists:gs.a}),[M,_,F]=Object(ls.a)({exceptionLists:null!=k?k:[]}),[A,D]=Object(n.useState)(!0),[N,P]=Object(n.useState)(Date.now()),[R,L]=Object(n.useState)({}),[B,q]=Object(n.useState)(!1),{addError:z,addSuccess:$}=Object(rs.a)(),V=!M&&!A,H=!S&&!_.length,G=x===as.i.SEARCHING,Q=x===as.i.LOADING,W=Object(n.useCallback)((e=>()=>{l.toasts.addSuccess({title:ss.cb(null!=e?e:y.listId)})}),[l.toasts,y.listId]),K=Object(n.useCallback)((e=>{z(e,{title:ss.q})}),[z]),Y=Object(n.useCallback)((({id:e,namespaceType:t})=>async()=>{try{null!=F[e]&&(h({contentText:F[e].rules.length>0?ss.eb(F[e].rules.length):ss.bb(F[e].name),rulesReferences:F[e].rules.map((({name:e})=>e)),isLoading:!0,listId:e,listNamespaceType:t}),f(!0))}catch(e){K(e)}}),[F,K]),J=Object(n.useCallback)(((e,t)=>a=>{$(ss.u(t)),L({name:e,blob:a})}),[$]),X=Object(n.useCallback)((e=>{z(e,{title:ss.s})}),[z]),Z=Object(n.useCallback)((({id:e,listId:t,name:a,namespaceType:n,includeExpiredExceptions:i})=>async()=>{await d({id:e,includeExpiredExceptions:i,listId:t,namespaceType:n,onError:X,onSuccess:J(t,a)})}),[d,X,J]),ee=Object(n.useCallback)((()=>{null!=T&&(P(Date.now()),T())}),[T]);Object(n.useEffect)((()=>{!A||s||S||M||D(!1)}),[A,s,S,M]);const te=Object(n.useCallback)((async({query:e,queryText:t})=>{j(as.i.SEARCHING);const a=Object(bs.e)({defaultSearchTerm:"name",filterOptions:{name:null,list_id:null,created_by:null,type:null,tags:null},query:e,searchValue:t});E(a)}),[]),ae=Object(n.useCallback)((e=>{z(e,{title:ss.r})}),[z]),ne=Object(n.useCallback)((e=>()=>{$(ss.t(e)),ee()}),[$,ee]),ie=Object(n.useCallback)((({listId:e,name:t,namespaceType:a,includeExpiredExceptions:n})=>async()=>{await b({includeExpiredExceptions:n,listId:e,namespaceType:a,onError:ae,onSuccess:ne(t)})}),[b,ne,ae]),re=Object(n.useCallback)((()=>{f(!1),h({contentText:"",rulesReferences:[],isLoading:!1,listId:"",listNamespaceType:"single"})}),[]),se=Object(n.useCallback)((async()=>{const e=y.listId,t=y.listNamespaceType,a=F[e].rules;try{await Promise.all(a.map((t=>{var a;const n=new AbortController,i=(null!==(a=t.exceptions_list)&&void 0!==a?a:[]).filter((({id:t})=>t!==e));return Object(ms.p)({ruleProperties:{rule_id:t.rule_id,exceptions_list:i},signal:n.signal})}))),await p({id:e,namespaceType:t,onError:K,onSuccess:W()})}catch(e){K(e)}finally{h(ys),f(!1),null!=T&&T()}}),[y.listId,y.listNamespaceType,F,p,K,W,T]),oe=Object(n.useCallback)((()=>{L({})}),[]),[ce,ue]=Object(n.useState)(0),[de,pe]=Object(n.useState)(5),[be,ge]=Object(n.useState)(!1),fe=()=>ge(!1),ye=i.a.createElement(U.EuiButtonEmpty,{size:"xs",color:"text",iconType:"arrowDown",iconSide:"right",onClick:()=>ge((e=>!e))},ss.ab(de)),he=e=>e===de?"check":"empty",ve=Object(n.useCallback)((e=>{fe(),pe(e),ue(0)}),[]),Ee=[i.a.createElement(U.EuiContextMenuItem,{key:"5 rows",icon:he(5),onClick:()=>ve(5)},"5 rows"),i.a.createElement(U.EuiContextMenuItem,{key:"10 rows",icon:he(10),onClick:()=>ve(10)},"10 rows"),i.a.createElement(U.EuiContextMenuItem,{key:"25 rows",icon:he(25),onClick:()=>ve(25)},"25 rows")];Object(n.useEffect)((()=>{w({page:ce+1,perPage:de,total:0})}),[ce,de,w]);const[xe,je]=Object(n.useState)(!1),[Se,ke]=Object(n.useState)(!1),[Oe,we]=Object(n.useState)(!1),Te=()=>{ke(!1),je(!1)},Ie=()=>we(!0),Ce=Object(n.useMemo)((()=>{var e;return null===(e=a&&!t)||void 0===e||e}),[a,t]);return Object(n.useEffect)((()=>{G&&H?j(as.i.EMPTY_SEARCH):V?Q&&H?j(as.i.EMPTY):Q&&V&&j(null):j(as.i.LOADING)}),[G,H,V,Q]),i.a.createElement(i.a.Fragment,null,i.a.createElement(Ti.a,null),i.a.createElement(U.EuiPageHeader,{pageTitle:ss.a,description:i.a.createElement(U.EuiFlexGroup,{gutterSize:"xs",direction:"column"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiFlexGroup,{gutterSize:"none",direction:"row"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiText,null,ss.b)),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiButtonIcon,{iconType:"popout","aria-label":"go-to-rules",color:"primary",onClick:()=>u("security",{openInNewTab:!0,path:"/rules"})})))),i.a.createElement(U.EuiFlexItem,null,c.getLastUpdated({showUpdating:s,updatedAt:N}))),rightSideItems:[i.a.createElement(U.EuiPopover,{"data-test-subj":"manageExceptionListCreateButton",button:i.a.createElement(U.EuiButton,{iconType:"arrowDown",onClick:()=>je((e=>!e))},ss.e),isOpen:xe,closePopover:Te},i.a.createElement(U.EuiContextMenuPanel,{items:[i.a.createElement(U.EuiContextMenuItem,{key:"createList","data-test-subj":"manageExceptionListCreateExceptionListButton",onClick:()=>{Te(),Ie()}},ss.g),i.a.createElement(U.EuiContextMenuItem,{key:"createItem","data-test-subj":"manageExceptionListCreateExceptionButton",onClick:()=>{Te(),ke(!0)}},ss.f)]})),i.a.createElement(U.EuiButton,{"data-test-subj":"importSharedExceptionList",iconType:"importAction",onClick:()=>q(!0)},ss.G)]}),Oe&&i.a.createElement(os.a,{handleRefresh:ee,http:o,addSuccess:$,addError:z,handleCloseFlyout:()=>we(!1)}),Se&&i.a.createElement(fs.a,{rules:null,isEndpointItem:!1,isBulkAction:!1,showAlertCloseOptions:!0,onCancel:()=>ke(!1),onConfirm:e=>{ke(!1),e&&ee()}}),B&&i.a.createElement(os.d,{handleRefresh:ee,http:o,addSuccess:$,addError:z,setDisplayImportListFlyout:q}),i.a.createElement(U.EuiHorizontalRule,null),i.a.createElement("div",{"data-test-subj":"allExceptionListsPanel"},!A&&i.a.createElement(os.i,{onSearch:te}),i.a.createElement(U.EuiSpacer,{size:"m"}),null!=x?i.a.createElement(as.a,{isReadOnly:Ce,title:ss.L,viewerStatus:x,buttonText:ss.g,body:ss.M,onEmptyButtonStateClick:Ie}):i.a.createElement(i.a.Fragment,null,i.a.createElement(os.c,{totalExceptionLists:_.length,onRefresh:ee,setSort:C,sort:I,sortFields:hs}),_.length>0&&i.a.createElement("div",{"data-test-subj":"exceptionsTable"},_.map((e=>i.a.createElement(os.b,{key:e.list_id,"data-test-subj":"exceptionsListCard",readOnly:Ce,exceptionsList:e,handleDelete:Y,handleExport:Z,handleDuplicate:ie}))))),i.a.createElement(U.EuiFlexGroup,null,i.a.createElement(U.EuiFlexItem,{style:{flex:"1 1 auto"}},i.a.createElement(U.EuiFlexGroup,{alignItems:"flexStart"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiPopover,{button:ye,isOpen:be,closePopover:fe},i.a.createElement(U.EuiContextMenuPanel,{items:Ee}))))),i.a.createElement(U.EuiFlexItem,{style:{alignItems:"flex-end"}},i.a.createElement(U.EuiFlexGroup,{alignItems:"flexEnd"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiPagination,{"aria-label":"Custom pagination example",pageCount:O.total?Math.ceil(O.total/de):0,activePage:ce,onPageClick:e=>ue(e)}))))),i.a.createElement(is,{blob:R.blob,name:`${R.name}.ndjson`,onDownload:oe}),i.a.createElement(ps,{cancelText:ss.O,confirmText:ss.P,contentText:y.contentText,onCancel:re,onClose:re,onConfirm:se,references:y.rulesReferences,showModal:g,titleText:ss.Q})))}));vs.displayName="SharedLists";var Es=a(757),xs=a(743);const js=()=>{const{detailName:e}=Object(B.useParams)(),{isLoading:t,invalidListId:a,isReadOnly:r,list:o,canUserEditList:l,listId:c,linkedRules:u,exportedList:d,handleOnDownload:p,viewerStatus:m,listName:b,listDescription:g,showManageRulesFlyout:f,headerBackOptions:y,showReferenceErrorModal:h,referenceModalState:v,showManageButtonLoader:x,refreshExceptions:j,disableManageButton:S,onEditListDetails:k,onDuplicateList:O,onExportList:w,onManageRules:T,onSaveManageRules:I,onCancelManageRules:C,onRuleSelectionChange:M,handleDelete:_,handleCloseReferenceErrorModal:F,handleReferenceDelete:A}=Object(Es.a)(e),[D,N]=Object(n.useState)(null),P=Object(n.useCallback)((()=>N(null)),[N]),R=Object(n.useCallback)((e=>{N(e)}),[N]),L=Object(n.useCallback)((()=>{(null==o?void 0:o.type)===es.b.ENDPOINT?w(!0):R("export")}),[R,o,w]),q=Object(n.useCallback)((()=>{R("duplicate")}),[R]),$=Object(n.useMemo)((()=>m===as.i.ERROR?i.a.createElement(as.a,{isReadOnly:r,viewerStatus:m}):t?i.a.createElement(U.EuiSkeletonText,{lines:4,"data-test-subj":"loading"}):!a&&b&&o?i.a.createElement(i.a.Fragment,null,i.a.createElement(Ti.a,null),i.a.createElement(as.d,{name:b,description:g,listId:c,linkedRules:u,isReadonly:r,canUserEditList:l,backOptions:y,securityLinkAnchorComponent:os.f,onEditListDetails:k,onExportList:L,onDeleteList:_,onManageRules:T,onDuplicateList:q,dataTestSubj:"exceptionListManagement"}),i.a.createElement(is,{blob:d,name:`${c}.ndjson`,onDownload:p}),i.a.createElement(os.h,{list:o,refreshExceptions:j,isReadOnly:r}),i.a.createElement(ps,{cancelText:Zr.bb,confirmText:Zr.cb,contentText:v.contentText,onCancel:F,onClose:F,onConfirm:A,references:v.rulesReferences,showModal:h,titleText:Zr.db}),f?i.a.createElement(os.j,{linkedRules:u,showButtonLoader:x,saveIsDisabled:S,onSave:I,onCancel:C,onRuleSelectionChange:M}):null,D&&i.a.createElement(xs.b,{onModalConfirm:"export"===D?w:O,handleCloseModal:P,action:D})):i.a.createElement(z.a,null)),[m,r,t,a,b,o,g,c,u,l,y,k,L,_,T,q,d,p,j,v.contentText,v.rulesReferences,F,A,h,f,x,S,I,C,M,D,w,O,P]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(E.a,{pageName:s.wc.exceptions,state:{listName:b}}),$)};js.displayName="ListsDetailViewComponent";const Ss=i.a.memo(js);Ss.displayName="ListsDetailView";const ks=()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:s.wc.exceptions},i.a.createElement(vs,null),i.a.createElement(E.a,{pageName:s.wc.exceptions}))),Os=()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:s.wc.exceptions},i.a.createElement(Ss,null))),ws=()=>(Lr(Zr.ab),i.a.createElement(q.c,null,i.a.createElement(q.a,{path:s.tb,exact:!0,component:ks}),i.a.createElement(q.a,{path:s.ub,component:Os}),i.a.createElement(q.a,{component:z.a}))),Ts=i.a.memo(ws),Is=[{path:s.tb,render:()=>i.a.createElement(Ts,null)}];var Cs=a(184),Ms=a(51),_s=a(661),Fs=a(44),As=a(130),Ds=a.n(As),Ns=a(3),Ps=a(530);const Rs=$.i18n.translate("xpack.securitySolution.lastEventTime.errorSearchDescription",{defaultMessage:"An error has occurred on last event time search"}),Ls=$.i18n.translate("xpack.securitySolution.lastEventTime.failSearchDescription",{defaultMessage:"Failed to run search on last event time"});var Bs=a(117),qs=a(132);const zs=Object(n.memo)((({hostName:e,userName:t,indexKey:a,ip:r,indexNames:s})=>{const[o,{lastSeen:l,errorMessage:c}]=(({indexKey:e,indexNames:t,details:a})=>{const{data:i}=Object(m.j)().services,r=Object(n.useRef)(x.noop),s=Object(n.useRef)(new AbortController),o=Object(n.useRef)(new Ns.Subscription),[l,c]=Object(n.useState)(!1),[u,d]=Object(n.useState)({defaultIndex:t,factoryQueryType:Ps.c.lastEventTime,indexKey:e,details:a}),[p,b]=Object(n.useState)({lastSeen:null,refetch:r.current,errorMessage:void 0}),{addError:g,addWarning:f}=Object(rs.a)(),y=Object(n.useCallback)((e=>{const t=async()=>{s.current=new AbortController,c(!0),o.current=i.search.search(e,{strategy:"timelineSearchStrategy",abortSignal:s.current.signal}).subscribe({next:e=>{Object(Ms.isCompleteResponse)(e)?(c(!1),b((t=>({...t,errorMessage:void 0,lastSeen:e.lastSeen,refetch:r.current})))):Object(Ms.isErrorResponse)(e)&&(c(!1),f(Rs))},error:e=>{c(!1),g(e,{title:Ls}),b((t=>({...t,errorMessage:e.message})))}})};o.current.unsubscribe(),s.current.abort(),t(),r.current=t}),[i.search,g,f]);return Object(n.useEffect)((()=>{d((n=>{const i={...n,defaultIndex:t,indexKey:e,details:a};return Ds()(n,i)?n:i}))}),[t,a,e]),Object(n.useEffect)((()=>(y(u),()=>{o.current.unsubscribe(),s.current.abort()})),[u,y]),[l,p]})({indexKey:a,indexNames:s,details:{hostName:e,ip:r,userName:t}});return null!=c?i.a.createElement(U.EuiToolTip,{position:"top",content:c,"data-test-subj":"last_event_time_error","aria-label":"last_event_time_error",id:`last_event_time_error-${a}`},i.a.createElement(U.EuiIcon,{"aria-describedby":`last_event_time_error-${a}`,type:"warning"})):i.a.createElement(i.a.Fragment,null,o&&i.a.createElement(U.EuiLoadingSpinner,{size:"m"}),o||null==l||"Invalid Date"!==new Date(l).toString()?!o&&null!=l&&i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.headerPage.pageSubtitle",defaultMessage:"Last event: {beat}",values:{beat:i.a.createElement(qs.b,{value:l})}}):l,!o&&null==l&&Object(Bs.d)())}));zs.displayName="LastEventTime";var $s=a(274),Vs=a(531);const Us=$.i18n.translate("xpack.securitySolution.paginatedTable.showingSubtitle",{defaultMessage:"Showing"}),Hs=$.i18n.translate("xpack.securitySolution.paginatedTable.rowsButtonLabel",{defaultMessage:"Rows per page"}),Gs=$.i18n.translate("xpack.securitySolution.paginatedTable.tooManyResultsToastTitle",{defaultMessage:" - too many results"}),Qs=$.i18n.translate("xpack.securitySolution.paginatedTable.tooManyResultsToastText",{defaultMessage:"Narrow your query to better filter the results"});var Ws=a(520);const Ks=({activePage:e,columns:t,dataTestSubj:a="paginated-table",headerCount:r,headerFilters:o,headerSupplement:l,headerTitle:c,headerTooltip:u,headerUnit:d,headerSubtitle:p,id:m,isInspect:b,itemsPerRow:g,limit:f,loading:y,loadPage:h,onChange:v=x.noop,pageOfItems:E,setQuerySkip:j,showMorePagesIndicator:S,sorting:k=null,split:O,stackHeader:w,totalCount:T,updateActivePage:I,updateLimitPagination:C})=>{const[M,_]=Object(n.useState)(y),[F,A]=Object(n.useState)(e),[D,N]=Object(n.useState)(-1===r),[P,R]=Object(n.useState)(!1),L=Math.ceil(T/f),B=Object(Vs.f)()[1];Object(n.useEffect)((()=>{A(e)}),[e]),Object(n.useEffect)((()=>{r>=0&&D&&N(!1)}),[D,r]),Object(n.useEffect)((()=>{_(y)}),[y]);const q=()=>{R(!1)},z=i.a.createElement(U.EuiButtonEmpty,{size:"xs",color:"text",iconType:"arrowDown",iconSide:"right",onClick:()=>{R(!P)}},`${Hs}: ${f}`),$=g&&g.map((e=>i.a.createElement(U.EuiContextMenuItem,{key:e.text,icon:f===e.numberOfRow?"check":"empty",onClick:()=>{q(),C(e.numberOfRow),I(0)}},e.text))),V=S?Zs:U.EuiFlexItem,H=Object(n.useMemo)((()=>k?{sort:{field:k.field,direction:k.direction}}:void 0),[k]),{toggleStatus:G,setToggleStatus:Q}=Object(Wn.a)(m),W=Object(n.useCallback)((e=>{Q(e),j(!e)}),[j,Q]);return i.a.createElement(Ve.c,{show:!D},i.a.createElement(Ws.a,{"data-test-subj":`${a}-loading-${y}`,loading:y},i.a.createElement(pn.a,{toggleStatus:G,toggleQuery:W,headerFilters:o,id:m,split:O,stackHeader:w,subtitle:!D&&p?`${Us}: ${p}`:d&&`${Us}: ${r>=0?r.toLocaleString():0} ${d}`,title:c,tooltip:u},!D&&l),G&&(D?i.a.createElement(U.EuiSkeletonText,{"data-test-subj":"initialLoadingPanelPaginatedTable",lines:10}):i.a.createElement(i.a.Fragment,null,i.a.createElement(Js,{"data-test-subj":"paginated-basic-table",columns:t,items:E,onChange:v,sorting:H}),i.a.createElement(Xs,null,i.a.createElement(U.EuiFlexItem,null,g&&g.length>0&&T>=g[0].numberOfRow&&i.a.createElement(U.EuiPopover,{id:"customizablePagination","data-test-subj":"loadingMoreSizeRowPopover",button:z,isOpen:P,closePopover:q,panelPaddingSize:"none",repositionOnScroll:!0},i.a.createElement(U.EuiContextMenuPanel,{items:$,"data-test-subj":"loadingMorePickSizeRow"}))),i.a.createElement(V,{grow:!1},T>0&&i.a.createElement(U.EuiPagination,{"data-test-subj":"numberedPagination",pageCount:L,activePage:F,onPageClick:e=>{if((e+1)*f>=s.N)return B({type:"addToaster",toast:{id:"PaginationWarningMsg",title:c+Gs,color:"warning",iconType:"warning",toastLifeTimeMs:1e4,text:Qs}});A(e),h(e),I(e)}}))),(b||M)&&i.a.createElement($s.a,{"data-test-subj":"loadingPanelPaginatedTable",overlay:!0,size:"xl"})))))},Ys=Object(n.memo)(Ks),Js=G()(U.EuiBasicTable).withConfig({displayName:"BasicTable",componentId:"sc-7nngg3-0"})(["tbody{th,td{vertical-align:top;}.euiTableCellContent{display:block;}}"]);Js.displayName="BasicTable";const Xs=G()(U.EuiFlexGroup).attrs((()=>({alignItems:"center",responsive:!1}))).withConfig({displayName:"FooterAction",componentId:"sc-7nngg3-1"})(["margin-top:",";"],(({theme:e})=>e.eui.euiSizeXS));Xs.displayName="FooterAction";const Zs=G()(U.EuiFlexItem).withConfig({displayName:"PaginationEuiFlexItem",componentId:"sc-7nngg3-2"})(["@media only screen and (min-width:","){.euiButtonIcon:last-child{margin-left:28px;}.euiPagination{position:relative;}.euiPagination::before{bottom:0;color:",";content:'\\2026';font-size:",";padding:5px ",";position:absolute;right:",";}}"],(({theme:e})=>e.eui.euiBreakpoints.m),(({theme:e})=>e.eui.euiButtonColorDisabled),(({theme:e})=>e.eui.euiFontSizeS),(({theme:e})=>e.eui.euiSizeS),(({theme:e})=>e.eui.euiSizeL));Zs.displayName="PaginationEuiFlexItem";var eo=a(331),to=a(1388),ao=a(475),no=a(212),io=a(162);const ro=$.i18n.translate("xpack.securitySolution.usersRiskTable.userNameTitle",{defaultMessage:"User Name"}),so=$.i18n.translate("xpack.securitySolution.usersRiskTable.userRiskScoreTitle",{defaultMessage:"User risk score"}),oo=$.i18n.translate("xpack.securitySolution.usersRiskTable.userRiskToolTip",{defaultMessage:"User risk classification is determined by user risk score. Users classified as Critical or High are indicated as risky."}),lo=e=>$.i18n.translate("xpack.securitySolution.usersRiskTable.filteredUsersTitle",{values:{severity:e},defaultMessage:"View {severity} risk users"}),co=e=>$.i18n.translate("xpack.securitySolution.usersTable.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {user} other {users}}"}),uo=$.i18n.translate("xpack.securitySolution.usersTable.rows",{values:{numRows:5},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),po=$.i18n.translate("xpack.securitySolution.usersTable.rows",{values:{numRows:10},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),mo=$.i18n.translate("xpack.securitySolution.hostsRiskTable.usersTableTooltip",{defaultMessage:"The user risk table is not affected by the KQL time range. This table shows the latest recorded risk score for each user."}),bo=ao.c.UsersTableType.allUsers,go=[{text:to.d,numberOfRow:5},{text:to.c,numberOfRow:10}],fo=({users:e,totalCount:t,type:a,id:r,fakeTotalCount:s,loading:l,loadPage:c,showMorePagesIndicator:u,sort:d,setQuerySkip:p})=>{const b=Object(o.useDispatch)(),g=Object(n.useMemo)((()=>ao.e.allUsersSelector()),[]),{activePage:f,limit:y}=Object(j.a)((e=>g(e))),h=Object(io.a)().isPlatinumOrTrialLicense,{navigateTo:v}=Object(m.k)(),E=Object(n.useCallback)((e=>{b(ao.b.updateTableLimit({usersType:a,limit:e,tableType:bo}))}),[a,b]),x=Object(n.useCallback)((e=>{b(ao.b.updateTableActivePage({activePage:e,usersType:a,tableType:bo}))}),[a,b]),k=Object(n.useCallback)((e=>{if(null!=e.sort){const t=e.sort;t.direction===d.direction&&t.field===d.field||b(ao.b.updateTableSorting({sort:t,tableType:bo}))}}),[b,d]),O=Object(n.useCallback)((e=>{b(ao.b.updateUserRiskScoreSeverityFilter({severitySelection:[e]})),v({deepLinkId:S.a.users,path:Cs.UsersTableType.risk})}),[b,v]),w=Object(n.useMemo)((()=>((e,t)=>{const a=[{field:"name",name:to.g,truncateText:!1,sortable:!0,mobileOptions:{show:!0},render:e=>null!=e&&e.length>0?Object(eo.b)({fieldName:"user.name",values:[e],idPrefix:`users-table-${e}-name`,render:e=>i.a.createElement(ge.m,{userName:e})}):Object(Bs.f)(e)},{field:"lastSeen",name:to.b,sortable:!0,truncateText:!1,mobileOptions:{show:!0},render:e=>i.a.createElement(qs.b,{value:e})},{field:"domain",name:to.a,sortable:!1,truncateText:!1,mobileOptions:{show:!0},render:e=>null!=e&&e.length>0?Object(eo.b)({fieldName:"user.domain",values:[e],idPrefix:`users-table-${e}-domain`}):Object(Bs.f)(e)}];return e&&a.push({field:"risk",name:i.a.createElement(U.EuiToolTip,{content:to.i},i.a.createElement(i.a.Fragment,null,to.h," ",i.a.createElement(U.EuiIcon,{color:"subdued",type:"iInCircle",className:"eui-alignTop"}))),truncateText:!1,mobileOptions:{show:!0},sortable:!1,render:e=>null!=e?i.a.createElement(no.b,{toolTipContent:i.a.createElement(U.EuiLink,{onClick:()=>t(e)},i.a.createElement(U.EuiText,{size:"xs"},lo(e.toLowerCase()))),severity:e}):Object(Bs.d)()}),a})(h,O)),[h,O]);return i.a.createElement(Ys,{activePage:f,columns:w,dataTestSubj:`table-${bo}`,headerCount:t,headerTitle:to.f,headerUnit:to.e(t),id:r,itemsPerRow:go,limit:y,loading:l,loadPage:c,pageOfItems:e,showMorePagesIndicator:u,totalCount:s,updateLimitPagination:E,updateActivePage:x,sorting:d,onChange:k,setQuerySkip:p})};fo.displayName="UsersTableComponent";const yo=i.a.memo(fo);var ho=a(194),vo=a(508);const Eo=$.i18n.translate("xpack.securitySolution.userTab.errorFetchingsData",{defaultMessage:"Failed to query users data"}),xo=(e,t,a)=>{const n=e*t;return{activePage:e,cursorStart:n,fakePossibleCount:4<=e&&e>0?t*(e+2):5*t,querySize:a?t:t+n}},jo=Object(ft.a)(yo),So="UsersTable",ko=({endDate:e,filterQuery:t,indexNames:a,skip:r,setQuery:s,startDate:o,type:l,deleteQuery:c})=>{const{toggleStatus:u}=Object(Wn.a)(So),[d,p]=Object(n.useState)(r||!u);Object(n.useEffect)((()=>{p(r||!u)}),[r,u]);const m=Object(n.useMemo)((()=>ao.e.allUsersSelector()),[]),{activePage:b,limit:g,sort:f}=Object(j.a)((e=>m(e))),y=Object(K.a)("riskScoringRoutesEnabled"),{loading:h,result:{users:v,pageInfo:E,totalCount:S},search:k,refetch:O,inspect:w}=Object(ho.a)({factoryQueryType:vo.c.users,initialResult:{users:[],totalCount:0,pageInfo:{activePage:0,fakeTotalCount:0,showMorePagesIndicator:!1}},errorMessage:Eo,abort:d});return Object(n.useEffect)((()=>{d||k({filterQuery:t,defaultIndex:a,timerange:{interval:"12h",from:o,to:e},pagination:xo(b,g),sort:f,isNewRiskScoreModuleAvailable:y})}),[k,o,e,t,a,d,b,g,f,y]),i.a.createElement(jo,{users:v,deleteQuery:c,fakeTotalCount:Object(x.getOr)(50,"fakeTotalCount",E),id:So,inspect:w,loading:h,loadPage:x.noop,refetch:O,showMorePagesIndicator:Object(x.getOr)(!1,"showMorePagesIndicator",E),setQuery:s,totalCount:S,type:l,sort:f,setQuerySkip:p})};ko.displayName="AllUsersQueryTabBody";var Oo=a(705);const wo=$.i18n.translate("xpack.securitySolution.authenticationsTable.authentications",{defaultMessage:"Authentications"}),To=e=>$.i18n.translate("xpack.securitySolution.authenticationsTable.usersUnit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {user} other {users}}"}),Io=e=>$.i18n.translate("xpack.securitySolution.authenticationsTable.hostsUnit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {host} other {hosts}}"}),Co=$.i18n.translate("xpack.securitySolution.authenticationsTable.lastSuccessfulSource",{defaultMessage:"Last successful source"}),Mo=$.i18n.translate("xpack.securitySolution.authenticationsTable.lastSuccessfulDestination",{defaultMessage:"Last successful destination"}),_o=$.i18n.translate("xpack.securitySolution.authenticationsTable.lastSuccessfulTime",{defaultMessage:"Last success"}),Fo=$.i18n.translate("xpack.securitySolution.authenticationsTable.lastFailedSource",{defaultMessage:"Last failed source"}),Ao=$.i18n.translate("xpack.securitySolution.authenticationsTable.lastFailedDestination",{defaultMessage:"Last failed destination"}),Do=$.i18n.translate("xpack.securitySolution.authenticationsTable.lastFailedTime",{defaultMessage:"Last failure"}),No=$.i18n.translate("xpack.securitySolution.authenticationsTable.successes",{defaultMessage:"Successes"}),Po=$.i18n.translate("xpack.securitySolution.authenticationsTable.failures",{defaultMessage:"Failures"}),Ro=$.i18n.translate("xpack.securitySolution.authenticationsTable.user",{defaultMessage:"User"}),Lo=$.i18n.translate("xpack.securitySolution.authenticationsTable.host",{defaultMessage:"Host"}),Bo=$.i18n.translate("xpack.securitySolution.authenticationsTable.rows",{values:{numRows:5},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),qo=$.i18n.translate("xpack.securitySolution.authenticationsTable.rows",{values:{numRows:10},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),zo=$.i18n.translate("xpack.securitySolution.hosts.navigation.authenticationsTitle",{defaultMessage:"Authentications"}),$o=$.i18n.translate("xpack.securitySolution.hosts.navigaton.matrixHistogram.errorFetchingAuthenticationsData",{defaultMessage:"Failed to query authentications data"});var Vo=a(113);const Uo={title:"Authentication",description:"",visualizationType:"lnsXY",state:{visualization:{title:"Empty XY chart",legend:{isVisible:!0,position:"right",legendSize:"xlarge"},valueLabels:"hide",preferredSeriesType:"bar_stacked",layers:[{layerId:"3fd0c5d5-f762-4a27-8c56-14eee0223e13",accessors:["5417777d-d9d9-4268-9cdc-eb29b873bd65"],position:"top",seriesType:"bar_stacked",showGridlines:!1,layerType:"data",xAccessor:"b41a2958-650b-470a-84c4-c6fd8f0c6d37",yConfig:[{forAccessor:"5417777d-d9d9-4268-9cdc-eb29b873bd65",color:"#54b399"}]},{layerId:"bef502be-e5ff-442f-9e3e-229f86ca2afa",seriesType:"bar_stacked",accessors:["a3bf9dc1-c8d2-42d6-9e60-31892a4c509e"],layerType:"data",xAccessor:"cded27f7-8ef8-458c-8d9b-70db48ae340d",yConfig:[{forAccessor:"a3bf9dc1-c8d2-42d6-9e60-31892a4c509e",color:"#da8b45"}]}],yRightExtent:{mode:"full"},yLeftExtent:{mode:"full"},axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0}},query:{query:"",language:"kuery"},filters:[{meta:{index:"6f4dbdc7-35b6-4e20-ac53-1272167e3919",type:"custom",disabled:!1,negate:!1,alias:null,key:"query",value:'{"bool":{"must":[{"term":{"event.category":"authentication"}}]}}'},$state:{store:"appState"},query:{bool:{must:[{term:{"event.category":"authentication"}}]}}}],datasourceStates:{formBased:{layers:{"3fd0c5d5-f762-4a27-8c56-14eee0223e13":{columns:{"b41a2958-650b-470a-84c4-c6fd8f0c6d37":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto"}},"5417777d-d9d9-4268-9cdc-eb29b873bd65":{label:ei.e,dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___",filter:{query:'event.outcome : "success"',language:"kuery"},customLabel:!0}},columnOrder:["b41a2958-650b-470a-84c4-c6fd8f0c6d37","5417777d-d9d9-4268-9cdc-eb29b873bd65"],incompleteColumns:{}},"bef502be-e5ff-442f-9e3e-229f86ca2afa":{columns:{"cded27f7-8ef8-458c-8d9b-70db48ae340d":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto"}},"a3bf9dc1-c8d2-42d6-9e60-31892a4c509e":{label:ei.d,dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___",filter:{query:'event.outcome : "failure"',language:"kuery"},customLabel:!0}},columnOrder:["cded27f7-8ef8-458c-8d9b-70db48ae340d","a3bf9dc1-c8d2-42d6-9e60-31892a4c509e"],incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-3fd0c5d5-f762-4a27-8c56-14eee0223e13"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-bef502be-e5ff-442f-9e3e-229f86ca2afa"},{type:"index-pattern",name:"6f4dbdc7-35b6-4e20-ac53-1272167e3919",id:"{dataViewId}"}]};var Ho;const Go=()=>[tl,nl,Wo,Ko,Yo,Jo,Xo,Zo,el],Qo=[{text:Bo,numberOfRow:5},{text:qo,numberOfRow:10}],Wo={name:Po,field:"node.failures",truncateText:!1,mobileOptions:{show:!0},width:"8%"},Ko={name:_o,truncateText:!1,mobileOptions:{show:!0},render:({node:e})=>{var t,a;return Object(x.has)("lastSuccess.timestamp",e)&&null!=(null===(t=e.lastSuccess)||void 0===t?void 0:t.timestamp)?i.a.createElement(qs.b,{value:null===(a=e.lastSuccess)||void 0===a?void 0:a.timestamp}):Object(Bs.d)()}},Yo={name:Co,truncateText:!1,mobileOptions:{show:!0},render:({node:e})=>{var t,a;return Object(eo.b)({values:(null===(t=e.lastSuccess)||void 0===t||null===(a=t.source)||void 0===a?void 0:a.ip)||null,fieldName:"source.ip",idPrefix:`authentications-table-${e._id}-lastSuccessSource`,render:e=>i.a.createElement(ge.h,{ip:e})})}},Jo={name:Mo,truncateText:!1,mobileOptions:{show:!0},render:({node:e})=>{var t,a,n;return Object(eo.b)({values:null!==(t=null===(a=e.lastSuccess)||void 0===a||null===(n=a.host)||void 0===n?void 0:n.name)&&void 0!==t?t:null,fieldName:"host.name",idPrefix:`authentications-table-${e._id}-lastSuccessfulDestination`,render:e=>i.a.createElement(ge.d,{hostName:e})})}},Xo={name:Do,truncateText:!1,mobileOptions:{show:!0},render:({node:e})=>{var t,a;return Object(x.has)("lastFailure.timestamp",e)&&null!=(null===(t=e.lastFailure)||void 0===t?void 0:t.timestamp)?i.a.createElement(qs.b,{value:null===(a=e.lastFailure)||void 0===a?void 0:a.timestamp}):Object(Bs.d)()}},Zo={name:Fo,truncateText:!1,mobileOptions:{show:!0},render:({node:e})=>{var t,a;return Object(eo.b)({values:(null===(t=e.lastFailure)||void 0===t||null===(a=t.source)||void 0===a?void 0:a.ip)||null,fieldName:"source.ip",idPrefix:`authentications-table-${e._id}-lastFailureSource`,render:e=>i.a.createElement(ge.h,{ip:e})})}},el={name:Ao,truncateText:!1,mobileOptions:{show:!0},render:({node:e})=>{var t,a;return Object(eo.b)({values:(null===(t=e.lastFailure)||void 0===t||null===(a=t.host)||void 0===a?void 0:a.name)||null,fieldName:"host.name",idPrefix:`authentications-table-${e._id}-lastFailureDestination`,render:e=>i.a.createElement(ge.d,{hostName:e})})}},tl={name:Ro,truncateText:!1,mobileOptions:{show:!0},render:({node:e})=>Object(eo.b)({values:e.stackedValue,fieldName:"user.name",idPrefix:`authentications-table-${e._id}-userName`,render:e=>i.a.createElement(ge.m,{userName:e})})},al={name:Lo,truncateText:!1,mobileOptions:{show:!0},render:({node:e})=>Object(eo.b)({values:e.stackedValue,fieldName:"host.name",idPrefix:`authentications-table-${e._id}-hostName`,render:e=>i.a.createElement(ge.d,{hostName:e})})},nl={name:No,field:"node.successes",truncateText:!1,mobileOptions:{show:!0},width:"8%"},il=[{text:"event.outcome",value:"event.outcome"}];var rl;let sl;!function(e){e.authenticationsSuccess="success",e.authenticationsFailure="failure"}(rl||(rl={})),function(e){e.authenticationsSuccess="#54B399",e.authenticationsFailure="#E7664C"}(sl||(sl={}));const ol={[rl.authenticationsSuccess]:{key:rl.authenticationsSuccess,value:null,color:sl.authenticationsSuccess},[rl.authenticationsFailure]:{key:rl.authenticationsFailure,value:null,color:sl.authenticationsFailure}},ll={defaultStackByOption:null!==(Ho=il.find((e=>"event.outcome"===e.text)))&&void 0!==Ho?Ho:il[0],errorMessage:$o,histogramType:Vo.l.authentications,mapping:ol,stackByOptions:il,title:zo,lensAttributes:Uo};var cl=a(338),ul=a(216);const dl=$.i18n.translate("xpack.securitySolution.authentications.failSearchDescription",{defaultMessage:"Failed to run search on authentications"}),pl=({activePage:e,endDate:t,filterQuery:a,indexNames:i,limit:r,skip:s,stackByField:o,startDate:l})=>{const[c,u]=Object(n.useState)(null),d=Object(n.useCallback)((e=>{u((t=>t?{...t,pagination:xo(e,r)}:t))}),[r]),{loading:p,result:m,search:b,refetch:g,inspect:f}=Object(ho.a)({factoryQueryType:cl.z.authentications,initialResult:{edges:[],totalCount:-1,pageInfo:{activePage:0,fakeTotalCount:0,showMorePagesIndicator:!1}},errorMessage:dl,abort:s}),y=Object(n.useMemo)((()=>({endDate:t,authentications:m.edges,inspect:f,isInspected:!1,loadPage:d,pageInfo:m.pageInfo,refetch:g,startDate:l,totalCount:m.totalCount})),[t,f,g,m.edges,m.pageInfo,m.totalCount,l,d]);return Object(n.useEffect)((()=>{u((n=>{const s={...null!=n?n:{},defaultIndex:i,factoryQueryType:cl.z.authentications,filterQuery:Object(ul.a)(a),stackByField:o,pagination:xo(e,r),timerange:{interval:"12h",from:l,to:t},sort:{}};return Ds()(n,s)?n:s}))}),[e,t,a,i,o,r,l]),Object(n.useEffect)((()=>{!s&&c&&b(c)}),[c,b,s]),[p,y]},ml="authenticationsUsersTableQuery",bl=({endDate:e,filterQuery:t,indexNames:a,skip:r,startDate:s,type:l,setQuery:c,deleteQuery:u,userName:d})=>{const p=Object(o.useDispatch)(),{toggleStatus:m}=Object(Wn.a)(ml),[b,g]=Object(n.useState)(r||!m);Object(n.useEffect)((()=>{g(r||!m)}),[r,m]);const f=Object(n.useMemo)((()=>ao.e.authenticationsSelector()),[]),{activePage:y,limit:h}=Object(j.a)((e=>f(e))),[v,{authentications:E,totalCount:S,pageInfo:k,loadPage:O,inspect:w,isInspected:T,refetch:I}]=pl({endDate:e,filterQuery:t,indexNames:a,skip:b,startDate:s,activePage:y,limit:h,stackByField:d?Oo.a.hostName:Oo.a.userName}),C=Object(n.useMemo)((()=>d?[al,nl,Wo,Ko,Yo,Xo,Zo]:Go()),[d]),M=Object(n.useCallback)((e=>p(ao.b.updateTableLimit({usersType:l,limit:e,tableType:ao.c.UsersTableType.authentications}))),[l,p]),_=Object(n.useCallback)((e=>p(ao.b.updateTableActivePage({activePage:e,usersType:l,tableType:ao.c.UsersTableType.authentications}))),[l,p]);return Object(ft.b)({queryId:ml,loading:v,refetch:I,setQuery:c,deleteQuery:u,inspect:w}),i.a.createElement(Ys,{activePage:y,columns:C,dataTestSubj:"table-users-authentications",headerCount:S,headerTitle:wo,headerUnit:d?Io(S):To(S),id:ml,isInspect:T,itemsPerRow:Qo,limit:h,loading:v,loadPage:O,pageOfItems:E,setQuerySkip:g,showMorePagesIndicator:Object(x.getOr)(!1,"showMorePagesIndicator",k),totalCount:Object(x.getOr)(50,"fakeTotalCount",k),updateLimitPagination:M,updateActivePage:_})};bl.displayName="AuthenticationsUserTableComponent";const gl=i.a.memo(bl);var fl=a(659);const yl=({endDate:e,filterQuery:t,indexNames:a,skip:n,setQuery:r,startDate:s,type:o,deleteQuery:l,userName:c})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(fl.a,Ni()({endDate:e,filterQuery:t,id:"usersAuthenticationsHistogramQuery",indexNames:a,setQuery:r,startDate:s},ll)),i.a.createElement(gl,{endDate:e,filterQuery:t,indexNames:a,setQuery:r,deleteQuery:l,startDate:s,type:o,skip:n,userName:c}));yl.displayName="AllUsersQueryTabBody";var hl=a(343),vl=a.n(hl),El=a(385);const xl=$.i18n.translate("xpack.securitySolution.containers.anomalies.stackByJobId",{defaultMessage:"job"}),jl=$.i18n.translate("xpack.securitySolution.containers.anomalies.title",{defaultMessage:"Anomalies"}),Sl=$.i18n.translate("xpack.securitySolution.containers.anomalies.errorFetchingAnomaliesData",{defaultMessage:"Failed to query anomalies data"});var kl,Ol=a(747);const wl=[{text:xl,value:"job_id"}],Tl=xl,Il={defaultStackByOption:null!==(kl=wl.find((e=>e.text===Tl)))&&void 0!==kl?kl:wl[0],errorMessage:Sl,hideHistogramIfEmpty:!0,histogramType:Ol.b.anomalies,stackByOptions:wl,subtitle:void 0,title:jl},Cl="anomaliesHistogramQuery",Ml=({deleteQuery:e,endDate:t,setQuery:a,skip:r,startDate:o,type:l,filterQuery:c,anomaliesFilterQuery:u,AnomaliesTableComponent:d,flowTarget:p,ip:b,hostName:g,userName:f,indexNames:y})=>{const{jobs:h}=Object(El.b)(),[v]=Object(m.p)(s.x),E=((e,t={},a=[],n,i,r)=>{const s=a.map((e=>e.id)).map((e=>({match_phrase:{job_id:e}}))),o=Object(ul.a)(e),l=o?JSON.parse(o):{},c=vl.a.all([l,t,{bool:{filter:[{bool:{should:s,minimum_should_match:1}},{match_phrase:{result_type:"record"}},i&&r&&{match_phrase:{[`${i}.ip`]:r}},{range:{record_score:{gte:n}}}]}}]);return JSON.stringify(c)})(c,u,h,v,p,b);return Object(n.useEffect)((()=>()=>{e&&e({id:Cl})}),[]),i.a.createElement(i.a.Fragment,null,i.a.createElement(fl.a,Ni()({endDate:t,filterQuery:E,id:Cl,indexNames:y,setQuery:a,startDate:o},Il)),i.a.createElement(d,{startDate:o,endDate:t,skip:r,type:l,flowTarget:p,ip:b,hostName:g,userName:f}))};Ml.displayName="AnomaliesQueryTabBodyComponent";const _l=i.a.memo(Ml);_l.displayName="AnomaliesQueryTabBody";var Fl=a(610),Al=a(231);const Dl=$.i18n.translate("xpack.securitySolution.anomaliesTable.table.showingDescription",{defaultMessage:"Showing"}),Nl=$.i18n.translate("xpack.securitySolution.anomaliesTable.table.anomaliesDescription",{defaultMessage:"Anomalies"}),Pl=e=>$.i18n.translate("xpack.securitySolution.anomaliesTable.table.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {anomaly} other {anomalies}}"}),Rl=$.i18n.translate("xpack.securitySolution.anomaliesTable.table.anomaliesTooltip",{defaultMessage:"The anomalies table is not filterable via the SIEM global KQL search."}),Ll=$.i18n.translate("xpack.securitySolution.ml.table.scoreTitle",{defaultMessage:"Anomaly score"}),Bl=$.i18n.translate("xpack.securitySolution.ml.table.hostNameTitle",{defaultMessage:"Host name"}),ql=$.i18n.translate("xpack.securitySolution.ml.table.userNameTitle",{defaultMessage:"User name"}),zl=$.i18n.translate("xpack.securitySolution.ml.table.influencedByTitle",{defaultMessage:"Influenced by"}),$l=$.i18n.translate("xpack.securitySolution.ml.table.entityTitle",{defaultMessage:"Entity"}),Vl=$.i18n.translate("xpack.securitySolution.ml.table.detectorTitle",{defaultMessage:"Job"}),Ul=$.i18n.translate("xpack.securitySolution.ml.table.networkNameTitle",{defaultMessage:"Network IP"}),Hl=$.i18n.translate("xpack.securitySolution.ml.table.timestampTitle",{defaultMessage:"Timestamp"}),Gl=$.i18n.translate("xpack.securitySolution.ml.table.jobIdFilter",{defaultMessage:"Job"}),Ql=$.i18n.translate("xpack.securitySolution.ml.table.intervalTooltip",{defaultMessage:"Show only the highest severity anomaly for each interval (such as hour or day) or show all anomalies in the selected time period."}),Wl=$.i18n.translate("xpack.securitySolution.ml.table.intervalLabel",{defaultMessage:"Interval"}),Kl=$.i18n.translate("xpack.securitySolution.ml.table.intervalAutoOption",{defaultMessage:"Auto"}),Yl=$.i18n.translate("xpack.securitySolution.ml.table.intervalHourOption",{defaultMessage:"1 hour"}),Jl=$.i18n.translate("xpack.securitySolution.ml.table.intervalDayOption",{defaultMessage:"1 day"}),Xl=$.i18n.translate("xpack.securitySolution.ml.table.intervalshowAllOption",{defaultMessage:"Show all"});var Zl=a(649),ec=a(686),tc=a(799);const ac=(e,t)=>"user.name"===e.entityName&&(null==t||e.entityValue===t),nc=e=>`${e.entityName}-${e.entityValue}-${e.severity}-${e.jobId}`,ic=({entityName:e,entityValue:t})=>i.a.createElement(Dn.c,{data:{field:e,value:t},triggerId:Dn.d.DEFAULT,mode:Dn.a.HOVER_DOWN,visibleCellActions:5},`${e}: "${t}"`);ic.displayName="EntityComponent";const rc=i.a.memo(ic);rc.displayName="Entity";var sc=a(1078),oc=a(1079);const lc=(e,t)=>[{name:Vl,field:"jobName",sortable:!0,render:(a,n)=>i.a.createElement(oc.a,{score:n.anomaly,startDate:e,endDate:t,linkName:a})},{name:Ll,field:"anomaly.severity",sortable:!0,render:(e,t)=>i.a.createElement(sc.a,{score:t.anomaly})},{name:$l,field:"anomaly.entityValue",sortable:!0,render:(e,t)=>i.a.createElement(rc,{entityName:t.anomaly.entityName,entityValue:e})},{name:zl,field:"anomaly.influencers",render:(e,t)=>i.a.createElement(U.EuiFlexGroup,{direction:"column",gutterSize:"none",responsive:!1},e&&e.map((e=>{const[a,n]=Object(tc.a)(e),r=null!=a?a:"",s=null!=n?n:"";return i.a.createElement(U.EuiFlexItem,{key:`${r}-${s}-${nc(t.anomaly)}`,grow:!1},i.a.createElement(U.EuiFlexGroup,{gutterSize:"none",responsive:!1},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(rc,{entityName:r,entityValue:s}))))})))},{name:Hl,field:"anomaly.time",sortable:!0,render:e=>i.a.createElement(qs.b,{value:e})}],cc=({selectedJobIds:e,onSelect:t,title:a,jobIds:r,jobNameById:s})=>{const{euiTheme:o}=Object(U.useEuiTheme)(),[l,c]=Object(n.useState)(!1),u=Object(n.useCallback)((()=>{c(!l)}),[l]),d=Object(n.useCallback)((()=>{c(!1)}),[]),p=Object(n.useCallback)((a=>{const n=null!=e?e:[],i=n.includes(a)?n.filter((e=>e!==a)):[...n,a];t(i)}),[e,t]),m=Object(n.useMemo)((()=>i.a.createElement(U.EuiFilterButton,{disabled:0===r.length,"data-test-subj":"job-id-filter-button",hasActiveFilters:e.length>0,iconType:"arrowDown",isSelected:l,numActiveFilters:e.length,onClick:u,contentProps:{style:{minWidth:112}}},a)),[r.length,e.length,l,u,a]);return i.a.createElement(U.EuiFilterGroup,null,i.a.createElement(U.EuiPopover,{button:m,isOpen:l,closePopover:d,panelPaddingSize:"none"},i.a.createElement(uc,{className:"eui-yScroll",$_css:30*o.base},r.map((t=>{var a;return i.a.createElement(U.EuiFilterSelectItem,{"data-test-subj":`job-id-filter-item-${t}`,checked:e.includes(t)?"on":void 0,key:t,onClick:()=>p(t)},null!==(a=s[t])&&void 0!==a?a:t)})))))};var uc=G()("div").withConfig({displayName:"_StyledDiv",componentId:"sc-1ona4k8-0"})((e=>({maxHeight:e.$_css})));const dc=[{value:"auto",text:Kl},{value:"hour",text:Yl},{value:"day",text:Jl},{value:"second",text:Xl}],pc=({interval:e,onChange:t})=>{const a=Object(n.useCallback)((e=>{t(e.target.value)}),[t]);return i.a.createElement(U.EuiSelect,{"data-test-subj":"selectInterval",prepend:Wl,append:i.a.createElement(U.EuiToolTip,{content:Ql},i.a.createElement(U.EuiIcon,{type:"questionInCircle",color:"subdued"})),options:dc,value:e,onChange:a})},mc={sort:{field:"anomaly.severity",direction:"desc"}},bc=({startDate:e,endDate:t,userName:a,skip:r,type:s})=>{const l=Object(o.useDispatch)(),c=Object(io.a)(),{toggleStatus:u,setToggleStatus:d}=Object(Wn.a)("AnomaliesUserTable"),[p,m]=Object(n.useState)(r||!u);Object(n.useEffect)((()=>{m(r||!u)}),[r,u]);const b=Object(n.useCallback)((e=>{d(e),m(!e)}),[m,d]),{jobNameById:g,loading:f}=Object(El.a)(),y=Object(n.useMemo)((()=>Object.keys(g)),[g]),h=Object(n.useMemo)((()=>ao.e.usersAnomaliesJobIdFilterSelector()),[]),v=Object(j.a)((e=>h(e,s))),E=Object(n.useCallback)((e=>{l(ao.b.updateUsersAnomaliesJobIdFilter({jobIds:e,usersType:s}))}),[l,s]),x=Object(n.useMemo)((()=>ao.e.usersAnomaliesIntervalSelector()),[]),S=Object(j.a)((e=>x(e,s))),k=Object(n.useCallback)((e=>{l(ao.b.updateUsersAnomaliesInterval({interval:e,usersType:s}))}),[l,s]),[O,w]=Object(Fl.a)({startDate:e,endDate:t,skip:p,criteriaFields:Object(ec.a)(s,a),filterQuery:{exists:{field:"user.name"}},jobIds:v.length>0?v:y,aggregationInterval:S}),T=((e,t,a)=>null==e?[]:e.anomalies.reduce(((e,n)=>{var i;if(ac(n,a))return[...e,{userName:n.entityValue,jobName:null!==(i=t[n.jobId])&&void 0!==i?i:n.jobId,anomaly:n}];{const i=((e=[],t)=>{const a=e.find((e=>{const[a,n]=Object(tc.a)(e);return"user.name"===a&&(null==t||n===t)}));return null!=a?Object.values(a)[0]:null})(n.influencers,a);var r;return null!=i?[...e,{userName:i,jobName:null!==(r=t[n.jobId])&&void 0!==r?r:n.jobId,anomaly:n}]:e}}),[]))(w,g,a),I=((e,t,a)=>{const n=((e,t)=>[{name:ql,field:"userName",sortable:!0,render:(e,t)=>Object(eo.b)({values:[e],fieldName:"user.name",idPrefix:`anomalies-user-table-userName-${nc(t.anomaly)}-userName`,render:e=>i.a.createElement(ge.m,{userName:e})})},...lc(e,t)])(t,a);return e===Cs.UsersType.details?n.filter((e=>e.name!==ql)):n})(s,e,t),C={initialPageIndex:0,initialPageSize:10,totalItemCount:T.length,pageSizeOptions:[5,10,20,50],showPerPageOptions:!0};return Object(Al.a)(c)?i.a.createElement(Ws.a,{loading:O||f,"data-test-subj":"user-anomalies-tab"},i.a.createElement(pn.a,{subtitle:`${Dl}: ${C.totalItemCount.toLocaleString()} ${Pl(C.totalItemCount)}`,title:Nl,toggleQuery:b,toggleStatus:u,tooltip:Rl,isInspectDisabled:r,headerFilters:i.a.createElement(U.EuiFlexGroup,null,i.a.createElement(U.EuiFlexItem,null,i.a.createElement(pc,{interval:S,onChange:k})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(cc,{title:Gl,onSelect:E,selectedJobIds:v,jobIds:y,jobNameById:g})))}),u&&i.a.createElement(Zl.a,{"data-test-subj":"user-anomalies-table",columns:I,items:T,pagination:C,sorting:mc}),(O||f)&&i.a.createElement($s.a,{"data-test-subj":"anomalies-user-table-loading-panel",overlay:!0,size:"xl"})):null},gc=i.a.memo(bc),fc=(e,t="default")=>`ml_${e}riskscore_pivot_transform_${t}`,yc=(e,t="default")=>`ml_${e}riskscore_latest_transform_${t}`,hc=(e,t="default")=>`ml_${e}riskscore_ingest_pipeline_${t}`,vc=(e,t="default")=>`ml_${e}riskscore_levels_script_${t}`,Ec=(e,t="default")=>`ml_${e}riskscore_init_script_${t}`,xc=(e,t="default")=>`ml_${e}riskscore_map_script_${t}`,jc=(e,t="default")=>`ml_${e}riskscore_reduce_script_${t}`,Sc=e=>`ml_${e}riskscore_ingest_pipeline`,kc=e=>`ml_${e}riskscore_levels_script`,Oc=e=>`ml_${e}riskscore_init_script`,wc=e=>`ml_${e}riskscore_map_script`,Tc=e=>`ml_${e}riskscore_reduce_script`,Ic=($.i18n.translate("xpack.securitySolution.riskScore.api.ingestPipeline.create.errorMessageTitle",{defaultMessage:"Failed to create Ingest pipeline"}),e=>$.i18n.translate("xpack.securitySolution.riskScore.api.ingestPipeline.delete.errorMessageTitle",{values:{totalCount:e},defaultMessage:"Failed to delete Ingest {totalCount, plural, =1 {pipeline} other {pipelines}}"})),Cc=($.i18n.translate("xpack.securitySolution.riskScore.api.storedScript.create.errorMessageTitle",{defaultMessage:"Failed to create stored script"}),$.i18n.translate("xpack.securitySolution.riskScore.api.storedScript.delete.errorMessageTitle",{defaultMessage:"Failed to delete stored script"})),Mc=($.i18n.translate("xpack.securitySolution.riskScore.api.transforms.create.errorMessageTitle",{defaultMessage:"Failed to create Transform"}),e=>$.i18n.translate("xpack.securitySolution.riskScore.api.transforms.delete.errorMessageTitle",{values:{totalCount:e},defaultMessage:"Failed to delete {totalCount, plural, =1 {Transform} other {Transforms}}"})),_c=$.i18n.translate("xpack.securitySolution.riskScore.api.transforms.getState.errorMessageTitle",{defaultMessage:"Failed to get Transform state"}),Fc=$.i18n.translate("xpack.securitySolution.riskScore.api.transforms.getState.notFoundMessageTitle",{defaultMessage:"Transform not found"}),Ac=e=>$.i18n.translate("xpack.securitySolution.riskScore.api.transforms.start.errorMessageTitle",{values:{totalCount:e},defaultMessage:"Failed to start {totalCount, plural, =1 {Transform} other {Transforms}}"}),Dc=e=>$.i18n.translate("xpack.securitySolution.riskScore.api.transforms.stop.errorMessageTitle",{values:{totalCount:e},defaultMessage:"Failed to stop {totalCount, plural, =1 {Transform} other {Transforms}}"}),Nc=$.i18n.translate("xpack.securitySolution.riskScore.install.errorMessageTitle",{defaultMessage:"Installation error"}),Pc=$.i18n.translate("xpack.securitySolution.riskScore.uninstall.errorMessageTitle",{defaultMessage:"Uninstallation error"}),Rc=$.i18n.translate("xpack.securitySolution.riskScore.savedObjects.bulkCreateFailureTitle",{defaultMessage:"Failed to import saved objects"}),Lc=$.i18n.translate("xpack.securitySolution.riskScore.savedObjects.bulkDeleteFailureTitle",{defaultMessage:"Failed to delete saved objects"}),Bc=$.i18n.translate("xpack.securitySolution.riskScore.hostRiskScoresEnabledTitle",{defaultMessage:"Host Risk Scores enabled"}),qc=$.i18n.translate("xpack.securitySolution.riskScore.userRiskScoresEnabledTitle",{defaultMessage:"User Risk Scores enabled"}),zc="/api/ingest_pipelines";async function $c({errorMessage:e,http:t,names:a,notifications:n,renderDocLink:i,signal:r,theme:s}){const o=a.split(",").length;return await t.delete(`${zc}/${a}`,{signal:r}).catch((t=>{var a,r,l;null==n||null===(a=n.toasts)||void 0===a||a.addDanger({title:null!=e?e:Ic(o),text:Object($r.toMountPoint)(i?i(null==t||null===(r=t.body)||void 0===r?void 0:r.message):null==t||null===(l=t.body)||void 0===l?void 0:l.message,{theme$:null==s?void 0:s.theme$})})}))}const Vc="/internal/transform",Uc=6e5,Hc=({messageBody:e,renderDocLink:t})=>t?t(e):e;async function Gc({http:e,notifications:t,signal:a,errorMessage:n,transformIds:i,renderDocLink:r}){const s=await async function({http:e,notifications:t,signal:a,errorMessage:n,transformIds:i}){const r=await Promise.all(i.map((i=>{const r=async function({http:e,notifications:t,renderDocLink:a,signal:n,errorMessage:i=_c,transformId:r}){return await e.get(`${Vc}/transforms/${r}/_stats`,{version:"1",signal:n}).then((e=>{var n;return 0===e.count&&(null==t||null===(n=t.toasts)||void 0===n||n.addError(new Error(i),{title:i,toastMessage:Hc({messageBody:`${Fc}: ${r}`,renderDocLink:a}),toastLifeTimeMs:Uc})),e})).catch((e=>{var n,r;null==t||null===(n=t.toasts)||void 0===n||n.addError(e,{title:i,toastMessage:Hc({messageBody:null==e||null===(r=e.body)||void 0===r?void 0:r.message,renderDocLink:a}),toastLifeTimeMs:Uc})}))}({http:e,notifications:t,signal:a,errorMessage:n,transformId:i});return r})));return r}({http:e,signal:a,transformIds:i});return await e.post(`${Vc}/stop_transforms`,{version:"1",body:JSON.stringify(s.reduce(((e,t)=>null!=t&&t.transforms.length>0?[...e,{id:t.transforms[0].id,state:t.transforms[0].state}]:e),[])),signal:a}).then((e=>{const a=Object.entries(e).reduce(((e,[t,a])=>{var n,i;return a.success?e:[...e,null!=a&&null!==(n=a.error)&&void 0!==n&&n.reason?`${t}: ${null==a||null===(i=a.error)||void 0===i?void 0:i.reason}`:t]}),[]),i=null!=n?n:Dc(a.length);var s;return a.length>0&&(null==t||null===(s=t.toasts)||void 0===s||s.addError(new Error(i),{title:i,toastMessage:Hc({messageBody:a.join(", "),renderDocLink:r}),toastLifeTimeMs:Uc})),e})).catch((e=>{var a,s;null==t||null===(a=t.toasts)||void 0===a||a.addError(e,{title:null!=n?n:Dc(i.length),toastMessage:Hc({messageBody:null==e||null===(s=e.body)||void 0===s?void 0:s.message,renderDocLink:r}),toastLifeTimeMs:Uc})}))}async function Qc({http:e,notifications:t,signal:a,errorMessage:n,transformIds:i,options:r,renderDocLink:s}){return await Gc({http:e,signal:a,transformIds:i}),await e.post(`${Vc}/delete_transforms`,{version:"1",body:JSON.stringify({transformsInfo:i.map((e=>({id:e,state:"stopped"}))),...r||{}}),signal:a}).then((e=>{const a=Object.entries(e).reduce(((e,[t,a])=>{var n,i,r,s;return a.transformDeleted.success?e:[...e,null!=a&&null!==(n=a.transformDeleted)&&void 0!==n&&null!==(i=n.error)&&void 0!==i&&i.reason?`${t}: ${null==a||null===(r=a.transformDeleted)||void 0===r||null===(s=r.error)||void 0===s?void 0:s.reason}`:t]}),[]),i=null!=n?n:Mc(a.length);var r;return a.length>0&&(null==t||null===(r=t.toasts)||void 0===r||r.addError(new Error(i),{title:i,toastMessage:Hc({messageBody:a.join(", "),renderDocLink:s}),toastLifeTimeMs:Uc})),e})).catch((e=>{var a,r;null==t||null===(a=t.toasts)||void 0===a||a.addError(e,{title:null!=n?n:Mc(i.length),toastMessage:Hc({messageBody:null==e||null===(r=e.body)||void 0===r?void 0:r.message,renderDocLink:s}),toastLifeTimeMs:Uc})}))}async function Wc({http:e,notifications:t,signal:a,errorMessage:n,ids:i}){const r=await Promise.all(i.map((i=>async function({errorMessage:e,http:t,notifications:a,options:n,renderDocLink:i,signal:r,theme:o}){return await t.delete(s.gc,{body:JSON.stringify(n),signal:r}).catch((t=>{var n,r,s;null==a||null===(n=a.toasts)||void 0===n||n.addDanger({title:null!=e?e:Cc,text:Object($r.toMountPoint)(i?i(null==t||null===(r=t.body)||void 0===r?void 0:r.message):null==t||null===(s=t.body)||void 0===s?void 0:s.message,{theme$:null==o?void 0:o.theme$})})}))}({http:e,notifications:t,signal:a,errorMessage:n,options:{id:i}}))));return r}const Kc="Current Risk Score for Hosts",Yc="Current Risk Score for Users",Jc={component:"RiskScoreTable"},Xc=6e5,Zc=async({dashboard:e,to:t,errorMessage:a,http:n,notifications:i,options:r,renderDashboardLink:o,renderDocLink:l,from:c,theme:u})=>await n.post(Object(s.Lc)(r.templateName)).then((n=>{var s;const d=n[r.templateName],p=null==d||null===(s=d.error)||void 0===s?void 0:s.message;if(p){var m;null==i||null===(m=i.toasts)||void 0===m||m.addError(new Error(null!=a?a:Rc),{title:null!=a?a:Rc,toastMessage:l?l(p):p,toastLifeTimeMs:Xc})}else{var b,g,f,y,h;const a=r.templateName===`${Vo.w.user}RiskScoreDashboards`?Yc:Kc,n=null==d||null===(b=d.body)||void 0===b?void 0:b.find((e=>"dashboard"===e.type&&(null==e?void 0:e.title)===a));let s;var v;null!=n&&n.id&&(s=null==e||null===(v=e.locator)||void 0===v?void 0:v.getRedirectUrl({dashboardId:null==n?void 0:n.id,timeRange:{to:t,from:c}}));const l=null==d||null===(g=d.body)||void 0===g?void 0:g.map((e=>{var t;return null!==(t=null==e?void 0:e.title)&&void 0!==t?t:null==e?void 0:e.name})).join(", ");if(null==l||null==(null==d||null===(f=d.body)||void 0===f?void 0:f.length))return;null==i||null===(y=i.toasts)||void 0===y||y.addSuccess({"data-test-subj":`${r.templateName}SuccessToast`,title:(E=null==d||null===(h=d.body)||void 0===h?void 0:h.length,$.i18n.translate("xpack.securitySolution.riskScore.savedObjects.bulkCreateSuccessTitle",{values:{totalCount:E},defaultMessage:"{totalCount} {totalCount, plural, =1 {saved object} other {saved objects}} imported successfully"})),text:Object($r.toMountPoint)(o&&s?o(l,s):l,{theme$:null==u?void 0:u.theme$}),toastLifeTimeMs:Xc})}var E})).catch((e=>{var t,n,r;null==i||null===(t=i.toasts)||void 0===t||t.addError(new Error(null!=a?a:Rc),{title:null!=a?a:Rc,toastMessage:l?l(null==e||null===(n=e.body)||void 0===n?void 0:n.message):null==e||null===(r=e.body)||void 0===r?void 0:r.message,toastLifeTimeMs:Xc})})),eu=async({http:e,notifications:t,errorMessage:a,options:n})=>await e.post(Object(s.Mc)(n.templateName)).catch((e=>{var n,i;null==t||null===(n=t.toasts)||void 0===n||n.addDanger({title:null!=a?a:Lc,text:null==e||null===(i=e.body)||void 0===i?void 0:i.message})})),tu=6e5,au=({errorMessage:e,http:t,notifications:a,options:n,renderDocLink:i,signal:r})=>t.post(s.Db,{body:JSON.stringify(n),signal:r}).then((t=>{const r=t.reduce(((e,t)=>{const[[a,n]]=Object.entries(t);return n.success?null!=n.success?{...e,success:[...e.success,`${a}`]}:e:null!=n.error?{...e,error:[...e.error,`${a}: ${null==n||null===(i=n.error)||void 0===i?void 0:i.message}`]}:e;var i}),{success:[],error:[]});var s,o,l;r.error.length>0?null==a||null===(s=a.toasts)||void 0===s||s.addError(new Error(null!=e?e:Nc),{title:null!=e?e:Nc,toastMessage:i?i(r.error.join(", ")):r.error.join(", "),toastLifeTimeMs:tu}):null==a||null===(o=a.toasts)||void 0===o||o.addSuccess({"data-test-subj":`${n.riskScoreEntity}EnableSuccessToast`,title:n.riskScoreEntity===Vo.w.user?qc:Bc,text:(l=r.success.join(", "),$.i18n.translate("xpack.securitySolution.riskScore.savedObjects.enableRiskScoreSuccessTitle",{values:{items:l},defaultMessage:"{items} imported successfully"}))})})).catch((t=>{var n,r,s;null==a||null===(n=a.toasts)||void 0===n||n.addError(new Error(null!=e?e:Nc),{title:null!=e?e:Nc,toastMessage:i?i(null==t||null===(r=t.body)||void 0===r?void 0:r.message):null==t||null===(s=t.body)||void 0===s?void 0:s.message,toastLifeTimeMs:tu})})),nu=async e=>{e.riskScoreEntity===Vo.w.user?await(async({dashboard:e,http:t,notifications:a,refetch:n,renderDashboardLink:i,renderDocLink:r,spaceId:s="default",theme:o,timerange:l})=>{await au({http:t,renderDocLink:r,notifications:a,options:{riskScoreEntity:Vo.w.user}}),await Zc({dashboard:e,http:t,notifications:a,options:{templateName:`${Vo.w.user}RiskScoreDashboards`},renderDashboardLink:i,renderDocLink:r,...l,theme:o}),n&&n()})(e):await(async({dashboard:e,http:t,notifications:a,refetch:n,renderDashboardLink:i,renderDocLink:r,theme:s,timerange:o})=>{await au({http:t,renderDocLink:r,notifications:a,options:{riskScoreEntity:Vo.w.host}}),await Zc({http:t,theme:s,dashboard:e,renderDashboardLink:i,renderDocLink:r,...o,notifications:a,options:{templateName:`${Vo.w.host}RiskScoreDashboards`}}),n&&n()})(e)},iu=async({http:e,notifications:t,refetch:a,renderDocLink:n,riskScoreEntity:i,spaceId:r="default",theme:s})=>{const o=[fc(i,r),yc(i,r)],l=[kc(Vo.w.host),Oc(Vo.w.host),wc(Vo.w.host),Tc(Vo.w.host),vc(Vo.w.host,r),Ec(Vo.w.host,r),xc(Vo.w.host,r),jc(Vo.w.host,r)],c=[kc(Vo.w.user),wc(Vo.w.user),Tc(Vo.w.user),vc(Vo.w.user,r),xc(Vo.w.user,r),jc(Vo.w.user,r)],u=[Sc(i),hc(i,r)];await Promise.all([eu({http:e,options:{templateName:`${i}RiskScoreDashboards`}}),Qc({http:e,theme:s,renderDocLink:n,notifications:t,errorMessage:`${Pc} - ${Mc(o.length)}`,transformIds:o,options:{deleteDestIndex:!0,deleteDestDataView:!0,forceDelete:!1}}),$c({http:e,errorMessage:`${Pc} - ${Ic(u.length)}`,names:u.join(",")}),Wc({http:e,ids:i===Vo.w.user?c:l})]),a&&a()},ru=async({dashboard:e,http:t,notifications:a,refetch:n,renderDashboardLink:i,renderDocLink:r,spaceId:s="default",theme:o,timerange:l})=>{await iu({http:t,notifications:a,renderDocLink:r,riskScoreEntity:Vo.w.host,spaceId:s,theme:o}),await nu({dashboard:e,http:t,notifications:a,refetch:n,renderDashboardLink:i,renderDocLink:r,riskScoreEntity:Vo.w.host,spaceId:s,theme:o,timerange:l})},su=async({dashboard:e,http:t,notifications:a,refetch:n,renderDashboardLink:i,renderDocLink:r,spaceId:s="default",theme:o,timerange:l})=>{await iu({http:t,notifications:a,renderDocLink:r,riskScoreEntity:Vo.w.user,spaceId:s,theme:o}),await nu({dashboard:e,http:t,notifications:a,refetch:n,renderDashboardLink:i,renderDocLink:r,riskScoreEntity:Vo.w.user,spaceId:s,theme:o,timerange:l})},ou=async({http:e,notifications:t,refetch:a,renderDocLink:n,riskScoreEntity:i,spaceId:r})=>{const s=[fc(i,r),yc(i,r)];await Gc({http:e,notifications:t,renderDocLink:n,transformIds:s});const o=await async function({http:e,notifications:t,renderDocLink:a,signal:n,errorMessage:i,transformIds:r}){return await e.post(`${Vc}/start_transforms`,{body:JSON.stringify(r.map((e=>({id:e})))),version:"1",signal:n}).then((e=>{const n=Object.entries(e).reduce(((e,[t,a])=>{var n,i;return a.success?e:[...e,null!=a&&null!==(n=a.error)&&void 0!==n&&n.reason?`${t}: ${null==a||null===(i=a.error)||void 0===i?void 0:i.reason}`:t]}),[]),r=null!=i?i:Ac(n.length);var s;return n.length>0&&(null==t||null===(s=t.toasts)||void 0===s||s.addError(new Error(r),{title:r,toastMessage:Hc({messageBody:n.join(", "),renderDocLink:a}),toastLifeTimeMs:Uc})),e})).catch((e=>{var n,s;null==t||null===(n=t.toasts)||void 0===n||n.addError(e,{title:null!=i?i:Ac(r.length),toastMessage:Hc({messageBody:null==e||null===(s=e.body)||void 0===s?void 0:s.message,renderDocLink:a}),toastLifeTimeMs:Uc})}))}({http:e,notifications:t,renderDocLink:n,transformIds:s});return a&&a(),o};var lu=a(813);const cu=G()(U.EuiButton).withConfig({displayName:"StyledButton",componentId:"sc-t4dw34-0"})(["float:right;"]),uu=e=>{const t=Object(n.useCallback)((t=>i.a.createElement(i.a.Fragment,null,t," ",i.a.createElement(lu.a,{riskScoreEntity:e}))),[e]),a=Object(n.useCallback)(((e,t)=>i.a.createElement(i.a.Fragment,null,e,i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement(cu,{href:t,target:"_blank"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.risk_score.toast.viewDashboard",defaultMessage:"View dashboard"})))),[]);return Object(n.useMemo)((()=>({renderDocLink:t,renderDashboardLink:a})),[a,t])};var du=a(533);const pu=({disabled:e,refetch:t,riskScoreEntity:a,timerange:r,title:s})=>{const o=Object(nr.a)(),{http:l,notifications:c,theme:u,dashboard:d}=Object(m.j)().services,{renderDocLink:p,renderDashboardLink:b}=uu(a),{fetch:g,isLoading:f}=Object(du.b)(du.a.UPGRADE_RISK_SCORE,a===Vo.w.user?su:ru),[y,h]=Object(n.useState)(!1),v=Object(n.useCallback)((()=>h(!1)),[]),E=Object(n.useCallback)((()=>h(!0)),[]),x=Object(n.useCallback)((async()=>{v(),g({http:l,notifications:c,spaceId:o,timerange:r,refetch:t,renderDashboardLink:b,renderDocLink:p,riskScoreEntity:a,theme:u,dashboard:d})}),[v,g,l,c,o,r,t,b,p,a,u,d]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiButton,{color:"primary","data-test-subj":`${a}-risk-score-upgrade`,disabled:e,fill:!0,isLoading:f,onClick:E},s),y&&i.a.createElement(U.EuiConfirmModal,{"data-test-subj":`${a}-risk-score-upgrade-confirmation-modal`,title:s,onCancel:v,onConfirm:x,cancelButtonText:i.a.createElement(lu.a,{riskScoreEntity:a,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.riskScore.upgradeConfirmation.cancel",defaultMessage:"Preserve data"})}),confirmButtonText:i.a.createElement(Fs.FormattedMessage,{"data-test-subj":`${a}-risk-score-upgrade-confirmation-button`,id:"xpack.securitySolution.riskScore.upgradeConfirmation.confirm",defaultMessage:"Erase data and Upgrade"}),buttonColor:"danger",defaultFocusedButton:"confirm"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.riskScore.upgradeConfirmation.content",defaultMessage:"The upgrade will delete existing risk scores from your environment. You may preserve existing risk data before upgrading the Risk Score package. Do you wish to upgrade?"})))},mu=i.a.memo(pu);mu.displayName="RiskScoreUpgradeButton";var bu=a(109),gu=a(239),fu=a(375);var yu=a(492);const hu=({refetch:e,riskScoreEntity:t,disabled:a=!1,timerange:r})=>{const o=Object(nr.a)(),{http:l,notifications:c,theme:u,dashboard:d}=Object(m.j)().services,{renderDocLink:p,renderDashboardLink:b}=uu(t),{fetch:g,isLoading:f}=Object(du.b)(du.a.ENABLE_RISK_SCORE,nu),y=Object(K.a)("riskScoringRoutesEnabled"),h=Object(n.useCallback)((()=>{g({dashboard:d,http:l,notifications:c,refetch:e,renderDashboardLink:b,renderDocLink:p,riskScoreEntity:t,spaceId:o,theme:u,timerange:r})}),[d,g,l,c,e,b,p,t,o,u,r]);return i.a.createElement(i.a.Fragment,null,y?i.a.createElement(ge.l,{color:"primary",fill:!0,deepLinkId:s.wc.entityAnalyticsManagement},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.riskScore.enableButtonTitle",defaultMessage:"Enable"})):i.a.createElement(U.EuiButton,{color:"primary",fill:!0,onClick:h,isLoading:f,"data-test-subj":`enable_${t}_risk_score`,disabled:a},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.riskScore.enableButtonTitle",defaultMessage:"Enable"})))},vu=i.a.memo(hu);vu.displayName="RiskScoreEnableButton";var Eu=a(225);const xu=$.i18n.translate("xpack.securitySolution.enableRiskScore.enableRiskScorePopoverTitle",{defaultMessage:"Alerts need to be available before enabling module"}),ju=$.i18n.translate("xpack.securitySolution.riskDeprecated.entity.upgradeRiskScoreDescription",{defaultMessage:"Current data is no longer supported. Please migrate your data and upgrade the module. The data might need an hour to be generated after enabling the module."}),Su=e=>$.i18n.translate("xpack.securitySolution.enableRiskScore.enableRiskScore",{defaultMessage:"Enable {riskEntity} Risk Score",values:{riskEntity:Object(Eu.d)(e)}}),ku=e=>$.i18n.translate("xpack.securitySolution.enableRiskScore.enableRiskScoreDescription",{defaultMessage:"Once you have enabled this feature you can get quick access to the {riskEntity} risk scores in this section. The data might need an hour to be generated after enabling the module.",values:{riskEntity:Object(Eu.d)(e,!0)}}),Ou=({isDeprecated:e,isDisabled:t,entityType:a,refetch:r,timerange:s})=>{const{signalIndexExists:o}=(()=>{const[e,t]=Object(n.useState)(!0),[a,i]=Object(n.useState)({signalIndexExists:null,signalIndexName:null,signalIndexMappingOutdated:null}),{addError:r}=Object(rs.a)(),{hasIndexRead:s}=Object(Rr.a)();return Object(n.useEffect)((()=>{let e=!0;const a=new AbortController;return s?(async()=>{try{t(!0);const n=await Object(gu.a)({signal:a.signal});e&&null!=n&&i({signalIndexExists:null==n?void 0:n.indexExists,signalIndexName:n.name,signalIndexMappingOutdated:n.index_mapping_outdated})}catch(t){e&&(i({signalIndexExists:!1,signalIndexName:null,signalIndexMappingOutdated:null}),Object(bu.v)(t)&&404!==t.body.status_code&&r(t,{title:fu.c}))}e&&t(!1)})():t(!1),()=>{e=!1,a.abort()}}),[r,s]),{loading:e,...a}})();if(!e&&!t)return null;const l=e?{cta:(c=a,$.i18n.translate("xpack.securitySolution.enableRiskScore.upgradeRiskScore",{defaultMessage:"Upgrade {riskEntity} Risk Score",values:{riskEntity:Object(Eu.d)(c)}})),body:ju}:{cta:Su(a),body:ku(a)};var c;return i.a.createElement(U.EuiPanel,{hasBorder:!0},i.a.createElement(pn.a,{title:i.a.createElement(yu.a,{riskScoreEntity:a,showTechnicalPreviewBadge:!0}),titleSize:"s"}),i.a.createElement(U.EuiEmptyPrompt,{title:i.a.createElement("h2",null,l.cta),body:i.a.createElement(i.a.Fragment,null,l.body," ",i.a.createElement(lu.a,{riskScoreEntity:a})),actions:i.a.createElement(U.EuiToolTip,{content:o?null:xu},e?i.a.createElement(mu,{refetch:r,riskScoreEntity:a,disabled:!o,timerange:s,"data-test-subj":`upgrade_${a}_risk_score`,title:l.cta}):i.a.createElement(vu,{disabled:!o,refetch:r,riskScoreEntity:a,timerange:s}))}))},wu=i.a.memo(Ou);wu.displayName="EnableRiskScore";var Tu=a(1391);const Iu=i.a.memo((({severityCount:e})=>i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceBetween",gutterSize:"m","data-test-subj":"risk-score-severity-badges"},i.a.createElement(U.EuiFlexItem,{grow:!1}),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFlexGroup,{gutterSize:"m"},Object.keys(no.a).map((t=>i.a.createElement(U.EuiFlexItem,{key:t,grow:!1},i.a.createElement(Cu,{status:t,count:e[t]||0})))))))));Iu.displayName="SeverityBadges";const Cu=i.a.memo((({status:e,count:t})=>i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"s"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(no.b,{severity:e})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiNotificationBadge,{size:"s",color:"subdued"},t)))));Cu.displayName="SeverityBadge";const Mu=G()(U.EuiColorPaletteDisplay).withConfig({displayName:"StyledEuiColorPaletteDisplay",componentId:"sc-glmy4v-0"})(["&.risk-score-severity-bar{border:none;border-radius:0;&:after{border:none;}}"]),_u=({severityCount:e})=>{const t=Object(n.useMemo)((()=>Object.keys(no.a).reduce(((t,a)=>{const n={stop:(t.length>0?t[t.length-1].stop:0)+(e[a]||0),color:no.a[a]};return t.push(n),t}),[])),[e]);return i.a.createElement(Mu,{className:"risk-score-severity-bar","data-test-subj":"risk-score-severity-bar",size:"s",palette:t})},Fu=({severityCount:e,selectedSeverities:t,onSelect:a,riskEntity:r})=>{const{euiTheme:s}=Object(U.useEuiTheme)(),{telemetry:o}=Object(m.j)().services,[l,c]=Object(n.useState)(!1),u=Object(n.useCallback)((()=>{c(!l)}),[l]),d=Object(n.useCallback)((()=>{c(!1)}),[]),p=Object(U.useGeneratedHtmlId)({prefix:"filterGroupPopover"}),b=Object(n.useMemo)((()=>Vo.z.map((a=>({risk:a,count:e[a],checked:t.includes(a)?"on":void 0})))),[e,t]),g=Object(n.useCallback)((e=>{const n=null!=t?t:[],i=!n.includes(e),s=i?[...n,e]:n.filter((t=>t!==e));i&&o.reportEntityRiskFiltered({entity:r,selectedSeverity:e}),a(s)}),[t,a,o,r]),f=Object(n.useMemo)((()=>b.reduce(((e,t)=>"on"===t.checked?e+t.count:e),0)),[b]),y=Object(n.useMemo)((()=>i.a.createElement(U.EuiFilterButton,{"data-test-subj":"risk-filter-button",hasActiveFilters:!!b.find((e=>"on"===e.checked)),iconType:"arrowDown",isSelected:l,numActiveFilters:f,onClick:u},Object(Eu.b)(r))),[l,b,u,f,r]);return i.a.createElement(U.EuiFilterGroup,null,i.a.createElement(U.EuiPopover,{id:p,button:y,isOpen:l,closePopover:d,panelPaddingSize:"none"},i.a.createElement(Au,{className:"eui-yScroll",$_css:30*s.base},b.map(((e,t)=>i.a.createElement(U.EuiFilterSelectItem,{"data-test-subj":`risk-filter-item-${e.risk}`,checked:e.checked,key:t+e.risk,onClick:()=>g(e.risk)},i.a.createElement(no.b,{severity:e.risk})))))))};var Au=G()("div").withConfig({displayName:"_StyledDiv",componentId:"sc-mfc9a3-0"})((e=>({maxHeight:e.$_css})));const Du=[{text:uo,numberOfRow:5},{text:po,numberOfRow:10}],Nu=ao.c.UsersTableType.risk,Pu=({data:e,id:t,isInspect:a,loading:r,loadPage:s,setQuerySkip:l,severityCount:c,totalCount:u,type:d})=>{const p=Object(o.useDispatch)(),m=Object(n.useMemo)((()=>ao.e.userRiskScoreSelector()),[]),{activePage:b,limit:g,sort:f}=Object(j.a)((e=>m(e))),y=Object(n.useCallback)((e=>{p(ao.b.updateTableLimit({usersType:d,limit:e,tableType:Nu}))}),[d,p]),h=Object(n.useCallback)((e=>{p(ao.b.updateTableActivePage({activePage:e,usersType:d,tableType:Nu}))}),[d,p]),v=Object(n.useCallback)((e=>{if(null!=e.sort){const t=e.sort;t.direction===f.direction&&t.field===f.field||p(ao.b.updateTableSorting({sort:t,tableType:Nu}))}}),[p,f]),E=Object(n.useCallback)((e=>{p(ao.b.updateUserRiskScoreSeverityFilter({severitySelection:[e]}))}),[p]),x=Object(n.useMemo)((()=>(({dispatchSeverityUpdate:e})=>[{field:"user.name",name:ro,truncateText:!1,mobileOptions:{show:!0},sortable:!0,render:e=>{if(null!=e&&e.length>0){const t=Object(za.i)(`user-risk-score-table-userName-${e}`);return i.a.createElement(Dn.c,{key:t,mode:Dn.a.HOVER_DOWN,visibleCellActions:5,showActionTooltips:!0,triggerId:Dn.d.DEFAULT,data:{value:e,field:"user.name"},metadata:{telemetry:Jc}},i.a.createElement(ge.m,{userName:e,userTab:Cs.UsersTableType.risk}))}return Object(Bs.d)()}},{field:Vo.x.userRiskScore,name:so,truncateText:!0,mobileOptions:{show:!0},sortable:!0,render:e=>null!=e?i.a.createElement("span",{"data-test-subj":"risk-score-truncate",title:`${e}`},Math.round(e)):Object(Bs.d)()},{field:Vo.x.userRisk,name:i.a.createElement(U.EuiToolTip,{content:oo},i.a.createElement(i.a.Fragment,null,Object(Eu.b)(Vo.w.user)," ",i.a.createElement(U.EuiIcon,{color:"subdued",type:"iInCircle",className:"eui-alignTop"}))),truncateText:!1,mobileOptions:{show:!0},sortable:!0,render:t=>null!=t?i.a.createElement(no.b,{toolTipContent:i.a.createElement(U.EuiLink,{onClick:()=>e(t)},i.a.createElement(U.EuiText,{size:"xs"},lo(t.toLowerCase()))),severity:t}):Object(Bs.d)()}])({dispatchSeverityUpdate:E})),[E]),S=i.a.createElement(U.EuiFlexGroup,{direction:"column",gutterSize:"s"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(Iu,{severityCount:c})),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(_u,{severityCount:c}))),k=Object(n.useMemo)((()=>ao.e.userRiskScoreSeverityFilterSelector()),[]),O=Object(j.a)((e=>k(e))),w=Object(n.useCallback)((e=>{p(ao.b.updateUserRiskScoreSeverityFilter({severitySelection:e}))}),[p]);return i.a.createElement(Ys,{activePage:b,columns:x,dataTestSubj:`table-${Nu}`,headerCount:u,headerFilters:i.a.createElement(Fu,{selectedSeverities:O,severityCount:c,onSelect:w,riskEntity:Vo.w.user}),headerSupplement:S,headerTitle:Tu.e,headerTooltip:mo,headerUnit:co(u),id:t,isInspect:a,itemsPerRow:Du,limit:g,loading:r,loadPage:s,onChange:v,pageOfItems:e,setQuerySkip:l,showMorePagesIndicator:!1,sorting:f,split:!0,stackHeader:!0,totalCount:u,updateLimitPagination:y,updateActivePage:h})};Pu.displayName="UserRiskScoreTableComponent";const Ru=i.a.memo(Pu);Ru.displayName="UserRiskScoreTable";var Lu=a(284),Bu=a(1040);const qu=({refetch:e,riskScoreEntity:t})=>{const{fetch:a,isLoading:r}=Object(du.b)(du.a.REFRESH_RISK_SCORE,ou),s=Object(nr.a)(),{renderDocLink:o}=uu(t),{http:l,notifications:c}=Object(m.j)().services,u=Object(n.useCallback)((async()=>{a({http:l,notifications:c,refetch:e,renderDocLink:o,riskScoreEntity:t,spaceId:s})}),[a,l,c,e,o,t,s]);return i.a.createElement(U.EuiButton,{color:"primary",fill:!0,onClick:u,isLoading:r,"data-test-subj":`restart_${t}_risk_score`},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.riskScore.restartButtonTitle",defaultMessage:"Restart"}))},zu=i.a.memo(qu);zu.displayName="RiskScoreRestartButton";var $u=a(800);const Vu=({entityType:e,refetch:t})=>{const a=Object(K.a)("riskScoringRoutesEnabled"),r=Object(n.useMemo)((()=>({title:e===Vo.w.user?Bu.f:Bu.b,body:e===Vo.w.user?Bu.e:Bu.a})),[e]);return i.a.createElement(U.EuiPanel,{"data-test-subj":`${e}-risk-score-no-data-detected`,hasBorder:!0},i.a.createElement(pn.a,{title:i.a.createElement(yu.a,{riskScoreEntity:e}),titleSize:"s",tooltip:e===Vo.w.user?$u.e:$u.a}),i.a.createElement(U.EuiEmptyPrompt,{title:i.a.createElement("h2",null,r.title),body:r.body,actions:i.a.createElement(i.a.Fragment,null,!a&&i.a.createElement(U.EuiToolTip,{content:Bu.c},i.a.createElement(zu,{refetch:t,riskScoreEntity:e})))}))},Uu=i.a.memo(Vu);Uu.displayName="RiskScoresNoDataDetected";var Hu=a(46),Gu=a(704);const Qu=["GET","FETCH_RISK_ENGINE_STATUS"],Wu=()=>{const e=Object(Hu.useQueryClient)();return Object(n.useCallback)((()=>{e.invalidateQueries(Qu,{refetchType:"active"})}),[e])},Ku=()=>{const e=Object(K.a)("riskScoringRoutesEnabled");return Object(Hu.useQuery)(Qu,(async({signal:t})=>{if(!e)return null;const a=await(async({signal:e})=>m.b.get().http.fetch(s.ec,{method:"GET",signal:e}))({signal:t});return{isUpdateAvailable:(null==a?void 0:a.legacy_risk_engine_status)===Gu.a.ENABLED&&a.risk_engine_status===Gu.a.NOT_INSTALLED,...a}}))},Yu=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.hosts.show",{defaultMessage:"Show hosts"}),Ju=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.hosts.hide",{defaultMessage:"Hide hosts"}),Xu=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.users.show",{defaultMessage:"Show users"}),Zu=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.users.hide",{defaultMessage:"Hide users"}),ed=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.status",{defaultMessage:"Status"}),td=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.statusOn",{defaultMessage:"On"}),ad=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.statusOff",{defaultMessage:"Off"}),nd=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.entityRiskScoring",{defaultMessage:"Entity risk scoring"}),id=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.usefulLinks",{defaultMessage:"Useful links"}),rd=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.eaDocsDashboard",{defaultMessage:"Entity Analytics documentation"}),sd=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.eaDocsHosts",{defaultMessage:"Host risk score"}),od=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.eaDocsUsers",{defaultMessage:"User risk score"}),ld=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.preview",{defaultMessage:"Preview"}),cd=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.previewDescription",{defaultMessage:"The entities shown in the preview are the riskiest found in the 1000 sampled during your chosen timeframe. They may not be the riskiest entities across all of your data."}),ud=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.errorTitle",{defaultMessage:"Preview failed"}),dd=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.errorMessage",{defaultMessage:"Something went wrong when creating the preview. Please try again."}),pd=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.tryAgain",{defaultMessage:"Try again"}),md=$.i18n.translate("xpack.securitySolution.riskScore.riskScorePreview.queryErrorTitle",{defaultMessage:"Invalid query"}),bd=$.i18n.translate("xpack.securitySolution.riskScore.updateAvailable",{defaultMessage:"Update available"}),gd=$.i18n.translate("xpack.securitySolution.riskScore.startUpdate",{defaultMessage:"Start update"}),fd=$.i18n.translate("xpack.securitySolution.riskScore.updatingRiskEngine",{defaultMessage:"Updating risk engine..."}),yd=$.i18n.translate("xpack.securitySolution.riskScore.updateRiskEngineModa.title",{defaultMessage:"Do you want to update the entity risk engine?"}),hd=$.i18n.translate("xpack.securitySolution.riskScore.updateRiskEngineModal.existingUserHost_1",{defaultMessage:"Existing user and host risk score transforms will be deleted"}),vd=$.i18n.translate("xpack.securitySolution.riskScore.updateRiskEngineModal.existingUserHost_2",{defaultMessage:", as they are no longer required."}),Ed=$.i18n.translate("xpack.securitySolution.riskScore.updateRiskEngineModal.existingData_1",{defaultMessage:"None of your risk score data will be deleted"}),xd=$.i18n.translate("xpack.securitySolution.riskScore.updateRiskEngineModal.existingData_2",{defaultMessage:", you will need to remove any old risk score data manually."}),jd=$.i18n.translate("xpack.securitySolution.riskScore.updateRiskEngineModal.buttonNo",{defaultMessage:"No, not yet"}),Sd=$.i18n.translate("xpack.securitySolution.riskScore.updateRiskEngineModal.buttonYes",{defaultMessage:"Yes, update now!"}),kd=$.i18n.translate("xpack.securitySolution.riskScore.errorPanel.title",{defaultMessage:"Sorry, there was an error"}),Od=$.i18n.translate("xpack.securitySolution.riskScore.errorPanel.message",{defaultMessage:"Something went wrong. Try again later."}),wd=$.i18n.translate("xpack.securitySolution.riskScore.errorPanel.errors",{defaultMessage:"Errors"}),Td=$.i18n.translate("xpack.securitySolution.riskScore.updatePanel.title",{defaultMessage:"New entity risk scoring engine available"}),Id=$.i18n.translate("xpack.securitySolution.riskScore.updatePanel.message",{defaultMessage:"A new entity risk scoring engine is available. Update now to get the latest features."}),Cd=$.i18n.translate("xpack.securitySolution.riskScore.updatePanel.goToManage",{defaultMessage:"Manage"}),Md=($.i18n.translate("xpack.securitySolution.riskScore.updatePanel.Dismiss",{defaultMessage:"Dismiss"}),$.i18n.translate("xpack.securitySolution.riskScore.maxSpacePanel.message",{defaultMessage:"Please disable a currently running engine before enabling it here."})),_d=()=>i.a.createElement(U.EuiCallOut,{title:Td,color:"primary",iconType:"starEmpty"},i.a.createElement(U.EuiText,null,Id),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiFlexGroup,{gutterSize:"m"},i.a.createElement(ge.l,{color:"primary",fill:!0,deepLinkId:s.wc.entityAnalyticsManagement},Cd))),Fd=Object(ft.a)(Ru),Ad=({deleteQuery:e,endDate:t,filterQuery:a,setQuery:r,skip:s,startDate:o,type:l})=>{const{data:c}=Ku(),u=Object(n.useMemo)((()=>ao.e.userRiskScoreSelector()),[]),{activePage:d,limit:p,sort:m}=Object(j.a)((e=>u(e))),b=Object(n.useMemo)((()=>ao.e.userRiskScoreSeverityFilterSelector()),[]),g=Object(j.a)((e=>b(e))),f=Object(n.useMemo)((()=>({cursorStart:d*p,querySize:p})),[d,p]),{toggleStatus:y}=Object(Wn.a)(Lu.b.USERS_BY_RISK),[h,v]=Object(n.useState)(s||!y);Object(n.useEffect)((()=>{v(s||!y)}),[s,y]);const E=Object(n.useMemo)((()=>({from:o,to:t})),[o,t]),{data:S,inspect:k,isDeprecated:O,isInspected:w,isModuleEnabled:T,loading:I,refetch:C,totalCount:M,isAuthorized:_}=Object(Lu.c)({filterQuery:a,pagination:f,riskEntity:Vo.w.user,skip:h,sort:m,timerange:E}),{severityCount:F,loading:A}=Object(Lu.d)({filterQuery:a,riskEntity:Vo.w.user,skip:h}),D={isDisabled:!T&&!I,isDeprecated:O&&!I};return _?null!=c&&c.isUpdateAvailable?i.a.createElement(_d,null):D.isDisabled||D.isDeprecated?i.a.createElement(wu,Ni()({},D,{entityType:Vo.w.user,refetch:C,timerange:E})):T&&0===g.length&&S&&0===S.length?i.a.createElement(Uu,{entityType:Vo.w.user,refetch:C}):i.a.createElement(Fd,{deleteQuery:e,data:null!=S?S:[],id:Lu.b.USERS_BY_RISK,inspect:k,isInspect:w,loading:I||A,loadPage:x.noop,refetch:C,setQuery:r,setQuerySkip:v,severityCount:null!=F?F:Vo.c,totalCount:M,type:l}):i.a.createElement(i.a.Fragment,null,"TODO: Add RiskScore Upsell")};Ad.displayName="UserRiskScoreQueryTabBody";var Dd=a(106),Nd=a(182),Pd=a(832),Rd=a(1043),Ld=a(1060),Bd=a(951),qd=a(1428);var zd=a(681),$d=a(159);const Vd=[R.e.alertsOnAlertsPage,R.e.alertsOnRuleDetailsPage],Ud=e=>Object(x.isString)(e)?e:JSON.stringify(e),Hd=(e,t)=>{var a,n,i;return{dsl:null!==(a=null!==(n=null==e||null===(i=e.inspect)||void 0===i?void 0:i.dsl)&&void 0!==n?n:null==t?void 0:t.dsl)&&void 0!==a?a:[],response:null!=e?[JSON.stringify(e.rawResponse,null,2)]:null==t?void 0:t.response}},Gd="eventsQuery",Qd=[{direction:R.b.desc,esTypes:["date"],field:"@timestamp",type:"date"}],Wd=[];var Kd=a(922);const Yd=({ariaRowindex:e,columnValues:t,checked:a})=>$.i18n.translate("xpack.securitySolution.controlColumns.checkboxForRowAriaLabel",{values:{ariaRowindex:e,checked:a,columnValues:t},defaultMessage:"{checked, select, false {unchecked} true {checked}} checkbox for the alert or event in row {ariaRowindex}, with columns {columnValues}"});var Jd=a(1484);const Xd=()=>null,Zd={id:"checkbox-control-column",width:32,headerCellRender:({onSelectAll:e,isSelectAllChecked:t})=>{const a=Object(n.useCallback)((t=>{e({isSelected:t.currentTarget.checked})}),[e]);return i.a.createElement(U.EuiCheckbox,{"data-test-subj":"select-all-events",id:"select-all-events",checked:t,onChange:a})},rowCellRender:({eventId:e,onRowSelected:t,checked:a,ariaRowindex:r,columnValues:s,disabled:o,loadingEventIds:l})=>{const c=Object(n.useCallback)((a=>{o||t({eventIds:[e],isSelected:a.currentTarget.checked})}),[e,t,o]);return l.includes(e)?i.a.createElement(U.EuiLoadingSpinner,{size:"m","data-test-subj":"event-loader"}):i.a.createElement(U.EuiCheckbox,{"data-test-subj":`select-event select-event-${e}`,id:e,checked:a&&!o,disabled:o,onChange:c,"aria-label":Yd({ariaRowindex:r,columnValues:s,checked:a})})}};var ep=a(1501);const tp=Object(n.lazy)((()=>a.e(42).then(a.bind(null,1675))));var ap=a(923),np=a(1126),ip=a(1034);const rp=new ir.Storage(localStorage),sp=[at.mb.SIEM],op={clearSelected:R.h.clearSelected,setSelected:R.h.setSelected},lp=Object(o.connect)(void 0,op)((({additionalFilters:e,additionalRightMenuOptions:t,bulkActions:a,cellActionsTriggerId:r,clearSelected:l,currentFilter:c,defaultModel:u,end:d,entityType:p="events",hasCrudPermissions:b=!0,indexNames:f,leadingControlColumns:y,onRuleChange:h,pageFilters:v,renderCellValue:E,rowRenderers:j,setSelected:S,sourcererScope:k,start:O,tableId:w,unit:T=np.a})=>{const I=Object(o.useDispatch)(),C=Object(n.useContext)(H.ThemeContext),M=Object(n.useMemo)((()=>({tableId:w})),[w]),{filters:_,query:F,dataTable:{columns:A,defaultColumns:D,deletedEventIds:N,graphEventId:P,itemsPerPage:L,itemsPerPageOptions:B,sessionViewConfig:q,showCheckboxes:z,sort:$,queryFields:V,selectAll:G,selectedEventIds:Q,isSelectAllChecked:W,loadingEventIds:K,title:J}=u}=Object(o.useSelector)((e=>Object(Pd.a)(e,w))),{uiSettings:X,data:Z,triggersActionsUi:{getFieldBrowser:ee}}=Object(m.j)().services,[te,ae]=Object(n.useState)((({tableId:e,value:t})=>(e=>e===R.e.alertsOnAlertsPage||e===R.e.alertsOnRuleDetailsPage)(e)&&(e=>"gridView"===e||"eventRenderedView"===e)(t)?t:"gridView")({tableId:w,value:rp.get(s.f)})),{browserFields:ne,dataViewId:ie,indexPattern:re,runtimeMappings:se,selectedPatterns:oe,dataViewId:le,loading:ce}=Object(g.d)(k),ue=Object(ip.a)(k),{globalFullScreen:de}=Object(fe.a)(),pe=Object(n.useRef)(null);Object(n.useEffect)((()=>(I(R.h.createDataTable({columns:A,dataViewId:le,defaultColumns:D,id:w,indexNames:null!=f?f:oe,itemsPerPage:L,showCheckboxes:z,sort:$})),()=>{I(Nd.c.deleteOneQuery({id:w,inputId:Y.a.global})),pe.current&&pe.current.closeEditor()})),[]);const me=Object(n.useMemo)((()=>[..._,...null!=v?v:[]]),[_,v]),{Navigation:be}=Object(Bd.b)({scopeId:w}),{DetailsPanel:ge,SessionView:ye}=Object(Bd.a)({entityType:p,scopeId:w}),he=Object(n.useMemo)((()=>null!=P&&P.length>0||null!=q?i.a.createElement(Rd.a,{scopeId:w,SessionView:ye,Navigation:be}):null),[P,w,q,ye,be]),ve=Object(n.useCallback)((({id:e,inspect:t,loading:a,refetch:n})=>I(Nd.c.setQuery({id:e,inputId:Y.a.global,inspect:t,loading:a,refetch:n}))),[I]),Ee=Object(Ld.a)({sourcererScope:k,editorActionsRef:pe,upsertColumn:Object(n.useCallback)(((e,t)=>I(R.h.upsertColumn({column:e,id:w,index:t}))),[I,w]),removeColumn:Object(n.useCallback)((e=>I(R.h.removeColumn({columnId:e,id:w}))),[I,w])}),xe=Object(it.isEmpty)(A)?R.l:A,je=Object(Ms.getEsQueryConfig)(X),Se=Object(n.useMemo)((()=>(({from:e,to:t,filters:a,...n})=>{const i=Object(kr.d)({...n,filters:[...a,Object(kr.a)(e,t)]});return i?i.filterQuery:void 0})({config:je,browserFields:ne,dataProviders:[],filters:me,from:O,indexPattern:re,kqlMode:"filter",kqlQuery:F,to:d})),[je,ne,me,O,re,F,d]),ke=Object(n.useMemo)((()=>null!=Se&&null!=ce&&!ce&&!Object(it.isEmpty)(O)&&!Object(it.isEmpty)(d)),[ce,Se,O,d]),Oe=Object(n.useMemo)((()=>[...xe.map((e=>e.id)),...null!=V?V:[]]),[xe,V]),we=Object(n.useMemo)((()=>$.map((({columnId:e,columnType:t,esTypes:a,sortDirection:n})=>({field:e,type:t,direction:n,esTypes:null!=a?a:[]})))),[$]),[Te,{events:Ie,loadPage:Ce,pageInfo:Me,refetch:_e,totalCount:Fe=0,inspect:Ae}]=(({alertConsumers:e=Wd,dataViewId:t,endDate:a,entityType:i,excludeEcsData:r=!1,id:s=Gd,indexNames:l,fields:c,filterQuery:u,filterStatus:d,startDate:p,language:m="kuery",limit:b,runtimeMappings:g,sort:f=Qd,skip:y=!1,timerangeKind:h,data:v})=>{const[E,j,S]=(({alertConsumers:e=Wd,dataViewId:t,endDate:a,entityType:i,excludeEcsData:r=!1,id:s=Gd,indexNames:l,fields:c,filterQuery:u,startDate:d,language:p="kuery",limit:m,runtimeMappings:b,sort:g=Qd,skip:f=!1,data:y,filterStatus:h})=>{const v=Object(o.useDispatch)(),{startTracking:E}=(e=>{const{startTransaction:t}=Object($d.b)();return{startTracking:Object(n.useCallback)((()=>{const a=t({name:Object($d.a)(e),type:"http-request",options:{managed:!1}}),n=null==a?void 0:a.startSpan("batched search","http-request",{blocking:!0});return{endTracking:e=>{null==a||a.addLabels({result:e}),null==n||n.end()}}}),[t,e])}})(s),j=Object(n.useRef)(x.noop),S=Object(n.useRef)(new AbortController),k=Object(n.useRef)(new Ns.Subscription),[O,w]=Object(n.useState)(!0),[T,I]=Object(n.useState)(0),[C,M]=Object(n.useState)(null),[_,F]=Object(n.useState)(h),A=Object(n.useRef)(null),D=Object(n.useCallback)((()=>{null!=s&&Vd.some((e=>e===s))&&(v(R.h.clearEventsLoading({id:s})),v(R.h.clearEventsDeleted({id:s})))}),[v,s]),N=Object(n.useCallback)((e=>{D(),I(e)}),[D]),P=Object(n.useCallback)((()=>{null!=j.current&&j.current(),N(0)}),[N]),L=Object(n.useCallback)((e=>{v(R.h.setTableUpdatedAt({id:s,updated:e}))}),[v,s]),B=Object(n.useCallback)((e=>v(R.h.updateTotalCount({id:s,totalCount:e}))),[v,s]),[q,z]=Object(n.useState)({consumers:{},id:s,inspect:{dsl:[],response:[]},refetch:P,totalCount:-1,pageInfo:{activePage:0,querySize:0},events:[],loadPage:N,updatedAt:0}),{addWarning:$}=Object(rs.a)(),V=Object(n.useCallback)(((e,a)=>{if(null==e||f)return;const n=async()=>{if(A.current=e,S.current=new AbortController,w(!0),y&&y.search){const{endTracking:n}=E(),r=S.current.signal;k.current=y.search.search({...e,entityType:i},{strategy:"eql"===e.language?"timelineEqlSearchStrategy":"timelineSearchStrategy",abortSignal:r,indexPattern:{id:t}}).subscribe({next:t=>{Object(Ms.isCompleteResponse)(t)?(z((e=>{const n={...e,consumers:t.consumers,events:(i=t.edges,i.map((e=>e.node))),inspect:Hd(t,e.inspect),pageInfo:t.pageInfo,totalCount:t.totalCount,updatedAt:Date.now()};var i;return L(n.updatedAt),B(n.totalCount),a&&a(n),n})),_!==e.filterStatus&&v(R.h.updateGraphEventId({id:s,graphEventId:""})),F(e.filterStatus),w(!1),k.current.unsubscribe()):Object(Ms.isErrorResponse)(t)&&(w(!1),n("invalid"),$(zd.b),k.current.unsubscribe())},error:e=>{w(!1),y.search.showError(e),k.current.unsubscribe()}})}};k.current.unsubscribe(),S.current.abort(),n(),j.current=n}),[f,y,B,i,t,L,$,E,v,s,_]);Object(n.useEffect)((()=>{0!==l.length&&M((t=>{var n,i,s,o,f,y;const v={defaultIndex:null!==(n=null==t?void 0:t.defaultIndex)&&void 0!==n?n:[],filterQuery:null!==(i=null==t?void 0:t.filterQuery)&&void 0!==i?i:"",querySize:null!==(s=null==t?void 0:t.pagination.querySize)&&void 0!==s?s:0,sort:null!==(o=null==t?void 0:t.sort)&&void 0!==o?o:Qd,timerange:null!==(f=null==t?void 0:t.timerange)&&void 0!==f?f:{},runtimeMappings:null!==(y=null==t?void 0:t.runtimeMappings)&&void 0!==y?y:{},filterStatus:null==t?void 0:t.filterStatus},E={defaultIndex:l,filterQuery:Ud(u),querySize:m,sort:g,runtimeMappings:b,timerange:{interval:"12h",from:d,to:a},filterStatus:h},x=Ds()(v,E)?T:0,j={alertConsumers:e,defaultIndex:l,excludeEcsData:r,factoryQueryType:Vo.A.all,fieldRequested:c,fields:[],filterQuery:Ud(u),pagination:{activePage:x,querySize:m},language:p,runtimeMappings:b,sort:g,timerange:{interval:"12h",from:d,to:a},filterStatus:h};return T!==x&&I(x),Ds()(t,j)?t:j}))}),[e,v,l,T,a,r,u,s,p,m,d,g,c,b,h]);const U=Object(n.useCallback)((e=>{Ds()(A.current,C)||V(C,e)}),[C,V]);return Object(n.useEffect)((()=>{Object(x.isEmpty)(u)&&z({consumers:{},id:s,inspect:{dsl:[],response:[]},refetch:P,totalCount:-1,pageInfo:{activePage:0,querySize:0},events:[],loadPage:N,updatedAt:0})}),[u,s,P,N]),[O,q,U]})({alertConsumers:e,dataViewId:t,endDate:a,entityType:i,excludeEcsData:r,filterStatus:d,id:s,indexNames:l,fields:c,filterQuery:u,startDate:p,language:m,limit:b,runtimeMappings:g,sort:f,skip:y,timerangeKind:h,data:v});return Object(n.useEffect)((()=>{S&&S()}),[S]),[E,j]})({alertConsumers:sp,data:Z,dataViewId:ie,endDate:d,entityType:p,fields:Oe,filterQuery:Se,id:w,indexNames:null!=f?f:oe,limit:L,runtimeMappings:se,skip:!ke,sort:we,startDate:O,filterStatus:c});Object(n.useEffect)((()=>{I(R.h.updateIsLoading({id:w,isLoading:Te}))}),[I,w,Te]);const De=Object(n.useCallback)((({id:e})=>I(Nd.c.deleteOneQuery({inputId:Y.a.global,id:e}))),[I]);Object(ft.b)({queryId:w,loading:Te,refetch:_e,setQuery:ve,deleteQuery:De,inspect:Ae});const Ne=Object(n.useMemo)((()=>Fe>0?Fe-N.length:0),[N.length,Fe]),Pe=Ne>0,Re=Te&&!Pe,Le=Object(n.useMemo)((()=>Ie.filter((e=>!N.includes(e._id)))),[N,Ie]);Object(n.useEffect)((()=>{ve({id:w,inspect:Ae,loading:Te,refetch:_e})}),[Ae,Te,_e,ve,w]),Object(n.useEffect)((()=>{I(R.h.clearSelected({id:w})),I(R.h.setDataTableSelectAll({id:w,selectAll:!1}))}),[Le,I,w]);const Be=Object(n.useCallback)((e=>{I(R.h.updateItemsPerPage({id:w,itemsPerPage:e}))}),[w,I]),qe=Object(n.useCallback)((e=>{Ce(e)}),[Ce]),ze=Object(n.useCallback)((({eventIds:e,isLoading:t})=>{I(R.h.setEventsLoading({id:w,eventIds:e,isLoading:t}))}),[I,w]),$e=Object(n.useCallback)((({eventIds:e,isDeleted:t})=>{I(R.h.setEventsDeleted({id:w,eventIds:e,isDeleted:t}))}),[I,w]),Ue=Object(n.useMemo)((()=>Object.keys(Q).length),[Q]),He=Object(n.useCallback)((({eventIds:e,isSelected:t})=>{S({id:w,eventIds:Object(R.m)(Le,e,V,b),isSelected:t,isSelectAllChecked:t&&Ue+1===Le.length})}),[S,w,Le,V,b,Ue]),Ge=Object(n.useCallback)((({isSelected:e})=>e?S({id:w,eventIds:Object(R.m)(Le,Le.map((e=>e._id)),V,b),isSelected:e,isSelectAllChecked:e}):l({id:w})),[S,w,Le,V,b,l]);Object(n.useEffect)((()=>{G&&!W&&Ge({isSelected:!0})}),[W,Ge,G]);const[Qe]=Object(n.useMemo)((()=>[z?[Zd,...y]:y].map((e=>(({columnHeaders:e,controlColumns:t,data:a,fieldBrowserOptions:n,loadingEventIds:r,onRowSelected:s,onRuleChange:o,selectedEventIds:l,showCheckboxes:c,tabType:u,timelineId:d,isSelectAllChecked:p,onSelectPage:m,browserFields:b,pageSize:g,sort:f,theme:y,setEventsLoading:h,setEventsDeleted:v})=>t.map((({id:E,headerCellRender:x=Xd,rowCellRender:j,width:S},k)=>({id:`${E}`,headerCellRender:()=>{const t=x;return i.a.createElement(i.a.Fragment,null,t&&i.a.createElement(t,{width:S,browserFields:b,fieldBrowserOptions:n,columnHeaders:e,isEventViewer:!1,isSelectAllChecked:p,onSelectAll:m,showEventsSelect:!1,showSelectAllCheckbox:c,sort:f,tabType:u,timelineId:d}))},rowCellRender:({isDetails:n,isExpandable:p,isExpanded:m,rowIndex:b,colIndex:f,setCellProps:x})=>{const j=Object(R.n)(b,g),O=a[j];return O?Object(R.g)(O.ecs,y,x):x({style:{display:"none"}}),i.a.createElement(Jd.a,{columnId:null!=E?E:"",columnHeaders:e,controlColumn:t[k],data:a[j],disabled:!1,index:k,isDetails:n,isExpanded:m,isEventViewer:!1,isExpandable:p,loadingEventIds:r,onRowSelected:s,onRuleChange:o,rowIndex:b,colIndex:f,pageRowIndex:j,selectedEventIds:l,setCellProps:x,showCheckboxes:c,tabType:u,tableId:d,width:S,setEventsLoading:h,setEventsDeleted:v})},width:S}))))({columnHeaders:xe,controlColumns:e,data:Le,fieldBrowserOptions:Ee,loadingEventIds:K,onRowSelected:He,onRuleChange:h,selectedEventIds:Q,showCheckboxes:z,tabType:"query",timelineId:w,isSelectAllChecked:W,sort:$,browserFields:ne,onSelectPage:Ge,theme:C,setEventsLoading:ze,setEventsDeleted:$e,pageSize:L})))),[z,y,xe,Le,Ee,K,He,h,Q,w,W,$,ne,Ge,C,ze,$e,L]),We=(({tableId:e,data:t,totalItems:a,hasAlertsCrud:r,showCheckboxes:s,filterStatus:o,filterQuery:l,bulkActions:c,selectedCount:u})=>{const d=Object(n.useMemo)((()=>{var e,t;return!!r&&!(0===u||!s)&&("boolean"==typeof c?c:null===(e=(null==c||null===(t=c.customBulkActions)||void 0===t?void 0:t.length)||(null==c?void 0:c.alertStatusActions))||void 0===e||e)}),[r,u,s,c]),p=Object(n.useMemo)((()=>{if(c&&!0!==c)return c.onAlertStatusActionSuccess}),[c]),m=Object(n.useMemo)((()=>{if(c&&!0!==c)return c.onAlertStatusActionFailure}),[c]),b=Object(n.useMemo)((()=>{var e;return!!r&&("boolean"==typeof c?c:null===(e=c&&c.alertStatusActions)||void 0===e||e)}),[c,r]),g=Object(n.useMemo)((()=>{if(c&&!0!==c&&void 0!==c.customBulkActions)return c.customBulkActions.map((e=>({...e,onClick:a=>{const n=t.filter((e=>a.find((t=>e._id===t))));e.onClick(n)}})))}),[c,t]);return Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,d&&i.a.createElement(n.Suspense,{fallback:i.a.createElement(U.EuiLoadingSpinner,null)},i.a.createElement(tp,{showAlertStatusActions:b,"data-test-subj":"bulk-actions",id:e,totalItems:a,filterStatus:o,query:l,onActionSuccess:p,onActionFailure:m,customBulkActions:g})))),[g,l,o,m,p,b,d,e,a])})({tableId:w,data:Le,totalItems:Ne,hasAlertsCrud:b,showCheckboxes:z,filterStatus:c,filterQuery:Se,bulkActions:a,selectedCount:Ue}),[Ke]=Object(n.useState)({timelineID:w,tabType:"query",enableHostDetailsFlyout:!0,enableIpDetailsFlyout:!0}),Ye=Object(n.useMemo)((()=>`${Ne.toLocaleString()} ${T(Ne)}`),[Ne,T]),Je=Object(n.useMemo)((()=>{if("eventRenderedView"===te)return{defaultHeight:"auto"}}),[te]),Xe=Object(n.useMemo)((()=>({pageIndex:Me.activePage,pageSize:L,pageSizeOptions:B,onChangeItemsPerPage:Be,onChangePage:qe})),[L,B,Be,qe,Me.activePage]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(qd.c,{$isFullScreen:de},i.a.createElement(Ve.c,null,i.a.createElement(qd.f,{hasBorder:!1,hasShadow:!1,paddingSize:"none","data-test-subj":"events-viewer-panel",$isFullScreen:de},Re&&i.a.createElement(Kd.c,{height:"short"}),he,ke&&i.a.createElement(Kd.b.Provider,{value:M},i.a.createElement(qd.b,{"data-timeline-id":w,"data-test-subj":`events-container-loading-${Te}`},i.a.createElement(ep.a,{tableView:te,loading:Te,tableId:w,title:J,onViewChange:e=>ae(e),additionalFilters:e,hasRightOffset:"gridView"===te&&Le.length>0,additionalMenuOptions:t}),!Pe&&!Te&&!he&&i.a.createElement(Kd.a,null),Pe&&i.a.createElement(qd.d,{$visible:!P&&null==he,gutterSize:"none"},i.a.createElement(qd.e,{grow:1},i.a.createElement(ap.a.Provider,{value:Ke},i.a.createElement(R.a,{cellActionsTriggerId:r,additionalControls:We,unitCountText:Ye,browserFields:ne,data:Le,id:w,loadPage:Ce,renderCellValue:E,rowRenderers:j,totalItems:Ne,bulkActions:a,fieldBrowserOptions:Ee,hasCrudPermissions:b,leadingControlColumns:Qe,pagination:Xe,isEventRenderedView:"eventRenderedView"===te,rowHeightsOptions:Je,getFieldBrowser:ee,getFieldSpec:ue}))))))))),ge)}));var cp=a(1066),up=a(918),dp=a(604),pp=a(1117),mp=a(382),bp=a(946),gp=a(176),fp=a(17);const yp={meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:"event.kind",params:{query:"alert"}},query:{bool:{filter:[{bool:{should:[{match:{"event.kind":"alert"}}],minimum_should_match:1}}]}}};var hp=a(1441),vp=a(254);const Ep="alertsOrEventsHistogramQuery",xp="onlyExternalAlerts",jp=({additionalFilters:e,deleteQuery:t,endDate:a,filterQuery:r,indexNames:l,setQuery:c,startDate:u,tableId:d})=>{const p=Object(o.useDispatch)(),{globalFullScreen:b}=Object(fe.a)(),g=Object(K.a)("tGridEnabled"),[y]=Object(m.p)(s.O),h=Object(fp.b)().isEnterprise()?5:4,v=Object(n.useMemo)((()=>Object(pp.a)(h)),[h]),E=kp(),[x,j]=Object(n.useState)(null!=E&&E);Op(x);const S=Object(n.useCallback)((()=>j((e=>!e))),[]),k=Object(n.useMemo)((()=>Object(dp.d)(y,x)),[y,x]);Object(n.useEffect)((()=>{p(R.h.initializeDataTableSettings({id:d,defaultColumns:cp.a.columns.map((e=>g||null!=e.initialWidth?e:{...e,initialWidth:gp.a})),title:up.d,showCheckboxes:!0,selectAll:!0}))}),[p,x,g,d]),Object(n.useEffect)((()=>()=>{t&&t({id:Ep})}),[t]);const O=Object(n.useMemo)((()=>i.a.createElement(U.EuiCheckbox,{id:"showExternalAlertsCheckbox","data-test-subj":"showExternalAlertsCheckbox","aria-label":up.h,checked:x,color:"text",label:up.h,onChange:S})),[x,S]),w=Object(n.useMemo)((()=>({...cp.a,excludedRowRendererIds:x?Object.values(Dd.d):[]})),[x]),T=Object(n.useMemo)((()=>x?[yp,...e]:e),[e,x]),I=Object(hp.a)({localFilters:T,tableId:d,from:u,to:a,scopeId:f.SourcererScopeName.default}),C=Object(n.useMemo)((()=>({alertStatusActions:!1,customBulkActions:[I]})),[I]);return i.a.createElement(i.a.Fragment,null,!b&&i.a.createElement(fl.a,Ni()({id:Ep,startDate:u,endDate:a,filterQuery:r,indexNames:l,setQuery:c},x?dp.a:dp.b,{subtitle:k})),i.a.createElement(lp,{additionalFilters:O,cellActionsTriggerId:Dn.d.DEFAULT,start:u,end:a,leadingControlColumns:v,renderCellValue:bp.a,rowRenderers:mp.b,sourcererScope:f.SourcererScopeName.default,tableId:d,unit:x?up.f:up.e,defaultModel:w,pageFilters:T,bulkActions:C}))};jp.displayName="EventsQueryTabBodyComponent";const Sp=i.a.memo(jp);Sp.displayName="EventsQueryTabBody";const kp=()=>{const e=Object(vp.f)(),t=Object(vp.e)(xp),a=Object(n.useMemo)((()=>t()),[t]);return Object(n.useEffect)((()=>()=>{e({[xp]:null})}),[e]),a},Op=e=>{const t=Object(vp.f)();Object(n.useEffect)((()=>{t({[xp]:!!e||null})}),[e,t])},wp=[{query:{bool:{filter:[{bool:{should:[{exists:{field:"user.name"}}],minimum_should_match:1}}]}},meta:{alias:"",disabled:!1,key:"bool",negate:!1,type:"custom",value:'{"query": {"bool": {"filter": [{"bool": {"should": [{"exists": {"field": "user.name"}}],"minimum_should_match": 1}}]}}}'}}],Tp=Object(n.memo)((({deleteQuery:e,filterQuery:t,from:a,indexNames:n,isInitializing:r,setQuery:o,to:l,type:c})=>{const u={deleteQuery:e,endDate:l,filterQuery:t,indexNames:n,skip:r||void 0===t,setQuery:o,startDate:a,type:c};return i.a.createElement(q.c,null,i.a.createElement(q.a,{path:`${s.Ic}/:tabName(${Cs.UsersTableType.allUsers})`},i.a.createElement(ko,u)),i.a.createElement(q.a,{path:`${s.Ic}/:tabName(${Cs.UsersTableType.authentications})`},i.a.createElement(yl,u)),i.a.createElement(q.a,{path:`${s.Ic}/:tabName(${Cs.UsersTableType.anomalies})`},i.a.createElement(_l,Ni()({},u,{AnomaliesTableComponent:gc}))),i.a.createElement(q.a,{path:`${s.Ic}/:tabName(${Cs.UsersTableType.risk})`},i.a.createElement(Ad,u)),i.a.createElement(q.a,{path:`${s.Ic}/:tabName(${Cs.UsersTableType.events})`},i.a.createElement(Sp,Ni()({additionalFilters:wp,tableId:R.e.usersPageEvents},u))))}));Tp.displayName="UsersTabs";const Ip=e=>`${s.Ic}/${e}`;var Cp=a(273);const Mp={title:"[Host] User authentications - area ",description:"",visualizationType:"lnsXY",state:{visualization:{axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},fittingFunction:"None",gridlinesVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},labelsOrientation:{x:0,yLeft:0,yRight:0},layers:[{accessors:["0eb97c09-a351-4280-97da-944e4bd30dd7"],layerId:"4590dafb-4ac7-45aa-8641-47a3ff0b817c",layerType:"data",seriesType:"area",xAccessor:"49a42fe6-ebe8-4adb-8eed-1966a5297b7e",yConfig:[{color:"#54b399",forAccessor:"0eb97c09-a351-4280-97da-944e4bd30dd7"}]},{accessors:["2b27c80e-a20d-46f1-8fb2-79626ef4563c"],layerId:"31213ae3-905b-4e88-b987-0cccb1f3209f",layerType:"data",seriesType:"area",xAccessor:"33a6163d-0c0a-451d-aa38-8ca6010dd5bf",yConfig:[{color:"#e7664c",forAccessor:"2b27c80e-a20d-46f1-8fb2-79626ef4563c"}]}],legend:{isVisible:!1,position:"right",showSingleSeries:!1},preferredSeriesType:"area",tickLabelsVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},valueLabels:"hide",yLeftExtent:{mode:"full"},yRightExtent:{mode:"full"}},query:{language:"kuery",query:""},filters:[{$state:{store:"appState"},meta:{alias:null,disabled:!1,indexRefName:"filter-index-pattern-0",key:"query",negate:!1,type:"custom",value:'{"bool":{"filter":[{"term":{"event.category":"authentication"}}]}}'},query:{bool:{filter:[{term:{"event.category":"authentication"}}]}}}],datasourceStates:{formBased:{layers:{"31213ae3-905b-4e88-b987-0cccb1f3209f":{columnOrder:["33a6163d-0c0a-451d-aa38-8ca6010dd5bf","2b27c80e-a20d-46f1-8fb2-79626ef4563c"],columns:{"2b27c80e-a20d-46f1-8fb2-79626ef4563c":{customLabel:!0,dataType:"number",filter:{language:"kuery",query:'event.outcome: "failure" '},isBucketed:!1,label:ei.i,operationType:"count",scale:"ratio",sourceField:"___records___"},"33a6163d-0c0a-451d-aa38-8ca6010dd5bf":{dataType:"date",isBucketed:!0,label:"@timestamp",operationType:"date_histogram",params:{interval:"auto"},scale:"interval",sourceField:"@timestamp"}},incompleteColumns:{}},"4590dafb-4ac7-45aa-8641-47a3ff0b817c":{columnOrder:["49a42fe6-ebe8-4adb-8eed-1966a5297b7e","0eb97c09-a351-4280-97da-944e4bd30dd7"],columns:{"0eb97c09-a351-4280-97da-944e4bd30dd7":{customLabel:!0,dataType:"number",filter:{language:"kuery",query:'event.outcome : "success" '},isBucketed:!1,label:ei.n,operationType:"count",scale:"ratio",sourceField:"___records___"},"49a42fe6-ebe8-4adb-8eed-1966a5297b7e":{dataType:"date",isBucketed:!0,label:"@timestamp",operationType:"date_histogram",params:{interval:"auto"},scale:"interval",sourceField:"@timestamp"}},incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-31213ae3-905b-4e88-b987-0cccb1f3209f"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-4590dafb-4ac7-45aa-8641-47a3ff0b817c"}]},_p={title:"[Host] User authentications - bar ",description:"",visualizationType:"lnsXY",state:{visualization:{axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},fittingFunction:"None",gridlinesVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},labelsOrientation:{x:0,yLeft:0,yRight:0},layers:[{accessors:["938b445a-a291-4bbc-84fe-4f47b69c20e4"],layerId:"31213ae3-905b-4e88-b987-0cccb1f3209f",layerType:"data",seriesType:"bar_horizontal_stacked",xAccessor:"430e690c-9992-414f-9bce-00812d99a5e7",yConfig:[]},{accessors:["c8165fc3-7180-4f1b-8c87-bc3ea04c6df7"],layerId:"b9acd453-f476-4467-ad38-203e37b73e55",layerType:"data",seriesType:"bar_horizontal_stacked",xAccessor:"e959c351-a3a2-4525-b244-9623f215a8fd",yConfig:[{color:"#e7664c",forAccessor:"c8165fc3-7180-4f1b-8c87-bc3ea04c6df7"}]}],legend:{isVisible:!1,position:"right",showSingleSeries:!1},preferredSeriesType:"bar_horizontal_stacked",tickLabelsVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},valueLabels:"hide",yLeftExtent:{mode:"full"},yRightExtent:{mode:"full"}},query:{language:"kuery",query:""},filters:[{$state:{store:"appState"},meta:{alias:null,disabled:!1,indexRefName:"filter-index-pattern-0",key:"query",negate:!1,type:"custom",value:'{"bool":{"filter":[{"term":{"event.category":"authentication"}}]}}'},query:{bool:{filter:[{term:{"event.category":"authentication"}}]}}}],datasourceStates:{formBased:{layers:{"31213ae3-905b-4e88-b987-0cccb1f3209f":{columnOrder:["430e690c-9992-414f-9bce-00812d99a5e7","938b445a-a291-4bbc-84fe-4f47b69c20e4"],columns:{"430e690c-9992-414f-9bce-00812d99a5e7":{dataType:"string",isBucketed:!0,label:"Filters",operationType:"filters",params:{filters:[{input:{language:"kuery",query:'event.outcome : "success" '},label:ei.n}]},scale:"ordinal"},"938b445a-a291-4bbc-84fe-4f47b69c20e4":{dataType:"number",isBucketed:!1,label:ei.n,operationType:"count",scale:"ratio",sourceField:"___records___"}},incompleteColumns:{}},"b9acd453-f476-4467-ad38-203e37b73e55":{columnOrder:["e959c351-a3a2-4525-b244-9623f215a8fd","c8165fc3-7180-4f1b-8c87-bc3ea04c6df7"],columns:{"c8165fc3-7180-4f1b-8c87-bc3ea04c6df7":{dataType:"number",isBucketed:!1,label:"Fail",operationType:"count",scale:"ratio",sourceField:"___records___"},"e959c351-a3a2-4525-b244-9623f215a8fd":{customLabel:!0,dataType:"string",isBucketed:!0,label:ei.i,operationType:"filters",params:{filters:[{input:{language:"kuery",query:'event.outcome:"failure" '},label:ei.i}]},scale:"ordinal"}},incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-31213ae3-905b-4e88-b987-0cccb1f3209f"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-b9acd453-f476-4467-ad38-203e37b73e55"}]},Fp=$.i18n.translate("xpack.securitySolution.usersKpiAuthentications.errorSearchDescription",{defaultMessage:"An error has occurred on users kpi authentications search"}),Ap=$.i18n.translate("xpack.securitySolution.usersKpiAuthentications.failSearchDescription",{defaultMessage:"Failed to run search on users kpi authentications"});var Dp=a(115);const Np="usersKpiAuthenticationsQuery";var Pp=a(293),Rp=a(917),Lp=a(390),Bp=a(311),qp=a(211);const zp=e=>!!Object(x.get)("value.length",e)&&Object(x.get)("value",e).every((({x:e,y:t})=>!Object(x.isNull)(e)&&Object(x.isNumber)(t)&&t>0)),$p={tickLine:{visible:!1},tickLabel:{padding:3}},Vp=({data:e,...t})=>{const a=Object(Na.i)(),n=Object(m.m)(),r=Object(x.get)("configs.axis.xTickFormatter",t),s=Object(x.get)("configs.axis.yTickFormatter",t),o=`group-${e[0].key}-x`,l=`group-${e[0].key}-y`,c={...Na.e,...a,...Object(x.get)("configs.settings",t)};return t.width&&t.height?i.a.createElement("div",{style:{height:t.height,width:t.width,position:"relative"}},i.a.createElement(Da.Chart,null,i.a.createElement(Da.Settings,c),e.map((e=>{const a=e.key;return zp(e)?i.a.createElement(Da.AreaSeries,{id:a,key:a,name:e.key.replace("Histogram",""),data:e.value||[],xScaleType:Object(x.getOr)(Da.ScaleType.Linear,"configs.series.xScaleType",t),yScaleType:Object(x.getOr)(Da.ScaleType.Linear,"configs.series.yScaleType",t),timeZone:n,xAccessor:"x",yAccessors:["y"],areaSeriesStyle:{area:{opacity:.04,visible:!0},line:{strokeWidth:1,visible:!0},point:{visible:!1,radius:.2,strokeWidth:1,opacity:1}},color:e.color?e.color:void 0}):null})),i.a.createElement(Da.Axis,{id:o,position:Da.Position.Bottom,showOverlappingTicks:!1,tickFormat:r,style:$p}),i.a.createElement(Da.Axis,{id:l,position:Da.Position.Left,style:$p,tickFormat:s}))):null};Vp.displayName="AreaChartBaseComponent";const Up=i.a.memo(Vp);Up.displayName="AreaChartBase";const Hp=({areaChart:e,configs:t,visualizationActionsOptions:a})=>{const{ref:r,width:s,height:o}=Object(Pp.b)(),l=Object(x.get)("customHeight",t),c=Object(x.get)("customWidth",t),u=Object(Na.g)(l,o),d=Object(Na.h)(c,s),p=Object(n.useMemo)((()=>{return t=e,Array.isArray(t)&&t.some(zp);var t}),[e]);return i.a.createElement(Na.d,null,i.a.createElement(Bp.a,{targetClassNames:[qp.a]},p&&e&&i.a.createElement(Na.b,{gutterSize:"none"},i.a.createElement(U.EuiFlexItem,{grow:!0},i.a.createElement(Na.c,{ref:r,height:u},i.a.createElement(Up,{data:e,height:u,width:d,configs:t})))),!p&&i.a.createElement(Rp.a,{height:u,width:d,data:e}),null!=a&&i.a.createElement(Lp.a,Ni()({},a,{className:"viz-actions"}))))},Gp=i.a.memo(Hp);var Qp=a(726);const Wp=G()(U.EuiFlexGroup).withConfig({displayName:"FlexGroup",componentId:"sc-1wwyh1g-0"})([".no-margin{margin-top:0 !important;margin-bottom:0 !important;}"]),Kp=G()(U.EuiFlexItem).withConfig({displayName:"FlexItem",componentId:"sc-1wwyh1g-1"})(["min-width:0;position:relative;"]);Kp.displayName="FlexItem";const Yp=G()(U.EuiFlexItem).withConfig({displayName:"MetricItem",componentId:"sc-1wwyh1g-2"})(["&.euiFlexItem{flex-basis:0;flex-grow:0;}"]);Yp.displayName="MetricItem";const Jp=G()(U.EuiTitle).withConfig({displayName:"StatValue",componentId:"sc-1wwyh1g-3"})(["overflow:hidden;text-overflow:ellipsis;white-space:nowrap;"]);Jp.displayName="StatValue";const Xp=G.a.h6.withConfig({displayName:"StyledTitle",componentId:"sc-1wwyh1g-4"})(["line-height:200%;"]),Zp=e=>e.toLocaleString(),em=e=>({series:{xScaleType:Da.ScaleType.Time,yScaleType:Da.ScaleType.Linear},axis:{xTickFormatter:Object(x.get)("xTickFormatter",e),yTickFormatter:Zp},settings:{onBrushEnd:Object(x.getOr)((()=>{}),"onBrushEnd",e)},customHeight:74}),tm=(e,t)=>e.map((e=>({...e,value:Object(x.get)(e.key,t)}))),am=(e,t)=>e.filter((e=>null!=Object(x.get)(`${e.key}Histogram`,t))).map((({lensAttributes:e,...a})=>({...a,value:Object(x.get)(`${a.key}Histogram`,t),key:`${a.key}Histogram`}))),nm=(e,t)=>0===e.length?[]:e.reduce(((a,n,i)=>{const{key:r,color:s}=n,o=Object(x.getOr)(null,r,t);return[...a,{key:r,color:s,value:[{x:Object(x.get)(`${i}.name`,e)||Object(x.getOr)("",`${i}.description`,e),y:o,g:r,y0:0}]}]}),[]);var im=a(910);const rm=({onToggle:e,isToggleExpanded:t,description:a})=>i.a.createElement(Wp,{gutterSize:"none"},i.a.createElement(U.EuiFlexItem,{className:t?"":"no-margin"},i.a.createElement(U.EuiFlexGroup,{gutterSize:"none",responsive:!1},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButtonIcon,{"aria-label":im.a(t),"data-test-subj":"query-toggle-stat",color:"text",display:"empty",iconType:t?"arrowDown":"arrowRight",onClick:e,size:"xs",title:im.a(t)})),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiTitle,{size:"xxxs"},i.a.createElement(Xp,null,a)))))),sm=i.a.memo(rm);sm.displayName="StatItemHeader";const om=({fields:e,id:t,timerange:a,isAreaChartDataAvailable:n,isBarChartDataAvailable:r,inspectTitle:s,inspectIndex:o})=>i.a.createElement(U.EuiFlexGroup,null,e.map((e=>i.a.createElement(Kp,{key:`stat-items-field-${e.key}`},i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"m",responsive:!1},(n||r)&&e.icon&&i.a.createElement(Kp,{grow:!1},i.a.createElement(U.EuiIcon,{type:e.icon,color:e.color,size:"l","data-test-subj":"stat-icon"})),i.a.createElement(Kp,null,i.a.createElement(Bp.a,{targetClassNames:[qp.a]},i.a.createElement(Jp,null,i.a.createElement("p",{"data-test-subj":"stat-title"},null!=e.value?e.value.toLocaleString():Object(Bs.d)()," ",e.description)),e.lensAttributes&&a&&i.a.createElement(Lp.a,{lensAttributes:e.lensAttributes,queryId:t,inspectIndex:o,timerange:a,title:s,className:"viz-actions"})))))))),lm=i.a.memo(om),cm=({fields:e,id:t,timerange:a,inspectTitle:n})=>i.a.createElement(U.EuiFlexGroup,{gutterSize:"none",className:"metricEmbeddable"},e.map((e=>i.a.createElement(Kp,{key:`stat-items-field-${e.key}`},i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"none",responsive:!1},e.icon&&i.a.createElement(Kp,{grow:!1},i.a.createElement(U.EuiIcon,{type:e.icon,color:e.color,size:"l","data-test-subj":"stat-icon"})),i.a.createElement(Yp,null,e.lensAttributes&&i.a.createElement("div",{"data-test-subj":"stat-title"},i.a.createElement(ci.a,{"data-test-subj":"embeddable-metric",height:36,id:`${t}-${e.key}-metric-embeddable`,lensAttributes:e.lensAttributes,timerange:a,inspectTitle:n}))),null!=e.description&&i.a.createElement(Kp,null,i.a.createElement(Jp,null,i.a.createElement("p",{"data-test-subj":"stat-title"},e.description)))))))),um=i.a.memo(cm),dm=i.a.memo((({areaChart:e,barChart:t,description:a,enableAreaChart:r,enableBarChart:s,fields:o,from:l,grow:c,id:u,loading:d=!1,index:p,updateDateRange:m,statKey:b="item",to:g,barChartLensAttributes:f,areaChartLensAttributes:y,setQuerySkip:h})=>{const v=!!(t&&t.length&&t.every((e=>null!=e.value&&e.value.length>0))),E=!!(e&&e.length&&e.every((e=>null!=e.value&&e.value.length>0))),j=Object(n.useMemo)((()=>({from:l,to:g})),[l,g]),{isToggleExpanded:S,onToggle:k}=(({id:e,setQuerySkip:t})=>{const{toggleStatus:a,setToggleStatus:i}=Object(Wn.a)(e),r=Object(n.useCallback)((e=>{i(e),t(!e)}),[t,i]),s=Object(n.useCallback)((()=>r(!a)),[r,a]);return{isToggleExpanded:a,onToggle:s}})({id:u,setQuerySkip:h}),O=Object(K.a)("chartEmbeddablesEnabled");return i.a.createElement(Kp,{grow:c,"data-test-subj":`stat-${b}`},i.a.createElement(U.EuiPanel,{hasBorder:!0},i.a.createElement(sm,{onToggle:k,isToggleExpanded:S,description:a}),d&&i.a.createElement(U.EuiFlexGroup,{justifyContent:"center",alignItems:"center"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiLoadingSpinner,{size:"l","data-test-subj":"loading-spinner"}))),S&&!d&&i.a.createElement(i.a.Fragment,null,O?i.a.createElement(um,{fields:o,id:u,timerange:j,inspectTitle:a}):i.a.createElement(lm,{fields:o,id:u,timerange:j,isAreaChartDataAvailable:E,isBarChartDataAvailable:v,inspectTitle:a,inspectIndex:p}),(r||s)&&i.a.createElement(U.EuiHorizontalRule,null),i.a.createElement(U.EuiFlexGroup,{gutterSize:O?"none":"l"},s&&i.a.createElement(Kp,null,O&&f?i.a.createElement(ci.a,{"data-test-subj":"embeddable-bar-chart",lensAttributes:f,timerange:j,id:`${u}-bar-embeddable`,height:120,inspectTitle:a}):i.a.createElement(Qp.a,{barChart:t,configs:{series:{xScaleType:Da.ScaleType.Ordinal,yScaleType:Da.ScaleType.Linear,stackAccessors:["y0"]},axis:{xTickFormatter:Zp},settings:{onElementClick:Object(x.getOr)((()=>{}),"onElementClick",undefined),rotation:90},customHeight:74},visualizationActionsOptions:{lensAttributes:f,queryId:u,inspectIndex:p,timerange:j,title:a}})),r&&null!=l&&null!=g&&i.a.createElement(i.a.Fragment,null,i.a.createElement(Kp,null,O&&y?i.a.createElement(ci.a,{"data-test-subj":"embeddable-area-chart",lensAttributes:y,timerange:j,id:`${u}-area-embeddable`,height:120,inspectTitle:a}):i.a.createElement(Gp,{areaChart:e,configs:em({xTickFormatter:Object(Pp.a)([l,g]),onBrushEnd:m}),visualizationActionsOptions:{lensAttributes:y,queryId:u,inspectIndex:p,timerange:j,title:a}})))))))}),((e,t)=>e.description===t.description&&e.enableAreaChart===t.enableAreaChart&&e.enableBarChart===t.enableBarChart&&e.from===t.from&&e.grow===t.grow&&e.loading===t.loading&&e.setQuerySkip===t.setQuerySkip&&e.id===t.id&&e.index===t.index&&e.updateDateRange===t.updateDateRange&&e.statKey===t.statKey&&e.to===t.to&&Ds()(e.areaChart,t.areaChart)&&Ds()(e.barChart,t.barChart)&&Ds()(e.fields,t.fields)));dm.displayName="StatItemsComponent",G()(U.EuiFlexGroup).withConfig({displayName:"FlexGroup",componentId:"sc-nwd2ek-0"})(["min-height:","px;"],247).displayName="FlexGroup";const pm=i.a.memo((({fieldsMapping:e,data:t,id:a,loading:n=!1,from:r,to:s,updateDateRange:o,setQuerySkip:l})=>{const c=((e,t,a,n,i,r,s,o)=>e.map((e=>({...e,areaChart:e.enableAreaChart?am(e.fields,t):void 0,barChart:e.enableBarChart?nm(e.fields,t):void 0,fields:tm(e.fields,t),id:a,key:`kpi-summary-${e.key}`,statKey:`${e.key}`,from:n,to:i,updateDateRange:r,setQuerySkip:s,loading:o}))))(e,t,a,r,s,o,l,n);return i.a.createElement(U.EuiFlexGroup,{wrap:!0},c.map((e=>i.a.createElement(dm,e))))}),((e,t)=>e.fieldsMapping===t.fieldsMapping&&e.id===t.id&&e.loading===t.loading&&e.from===t.from&&e.to===t.to&&e.updateDateRange===t.updateDateRange&&Ds()(e.data,t.data)));pm.displayName="KpiBaseComponent";const mm=Object(ft.a)(pm),bm=$.i18n.translate("xpack.securitySolution.kpiHosts.userAuthentications.title",{defaultMessage:"User authentications"}),gm=$.i18n.translate("xpack.securitySolution.kpiHosts.userAuthentications.successUnitLabel",{defaultMessage:"success"}),fm=$.i18n.translate("xpack.securitySolution.kpiHosts.userAuthentications.failUnitLabel",{defaultMessage:"fail"}),ym=$.i18n.translate("xpack.securitySolution.kpiHosts.userAuthentications.successChartLabel",{defaultMessage:"Succ."}),hm=$.i18n.translate("xpack.securitySolution.kpiHosts.userAuthentications.failChartLabel",{defaultMessage:"Fail"});var vm,Em=a(482);!function(e){e.authenticationsSuccess="#54B399",e.authenticationsFailure="#E7664C"}(vm||(vm={}));const xm=[{key:"authentication",fields:[{key:"authenticationsSuccess",name:ym,description:gm,value:null,color:vm.authenticationsSuccess,icon:"check",lensAttributes:{title:"[Host] User authentications - metric success ",description:"",visualizationType:"lnsLegacyMetric",state:{visualization:{accessor:"0eb97c09-a351-4280-97da-944e4bd30dd7",layerId:"4590dafb-4ac7-45aa-8641-47a3ff0b817c",layerType:"data"},query:{language:"kuery",query:""},filters:[{$state:{store:"appState"},meta:{alias:null,disabled:!1,indexRefName:"filter-index-pattern-0",key:"query",negate:!1,type:"custom",value:'{"bool":{"filter":[{"term":{"event.category":"authentication"}}]}}'},query:{bool:{filter:[{term:{"event.category":"authentication"}}]}}}],datasourceStates:{formBased:{layers:{"4590dafb-4ac7-45aa-8641-47a3ff0b817c":{columnOrder:["0eb97c09-a351-4280-97da-944e4bd30dd7"],columns:{"0eb97c09-a351-4280-97da-944e4bd30dd7":{customLabel:!0,dataType:"number",filter:{language:"kuery",query:'event.outcome : "success" '},isBucketed:!1,label:" ",operationType:"count",scale:"ratio",sourceField:"___records___"}},incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-4590dafb-4ac7-45aa-8641-47a3ff0b817c"}]}},{key:"authenticationsFailure",name:hm,description:fm,value:null,color:vm.authenticationsFailure,icon:"cross",lensAttributes:{title:"[Host] User authentications - metric failure ",description:"",visualizationType:"lnsLegacyMetric",state:{visualization:{accessor:"0eb97c09-a351-4280-97da-944e4bd30dd7",layerId:"4590dafb-4ac7-45aa-8641-47a3ff0b817c",layerType:"data"},query:{language:"kuery",query:""},filters:[{$state:{store:"appState"},meta:{alias:null,disabled:!1,indexRefName:"filter-index-pattern-0",key:"query",negate:!1,type:"custom",value:'{"bool":{"filter":[{"term":{"event.category":"authentication"}}]}}'},query:{bool:{filter:[{term:{"event.category":"authentication"}}]}}}],datasourceStates:{formBased:{layers:{"4590dafb-4ac7-45aa-8641-47a3ff0b817c":{columnOrder:["0eb97c09-a351-4280-97da-944e4bd30dd7"],columns:{"0eb97c09-a351-4280-97da-944e4bd30dd7":{dataType:"number",filter:{language:"kuery",query:'event.outcome : "failure" '},isBucketed:!1,label:" ",operationType:"count",scale:"ratio",sourceField:"___records___",customLabel:!0}},incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-4590dafb-4ac7-45aa-8641-47a3ff0b817c"}]}}],enableAreaChart:!0,enableBarChart:!0,description:bm,areaChartLensAttributes:Mp,barChartLensAttributes:_p}],jm=({filterQuery:e,from:t,indexNames:a,to:r,updateDateRange:s,setQuery:o,skip:l})=>{const{toggleStatus:c}=Object(Wn.a)(Np),[u,d]=Object(n.useState)(l||!c),p=Object(K.a)("chartEmbeddablesEnabled");Object(n.useEffect)((()=>{d(l||!c)}),[l,c]);const[b,{refetch:g,id:f,inspect:y,...h}]=(({filterQuery:e,endDate:t,indexNames:a,skip:i=!1,startDate:r})=>{const{data:s}=Object(m.j)().services,o=Object(n.useRef)(x.noop),l=Object(n.useRef)(new AbortController),c=Object(n.useRef)(new Ns.Subscription),[u,d]=Object(n.useState)(!1),[p,b]=Object(n.useState)(null),[g,f]=Object(n.useState)({authenticationsSuccess:0,authenticationsSuccessHistogram:[],authenticationsFailure:0,authenticationsFailureHistogram:[],id:Np,inspect:{dsl:[],response:[]},isInspected:!1,refetch:o.current}),{addError:y,addWarning:h}=Object(rs.a)(),v=Object(n.useCallback)((e=>{if(null==e||i)return;const t=async()=>{l.current=new AbortController,d(!0),c.current=s.search.search(e,{strategy:"securitySolutionSearchStrategy",abortSignal:l.current.signal}).subscribe({next:e=>{e.isPartial||e.isRunning?e.isPartial&&!e.isRunning&&(d(!1),h(Fp),c.current.unsubscribe()):(d(!1),f((t=>({...t,authenticationsSuccess:e.authenticationsSuccess,authenticationsSuccessHistogram:e.authenticationsSuccessHistogram,authenticationsFailure:e.authenticationsFailure,authenticationsFailureHistogram:e.authenticationsFailureHistogram,inspect:Object(Dp.getInspectResponse)(e,t.inspect),refetch:o.current}))),c.current.unsubscribe())},error:e=>{d(!1),y(e,{title:Ap}),c.current.unsubscribe()}})};c.current.unsubscribe(),l.current.abort(),t(),o.current=t}),[s.search,y,h,i]);return Object(n.useEffect)((()=>{b((n=>{const i={...null!=n?n:{},defaultIndex:a,factoryQueryType:Vo.B.kpiAuthentications,filterQuery:Object(ul.a)(e),timerange:{interval:"12h",from:r,to:t}};return Ds()(n,i)?n:i}))}),[a,t,e,r]),Object(n.useEffect)((()=>(v(p),()=>{c.current.unsubscribe(),l.current.abort()})),[p,v]),Object(n.useEffect)((()=>{i&&(d(!1),c.current.unsubscribe(),l.current.abort())}),[i]),[u,g]})({filterQuery:e,endDate:r,indexNames:a,startDate:t,skip:u||p}),{session:v,refetchByRestartingSession:E}=Object(Em.a)({inputId:Y.a.global,queryId:f});return i.a.createElement(mm,{data:h,id:f,inspect:y,loading:b,fieldsMapping:xm,from:t,to:r,updateDateRange:s,refetch:p?E:g,setQuery:o,setQuerySkip:d,session:p?v:void 0})};jm.displayName="UsersKpiAuthenticationsComponent";const Sm=i.a.memo(jm),km={description:"",state:{datasourceStates:{formBased:{layers:{"416b6fad-1923-4f6a-a2df-b223bb287e30":{columnOrder:["5eea817b-67b7-4268-8ecb-7688d1094721","b00c65ea-32be-4163-bfc8-f795b1ef9d06"],columns:{"5eea817b-67b7-4268-8ecb-7688d1094721":{dataType:"date",isBucketed:!0,label:"@timestamp",operationType:"date_histogram",params:{interval:"auto"},scale:"interval",sourceField:"@timestamp"},"b00c65ea-32be-4163-bfc8-f795b1ef9d06":{customLabel:!0,dataType:"number",isBucketed:!1,label:Object(ei.p)("user.name"),operationType:"unique_count",scale:"ratio",sourceField:"user.name"}},incompleteColumns:{}}}}},filters:[],query:{language:"kuery",query:""},visualization:{axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!1},fittingFunction:"None",gridlinesVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},labelsOrientation:{x:0,yLeft:0,yRight:0},layers:[{accessors:["b00c65ea-32be-4163-bfc8-f795b1ef9d06"],layerId:"416b6fad-1923-4f6a-a2df-b223bb287e30",layerType:"data",seriesType:"area",xAccessor:"5eea817b-67b7-4268-8ecb-7688d1094721"}],legend:{isVisible:!0,position:"right"},preferredSeriesType:"area",tickLabelsVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},valueLabels:"hide",yLeftExtent:{mode:"full"},yRightExtent:{mode:"full"}}},title:"[User] Users - area",visualizationType:"lnsXY",references:[{id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern",type:"index-pattern"},{id:"{dataViewId}",name:"indexpattern-datasource-layer-416b6fad-1923-4f6a-a2df-b223bb287e30",type:"index-pattern"}]},Om=$.i18n.translate("xpack.securitySolution.kpiUsers.totalUsers.title",{defaultMessage:"Users"}),wm=$.i18n.translate("xpack.securitySolution.kpiUsers.totalUsers.errorSearchDescription",{defaultMessage:"An error has occurred on total users kpi search"}),Tm=[{key:"users",fields:[{key:"users",value:null,color:Object(U.euiPaletteColorBlind)()[1],icon:"storage",lensAttributes:{description:"",state:{datasourceStates:{formBased:{layers:{"416b6fad-1923-4f6a-a2df-b223bb287e30":{columnOrder:["3e51b035-872c-4b44-824b-fe069c222e91"],columns:{"3e51b035-872c-4b44-824b-fe069c222e91":{dataType:"number",isBucketed:!1,label:" ",operationType:"unique_count",scale:"ratio",sourceField:"user.name",customLabel:!0}},incompleteColumns:{}}}}},filters:[],query:{language:"kuery",query:""},visualization:{accessor:"3e51b035-872c-4b44-824b-fe069c222e91",layerId:"416b6fad-1923-4f6a-a2df-b223bb287e30",layerType:"data"}},title:"[User] Users - metric",visualizationType:"lnsLegacyMetric",references:[{id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern",type:"index-pattern"},{id:"{dataViewId}",name:"indexpattern-datasource-layer-416b6fad-1923-4f6a-a2df-b223bb287e30",type:"index-pattern"}]}}],enableAreaChart:!0,description:Om,areaChartLensAttributes:km}],Im="TotalUsersKpiQuery",Cm=({filterQuery:e,from:t,indexNames:a,to:r,updateDateRange:s,setQuery:o,skip:l})=>{const{toggleStatus:c}=Object(Wn.a)(Im),[u,d]=Object(n.useState)(l||!c),p=Object(K.a)("chartEmbeddablesEnabled");Object(n.useEffect)((()=>{d(l||!c)}),[l,c]);const{loading:m,result:b,search:g,refetch:f,inspect:y}=Object(ho.a)({factoryQueryType:vo.c.kpiTotalUsers,initialResult:{users:0,usersHistogram:[]},errorMessage:wm,abort:u||p}),{session:h,refetchByRestartingSession:v}=Object(Em.a)({inputId:Y.a.global,queryId:Im});return Object(n.useEffect)((()=>{u||g({filterQuery:e,defaultIndex:a,timerange:{interval:"12h",from:t,to:r}})}),[g,t,r,e,a,u]),i.a.createElement(mm,{data:b,id:Im,inspect:y,loading:m,fieldsMapping:Tm,from:t,to:r,updateDateRange:s,refetch:p?v:f,setQuery:o,setQuerySkip:d,session:p?h:void 0})},Mm=i.a.memo(Cm),_m=i.a.memo((({filterQuery:e,from:t,indexNames:a,to:n,setQuery:r,skip:s,updateDateRange:o})=>i.a.createElement(U.EuiFlexGroup,{wrap:!0},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(Mm,{filterQuery:e,from:t,indexNames:a,to:n,updateDateRange:o,setQuery:r,skip:s})),i.a.createElement(U.EuiFlexItem,{grow:2},i.a.createElement(Sm,{filterQuery:e,from:t,indexNames:a,to:n,updateDateRange:o,setQuery:r,skip:s})))));_m.displayName="UsersKpiComponent";var Fm=a(835);const Am=G.a.div.withConfig({displayName:"StyledFullHeightContainer",componentId:"sc-1dz707e-0"})(["display:flex;flex-direction:column;flex:1 1 auto;"]),Dm=()=>{const e=Object(o.useDispatch)(),t=Object(n.useRef)(null),a=Object(n.useMemo)((()=>Vr.d.globalFiltersQuerySelector()),[]),r=Object(n.useMemo)((()=>Vr.d.globalQuerySelector()),[]),s=Object(j.a)(r),l=Object(j.a)(a),c=Object(n.useMemo)((()=>ao.e.userRiskScoreSeverityFilterSelector()),[]),u=Object(j.a)((e=>c(e))),{to:d,from:p,deleteQuery:b,setQuery:f,isInitializing:y}=Object(J.a)(),{globalFullScreen:v}=Object(fe.a)(),{uiSettings:k}=Object(m.j)().services,{tabName:O}=Object(B.useParams)(),w=i.a.useMemo((()=>O===Cs.UsersTableType.events?[...l,...wp]:O===Cs.UsersTableType.risk?[...Object(Fm.a)(u,Vo.w.user),...l]:l),[u,O,l]),{indicesExist:T,indexPattern:I,selectedPatterns:C}=Object(g.d)(),[M,_]=Object(n.useMemo)((()=>Object(kr.i)({config:Object(Ms.getEsQueryConfig)(k),indexPattern:I,queries:[s],filters:l})),[l,I,k,s]),[F]=Object(n.useMemo)((()=>Object(kr.i)({config:Object(Ms.getEsQueryConfig)(k),indexPattern:I,queries:[s],filters:w})),[I,s,w,k]);Object(Cp.a)({id:"UsersQueryId",filterQuery:M,kqlError:_,query:s,startDate:p,endDate:d});const A=Object(n.useCallback)((()=>{var e,a;null===(e=t.current)||void 0===e||null===(a=e.querySelector(".inspectButtonComponent:last-of-type"))||void 0===a||a.focus()}),[t]),D=Object(n.useCallback)((()=>{Object(he.m)()}),[]),N=Object(n.useCallback)((e=>{Object(Q.isTab)(e)&&Object(he.l)({containerElement:t.current,keyboardEvent:e,onSkipFocusBeforeEventsTable:A,onSkipFocusAfterEventsTable:D})}),[t,A,D]),P=Object(n.useCallback)((({x:t})=>{if(!t)return;const[a,n]=t;e(Object(ae.setAbsoluteRangeDatePicker)({id:Y.a.global,from:new Date(a).toISOString(),to:new Date(n).toISOString()}))}),[e]),R=Object(io.a)(),L=Object(io.a)().isPlatinumOrTrialLicense,q=Object(n.useMemo)((()=>((e,t)=>{const a=[],n={[Cs.UsersTableType.allUsers]:{id:Cs.UsersTableType.allUsers,name:Tu.a,href:Ip(Cs.UsersTableType.allUsers),disabled:!1},[Cs.UsersTableType.authentications]:{id:Cs.UsersTableType.authentications,name:Tu.c,href:Ip(Cs.UsersTableType.authentications),disabled:!1},[Cs.UsersTableType.anomalies]:{id:Cs.UsersTableType.anomalies,name:Tu.b,href:Ip(Cs.UsersTableType.anomalies),disabled:!1},[Cs.UsersTableType.events]:{id:Cs.UsersTableType.events,name:Tu.d,href:Ip(Cs.UsersTableType.events),disabled:!1},[Cs.UsersTableType.risk]:{id:Cs.UsersTableType.risk,name:Tu.e,href:Ip(Cs.UsersTableType.risk),disabled:!1}};return e||a.push(Cs.UsersTableType.anomalies),t||a.push(Cs.UsersTableType.risk),Object(x.omit)(a,n)})(Object(Al.a)(R),L)),[R,L]);return i.a.createElement(i.a.Fragment,null,T?i.a.createElement(Am,{onKeyDown:N,ref:t},i.a.createElement(U.EuiWindowEvent,{event:"resize",handler:x.noop}),i.a.createElement(X.a,null,i.a.createElement(ee.a,{indexPattern:I,id:Y.a.global})),i.a.createElement(h.a,{noPadding:v},i.a.createElement(Ci.a,{subtitle:i.a.createElement(zs,{indexKey:Vo.k.users,indexNames:C}),border:!0,title:Tu.f}),i.a.createElement(_m,{filterQuery:M,indexNames:C,from:p,setQuery:f,to:d,skip:y||!!_,updateDateRange:P}),i.a.createElement(U.EuiSpacer,null),i.a.createElement(_s.a,{navTabs:q}),i.a.createElement(U.EuiSpacer,null),i.a.createElement(Tp,{deleteQuery:b,filterQuery:F,from:p,indexNames:C,isInitializing:y,setQuery:f,to:d,type:ao.c.UsersType.page}))):i.a.createElement(Mi.a,null),i.a.createElement(E.a,{pageName:S.a.users}))};Dm.displayName="UsersComponent";const Nm=i.a.memo(Dm);var Pm=a(142);const Rm=()=>{const{navigateTo:e}=Object(m.l)();return t=>{const a=Object(zr.encode)(Xi(Array.isArray(t)?t:[t]));e({deepLinkId:s.wc.alerts,path:`?${Ji.a.pageFilter}=${a}`})}};var Lm=a(457),Bm=a(327),qm=a(228);const zm=G.a.span.withConfig({displayName:"LegendText",componentId:"sc-17lxi1z-0"})(["font-size:10.5px;"]),$m=i.a.memo((({value:e})=>Object(qm.a)(e)?i.a.createElement(zm,null,e):i.a.createElement(zm,{"data-test-subj":"value-wrapper-empty"},Bm.c)));$m.displayName="ValueWrapper";const Vm=({legendItem:e})=>{const{color:t,value:a}=e;return i.a.createElement(U.EuiText,{size:"xs"},i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"none",responsive:!1},null!=t&&i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiHealth,{"data-test-subj":"legend-color",color:t})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement($m,{value:a}))))};Vm.displayName="LegendItemComponent";const Um=i.a.memo(Vm),Hm=({legendItems:e})=>0===e.length?null:i.a.createElement(U.EuiText,{size:"xs","data-test-subj":"legend"},i.a.createElement(U.EuiFlexGroup,{direction:"column",gutterSize:"none"},e.map(((e,t)=>i.a.createElement(U.EuiFlexItem,{key:`legend-item-${t}`,grow:!1},i.a.createElement(Um,{legendItem:e}),i.a.createElement(U.EuiSpacer,{"data-test-subj":"legend-spacer",size:"s"}))))));Hm.displayName="LegendComponent";const Gm=i.a.memo(Hm),Qm=$.i18n.translate("xpack.securitySolution.detectionResponse.updating",{defaultMessage:"Updating..."}),Wm=$.i18n.translate("xpack.securitySolution.detectionResponse.updated",{defaultMessage:"Updated"}),Km=({isUpdating:e,updatedAt:t})=>i.a.createElement(U.EuiFlexGroup,null,e?i.a.createElement(U.EuiFlexItem,{grow:!1},Qm):i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(i.a.Fragment,null,Wm," "),i.a.createElement(Fs.FormattedRelative,{"data-test-subj":"last-updated-at-date",value:new Date(t)})));var Ym=a(158),Jm=a(320),Xm=a(242);const Zm=()=>{const e=Object(o.useDispatch)(),t=Object(n.useMemo)((()=>Vr.e.getSourcererDataViewsSelector()),[]),{defaultDataView:a,signalIndexName:i}=Object(j.a)((e=>t(e))),r=Object(Xm.a)({timelineId:d.c.active,timelineType:Dd.l.default}),s=Object(n.useCallback)(((t,n)=>{r({timeRange:n}),e(Object(k.updateProviders)({id:d.c.active,providers:t})),e(Ym.a.setSelectedDataView({id:f.SourcererScopeName.timeline,selectedDataViewId:a.id,selectedPatterns:[i||""]}))}),[r,a.id,e,i]);return{openTimelineWithFilters:Object(n.useCallback)(((e,t)=>{const a=[];for(const t of e){const e=t[0];if(e){const n=Object(Jm.a)(e.field,Object(nt.v4)(),e.value,e.operator);for(const e of t.slice(1))n.and.push(Object(Jm.b)(e.field,Object(nt.v4)(),e.value,e.operator));a.push(n)}}s(a,t)}),[s])}};var eb=a(413);const tb="detection-response-alerts-by-status",ab=`${tb}-open`,nb=`${tb}- acknowledged`,ib=`${tb}-closed`,rb=Object(nt.v4)(),sb=(e="kibana.alert.workflow_status",t)=>({title:"Alerts",description:"",visualizationType:"lnsPie",state:{visualization:{shape:"donut",layers:[{layerId:rb,primaryGroups:["a9b43606-7ff7-46ae-a47c-85bed80fab9a"],metrics:["21cc4a49-3780-4b1a-be28-f02fa5303d24"],numberDisplay:"value",categoryDisplay:"hide",legendDisplay:"hide",nestedLegend:!0,layerType:"data",emptySizeRatio:.85,percentDecimals:2}]},query:{query:"",language:"kuery"},filters:[...null!=t&&t.status&&e?[{meta:{disabled:!1,negate:!1,alias:null,index:"a1aaa83b-5026-444e-9465-50e0afade01c",key:e,field:e,params:{query:null==t?void 0:t.status},type:"phrase"},query:{match_phrase:{[e]:null==t?void 0:t.status}}}]:[],...null!=t&&t.filters?t.filters:[]],datasourceStates:{formBased:{layers:{[rb]:{columns:{"a9b43606-7ff7-46ae-a47c-85bed80fab9a":{label:"Filters",dataType:"string",operationType:"filters",scale:"ordinal",isBucketed:!0,params:{filters:[{input:{query:'kibana.alert.severity: "critical"',language:"kuery"},label:"Critical"},{label:"High",input:{query:'kibana.alert.severity : "high" ',language:"kuery"}},{input:{query:'kibana.alert.severity: "medium"',language:"kuery"},label:"Medium"},{input:{query:'kibana.alert.severity : "low" ',language:"kuery"},label:"Low"}]}},"21cc4a49-3780-4b1a-be28-f02fa5303d24":{label:"Count of records",dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___",filter:{query:"",language:"kuery"},params:{emptyAsNull:!0}}},columnOrder:["a9b43606-7ff7-46ae-a47c-85bed80fab9a","21cc4a49-3780-4b1a-be28-f02fa5303d24"],sampling:1,incompleteColumns:{}}}},textBased:{layers:{}}},internalReferences:[],adHocDataViews:{}},references:[{type:"index-pattern",id:"{dataViewId}",name:`indexpattern-datasource-layer-${rb}`},{type:"index-pattern",name:"a1aaa83b-5026-444e-9465-50e0afade01c",id:"{dataViewId}"}]}),ob=G()(U.EuiFlexItem).withConfig({displayName:"StyledFlexItem",componentId:"sc-af0tmj-0"})(["padding:0 4px;"]),lb=G()(U.EuiFlexItem).withConfig({displayName:"StyledLegendFlexItem",componentId:"sc-af0tmj-1"})(["padding-left:32px;padding-top:45px;"]),cb=120,ub=[{key:"critical",label:yt,color:da.b.critical},{key:"high",label:ht,color:da.b.high},{key:"medium",label:vt,color:da.b.medium},{key:"low",label:Et,color:da.b.low}],db={field:"event.kind",value:"signal"},pb={status:"open"},mb={status:"acknowledged"},bb={status:"closed"},gb=({additionalFilters:e,applyGlobalQueriesAndFilters:t=!0,signalIndexName:a,entityFilter:r})=>{var l,c,u,d,p,m,b,g,y;const{toggleStatus:h,setToggleStatus:v}=Object(Wn.a)(tb),{openTimelineWithFilters:E}=Zm(),x=Rm(),{onClick:j,href:S}=Object(ge.o)()({deepLinkId:s.wc.alerts}),k=Object(K.a)("donutChartEmbeddablesEnabled"),{to:O,from:w}=Object(J.a)(),T=Object(n.useMemo)((()=>({from:w,to:O})),[w,O]),M=Object(U.useIsWithinMinBreakpoint)("xl"),_=Object(U.useIsWithinMaxBreakpoint)("s")||M?120:90,F=Object(n.useMemo)((()=>({name:r?aa:Lm.m,href:r?void 0:S,onClick:r?()=>E([[r,db]]):j})),[r,S,j,E]),{items:A,isLoading:D,updatedAt:N}=(({additionalFilters:e,entityFilter:t,queryId:a,signalIndexName:i,skip:r=!1,to:s,from:l})=>{const c=Object(o.useDispatch)(),[u,d]=Object(n.useState)(Date.now()),[p,m]=Object(n.useState)(null),b=Object(n.useCallback)((({id:e,inspect:t,loading:a,refetch:n,searchSessionId:i})=>c(te.b.setQuery({inputId:Y.a.global,id:e,inspect:t,loading:a,refetch:n,searchSessionId:i}))),[c]),g=Object(n.useCallback)((({id:e})=>c(te.b.deleteOneQuery({inputId:Y.a.global,id:e}))),[c]),{data:f,loading:y,refetch:h,request:v,response:E,setQuery:x}=Object(I.a)({query:ca({from:l,to:s,entityFilter:t,additionalFilters:e}),indexName:i,skip:r,queryName:C.a.BY_STATUS});Object(n.useEffect)((()=>{x(ca({from:l,to:s,entityFilter:t,additionalFilters:e}))}),[x,l,s,t,e]),Object(n.useEffect)((()=>{m(null==f?null:(e=>{var t,a,n;const i=null!==(t=null==e||null===(a=e.aggregations)||void 0===a||null===(n=a.alertsByStatus)||void 0===n?void 0:n.buckets)&&void 0!==t?t:[];return 0===i.length?null:i.reduce(((e,t)=>{var a,n;const i=null!==(a=null===(n=t.statusBySeverity)||void 0===n?void 0:n.buckets)&&void 0!==a?a:[];return{...e,[t.key]:{total:t.doc_count,severities:i.map((e=>({key:e.key,value:e.doc_count,label:la[e.key]})))}}}),{})})(f)),d(Date.now())}),[f]);const j=Object(n.useCallback)((()=>{!r&&h&&h()}),[r,h]);return Object(ft.b)({deleteQuery:g,inspect:{dsl:[v],response:[E]},refetch:j,setQuery:b,queryId:a,loading:y}),{items:p,isLoading:y,updatedAt:u}})({additionalFilters:e,entityFilter:r,signalIndexName:a,skip:!h||k,queryId:tb,to:O,from:w}),P=Object(n.useMemo)((()=>ub.map((e=>({color:e.color,field:at.U,value:e.label})))),[]),R=Object(n.useCallback)(((e,t)=>x([{title:ia,selectedOptions:[e],fieldName:at.jb},...t?[{title:na,selectedOptions:[t],fieldName:at.U}]:[],...r?[{selectedOptions:[r.value],fieldName:r.field}]:[]])),[r,x]),L=Object(n.useCallback)((e=>R(Pm.d,e)),[R]),B=Object(n.useCallback)((e=>R(Pm.b,e)),[R]),q=Object(n.useCallback)((e=>R(Pm.c,e)),[R]),z=null!==(l=null==A||null===(c=A.open)||void 0===c?void 0:c.total)&&void 0!==l?l:0,V=null!==(u=null==A||null===(d=A.acknowledged)||void 0===d?void 0:d.total)&&void 0!==u?u:0,H=null!==(p=null==A||null===(m=A.closed)||void 0===m?void 0:m.total)&&void 0!==p?p:0,G=D||null==A?0:z+V+H,{total:Q}=(()=>{var e;const t=Object(eb.a)({visualizationId:ab}),a=Object(eb.a)({visualizationId:nb}),n=Object(eb.a)({visualizationId:ib}),i=null!=t?t[0].hits.total:0,r=null!=a?a[0].hits.total:0,s=null!=n?n[0].hits.total:0;return{open:i,acknowledged:r,closed:s,total:null!==(e=i+r+s)&&void 0!==e?e:0}})(),W=k?Q:G,X=Object(n.useCallback)((e=>{var t,a;return null!==(t=null===(a=ub.find((t=>t.label===e)))||void 0===a?void 0:a.color)&&void 0!==t?t:ua.b}),[]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(Bp.a,{show:!0,targetClassNames:[Ve.a]},i.a.createElement(U.EuiPanel,{hasBorder:!0,"data-test-subj":`${tb}-panel`},D&&i.a.createElement(U.EuiProgress,{"data-test-subj":"initialLoadingPanelMatrixOverTime",size:"xs",position:"absolute",color:"accent"}),i.a.createElement(pn.a,{id:tb,title:r?wt:Ot,titleSize:"m",subtitle:i.a.createElement(Km,{isUpdating:D,updatedAt:N}),inspectMultiple:!0,toggleStatus:h,toggleQuery:v,showInspectButton:!k},i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(ge.g,{"data-test-subj":"view-details-button",onClick:F.onClick,href:F.href},F.name)))),h&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiFlexGroup,{justifyContent:"center",gutterSize:"none"},i.a.createElement(U.EuiFlexItem,{grow:k},i.a.createElement(U.EuiText,{className:"eui-textCenter",size:"s"},0!==G||0!==Q&&i.a.createElement(i.a.Fragment,null,i.a.createElement("b",null,i.a.createElement(wa.a,{count:W})),i.a.createElement(i.a.Fragment,null," "),i.a.createElement("small",null,(e=>$.i18n.translate("xpack.securitySolution.detectionResponse.alertsByStatus.totalAlerts",{values:{totalAlerts:e},defaultMessage:"total {totalAlerts, plural, =1 {alert} other {alerts}}"}))(W)))),i.a.createElement(U.EuiSpacer,{size:"l"}),i.a.createElement(U.EuiFlexGroup,{justifyContent:"center"},i.a.createElement(ob,{key:"alerts-status-open",grow:k},k?i.a.createElement(ci.a,{applyGlobalQueriesAndFilters:t,extraOptions:pb,getLensAttributes:sb,height:cb,id:`${tb}-open`,isDonut:!0,label:jt,scopeId:f.SourcererScopeName.detections,stackByField:at.jb,timerange:T,width:cb}):i.a.createElement(kn.a,{onPartitionClick:L,data:null==A||null===(b=A.open)||void 0===b?void 0:b.severities,fillColor:X,height:_,label:jt,title:i.a.createElement(On.a,{onClick:L,count:z}),totalCount:z})),i.a.createElement(ob,{key:"alerts-status-acknowledged",grow:k},k?i.a.createElement(ci.a,{applyGlobalQueriesAndFilters:t,extraOptions:mb,getLensAttributes:sb,height:cb,id:`${tb}-acknowledged`,isDonut:!0,label:xt,scopeId:f.SourcererScopeName.detections,stackByField:at.jb,timerange:T,width:cb}):i.a.createElement(kn.a,{data:null==A||null===(g=A.acknowledged)||void 0===g?void 0:g.severities,fillColor:X,height:_,label:xt,onPartitionClick:B,title:i.a.createElement(On.a,{onClick:B,count:V}),totalCount:V})),i.a.createElement(ob,{key:"alerts-status-closed",grow:k},k?i.a.createElement(ci.a,{applyGlobalQueriesAndFilters:t,extraOptions:bb,getLensAttributes:sb,height:cb,id:`${tb}-closed`,isDonut:!0,label:St,scopeId:f.SourcererScopeName.detections,stackByField:at.jb,timerange:T,width:cb}):i.a.createElement(kn.a,{data:null==A||null===(y=A.closed)||void 0===y?void 0:y.severities,fillColor:X,height:_,label:St,onPartitionClick:q,title:i.a.createElement(On.a,{onClick:q,count:H}),totalCount:H})))),!k&&i.a.createElement(lb,{grow:!1},P.length>0&&i.a.createElement(Gm,{legendItems:P}))),i.a.createElement(U.EuiSpacer,{size:"m"})))))};var fb=a(299),yb=a(61),hb=a(188);const vb=i.a.memo((({allItems:e,selectedItems:t,title:a,onSelectedItemsChange:r})=>{const[s,o]=Object(n.useState)(!1),l=Object(n.useCallback)((e=>r(Eb(e,t))),[t,r]),c=Object(n.useMemo)((()=>e.map(((e,a)=>i.a.createElement(U.EuiFilterSelectItem,{checked:t.includes(e)?"on":void 0,key:`${a}-${e}`,onClick:()=>l(e),title:e},e)))),[e,t,l]),u=Object(n.useCallback)((e=>{o((t=>e||!t))}),[o]);return i.a.createElement(U.EuiPopover,{ownFocus:!0,button:i.a.createElement(U.EuiFilterGroup,null,i.a.createElement(U.EuiFilterButton,{grow:!1,"data-test-subj":"multiselect-popover-button",iconType:"arrowDown",onClick:()=>u(),numFilters:e.length,isSelected:s,hasActiveFilters:t.length>0,numActiveFilters:t.length},a)),isOpen:s,closePopover:()=>u(!1),panelPaddingSize:"none"},c)}));vb.displayName="MultiSelectPopover";const Eb=(e,t)=>{const a=t.indexOf(e),n=[...t];return a>=0?n.splice(a,1):n.push(e),n},xb=$.i18n.translate("xpack.securitySolution.alertCountByRuleByStatus.status",{defaultMessage:"Status"}),jb=$.i18n.translate("xpack.securitySolution.alertCountByRuleByStatus.alertsByRule",{defaultMessage:"Alerts by Rule"}),Sb=$.i18n.translate("xpack.securitySolution.alertCountByRuleByStatus.ruleName",{defaultMessage:"kibana.alert.rule.name"}),kb=$.i18n.translate("xpack.securitySolution.alertCountByRuleByStatus.count",{defaultMessage:"count"}),Ob=$.i18n.translate("xpack.securitySolution.alertCountByRuleByStatus.tooltipTitle",{defaultMessage:"Rule name"}),wb=$.i18n.translate("xpack.securitySolution.alertCountByRuleByStatus.noRuleAlerts",{defaultMessage:"No alerts to display"}),Tb="alertsByRuleAggregation",Ib="kibana.alert.rule.uuid",Cb=({additionalFilters:e=[],from:t,to:a,field:n,value:i,statuses:r})=>({size:0,_source:!1,fields:[Ib],query:{bool:{filter:[...e,{range:{"@timestamp":{gte:t,lte:a}}},...(null==r?void 0:r.length)>0?[{terms:{"kibana.alert.workflow_status":r}}]:[],{term:{[n]:i}}]}},aggs:{[Tb]:{terms:{field:"kibana.alert.rule.name",size:100},aggs:{ruleUuid:{top_hits:{_source:!1,fields:[Ib],size:1}}}}}}),Mb=["open","acknowledged","closed"],_b=Object(yb.euiStyled)(U.EuiPanel)`
  display: flex;
  flex-direction: column;
  position: relative;
  overflow: hidden;
  max-height: 308px;
`,Fb=i.a.memo((({entityFilter:e,signalIndexName:t,additionalFilters:a})=>{const{field:r,value:s}=e,o=`alerts-by-status-by-rule-by-${r}`,{toggleStatus:l,setToggleStatus:c}=Object(Wn.a)(o),{openTimelineWithFilters:u}=Zm(),[d,p]=Object(Ee.a)({defaultValue:{[r]:["open"]},key:"alertCountByFieldNameWidgetSettings",isInvalidDefault:e=>!e}),m=Object(n.useMemo)((()=>Ab((t=>{const a=[];for(const n of d[r])a.push([e,{field:hb.n,value:t},{field:hb.o,value:n}]);u(a)}))),[e,r,u,d]),b=Object(n.useCallback)((e=>{p({...d,[r]:e})}),[r,d,p]),{items:g,isLoading:f,updatedAt:y}=(({additionalFilters:e,field:t,value:a,queryId:i,statuses:r,skip:s=!1,signalIndexName:o})=>{const[l,c]=Object(n.useState)(Date.now()),[u,d]=Object(n.useState)([]),{to:p,from:m,deleteQuery:b,setQuery:g}=Object(J.a)(),{loading:f,data:y,setQuery:h,response:v,request:E,refetch:x}=Object(I.a)({query:Cb({additionalFilters:e,from:m,to:p,field:t,value:a,statuses:r}),skip:s,queryName:C.a.ALERTS_COUNT_BY_STATUS,indexName:o});Object(n.useEffect)((()=>{h(Cb({additionalFilters:e,from:m,to:p,field:t,value:a,statuses:r}))}),[h,m,p,t,a,r,e]),Object(n.useEffect)((()=>{var e,t;d(y?(e=y.aggregations,(null!==(t=null==e?void 0:e[Tb].buckets)&&void 0!==t?t:[]).map((e=>{var t,a,n,i;const r=null!==(t=Object(Ba.a)(null===(a=e.ruleUuid.hits)||void 0===a||null===(n=a.hits[0])||void 0===n?void 0:n.fields["kibana.alert.rule.uuid"]))&&void 0!==t?t:"";return{ruleName:null!==(i=Object(Ba.a)(e.key))&&void 0!==i?i:"-",count:e.doc_count,uuid:r}}))):[]),c(Date.now())}),[y]);const j=Object(n.useCallback)((()=>{!s&&x&&x()}),[s,x]);return Object(ft.b)({deleteQuery:b,inspect:{dsl:[E],response:[v]},refetch:j,setQuery:g,queryId:i,loading:f}),{items:u,isLoading:f,updatedAt:l}})({additionalFilters:a,field:r,value:s,queryId:o,statuses:d[r],skip:!l,signalIndexName:t});return i.a.createElement(Bp.a,{show:!0,targetClassNames:[Ve.a]},i.a.createElement(_b,{hasBorder:!0,"data-test-subj":"alertCountByRulePanel"},i.a.createElement(i.a.Fragment,null,i.a.createElement(pn.a,{id:o,title:jb,titleSize:"m",toggleStatus:l,toggleQuery:c,subtitle:i.a.createElement(Km,{updatedAt:y,isUpdating:f})},i.a.createElement(vb,{title:xb,allItems:Mb,selectedItems:d[r]||["open"],onSelectedItemsChange:e=>b(e)})),l&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiBasicTable,{className:"eui-yScroll","data-test-subj":"alertCountByRuleTable",columns:m,items:g,loading:f,noItemsMessage:i.a.createElement(U.EuiEmptyPrompt,{title:i.a.createElement("h3",null,wb),titleSize:"xs"})})))))}));Fb.displayName="AlertCountByStatus";const Ab=e=>[{field:"ruleName",name:Sb,"data-test-subj":Sb,align:"left",width:"67%",sortable:!1,render:(e,{uuid:t})=>i.a.createElement(U.EuiToolTip,{"data-test-subj":`${e}-tooltip`,title:Ob,content:e,anchorClassName:"eui-textTruncate"},i.a.createElement(ge.k,{"data-test-subj":"severityRuleAlertsTable-name",deepLinkId:s.wc.rules,path:`id/${t}`},e))},{field:"count",name:kb,width:"33%","data-test-subj":kb,sortable:!0,align:"right",render:(t,{ruleName:a})=>i.a.createElement(U.EuiLink,{disabled:0===t,onClick:()=>e(a)},i.a.createElement(wa.a,{count:t}))}];var Db=a(524),Nb=a(400),Pb=a(21);const Rb=$.i18n.translate("xpack.securitySolution.riskInformation.classificationHeader",{defaultMessage:"Classification"}),Lb=($.i18n.translate("xpack.securitySolution.riskInformation.informationAriaLabel",{defaultMessage:"Information"}),e=>$.i18n.translate("xpack.securitySolution.riskInformation.riskHeader",{defaultMessage:"{riskEntity} risk score range",values:{riskEntity:Object(Eu.d)(e)}})),Bb=$.i18n.translate("xpack.securitySolution.riskInformation.unknownRiskDescription",{defaultMessage:"Less than 20"}),qb=$.i18n.translate("xpack.securitySolution.riskInformation.criticalRiskDescription",{defaultMessage:"90 and above"}),zb=$.i18n.translate("xpack.securitySolution.riskInformation.closeBtn",{defaultMessage:"Close"}),$b=$.i18n.translate("xpack.securitySolution.riskInformation.buttonLabel",{defaultMessage:"How is risk score calculated?"});var Vb=a(414);const Ub=e=>[{field:"classification",name:Rb,render:e=>{if(null!=e)return i.a.createElement(no.b,{severity:e,hideBackgroundColor:!0})}},{field:"range",name:Lb(e)}],Hb=[{classification:Vo.y.critical,range:qb},{classification:Vo.y.high,range:"70 - 90 "},{classification:Vo.y.moderate,range:"40 - 70"},{classification:Vo.y.low,range:"20 - 40"},{classification:Vo.y.unknown,range:Bb}],Gb=({riskEntity:e})=>{const[t,a,n]=Object(Vb.b)();return i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiButtonEmpty,{onClick:a,"data-test-subj":"open-risk-information-flyout-trigger"},$b),t&&i.a.createElement(Qb,{riskEntity:e,handleOnClose:n}))},Qb=({handleOnClose:e,riskEntity:t})=>{const{euiTheme:a}=Object(U.useEuiTheme)(),n=Object(U.useGeneratedHtmlId)({prefix:"RiskInformation"});return i.a.createElement(U.EuiFlyout,{ownFocus:!0,onClose:e,"aria-labelledby":n,size:450,"data-test-subj":"open-risk-information-flyout"},i.a.createElement(U.EuiFlyoutHeader,{hasBorder:!0},i.a.createElement(U.EuiTitle,{size:"m"},i.a.createElement("h2",{id:n},(e=>$.i18n.translate("xpack.securitySolution.riskInformation.title",{defaultMessage:"How is {riskEntity} risk calculated?",values:{riskEntity:Object(Eu.d)(e,!0)}}))(t))),i.a.createElement(Wb,{label:Bu.d,size:"s",$_css:a.colors.text,$_css2:a.size.xxs})),i.a.createElement(U.EuiFlyoutBody,null,i.a.createElement(U.EuiText,{size:"s"},i.a.createElement("p",null,(e=>$.i18n.translate("xpack.securitySolution.riskInformation.introduction",{defaultMessage:"The {riskEntity} Risk Score capability surfaces risky {riskEntityLowerPlural} from within your environment.",values:{riskEntity:Object(Eu.d)(e),riskEntityLowerPlural:Object(Eu.d)(e,!0,!0)}}))(t)),i.a.createElement("p",null,(e=>$.i18n.translate("xpack.securitySolution.riskInformation.explanation",{defaultMessage:'This feature utilizes a transform, with a scripted metric aggregation to calculate {riskEntityLower} risk scores based on detection rule alerts with an "open" status, within a 5 day time window. The transform runs hourly to keep the score updated as new detection rule alerts stream in.',values:{riskEntityLower:Object(Eu.d)(e,!0)}}))(t))),i.a.createElement(U.EuiSpacer,null),i.a.createElement(U.EuiBasicTable,{columns:Ub(t),items:Hb,"data-test-subj":"risk-information-table"}),i.a.createElement(U.EuiSpacer,{size:"l"}),i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.riskInformation.learnMore",defaultMessage:"You can learn more about {riskEntity} risk {riskScoreDocumentationLink}",values:{riskScoreDocumentationLink:i.a.createElement(lu.a,{riskScoreEntity:t,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.riskInformation.link",defaultMessage:"here"})}),riskEntity:Object(Eu.d)(t,!0)}})),i.a.createElement(U.EuiFlyoutFooter,null,i.a.createElement(U.EuiFlexGroup,{justifyContent:"flexEnd"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{onClick:e},zb)))))};var Wb=G()(U.EuiBetaBadge).withConfig({displayName:"_StyledEuiBetaBadge",componentId:"sc-8m2suk-0"})(["color:",";margin-top:",";"],(e=>e.$_css),(e=>e.$_css2));const Kb=e=>$.i18n.translate("xpack.securitySolution.riskTabBody.scoreOverTimeTitle",{defaultMessage:"{riskEntity} risk score over time",values:{riskEntity:Object(Eu.d)(e)}}),Yb=$.i18n.translate("xpack.securitySolution.riskTabBody.viewDashboardButtonLabel",{defaultMessage:"View source dashboard"});var Jb=a(48);const Xb=$.i18n.translate("xpack.securitySolution.hosts.hostScoreOverTime.riskyThresholdHeader",{defaultMessage:"Risky threshold"}),Zb=$.i18n.translate("xpack.securitySolution.hosts.hostScoreOverTime.riskyLabel",{defaultMessage:"Risky"}),eg=$.i18n.translate("xpack.securitySolution.hosts.hostScoreOverTime.riskScore",{defaultMessage:"Risk score"}),tg={host:Object(nt.v4)(),user:Object(nt.v4)()},ag=(e="host",t={spaceId:"default"})=>{const a=[Object(nt.v4)(),Object(nt.v4)()],n=Object(nt.v4)(),i=tg[e];return{title:`${e} risk score over time`,description:"",visualizationType:"lnsXY",state:{visualization:{title:"Empty XY chart",legend:{isVisible:!1,position:"right"},valueLabels:"hide",preferredSeriesType:"line",layers:[{layerId:a[0],accessors:["8886a925-4419-4d9a-8498-3bda4ecf1b0a"],position:"top",seriesType:"line",showGridlines:!1,layerType:"data",xAccessor:"02a55c97-d7a4-440d-ac77-33b941c16189",yConfig:[{forAccessor:"8886a925-4419-4d9a-8498-3bda4ecf1b0a",axisMode:"left"}]},{layerId:a[1],layerType:"referenceLine",accessors:[n],yConfig:[{forAccessor:n,axisMode:"left",lineWidth:2,color:"#aa6556",icon:"alert",textVisibility:!0,fill:"none",iconPosition:"left"}]}],xTitle:"",axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!1},yTitle:"",yRightTitle:"",valuesInLegend:!0,labelsOrientation:{x:0,yLeft:0,yRight:0},tickLabelsVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},yLeftExtent:{mode:"custom",lowerBound:0,upperBound:100}},query:{query:"",language:"kuery"},filters:[],datasourceStates:{formBased:{layers:{[a[0]]:{columns:{"02a55c97-d7a4-440d-ac77-33b941c16189":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto",includeEmptyRows:!0,dropPartials:!1}},"8886a925-4419-4d9a-8498-3bda4ecf1b0a":{label:"Risk score",dataType:"number",operationType:"max",sourceField:`${e}.risk.calculated_score_norm`,isBucketed:!1,scale:"ratio",params:{format:{id:"number",params:{decimals:0}},emptyAsNull:!0},customLabel:!0}},columnOrder:["02a55c97-d7a4-440d-ac77-33b941c16189","8886a925-4419-4d9a-8498-3bda4ecf1b0a"],sampling:1,incompleteColumns:{}},[a[1]]:{linkToLayers:[],columns:{[n]:{label:"Risky threshold",dataType:"number",operationType:"static_value",isStaticValue:!0,isBucketed:!1,scale:"ratio",params:{value:"70"},references:[],customLabel:!0}},columnOrder:[n],sampling:1,incompleteColumns:{}}}},textBased:{layers:{}}},internalReferences:[{type:"index-pattern",id:i,name:`indexpattern-datasource-layer-${a[0]}`},{type:"index-pattern",id:i,name:`indexpattern-datasource-layer-${a[1]}`}],adHocDataViews:{[i]:{id:i,title:`ml_${e}_risk_score_${t.spaceId}`,timeFieldName:"@timestamp",sourceFilters:[],fieldFormats:{},runtimeFieldMap:{},fieldAttrs:{},allowNoIndex:!1,name:`ml_${e}_risk_score_${t.spaceId}`}}},references:[]}},ng=G()(U.EuiText).withConfig({displayName:"StyledEuiText",componentId:"sc-ggkz6s-0"})(["font-size:9px;font-weight:",";margin-right:",";"],(({theme:e})=>e.eui.euiFontWeightSemiBold),(({theme:e})=>e.eui.euiSizeXS)),ig=G()(U.EuiLoadingChart).withConfig({displayName:"LoadingChart",componentId:"sc-ggkz6s-1"})(["display:block;text-align:center;"]),rg=e=>Math.round(e).toString(),sg=({from:e,to:t,riskScore:a,loading:r,queryId:s,riskEntity:o,title:l,toggleStatus:c,toggleQuery:u})=>{const d=Object(m.m)(),p=Object(n.useMemo)((()=>Object(Pp.a)([e,t])),[e,t]),b=Object(n.useCallback)((({value:e})=>i.a.createElement(qs.c,{value:e})),[]),{baseTheme:g,theme:f}=Object(Na.i)(),y=Object(n.useMemo)((()=>{var e;return null!==(e=null==a?void 0:a.map((e=>({x:e["@timestamp"],y:(Object(Vo.H)(e)?e.user:e.host).risk.calculated_score_norm}))).reverse())&&void 0!==e?e:[]}),[a]),h=Object(nr.a)(),v=Object(K.a)("chartEmbeddablesEnabled"),E=Object(n.useMemo)((()=>({from:e,to:t})),[e,t]);return i.a.createElement(Ve.c,null,i.a.createElement(U.EuiPanel,{hasBorder:!0,"data-test-subj":"RiskScoreOverTime"},i.a.createElement(U.EuiFlexGroup,{gutterSize:"none"},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(pn.a,{title:l,hideSubtitle:!0,toggleQuery:u,toggleStatus:c})),c&&!v&&i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(Ve.b,{queryId:s,title:l}))),c&&i.a.createElement(U.EuiFlexGroup,{gutterSize:"none",direction:"column"},i.a.createElement(U.EuiFlexItem,{grow:1},v&&h?i.a.createElement(ci.a,{applyGlobalQueriesAndFilters:!1,timerange:E,getLensAttributes:ag,stackByField:o,id:`${s}-embeddable`,height:180,extraOptions:{spaceId:h}}):i.a.createElement("div",{style:{height:250}},r?i.a.createElement(ig,{size:"l","data-test-subj":"RiskScoreOverTime-loading"}):i.a.createElement(Da.Chart,null,i.a.createElement(Da.Tooltip,{headerFormatter:b}),i.a.createElement(Da.Settings,Ni()({},Na.e,{baseTheme:g,theme:f})),i.a.createElement(Da.Axis,{id:"bottom",position:Da.Position.Bottom,tickFormat:p,gridLine:{visible:!0,strokeWidth:1,opacity:1,dash:[3,5]}}),i.a.createElement(Da.Axis,{domain:{min:0,max:100},id:"left",position:Da.Position.Left,ticks:3,style:{tickLine:{visible:!1},tickLabel:{padding:10}}}),i.a.createElement(Da.LineSeries,{id:"RiskOverTime",name:eg,xScaleType:Da.ScaleType.Time,yScaleType:Da.ScaleType.Linear,xAccessor:"x",yAccessors:["y"],timeZone:d,data:y,tickFormat:rg}),i.a.createElement(Da.LineAnnotation,{id:"RiskOverTime_annotation",domainType:Da.AnnotationDomainType.YDomain,dataValues:[{dataValue:70,details:"70",header:Xb}],markerPosition:"left",style:{line:{strokeWidth:1,stroke:Jb.euiThemeVars.euiColorDanger,opacity:1}},marker:i.a.createElement(ng,{color:Jb.euiThemeVars.euiColorDarkestShade},Zb)})))))))};sg.displayName="RiskScoreOverTimeComponent";const og=i.a.memo(sg);og.displayName="RiskScoreOverTime";const lg=$.i18n.translate("xpack.securitySolution.hosts.topRiskScoreContributors.title",{defaultMessage:"Top risk score contributors"}),cg=$.i18n.translate("xpack.securitySolution.hosts.topRiskScoreContributors.rankColumnTitle",{defaultMessage:"Rank"}),ug=$.i18n.translate("xpack.securitySolution.hosts.topRiskScoreContributors.ruleNameColumnTitle",{defaultMessage:"Rule name"});var dg=a(204),pg=a(752),mg=a(728),bg=a(333),gg=a(1061),fg=a(1134),yg=a(736);const hg=G()(U.EuiFlexGroup).withConfig({displayName:"IntegrationsPopoverWrapper",componentId:"sc-1x92pc2-0"})(["width:100%;"]),vg=G()(U.EuiPopoverTitle).withConfig({displayName:"PopoverTitleWrapper",componentId:"sc-1x92pc2-1"})(["max-width:390px;"]),Eg=G()("div").withConfig({displayName:"PopoverContentWrapper",componentId:"sc-1x92pc2-2"})(["max-height:400px;max-width:390px;overflow:auto;line-height:",";"],(({theme:e})=>e.eui.euiLineHeight)),xg=G()("li").withConfig({displayName:"IntegrationListItem",componentId:"sc-1x92pc2-3"})(["list-style-type:disc;margin-left:25px;margin-bottom:5px;"]),jg=({relatedIntegrations:e})=>{const[t,a]=Object(n.useState)(!1),{integrations:r,isLoaded:s}=Object(fg.a)(e),o=Object(n.useMemo)((()=>r.filter((e=>e.installationStatus.isKnown&&e.installationStatus.isEnabled))),[r]),l=r.length,c=o.length,u=Object(n.useMemo)((()=>s?`${c}/${l} ${yg.a}`:`${l} ${yg.a}`),[s,l,c]);return i.a.createElement(hg,{alignItems:"center",gutterSize:"s","data-test-subj":"IntegrationsWrapper"},i.a.createElement(U.EuiPopover,{ownFocus:!0,"data-test-subj":"IntegrationsDisplayPopover",button:i.a.createElement(U.EuiBadge,{iconType:"package",color:"hollow","data-test-subj":"IntegrationsDisplayPopoverButton",onClick:()=>a(!t),onClickAriaLabel:u},u),isOpen:t,closePopover:()=>a(!t),repositionOnScroll:!0},i.a.createElement(vg,{"data-test-subj":"IntegrationsPopoverTitle"},yg.h(l)),i.a.createElement(Eg,{"data-test-subj":"IntegrationsPopoverContentWrapper"},i.a.createElement(U.EuiText,{size:"s"},yg.g(l)),i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement("ul",null,r.map(((e,t)=>i.a.createElement(xg,{key:`${e.packageName}-${t}`},i.a.createElement(gg.a,{integration:e}))))))))},Sg=i.a.memo(jg);Sg.displayName="IntegrationsPopover";const kg=Sg;var Og=a(1393),wg=a(1107),Tg=a(329),Ig=a(137),Cg=a(866),Mg=a(1109),_g=a(265),Fg=a(1110);const Ag=()=>{const{services:{application:{capabilities:{actions:e}}}}=Object(m.j)();return!Object(bg.d)(e.show)||e.show};var Dg=a(648),Ng=a(486);const Pg=()=>{const e=Object(io.a)();return Object(Ng.a)(e)&&Object(Dg.a)(e)};var Rg=a(687),Lg=a(172),Bg=a(196),qg=a(1067),zg=a(612),$g=a(1050),Vg=a(283);const Ug=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagementUi.rulesTable.mlJobsWarning.popover.description",{defaultMessage:"The following jobs are not running and might cause the rule to generate wrong results:"}),Hg=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagementUi.rulesTable.mlJobsWarning.popover.buttonLabel",{defaultMessage:"Visit rule details page to investigate"}),Gg=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagementUi.rulesTable.allRules.tabs.rules",{defaultMessage:"Installed Rules"}),Qg=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagementUi.rulesTable.allRules.tabs.monitoring",{defaultMessage:"Rule Monitoring"}),Wg=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagementUi.rulesTable.allRules.tabs.updates",{defaultMessage:"Rule Updates"});$.i18n.translate("xpack.securitySolution.detectionEngine.ruleManagementUi.rulesTable.allRules.tabs.addRules",{defaultMessage:"Add Rules"});var Kg=a(472),Yg=a(197),Jg=a(1416);const Xg=({rule:e,loadingJobs:t,jobs:a})=>{const[n,,r,o]=Object(Kg.a)();if(!Object(Yg.c)(e.type)||t||!e.machine_learning_job_id)return null;const l=e.machine_learning_job_id,c=a.filter((e=>l.includes(e.id)&&!Object(dg.c)(e.jobState,e.datafeedState)));if(!c.length)return null;const u=i.a.createElement(U.EuiButtonIcon,{display:"empty",color:"warning",iconType:"warning",onClick:o}),d=Object(Jg.a)(Vg.f["partial failure"]);return i.a.createElement(U.EuiPopover,{button:u,isOpen:n,closePopover:r,anchorPosition:"leftCenter"},i.a.createElement(U.EuiPopoverTitle,null,d),i.a.createElement("div",{style:{width:"340px"}},i.a.createElement(U.EuiText,{size:"s"},i.a.createElement("p",null,Ug))),i.a.createElement(U.EuiSpacer,{size:"s"}),c.map((e=>{var t,a;return i.a.createElement(U.EuiText,{key:e.id},null!==(t=null===(a=e.customSettings)||void 0===a?void 0:a.security_app_display_name)&&void 0!==t?t:e.id)})),i.a.createElement(U.EuiPopoverFooter,null,i.a.createElement(ge.l,{"data-test-subj":"open-rule-details",fullWidth:!0,deepLinkId:s.wc.rules,path:Object(Z.c)(e.id,Cg.b.alerts)},Hg)))},Zg=i.a.memo(Xg);Zg.displayName="MlRuleWarningPopover";const ef=({hasCRUDPermissions:e,startMlJobs:t})=>{const a=Pg(),r=Ag(),{loadingRulesAction:s,loadingRuleIds:o}=Object(_g.b)().state,l=Object(n.useMemo)((()=>["disable","enable","edit","delete"].includes(null!=s?s:"")?o:[]),[o,s]);return Object(n.useMemo)((()=>({field:"enabled",name:Ig.bb,render:(n,s)=>i.a.createElement(U.EuiToolTip,{position:"top",content:Object(bg.b)(s,a,r,e)},i.a.createElement(wg.a,{id:s.id,enabled:s.enabled,startMlJobsIfNeeded:()=>t(s.machine_learning_job_id),isDisabled:!Object(bg.a)(s,r)||!e||Object(dg.d)(s.type)&&!a,isLoading:l.includes(s.id)})),width:"95px",sortable:!0})),[a,r,e,l,t])},tf=({name:e,id:t})=>i.a.createElement(U.EuiToolTip,{content:e,anchorClassName:"eui-textTruncate"},i.a.createElement(ge.k,{"data-test-subj":"ruleName",deepLinkId:s.wc.rules,path:Object(Z.c)(t,Cg.b.alerts)},e)),af=()=>Object(n.useMemo)((()=>({field:"name",name:Ig.mb,render:(e,t)=>i.a.createElement(tf,{id:t.id,name:e}),sortable:!0,truncateText:!0,width:"38%"})),[]),nf=({sortable:e,width:t,isLoadingJobs:a,mlJobs:r})=>Object(n.useMemo)((()=>({field:"execution_summary.last_execution.status",name:Ig.hb,render:(e,t)=>{var n;return i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(Og.b,{status:e,message:null===(n=t.execution_summary)||void 0===n?void 0:n.last_execution.message})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(Zg,{rule:t,loadingJobs:a,jobs:r})))},sortable:e,truncateText:!0,width:t})),[a,r,e,t]),rf={field:"tags",name:null,align:"center",render:e=>null==e||0===e.length?null:i.a.createElement(mg.a,{items:e,popoverTitle:Ig.pb,popoverButtonTitle:e.length.toString(),popoverButtonIcon:"tag",dataTestPrefix:"tags",renderItem:(e,t)=>i.a.createElement(U.EuiBadge,{color:"hollow",key:`${e}-${t}`,"data-test-subj":"tag"},e)}),width:"65px",truncateText:!0},sf={field:"related_integrations",name:null,align:"center",render:e=>null==e||0===e.length?null:i.a.createElement(kg,{relatedIntegrations:e}),width:"143px",truncateText:!0},of=({showExceptionsDuplicateConfirmation:e,confirmDeletion:t})=>{const a=(({showExceptionsDuplicateConfirmation:e,confirmDeletion:t})=>{const{navigateToApp:a}=Object(m.j)().services.application,n=Ag(),{startTransaction:r}=Object($d.b)(),{executeBulkAction:s}=Object(zg.b)(),{bulkExport:o}=Object(qg.a)(),l=Object($g.a)();return[{type:"icon","data-test-subj":"editRuleAction",description:Ig.Cb,name:n?Ig.Cb:i.a.createElement(U.EuiToolTip,{position:"left",content:Ig.Qb},i.a.createElement(i.a.Fragment,null,Ig.Cb)),icon:"controlsHorizontal",onClick:e=>Object(zg.a)(e.id,a),enabled:e=>Object(bg.a)(e,n)},{type:"icon","data-test-subj":"duplicateRuleAction",description:Ig.Ab,icon:"copy",name:n?Ig.Ab:i.a.createElement(U.EuiToolTip,{position:"left",content:Ig.Qb},i.a.createElement(i.a.Fragment,null,Ig.Ab)),enabled:e=>Object(bg.a)(e,n),onClick:async t=>{r({name:Bg.e.DUPLICATE});const n=await e();if(null===n)return;const i=await s({type:Lg.b.duplicate,ids:[t.id],duplicatePayload:{include_exceptions:n===Rg.a.withExceptions||n===Rg.a.withExceptionsExcludeExpiredExceptions,include_expired_exceptions:!(n===Rg.a.withExceptionsExcludeExpiredExceptions)}}),o=null==i?void 0:i.attributes.results.created;null!=o&&o.length&&Object(zg.a)(o[0].id,a)}},{type:"icon","data-test-subj":"exportRuleAction",description:Ig.Hb,icon:"exportAction",name:Ig.Hb,onClick:async e=>{r({name:Bg.e.EXPORT});const t=await o({ids:[e.id]});t&&await l(t)},enabled:e=>!e.immutable},{type:"icon","data-test-subj":"deleteRuleAction",description:Ig.xb,icon:"trash",name:Ig.xb,onClick:async e=>{!1!==await t()&&(r({name:Bg.e.DELETE}),await s({type:Lg.b.delete,ids:[e.id]}))}}]})({showExceptionsDuplicateConfirmation:e,confirmDeletion:t});return Object(n.useMemo)((()=>({actions:a,width:"40px"})),[a])},lf=[{name:cg,field:"rank",width:"45px",align:"right"},{name:ug,field:"name",sortable:!0,truncateText:!0,render:(e,{id:t})=>t?i.a.createElement(tf,{id:t,name:e}):e}],cf=({rules:e=[],loading:t,queryId:a,toggleStatus:r,toggleQuery:s})=>{const o=Object(n.useMemo)((()=>null==e?void 0:e.sort(((e,t)=>t.rule_risk-e.rule_risk)).map((({rule_name:e,rule_id:t},a)=>({rank:a+1,name:e,id:t})))),[e]),l=Object(n.useMemo)((()=>({showPerPageOptions:!1,pageSize:5,totalItemCount:o.length})),[o.length]);return i.a.createElement(Ve.c,null,i.a.createElement(U.EuiPanel,{hasBorder:!0,"data-test-subj":"topRiskScoreContributors"},i.a.createElement(U.EuiFlexGroup,{gutterSize:"none"},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(pn.a,{title:lg,hideSubtitle:!0,toggleQuery:s,toggleStatus:r})),r&&i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(Ve.b,{queryId:a,title:lg}))),r&&i.a.createElement(U.EuiFlexGroup,{"data-test-subj":"topRiskScoreContributors-table",gutterSize:"none",direction:"column"},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(U.EuiInMemoryTable,{items:o,columns:lf,pagination:l,loading:t})))))},uf=i.a.memo(cf);uf.displayName="TopRiskScoreContributors";const df=$.i18n.translate("xpack.securitySolution.hosts.topRiskScoreContributorsTable.title",{defaultMessage:"Top risk score contributors"});var pf=a(599);const mf=({toggleStatus:e,toggleQuery:t,riskScore:a,riskEntity:r,loading:o})=>{const{to:l,from:c}=Object(J.a)(),[{loading:u,signalIndexName:d,hasIndexWrite:p,hasIndexMaintenance:m}]=Object(le.b)(),{runtimeMappings:b}=Object(g.d)(f.SourcererScopeName.detections),y=Object(n.useMemo)((()=>te.d.globalFiltersQuerySelector()),[]),h=Object(n.useMemo)((()=>te.d.globalQuerySelector()),[]),v=Object(j.a)(h),E=Object(j.a)(y),x=Object(n.useMemo)((()=>{var e,t;const n=r===pf.c.host?a.host:a.user;return[{meta:{alias:null,negate:!1,disabled:!1},query:{terms:{_id:(null!==(e=null==n||null===(t=n.risk)||void 0===t?void 0:t.inputs)&&void 0!==e?e:[]).map((e=>e.id))}}}]}),[a,r]),S=Object(n.useCallback)((e=>i.a.createElement(Ai.a,{configId:s.e.RISK_INPUTS,flyoutSize:"m",inputFilters:[...x,...E,...e],tableId:R.e.alertsRiskInputs})),[x,E]);return i.a.createElement(U.EuiPanel,{hasBorder:!0,"data-test-subj":"topRiskScoreContributorsAlerts"},i.a.createElement(U.EuiFlexGroup,{gutterSize:"none"},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(pn.a,{title:df,hideSubtitle:!0,toggleQuery:t,toggleStatus:e}))),e&&i.a.createElement(U.EuiFlexGroup,{"data-test-subj":"topRiskScoreContributorsAlerts-table",gutterSize:"none",direction:"column"},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(Fi.a,{defaultFilters:[...x,...E],from:c,globalFilters:E,globalQuery:v,hasIndexMaintenance:null!=m&&m,hasIndexWrite:null!=p&&p,loading:u||o,renderChildComponent:S,runtimeMappings:b,signalIndexName:d,tableId:R.e.alertsRiskInputs,to:l}))))};var bf=a(609);const gf=G()(U.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-n8fpjk-0"})(["margin-top:",";"],(({theme:e})=>e.eui.euiSizeL)),ff=e=>e===Vo.w.host?Kc:Yc,yf=({entityName:e,startDate:t,endDate:a,setQuery:r,deleteQuery:o,riskEntity:l})=>{const c=Object(n.useMemo)((()=>l===Vo.w.host?Lu.a.HOST_DETAILS_RISK_SCORE:Lu.b.USER_DETAILS_RISK_SCORE),[l]),u=Object(K.a)("riskScoringRoutesEnabled"),d=Object(j.a)((e=>l===Vo.w.host?Nb.d.hostRiskScoreSeverityFilterSelector()(e,Nb.b.HostsType.details):ao.e.userRiskScoreSeverityFilterSelector()(e))),p=(({title:e})=>{const{dashboard:t}=Object(m.j)().services,{getAppUrl:a}=Object(m.c)(),[i,r]=Object(n.useState)(),o=Object(bf.b)(s.wc.dashboards);return Object(n.useEffect)((()=>{let a=!1;return(async()=>{if(t&&e){var n;const i=await(null==t?void 0:t.findDashboardsService()),{id:s}=null!==(n=await i.findByTitle(e))&&void 0!==n?n:{};a||r(s)}})(),()=>{a=!0}}),[t,e]),Object(n.useMemo)((()=>i?a({deepLinkId:s.wc.dashboards,path:`${i}${o}`}):void 0),[i,a,o])})({title:ff(l)}),b=Object(n.useMemo)((()=>({from:t,to:a})),[t,a]),{toggleStatus:g,setToggleStatus:f}=Object(Wn.a)(`${c} overTime`),{toggleStatus:y,setToggleStatus:h}=Object(Wn.a)(`${c} contributors`),v=Object(n.useMemo)((()=>e?Object(Vo.C)([e],l):{}),[e,l]),{data:E,loading:x,refetch:S,inspect:k,isDeprecated:O,isModuleEnabled:w,isAuthorized:T}=Object(Lu.c)({filterQuery:v,onlyLatest:!1,riskEntity:l,skip:!g&&!y,timerange:b}),{data:I}=Ku(),C=Object(n.useMemo)((()=>{const e=E&&E.length>0?E[E.length-1]:null;return e?l===Vo.w.host?e.host.risk.rule_risks:e.user.risk.rule_risks:[]}),[E,l]);Object(ft.b)({queryId:c,loading:x,refetch:S,setQuery:r,deleteQuery:o,inspect:k});const M=Object(n.useCallback)((e=>{h(e)}),[h]),_=Object(n.useCallback)((e=>{f(e)}),[f]),F={isDisabled:!w&&!x,isDeprecated:O&&!x};return T?null!=I&&I.isUpdateAvailable?i.a.createElement(_d,null):F.isDisabled||F.isDeprecated?i.a.createElement(wu,Ni()({},F,{entityType:l,refetch:S,timerange:b})):w&&0===d.length&&E&&0===E.length?i.a.createElement(Uu,{entityType:l,refetch:S}):i.a.createElement(i.a.Fragment,null,u?i.a.createElement(gf,{gutterSize:"s"},i.a.createElement(U.EuiFlexItem,null,(null==E?void 0:E[0])&&i.a.createElement(mf,{toggleStatus:y,toggleQuery:M,riskScore:E[0],riskEntity:l,loading:x}))):i.a.createElement(U.EuiFlexGroup,{direction:"row"},i.a.createElement(U.EuiFlexItem,{grow:2},i.a.createElement(og,{from:t,loading:x,queryId:c,riskEntity:l,riskScore:E,title:Kb(l),to:a,toggleQuery:_,toggleStatus:g})),i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(uf,{loading:x,queryId:c,toggleStatus:y,toggleQuery:M,rules:C}))),i.a.createElement(gf,{gutterSize:"s"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{href:p,isDisabled:!p,"data-test-subj":`risky-${l}s-view-dashboard-button`,target:"_blank",iconType:"popout",iconSide:"right"},Yb)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(Gb,{riskEntity:l})))):i.a.createElement(i.a.Fragment,null,"TODO: Add RiskScore Upsell")};yf.displayName="RiskDetailsTabBodyComponent";const hf=i.a.memo(yf);hf.displayName="RiskDetailsTabBody";const vf=`${s.Ic}/name/:detailName`,Ef=`${s.Ic}/:tabName(${Cs.UsersTableType.allUsers}|${Cs.UsersTableType.authentications}|${Cs.UsersTableType.anomalies}|${Cs.UsersTableType.risk}|${Cs.UsersTableType.events}|)`,xf=`${vf}/:tabName(${Cs.UsersTableType.authentications}|${Cs.UsersTableType.anomalies}|${Cs.UsersTableType.events}|${Cs.UsersTableType.risk})`,jf=i.a.memo((({deleteQuery:e,filterQuery:t,from:a,indexNames:n,isInitializing:r,setQuery:s,to:o,type:l,detailName:c,userDetailFilter:u})=>{const d={deleteQuery:e,endDate:o,filterQuery:t,indexNames:n,skip:r||void 0===t,setQuery:s,startDate:a,type:l,userName:c};return i.a.createElement(q.c,null,i.a.createElement(q.a,{path:`${vf}/:tabName(${Cs.UsersTableType.authentications})`},i.a.createElement(yl,d)),i.a.createElement(q.a,{path:`${vf}/:tabName(${Cs.UsersTableType.anomalies})`},i.a.createElement(_l,Ni()({},d,{AnomaliesTableComponent:gc}))),i.a.createElement(q.a,{path:`${vf}/:tabName(${Cs.UsersTableType.events})`},i.a.createElement(Sp,Ni()({additionalFilters:u,tableId:R.e.usersPageEvents},d))),i.a.createElement(q.a,{path:`${vf}/:tabName(${Cs.UsersTableType.risk})`},i.a.createElement(hf,Ni()({},d,{riskEntity:Vo.w.user,entityName:d.userName}))))}));jf.displayName="UsersDetailsTabs";const Sf=(e,t)=>`${s.Ic}/name/${e}/${t}`,kf=(e,t,a)=>{const n=[],i={[Cs.UsersTableType.authentications]:{id:Cs.UsersTableType.authentications,name:Tu.c,href:Sf(e,Cs.UsersTableType.authentications),disabled:!1},[Cs.UsersTableType.anomalies]:{id:Cs.UsersTableType.anomalies,name:Tu.b,href:Sf(e,Cs.UsersTableType.anomalies),disabled:!1},[Cs.UsersTableType.events]:{id:Cs.UsersTableType.events,name:Tu.d,href:Sf(e,Cs.UsersTableType.events),disabled:!1},[Cs.UsersTableType.risk]:{id:Cs.UsersTableType.risk,name:Tu.e,href:Sf(e,Cs.UsersTableType.risk),disabled:!1}};return t||n.push(Cs.UsersTableType.anomalies),a||n.push(Cs.UsersTableType.risk),Object(x.omit)(n,i)};var Of=a(133),wf=a(367),Tf=a(797),If=a(386),Cf=a(298);const Mf="UsersDetailsQueryId",_f=({detailName:e,usersDetailsPagePath:t})=>{const a=Object(o.useDispatch)(),r=Object(io.a)().isPlatinumOrTrialLicense,s=Object(n.useMemo)((()=>R.j.getTableByIdSelector()),[]),l=Object(j.b)((e=>{var t;return(null!==(t=s(e,R.e.hostsPageEvents))&&void 0!==t?t:Of.b).graphEventId})),c=Object(n.useMemo)((()=>Vr.d.globalFiltersQuerySelector()),[]),u=Object(n.useMemo)((()=>Vr.d.globalQuerySelector()),[]),d=Object(j.a)(u),p=Object(j.a)(c),{signalIndexName:b}=Object(fb.a)(),{hasKibanaREAD:f,hasIndexRead:y}=Object(Rr.a)(),v=f&&y,{to:k,from:O,deleteQuery:w,setQuery:T,isInitializing:I}=Object(J.a)(),{globalFullScreen:C}=Object(fe.a)(),{services:{uiSettings:M}}=Object(m.j)(),_=Object(n.useMemo)((()=>{return[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:"user.name",value:t=e,params:{query:t}},query:{match:{"user.name":{query:t,type:"phrase"}}}}];var t}),[e]),{indicesExist:F,indexPattern:A,selectedPatterns:D}=Object(g.d)(),[N,P]=Object(n.useMemo)((()=>{try{return[Object(bt.buildEsQuery)(A,[d],[..._,...p],Object(Ms.getEsQueryConfig)(M))]}catch(e){return[void 0,e]}}),[p,A,d,M,_]),L=JSON.stringify(N);Object(Cp.a)({id:Mf,filterQuery:L,kqlError:P,query:d,startDate:O,endDate:k}),Object(n.useEffect)((()=>{a(Object(Db.setUsersDetailsTablesActivePageToZero)())}),[a,e]);const[B,{inspect:q,userDetails:z,refetch:$}]=Object(If.b)({id:Mf,endDate:k,startDate:O,userName:e,indexNames:D,skip:0===D.length}),V=Object(io.a)();Object(ft.b)({setQuery:T,deleteQuery:w,refetch:$,inspect:q,loading:B,queryId:Mf});const H=Object(n.useCallback)(((e,t)=>{const n=Object(Cf.a)(e,t);a(Object(ae.setAbsoluteRangeDatePicker)({id:Y.a.global,from:n.from,to:n.to}))}),[a]),G=Object(n.useMemo)((()=>({field:"user.name",value:e})),[e]);return i.a.createElement(i.a.Fragment,null,F?i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiWindowEvent,{event:"resize",handler:x.noop}),i.a.createElement(X.a,{show:Object(he.n)({globalFullScreen:C,graphEventId:l})},i.a.createElement(ee.a,{indexPattern:A,id:Y.a.global})),i.a.createElement(h.a,{noPadding:C},i.a.createElement(Ci.a,{subtitle:i.a.createElement(zs,{indexKey:Vo.k.userDetails,indexNames:D,userName:e}),title:e}),i.a.createElement(wf.a,{criteriaFields:Object(ec.a)(Cs.UsersType.details,e),startDate:O,endDate:k,skip:I},(({isLoadingAnomaliesData:t,anomaliesData:a,jobNameById:n})=>i.a.createElement(Tf.a,{userName:e,id:Mf,isInDetailsSidePanel:!1,data:z,anomaliesData:a,isLoadingAnomaliesData:t,loading:B,startDate:O,endDate:k,narrowDateRange:H,indexPatterns:D,jobNameById:n}))),i.a.createElement(U.EuiHorizontalRule,null),i.a.createElement(U.EuiSpacer,null),v&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiFlexGroup,null,i.a.createElement(U.EuiFlexItem,null,i.a.createElement(gb,{signalIndexName:b,entityFilter:G,additionalFilters:N?[N]:[]})),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(Fb,{entityFilter:G,signalIndexName:b,additionalFilters:N?[N]:[]}))),i.a.createElement(U.EuiSpacer,null)),i.a.createElement(_s.a,{navTabs:kf(e,Object(Al.a)(V),r)}),i.a.createElement(U.EuiSpacer,null),i.a.createElement(jf,{deleteQuery:w,detailName:e,filterQuery:L,from:O,indexNames:D,indexPattern:A,isInitializing:I,userDetailFilter:_,setQuery:T,to:k,type:Cs.UsersType.details,usersDetailsPagePath:t}))):i.a.createElement(Mi.a,null),i.a.createElement(E.a,{pageName:S.a.users}))};_f.displayName="UsersDetailsComponent";const Ff=i.a.memo(_f),Af=i.a.memo((()=>i.a.createElement(q.c,null,i.a.createElement(q.a,{path:Ef},i.a.createElement(Nm,null)),i.a.createElement(q.a,{path:`${s.Ic}/externalAlerts`,render:({location:{search:e=""}})=>i.a.createElement(B.Redirect,{to:{pathname:`${s.Ic}/${Cs.UsersTableType.events}`,search:`${e}&onlyExternalAlerts=true`}})}),i.a.createElement(q.a,{path:xf,render:({match:{params:{detailName:e}}})=>i.a.createElement(Ff,{usersDetailsPagePath:vf,detailName:decodeURIComponent(e)})}),i.a.createElement(q.a,{path:vf,render:({match:{params:{detailName:e}},location:{search:t=""}})=>i.a.createElement(B.Redirect,{to:{pathname:`${s.Ic}/name/${e}/${Cs.UsersTableType.authentications}`,search:t}})}),i.a.createElement(q.a,{path:`${s.Ic}/:detailName/:tabName?`,render:({match:{params:{detailName:e,tabName:t=Cs.UsersTableType.authentications}},location:{search:a=""}})=>i.a.createElement(B.Redirect,{to:{pathname:`${s.Ic}/name/${e}/${t}`,search:a}})}),i.a.createElement(q.a,{path:s.Ic,render:({location:{search:e=""}})=>i.a.createElement(B.Redirect,{to:{pathname:`${s.Ic}/${Cs.UsersTableType.allUsers}`,search:e}})}))));Af.displayName="UsersContainer";var Df=a(647),Nf=a(879),Pf=a(525),Rf=a(200);const Lf=(e,t)=>"host.name"===e.entityName&&(null==t||e.entityValue===t),Bf=(e,t)=>e===Rf.HostsType.details&&null!=t?[{fieldName:"host.name",fieldValue:t}]:[],qf={sort:{field:"anomaly.severity",direction:"desc"}},zf=({startDate:e,endDate:t,hostName:a,skip:r,type:s})=>{const l=Object(o.useDispatch)(),c=Object(io.a)(),{toggleStatus:u,setToggleStatus:d}=Object(Wn.a)("AnomaliesHostTable"),[p,m]=Object(n.useState)(r||!u);Object(n.useEffect)((()=>{m(r||!u)}),[r,u]);const b=Object(n.useCallback)((e=>{d(e),m(!e)}),[m,d]),{jobNameById:g,loading:f}=Object(El.a)(),y=Object(n.useMemo)((()=>Object.keys(g)),[g]),h=Object(n.useMemo)((()=>Nb.d.hostsAnomaliesJobIdFilterSelector()),[]),v=Object(j.a)((e=>h(e,s))),E=Object(n.useCallback)((e=>{l(Nb.a.updateHostsAnomaliesJobIdFilter({jobIds:e,hostsType:s}))}),[l,s]),x=Object(n.useMemo)((()=>Nb.d.hostsAnomaliesIntervalSelector()),[]),S=Object(j.a)((e=>x(e,s))),k=Object(n.useCallback)((e=>{l(Nb.a.updateHostsAnomaliesInterval({interval:e,hostsType:s}))}),[l,s]),[O,w]=Object(Fl.a)({startDate:e,endDate:t,skip:p,criteriaFields:Bf(s,a),filterQuery:{exists:{field:"host.name"}},jobIds:v.length>0?v:y,aggregationInterval:S}),T=((e,t,a)=>null==e?[]:e.anomalies.reduce(((e,n)=>{var i;if(Lf(n,a))return[...e,{hostName:n.entityValue,jobName:null!==(i=t[n.jobId])&&void 0!==i?i:n.jobId,anomaly:n}];{const i=((e=[],t)=>{const a=e.find((e=>{const[a,n]=Object(tc.a)(e);return"host.name"===a&&(null==t||n===t)}));return null!=a?Object.values(a)[0]:null})(n.influencers,a);var r;return null!=i?[...e,{hostName:i,jobName:null!==(r=t[n.jobId])&&void 0!==r?r:n.jobId,anomaly:n}]:e}}),[]))(w,g,a),I=((e,t,a)=>{const n=((e,t)=>[{name:Bl,field:"hostName",sortable:!0,render:(e,t)=>Object(eo.b)({values:[e],fieldName:"host.name",idPrefix:`anomalies-host-table-hostName-${nc(t.anomaly)}-hostName`,render:e=>i.a.createElement(ge.d,{hostName:e})})},...lc(e,t)])(t,a);return e===Rf.HostsType.details?n.filter((e=>e.name!==Bl)):n})(s,e,t),C={initialPageIndex:0,initialPageSize:10,totalItemCount:T.length,pageSizeOptions:[5,10,20,50],showPerPageOptions:!0};return Object(Al.a)(c)?i.a.createElement(Ws.a,{loading:O||f},i.a.createElement(pn.a,{subtitle:`${Dl}: ${C.totalItemCount.toLocaleString()} ${Pl(C.totalItemCount)}`,title:Nl,toggleQuery:b,toggleStatus:u,tooltip:Rl,isInspectDisabled:r,headerFilters:i.a.createElement(U.EuiFlexGroup,null,i.a.createElement(U.EuiFlexItem,null,i.a.createElement(pc,{interval:S,onChange:k})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(cc,{title:Gl,onSelect:E,selectedJobIds:v,jobIds:y,jobNameById:g})))}),u&&i.a.createElement(Zl.a,{"data-test-subj":"host-anomalies-table",columns:I,items:T,pagination:C,sorting:qf}),(O||f)&&i.a.createElement($s.a,{"data-test-subj":"anomalies-host-table-loading-panel",overlay:!0,size:"xl"})):null},$f=i.a.memo(zf),Vf="authenticationsHostsTableQuery",Uf=Nb.b.HostsTableType.authentications,Hf=({endDate:e,filterQuery:t,indexNames:a,skip:r,startDate:s,type:l,setQuery:c,deleteQuery:u})=>{const d=Object(o.useDispatch)(),{toggleStatus:p}=Object(Wn.a)(Vf),[m,b]=Object(n.useState)(r||!p);Object(n.useEffect)((()=>{b(r||!p)}),[r,p]);const g=Nb.d.authenticationsSelector(),{activePage:f,limit:y}=Object(j.a)((e=>g(e,l))),[h,{authentications:v,totalCount:E,pageInfo:S,loadPage:k,inspect:O,isInspected:w,refetch:T}]=pl({endDate:e,filterQuery:t,indexNames:a,skip:m,startDate:s,stackByField:Vo.a.userName,activePage:f,limit:y}),I=l===Nb.b.HostsType.details?[tl,nl,Wo,Ko,Yo,Xo,Zo]:Go(),C=Object(n.useCallback)((e=>d(Nb.a.updateTableLimit({hostsType:l,limit:e,tableType:Uf}))),[l,d]),M=Object(n.useCallback)((e=>d(Nb.a.updateTableActivePage({activePage:e,hostsType:l,tableType:Uf}))),[l,d]);return Object(ft.b)({queryId:Vf,loading:h,refetch:T,setQuery:c,deleteQuery:u,inspect:O}),i.a.createElement(Ys,{activePage:f,columns:I,dataTestSubj:"authentications-host-table",headerCount:E,headerTitle:wo,headerUnit:To(E),id:Vf,isInspect:w,itemsPerRow:Qo,limit:y,loading:h,loadPage:k,pageOfItems:v,setQuerySkip:b,showMorePagesIndicator:Object(x.getOr)(!1,"showMorePagesIndicator",S),totalCount:Object(x.getOr)(50,"fakeTotalCount",S),updateLimitPagination:C,updateActivePage:M})};Hf.displayName="AuthenticationsHostTableComponent";const Gf=i.a.memo(Hf),Qf=({deleteQuery:e,endDate:t,filterQuery:a,indexNames:n,skip:r,setQuery:s,startDate:o,type:l})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(fl.a,Ni()({endDate:t,filterQuery:a,id:"authenticationsHistogramQuery",indexNames:n,setQuery:s,startDate:o},ll)),i.a.createElement(Gf,{endDate:t,filterQuery:a,indexNames:n,setQuery:s,deleteQuery:e,startDate:o,type:l,skip:r}));Qf.displayName="AuthenticationsQueryTabBodyComponent";const Wf=i.a.memo(Qf);Wf.displayName="AuthenticationsQueryTabBody";const Kf=$.i18n.translate("xpack.securitySolution.allHost.failSearchDescription",{defaultMessage:"Failed to run search on all hosts"}),Yf="hostsAllQuery";var Jf=a(1081);const Xf=$.i18n.translate("xpack.securitySolution.hostsRiskTable.hostNameTitle",{defaultMessage:"Host Name"}),Zf=$.i18n.translate("xpack.securitySolution.hostsRiskTable.hostRiskScoreTitle",{defaultMessage:"Host risk score"}),ey=($.i18n.translate("xpack.securitySolution.hostsRiskTable.riskTitle",{defaultMessage:"Host risk classification"}),$.i18n.translate("xpack.securitySolution.hostsRiskTable.hostRiskToolTip",{defaultMessage:"Host risk classification is determined by host risk score. Hosts classified as Critical or High are indicated as risky."})),ty=$.i18n.translate("xpack.securitySolution.hostsRiskTable.hostRiskTitle",{defaultMessage:"Host risk"}),ay=$.i18n.translate("xpack.securitySolution.hostsRiskTable.hostsTableTooltip",{defaultMessage:"The host risk table is not affected by the KQL time range. This table shows the latest recorded risk score for each host."}),ny=e=>$.i18n.translate("xpack.securitySolution.hostsRiskTable.filteredHostsTitle",{values:{severity:e},defaultMessage:"View {severity} risk hosts"});var iy=a(419),ry=a(323);const sy=Nb.b.HostsTableType.hosts,oy=[{text:Jf.i,numberOfRow:5},{text:Jf.h,numberOfRow:10}],ly=({data:e,fakeTotalCount:t,id:a,isInspect:r,loading:l,loadPage:c,setQuerySkip:u,showMorePagesIndicator:d,totalCount:p,type:m})=>{const b=Object(o.useDispatch)(),{navigateTo:g}=Object(ry.h)(),f=Object(n.useMemo)((()=>Nb.d.hostsSelector()),[]),{activePage:y,direction:h,limit:v,sortField:E}=Object(j.a)((e=>f(e,m))),x=Object(n.useCallback)((e=>b(Nb.a.updateTableLimit({hostsType:m,limit:e,tableType:sy}))),[m,b]),S=Object(n.useCallback)((e=>b(Nb.a.updateTableActivePage({activePage:e,hostsType:m,tableType:sy}))),[m,b]),k=Object(n.useCallback)((e=>{if(null!=e.sort){const t={field:cy(e.sort.field),direction:e.sort.direction};t.direction===h&&t.field===E||b(Nb.a.updateHostsSort({sort:t,hostsType:m}))}}),[h,E,m,b]),O=Object(Vb.a)("entity-analytics"),w=Object(io.a)().isPlatinumOrTrialLicense,T=Object(n.useCallback)((e=>{b(Nb.a.updateHostRiskScoreSeverityFilter({severitySelection:[e],hostsType:m})),g({deepLinkId:s.wc.hosts,path:Rf.HostsTableType.risk})}),[b,g,m]),I=Object(n.useMemo)((()=>((e,t)=>{const a=[{field:"node.host.name",name:Jf.e,truncateText:!1,mobileOptions:{show:!0},sortable:!0,render:e=>null!=e&&e.length>0?i.a.createElement(Dn.c,{mode:Dn.a.HOVER_DOWN,visibleCellActions:5,showActionTooltips:!0,triggerId:Dn.d.DEFAULT,data:{value:e[0],field:"host.name"}},i.a.createElement(ge.d,{hostName:e[0]})):Object(Bs.d)(),width:"35%"},{field:"node.lastSeen",name:i.a.createElement(U.EuiToolTip,{content:Jf.a},i.a.createElement(i.a.Fragment,null,Jf.d," ",i.a.createElement(U.EuiIcon,{color:"subdued",type:"iInCircle",className:"eui-alignTop"}))),truncateText:!1,mobileOptions:{show:!0},sortable:!0,render:e=>null!=e&&e.length>0?i.a.createElement(qs.b,{value:Array.isArray(e)?e[0]:e}):Object(Bs.d)()},{field:"node.host.os.name",name:i.a.createElement(U.EuiToolTip,{content:Jf.g},i.a.createElement(i.a.Fragment,null,Jf.f," ",i.a.createElement(U.EuiIcon,{color:"subdued",type:"iInCircle",className:"eui-alignTop"}))),truncateText:!1,mobileOptions:{show:!0},sortable:!1,render:e=>null!=e?i.a.createElement(Dn.c,{mode:Dn.a.HOVER_DOWN,visibleCellActions:5,showActionTooltips:!0,triggerId:Dn.d.DEFAULT,data:{value:e[0],field:"host.os.name"}},e):Object(Bs.d)()},{field:"node.host.os.version",name:Jf.k,truncateText:!1,mobileOptions:{show:!0},sortable:!1,render:e=>null!=e?i.a.createElement(Dn.c,{mode:Dn.a.HOVER_DOWN,visibleCellActions:5,showActionTooltips:!0,triggerId:Dn.d.DEFAULT,data:{value:e[0],field:"host.os.version"}},e):Object(Bs.d)()}];return e&&a.push({field:"node.risk",name:i.a.createElement(U.EuiToolTip,{content:Jf.c},i.a.createElement(i.a.Fragment,null,Object(Eu.b)(Vo.w.host)," ",i.a.createElement(U.EuiIcon,{color:"subdued",type:"iInCircle",className:"eui-alignTop"}))),truncateText:!1,mobileOptions:{show:!0},sortable:!1,render:e=>null!=e?i.a.createElement(no.b,{toolTipContent:i.a.createElement(U.EuiLink,{onClick:()=>t(e)},i.a.createElement(U.EuiText,{size:"xs"},ny(e.toLowerCase()))),severity:e}):Object(Bs.d)()}),a})(w&&O,T)),[T,w,O]),C=Object(n.useMemo)((()=>((e,t)=>({field:uy(e),direction:t}))(E,h)),[E,h]);return i.a.createElement(Ys,{activePage:y,columns:I,dataTestSubj:`table-${sy}`,headerCount:p,headerTitle:Jf.b,headerUnit:Jf.j(p),id:a,isInspect:r,itemsPerRow:oy,limit:v,loading:l,loadPage:c,onChange:k,pageOfItems:e,setQuerySkip:u,showMorePagesIndicator:d,sorting:C,totalCount:t,updateLimitPagination:x,updateActivePage:S})};ly.displayName="HostsTableComponent";const cy=e=>"node.host.name"===e?iy.b.hostName:iy.b.lastSeen,uy=e=>{switch(e){case iy.b.hostName:return"node.host.name";case iy.b.lastSeen:return"node.lastSeen"}},dy=i.a.memo(ly);dy.displayName="HostsTable";const py=Object(ft.a)(dy),my=({deleteQuery:e,endDate:t,filterQuery:a,indexNames:r,skip:s,setQuery:o,startDate:l,type:c})=>{const{toggleStatus:u}=Object(Wn.a)(Yf),[d,p]=Object(n.useState)(s||!u);Object(n.useEffect)((()=>{p(s||!u)}),[s,u]);const[m,{hosts:b,totalCount:g,pageInfo:f,loadPage:y,id:h,inspect:v,isInspected:E,refetch:S}]=(({endDate:e,filterQuery:t,indexNames:a,skip:i=!1,startDate:r,type:s})=>{const o=Object(n.useMemo)((()=>Nb.d.hostsSelector()),[]),{activePage:l,direction:c,limit:u,sortField:d}=Object(j.a)((e=>o(e,s))),p=Object(K.a)("riskScoringRoutesEnabled"),[m,b]=Object(n.useState)(null),g=Object(n.useCallback)((e=>{b((t=>t?{...t,pagination:xo(e,u)}:t))}),[u]),{loading:f,result:y,search:h,refetch:v,inspect:E}=Object(ho.a)({factoryQueryType:Vo.j.hosts,initialResult:{edges:[],totalCount:-1,pageInfo:{activePage:0,fakeTotalCount:0,showMorePagesIndicator:!1}},errorMessage:Kf,abort:i}),x=Object(n.useMemo)((()=>({endDate:e,hosts:y.edges,id:Yf,inspect:E,isInspected:!1,loadPage:g,pageInfo:y.pageInfo,refetch:v,startDate:r,totalCount:y.totalCount})),[e,E,v,y.edges,y.pageInfo,y.totalCount,r,g]);return Object(n.useEffect)((()=>{b((n=>{const i={...null!=n?n:{},defaultIndex:a,factoryQueryType:Vo.j.hosts,filterQuery:Object(ul.a)(t),pagination:xo(l,u),timerange:{interval:"12h",from:r,to:e},sort:{direction:c,field:d},isNewRiskScoreModuleAvailable:p};return Ds()(n,i)?n:i}))}),[l,c,e,t,a,u,r,d,p]),Object(n.useEffect)((()=>{!i&&m&&h(m)}),[m,h,i]),[f,x]})({endDate:t,filterQuery:a,indexNames:r,skip:d,startDate:l,type:c});return i.a.createElement(py,{deleteQuery:e,data:b,fakeTotalCount:Object(x.getOr)(50,"fakeTotalCount",f),id:h,inspect:v,isInspect:E,loading:m,loadPage:y,refetch:S,setQuery:o,setQuerySkip:p,showMorePagesIndicator:Object(x.getOr)(!1,"showMorePagesIndicator",f),totalCount:g,type:c})};my.displayName="HostsQueryTabBody";const by=$.i18n.translate("xpack.securitySolution.uncommonProcesses.failSearchDescription",{defaultMessage:"Failed to run search on uncommon processes"}),gy="hostsUncommonProcessesQuery",fy=$.i18n.translate("xpack.securitySolution.authenticationsTable.uncommonProcessTable",{defaultMessage:"Uncommon processes"}),yy=e=>$.i18n.translate("xpack.securitySolution.uncommonProcessTable.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {process} other {processes}}"}),hy=$.i18n.translate("xpack.securitySolution.uncommonProcessTable.hostsTitle",{defaultMessage:"Host names"}),vy=$.i18n.translate("xpack.securitySolution.uncommonProcessTable.numberOfHostsTitle",{defaultMessage:"Hosts"}),Ey=$.i18n.translate("xpack.securitySolution.uncommonProcessTable.numberOfInstances",{defaultMessage:"Instances"}),xy=$.i18n.translate("xpack.securitySolution.uncommonProcessTable.lastCommandTitle",{defaultMessage:"Last command"}),jy=$.i18n.translate("xpack.securitySolution.uncommonProcessTable.lastUserTitle",{defaultMessage:"Last user"}),Sy=$.i18n.translate("xpack.securitySolution.uncommonProcessTable.nameTitle",{defaultMessage:"Process name"}),ky=$.i18n.translate("xpack.securitySolution.uncommonProcessTable.rows",{values:{numRows:5},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),Oy=$.i18n.translate("xpack.securitySolution.uncommonProcessTable.rows",{values:{numRows:10},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),wy=Nb.b.HostsTableType.uncommonProcesses,Ty=[{text:ky,numberOfRow:5},{text:Oy,numberOfRow:10}],Iy=i.a.memo((({data:e,fakeTotalCount:t,id:a,isInspect:r,loading:s,loadPage:l,totalCount:c,setQuerySkip:u,showMorePagesIndicator:d,type:p})=>{const m=Object(o.useDispatch)(),b=Object(n.useMemo)((()=>Nb.d.uncommonProcessesSelector()),[]),{activePage:g,limit:f}=Object(j.a)((e=>b(e,p))),y=Object(n.useCallback)((e=>m(Nb.a.updateTableLimit({hostsType:p,limit:e,tableType:wy}))),[p,m]),h=Object(n.useCallback)((e=>m(Nb.a.updateTableActivePage({activePage:e,hostsType:p,tableType:wy}))),[p,m]),v=Object(n.useMemo)((()=>My(p)),[p]);return i.a.createElement(Ys,{activePage:g,columns:v,dataTestSubj:`table-${wy}`,headerCount:c,headerTitle:fy,headerUnit:yy(c),id:a,isInspect:r,itemsPerRow:Ty,limit:f,loading:s,loadPage:l,pageOfItems:e,setQuerySkip:u,showMorePagesIndicator:d,totalCount:t,updateLimitPagination:y,updateActivePage:h})}));Iy.displayName="UncommonProcessTableComponent";const Cy=i.a.memo(Iy);Cy.displayName="UncommonProcessTable";const My=e=>{const t=[{name:Sy,truncateText:!1,mobileOptions:{show:!0},width:"20%",render:({node:e})=>Object(eo.b)({values:e.process.name,fieldName:"process.name",idPrefix:`uncommon-process-table-${e._id}-processName`})},{align:"right",name:vy,truncateText:!1,mobileOptions:{show:!0},render:({node:e})=>i.a.createElement(i.a.Fragment,null,null!=e.hosts?e.hosts.length:Object(Bs.e)()),width:"8%"},{align:"right",name:Ey,truncateText:!1,mobileOptions:{show:!0},render:({node:e})=>Object(Bs.a)(e.instances),width:"8%"},{name:hy,truncateText:!1,mobileOptions:{show:!0},width:"25%",render:({node:e})=>{return Object(eo.b)({values:(t=e.hosts,null!=t?t.filter((e=>null!=e.name&&null!=e.name[0])).map((e=>null!=e.name&&null!=e.name[0]?e.name[0]:"")):[]),fieldName:"host.name",idPrefix:`uncommon-process-table-${e._id}-processHost`,render:e=>i.a.createElement(ge.d,{hostName:e})});var t}},{name:xy,truncateText:!1,mobileOptions:{show:!0},width:"25%",render:({node:e})=>Object(eo.b)({values:null!=e.process?e.process.args:null,fieldName:"process.args",idPrefix:`uncommon-process-table-${e._id}-processArgs`,render:e=>i.a.createElement(ge.d,{hostName:e}),displayCount:1})},{name:jy,truncateText:!1,mobileOptions:{show:!0},render:({node:e})=>Object(eo.b)({values:null!=e.user?e.user.name:null,fieldName:"user.name",idPrefix:`uncommon-process-table-${e._id}-processUser`})}];return e===Rf.HostsType.details?[hy,vy].reduce(((e,t)=>(e.splice(e.findIndex((e=>e.name===t)),1),e)),t):t},_y=Object(ft.a)(Cy),Fy=({deleteQuery:e,endDate:t,filterQuery:a,indexNames:r,skip:s,setQuery:o,startDate:l,type:c})=>{const{toggleStatus:u}=Object(Wn.a)(gy),[d,p]=Object(n.useState)(s||!u);Object(n.useEffect)((()=>{p(s||!u)}),[s,u]);const[m,{uncommonProcesses:b,totalCount:g,pageInfo:f,loadPage:y,id:h,inspect:v,isInspected:E,refetch:S}]=(({endDate:e,filterQuery:t,indexNames:a,skip:i=!1,startDate:r,type:s})=>{const o=Object(n.useMemo)((()=>Nb.d.uncommonProcessesSelector()),[]),{activePage:l,limit:c}=Object(j.a)((e=>o(e,s))),[u,d]=Object(n.useState)(null),p=Object(n.useCallback)((e=>{d((t=>t?{...t,pagination:xo(e,c)}:t))}),[c]),{loading:m,result:b,search:g,refetch:f,inspect:y}=Object(ho.a)({factoryQueryType:Vo.j.uncommonProcesses,initialResult:{edges:[],totalCount:-1,pageInfo:{activePage:0,fakeTotalCount:0,showMorePagesIndicator:!1}},errorMessage:by,abort:i}),h=Object(n.useMemo)((()=>({id:gy,inspect:y,isInspected:!1,loadPage:p,pageInfo:b.pageInfo,refetch:f,totalCount:b.totalCount,uncommonProcesses:b.edges})),[y,f,b.edges,b.pageInfo,b.totalCount,p]);return Object(n.useEffect)((()=>{d((n=>{const i={...null!=n?n:{},defaultIndex:a,factoryQueryType:Vo.j.uncommonProcesses,filterQuery:Object(ul.a)(t),pagination:xo(l,c),timerange:{interval:"12h",from:r,to:e},sort:{}};return Ds()(n,i)?n:i}))}),[l,a,e,t,c,r]),Object(n.useEffect)((()=>{!i&&u&&g(u)}),[g,i,u]),[m,h]})({endDate:t,filterQuery:a,indexNames:r,skip:d,startDate:l,type:c});return i.a.createElement(_y,{deleteQuery:e,data:b,fakeTotalCount:Object(x.getOr)(50,"fakeTotalCount",f),id:h,inspect:v,isInspect:E,loading:m,loadPage:y,refetch:S,setQuery:o,setQuerySkip:p,showMorePagesIndicator:Object(x.getOr)(!1,"showMorePagesIndicator",f),totalCount:g,type:c})};Fy.dispalyName="UncommonProcessQueryTabBody";const Ay=[{text:Jf.i,numberOfRow:5},{text:Jf.h,numberOfRow:10}],Dy=Nb.b.HostsTableType.risk,Ny=({data:e,id:t,isInspect:a,loading:r,loadPage:s,setQuerySkip:l,severityCount:c,totalCount:u,type:d})=>{const p=Object(o.useDispatch)(),m=Object(n.useMemo)((()=>Nb.d.hostRiskScoreSelector()),[]),{activePage:b,limit:g,sort:f}=Object(j.a)((e=>m(e,Nb.b.HostsType.page))),y=Object(n.useCallback)((e=>p(Nb.a.updateTableLimit({hostsType:d,limit:e,tableType:Dy}))),[d,p]),h=Object(n.useCallback)((e=>p(Nb.a.updateTableActivePage({activePage:e,hostsType:d,tableType:Dy}))),[d,p]),v=Object(n.useCallback)((e=>{if(null!=e.sort){const t=e.sort;t.direction===f.direction&&t.field===f.field||p(Nb.a.updateHostRiskScoreSort({sort:t,hostsType:d}))}}),[p,f,d]),E=Object(n.useCallback)((e=>{p(Nb.a.updateHostRiskScoreSeverityFilter({severitySelection:[e],hostsType:d}))}),[p,d]),x=Object(n.useMemo)((()=>(({dispatchSeverityUpdate:e})=>[{field:"host.name",name:Xf,truncateText:!1,mobileOptions:{show:!0},sortable:!0,render:e=>null!=e&&e.length>0?i.a.createElement(Dn.c,{mode:Dn.a.HOVER_DOWN,visibleCellActions:5,showActionTooltips:!0,triggerId:Dn.d.DEFAULT,data:{value:e,field:"host.name"},metadata:{telemetry:Jc}},i.a.createElement(ge.d,{hostName:e,hostTab:Rf.HostsTableType.risk})):Object(Bs.d)()},{field:Vo.x.hostRiskScore,name:Zf,truncateText:!0,mobileOptions:{show:!0},sortable:!0,render:e=>null!=e?i.a.createElement("span",{"data-test-subj":"risk-score-truncate",title:`${e}`},Math.round(e)):Object(Bs.d)()},{field:Vo.x.hostRisk,name:i.a.createElement(U.EuiToolTip,{content:ey},i.a.createElement(i.a.Fragment,null,Object(Eu.b)(Vo.w.host)," ",i.a.createElement(U.EuiIcon,{color:"subdued",type:"iInCircle",className:"eui-alignTop"}))),truncateText:!1,mobileOptions:{show:!0},sortable:!0,render:t=>null!=t?i.a.createElement(no.b,{toolTipContent:i.a.createElement(U.EuiLink,{onClick:()=>e(t)},i.a.createElement(U.EuiText,{size:"xs"},ny(t.toLowerCase()))),severity:t}):Object(Bs.d)()}])({dispatchSeverityUpdate:E})),[E]),S=i.a.createElement(U.EuiFlexGroup,{direction:"column",gutterSize:"s"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(Iu,{severityCount:c})),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(_u,{severityCount:c}))),k=Object(n.useMemo)((()=>Nb.d.hostRiskScoreSeverityFilterSelector()),[]),O=Object(j.a)((e=>k(e,d))),w=Object(n.useCallback)((e=>{p(Nb.a.updateHostRiskScoreSeverityFilter({severitySelection:e,hostsType:d}))}),[p,d]);return i.a.createElement(Ys,{activePage:b,columns:x,dataTestSubj:`table-${Dy}`,headerCount:u,headerFilters:i.a.createElement(Fu,{selectedSeverities:O,severityCount:c,onSelect:w,riskEntity:Vo.w.host}),headerSupplement:S,headerTitle:ty,headerUnit:Jf.j(u),headerTooltip:ay,id:t,isInspect:a,itemsPerRow:Ay,limit:g,loading:r,loadPage:s,onChange:v,pageOfItems:e,setQuerySkip:l,showMorePagesIndicator:!1,sorting:f,split:!0,stackHeader:!0,totalCount:u,updateLimitPagination:y,updateActivePage:h})};Ny.displayName="HostRiskScoreTableComponent";const Py=i.a.memo(Ny);Py.displayName="HostRiskScoreTable";const Ry=Object(ft.a)(Py),Ly=({deleteQuery:e,endDate:t,filterQuery:a,setQuery:r,skip:s,startDate:o,type:l})=>{const c=Object(n.useMemo)((()=>Nb.d.hostRiskScoreSelector()),[]),{activePage:u,limit:d,sort:p}=Object(j.a)((e=>c(e,Nb.b.HostsType.page))),m=Object(n.useMemo)((()=>Nb.d.hostRiskScoreSeverityFilterSelector()),[]),b=Object(j.a)((e=>m(e,Nb.b.HostsType.page))),{data:g}=Ku(),f=Object(n.useMemo)((()=>({cursorStart:u*d,querySize:d})),[u,d]),{toggleStatus:y}=Object(Wn.a)(Lu.a.HOSTS_BY_RISK),[h,v]=Object(n.useState)(s||!y);Object(n.useEffect)((()=>{v(!y)}),[y]);const E=Object(n.useMemo)((()=>({from:o,to:t})),[o,t]),{data:S,inspect:k,isDeprecated:O,isInspected:w,isModuleEnabled:T,loading:I,refetch:C,isAuthorized:M,totalCount:_}=Object(Lu.c)({filterQuery:a,pagination:f,riskEntity:Vo.w.host,skip:h,sort:p,timerange:E}),{severityCount:F,loading:A}=Object(Lu.d)({filterQuery:a,skip:h,riskEntity:Vo.w.host}),D={isDisabled:!T&&!I,isDeprecated:O&&!I};return M?null!=g&&g.isUpdateAvailable?i.a.createElement(_d,null):D.isDisabled||D.isDeprecated?i.a.createElement(U.EuiPanel,{hasBorder:!0},i.a.createElement(wu,Ni()({},D,{entityType:Vo.w.host,refetch:C,timerange:E}))):!I&&T&&0===b.length&&S&&0===S.length?i.a.createElement(Uu,{entityType:Vo.w.host,refetch:C}):i.a.createElement(Ry,{deleteQuery:e,data:null!=S?S:[],id:Lu.a.HOSTS_BY_RISK,inspect:k,isInspect:w,loading:I||A,loadPage:x.noop,refetch:C,setQuery:r,setQuerySkip:v,severityCount:null!=F?F:Vo.c,totalCount:_,type:l}):i.a.createElement(i.a.Fragment,null,"TODO: Add RiskScore Upsell")};Ly.displayName="HostRiskScoreQueryTabBody";var By=a(95),qy=a(190);const zy=$.i18n.translate("xpack.securitySolution.sessionsView.sessionsTitle",{defaultMessage:"Sessions"}),$y=$.i18n.translate("xpack.securitySolution.sessionsView.totalCountOfSessions",{defaultMessage:"sessions"}),Vy=$.i18n.translate("xpack.securitySolution.sessionsView.singleCountOfSessions",{defaultMessage:"session"}),Uy=$.i18n.translate("xpack.securitySolution.sessionsView.columnSessionStart",{defaultMessage:"Started"}),Hy=$.i18n.translate("xpack.securitySolution.sessionsView.columnExecutable",{defaultMessage:"Executable"}),Gy=$.i18n.translate("xpack.securitySolution.sessionsView.columnEntryUserID",{defaultMessage:"User ID"}),Qy=$.i18n.translate("xpack.securitySolution.sessionsView.columnInteractive",{defaultMessage:"Interactive"}),Wy=$.i18n.translate("xpack.securitySolution.sessionsView.columnHostName",{defaultMessage:"Hostname"}),Ky=$.i18n.translate("xpack.securitySolution.sessionsView.columnEntryType",{defaultMessage:"Type"}),Yy=$.i18n.translate("xpack.securitySolution.sessionsView.columnEntrySourceIp",{defaultMessage:"Source IP"}),Jy=[{columnHeaderType:qy.a,id:"process.entry_leader.start",initialWidth:gp.b,display:Uy},{columnHeaderType:qy.a,id:"process.entry_leader.executable",display:Hy},{columnHeaderType:qy.a,id:"process.entry_leader.user.id",display:Gy},{columnHeaderType:qy.a,id:"process.entry_leader.interactive",display:Qy},{columnHeaderType:qy.a,id:"host.hostname",display:Wy},{columnHeaderType:qy.a,id:"process.entry_leader.entry_meta.type",display:Ky},{id:"process.entry_leader.entry_meta.source.ip",columnHeaderType:qy.a,display:Yy}],Xy=(e,t)=>({...R.q,columns:e,defaultColumns:t,sort:[{columnId:"process.entry_leader.start",columnType:"date",sortDirection:"desc"}]}),Zy={query:{bool:{filter:[{bool:{should:[{term:{[at.ob]:"exec"}},{term:{[at.ob]:"fork"}},{term:{[at.ob]:"end"}}]}},{bool:{filter:{exists:{field:By.ENTRY_SESSION_ENTITY_ID_PROPERTY}}}}]}},meta:{alias:null,disabled:!1,key:By.ENTRY_SESSION_ENTITY_ID_PROPERTY,negate:!1,params:{},type:"string"}},eh=({tableId:e,endDate:t,entityType:a="sessions",pageFilters:r,startDate:s,filterQuery:l,columns:c=Jy,defaultColumns:u=Jy})=>{const d=Object(o.useDispatch)(),p=Object(K.a)("tGridEnabled"),m=Object(n.useMemo)((()=>l&&""!==l?JSON.parse(l):{}),[l]),b=Object(n.useMemo)((()=>[{...Zy,query:{...Zy.query,bool:{...Zy.query.bool,filter:Zy.query.bool.filter.concat(m)}}},...r]),[r,m]);Object(n.useEffect)((()=>{d(R.h.initializeDataTableSettings({id:e,title:zy,defaultColumns:cp.a.columns.map((e=>p||null!=e.initialWidth?e:{...e,initialWidth:gp.a})),showCheckboxes:!0,selectAll:!0}))}),[d,p,e]);const g=Object(fp.b)().isEnterprise()||e===R.e.kubernetesPageSessions?5:4,y=Object(n.useMemo)((()=>Object(pp.a)(g)),[g]),h=Object(hp.a)({localFilters:b,tableId:e,from:s,to:t,scopeId:f.SourcererScopeName.default}),v=Object(n.useMemo)((()=>({alertStatusActions:!1,customBulkActions:[h]})),[h]);return i.a.createElement("div",{"data-test-subj":"security_solution:sessions_viewer:sessions_view"},i.a.createElement(lp,{cellActionsTriggerId:Dn.d.DEFAULT,pageFilters:b,defaultModel:Xy(c,u),end:t,bulkActions:v,entityType:a,tableId:e,leadingControlColumns:y,renderCellValue:bp.a,rowRenderers:mp.b,sourcererScope:f.SourcererScopeName.default,start:s,unit:e=>e>1?$y:Vy}))};eh.displayName="SessionsViewComponent";const th=i.a.memo(eh),ah=i.a.memo((e=>{const{pageFilters:t,filterQuery:a,...r}=e,s=Object(n.useMemo)((()=>{const e=Object(qp.b)(S.a.hosts);return null!=t?[...e,...t]:e}),[t]);return Object(fp.b)().isEnterprise()?i.a.createElement(th,Ni()({entityType:"sessions",tableId:R.e.hostsPageSessions},r,{pageFilters:s,filterQuery:a})):null}));ah.displayName="SessionsTabBody";const nh=i.a.memo((({detailName:e,filterQuery:t,indexNames:a,indexPattern:n,hostDetailsPagePath:r,hostDetailsFilter:s})=>{const{from:o,to:l,isInitializing:c,deleteQuery:u,setQuery:d}=Object(J.a)(),p={deleteQuery:u,endDate:l,filterQuery:t,skip:c||void 0===t,setQuery:d,startDate:o,type:Rf.HostsType.details,indexPattern:n,indexNames:a,hostName:e};return i.a.createElement(q.c,null,i.a.createElement(q.a,{path:`${r}/:tabName(${Rf.HostsTableType.authentications})`},i.a.createElement(Wf,p)),i.a.createElement(q.a,{path:`${r}/:tabName(${Rf.HostsTableType.uncommonProcesses})`},i.a.createElement(Fy,p)),i.a.createElement(q.a,{path:`${r}/:tabName(${Rf.HostsTableType.anomalies})`},i.a.createElement(_l,Ni()({},p,{AnomaliesTableComponent:$f}))),i.a.createElement(q.a,{path:`${r}/:tabName(${Rf.HostsTableType.events})`},i.a.createElement(Sp,Ni()({additionalFilters:s,tableId:R.e.hostsPageEvents},p))),i.a.createElement(q.a,{path:`${r}/:tabName(${Rf.HostsTableType.risk})`},i.a.createElement(hf,Ni()({},p,{riskEntity:Vo.w.host,entityName:p.hostName}))),i.a.createElement(q.a,{path:`${r}/:tabName(${Rf.HostsTableType.sessions})`},i.a.createElement(ah,p)))}));nh.displayName="HostDetailsTabs";var ih=a(1424);const rh=(e,t)=>`${s.zb}/name/${e}/${t}`,sh=({hasMlUserPermissions:e,isRiskyHostsEnabled:t,hostName:a,isEnterprise:n})=>{const i=[],r={[Rf.HostsTableType.authentications]:{id:Rf.HostsTableType.authentications,name:ih.c,href:rh(a,Rf.HostsTableType.authentications),disabled:!1},[Rf.HostsTableType.uncommonProcesses]:{id:Rf.HostsTableType.uncommonProcesses,name:ih.g,href:rh(a,Rf.HostsTableType.uncommonProcesses),disabled:!1},[Rf.HostsTableType.anomalies]:{id:Rf.HostsTableType.anomalies,name:ih.b,href:rh(a,Rf.HostsTableType.anomalies),disabled:!1},[Rf.HostsTableType.events]:{id:Rf.HostsTableType.events,name:ih.d,href:rh(a,Rf.HostsTableType.events),disabled:!1},[Rf.HostsTableType.risk]:{id:Rf.HostsTableType.risk,name:ih.e,href:rh(a,Rf.HostsTableType.risk),disabled:!1},[Rf.HostsTableType.sessions]:{id:Rf.HostsTableType.sessions,name:ih.f,href:rh(a,Rf.HostsTableType.sessions),disabled:!1,isBeta:!1}};return e||i.push(Rf.HostsTableType.anomalies),t||i.push(Rf.HostsTableType.risk),n||i.push(Rf.HostsTableType.sessions),Object(x.omit)(i,r)};var oh=a(663),lh=a(1132),ch=a(126);const uh=Object(n.memo)((({endpointId:e,onClick:t})=>{const{handleResponseActionsClick:a,isDisabled:n,tooltip:r}=Object(lh.a)({endpointId:e,onClick:t});if(!Object(ch.a)().endpointPrivileges.canAccessResponseConsole)return null;const s="endpointResponseActions-action-button";return i.a.createElement(U.EuiToolTip,{position:"top",content:r},i.a.createElement(U.EuiButton,{fill:!0,key:s,"data-test-subj":s,disabled:n,onClick:a},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.detections.takeAction.responseActionConsole.buttonLabel",defaultMessage:"Respond"})))}));uh.displayName="ResponderActionButton";const dh=Object(ft.a)(Nf.a),ph=({detailName:e,hostDetailsPagePath:t})=>{var a,r,s,l;const c=Object(o.useDispatch)(),u=Object(n.useMemo)((()=>R.j.getTableByIdSelector()),[]),d=Object(j.b)((e=>{var t;return(null!==(t=u(e,R.e.hostsPageEvents))&&void 0!==t?t:R.q).graphEventId})),p=Object(n.useMemo)((()=>Vr.d.globalFiltersQuerySelector()),[]),b=Object(n.useMemo)((()=>Vr.d.globalQuerySelector()),[]),f=Object(j.a)(b),y=Object(j.a)(p),{to:v,from:k,deleteQuery:O,setQuery:w,isInitializing:T}=Object(J.a)(),{globalFullScreen:I}=Object(fe.a)(),{signalIndexName:C}=Object(fb.a)(),M=Object(io.a)(),{services:{uiSettings:_}}=Object(m.j)(),F=Object(n.useMemo)((()=>{return[{meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:"host.name",value:t=e,params:{query:t}},query:{match:{"host.name":{query:t,type:"phrase"}}}}];var t}),[e]),A=Object(fp.b)().isEnterprise(),D=Object(n.useCallback)(((e,t)=>{const a=Object(Cf.a)(e,t);c(Object(ae.setAbsoluteRangeDatePicker)({id:Y.a.global,from:a.from,to:a.to}))}),[c]),{indexPattern:N,indicesExist:P,selectedPatterns:L}=Object(g.d)(),[B,{inspect:q,hostDetails:z,id:$,refetch:V}]=Object(oh.b)({endDate:v,startDate:k,hostName:e,indexNames:L,skip:0===L.length}),[H,G]=Object(n.useMemo)((()=>{try{return[Object(bt.buildEsQuery)(N,[f],[...F,...y],Object(Ms.getEsQueryConfig)(_))]}catch(e){return[void 0,e]}}),[y,N,f,_,F]),Q=JSON.stringify(H);Object(Cp.a)({id:oh.a,filterQuery:Q,kqlError:G,query:f,startDate:k,endDate:v}),Object(n.useEffect)((()=>{c(Object(Pf.setHostDetailsTablesActivePageToZero)())}),[c,e]);const W=Object(io.a)().isPlatinumOrTrialLicense,{hasKibanaREAD:K,hasIndexRead:Z}=Object(Rr.a)(),te=K&&Z,ne=Object(n.useMemo)((()=>({field:"host.name",value:e})),[e]);return i.a.createElement(i.a.Fragment,null,P?i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiWindowEvent,{event:"resize",handler:x.noop}),i.a.createElement(X.a,{show:Object(he.n)({globalFullScreen:I,graphEventId:d})},i.a.createElement(ee.a,{indexPattern:N,id:Y.a.global})),i.a.createElement(h.a,{noPadding:I,"data-test-subj":"hostDetailsPage"},i.a.createElement(ye.a,{show:!I},i.a.createElement(Ci.a,{border:!0,subtitle:i.a.createElement(zs,{indexKey:Vo.k.hostDetails,hostName:e,indexNames:L}),title:e,rightSideItems:[(null===(a=z.endpoint)||void 0===a||null===(r=a.hostInfo)||void 0===r?void 0:r.metadata.elastic.agent.id)&&i.a.createElement(uh,{endpointId:null===(s=z.endpoint)||void 0===s||null===(l=s.hostInfo)||void 0===l?void 0:l.metadata.elastic.agent.id})]}),i.a.createElement(wf.a,{criteriaFields:Object(Df.a)(z),startDate:k,endDate:v,skip:T},(({isLoadingAnomaliesData:t,anomaliesData:a,jobNameById:n})=>i.a.createElement(dh,{id:$,isInDetailsSidePanel:!1,data:z,anomaliesData:a,isLoadingAnomaliesData:t,loading:B,startDate:k,endDate:v,narrowDateRange:D,setQuery:w,refetch:V,inspect:q,hostName:e,indexNames:L,jobNameById:n}))),i.a.createElement(U.EuiHorizontalRule,null),i.a.createElement(U.EuiSpacer,null),te&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiFlexGroup,null,i.a.createElement(U.EuiFlexItem,null,i.a.createElement(gb,{signalIndexName:C,entityFilter:ne,additionalFilters:H?[H]:[]})),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(Fb,{entityFilter:ne,signalIndexName:C,additionalFilters:H?[H]:[]}))),i.a.createElement(U.EuiSpacer,null)),i.a.createElement(_s.a,{navTabs:sh({hasMlUserPermissions:Object(Al.a)(M),isRiskyHostsEnabled:W,hostName:e,isEnterprise:A})}),i.a.createElement(U.EuiSpacer,null)),i.a.createElement(nh,{indexNames:L,isInitializing:T,deleteQuery:O,hostDetailsFilter:F,to:v,from:k,detailName:e,type:Rf.HostsType.details,setQuery:w,filterQuery:Q,hostDetailsPagePath:t,indexPattern:N}))):i.a.createElement(Mi.a,null),i.a.createElement(E.a,{pageName:S.a.hosts}))};ph.displayName="HostDetailsComponent";const mh=i.a.memo(ph);var bh=a(478);const gh=e=>{try{return Object(zr.decode)(e)}catch(e){return null}},fh=e=>Object(x.isObject)(e),yh=e=>Object(x.isString)(e),hh=(e,t)=>t.reduce(((t,a,n)=>{const i=((e,t)=>1===e.length?`${e[0]}: "${t}"`:e.reduce(((e,a,n,i)=>0===n?`(${a}: "${t}"`:n===i.length-1?`${e} or ${a}: "${t}")`:`${e} or ${a}: "${t}"`),""))(e,a);return 0===n?i:`${t} or ${i}`}),""),vh=(e,t,a)=>{const n=gh(a);if(fh(n)){const a=n;if(fh(a)&&yh(a.query)){const i=hh(e,t);return""!==a.query&&""!==i?a.query=`(${i}) and (${a.query})`:""===a.query&&""!==i&&(a.query=`(${i})`),Object(zr.encode)(n)}}else if(null==n){const a=hh(e,t);return Object(zr.encode)({query:`(${a})`,language:"kuery"})}return a},Eh=(e,t,a)=>`(${a.split(",").reduce(((e,a,n)=>0===n?`${t}: "${a}"`:`${e} or ${t}: "${a}"`),"")})`,xh=e=>{const t=gh(e);if(fh(t)){const e=t;if(fh(e)&&yh(e.query))return e.query=e.query.replace(/([\w\.\-\[\]]+)\s*:\s*"(([\w\.\-\(\)\[\]]+,[\w\.\-\(\)\[\]]+){1,})"/g,Eh),Object(zr.encode)(t)}return e},jh=["and","or","not"],Sh=(e,...t)=>{if(null==t)return"";const a=t.reduce(((e,t)=>null!=t&&jh.includes(t)?[...e,t]:e),[]);return a.length>1?` ${a[a.length-1].trim()} `:""},kh=e=>{const t=gh(e);if(fh(t)){const e=t;if(fh(e)&&yh(e.query))return e.query=e.query.replace(/(\s+)*(and|or|not){0,1}(\s+)*([\w\.\-\[\]]+)\s*:\s*"(\$[\w\.\-\(\)\[\]]+\$)"(\s+)*(and|or|not){0,1}(\s+)*/g,Sh),Object(zr.encode)(t)}return e},Oh=e=>Object(x.flow)(xh,kh)(e),wh=e=>""===e.trim()||e.startsWith("$")&&e.endsWith("$"),Th=e=>e.split(",").length>1,Ih=e=>e.split(","),Ch=i.a.memo((()=>{const{path:e}=Object(B.useRouteMatch)();return i.a.createElement(q.c,null,i.a.createElement(q.a,{strict:!0,exact:!0,path:e,render:({location:e})=>{const t=Object(bh.parse)(e.search.substring(1),{sort:!1});null!=t.query&&(t.query=Oh(t.query));const a=Object(bh.stringify)(ir.url.encodeQuery(t),{sort:!1,encode:!1});return i.a.createElement(B.Redirect,{to:`${s.zb}?${a}`})}}),i.a.createElement(q.a,{path:`${e}/:hostName`,render:({location:e,match:{params:{hostName:t}}})=>{const a=Object(bh.parse)(e.search.substring(1),{sort:!1});if(null!=a.query&&(a.query=Oh(a.query)),wh(t)){const e=Object(bh.stringify)(ir.url.encodeQuery(a),{sort:!1,encode:!1});return i.a.createElement(B.Redirect,{to:`${s.zb}/${Rf.HostsTableType.anomalies}?${e}`})}if(Th(t)){const e=Ih(t);a.query=vh(["host.name"],e,a.query||"");const n=Object(bh.stringify)(ir.url.encodeQuery(a),{sort:!1,encode:!1});return i.a.createElement(B.Redirect,{to:`${s.zb}/${Rf.HostsTableType.anomalies}?${n}`})}{const e=Object(bh.stringify)(ir.url.encodeQuery(a),{sort:!1,encode:!1});return i.a.createElement(B.Redirect,{to:`${s.zb}/name/${t}/${Rf.HostsTableType.anomalies}?${e}`})}}}),i.a.createElement(q.a,{path:`${s.zb}/ml-hosts/`,render:({location:{search:e=""}})=>i.a.createElement(B.Redirect,{from:`${s.zb}/ml-hosts/`,to:`${s.zb}/ml-hosts${e}`})}))}));Ch.displayName="MlHostConditionalContainer";const Mh={description:"",state:{datasourceStates:{formBased:{layers:{"416b6fad-1923-4f6a-a2df-b223bb287e30":{columnOrder:["5eea817b-67b7-4268-8ecb-7688d1094721","b00c65ea-32be-4163-bfc8-f795b1ef9d06"],columns:{"5eea817b-67b7-4268-8ecb-7688d1094721":{dataType:"date",isBucketed:!0,label:"@timestamp",operationType:"date_histogram",params:{interval:"auto"},scale:"interval",sourceField:"@timestamp"},"b00c65ea-32be-4163-bfc8-f795b1ef9d06":{customLabel:!0,dataType:"number",isBucketed:!1,label:Object(ei.p)("host.name"),operationType:"unique_count",scale:"ratio",sourceField:"host.name"}},incompleteColumns:{}}}}},filters:[],query:{language:"kuery",query:""},visualization:{axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!1},fittingFunction:"None",gridlinesVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},labelsOrientation:{x:0,yLeft:0,yRight:0},layers:[{accessors:["b00c65ea-32be-4163-bfc8-f795b1ef9d06"],layerId:"416b6fad-1923-4f6a-a2df-b223bb287e30",layerType:"data",seriesType:"area",xAccessor:"5eea817b-67b7-4268-8ecb-7688d1094721"}],legend:{isVisible:!1,position:"right"},preferredSeriesType:"area",tickLabelsVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},valueLabels:"hide",yLeftExtent:{mode:"full"},yRightExtent:{mode:"full"}}},title:"[Host] Hosts - area",visualizationType:"lnsXY",references:[{id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern",type:"index-pattern"},{id:"{dataViewId}",name:"indexpattern-datasource-layer-416b6fad-1923-4f6a-a2df-b223bb287e30",type:"index-pattern"}]},_h=$.i18n.translate("xpack.securitySolution.hostsKpiHosts.errorSearchDescription",{defaultMessage:"An error has occurred on hosts kpi hosts search"}),Fh=$.i18n.translate("xpack.securitySolution.hostsKpiHosts.failSearchDescription",{defaultMessage:"Failed to run search on hosts kpi hosts"}),Ah="hostsKpiHostsQuery";let Dh;!function(e){e.uniqueSourceIps="#D36086",e.uniqueDestinationIps="#9170B8",e.hosts="#6092C0"}(Dh||(Dh={}));const Nh=$.i18n.translate("xpack.securitySolution.kpiHosts.hosts.title",{defaultMessage:"Hosts"}),Ph=[{key:"hosts",fields:[{key:"hosts",value:null,color:Dh.hosts,icon:"storage",lensAttributes:{description:"",state:{datasourceStates:{formBased:{layers:{"416b6fad-1923-4f6a-a2df-b223bb287e30":{columnOrder:["b00c65ea-32be-4163-bfc8-f795b1ef9d06"],columns:{"b00c65ea-32be-4163-bfc8-f795b1ef9d06":{customLabel:!0,dataType:"number",isBucketed:!1,label:" ",operationType:"unique_count",scale:"ratio",sourceField:"host.name"}},incompleteColumns:{}}}}},filters:[],query:{language:"kuery",query:""},visualization:{accessor:"b00c65ea-32be-4163-bfc8-f795b1ef9d06",layerId:"416b6fad-1923-4f6a-a2df-b223bb287e30",layerType:"data"}},title:"[Host] Hosts - metric",visualizationType:"lnsLegacyMetric",references:[{id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern",type:"index-pattern"},{id:"{dataViewId}",name:"indexpattern-datasource-layer-416b6fad-1923-4f6a-a2df-b223bb287e30",type:"index-pattern"}]}}],enableAreaChart:!0,description:Nh,areaChartLensAttributes:Mh}],Rh=({filterQuery:e,from:t,indexNames:a,to:r,updateDateRange:s,setQuery:o,skip:l})=>{const{toggleStatus:c}=Object(Wn.a)(Ah),[u,d]=Object(n.useState)(l||!c),p=Object(K.a)("chartEmbeddablesEnabled");Object(n.useEffect)((()=>{d(l||!c)}),[l,c]);const[b,{refetch:g,id:f,inspect:y,...h}]=(({filterQuery:e,endDate:t,indexNames:a,skip:i=!1,startDate:r})=>{const{data:s}=Object(m.j)().services,o=Object(n.useRef)(x.noop),l=Object(n.useRef)(new AbortController),c=Object(n.useRef)(new Ns.Subscription),[u,d]=Object(n.useState)(!1),[p,b]=Object(n.useState)(null),[g,f]=Object(n.useState)({hosts:0,hostsHistogram:[],id:Ah,inspect:{dsl:[],response:[]},isInspected:!1,refetch:o.current}),{addError:y,addWarning:h}=Object(rs.a)(),v=Object(n.useCallback)((e=>{if(null==e||i)return;const t=async()=>{l.current=new AbortController,d(!0),c.current=s.search.search(e,{strategy:"securitySolutionSearchStrategy",abortSignal:l.current.signal}).subscribe({next:e=>{e.isPartial||e.isRunning?e.isPartial&&!e.isRunning&&(d(!1),h(_h),c.current.unsubscribe()):(d(!1),f((t=>({...t,hosts:e.hosts,hostsHistogram:e.hostsHistogram,inspect:Object(Dp.getInspectResponse)(e,t.inspect),refetch:o.current}))),c.current.unsubscribe())},error:e=>{d(!1),y(e,{title:Fh}),c.current.unsubscribe()}})};c.current.unsubscribe(),l.current.abort(),t(),o.current=t}),[s.search,y,h,i]);return Object(n.useEffect)((()=>{b((n=>{const i={...null!=n?n:{},defaultIndex:a,factoryQueryType:Vo.i.kpiHosts,filterQuery:Object(ul.a)(e),timerange:{interval:"12h",from:r,to:t}};return Ds()(n,i)?n:i}))}),[a,t,e,r]),Object(n.useEffect)((()=>(v(p),()=>{c.current.unsubscribe(),l.current.abort()})),[p,v]),Object(n.useEffect)((()=>{i&&(d(!1),c.current.unsubscribe(),l.current.abort())}),[i]),[u,g]})({filterQuery:e,endDate:r,indexNames:a,startDate:t,skip:u||p}),{session:v,refetchByRestartingSession:E}=Object(Em.a)({inputId:Y.a.global,queryId:f});return i.a.createElement(mm,{data:h,id:f,inspect:y,loading:b,fieldsMapping:Ph,from:t,to:r,updateDateRange:s,refetch:p?E:g,setQuery:o,setQuerySkip:d,session:p?v:void 0})},Lh=i.a.memo(Rh),Bh={description:"",state:{datasourceStates:{formBased:{layers:{"8be0156b-d423-4a39-adf1-f54d4c9f2e69":{columnOrder:["a0cb6400-f708-46c3-ad96-24788f12dae4","d9a6eb6b-8b78-439e-98e7-a718f8ffbebe"],columns:{"a0cb6400-f708-46c3-ad96-24788f12dae4":{dataType:"date",isBucketed:!0,label:"@timestamp",operationType:"date_histogram",params:{interval:"auto"},scale:"interval",sourceField:"@timestamp"},"d9a6eb6b-8b78-439e-98e7-a718f8ffbebe":{customLabel:!0,dataType:"number",isBucketed:!1,label:ei.m,operationType:"unique_count",scale:"ratio",sourceField:"source.ip"}},incompleteColumns:{}},"ca05ecdb-0fa4-49a8-9305-b23d91012a46":{columnOrder:["f95e74e6-99dd-4b11-8faf-439b4d959df9","e7052671-fb9e-481f-8df3-7724c98cfc6f"],columns:{"e7052671-fb9e-481f-8df3-7724c98cfc6f":{customLabel:!0,dataType:"number",isBucketed:!1,label:ei.h,operationType:"unique_count",scale:"ratio",sourceField:"destination.ip"},"f95e74e6-99dd-4b11-8faf-439b4d959df9":{dataType:"date",isBucketed:!0,label:"@timestamp",operationType:"date_histogram",params:{interval:"auto"},scale:"interval",sourceField:"@timestamp"}},incompleteColumns:{}}}}},filters:[],query:{language:"kuery",query:""},visualization:{axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},fittingFunction:"None",gridlinesVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},labelsOrientation:{x:0,yLeft:0,yRight:0},layers:[{accessors:["d9a6eb6b-8b78-439e-98e7-a718f8ffbebe"],layerId:"8be0156b-d423-4a39-adf1-f54d4c9f2e69",layerType:"data",seriesType:"area",xAccessor:"a0cb6400-f708-46c3-ad96-24788f12dae4",yConfig:[{color:"#d36186",forAccessor:"d9a6eb6b-8b78-439e-98e7-a718f8ffbebe"}]},{accessors:["e7052671-fb9e-481f-8df3-7724c98cfc6f"],layerId:"ca05ecdb-0fa4-49a8-9305-b23d91012a46",layerType:"data",seriesType:"area",xAccessor:"f95e74e6-99dd-4b11-8faf-439b4d959df9",yConfig:[{color:"#9170b8",forAccessor:"e7052671-fb9e-481f-8df3-7724c98cfc6f"}]}],legend:{isVisible:!1,position:"right",showSingleSeries:!1},preferredSeriesType:"area",tickLabelsVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},valueLabels:"hide",yLeftExtent:{mode:"full"},yRightExtent:{mode:"full"}}},title:"[Host] Unique IPs - area",visualizationType:"lnsXY",references:[{id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern",type:"index-pattern"},{id:"{dataViewId}",name:"indexpattern-datasource-layer-8be0156b-d423-4a39-adf1-f54d4c9f2e69",type:"index-pattern"},{id:"{dataViewId}",name:"indexpattern-datasource-layer-ca05ecdb-0fa4-49a8-9305-b23d91012a46",type:"index-pattern"}],type:"lens",updated_at:"2022-02-09T17:44:03.359Z",version:"WzI5MTI5OSwzXQ=="},qh={description:"",state:{datasourceStates:{formBased:{layers:{"8be0156b-d423-4a39-adf1-f54d4c9f2e69":{columnOrder:["f8bfa719-5c1c-4bf2-896e-c318d77fc08e","32f66676-f4e1-48fd-b7f8-d4de38318601"],columns:{"32f66676-f4e1-48fd-b7f8-d4de38318601":{dataType:"number",isBucketed:!1,label:Object(ei.p)("source.ip"),operationType:"unique_count",scale:"ratio",sourceField:"source.ip"},"f8bfa719-5c1c-4bf2-896e-c318d77fc08e":{dataType:"string",isBucketed:!0,label:"Filters",operationType:"filters",params:{filters:[{input:{language:"kuery",query:"source.ip: *"},label:ei.m}]},scale:"ordinal"}},incompleteColumns:{}},"ec84ba70-2adb-4647-8ef0-8ad91a0e6d4e":{columnOrder:["c72aad6a-fc9c-43dc-9194-e13ca3ee8aff","b7e59b08-96e6-40d1-84fd-e97b977d1c47"],columns:{"b7e59b08-96e6-40d1-84fd-e97b977d1c47":{dataType:"number",isBucketed:!1,label:Object(ei.p)("destination.ip"),operationType:"unique_count",scale:"ratio",sourceField:"destination.ip"},"c72aad6a-fc9c-43dc-9194-e13ca3ee8aff":{customLabel:!0,dataType:"string",isBucketed:!0,label:ei.h,operationType:"filters",params:{filters:[{input:{language:"kuery",query:"destination.ip: *"},label:"Dest."}]},scale:"ordinal"}},incompleteColumns:{}}}}},filters:[],query:{language:"kuery",query:""},visualization:{axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},fittingFunction:"None",gridlinesVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},labelsOrientation:{x:0,yLeft:0,yRight:0},layers:[{accessors:["32f66676-f4e1-48fd-b7f8-d4de38318601"],layerId:"8be0156b-d423-4a39-adf1-f54d4c9f2e69",layerType:"data",seriesType:"bar_horizontal_stacked",xAccessor:"f8bfa719-5c1c-4bf2-896e-c318d77fc08e",yConfig:[{color:"#d36186",forAccessor:"32f66676-f4e1-48fd-b7f8-d4de38318601"}]},{accessors:["b7e59b08-96e6-40d1-84fd-e97b977d1c47"],layerId:"ec84ba70-2adb-4647-8ef0-8ad91a0e6d4e",layerType:"data",seriesType:"bar_horizontal_stacked",xAccessor:"c72aad6a-fc9c-43dc-9194-e13ca3ee8aff",yConfig:[{color:"#9170b8",forAccessor:"b7e59b08-96e6-40d1-84fd-e97b977d1c47"}]}],legend:{isVisible:!1,position:"right",showSingleSeries:!1},preferredSeriesType:"bar_horizontal_stacked",tickLabelsVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},valueLabels:"hide",yLeftExtent:{mode:"full"},yRightExtent:{mode:"full"}}},title:"[Host] Unique IPs - bar chart",visualizationType:"lnsXY",references:[{id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern",type:"index-pattern"},{id:"{dataViewId}",name:"indexpattern-datasource-layer-8be0156b-d423-4a39-adf1-f54d4c9f2e69",type:"index-pattern"},{id:"{dataViewId}",name:"indexpattern-datasource-layer-ec84ba70-2adb-4647-8ef0-8ad91a0e6d4e",type:"index-pattern"}]},zh=$.i18n.translate("xpack.securitySolution.hostsKpiUniqueIps.errorSearchDescription",{defaultMessage:"An error has occurred on hosts kpi unique ips search"}),$h=$.i18n.translate("xpack.securitySolution.hostsKpiUniqueIps.failSearchDescription",{defaultMessage:"Failed to run search on hosts kpi unique ips"}),Vh="hostsKpiUniqueIpsQuery",Uh=$.i18n.translate("xpack.securitySolution.kpiHosts.uniqueIps.title",{defaultMessage:"Unique IPs"}),Hh=$.i18n.translate("xpack.securitySolution.kpiHosts.uniqueIps.sourceUnitLabel",{defaultMessage:"source"}),Gh=$.i18n.translate("xpack.securitySolution.kpiHosts.uniqueIps.destinationUnitLabel",{defaultMessage:"destination"}),Qh=$.i18n.translate("xpack.securitySolution.kpiHosts.uniqueIps.sourceChartLabel",{defaultMessage:"Src."}),Wh=$.i18n.translate("xpack.securitySolution.kpiHosts.uniqueIps.destinationChartLabel",{defaultMessage:"Dest."}),Kh=[{key:"uniqueIps",fields:[{key:"uniqueSourceIps",name:Qh,description:Hh,value:null,color:Dh.uniqueSourceIps,icon:"visMapCoordinate",lensAttributes:{description:"",state:{datasourceStates:{formBased:{layers:{"8be0156b-d423-4a39-adf1-f54d4c9f2e69":{columnOrder:["d9a6eb6b-8b78-439e-98e7-a718f8ffbebe"],columns:{"d9a6eb6b-8b78-439e-98e7-a718f8ffbebe":{customLabel:!0,dataType:"number",isBucketed:!1,label:" ",operationType:"unique_count",scale:"ratio",sourceField:"source.ip"}},incompleteColumns:{}}}}},filters:[],query:{language:"kuery",query:""},visualization:{accessor:"d9a6eb6b-8b78-439e-98e7-a718f8ffbebe",layerId:"8be0156b-d423-4a39-adf1-f54d4c9f2e69",layerType:"data"}},title:"[Host] Unique IPs - source metric",visualizationType:"lnsLegacyMetric",references:[{id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern",type:"index-pattern"},{id:"{dataViewId}",name:"indexpattern-datasource-layer-8be0156b-d423-4a39-adf1-f54d4c9f2e69",type:"index-pattern"}]}},{key:"uniqueDestinationIps",name:Wh,description:Gh,value:null,color:Dh.uniqueDestinationIps,icon:"visMapCoordinate",lensAttributes:{description:"",state:{datasourceStates:{formBased:{layers:{"8be0156b-d423-4a39-adf1-f54d4c9f2e69":{columnOrder:["d9a6eb6b-8b78-439e-98e7-a718f8ffbebe"],columns:{"d9a6eb6b-8b78-439e-98e7-a718f8ffbebe":{customLabel:!0,dataType:"number",isBucketed:!1,label:" ",operationType:"unique_count",scale:"ratio",sourceField:"destination.ip"}},incompleteColumns:{}}}}},filters:[],query:{language:"kuery",query:""},visualization:{accessor:"d9a6eb6b-8b78-439e-98e7-a718f8ffbebe",layerId:"8be0156b-d423-4a39-adf1-f54d4c9f2e69",layerType:"data"}},title:"[Host] Unique IPs - destination metric",visualizationType:"lnsLegacyMetric",references:[{id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern",type:"index-pattern"},{id:"{dataViewId}",name:"indexpattern-datasource-layer-8be0156b-d423-4a39-adf1-f54d4c9f2e69",type:"index-pattern"}]}}],enableAreaChart:!0,enableBarChart:!0,description:Uh,areaChartLensAttributes:Bh,barChartLensAttributes:qh}],Yh=({filterQuery:e,from:t,indexNames:a,to:r,updateDateRange:s,setQuery:o,skip:l})=>{const{toggleStatus:c}=Object(Wn.a)(Vh),[u,d]=Object(n.useState)(l||!c),p=Object(K.a)("chartEmbeddablesEnabled");Object(n.useEffect)((()=>{d(l||!c)}),[l,c]);const[b,{refetch:g,id:f,inspect:y,...h}]=(({filterQuery:e,endDate:t,indexNames:a,skip:i=!1,startDate:r})=>{const{data:s}=Object(m.j)().services,o=Object(n.useRef)(x.noop),l=Object(n.useRef)(new AbortController),c=Object(n.useRef)(new Ns.Subscription),[u,d]=Object(n.useState)(!1),[p,b]=Object(n.useState)(null),[g,f]=Object(n.useState)({uniqueSourceIps:0,uniqueSourceIpsHistogram:[],uniqueDestinationIps:0,uniqueDestinationIpsHistogram:[],id:Vh,inspect:{dsl:[],response:[]},isInspected:!1,refetch:o.current}),{addError:y,addWarning:h}=Object(rs.a)(),v=Object(n.useCallback)((e=>{if(null==e||i)return;const t=async()=>{l.current=new AbortController,d(!0),c.current=s.search.search(e,{strategy:"securitySolutionSearchStrategy",abortSignal:l.current.signal}).subscribe({next:e=>{e.isPartial||e.isRunning?e.isPartial&&!e.isRunning&&(d(!1),h(zh),c.current.unsubscribe()):(d(!1),f((t=>({...t,uniqueSourceIps:e.uniqueSourceIps,uniqueSourceIpsHistogram:e.uniqueSourceIpsHistogram,uniqueDestinationIps:e.uniqueDestinationIps,uniqueDestinationIpsHistogram:e.uniqueDestinationIpsHistogram,inspect:Object(Dp.getInspectResponse)(e,t.inspect),refetch:o.current}))),c.current.unsubscribe())},error:e=>{d(!1),y(e,{title:$h}),c.current.unsubscribe()}})};c.current.unsubscribe(),l.current.abort(),t(),o.current=t}),[s.search,y,h,i]);return Object(n.useEffect)((()=>{b((n=>{const i={...null!=n?n:{},defaultIndex:a,factoryQueryType:Vo.i.kpiUniqueIps,filterQuery:Object(ul.a)(e),timerange:{interval:"12h",from:r,to:t}};return Ds()(n,i)?n:i}))}),[a,t,e,i,r]),Object(n.useEffect)((()=>(v(p),()=>{c.current.unsubscribe(),l.current.abort()})),[p,v]),Object(n.useEffect)((()=>{i&&(d(!1),c.current.unsubscribe(),l.current.abort())}),[i]),[u,g]})({filterQuery:e,endDate:r,indexNames:a,startDate:t,skip:u||p}),{session:v,refetchByRestartingSession:E}=Object(Em.a)({inputId:Y.a.global,queryId:f});return i.a.createElement(mm,{data:h,id:f,inspect:y,loading:b,fieldsMapping:Kh,from:t,to:r,updateDateRange:s,refetch:p?E:g,setQuery:o,setQuerySkip:d,session:p?v:void 0})},Jh=i.a.memo(Yh),Xh=i.a.memo((({filterQuery:e,from:t,indexNames:a,to:n,setQuery:r,skip:s,updateDateRange:o})=>i.a.createElement(U.EuiFlexGroup,{wrap:!0},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(Lh,{filterQuery:e,from:t,indexNames:a,to:n,updateDateRange:o,setQuery:r,skip:s})),i.a.createElement(U.EuiFlexItem,{grow:2},i.a.createElement(Jh,{filterQuery:e,from:t,indexNames:a,to:n,updateDateRange:o,setQuery:r,skip:s})))));Xh.displayName="HostsKpiComponent",i.a.memo((({filterQuery:e,from:t,indexNames:a,to:n,setQuery:r,skip:s,updateDateRange:o})=>i.a.createElement(U.EuiFlexGroup,{wrap:!0},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(Jh,{filterQuery:e,from:t,indexNames:a,to:n,updateDateRange:o,setQuery:r,skip:s}))))).displayName="HostsDetailsKpiComponent";const Zh=i.a.memo((({deleteQuery:e,filterQuery:t,from:a,indexNames:r,isInitializing:o,setQuery:l,to:c,type:u})=>{const d={deleteQuery:e,endDate:c,filterQuery:t,indexNames:r,skip:o||void 0===t,setQuery:l,startDate:a,type:u},p=Object(n.useMemo)((()=>Object(qp.b)(s.wc.hosts)),[]);return i.a.createElement(q.c,null,i.a.createElement(q.a,{path:`${s.zb}/:tabName(${Rf.HostsTableType.hosts})`},i.a.createElement(my,d)),i.a.createElement(q.a,{path:`${s.zb}/:tabName(${Rf.HostsTableType.risk})`},i.a.createElement(Ly,d)),i.a.createElement(q.a,{path:`${s.zb}/:tabName(${Rf.HostsTableType.uncommonProcesses})`},i.a.createElement(Fy,d)),i.a.createElement(q.a,{path:`${s.zb}/:tabName(${Rf.HostsTableType.anomalies})`},i.a.createElement(_l,Ni()({},d,{AnomaliesTableComponent:$f}))),i.a.createElement(q.a,{path:`${s.zb}/:tabName(${Rf.HostsTableType.events})`},i.a.createElement(Sp,Ni()({additionalFilters:p,tableId:R.e.hostsPageEvents},d))),i.a.createElement(q.a,{path:`${s.zb}/:tabName(${Rf.HostsTableType.sessions})`},i.a.createElement(ah,d)))}));Zh.displayName="HostsTabs";const ev=e=>`${s.zb}/${e}`,tv=({hasMlUserPermissions:e,isRiskyHostsEnabled:t,isEnterprise:a})=>{const n=[],i={[Rf.HostsTableType.hosts]:{id:Rf.HostsTableType.hosts,name:ih.a,href:ev(Rf.HostsTableType.hosts),disabled:!1},[Rf.HostsTableType.uncommonProcesses]:{id:Rf.HostsTableType.uncommonProcesses,name:ih.g,href:ev(Rf.HostsTableType.uncommonProcesses),disabled:!1},[Rf.HostsTableType.anomalies]:{id:Rf.HostsTableType.anomalies,name:ih.b,href:ev(Rf.HostsTableType.anomalies),disabled:!1},[Rf.HostsTableType.events]:{id:Rf.HostsTableType.events,name:ih.d,href:ev(Rf.HostsTableType.events),disabled:!1},[Rf.HostsTableType.risk]:{id:Rf.HostsTableType.risk,name:ih.e,href:ev(Rf.HostsTableType.risk),disabled:!1},[Rf.HostsTableType.sessions]:{id:Rf.HostsTableType.sessions,name:ih.f,href:ev(Rf.HostsTableType.sessions),disabled:!1,isBeta:!1}};return e||n.push(Rf.HostsTableType.anomalies),t||n.push(Rf.HostsTableType.risk),a||n.push(Rf.HostsTableType.sessions),Object(x.omit)(n,i)},av=G.a.div.withConfig({displayName:"StyledFullHeightContainer",componentId:"sc-2687cy-0"})(["display:flex;flex-direction:column;flex:1 1 auto;"]),nv=()=>{const e=Object(o.useDispatch)(),t=Object(n.useRef)(null),a=Object(n.useMemo)((()=>R.j.getTableByIdSelector()),[]),r=Object(j.b)((e=>{var t;return(null!==(t=a(e,R.e.hostsPageEvents))&&void 0!==t?t:R.q).graphEventId})),s=Object(n.useMemo)((()=>Vr.d.globalFiltersQuerySelector()),[]),l=Object(n.useMemo)((()=>Vr.d.globalQuerySelector()),[]),c=Object(j.a)(l),u=Object(j.a)(s),d=Object(n.useMemo)((()=>Nb.d.hostRiskScoreSeverityFilterSelector()),[]),p=Object(j.a)((e=>d(e,Nb.b.HostsType.page))),{to:b,from:f,deleteQuery:y,setQuery:v,isInitializing:k}=Object(J.a)(),{globalFullScreen:O}=Object(fe.a)(),w=Object(io.a)(),{uiSettings:T}=Object(m.j)().services,{tabName:I}=Object(B.useParams)(),C=i.a.useMemo((()=>{const e=Object(qp.b)(S.a.hosts);if(I===Rf.HostsTableType.events)return[...u,...e];if(I===Rf.HostsTableType.risk){const t=Object(Fm.a)(p,Vo.w.host);return[...u,...e,...t]}return u}),[u,p,I]),M=Object(n.useCallback)((({x:t})=>{if(!t)return;const[a,n]=t;e(Object(ae.setAbsoluteRangeDatePicker)({id:Y.a.global,from:new Date(a).toISOString(),to:new Date(n).toISOString()}))}),[e]),{indicesExist:_,indexPattern:F,selectedPatterns:A}=Object(g.d)(),[D,N]=Object(n.useMemo)((()=>Object(kr.i)({config:Object(Ms.getEsQueryConfig)(T),indexPattern:F,queries:[c],filters:u})),[u,F,T,c]),[P]=Object(n.useMemo)((()=>Object(kr.i)({config:Object(Ms.getEsQueryConfig)(T),indexPattern:F,queries:[c],filters:C})),[F,c,C,T]);Object(Cp.a)({id:Yf,filterQuery:D,kqlError:N,query:c,startDate:f,endDate:b});const L=Object(fp.b)().isEnterprise(),q=Object(n.useCallback)((()=>{var e,a;null===(e=t.current)||void 0===e||null===(a=e.querySelector(".inspectButtonComponent:last-of-type"))||void 0===a||a.focus()}),[t]),z=Object(n.useCallback)((()=>{Object(he.m)()}),[]),$=Object(n.useCallback)((e=>{Object(Q.isTab)(e)&&Object(he.l)({containerElement:t.current,keyboardEvent:e,onSkipFocusBeforeEventsTable:q,onSkipFocusAfterEventsTable:z})}),[t,q,z]);return i.a.createElement(i.a.Fragment,null,_?i.a.createElement(av,{onKeyDown:$,ref:t},i.a.createElement(U.EuiWindowEvent,{event:"resize",handler:x.noop}),i.a.createElement(X.a,{show:Object(he.n)({globalFullScreen:O,graphEventId:r})},i.a.createElement(ee.a,{indexPattern:F,id:Y.a.global})),i.a.createElement(h.a,{noPadding:O},i.a.createElement(ye.a,{show:!O},i.a.createElement(Ci.a,{subtitle:i.a.createElement(zs,{indexKey:Vo.k.hosts,indexNames:A}),title:ih.h,border:!0}),i.a.createElement(Xh,{filterQuery:D,indexNames:A,from:f,setQuery:v,to:b,skip:k||!!N,updateDateRange:M}),i.a.createElement(U.EuiSpacer,null),i.a.createElement(_s.a,{navTabs:tv({hasMlUserPermissions:Object(Al.a)(w),isRiskyHostsEnabled:w.isPlatinumOrTrialLicense,isEnterprise:L})}),i.a.createElement(U.EuiSpacer,null)),i.a.createElement(Zh,{deleteQuery:y,to:b,filterQuery:P,isInitializing:k,indexNames:A,setQuery:v,from:f,type:Nb.b.HostsType.page}))):i.a.createElement(Mi.a,null),i.a.createElement(E.a,{pageName:S.a.hosts}))};nv.displayName="HostsComponent";const iv=i.a.memo(nv),rv=`${s.zb}/name/:detailName`,sv=i.a.memo((()=>i.a.createElement(q.c,null,i.a.createElement(q.a,{path:`${s.zb}/ml-hosts`},i.a.createElement(Ch,null)),i.a.createElement(q.a,{path:`${s.zb}/externalAlerts`,render:({location:{search:e=""}})=>i.a.createElement(B.Redirect,{to:{pathname:`${s.zb}/${Rf.HostsTableType.events}`,search:`${e}&onlyExternalAlerts=true`}})}),i.a.createElement(q.a,{path:`${s.zb}/:tabName(${Rf.HostsTableType.hosts}|${Rf.HostsTableType.uncommonProcesses}|${Rf.HostsTableType.anomalies}|${Rf.HostsTableType.events}|${Rf.HostsTableType.risk}|${Rf.HostsTableType.sessions})`},i.a.createElement(iv,null)),i.a.createElement(q.a,{path:`${rv}/:tabName(${Rf.HostsTableType.authentications}|${Rf.HostsTableType.uncommonProcesses}|${Rf.HostsTableType.anomalies}|${Rf.HostsTableType.events}|${Rf.HostsTableType.risk}|${Rf.HostsTableType.sessions})`,render:({match:{params:{detailName:e}}})=>i.a.createElement(mh,{hostDetailsPagePath:rv,detailName:decodeURIComponent(e)})}),i.a.createElement(q.a,{path:rv,render:({match:{params:{detailName:e}},location:{search:t=""}})=>i.a.createElement(B.Redirect,{to:{pathname:`${s.zb}/name/${e}/${Rf.HostsTableType.authentications}`,search:t}})}),i.a.createElement(q.a,{path:`${s.zb}/:detailName/:tabName?`,render:({match:{params:{detailName:e,tabName:t=Rf.HostsTableType.authentications}},location:{search:a=""}})=>i.a.createElement(B.Redirect,{to:{pathname:`${s.zb}/name/${e}/${t}`,search:a}})}),i.a.createElement(q.a,{path:s.zb,render:({location:{search:e=""}})=>i.a.createElement(B.Redirect,{to:{pathname:`${s.zb}/${Rf.HostsTableType.hosts}`,search:e}})}))));sv.displayName="HostsContainer";var ov=a(1099),lv=a(364);const cv=$.i18n.translate("xpack.securitySolution.components.flowControls.selectFlowTarget.sourceDropDownOptionLabel",{defaultMessage:"Source"}),uv=$.i18n.translate("xpack.securitySolution.components.flowControls.selectFlowTarget.destinationDropDownOptionLabel",{defaultMessage:"Destination"}),dv=$.i18n.translate("xpack.securitySolution.components.flowControls.selectFlowTarget.clientDropDownOptionLabel",{defaultMessage:"CLIENT"}),pv=$.i18n.translate("xpack.securitySolution.components.flowControls.selectFlowTarget.serverDropDownOptionLabel",{defaultMessage:"SERVER"}),mv=($.i18n.translate("xpack.securitySolution.components.flowControls.selectFlowDirection.unidirectionalButtonLabel",{defaultMessage:"Unidirectional"}),$.i18n.translate("xpack.securitySolution.components.flowControls.selectFlowDirection.bidirectionalButtonLabel",{defaultMessage:"Bidirectional"}),(e,t)=>[{id:`${e}-select-flow-target-${Vo.f.source}`,value:Vo.f.source,inputDisplay:t[0]||cv,directions:[Vo.e.uniDirectional,Vo.e.biDirectional]},{id:`${e}-select-flow-target-${Vo.f.destination}`,value:Vo.f.destination,inputDisplay:t[1]||uv,directions:[Vo.e.uniDirectional,Vo.e.biDirectional]},{id:`${e}-select-flow-target-${Vo.f.client}`,value:Vo.f.client,inputDisplay:t[2]||dv,directions:[Vo.e.biDirectional]},{id:`${e}-select-flow-target-${Vo.f.server}`,value:Vo.f.server,inputDisplay:t[3]||pv,directions:[Vo.e.biDirectional]}]),bv=({id:e,isLoading:t=!1,selectedDirection:a,selectedTarget:n,displayTextOverride:r=[],updateFlowTargetAction:s})=>i.a.createElement(U.EuiSuperSelect,{options:a?mv(e,r).filter((e=>e.directions.includes(a))):mv(e,r),valueOfSelected:n,onChange:s,isLoading:t}),gv=i.a.memo(bv);var fv=a(224);const yv=G()(U.EuiFlexItem).withConfig({displayName:"SelectTypeItem",componentId:"sc-loe16c-0"})(["min-width:180px;"]);yv.displayName="SelectTypeItem";const hv=({flowTarget:e})=>{const t=Object(B.useHistory)(),a=Object(B.useLocation)(),r=Object(n.useCallback)((n=>{const i=((e,t,a)=>`${e.pathname.replace(t,a)}${e.search}`)(a,e,n);t.push(i)}),[t,a,e]);return i.a.createElement(yv,{grow:!1,"data-test-subj":`${fv.b}-select-flow-target`},i.a.createElement(gv,{id:fv.b,isLoading:!e,selectedDirection:Vo.e.uniDirectional,selectedTarget:e,displayTextOverride:[lv.b,lv.a],updateFlowTargetAction:r}))},vv=i.a.memo(hv);var Ev=a(1098),xv=a(1130),jv=a(449),Sv=a(523),kv=a(280),Ov=a(1425),wv=a(668);const Tv=(e,t,a)=>`${s.Mb}/ip/${e}/${a}/${t}`,Iv=(e,t,a)=>{const n={[wv.a.flows]:{id:wv.a.flows,name:Ov.d,href:Tv(e,wv.a.flows,a),disabled:!1},[wv.a.users]:{id:wv.a.users,name:Ov.g,href:Tv(e,wv.a.users,a),disabled:!1},[wv.a.http]:{id:wv.a.http,name:Ov.e,href:Tv(e,wv.a.http,a),disabled:!1},[wv.a.tls]:{id:wv.a.tls,name:Ov.f,href:Tv(e,wv.a.tls,a),disabled:!1},[wv.a.anomalies]:{id:wv.a.anomalies,name:Ov.a,href:Tv(e,wv.a.anomalies,a),disabled:!1},[wv.a.events]:{id:wv.a.events,name:Ov.c,href:Tv(e,wv.a.events,a),disabled:!1}};return t||delete n.anomalies,n},Cv=["source.ip","destination.ip"],Mv=e=>null!=e&&Cv.includes(e),_v=(e,t)=>!!Mv(e.entityName)&&(null==t||e.entityValue===t);var Fv=a(270);const Av=(e,t,a)=>e===Fv.NetworkType.details&&null!=t?a===Vo.f.source?[{fieldName:"source.ip",fieldValue:t}]:a===Vo.f.destination?[{fieldName:"destination.ip",fieldValue:t}]:[]:[],Dv={sort:{field:"anomaly.severity",direction:"desc"}},Nv=({startDate:e,endDate:t,skip:a,ip:r,type:s,flowTarget:l})=>{const c=Object(io.a)(),u=Object(o.useDispatch)(),{toggleStatus:d,setToggleStatus:p}=Object(Wn.a)(`AnomaliesNetwork-${l}`),[m,b]=Object(n.useState)(a||!d);Object(n.useEffect)((()=>{b(a||!d)}),[a,d]);const g=Object(n.useCallback)((e=>{p(e),b(!e)}),[b,p]),{jobNameById:f,loading:y}=Object(El.a)(),h=Object(n.useMemo)((()=>Object.keys(f)),[f]),v=Object(n.useMemo)((()=>kv.e.networkAnomaliesJobIdFilterSelector()),[]),E=Object(j.a)((e=>v(e,s))),x=Object(n.useCallback)((e=>{u(kv.b.updateNetworkAnomaliesJobIdFilter({jobIds:e,networkType:s}))}),[u,s]),S=Object(n.useMemo)((()=>kv.e.networkAnomaliesIntervalSelector()),[]),k=Object(j.a)((e=>S(e,s))),O=Object(n.useCallback)((e=>{u(kv.b.updateNetworkAnomaliesInterval({interval:e,networkType:s}))}),[u,s]),[w,T]=Object(Fl.a)({startDate:e,endDate:t,skip:m,criteriaFields:Av(s,r,l),jobIds:E.length>0?E:h,aggregationInterval:k}),I=((e,t,a)=>null==e?[]:e.anomalies.reduce(((e,n)=>{var i;if(Mv(n.entityName)&&_v(n,a))return[...e,{ip:n.entityValue,type:n.entityName,jobName:null!==(i=t[n.jobId])&&void 0!==i?i:n.jobId,anomaly:n}];{const i=((e=[],t)=>{const a=e.find((e=>{const[a,n]=Object(tc.a)(e);return!!Mv(a)&&(null==t||n===t)}));if(null!=a){const[e]=Object(tc.a)(a);return Mv(e)?{ip:Object.values(a)[0],type:e}:{ip:Object.values(a)[0],type:"destination.ip"}}return null})(n.influencers,a);var r;return null!=i?[...e,{ip:i.ip,type:i.type,jobName:null!==(r=t[n.jobId])&&void 0!==r?r:n.jobId,anomaly:n}]:e}}),[]))(T,f,r),C=((e,t,a,n)=>{const r=((e,t,a)=>[{name:Ul,field:"ip",sortable:!0,render:(e,t)=>Object(eo.b)({values:[e],fieldName:t.type,idPrefix:`anomalies-network-table-ip-${nc(t.anomaly)}`,render:e=>i.a.createElement(ge.h,{ip:e,flowTarget:a})})},...lc(e,t)])(t,a,n);return e===Fv.NetworkType.details?r.filter((e=>e.name!==Ul)):r})(s,e,t,l),M={initialPageIndex:0,initialPageSize:10,totalItemCount:I.length,pageSizeOptions:[5,10,20,50],showPerPageOptions:!0};return Object(Al.a)(c)?i.a.createElement(Ws.a,{loading:w||y},i.a.createElement(pn.a,{subtitle:`${Dl}: ${M.totalItemCount.toLocaleString()} ${Pl(M.totalItemCount)}`,title:Nl,tooltip:Rl,toggleQuery:g,toggleStatus:d,isInspectDisabled:a,headerFilters:i.a.createElement(U.EuiFlexGroup,null,i.a.createElement(U.EuiFlexItem,null,i.a.createElement(pc,{interval:k,onChange:O})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(cc,{title:Gl,onSelect:x,selectedJobIds:E,jobIds:h,jobNameById:f})))}),d&&i.a.createElement(Zl.a,{"data-test-subj":"network-anomalies-table",columns:C,items:I,pagination:M,sorting:Dv}),(w||y)&&i.a.createElement($s.a,{"data-test-subj":"anomalies-network-table-loading-panel",overlay:!0,size:"xl"})):null},Pv=i.a.memo(Nv);var Rv=a(263),Lv=a(562);const Bv=[Lv.a.flows,Lv.a.dns,Lv.a.http,Lv.a.tls,Lv.a.events],qv=Bv.join("|"),zv=[...Bv,Lv.a.anomalies].join("|"),$v=`${s.Mb}/:tabName(${zv})`,Vv=`${s.Mb}/:tabName(${qv})`,Uv=[wv.a.flows,wv.a.http,wv.a.tls,wv.a.anomalies,wv.a.events,wv.a.users].join("|"),Hv=[Vo.g.source,Vo.g.destination].join("|"),Gv=`${s.Mb}/ip/:detailName`,Qv=`${Gv}/:flowTarget(${Hv})/:tabName(${Uv})`,Wv=G()(U.EuiFlexGroup).withConfig({displayName:"ConditionalFlexGroup",componentId:"sc-ivhqnd-0"})(["@media only screen and (min-width:1441px){flex-direction:row !important;}"]);Wv.displayName="ConditionalFlexGroup";const Kv=i.a.memo((({type:e,to:t,filterQuery:a,isInitializing:n,from:r,indexPattern:o,indexNames:l,setQuery:c})=>{const u={startDate:r,endDate:t,indexNames:l,skip:n,type:e,setQuery:c,filterQuery:a},d={...u,indexPattern:o},p={...u,anomaliesFilterQuery:{bool:{should:[{exists:{field:"source.ip"}},{exists:{field:"destination.ip"}}],minimum_should_match:1}},AnomaliesTableComponent:Pv};return i.a.createElement(q.c,null,i.a.createElement(q.a,{path:`${s.Mb}/:tabName(${Lv.a.dns})`},i.a.createElement(UE,d)),i.a.createElement(q.a,{path:`${s.Mb}/:tabName(${Lv.a.flows})`},i.a.createElement(i.a.Fragment,null,i.a.createElement(Wv,{direction:"column"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(Ox,Ni()({},d,{flowTarget:Rv.b.source}))),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(Ox,Ni()({},d,{flowTarget:Rv.b.destination})))),i.a.createElement(U.EuiSpacer,null),i.a.createElement(Wv,{direction:"column"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(vE,Ni()({},d,{flowTarget:Rv.b.source}))),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(vE,Ni()({},d,{flowTarget:Rv.b.destination})))))),i.a.createElement(q.a,{path:`${s.Mb}/:tabName(${Lv.a.http})`},i.a.createElement(rx,d)),i.a.createElement(q.a,{path:`${s.Mb}/:tabName(${Lv.a.tls})`},i.a.createElement($x,Ni()({},d,{flowTarget:Rv.b.source}))),i.a.createElement(q.a,{path:`${s.Mb}/:tabName(${Lv.a.anomalies})`},i.a.createElement(_l,Ni()({},p,{AnomaliesTableComponent:Pv}))),i.a.createElement(q.a,{path:`${s.Mb}/:tabName(${Lv.a.events})`},i.a.createElement(Sp,Ni()({additionalFilters:qp.h,tableId:R.e.networkPageEvents},d))))}));Kv.displayName="NetworkRoutes";const Yv=G()(U.EuiFlexGroup).withConfig({displayName:"FlexGroup",componentId:"sc-1bc33a1-0"})(["min-height:200px;"]);Yv.displayName="FlexGroup";const Jv=()=>i.a.createElement(Yv,{justifyContent:"center",alignItems:"center"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiLoadingSpinner,{size:"xl"})));Jv.displayName="NetworkRoutesLoading";const Xv=e=>`${s.Mb}/${e}`,Zv=e=>{const t={[Lv.a.flows]:{id:Lv.a.flows,name:Ov.d,href:Xv(Lv.a.flows),disabled:!1},[Lv.a.dns]:{id:Lv.a.dns,name:Ov.b,href:Xv(Lv.a.dns),disabled:!1},[Lv.a.http]:{id:Lv.a.http,name:Ov.e,href:Xv(Lv.a.http),disabled:!1},[Lv.a.tls]:{id:Lv.a.tls,name:Ov.f,href:Xv(Lv.a.tls),disabled:!1},[Lv.a.anomalies]:{id:Lv.a.anomalies,name:Ov.a,href:Xv(Lv.a.anomalies),disabled:!1},[Lv.a.events]:{id:Lv.a.events,name:Ov.c,href:Xv(Lv.a.events),disabled:!1}};return e?t:Object(x.omit)([Lv.a.anomalies],t)};var eE=a(1044);const tE=e=>$.i18n.translate("xpack.securitySolution.networkTopCountriesTable.heading.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {Country} other {Countries}}"}),aE=$.i18n.translate("xpack.securitySolution.networkTopCountriesTable.column.countryTitle",{defaultMessage:"Country"}),nE=$.i18n.translate("xpack.securitySolution.networkTopCountriesTable.column.bytesInTitle",{defaultMessage:"Bytes in"}),iE=$.i18n.translate("xpack.securitySolution.networkTopCountriesTable.column.bytesOutTitle",{defaultMessage:"Bytes out"}),rE=$.i18n.translate("xpack.securitySolution.networkTopCountriesTable.column.flows",{defaultMessage:"Flows"}),sE=$.i18n.translate("xpack.securitySolution.networkTopCountriesTable.heading.destinationCountries",{defaultMessage:"Destination countries"}),oE=$.i18n.translate("xpack.securitySolution.networkTopCountriesTable.heading.sourceCountries",{defaultMessage:"Source countries"}),lE=$.i18n.translate("xpack.securitySolution.networkTopCountriesTable.column.destinationIps",{defaultMessage:"Destination IPs"}),cE=$.i18n.translate("xpack.securitySolution.networkTopCountriesTable.column.sourceIps",{defaultMessage:"Source IPs"}),uE=$.i18n.translate("xpack.securitySolution.networkTopCountriesTable.rows",{values:{numRows:5},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),dE=$.i18n.translate("xpack.securitySolution.networkTopCountriesTable.rows",{values:{numRows:10},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"});var pE=a(727);const mE=e=>e===Rv.b.source?Rv.b.destination:Rv.b.source,bE=[{text:uE,numberOfRow:5},{text:dE,numberOfRow:10}],gE=({data:e,fakeTotalCount:t,flowTargeted:a,id:r,indexPattern:s,isInspect:l,loading:c,loadPage:u,setQuerySkip:d,showMorePagesIndicator:p,totalCount:m,type:b})=>{const g=Object(o.useDispatch)(),f=Object(n.useMemo)((()=>kv.e.topCountriesSelector()),[]),{activePage:y,limit:h,sort:v}=Object(j.a)((e=>f(e,b,a))),E=Object(n.useMemo)((()=>a===Vo.g.source?oE:sE),[a]),S=Object(n.useMemo)((()=>b===kv.c.NetworkType.page?a===Vo.g.source?kv.c.NetworkTableType.topCountriesSource:kv.c.NetworkTableType.topCountriesDestination:a===Vo.g.source?kv.c.NetworkDetailsTableType.topCountriesSource:kv.c.NetworkDetailsTableType.topCountriesDestination),[a,b]),k=v.field===Vo.t.bytes_out||v.field===Vo.t.bytes_in?`node.network.${v.field}`:`node.${a}.${v.field}`,O=Object(n.useCallback)((e=>g(kv.b.updateNetworkTable({networkType:b,tableType:S,updates:{limit:e}}))),[g,b,S]),w=Object(n.useCallback)((e=>g(kv.b.updateNetworkTable({networkType:b,tableType:S,updates:{activePage:e}}))),[g,b,S]),T=Object(n.useCallback)((e=>{if(null!=e.sort){const t=e.sort.field.split("."),a=Object(x.last)(t),n={field:a,direction:a!==v.field?Vo.b.desc:e.sort.direction};Ds()(n,v)||g(kv.b.updateNetworkTable({networkType:b,tableType:S,updates:{sort:n}}))}}),[v,g,b,S]),I=Object(n.useMemo)((()=>((e,t,a,n)=>{const r=((e,t,a,n)=>[{name:aE,render:({node:e})=>{const a=Object(x.get)(`${t}.country`,e),r=`${t}.geo.country_iso_code`,s=Object(za.i)(`${n}-table-${t}-country-${a}`);return null!=a?i.a.createElement(Dn.c,{key:s,mode:Dn.a.HOVER_DOWN,visibleCellActions:5,showActionTooltips:!0,triggerId:Dn.d.DEFAULT,data:{value:a,field:r}},i.a.createElement(eE.b,{countryCode:a})):Object(Bs.d)()},width:"20%"},{align:"right",field:"node.network.bytes_in",name:nE,sortable:!0,render:e=>null!=e?i.a.createElement(pE.a,{value:e}):Object(Bs.d)()},{align:"right",field:"node.network.bytes_out",name:iE,sortable:!0,render:e=>null!=e?i.a.createElement(pE.a,{value:e}):Object(Bs.d)()},{align:"right",field:`node.${t}.flows`,name:rE,sortable:!0,render:e=>null!=e?di()(e).format("0,000"):Object(Bs.d)()},{align:"right",field:`node.${t}.${t}_ips`,name:t===Rv.b.source?cE:lE,sortable:!0,render:e=>null!=e?di()(e).format("0,000"):Object(Bs.d)()},{align:"right",field:`node.${t}.${mE(t)}_ips`,name:mE(t)===Rv.b.source?cE:lE,sortable:!0,render:e=>null!=e?di()(e).format("0,000"):Object(Bs.d)()}])(0,t,0,n);return a===kv.c.NetworkType.details?(r.pop(),r):r})(0,a,b,"networkTopCountries-top-talkers")),[s,a,b]);return i.a.createElement(Ys,{activePage:y,columns:I,dataTestSubj:`table-${S}`,headerCount:m,headerTitle:E,headerUnit:tE(m),id:r,isInspect:l,itemsPerRow:bE,limit:h,loading:c,loadPage:u,onChange:T,pageOfItems:e,setQuerySkip:d,showMorePagesIndicator:p,sorting:{field:k,direction:v.direction},totalCount:t,updateActivePage:w,updateLimitPagination:O})};gE.displayName="NetworkTopCountriesTableComponent";const fE=i.a.memo(gE),yE=$.i18n.translate("xpack.securitySolution.networkTopCountries.failSearchDescription",{defaultMessage:"Failed to run search on network top countries"}),hE=Object(ft.a)(fE),vE=({endDate:e,filterQuery:t,flowTarget:a,indexNames:r,indexPattern:s,ip:o,setQuery:l,skip:c,startDate:u,type:d})=>{const p=`networkTopCountriesQuery-${a}-${d}`,{toggleStatus:m}=Object(Wn.a)(p),[b,g]=Object(n.useState)(c||!m);Object(n.useEffect)((()=>{g(c||!m)}),[c,m]);const[f,{id:y,inspect:h,isInspected:v,loadPage:E,networkTopCountries:S,pageInfo:k,refetch:O,totalCount:w}]=(({endDate:e,filterQuery:t,flowTarget:a,id:i,indexNames:r,ip:s,skip:o,startDate:l,type:c})=>{const u=Object(n.useMemo)((()=>kv.e.topCountriesSelector()),[]),{activePage:d,limit:p,sort:m}=Object(j.a)((e=>u(e,c,a))),[b,g]=Object(n.useState)(null),f=Object(n.useCallback)((e=>{g((t=>t?{...t,pagination:xo(e,p)}:t))}),[p]),{loading:y,result:h,search:v,refetch:E,inspect:x}=Object(ho.a)({factoryQueryType:Vo.r.topCountries,initialResult:{edges:[],totalCount:-1,pageInfo:{activePage:0,fakeTotalCount:0,showMorePagesIndicator:!1}},errorMessage:yE,abort:o}),S=Object(n.useMemo)((()=>({endDate:e,networkTopCountries:h.edges,id:i,inspect:x,isInspected:!1,loadPage:f,pageInfo:h.pageInfo,refetch:E,startDate:l,totalCount:h.totalCount})),[e,i,x,E,h.edges,h.pageInfo,h.totalCount,l,f]);return Object(n.useEffect)((()=>{g((n=>{const i={...null!=n?n:{},defaultIndex:r,factoryQueryType:Vo.r.topCountries,filterQuery:Object(ul.a)(t),flowTarget:a,ip:s,pagination:xo(d,p),sort:m,timerange:{interval:"12h",from:l,to:e}};return Ds()(n,i)?n:i}))}),[d,r,e,t,s,p,l,m,a]),Object(n.useEffect)((()=>{!o&&b&&v(b)}),[b,v,o]),[y,S]})({endDate:e,flowTarget:a,filterQuery:t,id:p,indexNames:r,ip:o,skip:b,startDate:u,type:d});return i.a.createElement(hE,{data:S,fakeTotalCount:Object(x.getOr)(50,"fakeTotalCount",k),flowTargeted:a,id:y,indexPattern:s,inspect:h,isInspect:v,loading:f,loadPage:E,refetch:O,setQuery:l,setQuerySkip:g,showMorePagesIndicator:Object(x.getOr)(!1,"showMorePagesIndicator",k),totalCount:w,type:d})};vE.displayName="CountriesQueryTabBody";const EE=$.i18n.translate("xpack.securitySolution.networkDnsTable.title",{defaultMessage:"Top DNS domains"}),xE=e=>$.i18n.translate("xpack.securitySolution.networkDnsTable.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {domain} other {domains}}"}),jE=$.i18n.translate("xpack.securitySolution.networkDnsTable.helperTooltip",{defaultMessage:"This shows DNS protocol traffic only and can be useful for hunting domains used in DNS data exfiltration."}),SE=$.i18n.translate("xpack.securitySolution.networkDnsTable.column.registeredDomain",{defaultMessage:"Registered domain"}),kE=$.i18n.translate("xpack.securitySolution.networkDnsTable.column.TotalQueriesTitle",{defaultMessage:"Total queries"}),OE=$.i18n.translate("xpack.securitySolution.networkDnsTable.column.uniqueDomainsTitle",{defaultMessage:"Unique domains"}),wE=$.i18n.translate("xpack.securitySolution.networkDnsTable.column.bytesInTitle",{defaultMessage:"DNS bytes in"}),TE=$.i18n.translate("xpack.securitySolution.networkDnsTable.column.bytesOutTitle",{defaultMessage:"DNS bytes out"}),IE=$.i18n.translate("xpack.securitySolution.networkDnsTable.select.includePtrRecords",{defaultMessage:"Include PTR records"}),CE=$.i18n.translate("xpack.securitySolution.networkDnsTable.rows",{values:{numRows:5},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),ME=$.i18n.translate("xpack.securitySolution.networkDnsTable.rows",{values:{numRows:10},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),_E=i.a.memo((({isPtrIncluded:e,onChange:t})=>i.a.createElement(U.EuiSwitch,{name:"switch-ptr-included",label:IE,checked:e,onChange:t})));_E.displayName="IsPtrIncluded";const FE=kv.c.NetworkTableType.dns,AE=[{text:CE,numberOfRow:5},{text:ME,numberOfRow:10}],DE=({data:e,fakeTotalCount:t,id:a,isInspect:r,loading:s,loadPage:l,showMorePagesIndicator:c,setQuerySkip:u,totalCount:d,type:p})=>{const m=Object(o.useDispatch)(),b=Object(n.useMemo)((()=>kv.e.dnsSelector()),[]),{activePage:g,isPtrIncluded:f,limit:y,sort:h}=Object(j.a)(b),v=Object(n.useCallback)((e=>m(kv.b.updateNetworkTable({networkType:p,tableType:FE,updates:{limit:e}}))),[p,m]),E=Object(n.useCallback)((e=>m(kv.b.updateNetworkTable({networkType:p,tableType:FE,updates:{activePage:e}}))),[m,p]),x=Object(n.useCallback)((e=>{if(null!=e.sort){const t={field:e.sort.field.split(".")[1],direction:e.sort.direction};Ds()(t,h)||m(kv.b.updateNetworkTable({networkType:p,tableType:FE,updates:{sort:t}}))}}),[h,p,m]),S=Object(n.useCallback)((()=>m(kv.b.updateNetworkTable({networkType:p,tableType:FE,updates:{isPtrIncluded:!f}}))),[m,p,f]),k=Object(n.useMemo)((()=>[{field:`node.${Vo.o.dnsName}`,name:SE,truncateText:!1,mobileOptions:{show:!0},sortable:!0,render:e=>null!=e?i.a.createElement(Dn.c,{key:Object(za.i)(`networkDns-table--name-${e}`),mode:Dn.a.HOVER_DOWN,visibleCellActions:5,showActionTooltips:!0,triggerId:Dn.d.DEFAULT,data:{value:e,field:"dns.question.registered_domain"}},Object(Bs.a)(e)):Object(Bs.d)()},{align:"right",field:`node.${Vo.o.queryCount}`,name:kE,sortable:!0,truncateText:!1,mobileOptions:{show:!0},render:e=>null!=e?di()(e).format("0"):Object(Bs.d)()},{align:"right",field:`node.${Vo.o.uniqueDomains}`,name:OE,sortable:!0,truncateText:!1,mobileOptions:{show:!0},render:e=>null!=e?di()(e).format("0"):Object(Bs.d)()},{align:"right",field:`node.${Vo.o.dnsBytesIn}`,name:wE,sortable:!0,truncateText:!1,mobileOptions:{show:!0},render:e=>null!=e?i.a.createElement(pE.a,{value:e}):Object(Bs.d)()},{align:"right",field:`node.${Vo.o.dnsBytesOut}`,name:TE,sortable:!0,truncateText:!1,mobileOptions:{show:!0},render:e=>null!=e?i.a.createElement(pE.a,{value:e}):Object(Bs.d)()}]),[]),O=Object(n.useMemo)((()=>({field:`node.${h.field}`,direction:h.direction})),[h.direction,h.field]),w=Object(n.useMemo)((()=>i.a.createElement(_E,{isPtrIncluded:f,onChange:S})),[f,S]);return i.a.createElement(Ys,{activePage:g,columns:k,dataTestSubj:`table-${FE}`,headerCount:d,headerSupplement:w,headerTitle:EE,headerTooltip:jE,headerUnit:xE(d),id:a,itemsPerRow:AE,isInspect:r,limit:y,loading:s,loadPage:l,onChange:x,pageOfItems:e,setQuerySkip:u,showMorePagesIndicator:c,sorting:O,totalCount:t,updateActivePage:E,updateLimitPagination:v})};DE.displayName="NetworkDnsTableComponent";const NE=i.a.memo(DE),PE=$.i18n.translate("xpack.securitySolution.networkDns.errorSearchDescription",{defaultMessage:"An error has occurred on network dns search"}),RE=$.i18n.translate("xpack.securitySolution.hosts.navigation.dns.histogram.errorFetchingDnsData",{defaultMessage:"Failed to query DNS data"});var LE;const BE="networkDnsHistogramQuery",qE=Object(ft.a)(NE),zE=[{text:"dns.question.registered_domain",value:"dns.question.registered_domain"}],$E={defaultStackByOption:null!==(LE=zE.find((e=>"dns.question.registered_domain"===e.text)))&&void 0!==LE?LE:zE[0],errorMessage:RE,histogramType:cl.j.dns,stackByOptions:zE,subtitle:void 0,getLensAttributes:(e="dns.question.registered_domain",t)=>({title:"Top domains by dns.question.registered_domain",visualizationType:"lnsXY",state:{visualization:{legend:{isVisible:!0,position:"right",legendSize:"xlarge"},valueLabels:"hide",fittingFunction:"None",yLeftExtent:{mode:"full"},yRightExtent:{mode:"full"},axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!1},valuesInLegend:!0,tickLabelsVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},labelsOrientation:{x:0,yLeft:0,yRight:0},gridlinesVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},preferredSeriesType:"bar_stacked",layers:[{layerId:"b1c3efc6-c886-4fba-978f-3b6bb5e7948a",accessors:["2a4d5e20-f570-48e4-b9ab-ff3068919377"],position:"top",seriesType:"bar_stacked",showGridlines:!1,layerType:"data",xAccessor:"d1452b87-0e9e-4fc0-a725-3727a18e0b37",splitAccessor:"e8842815-2a45-4c74-86de-c19a391e2424"}]},query:{query:"",language:"kuery"},filters:null!=t&&t.dnsIsPtrIncluded?[]:[{meta:{alias:null,negate:!0,disabled:!1,type:"phrase",key:"dns.question.type",params:{query:"PTR"},indexRefName:"filter-index-pattern-0"},query:{match_phrase:{"dns.question.type":"PTR"}},$state:{store:"appState"}}],datasourceStates:{formBased:{layers:{"b1c3efc6-c886-4fba-978f-3b6bb5e7948a":{columns:{"e8842815-2a45-4c74-86de-c19a391e2424":{label:Object(ei.o)(e),dataType:"string",operationType:"terms",scale:"ordinal",sourceField:e,isBucketed:!0,params:{size:10,orderBy:{type:"column",columnId:"2a4d5e20-f570-48e4-b9ab-ff3068919377"},orderDirection:"desc",otherBucket:!0,missingBucket:!1,secondaryFields:[],parentFormat:{id:"terms"},accuracyMode:!0}},"d1452b87-0e9e-4fc0-a725-3727a18e0b37":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto"}},"2a4d5e20-f570-48e4-b9ab-ff3068919377":{label:Object(ei.p)("dns.question.name"),dataType:"number",operationType:"unique_count",scale:"ratio",sourceField:"dns.question.name",isBucketed:!1}},columnOrder:["e8842815-2a45-4c74-86de-c19a391e2424","d1452b87-0e9e-4fc0-a725-3727a18e0b37","2a4d5e20-f570-48e4-b9ab-ff3068919377"],incompleteColumns:{}}}}},internalReferences:[],adHocDataViews:{}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-b1c3efc6-c886-4fba-978f-3b6bb5e7948a"}]})},VE=({deleteQuery:e,endDate:t,filterQuery:a,indexNames:r,skip:s,startDate:o,setQuery:l,type:c})=>{const u=kv.e.dnsSelector(),d=Object(j.b)((e=>u(e).isPtrIncluded));Object(n.useEffect)((()=>()=>{e&&e({id:BE})}),[e]);const p=`networkDnsQuery-${c}`,{toggleStatus:m}=Object(Wn.a)(p),[b,g]=Object(n.useState)(s||!m);Object(n.useEffect)((()=>{g(s||!m)}),[s,m]);const[f,{totalCount:y,networkDns:h,pageInfo:v,loadPage:E,id:S,inspect:k,isInspected:O,refetch:w}]=(({endDate:e,filterQuery:t,id:a,indexNames:i,skip:r,startDate:s})=>{const o=Object(n.useMemo)((()=>kv.e.dnsSelector()),[]),{activePage:l,sort:c,isPtrIncluded:u,limit:d}=Object(j.a)(o),[p,m]=Object(n.useState)(null),b=Object(n.useCallback)((e=>{m((t=>t?{...t,pagination:xo(e,d)}:t))}),[d]),{loading:g,result:f,search:y,refetch:h,inspect:v}=Object(ho.a)({factoryQueryType:Vo.r.dns,initialResult:{edges:[],totalCount:-1,pageInfo:{activePage:0,fakeTotalCount:0,showMorePagesIndicator:!1}},errorMessage:PE,abort:r}),E=Object(n.useMemo)((()=>({id:a,inspect:v,isInspected:!1,loadPage:b,networkDns:f.edges,pageInfo:f.pageInfo,refetch:h,totalCount:f.totalCount})),[a,v,h,f.edges,f.pageInfo,f.totalCount,b]);return Object(n.useEffect)((()=>{m((a=>{const n={...null!=a?a:{},defaultIndex:i,isPtrIncluded:u,factoryQueryType:Vo.r.dns,filterQuery:Object(ul.a)(t),pagination:xo(l,d,!0),sort:c,timerange:{interval:"12h",from:s,to:e}};return Ds()(a,n)?a:n}))}),[l,i,e,t,d,s,c,u]),Object(n.useEffect)((()=>{!r&&p&&y(p)}),[p,y,r]),[g,E]})({endDate:t,filterQuery:a,id:p,indexNames:r,skip:b,startDate:o}),T=Object(n.useCallback)((e=>{return t=e.text,$.i18n.translate("xpack.securitySolution.network.dns.stackByUniqueSubdomain",{values:{groupByField:t},defaultMessage:"Top domains by {groupByField}"});var t}),[]),I=Object(n.useMemo)((()=>({...$E,title:T})),[T]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(fl.a,Ni()({id:BE,isPtrIncluded:d,endDate:t,filterQuery:a,indexNames:r,setQuery:l,showLegend:!0,startDate:o},I)),i.a.createElement(qE,{data:h,fakeTotalCount:Object(x.getOr)(50,"fakeTotalCount",v),id:S,inspect:k,isInspect:O,loading:f,loadPage:E,refetch:w,setQuery:l,setQuerySkip:g,showMorePagesIndicator:Object(x.getOr)(!1,"showMorePagesIndicator",v),totalCount:y,type:c}))};VE.displayName="DnsQueryTabBodyComponent";const UE=i.a.memo(VE),HE=$.i18n.translate("xpack.securitySolution.networkHttpTable.title",{defaultMessage:"HTTP Requests"}),GE=e=>$.i18n.translate("xpack.securitySolution.networkHttpTable.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {request} other {requests}}"}),QE=$.i18n.translate("xpack.securitySolution.networkHttpTable.column.methodTitle",{defaultMessage:"Method"}),WE=$.i18n.translate("xpack.securitySolution.networkHttpTable.column.domainTitle",{defaultMessage:"Domain"}),KE=$.i18n.translate("xpack.securitySolution.networkHttpTable.column.pathTitle",{defaultMessage:"Path"}),YE=$.i18n.translate("xpack.securitySolution.networkHttpTable.column.statusTitle",{defaultMessage:"Status"}),JE=$.i18n.translate("xpack.securitySolution.networkHttpTable.column.lastHostTitle",{defaultMessage:"Last host"}),XE=$.i18n.translate("xpack.securitySolution.networkHttpTable.column.lastSourceIpTitle",{defaultMessage:"Last source Ip"}),ZE=$.i18n.translate("xpack.securitySolution.networkHttpTable.column.requestsTitle",{defaultMessage:"Requests"}),ex=[{text:$.i18n.translate("xpack.securitySolution.networkHttpTable.rows",{values:{numRows:5},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),numberOfRow:5},{text:$.i18n.translate("xpack.securitySolution.networkHttpTable.rows",{values:{numRows:10},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),numberOfRow:10}],tx=({data:e,fakeTotalCount:t,id:a,isInspect:r,loading:s,loadPage:l,setQuerySkip:c,showMorePagesIndicator:u,totalCount:d,type:p})=>{const m=Object(o.useDispatch)(),b=Object(n.useMemo)((()=>kv.e.httpSelector()),[]),{activePage:g,limit:f,sort:y}=Object(j.a)((e=>b(e,p))),h=p===kv.c.NetworkType.page?kv.c.NetworkTableType.http:kv.c.NetworkDetailsTableType.http,v=Object(n.useCallback)((e=>m(kv.b.updateNetworkTable({networkType:p,tableType:h,updates:{limit:e}}))),[m,p,h]),E=Object(n.useCallback)((e=>m(kv.b.updateNetworkTable({networkType:p,tableType:h,updates:{activePage:e}}))),[m,p,h]),x=Object(n.useCallback)((e=>{null!=e.sort&&e.sort.direction!==y.direction&&m(kv.b.updateNetworkTable({networkType:p,tableType:h,updates:{sort:{direction:e.sort.direction}}}))}),[y.direction,m,p,h]),S={field:`node.${Vo.p.requestCount}`,direction:y.direction},k=Object(n.useMemo)((()=>{return e=h,[{name:QE,render:({node:{methods:t,path:a}})=>Array.isArray(t)&&t.length>0?Object(eo.b)({fieldName:"http.request.method",values:t,idPrefix:Object(za.i)(`${e}-table-methods-${a}`),displayCount:3}):Object(Bs.d)()},{name:WE,render:({node:{domains:t,path:a}})=>Array.isArray(t)&&t.length>0?Object(eo.b)({values:t,fieldName:"url.domain",idPrefix:Object(za.i)(`${e}-table-domains-${a}`)}):Object(Bs.d)()},{field:`node.${Rv.e.path}`,name:KE,render:t=>null!=t?Object(eo.b)({values:[t],fieldName:"url.path",idPrefix:Object(za.i)(`${e}-table-path-${t}`)}):Object(Bs.d)()},{name:YE,render:({node:{statuses:t,path:a}})=>Array.isArray(t)&&t.length>0?Object(eo.b)({values:t,fieldName:"http.response.status_code",idPrefix:Object(za.i)(`${e}-table-statuses-${a}`),displayCount:3}):Object(Bs.d)()},{name:JE,render:({node:{lastHost:t,path:a}})=>null!=t?Object(eo.b)({values:[t],fieldName:"host.name",idPrefix:Object(za.i)(`${e}-table-lastHost-${a}`)}):Object(Bs.d)()},{name:XE,render:({node:{lastSourceIp:t,path:a}})=>null!=t?Object(eo.b)({values:[t],fieldName:"source.ip",idPrefix:Object(za.i)(`${e}-table-lastSourceIp-${a}`),render:()=>i.a.createElement(ge.h,{ip:t})}):Object(Bs.d)()},{align:"right",field:`node.${Rv.e.requestCount}`,name:ZE,sortable:!0,render:e=>null!=e?di()(e).format("0,000"):Object(Bs.d)()}];var e}),[h]);return i.a.createElement(Ys,{activePage:g,columns:k,dataTestSubj:`table-${h}`,headerCount:d,headerTitle:HE,headerUnit:GE(d),id:a,itemsPerRow:ex,isInspect:r,limit:f,loading:s,loadPage:l,onChange:x,pageOfItems:e,setQuerySkip:c,showMorePagesIndicator:u,sorting:S,totalCount:t,updateActivePage:E,updateLimitPagination:v})};tx.displayName="NetworkHttpTableComponent";const ax=i.a.memo(tx),nx=$.i18n.translate("xpack.securitySolution.networkHttp.failSearchDescription",{defaultMessage:"Failed to run search on network http"}),ix=Object(ft.a)(ax),rx=({endDate:e,filterQuery:t,indexNames:a,skip:r,startDate:s,setQuery:o,type:l})=>{const c=`networkHttpQuery-${l}`,{toggleStatus:u}=Object(Wn.a)(c),[d,p]=Object(n.useState)(r||!u);Object(n.useEffect)((()=>{p(r||!u)}),[r,u]);const[m,{id:b,inspect:g,isInspected:f,loadPage:y,networkHttp:h,pageInfo:v,refetch:E,totalCount:S}]=(({endDate:e,filterQuery:t,id:a,indexNames:i,ip:r,skip:s,startDate:o,type:l})=>{const c=Object(n.useMemo)((()=>kv.e.httpSelector()),[]),{activePage:u,limit:d,sort:p}=Object(j.a)((e=>c(e,l))),[m,b]=Object(n.useState)(null),g=Object(n.useCallback)((e=>{b((t=>t?{...t,pagination:xo(e,d)}:t))}),[d]),{loading:f,result:y,search:h,refetch:v,inspect:E}=Object(ho.a)({factoryQueryType:Vo.r.http,initialResult:{edges:[],totalCount:-1,pageInfo:{activePage:0,fakeTotalCount:0,showMorePagesIndicator:!1}},errorMessage:nx,abort:s}),x=Object(n.useMemo)((()=>({endDate:e,networkHttp:y.edges,id:a,inspect:E,isInspected:!1,loadPage:g,pageInfo:y.pageInfo,refetch:v,startDate:o,totalCount:y.totalCount})),[e,a,E,v,y.edges,y.pageInfo,y.totalCount,o,g]);return Object(n.useEffect)((()=>{b((a=>{const n={...null!=a?a:{},defaultIndex:i,factoryQueryType:Vo.r.http,filterQuery:Object(ul.a)(t),ip:r,pagination:xo(u,d),sort:p,timerange:{interval:"12h",from:o,to:e}};return Ds()(a,n)?a:n}))}),[u,i,e,t,r,d,o,p]),Object(n.useEffect)((()=>{!s&&m&&h(m)}),[m,h,s]),[f,x]})({endDate:e,filterQuery:t,id:c,indexNames:a,skip:d,startDate:s,type:l});return i.a.createElement(ix,{data:h,fakeTotalCount:Object(x.getOr)(50,"fakeTotalCount",v),id:b,inspect:g,isInspect:f,loading:m,loadPage:y,refetch:E,setQuery:o,setQuerySkip:p,showMorePagesIndicator:Object(x.getOr)(!1,"showMorePagesIndicator",v),totalCount:S,type:l})};rx.displayName="HttpQueryTabBody";const sx=e=>$.i18n.translate("xpack.securitySolution.networkTopNFlowTable.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {IP} other {IPs}}"}),ox=$.i18n.translate("xpack.securitySolution.networkTopNFlowTable.column.sourceIpTitle",{defaultMessage:"Source IPs"}),lx=$.i18n.translate("xpack.securitySolution.networkTopNFlowTable.column.destinationIpTitle",{defaultMessage:"Destination IPs"}),cx=$.i18n.translate("xpack.securitySolution.networkTopNFlowTable.column.IpTitle",{defaultMessage:"IP"}),ux=$.i18n.translate("xpack.securitySolution.networkTopNFlowTable.column.domainTitle",{defaultMessage:"Domain"}),dx=$.i18n.translate("xpack.securitySolution.networkTopNFlowTable.column.bytesInTitle",{defaultMessage:"Bytes in"}),px=$.i18n.translate("xpack.securitySolution.networkTopNFlowTable.column.bytesOutTitle",{defaultMessage:"Bytes out"}),mx=$.i18n.translate("xpack.securitySolution.networkTopNFlowTable.column.asTitle",{defaultMessage:"Autonomous system"}),bx=$.i18n.translate("xpack.securitySolution.networkTopNFlowTable.flows",{defaultMessage:"Flows"}),gx=$.i18n.translate("xpack.securitySolution.networkTopNFlowTable.destinationIps",{defaultMessage:"Destination IPs"}),fx=$.i18n.translate("xpack.securitySolution.networkTopNFlowTable.sourceIps",{defaultMessage:"Source IPs"}),yx=$.i18n.translate("xpack.securitySolution.networkTopNFlowTable.rows",{values:{numRows:5},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),hx=$.i18n.translate("xpack.securitySolution.networkTopNFlowTable.rows",{values:{numRows:10},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),vx=e=>e===Vo.g.source?Vo.g.destination:Vo.g.source,Ex=[{text:yx,numberOfRow:5},{text:hx,numberOfRow:10}],xx=({data:e,fakeTotalCount:t,flowTargeted:a,id:r,isInspect:s,loading:l,loadPage:c,setQuerySkip:u,showMorePagesIndicator:d,totalCount:p,type:m})=>{const b=Object(o.useDispatch)(),g=Object(n.useMemo)((()=>kv.e.topNFlowSelector()),[]),{activePage:f,limit:y,sort:h}=Object(j.a)((e=>g(e,m,a))),v=Object(n.useMemo)((()=>((e,t,a)=>{const n=((e,t)=>[{name:cx,render:({node:a})=>{const n=`${e}.ip`,r=Object(x.get)(n,a),s=`${e}.location.geo.country_iso_code[0]`,o=`${e}.geo.country_iso_code`,l=Object(x.get)(s,a),c=Object(za.i)(`${t}-table-${e}-ip-${r}`);return null!=r?i.a.createElement(i.a.Fragment,null,i.a.createElement(Dn.c,{key:c,mode:Dn.a.HOVER_DOWN,visibleCellActions:5,showActionTooltips:!0,triggerId:Dn.d.DEFAULT,data:{value:r,field:n}},i.a.createElement(ge.h,{ip:r,flowTarget:e})),l&&i.a.createElement(Dn.c,{key:`${c}-${l}`,mode:Dn.a.HOVER_DOWN,visibleCellActions:5,showActionTooltips:!0,triggerId:Dn.d.DEFAULT,data:{value:l,field:o}}," ",i.a.createElement(eE.a,{countryCode:l})," ",l)):Object(Bs.d)()},width:"20%"},{name:ux,render:({node:a})=>{const n=`${e}.domain`,i=`${e}.ip`,r=Object(x.get)(n,a),s=Object(x.get)(i,a);if(Array.isArray(r)&&r.length>0){const e=Object(za.i)(`${t}-table-${s}`);return Object(eo.b)({values:r,fieldName:n,idPrefix:e,displayCount:1})}return Object(Bs.d)()},width:"20%"},{name:mx,render:({node:a,cursor:{value:n}})=>{const r=`${e}.autonomous_system`,s=Object(x.get)(r,a);if(null!=s){const a=Object(za.i)(`${t}-table-${e}-ip-${n}`);return i.a.createElement(i.a.Fragment,null,s.name&&Object(eo.b)({values:[s.name],fieldName:`${e}.as.organization.name`,idPrefix:`${a}-name`}),s.number&&i.a.createElement(i.a.Fragment,null," ",Object(eo.b)({values:[`${s.number}`],fieldName:`${e}.as.number`,idPrefix:`${a}-number`})))}return Object(Bs.d)()},width:"20%"},{align:"right",field:"node.network.bytes_in",name:dx,sortable:!0,render:e=>null!=e?i.a.createElement(pE.a,{value:e}):Object(Bs.d)()},{align:"right",field:"node.network.bytes_out",name:px,sortable:!0,render:e=>null!=e?i.a.createElement(pE.a,{value:e}):Object(Bs.d)()},{align:"right",field:`node.${e}.flows`,name:bx,sortable:!0,render:e=>null!=e?di()(e).format("0,000"):Object(Bs.d)()},{align:"right",field:`node.${e}.${vx(e)}_ips`,name:e===Vo.g.source?gx:fx,sortable:!0,render:e=>null!=e?di()(e).format("0,000"):Object(Bs.d)()}])(e,a);return t===kv.c.NetworkType.details?(n.pop(),n):n})(a,m,"networkTopSourceFlow-top-talkers")),[a,m]);let E;const S=a===Vo.g.source?ox:lx;E=m===kv.c.NetworkType.page?a===Vo.g.source?kv.c.NetworkTableType.topNFlowSource:kv.c.NetworkTableType.topNFlowDestination:a===Vo.g.source?kv.c.NetworkDetailsTableType.topNFlowSource:kv.c.NetworkDetailsTableType.topNFlowDestination;const k=Object(n.useCallback)((e=>{if(null!=e.sort){const t=e.sort.field.split("."),a=Object(x.last)(t),n={field:a,direction:a!==h.field?Vo.b.desc:e.sort.direction};Ds()(n,h)||b(kv.b.updateNetworkTable({networkType:m,tableType:E,updates:{sort:n}}))}}),[h,b,m,E]),O=Object(n.useMemo)((()=>({field:h.field===Vo.t.bytes_out||h.field===Vo.t.bytes_in?`node.network.${h.field}`:`node.${a}.${h.field}`,direction:h.direction})),[a,h]),w=Object(n.useCallback)((e=>b(kv.b.updateNetworkTable({networkType:m,tableType:E,updates:{activePage:e}}))),[b,m,E]),T=Object(n.useCallback)((e=>b(kv.b.updateNetworkTable({networkType:m,tableType:E,updates:{limit:e}}))),[b,m,E]);return i.a.createElement(Ys,{activePage:f,columns:v,dataTestSubj:`table-${E}`,headerCount:p,headerTitle:S,headerUnit:sx(p),id:r,isInspect:s,itemsPerRow:Ex,limit:y,loading:l,loadPage:c,onChange:k,pageOfItems:e,setQuerySkip:u,showMorePagesIndicator:d,sorting:O,totalCount:t,updateActivePage:w,updateLimitPagination:T})},jx=i.a.memo(xx),Sx=$.i18n.translate("xpack.securitySolution.networkTopNFlow.failSearchDescription",{defaultMessage:"Failed to run search on network top n flow"}),kx=Object(ft.a)(jx),Ox=({endDate:e,filterQuery:t,flowTarget:a,indexNames:r,ip:s,setQuery:o,skip:l,startDate:c,type:u})=>{const d=`networkTopNFlowQuery-${a}-${u}`,{toggleStatus:p}=Object(Wn.a)(d),[m,b]=Object(n.useState)(l||!p);Object(n.useEffect)((()=>{b(l||!p)}),[l,p]);const[g,{id:f,inspect:y,isInspected:h,loadPage:v,networkTopNFlow:E,pageInfo:S,refetch:k,totalCount:O}]=(({endDate:e,filterQuery:t,flowTarget:a,id:i,indexNames:r,ip:s,skip:o,startDate:l,type:c})=>{const u=Object(n.useMemo)((()=>kv.e.topNFlowSelector()),[]),{activePage:d,limit:p,sort:m}=Object(j.a)((e=>u(e,c,a))),[b,g]=Object(n.useState)(null),f=Object(n.useCallback)((e=>{g((t=>t?{...t,pagination:xo(e,p)}:t))}),[p]),{loading:y,result:h,search:v,refetch:E,inspect:x}=Object(ho.a)({factoryQueryType:Vo.r.topNFlow,initialResult:{edges:[],totalCount:-1,pageInfo:{activePage:0,fakeTotalCount:0,showMorePagesIndicator:!1}},errorMessage:Sx,abort:o}),S=Object(n.useMemo)((()=>({endDate:e,networkTopNFlow:h.edges,id:i,inspect:x,isInspected:!1,loadPage:f,pageInfo:h.pageInfo,refetch:E,startDate:l,totalCount:h.totalCount})),[e,i,x,E,h.edges,h.pageInfo,h.totalCount,l,f]);return Object(n.useEffect)((()=>{g((n=>{const i={...null!=n?n:{},defaultIndex:r,factoryQueryType:Vo.r.topNFlow,filterQuery:Object(ul.a)(t),flowTarget:a,ip:s,pagination:xo(d,p),timerange:{interval:"12h",from:l,to:e},sort:m};return Ds()(n,i)?n:i}))}),[d,e,t,r,s,p,l,m,a]),Object(n.useEffect)((()=>{!o&&b&&v(b)}),[b,v,o]),[y,S]})({endDate:e,flowTarget:a,filterQuery:t,id:d,indexNames:r,ip:s,skip:m,startDate:c,type:u});return i.a.createElement(kx,{data:E,fakeTotalCount:Object(x.getOr)(50,"fakeTotalCount",S),flowTargeted:a,id:f,inspect:y,isInspect:h,loading:g,loadPage:v,refetch:k,setQuery:o,setQuerySkip:b,showMorePagesIndicator:Object(x.getOr)(!1,"showMorePagesIndicator",S),totalCount:O,type:u})};Ox.displayName="IPsQueryTabBody",$.i18n.translate("xpack.securitySolution.networkTls.errorSearchDescription",{defaultMessage:"An error has occurred on network tls search"});const wx=$.i18n.translate("xpack.securitySolution.networkTls.failSearchDescription",{defaultMessage:"Failed to run search on network tls"});var Tx=a(907);const Ix=$.i18n.translate("xpack.securitySolution.network.ipDetails.tlsTable.transportLayerSecurityTitle",{defaultMessage:"Transport Layer Security"}),Cx=e=>$.i18n.translate("xpack.securitySolution.network.ipDetails.tlsTable.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {server certificate} other {server certificates}}"}),Mx=$.i18n.translate("xpack.securitySolution.network.ipDetails.tlsTable.columns.issuerTitle",{defaultMessage:"Issuer"}),_x=$.i18n.translate("xpack.securitySolution.network.ipDetails.tlsTable.columns.subjectTitle",{defaultMessage:"Subject"}),Fx=$.i18n.translate("xpack.securitySolution.network.ipDetails.tlsTable.columns.sha1FingerPrintTitle",{defaultMessage:"SHA1 fingerprint"}),Ax=$.i18n.translate("xpack.securitySolution.network.ipDetails.tlsTable.columns.ja3FingerPrintTitle",{defaultMessage:"JA3 fingerprint"}),Dx=$.i18n.translate("xpack.securitySolution.network.ipDetails.tlsTable.columns.validUntilTitle",{defaultMessage:"Valid until"}),Nx=[{text:$.i18n.translate("xpack.securitySolution.network.ipDetails.tlsTable.rows",{values:{numRows:5},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),numberOfRow:5},{text:$.i18n.translate("xpack.securitySolution.network.ipDetails.tlsTable.rows",{values:{numRows:10},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),numberOfRow:10}],Px=({data:e,fakeTotalCount:t,id:a,isInspect:r,loading:s,loadPage:l,setQuerySkip:c,showMorePagesIndicator:u,totalCount:d,type:p})=>{const m=Object(o.useDispatch)(),b=Object(n.useMemo)((()=>kv.e.tlsSelector()),[]),{activePage:g,limit:f,sort:y}=Object(j.a)((e=>b(e,p))),h=p===kv.c.NetworkType.page?kv.c.NetworkTableType.tls:kv.c.NetworkDetailsTableType.tls,v=Object(n.useCallback)((e=>m(kv.b.updateNetworkTable({networkType:p,tableType:h,updates:{limit:e}}))),[m,p,h]),E=Object(n.useCallback)((e=>m(kv.b.updateNetworkTable({networkType:p,tableType:h,updates:{activePage:e}}))),[m,p,h]),x=Object(n.useCallback)((e=>{if(null!=e.sort){const t=e.sort.field.split("."),a={field:Bx(t[t.length-1]),direction:e.sort.direction};Ds()(a,y)||m(kv.b.updateNetworkTable({networkType:p,tableType:h,updates:{sort:a}}))}}),[y,m,p,h]),S=Object(n.useMemo)((()=>{return e="tls-table",[{field:"node",name:Mx,truncateText:!1,mobileOptions:{show:!0},sortable:!1,render:({_id:t,issuers:a})=>Object(eo.b)({values:a,fieldName:"tls.server.issuer",idPrefix:`${e}-${t}-table-issuers`})},{field:"node",name:_x,truncateText:!1,mobileOptions:{show:!0},sortable:!1,render:({_id:t,subjects:a})=>Object(eo.b)({values:a,fieldName:"tls.server.subject",idPrefix:`${e}-${t}-table-subjects`})},{field:"node._id",name:Fx,truncateText:!1,mobileOptions:{show:!0},sortable:!0,render:t=>Object(eo.b)({values:t?[t]:void 0,fieldName:"tls.server.hash.sha1",idPrefix:`${e}-${t}-table-sha1`})},{field:"node",name:Ax,truncateText:!1,mobileOptions:{show:!0},sortable:!1,render:({_id:t,ja3:a})=>Object(eo.b)({values:a,fieldName:"tls.server.ja3s",idPrefix:`${e}-${t}-table-ja3`})},{field:"node",name:Dx,truncateText:!1,mobileOptions:{show:!0},sortable:!1,render:({_id:t,notAfter:a})=>Object(eo.b)({values:a,fieldName:"tls.server.not_after",idPrefix:`${e}-${t}-table-notAfter`,render:e=>i.a.createElement(Tx.a,{date:qr()(new Date(e)).toDate()},i.a.createElement(qs.c,{value:new Date(e)}))})}];var e}),[]);return i.a.createElement(Ys,{activePage:g,columns:S,dataTestSubj:`table-${h}`,showMorePagesIndicator:u,headerCount:d,headerTitle:Ix,headerUnit:Cx(d),id:a,isInspect:r,itemsPerRow:Nx,limit:f,loading:s,loadPage:l,onChange:x,pageOfItems:e,setQuerySkip:c,sorting:Lx(y),totalCount:t,updateActivePage:E,updateLimitPagination:v})};Px.displayName="TlsTableComponent";const Rx=i.a.memo(Px),Lx=e=>({field:`node.${e.field}`,direction:e.direction}),Bx=e=>Vo.s._id,qx=Object(ft.a)(Rx),zx=({endDate:e,filterQuery:t,flowTarget:a,indexNames:r,ip:s="",setQuery:o,skip:l,startDate:c,type:u})=>{const d=`networkTlsQuery-${u}`,{toggleStatus:p}=Object(Wn.a)(d),[m,b]=Object(n.useState)(l||!p);Object(n.useEffect)((()=>{b(l||!p)}),[l,p]);const[g,{id:f,inspect:y,isInspected:h,tls:v,totalCount:E,pageInfo:S,loadPage:k,refetch:O}]=(({endDate:e,filterQuery:t,flowTarget:a,id:i,indexNames:r,ip:s,skip:o,startDate:l,type:c})=>{const u=Object(n.useMemo)((()=>kv.e.tlsSelector()),[]),{activePage:d,limit:p,sort:m}=Object(j.a)((e=>u(e,c))),[b,g]=Object(n.useState)(null),f=Object(n.useCallback)((e=>{g((t=>t?{...t,pagination:xo(e,p)}:t))}),[p]),{loading:y,result:h,search:v,refetch:E,inspect:x}=Object(ho.a)({factoryQueryType:Rv.g.tls,initialResult:{edges:[],totalCount:-1,pageInfo:{activePage:0,fakeTotalCount:0,showMorePagesIndicator:!1}},errorMessage:wx,abort:o}),S=Object(n.useMemo)((()=>({endDate:e,tls:h.edges,id:i,inspect:x,isInspected:!1,loadPage:f,pageInfo:h.pageInfo,refetch:E,startDate:l,totalCount:h.totalCount})),[e,i,x,E,h.edges,h.pageInfo,h.totalCount,l,f]);return Object(n.useEffect)((()=>{g((n=>{const i={...null!=n?n:{},defaultIndex:r,factoryQueryType:Rv.g.tls,filterQuery:Object(ul.a)(t),flowTarget:a,ip:s,pagination:xo(d,p),timerange:{interval:"12h",from:l,to:e},sort:m};return Ds()(n,i)?n:i}))}),[d,r,e,t,p,l,m,a,s,i]),Object(n.useEffect)((()=>{!o&&b&&v(b)}),[b,v,o]),[y,S]})({endDate:e,filterQuery:t,flowTarget:a,id:d,indexNames:r,ip:s,skip:m,startDate:c,type:u});return i.a.createElement(qx,{data:v,id:f,inspect:y,isInspect:h,fakeTotalCount:Object(x.getOr)(50,"fakeTotalCount",S),loading:g,loadPage:k,showMorePagesIndicator:Object(x.getOr)(!1,"showMorePagesIndicator",S),refetch:O,setQuery:o,setQuerySkip:b,totalCount:E,type:u})};zx.displayName="TlsQueryTabBodyComponent";const $x=i.a.memo(zx),Vx=($.i18n.translate("xpack.securitySolution.networkUsers.errorSearchDescription",{defaultMessage:"An error has occurred on network users search"}),$.i18n.translate("xpack.securitySolution.networkUsers.failSearchDescription",{defaultMessage:"Failed to run search on network users"}));var Ux=a(145);const Hx=$.i18n.translate("xpack.securitySolution.network.ipDetails.usersTable.usersTitle",{defaultMessage:"Users"}),Gx=e=>$.i18n.translate("xpack.securitySolution.network.ipDetails.usersTable.unit",{values:{totalCount:e},defaultMessage:"{totalCount, plural, =1 {user} other {users}}"}),Qx=$.i18n.translate("xpack.securitySolution.network.ipDetails.usersTable.columns.userNameTitle",{defaultMessage:"User"}),Wx=$.i18n.translate("xpack.securitySolution.network.ipDetails.usersTable.columns.userIdTitle",{defaultMessage:"ID"}),Kx=$.i18n.translate("xpack.securitySolution.network.ipDetails.usersTable.columns.groupNameTitle",{defaultMessage:"Group name"}),Yx=$.i18n.translate("xpack.securitySolution.network.ipDetails.usersTable.columns.groupIdTitle",{defaultMessage:"Group ID"}),Jx=$.i18n.translate("xpack.securitySolution.network.ipDetails.usersTable.columns.documentCountTitle",{defaultMessage:"Document count"}),Xx=$.i18n.translate("xpack.securitySolution.network.ipDetails.usersTable.rows",{values:{numRows:5},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),Zx=$.i18n.translate("xpack.securitySolution.network.ipDetails.usersTable.rows",{values:{numRows:10},defaultMessage:"{numRows} {numRows, plural, =0 {rows} =1 {row} other {rows}}"}),ej=kv.c.NetworkDetailsTableType.users,tj=[{text:Xx,numberOfRow:5},{text:Zx,numberOfRow:10}],aj="users-table",nj=({data:e,fakeTotalCount:t,flowTarget:a,id:r,isInspect:s,loading:l,loadPage:c,setQuerySkip:u,showMorePagesIndicator:d,totalCount:p,type:m})=>{const b=Object(o.useDispatch)(),g=Object(n.useMemo)((()=>kv.e.usersSelector()),[]),{activePage:f,sort:y,limit:h}=Object(j.a)(g),v=Object(n.useCallback)((e=>b(kv.b.updateNetworkTable({networkType:m,tableType:ej,updates:{limit:e}}))),[b,m]),E=Object(n.useCallback)((e=>b(kv.b.updateNetworkTable({networkType:m,tableType:ej,updates:{activePage:e}}))),[b,m]),x=Object(n.useCallback)((e=>{if(null!=e.sort){const t=e.sort.field.split("."),a={field:sj(t[t.length-1]),direction:e.sort.direction};Ds()(a,y)||b(kv.b.updateNetworkTable({networkType:m,tableType:ej,updates:{sort:a}}))}}),[b,y,m]),S=Object(n.useMemo)((()=>((e,t)=>[{field:"node.user.name",name:Qx,truncateText:!1,mobileOptions:{show:!0},sortable:!0,render:a=>Object(eo.b)({values:a?[a]:void 0,fieldName:"user.name",idPrefix:`${t}-table-${e}-user`})},{field:"node.user.id",name:Wx,truncateText:!1,mobileOptions:{show:!0},sortable:!1,render:a=>Object(eo.b)({values:a,fieldName:"user.id",idPrefix:`${t}-table-${e}`})},{field:"node.user.groupName",name:Kx,truncateText:!1,mobileOptions:{show:!0},sortable:!1,render:a=>Object(eo.b)({values:a,fieldName:"user.group.name",idPrefix:`${t}-table-${e}`})},{field:"node.user.groupId",name:Yx,truncateText:!1,mobileOptions:{show:!0},sortable:!1,render:a=>Object(eo.b)({values:a,fieldName:"user.group.id",idPrefix:`${t}-table-${e}`})},{align:"right",field:"node.user.count",name:Jx,truncateText:!1,mobileOptions:{show:!0},sortable:!0,render:e=>Object(Bs.a)(e)}])(a,aj)),[a,aj]);return i.a.createElement(Ys,{activePage:f,columns:S,dataTestSubj:`table-${ej}`,showMorePagesIndicator:d,headerCount:p,headerTitle:Hx,headerUnit:Gx(p),id:r,isInspect:s,itemsPerRow:tj,limit:h,loading:l,loadPage:c,onChange:x,pageOfItems:e,setQuerySkip:u,sorting:rj(y),totalCount:t,updateActivePage:E,updateLimitPagination:v})};nj.displayName="UsersTableComponent";const ij=i.a.memo(nj),rj=e=>{switch(e.field){case Vo.u.name:case Vo.u.count:return{field:`node.user.${e.field}`,direction:e.direction}}return Object(Ux.a)(e.field)},sj=e=>{switch(e){case Vo.u.name.valueOf():return Vo.u.name;case Vo.u.count.valueOf():return Vo.u.count;default:return Vo.u.name}},oj=Object(ft.a)(ij),lj=({endDate:e,filterQuery:t,flowTarget:a,ip:r,setQuery:o,skip:l,startDate:c,type:u})=>{const d=`networkUsersQuery-${u}`,{toggleStatus:p}=Object(Wn.a)(d),[b,g]=Object(n.useState)(l||!p);Object(n.useEffect)((()=>{g(l||!p)}),[l,p]);const[f,{id:y,inspect:h,isInspected:v,networkUsers:E,totalCount:S,pageInfo:k,loadPage:O,refetch:w}]=(({endDate:e,filterQuery:t,flowTarget:a,id:i,ip:r,skip:o,startDate:l})=>{const c=Object(n.useMemo)((()=>kv.e.usersSelector()),[]),{activePage:u,sort:d,limit:p}=Object(j.a)(c),{uiSettings:b}=Object(m.j)().services,g=b.get(s.H),[f,y]=Object(n.useState)(null),h=Object(n.useCallback)((e=>{y((t=>t?{...t,pagination:xo(e,p)}:t))}),[p]),{loading:v,result:E,search:x,refetch:S,inspect:k}=Object(ho.a)({factoryQueryType:Rv.g.users,initialResult:{edges:[],totalCount:-1,pageInfo:{activePage:0,fakeTotalCount:0,showMorePagesIndicator:!1}},errorMessage:Vx,abort:o}),O=Object(n.useMemo)((()=>({endDate:e,networkUsers:E.edges,id:i,inspect:k,isInspected:!1,loadPage:h,pageInfo:E.pageInfo,refetch:S,startDate:l,totalCount:E.totalCount})),[e,i,k,S,E.edges,E.pageInfo,E.totalCount,l,h]);return Object(n.useEffect)((()=>{y((n=>{const i={...null!=n?n:{},ip:r,defaultIndex:g,factoryQueryType:Rv.g.users,filterQuery:Object(ul.a)(t),flowTarget:a,pagination:xo(u,p),sort:d,timerange:{interval:"12h",from:l,to:e}};return Ds()(n,i)?n:i}))}),[u,g,e,t,p,l,d,r,a]),Object(n.useEffect)((()=>{!o&&f&&x(f)}),[f,x,o]),[v,O]})({endDate:e,filterQuery:t,flowTarget:a,id:d,ip:r,skip:b,startDate:c});return i.a.createElement(oj,{data:E,id:y,inspect:h,isInspect:v,flowTarget:a,fakeTotalCount:Object(x.getOr)(50,"fakeTotalCount",k),loading:f,loadPage:O,showMorePagesIndicator:Object(x.getOr)(!1,"showMorePagesIndicator",k),refetch:w,setQuery:o,setQuerySkip:g,totalCount:S,type:u})};lj.displayName="UsersQueryTable";const cj=i.a.memo((({flowTarget:e,indexPattern:t,networkDetailsFilter:a,...n})=>{const r={...n,type:kv.c.NetworkType.details},s={...r,indexPattern:t},o={...r,flowTarget:e};return i.a.createElement(q.c,null,i.a.createElement(q.a,{path:`${Gv}/:flowTarget/:tabName(${wv.a.flows})`},i.a.createElement(i.a.Fragment,null,i.a.createElement(Wv,{direction:"column"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(Ox,Ni()({},s,{flowTarget:Rv.b.source}))),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(Ox,Ni()({},s,{flowTarget:Rv.b.destination})))),i.a.createElement(U.EuiSpacer,null),i.a.createElement(Wv,{direction:"column"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(vE,Ni()({},s,{flowTarget:Rv.b.source}))),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(vE,Ni()({},s,{flowTarget:Rv.b.destination})))))),i.a.createElement(q.a,{path:`${Gv}/:flowTarget/:tabName(${wv.a.users})`},i.a.createElement(lj,o)),i.a.createElement(q.a,{path:`${Gv}/:flowTarget/:tabName(${wv.a.http})`},i.a.createElement(rx,r)),i.a.createElement(q.a,{path:`${Gv}/:flowTarget/:tabName(${wv.a.tls})`},i.a.createElement($x,o)),i.a.createElement(q.a,{path:`${Gv}/:flowTarget/:tabName(${wv.a.anomalies})`},i.a.createElement(_l,Ni()({},o,{hideHistogramIfEmpty:!0,AnomaliesTableComponent:Pv}))),i.a.createElement(q.a,{path:`${Gv}/:flowTarget/:tabName(${wv.a.events})`},i.a.createElement(Sp,Ni()({additionalFilters:a},r,{tableId:R.e.networkPageEvents}))))}));cj.displayName="UsersDetailsTabs";const uj=Object(ft.a)(Ev.a),dj=()=>{const e=Object(o.useDispatch)(),t=Object(io.a)(),{to:a,from:r,setQuery:s,isInitializing:l}=Object(J.a)(),{detailName:c,flowTarget:u}=Object(B.useParams)(),d=Object(n.useMemo)((()=>Vr.d.globalQuerySelector()),[]),p=Object(n.useMemo)((()=>Vr.d.globalFiltersQuerySelector()),[]),{signalIndexName:b}=Object(fb.a)(),{hasKibanaREAD:f,hasIndexRead:y}=Object(Rr.a)(),v=f&&y,x=Object(j.a)(d),k=Object(j.a)(p),O=kv.c.NetworkType.details,w=Object(n.useCallback)(((t,a)=>{const n=Object(Cf.a)(t,a);e(Object(ae.setAbsoluteRangeDatePicker)({id:Y.a.global,from:n.from,to:n.to}))}),[e]),{services:{uiSettings:T}}=Object(m.j)();Object(n.useEffect)((()=>{e(Object(Sv.setNetworkDetailsTablesActivePageToZero)())}),[c,e]);const{indicesExist:I,indexPattern:C,selectedPatterns:M}=Object(g.d)(),_=Object(jv.b)(c),F=Object(n.useMemo)((()=>Object(qp.e)(_)),[_]),[A,D]=Object(n.useMemo)((()=>{try{return[Object(bt.buildEsQuery)(C,[x],[...F,...k],Object(Ms.getEsQueryConfig)(T))]}catch(e){return[void 0,e]}}),[k,C,F,x,T]),N=JSON.stringify(A);Object(Cp.a)({id:xv.a,filterQuery:N,kqlError:D,query:x,startDate:r,endDate:a});const[P,{id:R,inspect:L,networkDetails:q,refetch:z}]=Object(xv.b)({skip:l,filterQuery:N,indexNames:M,ip:_}),{jobNameById:$}=Object(El.a)(),V=Object(n.useMemo)((()=>Object.keys($)),[$]),[H,G]=Object(Fl.a)({criteriaFields:Object(ov.a)(c,u),startDate:r,endDate:a,skip:l,jobIds:V,aggregationInterval:"auto"}),Q=Object(n.useMemo)((()=>({field:`${u}.ip`,value:c})),[c,u]);return i.a.createElement("div",{"data-test-subj":"network-details-page"},I?i.a.createElement(i.a.Fragment,null,i.a.createElement(X.a,null,i.a.createElement(ee.a,{indexPattern:C,id:Y.a.global})),i.a.createElement(h.a,null,i.a.createElement(Ci.a,{border:!0,"data-test-subj":"network-details-headline",subtitle:i.a.createElement(zs,{indexKey:Vo.k.ipDetails,indexNames:M,ip:_}),title:i.a.createElement(Dn.c,{data:{value:_,field:`${u}.ip`},mode:Dn.a.HOVER_DOWN,visibleCellActions:5,triggerId:Dn.d.DEFAULT},_)},i.a.createElement(vv,{flowTarget:u})),i.a.createElement(uj,{id:R,inspect:L,ip:_,isInDetailsSidePanel:!1,data:q,anomaliesData:G,loading:P,isLoadingAnomaliesData:H,type:O,flowTarget:u,refetch:z,setQuery:s,startDate:r,endDate:a,narrowDateRange:w,indexPatterns:M,jobNameById:$}),i.a.createElement(U.EuiHorizontalRule,null),i.a.createElement(U.EuiSpacer,null),v&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiFlexGroup,null,i.a.createElement(U.EuiFlexItem,null,i.a.createElement(gb,{signalIndexName:b,entityFilter:Q,additionalFilters:A?[A]:[]})),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(Fb,{entityFilter:Q,signalIndexName:b,additionalFilters:A?[A]:[]}))),i.a.createElement(U.EuiSpacer,null)),i.a.createElement(_s.a,{navTabs:Iv(_,Object(Al.a)(t),u)}),i.a.createElement(U.EuiSpacer,null),i.a.createElement(cj,{ip:_,endDate:a,startDate:r,filterQuery:N,indexNames:M,skip:l||!!D,setQuery:s,indexPattern:C,flowTarget:u,networkDetailsFilter:F}))):i.a.createElement(Mi.a,null),i.a.createElement(E.a,{pageName:S.a.network}))};dj.displayName="NetworkDetailsComponent";const pj=i.a.memo(dj);var mj=a(365),bj=a(501),gj=a(240),fj=a.n(gj),yj=a(96);const hj=$.i18n.translate("xpack.securitySolution.components.embeddables.embeddedMap.embeddableHeaderTitle",{defaultMessage:"Network map"}),vj=$.i18n.translate("xpack.securitySolution.components.embeddables.embeddedMap.embeddableHeaderHelp",{defaultMessage:"Map configuration help"}),Ej=$.i18n.translate("xpack.securitySolution.components.embeddables.embeddedMap.embeddablePanelTitle",{defaultMessage:"Source -> Destination Point-to-Point Map"}),xj=$.i18n.translate("xpack.securitySolution.components.embeddables.embeddedMap.sourceLayerLabel",{defaultMessage:"Source Point"}),jj=$.i18n.translate("xpack.securitySolution.components.embeddables.embeddedMap.destinationLayerLabel",{defaultMessage:"Destination Point"}),Sj=$.i18n.translate("xpack.securitySolution.components.embeddables.embeddedMap.clientLayerLabel",{defaultMessage:"Client Point"}),kj=$.i18n.translate("xpack.securitySolution.components.embeddables.embeddedMap.serverLayerLabel",{defaultMessage:"Server Point"}),Oj=$.i18n.translate("xpack.securitySolution.components.embeddables.embeddedMap.lineLayerLabel",{defaultMessage:"Line"}),wj=$.i18n.translate("xpack.securitySolution.components.embeddables.embeddedMap.errorCreatingMapEmbeddableTitle",{defaultMessage:"Error creating Map Embeddable"}),Tj=$.i18n.translate("xpack.securitySolution.components.embeddables.indexPatternsMissingPrompt.errorTitle",{defaultMessage:"Required index patterns not configured"}),Ij=$.i18n.translate("xpack.securitySolution.components.embeddables.indexPatternsMissingPrompt.errorButtonLabel",{defaultMessage:"Configure index patterns"}),Cj=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.errorTitle",{defaultMessage:"Error loading map features"}),Mj=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.pointContent.hostTitle",{defaultMessage:"Host"}),_j=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.pointContent.sourceIPTitle",{defaultMessage:"Source IP"}),Fj=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.pointContent.destinationIPTitle",{defaultMessage:"Destination IP"}),Aj=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.pointContent.clientIPTitle",{defaultMessage:"Client IP"}),Dj=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.pointContent.serverIPTitle",{defaultMessage:"Server IP"}),Nj=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.pointContent.sourceDomainTitle",{defaultMessage:"Source domain"}),Pj=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.pointContent.destinationDomainTitle",{defaultMessage:"Destination domain"}),Rj=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.pointContent.clientDomainTitle",{defaultMessage:"Client domain"}),Lj=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.pointContent.serverDomainTitle",{defaultMessage:"Server domain"}),Bj=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.pointContent.locationTitle",{defaultMessage:"Location"}),qj=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.pointContent.asnTitle",{defaultMessage:"ASN"}),zj=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.lineContent.sourceLabel",{defaultMessage:"Source"}),$j=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.lineContent.destinationLabel",{defaultMessage:"Destination"}),Vj=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.lineContent.clientLabel",{defaultMessage:"Client"}),Uj=$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.lineContent.serverLabel",{defaultMessage:"Server"}),Hj=Object(U.euiPaletteColorBlind)(),Gj={"host.name":Mj,"source.ip":_j,"source.domain":Nj,"source.geo.country_iso_code":Bj,"source.as.organization.name":qj},Qj={"host.name":Mj,"destination.ip":Fj,"destination.domain":Pj,"destination.geo.country_iso_code":Bj,"destination.as.organization.name":qj},Wj={"host.name":Mj,"client.ip":Aj,"client.domain":Rj,"client.geo.country_iso_code":Bj,"client.as.organization.name":qj},Kj={"host.name":Mj,"server.ip":Dj,"server.domain":Lj,"server.geo.country_iso_code":Bj,"server.as.organization.name":qj},Yj={...Gj,...Qj,...Wj,...Kj},Jj="sum_of_source.bytes",Xj={source:{metricField:"client.bytes",geoField:"client.geo.location",tooltipProperties:Object.keys(Wj),label:Sj},destination:{metricField:"server.bytes",geoField:"server.geo.location",tooltipProperties:Object.keys(Kj),label:kj}},Zj={default:{source:{metricField:"source.bytes",geoField:"source.geo.location",tooltipProperties:Object.keys(Gj),label:xj},destination:{metricField:"destination.bytes",geoField:"destination.geo.location",tooltipProperties:Object.keys(Qj),label:jj}},"apm-*":Xj,"traces-apm*,logs-apm*,metrics-apm*,apm-*":Xj},eS=e=>[{sourceDescriptor:{type:yj.SOURCE_TYPES.EMS_TMS,isAutoSelect:!0},id:Object(nt.v4)(),label:null,minZoom:0,maxZoom:24,alpha:1,visible:!0,style:null,type:yj.LAYER_TYPE.EMS_VECTOR_TILE},...e.reduce(((e,{title:t,id:a})=>{var n,i,r,s,o;const l={id:Object(nt.v4)(),label:t,sourceDescriptor:null,type:yj.LAYER_TYPE.LAYER_GROUP,visible:!0};return[...e,nS(t,a,l.id,null!==(n=Zj[t])&&void 0!==n?n:Zj.default),aS(t,a,l.id,null!==(i=null===(r=Zj[t])||void 0===r?void 0:r.destination)&&void 0!==i?i:Zj.default.destination),tS(t,a,l.id,null!==(s=null===(o=Zj[t])||void 0===o?void 0:o.source)&&void 0!==s?s:Zj.default.source),l]}),[])],tS=(e,t,a,n)=>({sourceDescriptor:{id:Object(nt.v4)(),type:"ES_SEARCH",applyGlobalQuery:!0,geoField:n.geoField,filterByMapBounds:!1,tooltipProperties:n.tooltipProperties,useTopHits:!1,topHitsTimeField:"@timestamp",topHitsSize:1,indexPatternId:t},style:{type:"VECTOR",properties:{fillColor:{type:"STATIC",options:{color:Hj[1]}},lineColor:{type:"STATIC",options:{color:"#FFFFFF"}},lineWidth:{type:"STATIC",options:{size:2}},iconSize:{type:"STATIC",options:{size:8}},iconOrientation:{type:"STATIC",options:{orientation:0}},symbolizeAs:{options:{value:"icon"}},icon:{type:"STATIC",options:{value:"home"}}}},id:Object(nt.v4)(),parent:a,label:`${e} | ${n.label}`,minZoom:0,maxZoom:24,alpha:1,visible:!0,type:yj.LAYER_TYPE.GEOJSON_VECTOR,query:{query:"",language:"kuery"},joins:[]}),aS=(e,t,a,n)=>({sourceDescriptor:{id:Object(nt.v4)(),type:"ES_SEARCH",scalingType:yj.SCALING_TYPES.LIMIT,applyGlobalQuery:!0,geoField:n.geoField,filterByMapBounds:!0,tooltipProperties:n.tooltipProperties,useTopHits:!1,topHitsTimeField:"@timestamp",topHitsSize:1,indexPatternId:t},style:{type:"VECTOR",properties:{fillColor:{type:"STATIC",options:{color:Hj[2]}},lineColor:{type:"STATIC",options:{color:"#FFFFFF"}},lineWidth:{type:"STATIC",options:{size:2}},iconSize:{type:"STATIC",options:{size:8}},iconOrientation:{type:"STATIC",options:{orientation:0}},symbolizeAs:{options:{value:"icon"}},icon:{type:"STATIC",options:{value:"marker"}}}},id:Object(nt.v4)(),parent:a,label:`${e} | ${n.label}`,minZoom:0,maxZoom:24,alpha:1,visible:!0,type:yj.LAYER_TYPE.GEOJSON_VECTOR,query:{query:"",language:"kuery"}}),nS=(e,t,a,n)=>({sourceDescriptor:{type:yj.SOURCE_TYPES.ES_PEW_PEW,applyGlobalQuery:!0,id:Object(nt.v4)(),indexPatternId:t,sourceGeoField:n.source.geoField,destGeoField:n.destination.geoField,metrics:[{type:"sum",field:n.source.metricField,label:n.source.metricField},{type:"sum",field:n.destination.metricField,label:n.destination.metricField}]},style:{type:"VECTOR",properties:{fillColor:{type:"STATIC",options:{color:"#1EA593"}},lineColor:{type:"STATIC",options:{color:Hj[1]}},lineWidth:{type:"DYNAMIC",options:{field:{label:"count",name:"doc_count",origin:"source"},minSize:1,maxSize:8,fieldMetaOptions:{isEnabled:!0,sigma:3}}},iconSize:{type:"STATIC",options:{size:10}},iconOrientation:{type:"STATIC",options:{orientation:0}},symbolizeAs:{options:{value:"icon"}},icon:{type:"STATIC",options:{value:"airfield"}}}},id:Object(nt.v4)(),parent:a,label:`${e} | ${Oj}`,minZoom:0,maxZoom:24,alpha:.5,visible:!0,type:yj.LAYER_TYPE.GEOJSON_VECTOR,query:{query:"",language:"kuery"}}),iS=G()(U.EuiPanel).withConfig({displayName:"Panel",componentId:"sc-10c2ivb-0"})(["overflow:hidden;"]);iS.displayName="Panel";const rS=i.a.memo((({children:e})=>i.a.createElement("section",{className:"siemEmbeddable","data-test-subj":"siemEmbeddable"},i.a.createElement(iS,{paddingSize:"none",hasBorder:!0},e))));rS.displayName="Embeddable";var sS=a(97);const oS=()=>{const{docLinks:e}=Object(m.j)().services,t=`${Object(m.d)()}/app`;return i.a.createElement(U.EuiEmptyPrompt,{iconType:"gisApp",title:i.a.createElement("h2",null,Tj),titleSize:"xs",body:i.a.createElement(i.a.Fragment,null,i.a.createElement("p",null,i.a.createElement(Fs.FormattedMessage,{defaultMessage:"To display map data, you must define SIEM indices ({defaultIndex}) and Kibana index patterns with matching glob patterns. When using {beats}, you can run the {setup} command on your hosts to automatically create the index patterns. For example: {example}.",id:"xpack.securitySolution.components.embeddables.indexPatternsMissingPrompt.errorDescription1",values:{defaultIndex:i.a.createElement("a",{href:`${t}/management/kibana/settings`,rel:"noopener noreferrer",target:"_blank"},"securitySolution:defaultIndex"),beats:i.a.createElement("a",{href:`${e.links.libbeat.getStarted}`,rel:"noopener noreferrer",target:"_blank"},"beats"),setup:i.a.createElement(U.EuiCode,null,"setup"),example:i.a.createElement(U.EuiCode,null,"./packetbeat setup")}})),i.a.createElement("p",null,i.a.createElement(Fs.FormattedMessage,{defaultMessage:"You can also configure index patterns manually in Kibana.",id:"xpack.securitySolution.components.embeddables.indexPatternsMissingPrompt.errorDescription2"}))),actions:i.a.createElement(U.EuiButton,{href:`${t}/management/kibana/dataViews`,color:"primary",target:"_blank",fill:!0},Ij)})};oS.displayName="IndexPatternsMissingPromptComponent";const lS=i.a.memo(oS);lS.displayName="IndexPatternsMissingPrompt",G()(U.EuiIcon).withConfig({displayName:"Icon",componentId:"sc-1qkenu9-0"})(["margin-right:",";"],Jb.euiLightVars.euiSizeS).displayName="Icon";const cS=({featureIndex:e,totalFeatures:t,previousFeature:a,nextFeature:n})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiHorizontalRule,{margin:"s"}),i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceBetween",alignItems:"center",gutterSize:"xs"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiText,{size:"xs"},((e,t)=>$.i18n.translate("xpack.securitySolution.components.embeddables.mapToolTip.footerLabel",{values:{currentFeature:e,totalFeatures:t},defaultMessage:"{currentFeature} of {totalFeatures} {totalFeatures, plural, =1 {feature} other {features}}"}))(e+1,t))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement("span",null,i.a.createElement(U.EuiButtonIcon,{"data-test-subj":"previous-feature-button",color:"text",onClick:a,iconType:"arrowLeft","aria-label":"Next",isDisabled:e<=0}),i.a.createElement(U.EuiButtonIcon,{"data-test-subj":"next-feature-button",color:"text",onClick:n,iconType:"arrowRight","aria-label":"Next",isDisabled:e>=t-1})))));cS.displayName="ToolTipFooterComponent";const uS=i.a.memo(cS);uS.displayName="ToolTipFooter";var dS=a(532);const pS=G()(U.EuiBadge).withConfig({displayName:"FlowBadge",componentId:"sc-c1u5cx-0"})(["height:45px;min-width:85px;"]),mS=G()(U.EuiFlexGroup).withConfig({displayName:"EuiFlexGroupStyled",componentId:"sc-c1u5cx-1"})(["margin:0 auto;"]),bS=({contextId:e,featureProps:t})=>{const a=t.reduce(((e,t)=>{var a;const n=null!==(a=t.getRawValue())&&void 0!==a?a:[];return{...e,[t.getPropertyKey()]:Array.isArray(n)?n:[n]}}),{}),n=Object.keys(a).includes(Jj);return i.a.createElement(U.EuiFlexGroup,{justifyContent:"center",gutterSize:"none"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(pS,{color:"hollow"},i.a.createElement(mS,{direction:"column"},i.a.createElement(U.EuiFlexItem,{grow:!1},n?zj:Vj)))),i.a.createElement(dS.e,{contextId:e,destinationBytes:n?a["sum_of_destination.bytes"]:a["sum_of_server.bytes"],eventId:`map-line-tooltip-${e}`,sourceBytes:n?a[Jj]:a["sum_of_client.bytes"]}),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(pS,{color:"hollow"},i.a.createElement(mS,null,i.a.createElement(U.EuiFlexItem,{grow:!1},n?$j:Uj)))))};bS.displayName="LineToolTipContentComponent";const gS=i.a.memo(bS);gS.displayName="LineToolTipContent";var fS=a(168);const yS=({contextId:e,featureProps:t})=>{const a=Object(n.useMemo)((()=>t.map((t=>{var a;const n=t.getPropertyKey(),r=null!==(a=t.getRawValue())&&void 0!==a?a:[];return{title:Yj[n],description:i.a.createElement(i.a.Fragment,null,null!=r?i.a.createElement(fv.a,{rowItems:Array.isArray(r)?r:[r],attrName:n,idPrefix:`map-point-tooltip-${e}-${n}-${r}`,render:e=>vS(n,e)}):Object(Bs.d)())}}))),[e,t]);return i.a.createElement(fS.d,{listItems:a})};yS.displayName="PointToolTipContentComponent";const hS=i.a.memo(yS);hS.displayName="PointToolTipContent";const vS=(e,t)=>{if(""===t)return Object(Bs.f)(t);if(["host.name"].includes(e))return i.a.createElement(ge.d,{hostName:t});if(["source.ip","destination.ip"].includes(e)){const a=e.split(".")[0];return i.a.createElement(ge.h,{ip:t,flowTarget:a})}return i.a.createElement(i.a.Fragment,null,t)},ES=({closeTooltip:e,features:t=[],getLayerName:a,loadFeatureProperties:r,loadFeatureGeometry:s})=>{const[o,l]=Object(n.useState)(!0),[c,u]=Object(n.useState)(!1),[d,p]=Object(n.useState)(!1),[m,b]=Object(n.useState)(0),[g,f]=Object(n.useState)([]),[y,h]=Object(n.useState)(null),[,v]=Object(n.useState)(""),E=Object(n.useCallback)((()=>{null!=e&&(e(),b(0))}),[e]),x=Object(n.useCallback)((()=>{b((e=>e-1)),u(!0)}),[]),j=Object(n.useCallback)((()=>{b((e=>e+1)),u(!0)}),[]),S=Object(n.useMemo)((()=>d?i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceAround"},i.a.createElement(U.EuiFlexItem,{grow:!1},Cj)):o&&!c?i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceAround"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiLoadingSpinner,{size:"m"}))):i.a.createElement("div",null,null!=y&&"LineString"===y.type?i.a.createElement(gS,{contextId:`${t[m].layerId}-${t[m].id}-${m}`,featureProps:g}):i.a.createElement(hS,{contextId:`${t[m].layerId}-${t[m].id}-${m}`,featureProps:g}),t.length>1&&i.a.createElement(uS,{featureIndex:m,totalFeatures:t.length,previousFeature:x,nextFeature:j}),c&&i.a.createElement($s.a,{"data-test-subj":"loading-panel",overlay:!0,size:"m"}))),[y,m,g,t,j,x,d,o,c]);return Object(n.useEffect)((()=>{0!==t.length&&null!=a&&null!=r&&null!=s&&(c||l(!0),p(!1),(async()=>{if(null!=t[m]){const e=t[m].layerId,n=t[m].id;try{const i=s({layerId:e,featureId:n}),[o,l]=await Promise.all([r({layerId:e,properties:t[m].mbProperties}),a(e)]);f(o),h(i),l&&v(l)}catch(e){p(!0)}finally{l(!1),u(!1)}}})())}),[m,t,a,c,s,r]),i.a.createElement(U.EuiOutsideClickDetector,{onOutsideClick:E},S)};ES.displayName="MapToolTipComponent";const xS=i.a.memo(ES);xS.displayName="MapToolTip";const jS="network_map_visbile",SS=G.a.div.attrs((()=>({className:"siemEmbeddable__map"}))).withConfig({displayName:"EmbeddableMap",componentId:"sc-128e6d0-0"})([".embPanel{border:none;box-shadow:none;}.mapToolbarOverlay__button{display:none;}",""],(({maintainRatio:e})=>e&&Object(H.css)(["padding-top:calc(3 / 4 * 100%);position:relative;@media only screen and (min-width:","){padding-top:calc(9 / 32 * 100%);}@media only screen and (min-width:1441px) and (min-height:901px){padding-top:calc(9 / 21 * 100%);}.embPanel{bottom:0;left:0;position:absolute;right:0;top:0;}"],(({theme:e})=>e.eui.euiBreakpoints.m)))),kS=G()(U.EuiText).withConfig({displayName:"StyledEuiText",componentId:"sc-128e6d0-1"})(["margin-right:16px;"]),OS=G()(U.EuiAccordion).withConfig({displayName:"StyledEuiAccordion",componentId:"sc-128e6d0-2"})(["& .euiAccordion__triggerWrapper{padding:16px;}"]);SS.displayName="EmbeddableMap";const wS=({endDate:e,filters:t,query:a,setQuery:r,startDate:s})=>{var o;const[l,c]=i.a.useState(void 0),{services:u}=Object(m.j)(),{storage:d}=u,[p,b]=Object(n.useState)(!1),[y,h]=Object(n.useState)(!1),[v,E]=Object(n.useState)(null===(o=d.get(jS))||void 0===o||o),{addError:S}=Object(rs.a)(),k=Object(n.useMemo)((()=>Ym.d.getSourcererDataViewsSelector()),[]),{kibanaDataViews:O}=Object(j.a)((e=>k(e))),{selectedPatterns:w}=Object(g.d)(f.SourcererScopeName.default),T=(()=>{const{dataViews:e}=Object(m.j)().services.data;return Object(n.useMemo)((()=>fj()((async t=>{const a=(e=>{var t;const a=null!==(t=Zj[e])&&void 0!==t?t:Zj.default;return[a.source.metricField,a.source.geoField,a.destination.metricField,a.destination.geoField]})(t),n=(await e.getFieldsForWildcard({pattern:t,fields:a})).map((e=>e.name));return a.every((e=>n.includes(e)))}),((e,t)=>e[0]===t[0]))),[e])})(),[I,C]=Object(n.useState)([]),[M,_]=Object(n.useState)([]);Object(n.useEffect)((()=>{let e=!1;return M.length&&(async()=>{try{const t=await Promise.all(M.map((async({title:e})=>T(e)))),a=M.filter(((e,a)=>{var n;return null!==(n=t[a])&&void 0!==n&&n}));e||C(a)}catch(t){e||(C([]),S(t,{title:wj}),b(!0))}})(),()=>{e=!0}}),[S,M,T]),Object(n.useEffect)((()=>{const e=O.filter((e=>w.includes(e.title)));w.length>0&&0===e.length&&h(!0),_((t=>Object(x.isEqual)(t,e)?t:e))}),[O,w]);const F=i.a.useMemo((()=>Object(mj.c)()),[]);Object(n.useEffect)((()=>{let n=!0;return null==l&&w.length>0&&!y&&async function(){try{const o=await(async(e,t,a,n,r,s,o,l)=>{const c=l.getEmbeddableFactory(sS.MAP_SAVED_OBJECT_TYPE);if(!c)throw new Error("Map embeddable factory undefined");const u={title:Ej,attributes:{title:""},id:Object(nt.v4)(),filters:e,hidePanelTitles:!0,query:a,timeRange:{from:new Date(n).toISOString(),to:new Date(r).toISOString()},viewMode:Ki.ViewMode.VIEW,isLayerTOCOpen:!1,openTOCDetails:[],hideFilterActions:!1,mapCenter:{lon:-1.05469,lat:15.96133,zoom:1},disabledActions:["CUSTOM_TIME_RANGE","CUSTOM_TIME_RANGE_BADGE"]},d=await c.create(u);if(!d)throw new Error("Map embeddable is undefined");return Object(Ki.isErrorEmbeddable)(d)||(d.setRenderTooltipContent((({addFilters:e,closeTooltip:t,features:a,isLocked:n,getLayerName:r,loadFeatureProperties:s,loadFeatureGeometry:l})=>{const c={addFilters:e,closeTooltip:t,features:a,isLocked:n,getLayerName:r,loadFeatureProperties:s,loadFeatureGeometry:l};return i.a.createElement(mj.b,Ni()({node:o},c))})),d.setLayerList(eS(t))),s({id:"embeddedMap",inspect:null,loading:!1,refetch:()=>d.reload()}),d})(t,I,a,s,e,r,F,u.embeddable);n&&c(o)}catch(e){n&&(S(e,{title:wj}),b(!0))}}(),()=>{n=!1}}),[S,e,l,t,I,a,F,u.embeddable,w,r,s,y]),Object(n.useEffect)((()=>{null==l||Object(Ki.isErrorEmbeddable)(l)||(async()=>{null!=l&&I.length&&(await l.setLayerList(eS(I)),l.reload())})()}),[l,I]),Object(n.useEffect)((()=>{null!=l&&l.updateInput({query:a})}),[l,a]);const A=Object(n.useMemo)((()=>Object(bj.a)(s,e)),[s,e]);Object(n.useEffect)((()=>{null!=l&&l.updateInput({filters:[...t,...A]})}),[l,t,A]);const D=Object(n.useCallback)((e=>{d.set(jS,e),E(e)}),[d]),N=Object(n.useMemo)((()=>v?i.a.createElement(rS,null,i.a.createElement(mj.a,{node:F},i.a.createElement(xS,null)),i.a.createElement(SS,{maintainRatio:!y},y?i.a.createElement(lS,{"data-test-subj":"missing-prompt"}):null!=l?i.a.createElement(Ki.EmbeddablePanel,{embeddable:l}):i.a.createElement($s.a,{"data-test-subj":"loading-panel",overlay:!0,size:"xl"}))):null),[l,y,F,v]);return p?null:i.a.createElement(OS,{"data-test-subj":"EmbeddedMapComponent",onToggle:D,id:"network-map",arrowDisplay:"right",arrowProps:{color:"primary","data-test-subj":`${v}-toggle-network-map`},buttonContent:i.a.createElement("strong",null,hj),extraAction:i.a.createElement(kS,{size:"xs"},i.a.createElement(U.EuiLink,{href:`${u.docLinks.links.siem.networkMap}`,target:"_blank"},vj)),paddingSize:"none",initialIsOpen:v},N)};wS.displayName="EmbeddedMapComponent";const TS=i.a.memo(wS);TS.displayName="EmbeddedMap";const IS=$.i18n.translate("xpack.securitySolution.networkKpiDns.errorSearchDescription",{defaultMessage:"An error has occurred on network kpi dns search"}),CS=$.i18n.translate("xpack.securitySolution.networkKpiDns.failSearchDescription",{defaultMessage:"Failed to run search on network kpi dns"}),MS="networkKpiDnsQuery",_S=[{key:"dnsQueries",fields:[{key:"dnsQueries",value:null,lensAttributes:{title:"[Network] DNS metric",description:"",visualizationType:"lnsLegacyMetric",state:{visualization:{layerId:"cea37c70-8f91-43bf-b9fe-72d8c049f6a3",accessor:"0374e520-eae0-4ac1-bcfe-37565e7fc9e3",layerType:"data",colorMode:"None",autoScaleMetricAlignment:"left"},query:{query:"",language:"kuery"},filters:[{meta:{index:"196d783b-3779-4c39-898e-6606fe633d05",type:"custom",disabled:!1,negate:!1,alias:null,key:"query",value:'{"bool":{"should":[{"exists":{"field":"dns.question.name"}},{"term":{"suricata.eve.dns.type":{"value":"query"}}},{"exists":{"field":"zeek.dns.query"}}],"minimum_should_match":1}}'},$state:{store:"appState"},query:{bool:{should:[{exists:{field:"dns.question.name"}},{term:{"suricata.eve.dns.type":{value:"query"}}},{exists:{field:"zeek.dns.query"}}],minimum_should_match:1}}}],datasourceStates:{formBased:{layers:{"cea37c70-8f91-43bf-b9fe-72d8c049f6a3":{columns:{"0374e520-eae0-4ac1-bcfe-37565e7fc9e3":{label:"",dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___",customLabel:!0}},columnOrder:["0374e520-eae0-4ac1-bcfe-37565e7fc9e3"],incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-cea37c70-8f91-43bf-b9fe-72d8c049f6a3"},{type:"index-pattern",name:"196d783b-3779-4c39-898e-6606fe633d05",id:"{dataViewId}"}]}}],description:$.i18n.translate("xpack.securitySolution.kpiNetwork.dnsQueries.title",{defaultMessage:"DNS queries"})}],FS=({filterQuery:e,from:t,indexNames:a,to:r,updateDateRange:s,setQuery:o,skip:l})=>{const{toggleStatus:c}=Object(Wn.a)(MS),[u,d]=Object(n.useState)(l||!c),p=Object(K.a)("chartEmbeddablesEnabled");Object(n.useEffect)((()=>{d(l||!c)}),[l,c]);const[b,{refetch:g,id:f,inspect:y,...h}]=(({filterQuery:e,endDate:t,indexNames:a,skip:i=!1,startDate:r})=>{const{data:s}=Object(m.j)().services,o=Object(n.useRef)(x.noop),l=Object(n.useRef)(new AbortController),c=Object(n.useRef)(new Ns.Subscription),[u,d]=Object(n.useState)(!1),[p,b]=Object(n.useState)(null),[g,f]=Object(n.useState)({dnsQueries:0,id:MS,inspect:{dsl:[],response:[]},isInspected:!1,refetch:o.current}),{addError:y,addWarning:h}=Object(rs.a)(),v=Object(n.useCallback)((e=>{if(null==e||i)return;const t=async()=>{l.current=new AbortController,d(!0),c.current=s.search.search(e,{strategy:"securitySolutionSearchStrategy",abortSignal:l.current.signal}).subscribe({next:e=>{Object(Ms.isCompleteResponse)(e)?(d(!1),f((t=>({...t,dnsQueries:e.dnsQueries,inspect:Object(Dp.getInspectResponse)(e,t.inspect),refetch:o.current}))),c.current.unsubscribe()):Object(Ms.isErrorResponse)(e)&&(d(!1),h(IS),c.current.unsubscribe())},error:e=>{d(!1),y(e,{title:CS}),c.current.unsubscribe()}})};c.current.unsubscribe(),l.current.abort(),t(),o.current=t}),[s.search,y,h,i]);return Object(n.useEffect)((()=>{b((n=>{const i={...null!=n?n:{},defaultIndex:a,factoryQueryType:Vo.q.dns,filterQuery:Object(ul.a)(e),timerange:{interval:"12h",from:r,to:t}};return Ds()(n,i)?n:i}))}),[a,t,e,r]),Object(n.useEffect)((()=>(v(p),()=>{c.current.unsubscribe(),l.current.abort()})),[p,v]),Object(n.useEffect)((()=>{i&&(d(!1),c.current.unsubscribe(),l.current.abort())}),[i]),[u,g]})({filterQuery:e,endDate:r,indexNames:a,startDate:t,skip:u||p}),{session:v,refetchByRestartingSession:E}=Object(Em.a)({inputId:Y.a.global,queryId:f});return i.a.createElement(mm,{data:h,id:f,inspect:y,loading:b,fieldsMapping:_S,from:t,to:r,updateDateRange:s,refetch:p?E:g,setQuery:o,setQuerySkip:d,session:p?v:void 0})},AS=i.a.memo(FS),DS=$.i18n.translate("xpack.securitySolution.networkKpiNetworkEvents.errorSearchDescription",{defaultMessage:"An error has occurred on network kpi network events search"}),NS=$.i18n.translate("xpack.securitySolution.networkKpiNetworkEvents.failSearchDescription",{defaultMessage:"Failed to run search on network kpi network events"}),PS="networkKpiNetworkEventsQuery",RS=$.i18n.translate("xpack.securitySolution.kpiNetwork.networkEvents.title",{defaultMessage:"Network events"}),LS=[{key:"networkEvents",fields:[{key:"networkEvents",value:null,color:Object(U.euiPaletteColorBlind)()[1],lensAttributes:{title:"[Network] Network events",description:"",visualizationType:"lnsLegacyMetric",state:{visualization:{layerId:"eaadfec7-deaa-4aeb-a403-3b4e516416d2",accessor:"370ebd07-5ce0-4f46-a847-0e363c50d037",layerType:"data",autoScaleMetricAlignment:"left"},query:{query:"",language:"kuery"},filters:[{meta:{index:"security-solution-default",alias:null,negate:!1,disabled:!1,type:"exists",key:"source.ip",value:"exists"},query:{exists:{field:"source.ip"}},$state:{store:"appState"}},{meta:{index:"security-solution-default",alias:null,negate:!1,disabled:!1,type:"exists",key:"destination.ip",value:"exists"},query:{exists:{field:"destination.ip"}},$state:{store:"appState"}}],datasourceStates:{formBased:{layers:{"eaadfec7-deaa-4aeb-a403-3b4e516416d2":{columns:{"370ebd07-5ce0-4f46-a847-0e363c50d037":{label:" ",dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___",customLabel:!0}},columnOrder:["370ebd07-5ce0-4f46-a847-0e363c50d037"],incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-eaadfec7-deaa-4aeb-a403-3b4e516416d2"},{type:"index-pattern",name:"861af17d-be25-45a3-a82d-d6e697b76e51",id:"{dataViewId}"},{type:"index-pattern",name:"09617767-f732-410e-af53-bebcbd0bf4b9",id:"{dataViewId}"}]}}],description:RS}],BS=({filterQuery:e,from:t,indexNames:a,to:r,updateDateRange:s,setQuery:o,skip:l})=>{const{toggleStatus:c}=Object(Wn.a)(PS),[u,d]=Object(n.useState)(l||!c),p=Object(K.a)("chartEmbeddablesEnabled");Object(n.useEffect)((()=>{d(l||!c)}),[l,c]);const[b,{refetch:g,id:f,inspect:y,...h}]=(({filterQuery:e,endDate:t,indexNames:a,skip:i=!1,startDate:r})=>{const{data:s}=Object(m.j)().services,o=Object(n.useRef)(x.noop),l=Object(n.useRef)(new AbortController),c=Object(n.useRef)(new Ns.Subscription),[u,d]=Object(n.useState)(!1),[p,b]=Object(n.useState)(null),[g,f]=Object(n.useState)({networkEvents:0,id:PS,inspect:{dsl:[],response:[]},isInspected:!1,refetch:o.current}),{addError:y,addWarning:h}=Object(rs.a)(),v=Object(n.useCallback)((e=>{if(null==e||i)return;const t=async()=>{l.current=new AbortController,d(!0),c.current=s.search.search(e,{strategy:"securitySolutionSearchStrategy",abortSignal:l.current.signal}).subscribe({next:e=>{Object(Ms.isCompleteResponse)(e)?(d(!1),f((t=>({...t,networkEvents:e.networkEvents,inspect:Object(Dp.getInspectResponse)(e,t.inspect),refetch:o.current}))),c.current.unsubscribe()):Object(Ms.isErrorResponse)(e)&&(d(!1),h(DS),c.current.unsubscribe())},error:e=>{d(!1),y(e,{title:NS}),c.current.unsubscribe()}})};c.current.unsubscribe(),l.current.abort(),t(),o.current=t}),[s.search,y,h,i]);return Object(n.useEffect)((()=>{b((n=>{const i={...null!=n?n:{},defaultIndex:a,factoryQueryType:Vo.q.networkEvents,filterQuery:Object(ul.a)(e),timerange:{interval:"12h",from:r,to:t}};return Ds()(n,i)?n:i}))}),[a,t,e,r]),Object(n.useEffect)((()=>(v(p),()=>{c.current.unsubscribe(),l.current.abort()})),[p,v]),Object(n.useEffect)((()=>{i&&(d(!1),c.current.unsubscribe(),l.current.abort())}),[i]),[u,g]})({filterQuery:e,endDate:r,indexNames:a,startDate:t,skip:u||p}),{session:v,refetchByRestartingSession:E}=Object(Em.a)({inputId:Y.a.global,queryId:f});return i.a.createElement(mm,{data:h,id:f,inspect:y,loading:b,fieldsMapping:LS,from:t,to:r,updateDateRange:s,refetch:p?E:g,setQuery:o,setQuerySkip:d,session:p?v:void 0})},qS=i.a.memo(BS),zS=$.i18n.translate("xpack.securitySolution.networkKpiTlsHandshakes.errorSearchDescription",{defaultMessage:"An error has occurred on network kpi tls handshakes search"}),$S=$.i18n.translate("xpack.securitySolution.networkKpiTlsHandshakes.failSearchDescription",{defaultMessage:"Failed to run search on network kpi tls handshakes"}),VS="networkKpiTlsHandshakesQuery",US=[{key:"tlsHandshakes",fields:[{key:"tlsHandshakes",value:null,lensAttributes:{title:"[Network] TLS handshakes",description:"",visualizationType:"lnsLegacyMetric",state:{visualization:{layerId:"1f48a633-8eee-45ae-9471-861227e9ca03",accessor:"21052b6b-5504-4084-a2e2-c17f772345cf",layerType:"data",autoScaleMetricAlignment:"left"},query:{query:"(source.ip: * or destination.ip: *) and (tls.version: * or suricata.eve.tls.version: * or zeek.ssl.version: * )",language:"kuery"},filters:[{meta:{index:"32ee22d9-2e77-4aee-8073-87750e92c3ee",type:"custom",disabled:!1,negate:!1,alias:null,key:"query",value:'{"bool":{"should":[{"exists":{"field":"source.ip"}},{"exists":{"field":"destination.ip"}}],"minimum_should_match":1}}'},$state:{store:"appState"},query:{bool:{should:[{exists:{field:"source.ip"}},{exists:{field:"destination.ip"}}],minimum_should_match:1}}},{meta:{index:"1e93f984-9374-4755-a198-de57751533c6",type:"custom",disabled:!1,negate:!1,alias:null,key:"query",value:'{"bool":{"should":[{"exists":{"field":"tls.version"}},{"exists":{"field":"suricata.eve.tls.version"}},{"exists":{"field":"zeek.ssl.version"}}],"minimum_should_match":1}}'},$state:{store:"appState"},query:{bool:{should:[{exists:{field:"tls.version"}},{exists:{field:"suricata.eve.tls.version"}},{exists:{field:"zeek.ssl.version"}}],minimum_should_match:1}}}],datasourceStates:{formBased:{layers:{"1f48a633-8eee-45ae-9471-861227e9ca03":{columns:{"21052b6b-5504-4084-a2e2-c17f772345cf":{label:" ",dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___",customLabel:!0}},columnOrder:["21052b6b-5504-4084-a2e2-c17f772345cf"],incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-1f48a633-8eee-45ae-9471-861227e9ca03"}]}}],description:$.i18n.translate("xpack.securitySolution.kpiNetwork.tlsHandshakes.title",{defaultMessage:"TLS handshakes"})}],HS=({filterQuery:e,from:t,indexNames:a,to:r,updateDateRange:s,setQuery:o,skip:l})=>{const{toggleStatus:c}=Object(Wn.a)(VS),[u,d]=Object(n.useState)(l||!c),p=Object(K.a)("chartEmbeddablesEnabled");Object(n.useEffect)((()=>{d(l||!c)}),[l,c]);const[b,{refetch:g,id:f,inspect:y,...h}]=(({filterQuery:e,endDate:t,indexNames:a,skip:i=!1,startDate:r})=>{const{data:s}=Object(m.j)().services,o=Object(n.useRef)(x.noop),l=Object(n.useRef)(new AbortController),c=Object(n.useRef)(new Ns.Subscription),[u,d]=Object(n.useState)(!1),[p,b]=Object(n.useState)(null),[g,f]=Object(n.useState)({tlsHandshakes:0,id:VS,inspect:{dsl:[],response:[]},isInspected:!1,refetch:o.current}),{addError:y,addWarning:h}=Object(rs.a)(),v=Object(n.useCallback)((e=>{if(null==e||i)return;const t=async()=>{l.current=new AbortController,d(!0),c.current=s.search.search(e,{strategy:"securitySolutionSearchStrategy",abortSignal:l.current.signal}).subscribe({next:e=>{Object(Ms.isCompleteResponse)(e)?(d(!1),f((t=>({...t,tlsHandshakes:e.tlsHandshakes,inspect:Object(Dp.getInspectResponse)(e,t.inspect),refetch:o.current}))),c.current.unsubscribe()):Object(Ms.isErrorResponse)(e)&&(d(!1),h(zS),c.current.unsubscribe())},error:e=>{d(!1),y(e,{title:$S}),c.current.unsubscribe()}})};c.current.unsubscribe(),l.current.abort(),t(),o.current=t}),[s.search,y,h,i]);return Object(n.useEffect)((()=>{b((n=>{const i={...null!=n?n:{},defaultIndex:a,factoryQueryType:Vo.q.tlsHandshakes,filterQuery:Object(ul.a)(e),timerange:{interval:"12h",from:r,to:t}};return Ds()(n,i)?n:i}))}),[a,t,e,r]),Object(n.useEffect)((()=>(v(p),()=>{c.current.unsubscribe(),l.current.abort()})),[p,v]),Object(n.useEffect)((()=>{i&&(d(!1),c.current.unsubscribe(),l.current.abort())}),[i]),[u,g]})({filterQuery:e,endDate:r,indexNames:a,startDate:t,skip:u||p}),{session:v,refetchByRestartingSession:E}=Object(Em.a)({inputId:Y.a.global,queryId:f});return i.a.createElement(mm,{data:h,id:f,inspect:y,loading:b,fieldsMapping:US,from:t,to:r,updateDateRange:s,refetch:p?E:g,setQuery:o,setQuerySkip:d,session:p?v:void 0})},GS=i.a.memo(HS),QS=$.i18n.translate("xpack.securitySolution.networkKpiUniqueFlows.errorSearchDescription",{defaultMessage:"An error has occurred on network kpi unique flows search"}),WS=$.i18n.translate("xpack.securitySolution.networkKpiUniqueFlows.failSearchDescription",{defaultMessage:"Failed to run search on network kpi unique flows"}),KS="networkKpiUniqueFlowsQuery",YS=[{key:"uniqueFlowId",fields:[{key:"uniqueFlowId",value:null,lensAttributes:{title:"[Network] Unique flow IDs",description:"",visualizationType:"lnsLegacyMetric",state:{visualization:{layerId:"5d46d48f-6ce8-46be-a797-17ad50642564",accessor:"a27f3503-9c73-4fc1-86bb-12461dae4b70",layerType:"data",autoScaleMetricAlignment:"left"},query:{query:"source.ip: * or destination.ip: * ",language:"kuery"},filters:[{meta:{index:"c01edc8a-90ce-4d49-95f0-76954a034eb2",type:"custom",disabled:!1,negate:!1,alias:null,key:"query",value:'{"bool":{"should":[{"exists":{"field":"source.ip"}},{"exists":{"field":"destination.ip"}}],"minimum_should_match":1}}'},$state:{store:"appState"},query:{bool:{should:[{exists:{field:"source.ip"}},{exists:{field:"destination.ip"}}],minimum_should_match:1}}}],datasourceStates:{formBased:{layers:{"5d46d48f-6ce8-46be-a797-17ad50642564":{columns:{"a27f3503-9c73-4fc1-86bb-12461dae4b70":{label:" ",dataType:"number",operationType:"unique_count",scale:"ratio",sourceField:"network.community_id",isBucketed:!1,customLabel:!0}},columnOrder:["a27f3503-9c73-4fc1-86bb-12461dae4b70"],incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-5d46d48f-6ce8-46be-a797-17ad50642564"}]}}],description:$.i18n.translate("xpack.securitySolution.kpiNetwork.uniqueFlowIds.title",{defaultMessage:"Unique flow IDs"})}],JS=({filterQuery:e,from:t,indexNames:a,to:r,updateDateRange:s,setQuery:o,skip:l})=>{const{toggleStatus:c}=Object(Wn.a)(KS),[u,d]=Object(n.useState)(l||!c),p=Object(K.a)("chartEmbeddablesEnabled");Object(n.useEffect)((()=>{d(l||!c)}),[l,c]);const[b,{refetch:g,id:f,inspect:y,...h}]=(({filterQuery:e,endDate:t,indexNames:a,skip:i=!1,startDate:r})=>{const{data:s}=Object(m.j)().services,o=Object(n.useRef)(x.noop),l=Object(n.useRef)(new AbortController),c=Object(n.useRef)(new Ns.Subscription),[u,d]=Object(n.useState)(!1),[p,b]=Object(n.useState)(null),[g,f]=Object(n.useState)({uniqueFlowId:0,id:KS,inspect:{dsl:[],response:[]},isInspected:!1,refetch:o.current}),{addError:y,addWarning:h}=Object(rs.a)(),v=Object(n.useCallback)((e=>{if(null==e||i)return;const t=async()=>{l.current=new AbortController,d(!0),c.current=s.search.search(e,{strategy:"securitySolutionSearchStrategy",abortSignal:l.current.signal}).subscribe({next:e=>{Object(Ms.isCompleteResponse)(e)?(d(!1),f((t=>({...t,uniqueFlowId:e.uniqueFlowId,inspect:Object(Dp.getInspectResponse)(e,t.inspect),refetch:o.current}))),c.current.unsubscribe()):Object(Ms.isErrorResponse)(e)&&(d(!1),h(QS),c.current.unsubscribe())},error:e=>{d(!1),y(e,{title:WS}),c.current.unsubscribe()}})};c.current.unsubscribe(),l.current.abort(),t(),o.current=t}),[s.search,y,h,i]);return Object(n.useEffect)((()=>{b((n=>{const i={...null!=n?n:{},defaultIndex:a,factoryQueryType:Vo.q.uniqueFlows,filterQuery:Object(ul.a)(e),timerange:{interval:"12h",from:r,to:t}};return Ds()(n,i)?n:i}))}),[a,t,e,r]),Object(n.useEffect)((()=>(v(p),()=>{c.current.unsubscribe(),l.current.abort()})),[p,v]),Object(n.useEffect)((()=>{i&&(d(!1),c.current.unsubscribe(),l.current.abort())}),[i]),[u,g]})({filterQuery:e,endDate:r,indexNames:a,startDate:t,skip:u||p}),{session:v,refetchByRestartingSession:E}=Object(Em.a)({inputId:Y.a.global,queryId:f});return i.a.createElement(mm,{data:h,id:f,inspect:y,loading:b,fieldsMapping:YS,from:t,to:r,updateDateRange:s,refetch:p?E:g,setQuery:o,setQuerySkip:d,session:p?v:void 0})},XS=i.a.memo(JS),ZS=$.i18n.translate("xpack.securitySolution.networkKpiUniquePrivateIps.errorSearchDescription",{defaultMessage:"An error has occurred on network kpi unique private ips search"}),ek=$.i18n.translate("xpack.securitySolution.networkKpiUniquePrivateIps.failSearchDescription",{defaultMessage:"Failed to run search on network kpi unique private ips"}),tk="networkKpiUniquePrivateIpsQuery",ak=$.i18n.translate("xpack.securitySolution.kpiNetwork.uniquePrivateIps.title",{defaultMessage:"Unique private IPs"}),nk=$.i18n.translate("xpack.securitySolution.kpiNetwork.uniquePrivateIps.sourceUnitLabel",{defaultMessage:"source"}),ik=$.i18n.translate("xpack.securitySolution.kpiNetwork.uniquePrivateIps.destinationUnitLabel",{defaultMessage:"destination"}),rk=$.i18n.translate("xpack.securitySolution.kpiNetwork.uniquePrivateIps.sourceChartLabel",{defaultMessage:"Src."}),sk=$.i18n.translate("xpack.securitySolution.kpiNetwork.uniquePrivateIps.destinationChartLabel",{defaultMessage:"Dest."}),ok={title:"[Network] Unique private IPs - area chart",description:"",visualizationType:"lnsXY",state:{visualization:{legend:{isVisible:!1,position:"right",showSingleSeries:!1},valueLabels:"hide",fittingFunction:"None",yLeftExtent:{mode:"full"},yRightExtent:{mode:"full"},axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},tickLabelsVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},labelsOrientation:{x:0,yLeft:0,yRight:0},gridlinesVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},preferredSeriesType:"area",layers:[{layerId:"38aa6532-6bf9-4c8f-b2a6-da8d32f7d0d7",seriesType:"area",accessors:["5f317308-cfbb-4ee5-bfb9-07653184fabf"],layerType:"data",xAccessor:"662cd5e5-82bf-4325-a703-273f84b97e09",yConfig:[{forAccessor:"5f317308-cfbb-4ee5-bfb9-07653184fabf",color:"#d36186"}]},{layerId:"72dc4b99-b07d-4dc9-958b-081d259e11fa",seriesType:"area",accessors:["ac1eb80c-ddde-46c4-a90c-400261926762"],layerType:"data",xAccessor:"36444b8c-7e10-4069-8298-6c1b46912be2",yConfig:[{forAccessor:"ac1eb80c-ddde-46c4-a90c-400261926762",color:"#9170b8"}]}]},query:{query:"",language:"kuery"},filters:[],datasourceStates:{formBased:{layers:{"38aa6532-6bf9-4c8f-b2a6-da8d32f7d0d7":{columns:{"662cd5e5-82bf-4325-a703-273f84b97e09":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto"}},"5f317308-cfbb-4ee5-bfb9-07653184fabf":{label:ei.m,dataType:"number",operationType:"unique_count",scale:"ratio",sourceField:"source.ip",isBucketed:!1,customLabel:!0,filter:{query:'"source.ip": "10.0.0.0/8" or "source.ip": "192.168.0.0/16" or "source.ip": "172.16.0.0/12" or "source.ip": "fd00::/8"',language:"kuery"}}},columnOrder:["662cd5e5-82bf-4325-a703-273f84b97e09","5f317308-cfbb-4ee5-bfb9-07653184fabf"],incompleteColumns:{}},"72dc4b99-b07d-4dc9-958b-081d259e11fa":{columns:{"36444b8c-7e10-4069-8298-6c1b46912be2":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto"}},"ac1eb80c-ddde-46c4-a90c-400261926762":{label:ei.h,dataType:"number",operationType:"unique_count",scale:"ratio",sourceField:"destination.ip",isBucketed:!1,filter:{query:'"destination.ip": "10.0.0.0/8" or "destination.ip": "192.168.0.0/16" or "destination.ip": "172.16.0.0/12" or "destination.ip": "fd00::/8"',language:"kuery"}}},columnOrder:["36444b8c-7e10-4069-8298-6c1b46912be2","ac1eb80c-ddde-46c4-a90c-400261926762"],incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-38aa6532-6bf9-4c8f-b2a6-da8d32f7d0d7"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-72dc4b99-b07d-4dc9-958b-081d259e11fa"}]},lk={title:"[Network] Unique private IPs - bar chart",description:"",visualizationType:"lnsXY",state:{visualization:{legend:{isVisible:!1,position:"right",showSingleSeries:!1},valueLabels:"hide",fittingFunction:"None",yLeftExtent:{mode:"full"},yRightExtent:{mode:"full"},axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0},tickLabelsVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},labelsOrientation:{x:0,yLeft:0,yRight:0},gridlinesVisibilitySettings:{x:!0,yLeft:!0,yRight:!0},preferredSeriesType:"bar_horizontal_stacked",layers:[{layerId:"e406bf4f-942b-41ac-b516-edb5cef06ec8",accessors:["5acd4c9d-dc3b-4b21-9632-e4407944c36d"],position:"top",seriesType:"bar_horizontal_stacked",showGridlines:!1,layerType:"data",yConfig:[{forAccessor:"5acd4c9d-dc3b-4b21-9632-e4407944c36d",color:"#d36186"}],xAccessor:"d9c438c5-f776-4436-9d20-d62dc8c03be8"},{layerId:"38aa6532-6bf9-4c8f-b2a6-da8d32f7d0d7",seriesType:"bar_horizontal_stacked",accessors:["d27e0966-daf9-41f4-9033-230cf1e76dc9"],layerType:"data",yConfig:[{forAccessor:"d27e0966-daf9-41f4-9033-230cf1e76dc9",color:"#9170b8"}],xAccessor:"4607c585-3af3-43b9-804f-e49b27796d79"}]},query:{query:"",language:"kuery"},filters:[],datasourceStates:{formBased:{layers:{"e406bf4f-942b-41ac-b516-edb5cef06ec8":{columns:{"5acd4c9d-dc3b-4b21-9632-e4407944c36d":{label:Object(ei.p)("source.ip"),dataType:"number",isBucketed:!1,operationType:"unique_count",scale:"ratio",sourceField:"source.ip",filter:{query:'source.ip: "10.0.0.0/8" or source.ip: "192.168.0.0/16" or source.ip: "172.16.0.0/12" or source.ip: "fd00::/8"',language:"kuery"}},"d9c438c5-f776-4436-9d20-d62dc8c03be8":{label:"Filters",dataType:"string",operationType:"filters",scale:"ordinal",isBucketed:!0,params:{filters:[{input:{language:"kuery",query:"source.ip: *"},label:ei.m}]}}},columnOrder:["d9c438c5-f776-4436-9d20-d62dc8c03be8","5acd4c9d-dc3b-4b21-9632-e4407944c36d"],incompleteColumns:{}},"38aa6532-6bf9-4c8f-b2a6-da8d32f7d0d7":{columns:{"d27e0966-daf9-41f4-9033-230cf1e76dc9":{label:Object(ei.p)("destination.ip"),dataType:"number",isBucketed:!1,operationType:"unique_count",scale:"ratio",sourceField:"destination.ip",filter:{query:'"destination.ip": "10.0.0.0/8" or "destination.ip": "192.168.0.0/16" or "destination.ip": "172.16.0.0/12" or "destination.ip": "fd00::/8"',language:"kuery"}},"4607c585-3af3-43b9-804f-e49b27796d79":{label:"Filters",dataType:"string",operationType:"filters",scale:"ordinal",isBucketed:!0,params:{filters:[{input:{language:"kuery",query:"destination.ip: *"},label:ei.h}]}}},columnOrder:["4607c585-3af3-43b9-804f-e49b27796d79","d27e0966-daf9-41f4-9033-230cf1e76dc9"],incompleteColumns:{}}}}}},references:[{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-e406bf4f-942b-41ac-b516-edb5cef06ec8"},{type:"index-pattern",id:"{dataViewId}",name:"indexpattern-datasource-layer-38aa6532-6bf9-4c8f-b2a6-da8d32f7d0d7"}]},ck=Object(U.euiPaletteColorBlind)(),uk=[{key:"uniqueIps",fields:[{key:"uniqueSourcePrivateIps",value:null,name:rk,description:nk,color:ck[2],icon:"visMapCoordinate",lensAttributes:{description:"",state:{datasourceStates:{formBased:{layers:{"cea37c70-8f91-43bf-b9fe-72d8c049f6a3":{columnOrder:["bd17c23e-4f83-4108-8005-2669170d064b"],columns:{"bd17c23e-4f83-4108-8005-2669170d064b":{customLabel:!0,dataType:"number",isBucketed:!1,label:"",operationType:"unique_count",scale:"ratio",sourceField:"source.ip",filter:{query:'source.ip: "10.0.0.0/8" or source.ip: "192.168.0.0/16" or source.ip: "172.16.0.0/12" or source.ip: "fd00::/8"',language:"kuery"}}},incompleteColumns:{}}}}},filters:[],query:{language:"kuery",query:""},visualization:{accessor:"bd17c23e-4f83-4108-8005-2669170d064b",layerId:"cea37c70-8f91-43bf-b9fe-72d8c049f6a3",layerType:"data"}},title:"[Network] Unique private IPs - source metric",visualizationType:"lnsLegacyMetric",references:[{id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern",type:"index-pattern"},{id:"{dataViewId}",name:"indexpattern-datasource-layer-cea37c70-8f91-43bf-b9fe-72d8c049f6a3",type:"index-pattern"}]}},{key:"uniqueDestinationPrivateIps",value:null,name:sk,description:ik,color:ck[3],icon:"visMapCoordinate",lensAttributes:{description:"",state:{datasourceStates:{formBased:{layers:{"cea37c70-8f91-43bf-b9fe-72d8c049f6a3":{columnOrder:["bd17c23e-4f83-4108-8005-2669170d064b"],columns:{"bd17c23e-4f83-4108-8005-2669170d064b":{customLabel:!0,dataType:"number",isBucketed:!1,label:"",operationType:"unique_count",scale:"ratio",sourceField:"destination.ip",filter:{language:"kuery",query:'"destination.ip": "10.0.0.0/8" or "destination.ip": "192.168.0.0/16" or "destination.ip": "172.16.0.0/12" or "destination.ip": "fd00::/8"'}}},incompleteColumns:{}}}}},filters:[],query:{language:"kuery",query:""},visualization:{accessor:"bd17c23e-4f83-4108-8005-2669170d064b",layerId:"cea37c70-8f91-43bf-b9fe-72d8c049f6a3",layerType:"data"}},title:"[Network] Unique private IPs - destination metric",visualizationType:"lnsLegacyMetric",references:[{id:"{dataViewId}",name:"indexpattern-datasource-current-indexpattern",type:"index-pattern"},{id:"{dataViewId}",name:"indexpattern-datasource-layer-cea37c70-8f91-43bf-b9fe-72d8c049f6a3",type:"index-pattern"}]}}],description:ak,enableAreaChart:!0,enableBarChart:!0,areaChartLensAttributes:ok,barChartLensAttributes:lk}],dk=({filterQuery:e,from:t,indexNames:a,to:r,updateDateRange:s,setQuery:o,skip:l})=>{const{toggleStatus:c}=Object(Wn.a)(tk),[u,d]=Object(n.useState)(l||!c),p=Object(K.a)("chartEmbeddablesEnabled");Object(n.useEffect)((()=>{d(l||!c)}),[l,c]);const[b,{refetch:g,id:f,inspect:y,...h}]=(({filterQuery:e,endDate:t,indexNames:a,skip:i=!1,startDate:r})=>{const{data:s}=Object(m.j)().services,o=Object(n.useRef)(x.noop),l=Object(n.useRef)(new AbortController),c=Object(n.useRef)(new Ns.Subscription),[u,d]=Object(n.useState)(!1),[p,b]=Object(n.useState)(null),[g,f]=Object(n.useState)({uniqueDestinationPrivateIps:0,uniqueDestinationPrivateIpsHistogram:null,uniqueSourcePrivateIps:0,uniqueSourcePrivateIpsHistogram:null,id:tk,inspect:{dsl:[],response:[]},isInspected:!1,refetch:o.current}),{addError:y,addWarning:h}=Object(rs.a)(),v=Object(n.useCallback)((e=>{if(null==e||i)return;const t=async()=>{l.current=new AbortController,d(!0),c.current=s.search.search(e,{strategy:"securitySolutionSearchStrategy",abortSignal:l.current.signal}).subscribe({next:e=>{Object(Ms.isCompleteResponse)(e)?(d(!1),f((t=>({...t,uniqueDestinationPrivateIps:e.uniqueDestinationPrivateIps,uniqueDestinationPrivateIpsHistogram:e.uniqueDestinationPrivateIpsHistogram,uniqueSourcePrivateIps:e.uniqueSourcePrivateIps,uniqueSourcePrivateIpsHistogram:e.uniqueSourcePrivateIpsHistogram,inspect:Object(Dp.getInspectResponse)(e,t.inspect),refetch:o.current}))),c.current.unsubscribe()):Object(Ms.isErrorResponse)(e)&&(d(!1),h(ZS),c.current.unsubscribe())},error:e=>{d(!1),y(e,{title:ek}),c.current.unsubscribe()}})};c.current.unsubscribe(),l.current.abort(),t(),o.current=t}),[s.search,y,h,i]);return Object(n.useEffect)((()=>{b((n=>{const i={...null!=n?n:{},defaultIndex:a,factoryQueryType:Vo.q.uniquePrivateIps,filterQuery:Object(ul.a)(e),timerange:{interval:"12h",from:r,to:t}};return Ds()(n,i)?n:i}))}),[a,t,e,r]),Object(n.useEffect)((()=>(v(p),()=>{c.current.unsubscribe(),l.current.abort()})),[p,v]),Object(n.useEffect)((()=>{i&&(d(!1),c.current.unsubscribe(),l.current.abort())}),[i]),[u,g]})({filterQuery:e,endDate:r,indexNames:a,startDate:t,skip:u||p}),{session:v,refetchByRestartingSession:E}=Object(Em.a)({inputId:Y.a.global,queryId:f});return i.a.createElement(mm,{data:h,id:f,inspect:y,loading:b,fieldsMapping:uk,from:t,to:r,updateDateRange:s,refetch:p?E:g,setQuery:o,setQuerySkip:d,session:p?v:void 0})},pk=i.a.memo(dk),mk=i.a.memo((({filterQuery:e,from:t,indexNames:a,to:n,setQuery:r,skip:s,updateDateRange:o})=>i.a.createElement(U.EuiFlexGroup,{wrap:!0},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(U.EuiFlexGroup,{wrap:!0},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(qS,{filterQuery:e,from:t,indexNames:a,to:n,updateDateRange:o,setQuery:r,skip:s})),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(AS,{filterQuery:e,from:t,indexNames:a,to:n,updateDateRange:o,setQuery:r,skip:s}))),i.a.createElement(U.EuiSpacer,{size:"l"}),i.a.createElement(U.EuiFlexGroup,{wrap:!0},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(XS,{filterQuery:e,from:t,indexNames:a,to:n,updateDateRange:o,setQuery:r,skip:s})),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(GS,{filterQuery:e,from:t,indexNames:a,to:n,updateDateRange:o,setQuery:r,skip:s})))),i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(pk,{filterQuery:e,from:t,indexNames:a,to:n,updateDateRange:o,setQuery:r,skip:s})))));mk.displayName="NetworkKpiComponent";const bk=G.a.div.withConfig({displayName:"StyledFullHeightContainer",componentId:"sc-v7oybx-0"})(["display:flex;flex-direction:column;flex:1 1 auto;"]),gk=i.a.memo((({hasMlUserPermissions:e,capabilitiesFetched:t})=>{const a=Object(o.useDispatch)(),r=Object(n.useRef)(null),s=Object(n.useMemo)((()=>R.j.getTableByIdSelector()),[]),l=Object(j.b)((e=>{var t;return(null!==(t=s(e,R.e.networkPageEvents))&&void 0!==t?t:R.q).graphEventId})),c=Object(n.useMemo)((()=>Vr.d.globalFiltersQuerySelector()),[]),u=Object(n.useMemo)((()=>Vr.d.globalQuerySelector()),[]),d=Object(j.a)(u),p=Object(j.a)(c),{to:b,from:f,setQuery:y,isInitializing:v}=Object(J.a)(),{globalFullScreen:k}=Object(fe.a)(),O=Object(m.j)(),{tabName:w}=Object(B.useParams)(),T=O.services.application.capabilities.maps.show,I=Object(n.useMemo)((()=>w===Lv.a.events?[...p,...qp.h]:p),[w,p]),C=Object(n.useCallback)((({x:e})=>{if(!e)return;const[t,n]=e;a(Object(ae.setAbsoluteRangeDatePicker)({id:Y.a.global,from:new Date(t).toISOString(),to:new Date(n).toISOString()}))}),[a]),{indicesExist:M,indexPattern:_,selectedPatterns:F}=Object(g.d)(),A=Object(n.useCallback)((()=>{var e,t;null===(e=r.current)||void 0===e||null===(t=e.querySelector(".inspectButtonComponent:last-of-type"))||void 0===t||t.focus()}),[r]),D=Object(n.useCallback)((()=>{Object(he.m)()}),[]),N=Object(n.useCallback)((e=>{Object(Q.isTab)(e)&&Object(he.l)({containerElement:r.current,keyboardEvent:e,onSkipFocusBeforeEventsTable:A,onSkipFocusAfterEventsTable:D})}),[r,A,D]),[P,L]=Object(kr.i)({config:Object(Ms.getEsQueryConfig)(O.services.uiSettings),indexPattern:_,queries:[d],filters:p}),[q]=Object(kr.i)({config:Object(Ms.getEsQueryConfig)(O.services.uiSettings),indexPattern:_,queries:[d],filters:I});return Object(Cp.a)({id:"NetworkQueryId",filterQuery:P,kqlError:L,query:d,startDate:f,endDate:b}),i.a.createElement(i.a.Fragment,null,M?i.a.createElement(bk,{onKeyDown:N,ref:r},i.a.createElement(U.EuiWindowEvent,{event:"resize",handler:x.noop}),i.a.createElement(X.a,{show:Object(he.n)({globalFullScreen:k,graphEventId:l})},i.a.createElement(ee.a,{indexPattern:_,id:Y.a.global})),i.a.createElement(h.a,{noPadding:k},i.a.createElement(ye.a,{show:!k},i.a.createElement(Ci.a,{subtitle:i.a.createElement(zs,{indexKey:Vo.k.network,indexNames:F}),title:Ov.h,border:!0}),T&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiPanel,{hasBorder:!0,paddingSize:"none","data-test-subj":"conditional-embeddable-map"},i.a.createElement(TS,{query:d,filters:p,startDate:f,endDate:b,setQuery:y})),i.a.createElement(U.EuiSpacer,null)),i.a.createElement(mk,{filterQuery:P,from:f,indexNames:F,updateDateRange:C,setQuery:y,skip:v||void 0===P,to:b})),t&&!v?i.a.createElement(i.a.Fragment,null,i.a.createElement(ye.a,{show:!k},i.a.createElement(U.EuiSpacer,null),i.a.createElement(_s.a,{navTabs:Zv(e)}),i.a.createElement(U.EuiSpacer,null)),i.a.createElement(Kv,{filterQuery:q,from:f,isInitializing:v,indexPattern:_,indexNames:F,setQuery:y,type:kv.c.NetworkType.page,to:b})):i.a.createElement(Jv,null))):i.a.createElement(Mi.a,null),i.a.createElement(E.a,{pageName:S.a.network}))}));gk.displayName="NetworkComponent";const fk=i.a.memo(gk),yk=i.a.memo((()=>{const{path:e}=Object(B.useRouteMatch)();return i.a.createElement(q.c,null,i.a.createElement(q.a,{strict:!0,exact:!0,path:e,render:({location:e})=>{const t=Object(bh.parse)(e.search.substring(1),{sort:!1});null!=t.query&&(t.query=Oh(t.query));const a=Object(bh.stringify)(ir.url.encodeQuery(t),{sort:!1,encode:!1});return i.a.createElement(B.Redirect,{to:`${s.Mb}?${a}`})}}),i.a.createElement(q.a,{path:`${e}/ip/:ip`,render:({location:e,match:{params:{ip:t}}})=>{const a=Object(bh.parse)(e.search.substring(1),{sort:!1});if(null!=a.query&&(a.query=Oh(a.query)),wh(t)){const e=Object(bh.stringify)(ir.url.encodeQuery(a),{sort:!1,encode:!1});return i.a.createElement(B.Redirect,{to:`${s.Mb}?${e}`})}if(Th(t)){const e=Ih(t);a.query=vh(["source.ip","destination.ip"],e,a.query||"");const n=Object(bh.stringify)(ir.url.encodeQuery(a),{sort:!1,encode:!1});return i.a.createElement(B.Redirect,{to:`${s.Mb}?${n}`})}{const e=Object(bh.stringify)(ir.url.encodeQuery(a),{sort:!1,encode:!1});return i.a.createElement(B.Redirect,{to:`${s.Mb}/ip/${t}?${e}`})}}}),i.a.createElement(q.a,{path:`${s.Mb}/ml-network/`,render:({location:{search:e=""}})=>i.a.createElement(B.Redirect,{from:`${s.Mb}/ml-network/`,to:{pathname:`${s.Mb}/ml-network`,search:e}})}))}));yk.displayName="MlNetworkConditionalContainer";const hk=(e,t)=>`${s.Mb}/ip/${e}/${t||Vo.g.source}/${Lv.a.flows}`,vk=()=>{const e=Object(io.a)(),t=e.capabilitiesFetched,a=Object(n.useMemo)((()=>Object(Al.a)(e)),[e]),r=Object(n.useMemo)((()=>((e,t)=>e&&!t?Vv:$v)(t,a)),[t,a]);return i.a.createElement(q.c,null,i.a.createElement(q.a,{exact:!0,strict:!0,path:s.Mb,render:({location:{search:e=""}})=>i.a.createElement(B.Redirect,{to:{pathname:`${s.Mb}/${Lv.a.flows}`,search:e}})}),i.a.createElement(q.a,{path:`${s.Mb}/ml-network`},i.a.createElement(yk,null)),i.a.createElement(q.a,{strict:!0,path:r},i.a.createElement(fk,{capabilitiesFetched:e.capabilitiesFetched,hasMlUserPermissions:a})),i.a.createElement(q.a,{path:Qv},i.a.createElement(pj,null)),i.a.createElement(q.a,{path:`${Gv}/:flowTarget(${Hv})?`,render:({match:{params:{detailName:e,flowTarget:t}},location:{search:a=""}})=>i.a.createElement(B.Redirect,{to:{pathname:hk(e,t),search:a}})}),i.a.createElement(q.a,null,i.a.createElement(B.Redirect,{to:{pathname:s.Mb}})))},Ek=i.a.memo(vk),xk={display:"flex",margin:"auto"},jk=e=>function(t){return Object(Pb.jsx)(n.Suspense,{fallback:Object(Pb.jsx)(U.EuiLoadingSpinner,{size:"xl",style:xk})},Object(Pb.jsx)(e,t))},Sk=jk(Object(n.lazy)((()=>a.e(32).then(a.bind(null,1653))))),kk=(jk(Object(n.lazy)((()=>a.e(34).then(a.bind(null,1444))))),jk(Object(n.lazy)((()=>a.e(33).then(a.bind(null,1654))))),jk(Object(n.lazy)((()=>a.e(36).then(a.bind(null,1655)))))),Ok=jk(Object(n.lazy)((()=>a.e(37).then(a.bind(null,1656)))));jk(Object(n.lazy)((()=>a.e(38).then(a.bind(null,1657)))));var wk=a(26),Tk=a(30),Ik=a(1);const Ck=e=>{Object(Tk.b)(Ik.a.CLICK,`${Ik.c.LANDING_CARD}${e}`)},Mk=$.i18n.translate("xpack.securitySolution.explore.landing.pageTitle",{defaultMessage:"Explore"}),_k=()=>{var e;const{links:t=[]}=null!==(e=Object(wk.c)(S.a.exploreLanding))&&void 0!==e?e:{},a=Object(Yi.a)();return i.a.createElement(h.a,null,i.a.createElement(Ci.a,{title:Mk}),i.a.createElement(kk,{items:t,urlState:a,onLinkClick:Ck}),i.a.createElement(E.a,{pageName:S.a.exploreLanding}))},Fk=[{path:s.vb,exact:!0,component:()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:S.a.exploreLanding},i.a.createElement(_k,null)))},{path:s.Mb,component:()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:S.a.network},i.a.createElement(Ek,null)))},{path:s.Ic,component:()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:S.a.users},i.a.createElement(Af,null)))},{path:s.zb,component:()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:S.a.hosts},i.a.createElement(sv,null)))}],Ak=$.i18n.translate("xpack.securitySolution.kubernetes.columnSessionStart",{defaultMessage:"Date started"}),Dk=$.i18n.translate("xpack.securitySolution.kubernetes.columnExecutable",{defaultMessage:"Executable"}),Nk=$.i18n.translate("xpack.securitySolution.kubernetes.columnNode",{defaultMessage:"Node"}),Pk=$.i18n.translate("xpack.securitySolution.kubernetes.columnEntryUser",{defaultMessage:"User ID"}),Rk=$.i18n.translate("xpack.securitySolution.kubernetes.columnInteractive",{defaultMessage:"Interactive"}),Lk=$.i18n.translate("xpack.securitySolution.kubernetes.columnContainer",{defaultMessage:"Container"}),Bk=$.i18n.translate("xpack.securitySolution.kubernetes.columnPod",{defaultMessage:"Pod"}),qk=[{columnHeaderType:qy.a,id:"process.entry_leader.start",initialWidth:gp.b,display:Ak},{columnHeaderType:qy.a,id:"process.entry_leader.executable",display:Dk},{columnHeaderType:qy.a,id:"process.entry_leader.user.id",display:Pk},{columnHeaderType:qy.a,id:"process.entry_leader.interactive",display:Rk},{columnHeaderType:qy.a,id:"cloud.instance.name",display:Nk},{columnHeaderType:qy.a,id:"orchestrator.resource.name",display:Bk},{columnHeaderType:qy.a,id:"container.name",display:Lk}],zk=i.a.memo((()=>{const{kubernetesSecurity:e,uiSettings:t}=Object(m.j)().services,{globalFullScreen:a}=Object(fe.a)(),{indexPattern:r}=Object(g.d)(),{from:o,to:l}=Object(J.a)(),c=Object(n.useMemo)((()=>Vr.d.globalFiltersQuerySelector()),[]),u=Object(n.useMemo)((()=>Vr.d.globalQuerySelector()),[]),d=Object(j.a)(u),p=Object(j.a)(c),[b,f]=Object(n.useMemo)((()=>Object(kr.i)({config:Object(Ms.getEsQueryConfig)(t),indexPattern:r,queries:[d],filters:p})),[p,r,t,d]);Object(Cp.a)({id:"kubernetesQuery",filterQuery:b,kqlError:f,query:d,startDate:o,endDate:l});const y=Object(n.useCallback)((e=>i.a.createElement(th,{tableId:R.e.kubernetesPageSessions,endDate:l,pageFilters:[],startDate:o,filterQuery:e,columns:qk,defaultColumns:qk})),[o,l]);return i.a.createElement(h.a,{noPadding:!0},e.getKubernetesPage({filter:i.a.createElement(X.a,{show:Object(he.n)({globalFullScreen:a,graphEventId:void 0})},i.a.createElement(ee.a,{id:Y.a.global,indexPattern:r})),indexPattern:r,globalFilter:{filterQuery:b,startDate:o,endDate:l},renderSessionsView:y}),i.a.createElement(E.a,{pageName:s.wc.kubernetes}))}));zk.displayName="KubernetesContainer";const $k=[{path:s.Gb,component:()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:S.a.kubernetes},i.a.createElement(zk,null)))}];var Vk=a(183),Uk=a(916);const Hk=$.i18n.translate("xpack.securitySolution.allHost.failSearchDescription",{defaultMessage:"Failed to run search on all hosts"}),Gk="overviewHostQuery",Qk=G.a.div.withConfig({displayName:"ProgressContainer",componentId:"sc-soprzh-0"})(["margin-left:8px;min-width:100px;@media only screen and (min-width:1400px){min-width:200px;}"]),Wk=({count:e,isGroupStat:t,isLoading:a,max:r})=>{const[o]=Object(m.p)(s.O),[l,c]=Object(n.useState)(!0);return Object(n.useEffect)((()=>{l&&!a&&c(!1)}),[a,l,c]),i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"none",responsive:!1,justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,{grow:!1},!l&&i.a.createElement(U.EuiText,{color:t?"default":"subdued",size:t?"m":"s"},di()(e).format(o))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(Qk,null,a?i.a.createElement(U.EuiSkeletonText,{"data-test-subj":"stat-value-loading-spinner",lines:1}):i.a.createElement(U.EuiProgress,{color:t?"primary":"subdued",max:r,size:"m",value:e}))))};Wk.displayName="StatValueComponent";const Kk=i.a.memo(Wk),Yk=e=>{var t,a,n,r,s,o,l,c,u,d,p,m,b,g,f,y;return[{count:null!==(t=e.auditbeatAuditd)&&void 0!==t?t:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.auditBeatAuditTitle",defaultMessage:"Audit"}),id:"auditbeatAuditd"},{count:null!==(a=e.auditbeatFIM)&&void 0!==a?a:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.auditBeatFimTitle",defaultMessage:"File Integrity Module"}),id:"auditbeatFIM"},{count:null!==(n=e.auditbeatLogin)&&void 0!==n?n:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.auditBeatLoginTitle",defaultMessage:"Login"}),id:"auditbeatLogin"},{count:null!==(r=e.auditbeatPackage)&&void 0!==r?r:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.auditBeatPackageTitle",defaultMessage:"Package"}),id:"auditbeatPackage"},{count:null!==(s=e.auditbeatProcess)&&void 0!==s?s:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.auditBeatProcessTitle",defaultMessage:"Process"}),id:"auditbeatProcess"},{count:null!==(o=e.auditbeatUser)&&void 0!==o?o:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.auditBeatUserTitle",defaultMessage:"User"}),id:"auditbeatUser"},{count:null!==(l=e.endgameDns)&&void 0!==l?l:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.endgameDnsTitle",defaultMessage:"DNS"}),id:"endgameDns"},{count:null!==(c=e.endgameFile)&&void 0!==c?c:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.endgameFileTitle",defaultMessage:"File"}),id:"endgameFile"},{count:null!==(u=e.endgameImageLoad)&&void 0!==u?u:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.endgameImageLoadTitle",defaultMessage:"Image Load"}),id:"endgameImageLoad"},{count:null!==(d=e.endgameNetwork)&&void 0!==d?d:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.endgameNetworkTitle",defaultMessage:"Network"}),id:"endgameNetwork"},{count:null!==(p=e.endgameProcess)&&void 0!==p?p:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.endgameProcessTitle",defaultMessage:"Process"}),id:"endgameProcess"},{count:null!==(m=e.endgameRegistry)&&void 0!==m?m:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.endgameRegistryTitle",defaultMessage:"Registry"}),id:"endgameRegistry"},{count:null!==(b=e.endgameSecurity)&&void 0!==b?b:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.endgameSecurityTitle",defaultMessage:"Security"}),id:"endgameSecurity"},{count:null!==(g=e.filebeatSystemModule)&&void 0!==g?g:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.filebeatSystemModuleTitle",defaultMessage:"System Module"}),id:"filebeatSystemModule"},{count:null!==(f=e.winlogbeatSecurity)&&void 0!==f?f:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.winlogbeatSecurityTitle",defaultMessage:"Security"}),id:"winlogbeatSecurity"},{count:null!==(y=e.winlogbeatMWSysmonOperational)&&void 0!==y?y:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.winlogbeatMWSysmonOperational",defaultMessage:"Microsoft-Windows-Sysmon/Operational"}),id:"winlogbeatMWSysmonOperational"}]},Jk=G.a.div.withConfig({displayName:"HostStatsContainer",componentId:"sc-11y71zp-0"})([".accordion-button{width:100%;}"]),Xk=[{groupId:"auditbeat",name:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.hostStatGroupAuditbeat",defaultMessage:"Auditbeat"}),statIds:["auditbeatAuditd","auditbeatFIM","auditbeatLogin","auditbeatPackage","auditbeatProcess","auditbeatUser"]},{groupId:"endgame",name:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.hostStatGroupElasticEndpointSecurity",defaultMessage:"Endpoint Security"}),statIds:["endgameDns","endgameFile","endgameImageLoad","endgameNetwork","endgameProcess","endgameRegistry","endgameSecurity"]},{groupId:"filebeat",name:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.hostStatGroupFilebeat",defaultMessage:"Filebeat"}),statIds:["filebeatSystemModule"]},{groupId:"winlogbeat",name:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.hostStatGroupWinlogbeat",defaultMessage:"Winlogbeat"}),statIds:["winlogbeatSecurity","winlogbeatMWSysmonOperational"]}],Zk=G.a.div.withConfig({displayName:"MoveItLeftTitle",componentId:"sc-11y71zp-1"})(["margin-left:24px;@media only screen and (min-width:","){max-width:40px;}"],(({theme:e})=>e.eui.euiBreakpoints.m)),eO=G.a.div.withConfig({displayName:"MoveItLeft",componentId:"sc-11y71zp-2"})(["margin-left:24px;"]),tO=G()(U.EuiFlexItem).withConfig({displayName:"NoMarginTopFlexItem",componentId:"sc-11y71zp-3"})(["@media only screen and (max-width:","){margin-top:-10px !important;}"],(({theme:e})=>e.eui.euiBreakpoints.m)),aO=G.a.div.withConfig({displayName:"AccordionContent",componentId:"sc-11y71zp-4"})(["padding-top:8px;"]),nO=({data:e,loading:t})=>{const a=Yk(e),n=a.reduce(((e,t)=>e+t.count),0);return i.a.createElement(Jk,{"data-test-subj":"overview-hosts-stats"},Xk.map(((e,r)=>{const s=a.filter((t=>e.statIds.includes(t.id))),o=s.reduce(((e,t)=>e+t.count),0);return i.a.createElement(i.a.Fragment,{key:e.groupId},i.a.createElement(U.EuiHorizontalRule,{margin:"xs"}),i.a.createElement(U.EuiAccordion,{id:`host-stat-accordion-group${e.groupId}`,buttonContent:i.a.createElement(U.EuiFlexGroup,{gutterSize:"s",justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiText,null,e.name)),i.a.createElement(tO,{grow:!1},i.a.createElement(Kk,{count:o,isGroupStat:!0,isLoading:t,max:n}))),buttonContentClassName:"accordion-button"},i.a.createElement(aO,null,s.map((e=>i.a.createElement(U.EuiFlexGroup,{key:e.id,gutterSize:"s",justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiText,{color:"subdued",size:"s"},i.a.createElement(Zk,null,e.title))),i.a.createElement(tO,{"data-test-subj":`host-stat-${e.id}`,grow:!1},i.a.createElement(eO,null,i.a.createElement(Kk,{count:e.count,isGroupStat:!1,isLoading:t,max:o})))))))))})))},iO=i.a.memo(nO),rO=Object(ft.a)(iO),sO=({endDate:e,filterQuery:t,indexNames:a,startDate:r,setQuery:o})=>{const[l]=Object(m.p)(s.O),{toggleStatus:c,setToggleStatus:u}=Object(Wn.a)(Gk),[d,p]=Object(n.useState)(void 0===t||!c);Object(n.useEffect)((()=>{p(void 0===t||!c)}),[t,c]);const b=Object(n.useCallback)((e=>{u(e),p(!e)}),[p,u]),[g,{overviewHost:f,id:y,inspect:h,refetch:v}]=(({filterQuery:e,endDate:t,indexNames:a,skip:i=!1,startDate:r})=>{const{loading:s,result:o,search:l,refetch:c,inspect:u}=Object(ho.a)({factoryQueryType:cl.h.overview,initialResult:{overviewHost:{}},errorMessage:Hk,abort:i}),d=Object(n.useMemo)((()=>({endDate:t,overviewHost:o.overviewHost,id:Gk,inspect:u,isInspected:!1,refetch:c,startDate:r})),[t,u,c,o.overviewHost,r]),p=Object(n.useMemo)((()=>({defaultIndex:a,factoryQueryType:cl.h.overview,filterQuery:Object(ul.a)(e),timerange:{interval:"12h",from:r,to:t}})),[t,e,a,r]);return Object(n.useEffect)((()=>{i||l(p)}),[p,l,i]),[s,d]})({endDate:e,filterQuery:t,indexNames:a,startDate:r,skip:d}),E=Object(n.useMemo)((()=>Yk(f).reduce(((e,t)=>e+t.count),0)),[f]),j=Object(n.useMemo)((()=>di()(E).format(l)),[l,E]),k=Object(n.useMemo)((()=>i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.hostsTitle",defaultMessage:"Host events"})),[]),O=Object(n.useMemo)((()=>Object(x.isEmpty)(f)?i.a.createElement(i.a.Fragment,null,""):i.a.createElement(Fs.FormattedMessage,{defaultMessage:"Showing: {formattedHostEventsCount} {hostEventsCount, plural, one {event} other {events}}",id:"xpack.securitySolution.overview.overviewHost.hostsSubtitle",values:{hostEventsCount:E,formattedHostEventsCount:j}})),[j,E,f]);return i.a.createElement(Ve.c,{show:c},i.a.createElement(U.EuiPanel,{hasBorder:!0},i.a.createElement(pn.a,{id:Gk,subtitle:O,toggleStatus:c,toggleQuery:b,title:k,isInspectDisabled:void 0===t},i.a.createElement(ge.l,{deepLinkId:S.a.hosts},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.hostsAction",defaultMessage:"View hosts"}))),c&&i.a.createElement(rO,{loading:g,data:f,setQuery:o,id:y,inspect:h,refetch:v})))};sO.displayName="OverviewHostComponent";const oO=i.a.memo(sO),lO=($.i18n.translate("xpack.securitySolution.allHost.errorSearchDescription",{defaultMessage:"An error has occurred on all hosts search"}),$.i18n.translate("xpack.securitySolution.allHost.failSearchDescription",{defaultMessage:"Failed to run search on all hosts"})),cO="overviewNetworkQuery",uO=e=>{var t,a,n,r,s,o,l,c,u;return[{count:null!==(t=e.auditbeatSocket)&&void 0!==t?t:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.auditBeatSocketTitle",defaultMessage:"Socket"}),id:"auditbeatSocket"},{count:null!==(a=e.filebeatCisco)&&void 0!==a?a:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.filebeatCiscoTitle",defaultMessage:"Cisco"}),id:"filebeatCisco"},{count:null!==(n=e.filebeatNetflow)&&void 0!==n?n:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.filebeatNetflowTitle",defaultMessage:"Netflow"}),id:"filebeatNetflow"},{count:null!==(r=e.filebeatPanw)&&void 0!==r?r:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.filebeatPanwTitle",defaultMessage:"Palo Alto Networks"}),id:"filebeatPanw"},{count:null!==(s=e.filebeatSuricata)&&void 0!==s?s:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.fileBeatSuricataTitle",defaultMessage:"Suricata"}),id:"filebeatSuricata"},{count:null!==(o=e.filebeatZeek)&&void 0!==o?o:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.fileBeatZeekTitle",defaultMessage:"Zeek"}),id:"filebeatZeek"},{count:null!==(l=e.packetbeatDNS)&&void 0!==l?l:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.packetBeatDnsTitle",defaultMessage:"DNS"}),id:"packetbeatDNS"},{count:null!==(c=e.packetbeatFlow)&&void 0!==c?c:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.packetBeatFlowTitle",defaultMessage:"Flow"}),id:"packetbeatFlow"},{count:null!==(u=e.packetbeatTLS)&&void 0!==u?u:0,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.packetbeatTLSTitle",defaultMessage:"TLS"}),id:"packetbeatTLS"}]},dO=[{groupId:"auditbeat",name:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.networkStatGroupAuditbeat",defaultMessage:"Auditbeat"}),statIds:["auditbeatSocket"]},{groupId:"filebeat",name:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.networkStatGroupFilebeat",defaultMessage:"Filebeat"}),statIds:["filebeatCisco","filebeatNetflow","filebeatPanw","filebeatSuricata","filebeatZeek"]},{groupId:"packetbeat",name:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.networkStatGroupPacketbeat",defaultMessage:"Packetbeat"}),statIds:["packetbeatDNS","packetbeatFlow","packetbeatTLS"]}],pO=G.a.div.withConfig({displayName:"NetworkStatsContainer",componentId:"sc-d9mimb-0"})([".accordion-button{width:100%;}"]),mO=G.a.div.withConfig({displayName:"MoveItLeftTitle",componentId:"sc-d9mimb-1"})(["margin-left:24px;@media only screen and (min-width:","){max-width:40px;}"],(({theme:e})=>e.eui.euiBreakpoints.m)),bO=G.a.div.withConfig({displayName:"MoveItLeft",componentId:"sc-d9mimb-2"})(["margin-left:24px;"]),gO=G()(U.EuiFlexItem).withConfig({displayName:"NoMarginTopFlexItem",componentId:"sc-d9mimb-3"})(["@media only screen and (max-width:","){margin-top:-10px !important;}"],(({theme:e})=>e.eui.euiBreakpoints.m)),fO=G.a.div.withConfig({displayName:"AccordionContent",componentId:"sc-d9mimb-4"})(["padding-top:8px;"]),yO=({data:e,loading:t})=>{const a=uO(e),n=a.reduce(((e,t)=>e+t.count),0);return i.a.createElement(pO,{"data-test-subj":"overview-network-stats"},dO.map(((e,r)=>{const s=a.filter((t=>e.statIds.includes(t.id))),o=s.reduce(((e,t)=>e+t.count),0);return i.a.createElement(i.a.Fragment,{key:e.groupId},i.a.createElement(U.EuiHorizontalRule,{margin:"xs"}),i.a.createElement(U.EuiAccordion,{id:`network-stat-accordion-group${e.groupId}`,buttonContent:i.a.createElement(U.EuiFlexGroup,{"data-test-subj":`network-stat-group-${e.groupId}`,justifyContent:"spaceBetween",gutterSize:"s"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiText,null,e.name)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(Kk,{count:o,isGroupStat:!0,isLoading:t,max:n}))),buttonContentClassName:"accordion-button"},i.a.createElement(fO,null,s.map((e=>i.a.createElement(U.EuiFlexGroup,{key:e.id,gutterSize:"s",justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiText,{color:"subdued",size:"s"},i.a.createElement(mO,null,e.title))),i.a.createElement(gO,{"data-test-subj":`network-stat-${e.id}`,grow:!1},i.a.createElement(bO,null,i.a.createElement(Kk,{count:e.count,isGroupStat:!1,isLoading:t,max:o})))))))))})))},hO=i.a.memo(yO),vO=Object(ft.a)(hO),EO=({endDate:e,filterQuery:t,indexNames:a,startDate:r,setQuery:o})=>{const{formatUrl:l,search:c}=Object(p.m)(S.a.network),{navigateToApp:u}=Object(m.j)().services.application,[d]=Object(m.p)(s.O),{toggleStatus:b,setToggleStatus:g}=Object(Wn.a)(cO),[f,y]=Object(n.useState)(void 0===t||!b);Object(n.useEffect)((()=>{y(void 0===t||!b)}),[t,b]);const h=Object(n.useCallback)((e=>{g(e),y(!e)}),[y,g]),[v,{overviewNetwork:E,id:j,inspect:k,refetch:O}]=(({filterQuery:e,endDate:t,indexNames:a,skip:i=!1,startDate:r})=>{const{loading:s,result:o,search:l,refetch:c,inspect:u}=Object(ho.a)({factoryQueryType:cl.q.overview,initialResult:{overviewNetwork:{}},errorMessage:lO,abort:i}),d=Object(n.useMemo)((()=>({endDate:t,overviewNetwork:o.overviewNetwork,id:cO,inspect:u,isInspected:!1,refetch:c,startDate:r})),[t,u,c,o.overviewNetwork,r]),p=Object(n.useMemo)((()=>({defaultIndex:a,factoryQueryType:cl.q.overview,filterQuery:Object(ul.a)(e),timerange:{interval:"12h",from:r,to:t}})),[t,e,a,r]);return Object(n.useEffect)((()=>{i||l(p)}),[p,l,i]),[s,d]})({endDate:e,filterQuery:t,indexNames:a,startDate:r,skip:f}),w=Object(n.useCallback)((e=>{e.preventDefault(),u(s.l,{deepLinkId:S.a.network,path:Object(p.h)(c)})}),[u,c]),T=Object(n.useMemo)((()=>uO(E).reduce(((e,t)=>e+t.count),0)),[E]),I=Object(n.useMemo)((()=>di()(T).format(d)),[d,T]),C=Object(n.useMemo)((()=>i.a.createElement(ge.g,{"data-test-subj":"overview-network-go-to-network-page",onClick:w,href:l(Object(p.h)())},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.networkAction",defaultMessage:"View network"}))),[w,l]),M=Object(n.useMemo)((()=>i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.networkTitle",defaultMessage:"Network events"})),[]),_=Object(n.useMemo)((()=>Object(x.isEmpty)(E)?i.a.createElement(i.a.Fragment,null,""):i.a.createElement(Fs.FormattedMessage,{defaultMessage:"Showing: {formattedNetworkEventsCount} {networkEventsCount, plural, one {event} other {events}}",id:"xpack.securitySolution.overview.overviewNetwork.networkSubtitle",values:{formattedNetworkEventsCount:I,networkEventsCount:T}})),[I,T,E]);return i.a.createElement(Ve.c,{show:b},i.a.createElement(U.EuiPanel,{hasBorder:!0,"data-test-subj":"overview-network-query"},i.a.createElement(i.a.Fragment,null,i.a.createElement(pn.a,{id:cO,subtitle:_,title:M,toggleStatus:b,toggleQuery:h,isInspectDisabled:void 0===t},C),b&&i.a.createElement(vO,{loading:v,data:E,id:j,inspect:k,setQuery:o,refetch:O}))))};EO.displayName="OverviewNetworkComponent";const xO=i.a.memo(EO),jO=({filters:e,from:t,indexNames:a,indexPattern:r,query:o,setQuery:l,to:c})=>{const{uiSettings:u}=Object(m.j)().services,[d,p]=Object(n.useMemo)((()=>Object(kr.i)({config:Object(Ms.getEsQueryConfig)(u),indexPattern:r,queries:[o],filters:[...e,...Object(qp.b)(s.wc.hosts)]})),[e,r,o,u]),[b]=Object(n.useMemo)((()=>Object(kr.i)({config:Object(Ms.getEsQueryConfig)(u),indexPattern:r,queries:[o],filters:[...e,...qp.h]})),[e,r,u,o]);return Object(Cp.a)({id:Gk,filterQuery:d||b,kqlError:p,query:o,startDate:t,endDate:c}),i.a.createElement(U.EuiFlexGroup,{direction:"row"},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(oO,{endDate:c,filterQuery:d,indexNames:a,startDate:t,setQuery:l})),i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(xO,{endDate:c,filterQuery:b,indexNames:a,startDate:t,setQuery:l})))},SO=i.a.memo(jO),kO=$.i18n.translate("xpack.securitySolution.recentTimelines.favoritesButtonLabel",{defaultMessage:"Favorites"}),OO=$.i18n.translate("xpack.securitySolution.recentTimelines.noFavoriteTimelinesMessage",{defaultMessage:"You haven't favorited any timelines yet. Get out there and start threat hunting!"}),wO=$.i18n.translate("xpack.securitySolution.recentTimelines.lastUpdatedButtonLabel",{defaultMessage:"Last updated"}),TO=$.i18n.translate("xpack.securitySolution.recentTimelines.noTimelinesMessage",{defaultMessage:"You haven't created any timelines yet. Get out there and start threat hunting!"}),IO=$.i18n.translate("xpack.securitySolution.recentTimelines.notesTooltip",{defaultMessage:"Notes"}),CO=$.i18n.translate("xpack.securitySolution.recentTimelines.openAsDuplicateTooltip",{defaultMessage:"Open as a timeline duplicate"}),MO=$.i18n.translate("xpack.securitySolution.recentTimelines.openAsDuplicateTemplateTooltip",{defaultMessage:"Open as a template duplicate"}),_O=$.i18n.translate("xpack.securitySolution.recentTimelines.pinnedEventsTooltip",{defaultMessage:"Pinned events"}),FO=$.i18n.translate("xpack.securitySolution.recentTimelines.untitledTimelineLabel",{defaultMessage:"Untitled timeline"}),AO=$.i18n.translate("xpack.securitySolution.recentTimelines.viewAllTimelinesLink",{defaultMessage:"View all timelines"}),DO=$.i18n.translate("xpack.securitySolution.recentTimelines.filterControlLegend",{defaultMessage:"Timelines filter"}),NO=[{id:"favorites",label:kO,iconType:"starFilled"},{id:"recently-updated",label:wO,iconType:"documentEdit"}],PO=i.a.memo((({filterBy:e,setFilterBy:t})=>i.a.createElement(U.EuiButtonGroup,{options:NO,idSelected:e,onChange:e=>{t(e)},isIconOnly:!0,legend:DO})));PO.displayName="Filters";var RO=a(479),LO=a(164);const BO=i.a.memo((({onOpenTimeline:e,timeline:t,timeline:{title:a,savedObjectId:r}})=>{const s=Object(n.useCallback)((()=>e({duplicate:!1,timelineId:`${r}`})),[e,r]);return i.a.createElement(U.EuiText,{size:"s"},i.a.createElement(U.EuiLink,{onClick:s},Object(LO.f)(t)?FO:a))}));BO.displayName="RecentTimelineHeader";var qO=a(637);const zO=G()(U.EuiIcon).withConfig({displayName:"Icon",componentId:"sc-hm3nav-0"})(["margin-right:8px;"]),$O=G()(U.EuiFlexGroup).withConfig({displayName:"FlexGroup",componentId:"sc-hm3nav-1"})(["margin-right:16px;"]),VO=i.a.memo((({count:e,icon:t,tooltip:a})=>i.a.createElement(U.EuiToolTip,{content:a},i.a.createElement($O,{alignItems:"center",gutterSize:"none"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(zO,{color:"subdued",size:"s",type:t})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiText,{color:"subdued",size:"xs"},e))))));VO.displayName="IconWithCount";const UO=i.a.memo((({timeline:e})=>i.a.createElement("div",null,i.a.createElement(VO,{count:Object(LO.e)(e),icon:"pinFilled",tooltip:_O}),i.a.createElement(VO,{count:Object(LO.d)(e),icon:"editorComment",tooltip:IO}))));UO.displayName="RecentTimelineCounts";const HO=G.a.div.withConfig({displayName:"ClampText",componentId:"sc-ehtgjx-0"})(["display:-webkit-box;-webkit-line-clamp:3;-webkit-box-orient:vertical;overflow:hidden;word-break:break-word;"]),GO=i.a.memo((({timeline:e,onOpenTimeline:t,isLastItem:a})=>{const r=Object(n.useCallback)((()=>t({duplicate:!0,timelineId:`${e.savedObjectId}`})),[t,e.savedObjectId]),s=Object(n.useCallback)((a=>i.a.createElement(U.EuiFlexGroup,{gutterSize:"none",justifyContent:"spaceBetween","data-test-subj":"overview-recent-timelines"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(BO,{onOpenTimeline:t,timeline:e}),i.a.createElement(UO,{timeline:e}),e.description&&e.description.length&&i.a.createElement(U.EuiText,{color:"subdued",size:"xs"},i.a.createElement(HO,null,e.description))),a&&i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiToolTip,{content:e.timelineType===Dd.l.default?CO:MO},i.a.createElement(U.EuiButtonIcon,{"aria-label":e.timelineType===Dd.l.default?CO:MO,"data-test-subj":"open-duplicate",isDisabled:null==e.savedObjectId,iconSize:"s",iconType:"copy",onClick:r,size:"s"}))))),[r,t,e]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(qO.a,{render:s}),i.a.createElement(i.a.Fragment,null,!a&&i.a.createElement(U.EuiSpacer,{size:"l"})))}));GO.displayName="RecentTimelinesItem";const QO=i.a.memo((({noTimelinesMessage:e,onOpenTimeline:t,timelines:a})=>{const r=Object(n.useMemo)((()=>a.map(((e,n)=>i.a.createElement(GO,{key:`${e.savedObjectId}-${e.title}`,timeline:e,onOpenTimeline:t,isLastItem:n===a.length-1})))),[t,a]);return 0===a.length?i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiText,{color:"subdued",size:"s"},e)):i.a.createElement(i.a.Fragment,null,r)}));QO.displayName="RecentTimelines";const WO=({lines:e,placeholders:t})=>i.a.createElement(i.a.Fragment,null,[...Array(t).keys()].map(((a,n)=>i.a.createElement(i.a.Fragment,{key:n},i.a.createElement(U.EuiSkeletonText,{lines:e}),n!==t-1&&i.a.createElement(U.EuiSpacer,{size:"l"})))));WO.displayName="LoadingPlaceholdersComponent";const KO=i.a.memo(WO);var YO=a(911);const JO=({filterBy:e})=>{const t=Object(o.useDispatch)(),a=Object(n.useCallback)((e=>t(Object(k.updateIsLoading)(e))),[t]),r=Object(n.useMemo)((()=>Object(LO.b)(t)),[t]),{formatUrl:l}=Object(p.m)(S.a.timelines),{navigateToApp:c}=Object(m.j)().services.application,u=Object(n.useCallback)((({duplicate:e,timelineId:t})=>{Object(LO.h)({duplicate:e,timelineId:t,updateIsLoading:a,updateTimeline:r})}),[a,r]),d=Object(n.useCallback)((e=>{e.preventDefault(),c(s.l,{deepLinkId:S.a.timelines})}),[c]),b="favorites"===e?OO:TO,g=Object(n.useMemo)((()=>i.a.createElement(ge.f,{onClick:d,href:l("")},AO)),[d,l]),f=Object(n.useMemo)((()=>i.a.createElement(KO,{lines:2,placeholders:"favorites"===e?1:3})),[e]),{fetchAllTimeline:y,timelines:h,loading:v}=Object(RO.b)(),E=Dd.l.default,{timelineStatus:x}=Object(YO.a)({timelineType:E});return Object(n.useEffect)((()=>{y({pageInfo:{pageIndex:1,pageSize:3},search:"",sort:{sortField:Dd.f.updated,sortOrder:Vo.b.desc},onlyUserFavorite:"favorites"===e,status:x,timelineType:E})}),[y,e,x,E]),i.a.createElement(i.a.Fragment,null,v?f:i.a.createElement(QO,{noTimelinesMessage:b,onOpenTimeline:u,timelines:null!=h?h:[]}),i.a.createElement(U.EuiHorizontalRule,{margin:"s"}),i.a.createElement(U.EuiText,{size:"xs"},g))};JO.displayName="StatefulRecentTimelinesComponent";const XO=i.a.memo(JO);var ZO=a(1103),ew=a.n(ZO);const tw="en",aw=[],nw=i.a.memo((({children:e,title:t})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"none",justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiTitle,{size:"xs"},i.a.createElement("h2",null,t))),i.a.createElement(U.EuiFlexItem,{grow:!1},e)),i.a.createElement(U.EuiHorizontalRule,{margin:"s"}))));nw.displayName="SidebarHeader";const iw=$.i18n.translate("xpack.securitySolution.newsFeed.noNewsMessage",{defaultMessage:"Your current news feed URL returned no recent news."}),rw=$.i18n.translate("xpack.securitySolution.newsFeed.noNewsMessageForAdmin",{defaultMessage:"Your current news feed URL returned no recent news. You may update the URL or disable security news via"}),sw=$.i18n.translate("xpack.securitySolution.newsFeed.advancedSettingsLinkTitle",{defaultMessage:"Security Solution advanced settings"}),ow=i.a.memo((()=>{var e;const{getUrlForApp:t,navigateToApp:a,capabilities:r}=Object(m.j)().services.application,s=null!==(e=r.management.kibana.settings)&&void 0!==e&&e,o=Object(n.useCallback)((()=>a("management",{path:"/kibana/settings"})),[a]);return i.a.createElement(U.EuiText,{color:"subdued",size:"s"},s?rw:iw,s&&i.a.createElement(i.a.Fragment,null," ",i.a.createElement(ge.f,{onClick:o,href:`${t("management",{path:"/kibana/settings"})}`},sw),"."))}));ow.displayName="NoNews";const lw=({href:e,children:t})=>i.a.createElement(U.EuiLink,{href:e,rel:"noopener nofollow noreferrer",target:"_blank"},t),cw=G.a.img.withConfig({displayName:"NewsItemPreviewImage",componentId:"sc-wdv9uf-0"})(["height:56px;margin-left:16px;min-width:56px;padding:4px;width:56px;"]),uw=i.a.memo((({newsItem:e})=>{const{linkUrl:t,title:a,publishOn:n,description:r,imageUrl:s}=e;return(({publishOn:e,expireOn:t})=>qr()(Date.now()).isAfter(e)&&qr()(Date.now()).isBefore(t))(e)?i.a.createElement(U.EuiFlexGroup,{gutterSize:"none",justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiText,{size:"s"},i.a.createElement(lw,{href:t},a)),i.a.createElement(U.EuiText,{color:"subdued",size:"xs"},i.a.createElement(qs.e,{value:n}),i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement("div",null,r),i.a.createElement(U.EuiSpacer,{size:"l"}))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement("div",null,s&&i.a.createElement(cw,{alt:a,className:"euiPanel",src:s})))):null}));uw.displayName="Post";const dw=({news:e})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(nw,{title:Lm.i}),null==e?i.a.createElement(KO,{lines:4,placeholders:5}):0===e.length?i.a.createElement(ow,null):e.map((e=>i.a.createElement(uw,{key:e.hash,newsItem:e}))));dw.displayName="NewsFeedComponent";const pw=i.a.memo(dw),mw=i.a.memo((({enableNewsFeedSetting:e,newsFeedSetting:t})=>{const a=Object(m.j)().services.newsfeed,[r]=Object(m.p)(e),[s]=Object(m.p)(t),[o,l]=Object(n.useState)(null),c=a&&r,u=(({newsFeedUrlSetting:e,getKibanaVersion:t})=>{return[null==e?void 0:e.trim().replace(/\/$/,""),`v${a=t(),null!==(n=null===(i=ew()(a))||void 0===i?void 0:i.version)&&void 0!==n?n:a}.json`].join("/");var a,n,i})({newsFeedUrlSetting:s,getKibanaVersion:()=>m.b.getKibanaVersion()});return Object(n.useEffect)((()=>{let e=!1;return c&&(async()=>{try{const t=await(async({newsFeedUrl:e})=>m.b.get().http.fetch(e,{method:"GET",credentials:"omit",mode:"cors"}))({newsFeedUrl:u});e||l((e=>{const t=(e=>{var t;return""===document.documentElement.lang?e:null!==(t=document.documentElement.lang)&&void 0!==t?t:e})(tw);return null==e||null==e.items?aw:e.items.filter((e=>null!=e)).map((e=>{var a,n,i,r,s,o,l,c,u,d,p;return{description:null!==(a=null!==(n=Object(x.get)(t,e.description))&&void 0!==n?n:Object(x.get)(tw,e.description))&&void 0!==a?a:"",expireOn:new Date(null!==(i=e.expire_on)&&void 0!==i?i:""),hash:null!==(r=e.hash)&&void 0!==r?r:Object(nt.v4)(),imageUrl:null!==(s=null!==(o=Object(x.get)(t,e.image_url))&&void 0!==o?o:Object(x.get)(tw,e.image_url))&&void 0!==s?s:null,linkUrl:null!==(l=null!==(c=Object(x.get)(t,e.link_url))&&void 0!==c?c:Object(x.get)(tw,e.link_url))&&void 0!==l?l:"",publishOn:new Date(null!==(u=e.publish_on)&&void 0!==u?u:""),title:null!==(d=null!==(p=Object(x.get)(t,e.title))&&void 0!==p?p:Object(x.get)(tw,e.title))&&void 0!==d?d:""}}))})(t))}catch{e||l([])}})(),()=>{e=!0}}),[c,u]),i.a.createElement(i.a.Fragment,null,c?i.a.createElement(pw,{news:o}):null)}));mw.displayName="StatefulNewsFeed";const bw=()=>{const{cases:e}=Object(m.j)().services,t=Object(m.h)();return e.ui.getRecentCases({permissions:t,maxCasesToShow:3,owner:[s.i]})};bw.displayName="RecentCasesComponent";const gw=i.a.memo(bw),fw=i.a.memo((({recentTimelinesFilterBy:e,setRecentTimelinesFilterBy:t})=>{const a=Object(n.useMemo)((()=>i.a.createElement(PO,{filterBy:e,setFilterBy:t})),[e,t]),r=Object(m.h)().read;return i.a.createElement(U.EuiFlexGroup,{direction:"column",responsive:!1,gutterSize:"l"},r&&i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(gw,null)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(nw,{title:Lm.j},a),i.a.createElement(XO,{filterBy:e})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(mw,{enableNewsFeedSetting:s.mb,newsFeedSetting:s.Nb})))}));fw.displayName="Sidebar";const yw=i.a.memo((()=>{const[e,t]=Object(n.useState)("favorites");return i.a.createElement(fw,{recentTimelinesFilterBy:e,setRecentTimelinesFilterBy:t})}));yw.displayName="StatefulSidebar";var hw=a(949),vw=a(488);const Ew=Object(n.memo)((({onDismiss:e})=>{const{getUrlForApp:t}=Object(m.j)().services.application,a=Object(v.e)({name:"endpointList"}),n=t(s.l,{path:a}),r=Object(vw.a)(s.l,{path:a});return i.a.createElement(U.EuiCallOut,{"data-test-subj":"endpoint-prompt-banner",iconType:"cheer",title:i.a.createElement(i.a.Fragment,null,i.a.createElement("b",null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.endpointNotice.introducing",defaultMessage:"Introducing: "})),i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.endpointNotice.title",defaultMessage:"Endpoint Security"}))},i.a.createElement(i.a.Fragment,null,i.a.createElement("p",null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.endpointNotice.message",defaultMessage:"Protect your hosts with threat prevention, detection, and deep security data visibility."})),i.a.createElement(U.EuiButton,{onClick:r,href:n},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.endpointNotice.tryButton",defaultMessage:"Try Endpoint Security"})),i.a.createElement(U.EuiButtonEmpty,{onClick:e},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.endpointNotice.dismiss",defaultMessage:"Dismiss message"}))))}));Ew.displayName="EndpointNotice";var xw=a(1111),jw=a(60),Sw=a(141),kw=a(13),Ow=a(408);const ww=$.i18n.translate("xpack.securitySolution.overview.ctiDashboardDangerPanelTitle",{defaultMessage:"No threat intelligence data"}),Tw=$.i18n.translate("xpack.securitySolution.overview.ctiDashboardEnableThreatIntel",{defaultMessage:"You need to enable threat intel sources in order to view data."}),Iw=$.i18n.translate("xpack.securitySolution.overview.ctiDashboardDangerButton",{defaultMessage:"Enable sources"}),Cw=$.i18n.translate("xpack.securitySolution.overview.ctiDashboardTitle",{defaultMessage:"Threat Intelligence"}),Mw=($.i18n.translate("xpack.securitySolution.overview.ctiViewDasboard",{defaultMessage:"View dashboard"}),$.i18n.translate("xpack.securitySolution.overview.ctiDashboardOtherDatasourceTitle",{defaultMessage:"Others"})),_w=$.i18n.translate("xpack.securitySolution.overview.ctiLinkSource",{defaultMessage:"Source"});var Fw=a(167);const Aw="ctiEventCountQuery",Dw=Object(Sw.d)((e=>(({data:e,defaultIndex:t,timerange:a,signal:n})=>e.search.search({defaultIndex:t,factoryQueryType:Ow.a.dataSource,timerange:a},{strategy:"securitySolutionSearchStrategy",abortSignal:n}))(e).pipe(Object(jw.filter)((e=>Object(kw.isErrorResponse)(e)||Object(kw.isCompleteResponse)(e)))))),Nw=({to:e,from:t,allTiDataSources:a,setQuery:i,deleteQuery:r})=>{const[o,l]=Object(n.useState)([]),[c,u]=Object(n.useState)(!1),{data:d,uiSettings:p}=Object(m.j)().services,b=p.get(s.T),{result:g,start:f,loading:y}=Object(Sw.c)(Dw);Object(n.useEffect)((()=>{f({data:d,timerange:e&&t?{to:e,from:t,interval:""}:void 0,defaultIndex:b})}),[e,t,f,d,b]),Object(n.useEffect)((()=>{var e,t;!y&&null!=g&&g.rawResponse&&null!=g&&g.inspect&&i&&i({id:Aw,inspect:{dsl:null!==(e=null==g||null===(t=g.inspect)||void 0===t?void 0:t.dsl)&&void 0!==e?e:[],response:[JSON.stringify(g.rawResponse,null,2)]},loading:y,refetch:()=>{}})}),[i,y,g]),Object(n.useEffect)((()=>()=>{r&&r({id:Aw})}),[r]),Object(n.useEffect)((()=>{g&&!c&&u(!0)}),[c,g]),Object(n.useEffect)((()=>{if(!y&&g){var e,t,n,i;const r=null!==(e=null==g||null===(t=g.rawResponse)||void 0===t||null===(n=t.aggregations)||void 0===n||null===(i=n.dataset)||void 0===i?void 0:i.buckets)&&void 0!==e?e:[],s=e=>{var t,a;return null==e||null===(t=e.buckets)||void 0===t||null===(a=t[0])||void 0===a?void 0:a.key},o=r.reduce(((e,t)=>{const a=s(null==t?void 0:t.name);if(a)return{...e,[t.key]:{dataset:null==t?void 0:t.key,name:a,dashboardId:s(null==t?void 0:t.dashboard),count:null==t?void 0:t.doc_count}};{var n,i,r;const a=Fw.o,s=null!==(n=null===(i=e[a])||void 0===i?void 0:i.count)&&void 0!==n?n:0;return{...e,[a]:{dataset:a,name:Mw,count:s+(null!==(r=null==t?void 0:t.doc_count)&&void 0!==r?r:0)}}}}),{});Array.isArray(a)&&a.forEach((e=>{o[e.dataset]||(o[e.dataset]={...e,count:0})})),l(Object.values(o))}}),[g,y,a]);const h=o.reduce(((e,t)=>e+t.count),0);return{tiDataSources:o,totalCount:h,isInitiallyLoaded:c}},Pw=({http:e,tagIds:t},a)=>e.post(s.Bb,{body:JSON.stringify({tagIds:t}),signal:a}),Rw=({http:e,tagName:t},a)=>e.get(s.Eb,{query:{name:t},signal:a}),Lw=({savedObjectsTaggingClient:e,tag:t})=>e.create(t),Bw=$.i18n.translate("xpack.securitySolution.overview.linkPanelLearnMoreButton",{defaultMessage:"Learn More"}),qw=G()(U.EuiFlexGroup).withConfig({displayName:"ButtonContainer",componentId:"sc-1mnynj-0"})(["padding:",";"],(({theme:e})=>e.eui.euiSizeS)),zw=G()(U.EuiIcon).withConfig({displayName:"Icon",componentId:"sc-1mnynj-1"})(["padding:0;margin-top:",";margin-left:12px;transform:scale(",");"],(({theme:e})=>e.eui.euiSizeM),(({color:e})=>"primary"===e?1.4:1)),$w=G()(U.EuiSplitPanel.Inner).withConfig({displayName:"PanelContainer",componentId:"sc-1mnynj-2"})(["margin-bottom:",";"],(({theme:e})=>e.eui.euiSizeM)),Vw=G()(U.EuiText).withConfig({displayName:"Title",componentId:"sc-1mnynj-3"})(["color:",";margin-bottom:",";"],(({theme:e,textcolor:t})=>"primary"===t?e.eui.euiColorPrimary:e.eui.euiColorWarningText),(({theme:e})=>e.eui.euiSizeM)),Uw=({body:e,button:t,color:a,dataTestSubj:n,learnMoreLink:r,title:s})=>i.a.createElement($w,{grow:!1,color:a},i.a.createElement(U.EuiFlexGroup,{direction:"column","data-test-subj":n},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiFlexGroup,{direction:"row"},i.a.createElement(zw,{type:"primary"===a?"iInCircle":"help",size:"m",color:a}),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(Vw,{"data-test-subj":"inner-link-panel-title",textcolor:a},s))),i.a.createElement("p",null,e," ",r&&i.a.createElement(U.EuiLink,{href:r,target:"_blank","data-test-subj":`${n}-learn-more`,external:!0},Bw))),t&&i.a.createElement(qw,null,i.a.createElement(U.EuiFlexItem,{grow:!1},t))));Uw.displayName="InnerLinkPanel";const Hw=G()(U.EuiBasicTable).withConfig({displayName:"StyledTable",componentId:"sc-1uwt3ks-0"})(["[data-test-subj='panel-link'],[data-test-subj='panel-no-link']{opacity:0;}tr:hover{[data-test-subj='panel-link'],[data-test-subj='panel-no-link']{opacity:1;}}"]),Gw=({button:e,columns:t,dataTestSubj:a,defaultSortField:r,defaultSortOrder:s,infoPanel:o,inspectQueryId:l,listItems:c,panelTitle:u,splitPanel:d,subtitle:p})=>{const[m,b]=Object(n.useState)(0),[g,f]=Object(n.useState)(null!=r?r:"title"),[y,h]=Object(n.useState)(null!=s?s:"asc"),v=Object(n.useMemo)((()=>((e,t,a)=>{const n=[...e].sort(((e,a)=>{const n=e[t],i=a[t];return void 0!==n&&void 0!==i?n===i?e.title>a.title?1:e.title<a.title?-1:0:n>i?1:n<i?-1:0:0}));return"desc"===a&&n.reverse(),Object(it.chunk)(n,5)})(c,g,y)),[c,y,g]),E=Object(n.useMemo)((()=>({showPerPageOptions:!1,pageIndex:m,pageSize:5,totalItemCount:c.length})),[m,c.length]),x=Object(n.useMemo)((()=>({sort:{direction:y,field:g}})),[g,y]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,{"data-test-subj":"spacer",size:"l"}),i.a.createElement(U.EuiFlexGroup,{gutterSize:"l",justifyContent:"spaceBetween","data-test-subj":a},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(Ve.c,null,i.a.createElement(U.EuiPanel,{hasBorder:!0},i.a.createElement(pn.a,{id:l,subtitle:p,title:u},i.a.createElement(i.a.Fragment,null,e)),d,o,v.length>0&&i.a.createElement(Hw,{columns:t,itemId:"id",items:v[m]||[],onChange:({page:e,sort:t})=>{const{index:a}=e;if(b(a),t){const{field:e,direction:a}=t;f(e),h(a)}},pagination:E,sorting:x}))))))},Qw=i.a.memo(Gw);Qw.displayName="LinkPanel";const Ww=({path:e,copy:t})=>e?i.a.createElement(U.EuiLink,{href:e,target:"_blank","data-test-subj":"panel-link"},t):i.a.createElement(U.EuiText,{color:"subdued",size:"s","data-test-subj":"panel-no-link"},t);Ww.displayName="Link";const Kw=[{name:"Name",field:"title",sortable:!0,truncateText:!0,width:"100%"},{name:"Indicator",field:"count",render:e=>{var t;if(e<1e4)return e.toString();const{magnitude:a,unit:n}=null!==(t=[{magnitude:1e18,unit:"E"},{magnitude:1e15,unit:"P"},{magnitude:1e12,unit:"T"},{magnitude:1e9,unit:"B"},{magnitude:1e6,unit:"M"},{magnitude:1e3,unit:"K"}].find((t=>e>=t.magnitude)))&&void 0!==t?t:{magnitude:1,unit:""};return((e,t)=>{const a=e.toFixed(t);return+a<=e?a:(+a-Math.pow(.1,t)).toFixed(t)})(e/a,1).replace(/\.0+$|(\.[0-9]*[1-9])0+$/,"$1")+n},sortable:!0,truncateText:!0,width:"70px",align:"right"},{name:"",field:"path",truncateText:!0,width:"80px",render:e=>i.a.createElement(Ww,{path:e,copy:_w})}],Yw=({isInspectEnabled:e=!0,listItems:t,splitPanel:a,totalCount:r=0})=>i.a.createElement(Qw,{columns:Kw,dataTestSubj:"cti-dashboard-links",inspectQueryId:e?Aw:void 0,listItems:t,panelTitle:Cw,splitPanel:a,subtitle:Object(n.useMemo)((()=>i.a.createElement(Fs.FormattedMessage,{"data-test-subj":"cti-total-event-count",defaultMessage:"Showing: {totalCount} {totalCount, plural, one {indicator} other {indicators}}",id:"xpack.securitySolution.overview.ctiDashboardSubtitle",values:{totalCount:r}})),[r]),button:Object(n.useMemo)((()=>i.a.createElement(ge.l,{"data-test-subj":"cti-view-indicators",deepLinkId:s.wc.threatIntelligence},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.overview.threatIndicatorsAction",defaultMessage:"View indicators"}))),[])}),Jw=e=>{const{to:t,from:a,allTiDataSources:r,setQuery:o,deleteQuery:l}=e,{tiDataSources:c,totalCount:u}=Nw({to:t,from:a,allTiDataSources:r,setQuery:o,deleteQuery:l}),{listItems:d}=(({tiDataSources:e=[]})=>{const{dashboards:t}=(()=>{const{http:e}=Object(m.j)().services,{data:t,isLoading:a,error:i}=Object(du.b)(du.a.CTI_TAGS,Rw,{initialParameters:{http:e,tagName:"threat intel"}}),{fetch:r,data:s,isLoading:o}=Object(du.b)(du.a.CTI_TAGS,Pw);return Object(n.useEffect)((()=>{a||i||null==t||!t.length||r({http:e,tagIds:t.map((e=>e.id))})}),[i,r,e,a,t]),{dashboards:s,isLoading:o||a}})(),a=Object(p.n)();return{listItems:Object(n.useMemo)((()=>{var n;const i=null!==(n=null==t?void 0:t.map((({id:e})=>e)))&&void 0!==n?n:[];return e.map((e=>{let t="";return e.dashboardId&&i.includes(e.dashboardId)&&(t=`${a({deepLinkId:s.wc.dashboards,path:e.dashboardId})}`),{title:e.name,count:e.count,path:t}}))}),[t,e,a])}})({tiDataSources:c});return i.a.createElement(Yw,{listItems:d,totalCount:u})},Xw=i.a.memo(Jw);Xw.displayName="CtiEnabledModule";const Zw=({bodyCopy:e,buttonCopy:t,dataTestSubjPrefix:a,docLink:n,learnMoreUrl:r,LinkPanelViewComponent:s,listItems:o,moreButtons:l,titleCopy:c})=>i.a.createElement(s,{listItems:o,splitPanel:i.a.createElement(Uw,{body:e,button:i.a.createElement(U.EuiFlexGroup,null,t&&n&&i.a.createElement(U.EuiFlexItem,null,i.a.createElement(ge.g,{color:"warning",href:n,target:"_blank","data-test-subj":`${a}-enable-module-button`},t)),l&&l),color:"warning",dataTestSubj:`${a}-inner-panel-danger`,learnMoreLink:r,title:c})}),eT=Object(n.memo)(Zw);eT.displayName="DisabledLinkPanel";const tT=()=>{const e=`${Object(m.d)()}/app/integrations/browse/threat_intel`;return i.a.createElement(eT,{bodyCopy:Tw,buttonCopy:Iw,dataTestSubjPrefix:"cti",docLink:e,listItems:[],titleCopy:ww,LinkPanelViewComponent:Yw})},aT=i.a.memo(tT);aT.displayName="CtiDisabledModule";const nT=e=>{const{allTiDataSources:t}=e;return t.length>0?i.a.createElement("div",{"data-test-subj":"cti-enabled-module"},i.a.createElement(Xw,Ni()({},e,{allTiDataSources:t}))):i.a.createElement("div",{"data-test-subj":"cti-disabled-module"},i.a.createElement(aT,null))},iT=i.a.memo(nT);iT.displayName="ThreatIntelDashboardLinksComponent";const rT=()=>{const e=Object(n.useMemo)((()=>Vr.d.globalFiltersQuerySelector()),[]),t=Object(n.useMemo)((()=>Vr.d.globalQuerySelector()),[]),a=Object(j.a)(t),r=Object(j.a)(e),{from:o,deleteQuery:l,setQuery:c,to:u}=Object(J.a)(),{indicesExist:d,indexPattern:p,selectedPatterns:m}=Object(g.d)(),b=Object(n.useMemo)((()=>[s.ob]),[]),[,{indexExists:f}]=Object(Vk.b)(b,!0),{addMessage:y,hasMessage:v}=Object(xw.a)(),x=Object(n.useMemo)((()=>v("management","dismissEndpointNotice")),[v]),[k,O]=Object(n.useState)(x),w=Object(n.useCallback)((()=>{O(!0),y("management","dismissEndpointNotice")}),[y]),{endpointPrivileges:{canAccessFleet:T}}=Object(ch.a)(),{hasIndexRead:I,hasKibanaREAD:C}=Object(Rr.a)(),{tiDataSources:M,isInitiallyLoaded:_}=(()=>{const{to:e,from:t}=Object(n.useMemo)((()=>({to:(new Date).toISOString(),from:new Date(0).toISOString()})),[]),{tiDataSources:a,isInitiallyLoaded:i}=Nw({to:e,from:t});return{tiDataSources:a,isInitiallyLoaded:i}})();return i.a.createElement(i.a.Fragment,null,d?i.a.createElement(i.a.Fragment,null,i.a.createElement(X.a,null,i.a.createElement(ee.a,{id:Y.a.global,indexPattern:p})),i.a.createElement(h.a,null,!k&&!f&&T&&i.a.createElement(i.a.Fragment,null,i.a.createElement(Ew,{onDismiss:w}),i.a.createElement(U.EuiSpacer,{size:"l"})),i.a.createElement(U.EuiFlexGroup,null,i.a.createElement(U.EuiShowFor,{sizes:["xl"]},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(yw,null))),i.a.createElement(U.EuiFlexItem,{grow:3},i.a.createElement(U.EuiFlexGroup,{direction:"column",responsive:!1,gutterSize:"none"},I&&C&&i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(hw.a,{filters:r,query:a}),i.a.createElement(U.EuiSpacer,{size:"l"})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(Uk.a,{deleteQuery:l,filters:r,from:o,indexPattern:p,indexNames:m,query:a,queryType:"overview",setQuery:c,to:u})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(SO,{filters:r,from:o,indexNames:m,indexPattern:p,query:a,setQuery:c,to:u})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFlexGroup,{direction:"row"},i.a.createElement(U.EuiFlexItem,{grow:1},_&&i.a.createElement(iT,{allTiDataSources:M,deleteQuery:l,from:o,setQuery:c,to:u}))))))))):i.a.createElement(Mi.a,null),i.a.createElement(E.a,{pageName:S.a.overview}))},sT=i.a.memo(rT);var oT=a(1536),lT=a(309);const cT={width:"322px"},uT=G()(U.EuiFormControlLayout).withConfig({displayName:"FormControlLayout",componentId:"sc-1q85sh-0"})(["max-width:500px;height:42px;.euiFormControlLayout__childrenWrapper{overflow:visible;}"]),dT=G.a.div.withConfig({displayName:"Option",componentId:"sc-1q85sh-1"})(["overflow:hidden;text-overflow:ellipsis;white-space:nowrap;width:100%;"]),pT=G.a.span.withConfig({displayName:"OptionLabel",componentId:"sc-1q85sh-2"})(["font-weight:bold;"]),mT=[{label:Lm.h,value:"hot"},{label:Lm.o,value:"warm"},{disabled:!0,label:Lm.c,value:"cold"},{disabled:!0,label:Lm.g,value:"frozen"},{label:Lm.l,value:"unmanaged"}],bT=[{label:Lm.h,value:"hot"},{label:Lm.o,value:"warm"},{label:Lm.l,value:"unmanaged"}],gT=e=>i.a.createElement(U.EuiToolTip,{content:`${e.label}: ${Object(oT.j)(e.label)}`},i.a.createElement(dT,null,i.a.createElement(pT,null,`${e.label}`),": ",i.a.createElement("span",null,Object(oT.j)(e.label)))),fT=()=>{const{hasAssistantPrivilege:e}=Object(lT.a)(),t=m.b.get().http.fetch,{baseTheme:a,theme:r}=Object(Na.i)(),o=Object(m.n)(),{services:{telemetry:c}}=Object(m.j)(),u=Object(n.useCallback)((e=>{o.addSuccess(e)}),[o]),[d]=Object(m.p)(s.A),[p]=Object(m.p)(s.O),b=Object(U.useGeneratedHtmlId)({prefix:"labelInput"}),[f,y]=Object(n.useState)(bT),{indicesExist:v,loading:x,selectedPatterns:j}=Object(g.d)(),{signalIndexName:k,loading:O}=Object(fb.a)(),w=Object(n.useMemo)((()=>null!=k?[k,...j]:[...j]),[j,k]),T=Object(n.useMemo)((()=>i.a.createElement(U.EuiText,{color:"subdued",size:"s"},i.a.createElement("span",null,oT.c)," ",i.a.createElement(U.EuiLink,{external:!0,href:oT.f,rel:"noopener noreferrer",target:"_blank"},Lm.f))),[]),I=Object(n.useMemo)((()=>f.map((({label:e})=>e))),[f]),C=Object(n.useMemo)((()=>i.a.createElement(U.EuiFormLabel,{htmlFor:b},oT.g)),[b]),[M,_]=Object(Ee.a)({defaultValue:"",key:"dataQualityDashboardLastChecked"}),F=Object(m.h)(),A=Object(n.useCallback)((()=>F.create&&F.read),[F.create,F.read]),{cases:D}=Object(m.j)().services,N=D.hooks.useCasesAddToNewCaseFlyout({toastContent:Lm.a}),P=Object(n.useCallback)((({comments:e,headerContent:t})=>{const a=e.map((e=>({comment:e,type:l.AttachmentType.user})));N.open({attachments:a,headerContent:t})}),[N]),R=Object(n.useCallback)((e=>{c.reportDataQualityIndexChecked(e)}),[c]),L=Object(n.useCallback)((e=>{c.reportDataQualityCheckAllCompleted(e)}),[c]);return x||O?i.a.createElement(U.EuiLoadingSpinner,{size:"l","data-test-subj":"ecsDataQualityDashboardLoader"}):i.a.createElement(i.a.Fragment,null,v?i.a.createElement(h.a,{"data-test-subj":"ecsDataQualityDashboardPage"},i.a.createElement(Ci.a,{subtitle:T,title:Lm.d},i.a.createElement(U.EuiToolTip,{content:oT.h},i.a.createElement(uT,{prepend:C},i.a.createElement(U.EuiComboBox,{id:b,"data-test-subj":"selectIlmPhases",placeholder:oT.i,renderOption:gT,selectedOptions:f,style:cT,options:mT,onChange:y})))),i.a.createElement(oT.e,{addSuccessToast:u,canUserCreateAndReadCases:A,defaultBytesFormat:d,defaultNumberFormat:p,getGroupByFieldsOnClick:Ka,reportDataQualityCheckAllCompleted:L,reportDataQualityIndexChecked:R,httpFetch:t,ilmPhases:I,isAssistantEnabled:e,lastChecked:M,openCreateCaseFlyout:P,patterns:w,setLastChecked:_,baseTheme:a,theme:r})):i.a.createElement(Mi.a,null),i.a.createElement(E.a,{pageName:S.a.dataQuality}))};fT.displayName="DataQualityComponent";const yT=i.a.memo(fT),hT=$.i18n.translate("xpack.securitySolution.socTrends.properties.lockDatePickerTooltip",{defaultMessage:"Disable syncing of date/time range between the currently viewed page and SOC Trends"}),vT=$.i18n.translate("xpack.securitySolution.socTrends.properties.unlockDatePickerTooltip",{defaultMessage:"Enable syncing of date/time range between the currently viewed page and SOC Trends"}),ET=$.i18n.translate("xpack.securitySolution.socTrends.properties.lockDatePickerDescription",{defaultMessage:"Lock global date picker to SOC Trends date picker"}),xT=$.i18n.translate("xpack.securitySolution.socTrends.properties.unlockDatePickerDescription",{defaultMessage:"Unlock global date picker from SOC Trends date picker"}),jT=()=>{const e=Object(o.useDispatch)(),t=Object(n.useMemo)((()=>te.d.globalSelector()),[]),a=Object(j.b)((e=>t(e).linkTo.includes(Y.a.socTrends))),r=Object(n.useCallback)((()=>e(te.b.toggleSocTrendsLinkTo())),[e]);return i.a.createElement(U.EuiToolTip,{"data-test-subj":"socTrends-date-picker-lock-tooltip",position:"top",content:a?hT:vT},i.a.createElement(U.EuiButtonIcon,{"data-test-subj":`socTrends-date-picker-${a?"lock":"unlock"}-button`,color:"primary",onClick:r,iconType:a?"lock":"lockOpen","aria-label":a?xT:ET}))};jT.displayName="SocTrendsDatePickerLockComponent";const ST=i.a.memo(jT);var kT=a(378);const OT=$.i18n.translate("xpack.securitySolution.detectionResponse.socTrends",{defaultMessage:"SOC Trends"}),wT=$.i18n.translate("xpack.securitySolution.detectionResponse.mttr",{defaultMessage:"Average case response time"}),TT=$.i18n.translate("xpack.securitySolution.detectionResponse.mttrDescription",{defaultMessage:"The average duration (from creation to closure) for your current cases"}),IT=$.i18n.translate("xpack.securitySolution.detectionResponse.criticalAlerts",{defaultMessage:"Open critical alerts"}),CT=$.i18n.translate("xpack.securitySolution.detectionResponse.criticalAlertsDescription",{defaultMessage:"The count of open critical alerts for the current time range"}),MT=e=>$.i18n.translate("xpack.securitySolution.detectionResponse.noChange",{defaultMessage:"Your {dataType} is unchanged",values:{dataType:e}}),_T=e=>$.i18n.translate("xpack.securitySolution.detectionResponse.noData",{defaultMessage:"There is no {dataType} data to compare",values:{dataType:e}}),FT=e=>$.i18n.translate("xpack.securitySolution.detectionResponse.noDataCompare",{defaultMessage:"There is no {dataType} data to compare from the compare time range",values:{dataType:e}}),AT=e=>$.i18n.translate("xpack.securitySolution.detectionResponse.noDataCurrent",{defaultMessage:"There is no {dataType} data to compare from the current time range",values:{dataType:e}}),DT=({upOrDown:e,percentageChange:t,stat:a,statType:n})=>$.i18n.translate("xpack.securitySolution.detectionResponse.timeDifference",{defaultMessage:"Your {statType} is {upOrDown} by {percentageChange} from {stat}",values:{upOrDown:e,percentageChange:t,stat:a,statType:n}}),NT=(e,t)=>{switch(t.type){case"setIsLoading":return{...e,isLoading:t.isLoading};case"setUpdatedAt":return{...e,updatedAt:t.updatedAt};case"setStat":return{...e,stat:t.stat};case"setPercentage":return{...e,percentage:t.percentage};default:throw new Error}};var PT=a(1620),RT=a.n(PT);const LT=(e,t)=>null!=e&&0!==e&&null!=t&&0!==t?`${((e-t)/t*100).toFixed(1)}%`:null,BT=e=>RT()(1e3*e,{compact:!0,verbose:!1}),qT=({from:e,to:t})=>({size:0,query:{bool:{filter:[{range:{"@timestamp":{gte:e,lte:t}}}]}},aggs:{open:{filter:{term:{"kibana.alert.workflow_status":"open"}},aggs:{critical:{filter:{term:{"kibana.alert.severity":"critical"}}}}}}}),zT="socTrends",$T=G()(U.EuiPanel).withConfig({displayName:"StyledEuiPanel",componentId:"sc-h2q72s-0"})(["min-width:300px;"]),VT=G()(U.EuiFlexGroup).withConfig({displayName:"StyledEuiFlexGroup",componentId:"sc-h2q72s-1"})(["max-width:300px;"]),UT=({signalIndexName:e})=>{const{toggleStatus:t,setToggleStatus:a}=Object(Wn.a)(zT),{stats:r,latestUpdate:o,isUpdating:c}=(({skip:e=!1,signalIndexName:t})=>{const{to:a,from:i,setQuery:r,deleteQuery:o}=Object(J.a)(),{from:c="",to:u=""}=Object(j.a)((e=>Object(x.pick)(["from","to"],Vr.d.socTrendsTimeRangeSelector(e)))),d=(({deleteQuery:e,from:t,fromCompare:a,setQuery:i,skip:r=!1,to:o,toCompare:c})=>{const{services:{cases:u}}=Object(m.j)(),d=Object(n.useMemo)((()=>`useCasesMttr-${Object(nt.v4)()}`),[]),[p,b]=Object(n.useReducer)(NT,{description:TT,isLoading:!0,percentage:{percent:null,color:"hollow",note:_T("case")},stat:"-",testRef:"casesMttr",title:wT,updatedAt:Date.now()});return Object(n.useEffect)((()=>{let n=!0;const p=new AbortController,m=async()=>{try{const[e,i]=await Promise.all([u.api.cases.getCasesMetrics({from:t,to:o,owner:s.i,features:[l.CaseMetricsFeature.MTTR]},p.signal),u.api.cases.getCasesMetrics({from:a,to:c,owner:s.i,features:[l.CaseMetricsFeature.MTTR]},p.signal)]),r=LT(e.mttr,i.mttr);if(n&&null!=e.mttr?b({type:"setStat",stat:BT(e.mttr)}):n&&b({type:"setStat",stat:"-"}),null!=e.mttr&&null!=i.mttr&&null!=r){const e="-"===r.charAt(0),t="0.0%"===r;b({type:"setPercentage",percentage:{percent:e||t?r:`+${r}`,color:t?"hollow":e?"success":"danger",note:t?MT("case resolution time"):DT({upOrDown:e?"down":"up",percentageChange:e?r.substring(1):r,stat:BT(i.mttr),statType:"case resolution time"})}})}else{const t=null==e.mttr,a=null==i.mttr,n=t&&a?_T("case"):t?AT("case"):FT("case");b({type:"setPercentage",percentage:{percent:null,color:"hollow",note:n}})}}catch(e){n&&b({type:"setStat",stat:"-"})}n&&(b({type:"setIsLoading",isLoading:!1}),b({type:"setUpdatedAt",updatedAt:Date.now()}))};return r||(m(),i({id:d,inspect:null,loading:!1,refetch:m})),r&&(b({type:"setIsLoading",isLoading:!1}),n=!1,p.abort()),()=>{n=!1,p.abort(),e&&e({id:d})}}),[u.api.cases,t,r,o,i,e,d,a,c]),p})({deleteQuery:o,from:i,fromCompare:c,setQuery:r,skip:e,to:a,toCompare:u}),p=(({from:e,fromCompare:t,skip:a=!1,signalIndexName:i,to:r,toCompare:s})=>{var o,l;const[c,u]=Object(n.useReducer)(NT,{description:CT,isLoading:!0,percentage:{percent:null,color:"hollow",note:_T("alerts")},stat:"-",testRef:"criticalAlerts",title:IT,updatedAt:Date.now()}),d=Object(n.useMemo)((()=>qT({from:e,to:r})),[e,r]),p=Object(n.useMemo)((()=>qT({from:t,to:s})),[t,s]),{data:m,loading:b,setQuery:g}=Object(I.a)({query:d,indexName:i,skip:a,queryName:C.a.SOC_TRENDS}),{data:f,loading:y,setQuery:h}=Object(I.a)({query:p,indexName:i,skip:a,queryName:C.a.SOC_TRENDS});Object(n.useEffect)((()=>{g(d)}),[d,g]),Object(n.useEffect)((()=>{h(p)}),[p,h]),Object(n.useEffect)((()=>{u({type:"setIsLoading",isLoading:b||y})}),[b,y]);const v=Object(n.useMemo)((()=>{var e,t;return null!==(e=null==m||null===(t=m.aggregations)||void 0===t?void 0:t.open.critical.doc_count)&&void 0!==e?e:null}),[null==m||null===(o=m.aggregations)||void 0===o?void 0:o.open.critical.doc_count]),E=Object(n.useMemo)((()=>{var e,t;return null!==(e=null==f||null===(t=f.aggregations)||void 0===t?void 0:t.open.critical.doc_count)&&void 0!==e?e:null}),[null==f||null===(l=f.aggregations)||void 0===l?void 0:l.open.critical.doc_count]);return Object(n.useEffect)((()=>{const e=LT(v,E);if(u(null!=v?{type:"setStat",stat:`${v}`}:{type:"setStat",stat:"-"}),null!=v&&null!=E&&0!==v&&0!==E&&null!=e){const t="-"===e.charAt(0),a="0.0%"===e;u({type:"setPercentage",percentage:{percent:t||a?e:`+${e}`,color:a?"hollow":t?"success":"danger",note:a?MT("open critical alert count"):DT({upOrDown:t?"down":"up",percentageChange:t?e.substring(1):e,stat:`${E}`,statType:"open critical alert count"})}})}else{const e=null==v||0===v,t=!e||null!=E&&0!==E?e?AT("alerts"):FT("alerts"):_T("alerts");u({type:"setPercentage",percentage:{percent:null,color:"hollow",note:t}})}u({type:"setUpdatedAt",updatedAt:Date.now()})}),[v,E]),c})({from:i,fromCompare:c,skip:e,signalIndexName:t,to:a,toCompare:u}),b=Object(n.useMemo)((()=>Math.max(d.updatedAt,p.updatedAt)),[d.updatedAt,p.updatedAt]),g=Object(n.useMemo)((()=>d.isLoading||p.isLoading),[d.isLoading,p.isLoading]);return{stats:[d,p],isUpdating:g,latestUpdate:b}})({skip:!t,signalIndexName:e}),u=Object(n.useMemo)((()=>r.map((e=>(e=>({title:i.a.createElement(U.EuiToolTip,{content:e.description},i.a.createElement(U.EuiText,null,i.a.createElement("h6",null,e.title," ",i.a.createElement(U.EuiIcon,{type:"questionInCircle"})))),description:e.isLoading?i.a.createElement(U.EuiLoadingSpinner,{"data-test-subj":`${e.testRef}-stat-loading-spinner`}):i.a.createElement(i.a.Fragment,null,e.stat," ",i.a.createElement(U.EuiToolTip,{content:e.percentage.note},i.a.createElement(U.EuiBadge,{color:e.percentage.color},null!=e.percentage.percent?e.percentage.percent:"-")))}))(e)))),[r]);return i.a.createElement($T,{hasBorder:!0},i.a.createElement(pn.a,{id:zT,showInspectButton:!1,stackHeader:!0,subtitle:i.a.createElement(Km,{updatedAt:o,isUpdating:c}),title:OT,titleSize:"s",toggleQuery:a,toggleStatus:t},i.a.createElement(VT,{gutterSize:"s"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(kT.a,{id:Y.a.socTrends,showUpdateButton:"iconOnly",width:"auto",compressed:!0})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(ST,null)))),t&&i.a.createElement(U.EuiFlexGroup,{direction:"column",gutterSize:"s"},i.a.createElement(U.EuiFlexItem,{grow:!0},i.a.createElement(U.EuiDescriptionList,{"data-test-subj":"statsList",textStyle:"reverse",listItems:u}))))},HT=i.a.memo(UT);var GT=a(247);const QT="hostsBySeverity",WT={pageCount:0,currentPage:0},KT=({from:e,to:t,currentPage:a,filterQuery:n})=>{const i=da.a*a;return{query:{bool:{filter:[{term:{"kibana.alert.workflow_status":"open"}},{range:{"@timestamp":{gte:e,lte:t}}},...n?[n]:[]]}},size:0,aggs:{host_count:{cardinality:{field:"host.name"}},[QT]:{terms:{size:100,field:"host.name",order:[{"critical.doc_count":"desc"},{"high.doc_count":"desc"},{"medium.doc_count":"desc"},{"low.doc_count":"desc"}]},aggs:{critical:{filter:{term:{"kibana.alert.severity":"critical"}}},high:{filter:{term:{"kibana.alert.severity":"high"}}},medium:{filter:{term:{"kibana.alert.severity":"medium"}}},low:{filter:{term:{"kibana.alert.severity":"low"}}},bucketOfPagination:{bucket_sort:{from:i,size:4}}}}}}},YT=({extraFilter:e,dataView:t}={})=>{const{from:a,to:i}=Object(J.a)(),r=Object(n.useMemo)((()=>Vr.d.globalFiltersQuerySelector()),[]),s=Object(n.useMemo)((()=>Vr.d.globalQuerySelector()),[]),o=Object(j.a)(s),l=Object(j.a)(r),{uiSettings:c}=Object(m.j)().services,u=Object(n.useMemo)((()=>{const t=l.filter((e=>!1===e.meta.disabled));return e?[...t,e]:t}),[e,l]),{filterQuery:d,kqlError:p}=Object(n.useMemo)((()=>JT(o,u,Object(Ms.getEsQueryConfig)(c),t)),[t,o,u,c]),b=Object(n.useMemo)((()=>d?JSON.stringify(d):void 0),[d]);return Object(Cp.a)({id:"GlobalFilterQuery",filterQuery:b,kqlError:p,query:o,startDate:a,endDate:i}),{filterQuery:d}},JT=(e,t,a,n)=>{try{return{filterQuery:Object(bt.buildEsQuery)(n,[e],t,a)}}catch(e){return{kqlError:e}}},XT="vulnerableHostsBySeverityQuery",ZT=i.a.memo((({signalIndexName:e})=>{const t=Rm(),{filterQuery:a}=YT(),r=Object(n.useCallback)((({hostName:e,severity:a})=>t([{title:sa,selectedOptions:[e],fieldName:"host.name"},...a?[{title:na,selectedOptions:[a],fieldName:at.U}]:[]])),[t]),{toggleStatus:s,setToggleStatus:o}=Object(Wn.a)(XT),{items:l,isLoading:c,updatedAt:u,pagination:d}=(({skip:e,queryId:t,signalIndexName:a,filterQuery:i})=>{const[r,s]=Object(n.useState)(Date.now()),[o,l]=Object(n.useState)([]),[c,u]=Object(n.useState)(WT),{to:d,from:p,setQuery:m,deleteQuery:b}=Object(J.a)(),g=Object(n.useMemo)((()=>KT({from:p,to:d,currentPage:c.currentPage,filterQuery:i})),[i,p,c.currentPage,d]),{data:f,request:y,response:h,setQuery:v,loading:E,refetch:x}=Object(I.a)({query:g,indexName:a,skip:e,queryName:C.a.VULNERABLE_HOSTS});Object(n.useEffect)((()=>{v(g)}),[v,c.currentPage,g]),Object(n.useEffect)((()=>{var e,t;null!=f&&f.aggregations?(l((null!==(t=null==(e=f.aggregations)?void 0:e[QT].buckets)&&void 0!==t?t:[]).reduce(((e,t)=>{var a;return e.push({hostName:null!==(a=Object(Ba.a)(t.key))&&void 0!==a?a:"-",totalAlerts:t.doc_count,low:t.low.doc_count,medium:t.medium.doc_count,high:t.high.doc_count,critical:t.critical.doc_count}),e}),[])),u((e=>{var t;return{...e,pageCount:Object(da.c)(null===(t=f.aggregations)||void 0===t?void 0:t.host_count.value)}}))):l([]),s(Date.now())}),[f]);const j=Object(n.useCallback)((()=>{!e&&x&&x()}),[e,x]);return Object(ft.b)({deleteQuery:b,inspect:{dsl:[y],response:[h]},refetch:j,setQuery:m,queryId:t,loading:E}),{items:o,isLoading:E,updatedAt:r,pagination:{...c,setPage:e=>{u((t=>({...t,currentPage:e})))}}}})({skip:!s,queryId:XT,signalIndexName:e,filterQuery:a}),p=Object(n.useMemo)((()=>eI(r)),[r]);return i.a.createElement(Bp.a,{show:!0,targetClassNames:[Ve.a]},i.a.createElement(U.EuiPanel,{hasBorder:!0,"data-test-subj":"severityHostAlertsPanel"},i.a.createElement(pn.a,{id:XT,title:_t,subtitle:i.a.createElement(Km,{updatedAt:u,isUpdating:c}),titleSize:"s",toggleQuery:o,toggleStatus:s,tooltip:ea}),s&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiBasicTable,{items:l,columns:p,loading:c,"data-test-subj":"severityHostAlertsTable",noItemsMessage:i.a.createElement(U.EuiEmptyPrompt,{title:i.a.createElement("h3",null,Nt),titleSize:"xs"})}),i.a.createElement(U.EuiSpacer,{size:"m"}),d.pageCount>1&&i.a.createElement(U.EuiTablePagination,{"data-test-subj":"hostTablePaginator",activePage:d.currentPage,itemsPerPage:da.a,pageCount:d.pageCount,onChangePage:d.setPage,showPerPageOptions:!1}))))}));ZT.displayName="HostAlertsTable";const eI=e=>[{field:"hostName",name:Qt,"data-test-subj":"hostSeverityAlertsTable-hostName",render:e=>i.a.createElement(U.EuiToolTip,{title:Vt,content:e,anchorClassName:"eui-textTruncate"},i.a.createElement(ge.d,{hostName:e}))},{field:"totalAlerts",name:Ot,"data-test-subj":"hostSeverityAlertsTable-totalAlerts",render:(t,{hostName:a})=>i.a.createElement(Dn.c,{data:{value:a,field:"host.name"},mode:GT.b.HOVER_RIGHT,triggerId:Dn.d.ALERTS_COUNT,sourcererScopeId:f.SourcererScopeName.detections,metadata:{andFilters:[{field:"kibana.alert.workflow_status",value:"open"}]}},i.a.createElement(U.EuiLink,{"data-test-subj":"hostSeverityAlertsTable-totalAlertsLink",disabled:0===t,onClick:()=>e({hostName:a})},i.a.createElement(wa.a,{count:t})))},{field:"critical",name:yt,render:(t,{hostName:a})=>i.a.createElement(U.EuiHealth,{"data-test-subj":"hostSeverityAlertsTable-critical",color:da.b.critical},t>0?i.a.createElement(Dn.c,{data:{value:a,field:"host.name"},mode:GT.b.HOVER_RIGHT,triggerId:Dn.d.ALERTS_COUNT,sourcererScopeId:f.SourcererScopeName.detections,metadata:{andFilters:[{field:"kibana.alert.severity",value:"critical"},{field:"kibana.alert.workflow_status",value:"open"}]}},i.a.createElement(U.EuiLink,{"data-test-subj":"hostSeverityAlertsTable-criticalLink",onClick:()=>e({hostName:a,severity:"critical"})},i.a.createElement(wa.a,{count:t}))):i.a.createElement(wa.a,{count:t}))},{field:"high",name:ht,render:(t,{hostName:a})=>i.a.createElement(U.EuiHealth,{"data-test-subj":"hostSeverityAlertsTable-high",color:da.b.high},t>0?i.a.createElement(Dn.c,{data:{value:a,field:"host.name"},mode:GT.b.HOVER_RIGHT,triggerId:Dn.d.ALERTS_COUNT,sourcererScopeId:f.SourcererScopeName.detections,metadata:{andFilters:[{field:"kibana.alert.severity",value:"high"},{field:"kibana.alert.workflow_status",value:"open"}]}},i.a.createElement(U.EuiLink,{onClick:()=>e({hostName:a,severity:"high"})},i.a.createElement(wa.a,{count:t}))):i.a.createElement(wa.a,{count:t}))},{field:"medium",name:vt,render:(t,{hostName:a})=>i.a.createElement(U.EuiHealth,{"data-test-subj":"hostSeverityAlertsTable-medium",color:da.b.medium},t>0?i.a.createElement(Dn.c,{data:{value:a,field:"host.name"},mode:GT.b.HOVER_RIGHT,triggerId:Dn.d.ALERTS_COUNT,sourcererScopeId:f.SourcererScopeName.detections,metadata:{andFilters:[{field:"kibana.alert.severity",value:"medium"},{field:"kibana.alert.workflow_status",value:"open"}]}},i.a.createElement(U.EuiLink,{onClick:()=>e({hostName:a,severity:"medium"})},i.a.createElement(wa.a,{count:t}))):i.a.createElement(wa.a,{count:t}))},{field:"low",name:Et,render:(t,{hostName:a})=>i.a.createElement(U.EuiHealth,{"data-test-subj":"hostSeverityAlertsTable-low",color:da.b.low},t>0?i.a.createElement(Dn.c,{data:{value:a,field:"host.name"},mode:GT.b.HOVER_RIGHT,triggerId:Dn.d.ALERTS_COUNT,sourcererScopeId:f.SourcererScopeName.detections,metadata:{andFilters:[{field:"kibana.alert.severity",value:"low"},{field:"kibana.alert.workflow_status",value:"open"}]}},i.a.createElement(U.EuiLink,{onClick:()=>e({hostName:a,severity:"low"})},i.a.createElement(wa.a,{count:t}))):i.a.createElement(wa.a,{count:t}))}];var tI=a(289);const aI="kibana.alert.rule.name",nI="kibana.alert.rule.uuid",iI="kibana.alert.severity",rI="@timestamp",sI="detection-response-rule-alerts-severity-table",oI=i.a.memo((({signalIndexName:e})=>{const{getAppUrl:t,navigateTo:a}=Object(m.l)(),{toggleStatus:r,setToggleStatus:o}=Object(Wn.a)(sI),{filterQuery:l}=YT(),{items:c,isLoading:u,updatedAt:d}=(({queryId:e,signalIndexName:t,skip:a=!1,filterQuery:i})=>{const[r,s]=Object(n.useState)([]),[o,l]=Object(n.useState)(Date.now()),{to:c,from:u,deleteQuery:d,setQuery:p}=Object(J.a)(),m=Object(n.useMemo)((()=>(({from:e,to:t,filterQuery:a})=>({_source:!1,fields:[aI,nI,iI,rI],size:0,query:{bool:{filter:[{term:{"kibana.alert.workflow_status":"open"}},{range:{"@timestamp":{gte:e,lte:t}}},...a?[a]:[]]}},aggs:{alertsByRule:{terms:{field:"kibana.alert.rule.name",size:4,order:[{critical:"desc"},{high:"desc"},{medium:"desc"},{low:"desc"}]},aggs:{critical:{filter:{term:{"kibana.alert.severity":"critical"}}},high:{filter:{term:{"kibana.alert.severity":"high"}}},medium:{filter:{term:{"kibana.alert.severity":"medium"}}},low:{filter:{term:{"kibana.alert.severity":"low"}}},lastRuleAlert:{top_hits:{size:1,sort:{"@timestamp":"desc"}}}}}}}))({from:u,to:c,filterQuery:i})),[i,u,c]),{loading:b,data:g,setQuery:f,response:y,request:h,refetch:v}=Object(I.a)({query:m,indexName:t,skip:a,queryName:C.a.BY_SEVERITY});Object(n.useEffect)((()=>{f(m)}),[f,m]),Object(n.useEffect)((()=>{var e,t;s(null==g?[]:(null!==(t=null==(e=g.aggregations)?void 0:e.alertsByRule.buckets)&&void 0!==t?t:[]).map((e=>{var t,a,n,i;const r=e.lastRuleAlert.hits.hits[0].fields;return{id:null!==(t=Object(Ba.a)(r[nI]))&&void 0!==t?t:"",alert_count:e.lastRuleAlert.hits.total.value,name:null!==(a=Object(Ba.a)(r[aI]))&&void 0!==a?a:"",last_alert_at:null!==(n=Object(Ba.a)(r[rI]))&&void 0!==n?n:"",severity:null!==(i=Object(Ba.a)(r[iI]))&&void 0!==i?i:"low"}}))),l(Date.now())}),[g]);const E=Object(n.useCallback)((()=>{!a&&v&&v()}),[a,v]);return Object(ft.b)({deleteQuery:d,inspect:{dsl:[h],response:[y]},refetch:E,setQuery:p,queryId:e,loading:b}),{items:r,isLoading:b,updatedAt:o}})({signalIndexName:e,queryId:sI,skip:!r,filterQuery:l}),p=Rm(),b=Object(n.useCallback)((e=>p({title:ra,selectedOptions:[e],fieldName:at.D})),[p]),g=Object(n.useCallback)((()=>{p({title:ia,selectedOptions:["open"],fieldName:at.jb})}),[p]),y=Object(n.useMemo)((()=>(({getAppUrl:e,navigateTo:t,openRuleInAlertsPage:a})=>[{field:"name",name:Rt,render:(a,{id:n})=>{const r=e({deepLinkId:s.wc.rules,path:`id/${n}`});return i.a.createElement(U.EuiToolTip,{"data-test-subj":`${n}-tooltip`,title:zt,content:a,anchorClassName:"eui-textTruncate"},i.a.createElement(U.EuiLink,{"data-test-subj":"severityRuleAlertsTable-name",href:r,onClick:e=>{e&&e.preventDefault(),t({url:r})}},a))}},{field:"last_alert_at",name:Lt,"data-test-subj":"severityRuleAlertsTable-lastAlertAt",render:e=>i.a.createElement(Fs.FormattedRelative,{value:new Date(e)})},{field:"alert_count",name:Bt,"data-test-subj":"severityRuleAlertsTable-alertCount",render:(e,{name:t})=>i.a.createElement(Dn.c,{data:{value:t,field:at.D},mode:GT.b.HOVER_RIGHT,triggerId:tI.b.ALERTS_COUNT,sourcererScopeId:f.SourcererScopeName.detections,metadata:{andFilters:[{field:"kibana.alert.workflow_status",value:"open"}]}},i.a.createElement(U.EuiLink,{"data-test-subj":"severityRuleAlertsTable-alertCountLink",disabled:0===e,onClick:()=>a(t)},i.a.createElement(wa.a,{count:e})))},{field:"severity",name:qt,"data-test-subj":"severityRuleAlertsTable-severity",render:e=>i.a.createElement(U.EuiHealth,{color:da.b[e]},Object(it.capitalize)(e))}])({getAppUrl:t,navigateTo:a,openRuleInAlertsPage:b})),[t,a,b]);return i.a.createElement(Bp.a,{show:!0,targetClassNames:[Ve.a]},i.a.createElement(U.EuiPanel,{hasBorder:!0,"data-test-subj":"severityRuleAlertsPanel"},i.a.createElement(pn.a,{id:sI,title:Mt,titleSize:"s",toggleStatus:r,toggleQuery:o,subtitle:i.a.createElement(Km,{updatedAt:d,isUpdating:u})}),r&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiBasicTable,{"data-test-subj":"severityRuleAlertsTable",columns:y,items:c,loading:u,noItemsMessage:i.a.createElement(U.EuiEmptyPrompt,{title:i.a.createElement("h3",null,Nt),titleSize:"xs"})}),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiButton,{"data-test-subj":"severityRuleAlertsButton",onClick:g},Ht))))}));oI.displayName="RuleAlertsTable";const lI="usersBySeverity",cI={pageCount:0,currentPage:0},uI=({from:e,to:t,currentPage:a,filterQuery:n})=>{const i=da.a*a;return{query:{bool:{filter:[{term:{"kibana.alert.workflow_status":"open"}},{range:{"@timestamp":{gte:e,lte:t}}},...n?[n]:[]]}},size:0,aggs:{user_count:{cardinality:{field:"user.name"}},[lI]:{terms:{size:100,field:"user.name",order:[{"critical.doc_count":"desc"},{"high.doc_count":"desc"},{"medium.doc_count":"desc"},{"low.doc_count":"desc"}]},aggs:{critical:{filter:{term:{"kibana.alert.severity":"critical"}}},high:{filter:{term:{"kibana.alert.severity":"high"}}},medium:{filter:{term:{"kibana.alert.severity":"medium"}}},low:{filter:{term:{"kibana.alert.severity":"low"}}},bucketOfPagination:{bucket_sort:{from:i,size:4}}}}}}},dI="vulnerableUsersBySeverityQuery",pI=i.a.memo((({signalIndexName:e})=>{const t=Rm(),{filterQuery:a}=YT(),r=Object(n.useCallback)((({userName:e,severity:a})=>t([{title:oa,selectedOptions:[e],fieldName:"user.name"},...a?[{title:na,selectedOptions:[a],fieldName:at.U}]:[]])),[t]),{toggleStatus:s,setToggleStatus:o}=Object(Wn.a)(dI),{items:l,isLoading:c,updatedAt:u,pagination:d}=(({skip:e,queryId:t,signalIndexName:a,filterQuery:i})=>{const[r,s]=Object(n.useState)(Date.now()),[o,l]=Object(n.useState)([]),[c,u]=Object(n.useState)(cI),{to:d,from:p,setQuery:m,deleteQuery:b}=Object(J.a)(),g=Object(n.useMemo)((()=>uI({from:p,to:d,currentPage:c.currentPage,filterQuery:i})),[i,p,c.currentPage,d]),{setQuery:f,data:y,loading:h,request:v,response:E,refetch:x}=Object(I.a)({query:g,indexName:a,skip:e,queryName:C.a.VULNERABLE_USERS});Object(n.useEffect)((()=>{f(g)}),[f,c.currentPage,g]),Object(n.useEffect)((()=>{var e,t;null!=y&&y.aggregations?(l((null!==(t=null==(e=y.aggregations)?void 0:e[lI].buckets)&&void 0!==t?t:[]).reduce(((e,t)=>{var a;return e.push({userName:null!==(a=Object(Ba.a)(t.key))&&void 0!==a?a:"-",totalAlerts:t.doc_count,low:t.low.doc_count,medium:t.medium.doc_count,high:t.high.doc_count,critical:t.critical.doc_count}),e}),[])),u((e=>{var t;return{...e,pageCount:Object(da.c)(null===(t=y.aggregations)||void 0===t?void 0:t.user_count.value)}}))):l([]),s(Date.now())}),[y]);const j=Object(n.useCallback)((()=>{!e&&x&&x()}),[e,x]);return Object(ft.b)({deleteQuery:b,inspect:{dsl:[v],response:[E]},refetch:j,setQuery:m,queryId:t,loading:h}),{items:o,isLoading:h,updatedAt:r,pagination:{...c,setPage:e=>{u((t=>({...t,currentPage:e})))}}}})({skip:!s,queryId:dI,signalIndexName:e,filterQuery:a}),p=Object(n.useMemo)((()=>mI(r)),[r]);return i.a.createElement(Bp.a,{show:!0,targetClassNames:[Ve.a]},i.a.createElement(U.EuiPanel,{hasBorder:!0,"data-test-subj":"severityUserAlertsPanel"},i.a.createElement(pn.a,{id:dI,title:Ft,titleSize:"s",toggleStatus:s,toggleQuery:o,subtitle:i.a.createElement(Km,{updatedAt:u,isUpdating:c}),tooltip:ta}),s&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiBasicTable,{"data-test-subj":"severityUserAlertsTable",columns:p,items:l,loading:c,noItemsMessage:i.a.createElement(U.EuiEmptyPrompt,{title:i.a.createElement("h3",null,Nt),titleSize:"xs"})}),i.a.createElement(U.EuiSpacer,{size:"m"}),d.pageCount>1&&i.a.createElement(U.EuiTablePagination,{"data-test-subj":"userTablePaginator",activePage:d.currentPage,itemsPerPage:da.a,pageCount:d.pageCount,onChangePage:d.setPage,showPerPageOptions:!1}))))}));pI.displayName="UserAlertsTable";const mI=e=>[{field:"userName",name:Wt,"data-test-subj":"userSeverityAlertsTable-userName",render:e=>i.a.createElement(U.EuiToolTip,{title:Ut,content:e,anchorClassName:"eui-textTruncate"},i.a.createElement(ge.m,{userName:e}))},{field:"totalAlerts",name:Ot,"data-test-subj":"userSeverityAlertsTable-totalAlerts",render:(t,{userName:a})=>i.a.createElement(Dn.c,{data:{value:a,field:"user.name"},mode:GT.b.HOVER_RIGHT,triggerId:tI.b.ALERTS_COUNT,sourcererScopeId:f.SourcererScopeName.detections,metadata:{andFilters:[{field:"kibana.alert.workflow_status",value:"open"}]}},i.a.createElement(U.EuiLink,{"data-test-subj":"userSeverityAlertsTable-totalAlertsLink",disabled:0===t,onClick:()=>e({userName:a})},i.a.createElement(wa.a,{count:t})))},{field:"critical",name:yt,render:(t,{userName:a})=>i.a.createElement(U.EuiHealth,{"data-test-subj":"userSeverityAlertsTable-critical",color:da.b.critical},t>0?i.a.createElement(Dn.c,{data:{value:a,field:"user.name"},mode:GT.b.HOVER_RIGHT,triggerId:tI.b.ALERTS_COUNT,sourcererScopeId:f.SourcererScopeName.detections,metadata:{andFilters:[{field:"kibana.alert.severity",value:"critical"},{field:"kibana.alert.workflow_status",value:"open"}]}},i.a.createElement(U.EuiLink,{"data-test-subj":"userSeverityAlertsTable-criticalLink",onClick:()=>e({userName:a,severity:"critical"})},i.a.createElement(wa.a,{count:t}))):i.a.createElement(wa.a,{count:t}))},{field:"high",name:ht,render:(t,{userName:a})=>i.a.createElement(U.EuiHealth,{"data-test-subj":"userSeverityAlertsTable-high",color:da.b.high},t>0?i.a.createElement(Dn.c,{data:{value:a,field:"user.name"},mode:GT.b.HOVER_RIGHT,triggerId:tI.b.ALERTS_COUNT,sourcererScopeId:f.SourcererScopeName.detections,metadata:{andFilters:[{field:"kibana.alert.severity",value:"high"},{field:"kibana.alert.workflow_status",value:"open"}]}},i.a.createElement(U.EuiLink,{onClick:()=>e({userName:a,severity:"high"})},i.a.createElement(wa.a,{count:t}))):i.a.createElement(wa.a,{count:t}))},{field:"medium",name:vt,render:(t,{userName:a})=>i.a.createElement(U.EuiHealth,{"data-test-subj":"userSeverityAlertsTable-medium",color:da.b.medium},t>0?i.a.createElement(Dn.c,{data:{value:a,field:"user.name"},mode:GT.b.HOVER_RIGHT,triggerId:tI.b.ALERTS_COUNT,sourcererScopeId:f.SourcererScopeName.detections,metadata:{andFilters:[{field:"kibana.alert.severity",value:"medium"},{field:"kibana.alert.workflow_status",value:"open"}]}},i.a.createElement(U.EuiLink,{onClick:()=>e({userName:a,severity:"medium"})},i.a.createElement(wa.a,{count:t}))):i.a.createElement(wa.a,{count:t}))},{field:"low",name:Et,render:(t,{userName:a})=>i.a.createElement(U.EuiHealth,{"data-test-subj":"userSeverityAlertsTable-low",color:da.b.low},t>0?i.a.createElement(Dn.c,{data:{value:a,field:"user.name"},mode:GT.b.HOVER_RIGHT,triggerId:tI.b.ALERTS_COUNT,sourcererScopeId:f.SourcererScopeName.detections,metadata:{andFilters:[{field:"kibana.alert.severity",value:"low"},{field:"kibana.alert.workflow_status",value:"open"}]}},i.a.createElement(U.EuiLink,{onClick:()=>e({userName:a,severity:"low"})},i.a.createElement(wa.a,{count:t}))):i.a.createElement(wa.a,{count:t}))}],bI=$.i18n.translate("cases.components.status.open",{defaultMessage:"Open"}),gI=$.i18n.translate("cases.components.status.inProgress",{defaultMessage:"In progress"}),fI=$.i18n.translate("cases.components.status.closed",{defaultMessage:"Closed"});let yI;!function(e){e.open="open",e["in-progress"]="in-progress",e.closed="closed"}(yI||(yI={}));const hI={[yI.open]:{color:"primary",label:bI,icon:"folderOpen"},[yI["in-progress"]]:{color:"warning",label:gI,icon:"folderExclamation"},[yI.closed]:{color:"default",label:fI,icon:"folderCheck"}},vI=({status:e,dataTestSubj:t})=>{var a,n;return Object(Pb.jsx)(U.EuiBadge,{"data-test-subj":t||`case-status-badge-${e}`,color:null===(a=hI[e])||void 0===a?void 0:a.color},null===(n=hI[e])||void 0===n?void 0:n.label)};vI.displayName="Status";const EI=Object(n.memo)(vI);var xI={name:"1uc4sf3",styles:"margin-left:auto;flex-grow:0"},jI={name:"qamjgr",styles:"margin-right:4px"};const SI=i.a.memo((({count:e,icon:t})=>Object(Pb.jsx)(U.EuiFlexGroup,{alignItems:"center",gutterSize:"none",css:xI},Object(Pb.jsx)(U.EuiFlexItem,{grow:!1},Object(Pb.jsx)(U.EuiIcon,{css:jI,size:"s",type:t,"data-test-subj":"comment-count-icon"})),Object(Pb.jsx)(U.EuiFlexItem,{grow:!1},Object(Pb.jsx)(U.EuiText,{size:"xs"},e)))));SI.displayName="IconWithCount";const kI=(e,t)=>t<=0||e.length<=t?e:e.slice(0,t).trim().concat("..."),OI=$.i18n.translate("cases.components.tooltip.opened",{defaultMessage:"Opened"}),wI=$.i18n.translate("cases.components.tooltip.closed",{defaultMessage:"Closed"}),TI=$.i18n.translate("cases.components.tooltip.by",{defaultMessage:"by"}),II=i.a.memo((({title:e,description:t,status:a,totalComments:n,createdAt:r,createdBy:s})=>{var o,l;return Object(Pb.jsx)(i.a.Fragment,null,Object(Pb.jsx)(U.EuiFlexGroup,{gutterSize:"xs",direction:"column"},Object(Pb.jsx)(U.EuiFlexGroup,{gutterSize:"xs",responsive:!1},Object(Pb.jsx)(U.EuiFlexItem,{grow:!1},Object(Pb.jsx)(EI,{status:a})),Object(Pb.jsx)(SI,{count:n,icon:"editorComment"})),Object(Pb.jsx)(U.EuiFlexGroup,{direction:"column",gutterSize:"xs"},Object(Pb.jsx)(U.EuiFlexItem,null,Object(Pb.jsx)(U.EuiText,{size:"relative"},Object(Pb.jsx)("strong",null,kI(e,35)))),Object(Pb.jsx)(U.EuiFlexItem,null,Object(Pb.jsx)(U.EuiText,{size:"relative"},kI(t,80))))),Object(Pb.jsx)(U.EuiHorizontalRule,{margin:"xs"}),Object(Pb.jsx)(U.EuiText,{size:"relative"},a===yI.closed?wI:OI," ",Object(Pb.jsx)(Fs.FormattedRelative,{value:r})," ",s.username||s.fullName?Object(Pb.jsx)(i.a.Fragment,null,TI," ",Object(Pb.jsx)("strong",{"data-test-subj":"tooltip-username"},kI(null!==(o=null!==(l=s.username)&&void 0!==l?l:s.fullName)&&void 0!==o?o:"",15))):null))}));II.displayName="TooltipContent";const CI=Object(n.memo)(II);var MI={name:"1tpdvqq",styles:"width:240px"},_I={name:"1o3679e",styles:"width:70px;margin-bottom:12px"};const FI=()=>Object(Pb.jsx)(U.EuiFlexItem,{css:MI,"data-test-subj":"tooltip-loading-content"},Object(Pb.jsx)(U.EuiSkeletonTitle,{size:"xxxs",css:_I}),Object(Pb.jsx)(U.EuiSkeletonText,{lines:3}),Object(Pb.jsx)(U.EuiHorizontalRule,{margin:"xs"}),Object(Pb.jsx)(U.EuiSpacer,{size:"s"}));FI.displayName="Skeleton";const AI=FI;i.a.memo((e=>{const{dataTestSubj:t,children:a,loading:n=!1,className:r="",content:s}=e;return Object(Pb.jsx)(U.EuiToolTip,{"data-test-subj":t||"cases-components-tooltip",anchorClassName:r,content:n?Object(Pb.jsx)(AI,null):Object(Pb.jsx)(CI,s)},Object(Pb.jsx)(i.a.Fragment,null,a))})).displayName="Tooltip";const DI={[yI.open]:{color:"primary",label:jt},[yI["in-progress"]]:{color:"warning",label:kt},[yI.closed]:{color:"default",label:St}},NI=({status:e})=>i.a.createElement(U.EuiBadge,{color:DI[e].color,"data-test-subj":"case-status-badge"},DI[e].label);NI.displayName="StatusBadge";var PI=a(241);const RI="recentlyCreatedCasesQuery",LI=i.a.memo((()=>{const{getAppUrl:e,navigateTo:t}=Object(m.l)(),{toggleStatus:a,setToggleStatus:r}=Object(Wn.a)(RI),{items:o,isLoading:l,updatedAt:c}=(({skip:e})=>{const{services:{cases:t}}=Object(m.j)(),{to:a,from:i,setQuery:r,deleteQuery:o}=Object(J.a)(),[l,c]=Object(n.useState)(!0),[u,d]=Object(n.useState)(Date.now()),[p,b]=Object(n.useState)([]),g=Object(n.useMemo)((()=>`useCaseItems-${Object(nt.v4)()}`),[]);return Object(n.useEffect)((()=>{let n=!0;const l=new AbortController,u=async()=>{try{const e=await t.api.cases.find({from:i,to:a,owner:s.i,sortField:"createdAt",sortOrder:"desc",page:1,perPage:4});n&&(b(function(e){return(e.cases||[]).reduce(((e,t)=>(e.push({id:t.id,name:t.title,totalAlerts:t.totalAlerts,createdAt:t.createdAt,createdBy:t.createdBy.username||"—",status:t.status}),e)),[])}(e)),d(Date.now()))}catch(e){n&&Object(PI.addError)(e,{title:Zt})}c(!1)};return e||(u(),r({id:g,inspect:null,loading:!1,refetch:u})),e&&(c(!1),n=!1,l.abort()),()=>{n=!1,l.abort(),o({id:g})}}),[t.api.cases,i,e,a,r,o,g]),{items:p,isLoading:l,updatedAt:u}})({skip:!a}),u=Object(n.useCallback)((()=>{t({deepLinkId:S.a.case})}),[t]),d=Object(n.useMemo)((()=>BI({getAppUrl:e,navigateTo:t})),[e,t]);return i.a.createElement(Bp.a,{show:!0,targetClassNames:[Ve.a]},i.a.createElement(U.EuiPanel,{hasBorder:!0,"data-test-subj":"recentlyCreatedCasesPanel"},i.a.createElement(pn.a,{id:RI,title:At,titleSize:"s",toggleStatus:a,toggleQuery:r,subtitle:i.a.createElement(Km,{updatedAt:c,isUpdating:l}),showInspectButton:!1,tooltip:Dt}),a&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiBasicTable,{"data-test-subj":"recentlyCreatedCasesTable",columns:d,items:o,loading:l,noItemsMessage:i.a.createElement(U.EuiEmptyPrompt,{title:i.a.createElement("h3",null,Pt),titleSize:"xs"})}),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiButton,{"data-test-subj":"allCasesButton",onClick:u},Gt))))}));LI.displayName="CasesTable";const BI=()=>[{field:"id",name:Kt,"data-test-subj":"recentlyCreatedCaseName",render:(e,{name:t})=>i.a.createElement(U.EuiToolTip,{title:$t,content:t,anchorClassName:"eui-textTruncate"},i.a.createElement(ge.a,{detailName:e},t))},{field:"totalAlerts",name:Ot,truncateText:!0,textOnly:!0,"data-test-subj":"recentlyCreatedCaseAlert",render:e=>i.a.createElement(wa.a,{count:e})},{field:"createdAt",name:Yt,render:e=>i.a.createElement(qs.a,{fieldName:Yt,value:e,className:"eui-textTruncate",dateFormat:"MMMM D, YYYY"}),"data-test-subj":"recentlyCreatedCaseTime"},{field:"createdBy",name:Jt,render:e=>i.a.createElement(U.EuiText,{"data-test-subj":"recentlyCreatedCaseCreatedBy",size:"s"},e)},{field:"status",name:Xt,render:e=>i.a.createElement(NI,{status:e}),"data-test-subj":"recentlyCreatedCaseStatus"}];var qI=a(195);const zI="casesByStatus",$I={series:{xScaleType:Da.ScaleType.Ordinal,yScaleType:Da.ScaleType.Linear,stackAccessors:["g"],barSeriesStyle:{rect:{widthPixel:22,opacity:1}}},axis:{xTickFormatter:e=>e.toLocaleString(),left:{style:{tickLine:{size:0},tickLabel:{padding:16,fontSize:14}}},bottom:{style:{tickLine:{size:0},tickLabel:{padding:16,fontSize:10.5}},labelFormat:e=>di()(e).format("0")}},settings:{rotation:90},customHeight:146},VI=G()(U.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItem",componentId:"sc-txg0dl-0"})(["align-items:center;width:70%;"]),UI=G.a.div.withConfig({displayName:"Wrapper",componentId:"sc-txg0dl-1"})(["width:100%;"]),HI=()=>{const{toggleStatus:e,setToggleStatus:t}=Object(Wn.a)(zI),{getAppUrl:a,navigateTo:r}=Object(m.l)(),{search:o}=Object(p.m)(s.wc.case),l=a({deepLinkId:s.wc.case,path:Object(qI.a)(o)}),c=Object(n.useCallback)((e=>{e.preventDefault(),r({url:l})}),[l,r]),{closed:u,inProgress:d,isLoading:b,open:g,totalCounts:f,updatedAt:y}=(({skip:e=!1})=>{var t,a,i,r,o,l;const{services:{cases:c}}=Object(m.j)(),{to:u,from:d,setQuery:p,deleteQuery:b}=Object(J.a)(),g=Object(n.useMemo)((()=>`useCaseItems-${Object(nt.v4)()}`),[]),[f,y]=Object(n.useState)(Date.now()),[h,v]=Object(n.useState)(!0),[E,x]=Object(n.useState)(null);return Object(n.useEffect)((()=>{let t=!0;const a=new AbortController,n=async()=>{try{const e=await c.api.cases.getCasesStatus({from:d,to:u,owner:s.i},a.signal);t&&x(e)}catch(e){t&&x(null)}t&&(v(!1),y(Date.now()))};return e||(n(),p({id:g,inspect:null,loading:!1,refetch:n})),e&&(v(!1),t=!1,a.abort()),()=>{t=!1,a.abort(),b({id:g})}}),[c.api.cases,d,e,u,p,b,g]),{closed:null!==(t=null==E?void 0:E.countClosedCases)&&void 0!==t?t:0,inProgress:null!==(a=null==E?void 0:E.countInProgressCases)&&void 0!==a?a:0,isLoading:h,open:null!==(i=null==E?void 0:E.countOpenCases)&&void 0!==i?i:0,totalCounts:(null!==(r=null==E?void 0:E.countClosedCases)&&void 0!==r?r:0)+(null!==(o=null==E?void 0:E.countInProgressCases)&&void 0!==o?o:0)+(null!==(l=null==E?void 0:E.countOpenCases)&&void 0!==l?l:0),updatedAt:f}})({skip:!e}),h=Object(n.useMemo)((()=>[{key:"open",value:[{y:g,x:jt,g:jt}],color:"#79aad9"},{key:"in-progress",value:[{y:d,x:kt,g:kt}],color:"#f1d86f"},{key:"closed",value:[{y:u,x:St,g:St}],color:"#d3dae6"}]),[u,d,g]);return i.a.createElement(U.EuiPanel,{hasBorder:!0},i.a.createElement(pn.a,{id:zI,title:Tt,titleSize:"s",toggleStatus:e,toggleQuery:t,subtitle:i.a.createElement(Km,{updatedAt:y,isUpdating:b}),showInspectButton:!1,tooltip:It},i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"none"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(ge.g,{href:l,onClick:c},Ct)))),!b&&e&&i.a.createElement(U.EuiFlexGroup,{justifyContent:"center",alignItems:"center",direction:"column",gutterSize:"s"},i.a.createElement(U.EuiFlexItem,null,0!==f&&i.a.createElement(U.EuiText,{className:"eui-textCenter",size:"s",grow:!1},i.a.createElement(i.a.Fragment,null,i.a.createElement("b",null,i.a.createElement(Fs.FormattedNumber,{value:f}))," ",i.a.createElement("span",null," ",(v=f,$.i18n.translate("xpack.securitySolution.detectionResponse.casesByStatus.totalCases",{values:{totalCases:v},defaultMessage:"total {totalCases, plural, =1 {case} other {cases}}"})))))),i.a.createElement(VI,{grow:!1},i.a.createElement(UI,{"data-test-subj":"chart-wrapper"},i.a.createElement(Qp.a,{configs:$I,barChart:h})))));var v},GI=i.a.memo(HI),QI=()=>{const{filterQuery:e}=YT(),{indicesExist:t,indexPattern:a,loading:n}=Object(g.d)(),{signalIndexName:r}=Object(fb.a)(),{hasKibanaREAD:s,hasIndexRead:o}=Object(Rr.a)(),l=Object(m.h)().read,c=s&&o,u=Object(K.a)("socTrendsEnabled");return c||l?i.a.createElement(i.a.Fragment,null,t?i.a.createElement(i.a.Fragment,null,i.a.createElement(X.a,null,i.a.createElement(ee.a,{id:Y.a.global,indexPattern:a})),i.a.createElement(h.a,{"data-test-subj":"detectionResponsePage"},i.a.createElement(Ci.a,{title:Lm.e}),n?i.a.createElement(U.EuiLoadingSpinner,{size:"l","data-test-subj":"detectionResponseLoader"}):i.a.createElement(U.EuiFlexGroup,{direction:"column","data-test-subj":"detectionResponseSections"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiFlexGroup,null,c&&i.a.createElement(U.EuiFlexItem,null,i.a.createElement(gb,{signalIndexName:r,additionalFilters:e?[e]:void 0})),l&&i.a.createElement(U.EuiFlexItem,null,i.a.createElement(GI,null)))),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiFlexGroup,null,i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiFlexGroup,{direction:"column"},c&&i.a.createElement(U.EuiFlexItem,null,i.a.createElement(oI,{signalIndexName:r})),l&&i.a.createElement(U.EuiFlexItem,null,i.a.createElement(LI,null)))),u&&i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(HT,{signalIndexName:r})))),c&&i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiFlexGroup,null,i.a.createElement(U.EuiFlexItem,null,i.a.createElement(ZT,{signalIndexName:r})),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(pI,{signalIndexName:r}))))))):i.a.createElement(Mi.a,null),i.a.createElement(E.a,{pageName:S.a.detectionAndResponse})):i.a.createElement(Ii.a,{docLinkSelector:e=>e.siem.privileges})},WI=i.a.memo(QI);var KI=a(814);const YI=G()(Dn.c).withConfig({displayName:"StyledCellActions",componentId:"sc-uvp78c-0"})(["padding-left:",";"],(({theme:e})=>e.eui.euiSizeS)),JI=G()(U.EuiBasicTable).withConfig({displayName:"StyledBasicTable",componentId:"sc-ihyued-0"})([".euiTableRow{.euiTableRowCell{border-bottom:none !important;}}.inlineActions{opacity:0;}.EntityAnalyticsTableHoverActions{.inlineActions-popoverOpen{opacity:1;}.inline-actions-table-cell:hover{.inlineActions{opacity:1;}}}"]);var XI=a(187),ZI=a(669),eC=a(259),tC=a(753);const aC=({entityDocLink:e,entityLinkProps:t,onSelectSeverityFilterGroup:a,riskEntity:r,selectedSeverity:s,severityCount:o,toggleStatus:l})=>{const c=Object(ge.o)(),[u,d]=Object(n.useMemo)((()=>{const{onClick:e,href:a}=c(t);return[e,a]}),[t,c]);return l?i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"m","data-test-subj":`${r}-risk-score-header-content`},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiButtonEmpty,{rel:"noopener nofollow noreferrer",href:e,target:"_blank"},KI.f)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(Fu,{selectedSeverities:s,severityCount:null!=o?o:Vo.c,riskEntity:r,onSelect:a})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(ge.g,{"data-test-subj":"view-all-button",onClick:u,href:d},KI.i))):null},nC=i.a.memo(aC),iC={host:Object(nt.v4)(),user:Object(nt.v4)()},rC=(e="host",t={spaceId:"default"})=>{var a;const n=Object(nt.v4)(),i=iC[e];return{title:`${e} risk donut`,description:"",visualizationType:"lnsPie",state:{visualization:{shape:"donut",layers:[{layerId:n,primaryGroups:["a2e8541a-c22f-4e43-8a12-caa33edc5de0"],metrics:["75179122-96fc-40e1-93b4-8e9310af5f06"],numberDisplay:"value",categoryDisplay:"hide",legendDisplay:"show",nestedLegend:!0,layerType:"data",legendSize:"medium",legendPosition:"left",percentDecimals:2,emptySizeRatio:.82}]},query:{query:"",language:"kuery"},filters:null!==(a=null==t?void 0:t.filters)&&void 0!==a?a:[],datasourceStates:{formBased:{layers:{[n]:{columns:{"a2e8541a-c22f-4e43-8a12-caa33edc5de0":{label:"Filters",dataType:"string",operationType:"filters",scale:"ordinal",isBucketed:!0,params:{filters:[{label:"Unknown",input:{query:`${e}.risk.calculated_level : "Unknown"`,language:"kuery"}},{input:{query:`${e}.risk.calculated_level : "Low"`,language:"kuery"},label:"Low"},{input:{query:`${e}.risk.calculated_level : "Moderiate"`,language:"kuery"},label:"Moderiate"},{input:{query:`${e}.risk.calculated_level : "High"`,language:"kuery"},label:"High"},{input:{query:`${e}.risk.calculated_level : "Critical"`,language:"kuery"},label:"Critical"}]}},"75179122-96fc-40e1-93b4-8e9310af5f06":{label:"Count of records",dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___",params:{emptyAsNull:!0}}},columnOrder:["a2e8541a-c22f-4e43-8a12-caa33edc5de0","75179122-96fc-40e1-93b4-8e9310af5f06"],sampling:1,incompleteColumns:{}}}},textBased:{layers:{}}},internalReferences:[{type:"index-pattern",id:i,name:`indexpattern-datasource-layer-${n}`}],adHocDataViews:{[i]:{id:i,title:`ml_${e}_risk_score_latest_${t.spaceId}`,timeFieldName:"",sourceFilters:[],fieldFormats:{},runtimeFieldMap:{},fieldAttrs:{},allowNoIndex:!1,name:`ml_${e}_risk_score_latest_${t.spaceId}_no_timestamp`}}},references:[]}},sC=e=>Object.hasOwn(no.a,e)?no.a[e]:ua.b,oC=G()(U.EuiFlexItem).withConfig({displayName:"DonutContainer",componentId:"sc-1b01ue2-0"})(["padding-right:",";padding-left:",";"],(({theme:e})=>e.eui.euiSizeXXL),(({theme:e})=>e.eui.euiSizeM)),lC=G()(U.EuiFlexItem).withConfig({displayName:"StyledLegendItems",componentId:"sc-1b01ue2-1"})(["justify-content:center;"]),cC=({severityCount:e})=>{const[t,a,r]=(e=>{const[t,a,i]=Object(n.useMemo)((()=>{const t=Object.keys(no.a);return[t.map((t=>({key:t,value:e[t]}))),t.map((e=>({color:no.a[e],field:"kibana.alert.severity",value:e}))),Object(x.sum)(Object.values(e))]}),[e]);return[t,a,i]})(e);return i.a.createElement(U.EuiFlexGroup,{responsive:!1,"data-test-subj":"risk-score-donut-chart"},i.a.createElement(lC,{grow:!1},a.length>0&&i.a.createElement(Gm,{legendItems:a})),i.a.createElement(oC,{grow:!1,className:"eui-textCenter"},i.a.createElement(kn.a,{data:null!=t?t:null,fillColor:sC,height:120,label:$u.d,title:i.a.createElement(On.a,{count:r}),totalCount:r})))},uC=({dataExists:e,kpiQueryId:t,riskEntity:a,severityCount:r,timerange:s,selectedSeverity:o})=>{const l=Object(K.a)("donutChartEmbeddablesEnabled"),c=Object(nr.a)(),u=Object(n.useMemo)((()=>({spaceId:c,filters:Object(Fm.a)(o,a)})),[c,o,a]);return i.a.createElement(i.a.Fragment,null,l&&c&&e&&i.a.createElement(ci.a,{applyGlobalQueriesAndFilters:!1,donutTextWrapperClassName:"risk-score",extraOptions:u,getLensAttributes:rC,height:180,id:`${t}-donut`,isDonut:!0,label:$u.d,stackByField:a,timerange:s,width:"270px"}),!l&&i.a.createElement(cC,{severityCount:null!=r?r:Vo.c}))},dC=i.a.memo(uC),pC=({riskEntity:e})=>{const{deleteQuery:t,setQuery:a,from:r,to:l}=Object(J.a)(),[c,u]=Object(n.useState)(Date.now()),d=(e=>{const t=Object(o.useDispatch)();return e===tC.c.host?{docLink:s.Xb,linkProps:{deepLinkId:S.a.hosts,path:Object(eC.c)(Rf.HostsTableType.risk),onClick:()=>{t(Nb.a.updateHostRiskScoreSeverityFilter({severitySelection:[],hostsType:Rf.HostsType.page}))}},tableQueryId:"hostRiskDashboardTable",kpiQueryId:"headerHostRiskScoreKpiQuery"}:{docLink:s.Zb,linkProps:{deepLinkId:S.a.users,path:Object(ZI.b)(Cs.UsersTableType.risk),onClick:()=>{t(ao.b.updateUserRiskScoreSeverityFilter({severitySelection:[]}))}},tableQueryId:"userRiskDashboardTable",kpiQueryId:"headerUserRiskScoreKpiQuery"}})(e),p=Rm(),{telemetry:b}=Object(m.j)().services,g=Object(n.useCallback)((t=>{b.reportEntityAlertsClicked({entity:e}),p([{title:Object(KI.j)(e),selectedOptions:[t],fieldName:e===Vo.w.host?"host.name":"user.name"}])}),[b,e,p]),{toggleStatus:f,setToggleStatus:y}=Object(Wn.a)(d.tableQueryId),h=Object(n.useMemo)((()=>((e,t)=>[{field:e===Vo.w.host?"host.name":"user.name",name:KI.b(e),truncateText:!1,mobileOptions:{show:!0},className:"inline-actions-table-cell",render:t=>null!=t&&t.length>0?e===Vo.w.host?i.a.createElement(i.a.Fragment,null,i.a.createElement(ge.d,{hostName:t,hostTab:Rf.HostsTableType.risk}),i.a.createElement(YI,{data:{value:t,field:"host.name"},triggerId:Dn.d.DEFAULT,mode:Dn.a.INLINE,visibleCellActions:2,disabledActionTypes:[Dn.b.FILTER,Dn.b.SHOW_TOP_N],metadata:{telemetry:Jc}})):i.a.createElement(i.a.Fragment,null,i.a.createElement(ge.m,{userName:t,userTab:Cs.UsersTableType.risk}),i.a.createElement(YI,{data:{value:t,field:"user.name"},triggerId:Dn.d.DEFAULT,mode:Dn.a.INLINE,disabledActionTypes:[Dn.b.FILTER,Dn.b.SHOW_TOP_N]})):Object(Bs.d)()},{field:e===Vo.w.host?Vo.x.hostRiskScore:Vo.x.userRiskScore,width:"15%",name:KI.g(e),truncateText:!0,mobileOptions:{show:!0},render:e=>null!=e?i.a.createElement("span",{"data-test-subj":"risk-score-truncate",title:`${e}`},Math.round(e)):Object(Bs.d)()},{field:e===Vo.w.host?Vo.x.hostRisk:Vo.x.userRisk,width:"30%",name:i.a.createElement(U.EuiToolTip,{content:KI.d(e)},i.a.createElement(i.a.Fragment,null,KI.c(e),i.a.createElement(U.EuiIcon,{color:"subdued",type:"iInCircle",className:"eui-alignTop"}))),truncateText:!1,mobileOptions:{show:!0},render:e=>null!=e?i.a.createElement(no.b,{severity:e}):Object(Bs.d)()},{field:Vo.x.alertsCount,width:"10%",name:KI.a,truncateText:!1,mobileOptions:{show:!0},className:"inline-actions-table-cell",render:(a,n)=>i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiLink,{"data-test-subj":"risk-score-alerts",disabled:0===a,onClick:()=>t(e===Vo.w.host?n.host.name:n.user.name)},i.a.createElement(wa.a,{count:a})),i.a.createElement(YI,{data:{value:e===Vo.w.host?n.host.name:n.user.name,field:e===Vo.w.host?"host.name":"user.name"},mode:Dn.a.INLINE,triggerId:Dn.d.ALERTS_COUNT,metadata:{andFilters:[{field:"kibana.alert.workflow_status",value:"open"}]}}))}])(e,g)),[e,g]),[v,E]=Object(n.useState)([]),x=Object(n.useCallback)((e=>{E(e)}),[]),k=Object(n.useMemo)((()=>{const[t]=Object(Fm.a)(v,e);return t||void 0}),[e,v]),{filterQuery:O}=YT({extraFilter:k}),w=Object(n.useMemo)((()=>({from:r,to:l})),[r,l]),{severityCount:T,loading:I,refetch:C,inspect:M}=Object(Lu.d)({filterQuery:O,skip:!f,timerange:w,riskEntity:e});Object(ft.b)({queryId:d.kpiQueryId,loading:I,refetch:C,setQuery:a,deleteQuery:t,inspect:M});const{data:_,loading:F,inspect:A,refetch:D,isDeprecated:N,isAuthorized:P,isModuleEnabled:R}=Object(Lu.c)({filterQuery:O,skip:!f,pagination:{cursorStart:0,querySize:5},timerange:w,riskEntity:e,includeAlertsCount:!0}),{data:L}=Ku();Object(ft.b)({queryId:d.tableQueryId,loading:F,refetch:D,setQuery:a,deleteQuery:t,inspect:A}),Object(n.useEffect)((()=>{u(Date.now())}),[F,I]);const B=(()=>{const e=Object(n.useMemo)((()=>Object(XI.h)()),[]),t=Object(j.a)((t=>e(t,Y.a.global)));return Object(n.useCallback)((()=>{t.forEach((e=>e.refetch&&e.refetch()))}),[t])})();if(!P)return null;const q={isDisabled:!R&&!F,isDeprecated:N&&!F};return null!=L&&L.isUpdateAvailable?null:q.isDisabled||q.isDeprecated?i.a.createElement(wu,Ni()({},q,{entityType:e,refetch:B,timerange:w})):R&&0===v.length&&_&&0===_.length?i.a.createElement(Uu,{entityType:e,refetch:B}):i.a.createElement(Ve.c,null,i.a.createElement(Ws.a,{hasBorder:!0,"data-test-subj":`entity_analytics_${e}s`},i.a.createElement(pn.a,{title:i.a.createElement(yu.a,{riskScoreEntity:e}),titleSize:"s",subtitle:i.a.createElement(Km,{isUpdating:F||I,updatedAt:c}),id:d.tableQueryId,toggleStatus:f,toggleQuery:y,tooltip:e===Vo.w.host?KI.e:KI.h,tooltipTitle:$u.c},i.a.createElement(nC,{entityDocLink:d.docLink,entityLinkProps:d.linkProps,onSelectSeverityFilterGroup:x,riskEntity:e,selectedSeverity:v,severityCount:T,toggleStatus:f})),f&&i.a.createElement(U.EuiFlexGroup,{"data-test-subj":"entity_analytics_content"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(dC,{dataExists:_&&_.length>0,kpiQueryId:d.kpiQueryId,riskEntity:e,severityCount:T,timerange:w,selectedSeverity:v})),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(JI,{responsive:!1,items:null!=_?_:[],columns:h,loading:F,id:d.tableQueryId,rowProps:{className:"EntityAnalyticsTableHoverActions"}}))),(F||I)&&i.a.createElement($s.a,{"data-test-subj":"loadingPanelRiskScore",overlay:!0,size:"xl"})))},mC=i.a.memo(pC);mC.displayName="EntityAnalyticsRiskScores";var bC=a(651);const gC=$.i18n.translate("xpack.securitySolution.entityAnalytics.header.criticalHosts",{defaultMessage:"Critical Hosts"}),fC=$.i18n.translate("xpack.securitySolution.entityAnalytics.header.criticalUsers",{defaultMessage:"Critical Users"}),yC=$.i18n.translate("xpack.securitySolution.entityAnalytics.header.anomalies",{defaultMessage:"Anomalies"});var hC=a(1080);const vC=({from:e,to:t,jobIds:a,anomalyScoreThreshold:n})=>({size:0,query:{bool:{filter:[{term:{result_type:"record"}},{range:{record_score:{gte:n}}},{range:{timestamp:{gte:e,lte:t}}},{terms:{job_id:a}}]}},aggs:{number_of_anomalies:{terms:{field:"job_id",size:1e4},aggs:{entity:{top_hits:{_source:!1,fields:["host.name","user.name"],size:1}}}}}});var EC=a(474);let xC;!function(e){e[e.User=0]="User",e[e.Host=1]="Host"}(xC||(xC={}));const jC=({skip:e,from:t,to:a})=>{const[i,r]=Object(n.useState)([]),{loading:o,isMlAdmin:l,jobs:c,refetch:u}=Object(EC.a)(),[d,p]=Object(n.useState)(!0),{addError:b}=Object(rs.a)(),[g]=Object(m.p)(s.x),{query:f}=Object(n.useMemo)((()=>({query:vC({jobIds:c.map((({id:e})=>e)),anomalyScoreThreshold:g,from:t,to:a})})),[c,g,t,a]);return Object(n.useEffect)((()=>{let t=!0;const a=new AbortController;return async function(){if(t)if(!e&&l&&0!==c.length){p(!0);try{const e=await(async(e,t)=>m.b.get().http.fetch("/internal/ml/results/anomaly_search",{method:"POST",version:"1",body:JSON.stringify(e),asSystemRequest:!0,signal:t}))({jobIds:c.filter((e=>e.isInstalled)).map((({id:e})=>e)),query:f},a.signal);if(t){var n,i;p(!1);const t=null!==(n=null===(i=e.aggregations)||void 0===i?void 0:i.number_of_anomalies.buckets)&&void 0!==n?n:[];r(function(e,t){const a=t.map((t=>{var a,n,i;const r=e.find((({key:e})=>e===(null==t?void 0:t.id))),s=Object(x.has)("entity.hits.hits[0].fields['user.name']",r);return{name:null!==(a=null==t||null===(n=t.customSettings)||void 0===n?void 0:n.security_app_display_name)&&void 0!==a?a:t.id,count:null!==(i=null==r?void 0:r.doc_count)&&void 0!==i?i:0,entity:s?xC.User:xC.Host,job:t}}));return Object(x.sortBy)(["name"],a)}(t,c))}}catch(e){t&&"AbortError"!==e.name&&(b(e,{title:hC.a}),p(!1))}}else p(!1)}(),()=>{t=!1,a.abort()}}),[e,l,b,f,c,u]),{isLoading:d||o,data:i,refetch:u}};var SC=a(77);const kC=$.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.anomaliesTitle",{defaultMessage:"Anomalies"}),OC=$.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.anomalyName",{defaultMessage:"Anomaly name"}),wC=$.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.anomalyCount",{defaultMessage:"Count"}),TC=$.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.viewUsersAnomalies",{defaultMessage:"View all user anomalies"}),IC=$.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.viewHostsAnomalies",{defaultMessage:"View all host anomalies"}),CC=$.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.viewAnomalies",{defaultMessage:"View all"}),MC=$.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.enableJob",{defaultMessage:"Run job"}),_C=($.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.jobStatusDisabled",{defaultMessage:"disabled"}),$.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.jobStatusUninstalled",{defaultMessage:"uninstalled"}),$.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.jobStatusFailed",{defaultMessage:"failed"})),FC=$.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.jobStatusLoading",{defaultMessage:"Waiting"}),AC=e=>$.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.moduleNotCompatibleTitle",{values:{incompatibleJobCount:e},defaultMessage:"{incompatibleJobCount} {incompatibleJobCount, plural, =1 {job is} other {jobs are}} currently unavailable"}),DC=$.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.AnomalyDetectionDocsTitle",{defaultMessage:"Anomaly Detection with Machine Learning"}),NC=$.i18n.translate("xpack.securitySolution.entityAnalytics.anomalies.anomaliesTooltip",{defaultMessage:"The anomalies table is not filterable via the SIEM global KQL search."}),PC=({count:e,jobId:t,entity:a})=>{const r=Object(o.useDispatch)(),s=a===xC.User?S.a.usersAnomalies:S.a.hostsAnomalies,l=Object(n.useCallback)((()=>{t&&(a===xC.User?(r(ao.b.updateUsersAnomaliesJobIdFilter({jobIds:[t],usersType:Cs.UsersType.page})),r(ao.b.updateUsersAnomaliesInterval({interval:"second",usersType:Cs.UsersType.page}))):(r(Nb.a.updateHostsAnomaliesJobIdFilter({jobIds:[t],hostsType:Rf.HostsType.page})),r(Nb.a.updateHostsAnomaliesInterval({interval:"second",hostsType:Rf.HostsType.page}))))}),[t,r,a]);return i.a.createElement(ge.k,{onClick:l,deepLinkId:s},e)};var RC=a(957);const LC=({job:e,isLoading:t,onJobEnabled:a})=>{const{enableDatafeed:r,isLoading:s}=Object(RC.a)(),o=Object(n.useCallback)((async()=>{(await r(e,e.latestTimestampMs||0)).enabled&&a(e)}),[r,e,a]);return t||s?i.a.createElement(U.EuiLoadingSpinner,{size:"m","data-test-subj":"job-switch-loader"}):i.a.createElement(ge.f,{onClick:o,"data-test-subj":"enable-job"},MC)},BC=({count:e,job:t,entity:a,recentlyEnabledJobIds:n,loading:r,onJobEnabled:s})=>Object(dg.b)(t.jobState,t.datafeedState)?i.a.createElement(i.a.Fragment,null,FC):Object(dg.a)(t.jobState,t.datafeedState)?i.a.createElement(i.a.Fragment,null,_C):e>0||Object(dg.c)(t.jobState,t.datafeedState)||n.includes(t.id)?i.a.createElement(PC,{count:e,jobId:t.id,entity:a}):t.isCompatible?i.a.createElement(LC,{job:t,isLoading:r,onJobEnabled:s}):i.a.createElement(U.EuiIcon,{"aria-label":"Warning",size:"s",type:"warning",color:"warning"}),qC=G.a.span.withConfig({displayName:"MediumShadeText",componentId:"sc-19sbgzu-0"})(["color:",";"],(({theme:e})=>e.eui.euiColorMediumShade)),zC="entityAnalyticsDashboardAnomaliesTable",$C={sort:{field:"count",direction:"desc"}},VC="entity_analytics_anomalies",UC=()=>{const[e,t]=Object(n.useState)([]),{services:{ml:a,http:r,docLinks:s}}=Object(m.j)(),o=Object(SC.useMlHref)(a,r.basePath.get(),{page:SC.ML_PAGES.ANOMALY_DETECTION_JOBS_MANAGE}),[l,c]=Object(n.useState)(Date.now()),{toggleStatus:u,setToggleStatus:d}=Object(Wn.a)(zC),{deleteQuery:p,setQuery:b,from:g,to:f}=Object(J.a)(),{isLoading:y,data:h,refetch:v}=jC({skip:!u,from:g,to:f}),E=((e,t,a)=>Object(n.useMemo)((()=>[{field:"name",name:OC,truncateText:!0,mobileOptions:{show:!0},"data-test-subj":"anomalies-table-column-name",render:(e,{count:t,job:n})=>t>0||n&&(Object(dg.c)(n.jobState,n.datafeedState)||a.includes(n.id))?e:i.a.createElement(qC,null,e)},{field:"count",sortable:({count:e,job:t})=>e>0?e:t&&Object(dg.c)(t.jobState,t.datafeedState)?0:-1,truncateText:!0,align:"right",name:wC,mobileOptions:{show:!0},width:"15%","data-test-subj":"anomalies-table-column-count",render:(n,{entity:r,job:s})=>s?i.a.createElement(BC,{count:n,job:s,entity:r,loading:e,onJobEnabled:t,recentlyEnabledJobIds:a}):""}]),[e,t,a]))(y,Object(n.useCallback)((async e=>{t((t=>[...t,e.id]))}),[]),e),x=Object(ge.o)();Object(n.useEffect)((()=>{c(Date.now())}),[y]),Object(ft.b)({refetch:v,queryId:zC,loading:y,setQuery:b,deleteQuery:p});const[j,k]=Object(n.useMemo)((()=>{const{onClick:e,href:t}=x({deepLinkId:S.a.hosts,path:Object(eC.c)(Rf.HostsTableType.anomalies)});return[e,t]}),[x]),[O,w]=Object(n.useMemo)((()=>{const{onClick:e,href:t}=x({deepLinkId:S.a.users,path:Object(ZI.b)(Cs.UsersTableType.anomalies)});return[e,t]}),[x]),T=Object(n.useMemo)((()=>h.filter((({job:e})=>!!e&&e.isInstalled)).map((({job:e})=>{var t;return null!==(t=null==e?void 0:e.id)&&void 0!==t?t:""})).concat(e)),[h,e]),I=Object(n.useMemo)((()=>h.filter((({job:e})=>e&&!e.isCompatible)).length),[h]);return i.a.createElement(U.EuiPanel,{hasBorder:!0,"data-test-subj":VC},i.a.createElement(pn.a,{title:kC,titleSize:"s",subtitle:i.a.createElement(Km,{isUpdating:y,updatedAt:l}),toggleStatus:u,toggleQuery:d,tooltip:NC},i.a.createElement(U.EuiFlexGroup,{alignItems:"center"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(ge.f,{"data-test-subj":"anomalies_table_hosts_link",onClick:j,href:k,className:"eui-textNoWrap"},IC)),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(ge.f,{"data-test-subj":"anomalies_table_users_link",onClick:O,href:w,className:"eui-textNoWrap"},TC)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(ge.g,{"data-test-subj":"anomalies_table_all",href:o,target:"_blank"},CC)))),u&&i.a.createElement(i.a.Fragment,null,I>0&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiCallOut,{title:AC(I),"data-test-subj":"incompatible_jobs_warnings",color:"warning",iconType:"warning",size:"s"},i.a.createElement("p",null,i.a.createElement(Fs.FormattedMessage,{defaultMessage:"We could not find any data, see {mlDocs} for more information on Machine Learning job requirements.",id:"xpack.securitySolution.components.mlPopup.moduleNotCompatibleDescription",values:{mlDocs:i.a.createElement("a",{href:`${s.links.siem.ml}`,rel:"noopener noreferrer",target:"_blank"},DC)}}))),i.a.createElement(U.EuiSpacer,{size:"m"})),i.a.createElement(SC.MLJobsAwaitingNodeWarning,{jobIds:T}),i.a.createElement(U.EuiInMemoryTable,{responsive:!1,items:h,columns:E,pagination:{showPerPageOptions:!0},loading:y,id:zC,sorting:$C})))},HC=G()(U.EuiTitle).withConfig({displayName:"StyledEuiTitle",componentId:"sc-32r58o-0"})(["color:",";"],(({theme:{eui:e}})=>da.b.critical)),GC=()=>{const{from:e,to:t}=Object(J.a)(),{filterQuery:a}=YT(),r=Object(n.useMemo)((()=>({from:e,to:t})),[e,t]),{severityCount:s,loading:l,inspect:c,refetch:u}=Object(Lu.d)({timerange:r,riskEntity:Vo.w.host,filterQuery:a}),{severityCount:d,loading:p,refetch:m,inspect:b}=Object(Lu.d)({filterQuery:a,timerange:r,riskEntity:Vo.w.user}),{data:g}=jC({skip:!1,from:e,to:t}),f=Object(o.useDispatch)(),y=Object(ge.o)(),h=Object(io.a)().isPlatinumOrTrialLicense,[v,E]=Object(n.useMemo)((()=>{const{onClick:e,href:t}=y({deepLinkId:S.a.hosts,path:Object(eC.c)(Rf.HostsTableType.risk),onClick:()=>{f(Nb.a.updateHostRiskScoreSeverityFilter({severitySelection:[Vo.y.critical],hostsType:Rf.HostsType.page})),f(Nb.a.updateHostRiskScoreSort({sort:{field:Vo.x.hostRiskScore,direction:Vo.b.desc},hostsType:Rf.HostsType.page}))}});return[e,t]}),[f,y]),[j,k]=Object(n.useMemo)((()=>{const{onClick:e,href:t}=y({deepLinkId:S.a.users,path:Object(ZI.b)(Cs.UsersTableType.risk),onClick:()=>{f(ao.b.updateUserRiskScoreSeverityFilter({severitySelection:[Vo.y.critical]})),f(ao.b.updateTableSorting({sort:{field:Vo.x.userRiskScore,direction:Vo.b.desc},tableType:Cs.UsersTableType.risk}))}});return[e,t]}),[f,y]),{deleteQuery:O,setQuery:w}=Object(J.a)();Object(ft.b)({queryId:"userRiskScoreKpiQuery",loading:p,refetch:m,setQuery:w,deleteQuery:O,inspect:b}),Object(ft.b)({queryId:"hostRiskScoreKpiQuery",loading:l,refetch:u,setQuery:w,deleteQuery:O,inspect:c});const T=Object(n.useMemo)((()=>g.some((({job:e,count:t})=>t>0||e&&Object(dg.c)(e.jobState,e.datafeedState)))),[g]),I=Object(n.useMemo)((()=>T?i.a.createElement(wa.a,{count:Object(x.sumBy)("count",g)}):"-"),[g,T]),C=Object(n.useCallback)((()=>{const e=document.querySelector(`[data-test-subj="${VC}"]`);e&&e.scrollIntoView({behavior:"smooth"})}),[]);return i.a.createElement(U.EuiPanel,{hasBorder:!0,paddingSize:"l"},i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceAround",responsive:!1},h&&i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFlexGroup,{direction:"column",gutterSize:"s",responsive:!1},i.a.createElement(U.EuiFlexItem,{className:"eui-textCenter"},i.a.createElement(HC,{"data-test-subj":"critical_hosts_quantity",size:"l"},i.a.createElement("span",null,s?i.a.createElement(wa.a,{count:s[Vo.y.critical]}):"-"))),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(ge.f,{onClick:v,href:E,"data-test-subj":"critical_hosts_link"},gC)))),h&&i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFlexGroup,{direction:"column",gutterSize:"s",responsive:!1},i.a.createElement(U.EuiFlexItem,{className:"eui-textCenter"},i.a.createElement(HC,{"data-test-subj":"critical_users_quantity",size:"l"},i.a.createElement("span",null,d?i.a.createElement(wa.a,{count:d[Vo.y.critical]}):"-"))),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(ge.f,{onClick:j,href:k,"data-test-subj":"critical_users_link"},fC)))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFlexGroup,{direction:"column",gutterSize:"s",responsive:!1},i.a.createElement(U.EuiFlexItem,{className:"eui-textCenter"},i.a.createElement(U.EuiTitle,{"data-test-subj":"anomalies_quantity",size:"l"},i.a.createElement("span",null,I))),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiLink,{"data-test-subj":"all_anomalies_link",onClick:C},yC))))))},QC=()=>{const{data:e}=Ku(),{indicesExist:t,loading:a,indexPattern:n}=Object(g.d)(),r=Object(Vb.a)("entity-analytics");return i.a.createElement(i.a.Fragment,null,t?i.a.createElement(i.a.Fragment,null,i.a.createElement(X.a,null,i.a.createElement(ee.a,{id:Y.a.global,indexPattern:n})),i.a.createElement(h.a,{"data-test-subj":"entityAnalyticsPage"},i.a.createElement(Ci.a,{title:bC.k}),a?i.a.createElement(U.EuiLoadingSpinner,{size:"l","data-test-subj":"entityAnalyticsLoader"}):i.a.createElement(U.EuiFlexGroup,{direction:"column","data-test-subj":"entityAnalyticsSections"},(null==e?void 0:e.isUpdateAvailable)&&r&&i.a.createElement(U.EuiFlexItem,null,i.a.createElement(_d,null)),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(GC,null)),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(mC,{riskEntity:Vo.w.host})),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(mC,{riskEntity:Vo.w.user})),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(UC,null))))):i.a.createElement(Mi.a,null),i.a.createElement(E.a,{pageName:S.a.entityAnalytics}))},WC=i.a.memo(QC);var KC=a(20),YC=a(453);const JC=({children:e,pageName:t})=>{const a=Object(KC.f)(t),n=Object(YC.c)(t);return a?i.a.createElement(r.TrackApplicationView,{viewId:t},e):n?i.a.createElement(i.a.Fragment,null,i.a.createElement(E.a,{pageName:t}),i.a.createElement(n,null)):i.a.createElement(i.a.Fragment,null,i.a.createElement(E.a,{pageName:t}),i.a.createElement(Ii.b,{pageName:t,docLinkSelector:e=>e.siem.privileges}))};var XC=a(98);const ZC=Object(n.memo)((()=>i.a.createElement(eM,null,i.a.createElement(h.a,{noPadding:!0},i.a.createElement(Mi.a,null),i.a.createElement(XC.Chat,null),i.a.createElement(E.a,{pageName:s.wc.landing})))));ZC.displayName="LandingPage";var eM=G()("div").withConfig({displayName:"_StyledDiv",componentId:"sc-1qv8avm-0"})(["display:flex;flex-direction:column;flex:1 1 auto;"]);const tM=[{path:s.Tb,component:()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:s.wc.overview},i.a.createElement(sT,null)))},{path:s.kb,component:()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:s.wc.detectionAndResponse},i.a.createElement(WI,null)))},{path:s.Hb,render:()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:s.wc.landing},i.a.createElement(ZC,null)))},{path:s.rb,render:()=>i.a.createElement(N,null,i.a.createElement(JC,{pageName:s.wc.entityAnalytics},i.a.createElement(WC,null)))},{path:s.u,component:()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:s.wc.dataQuality},i.a.createElement(yT,null)))}],aM=$.i18n.translate("xpack.securitySolution.rules.badge.readOnly.tooltip",{defaultMessage:"Unable to create, edit or delete rules"});let nM;$.i18n.translate("alertsUIShared.components.alertLifecycleStatusBadge.activeLabel",{defaultMessage:"Active"}),$.i18n.translate("alertsUIShared.components.alertLifecycleStatusBadge.recoveredLabel",{defaultMessage:"Recovered"}),$.i18n.translate("alertsUIShared.components.alertLifecycleStatusBadge.flappingLabel",{defaultMessage:"Flapping"}),function(e){e.Running="running",e.Upcoming="upcoming",e.Finished="finished",e.Archived="archived"}(nM||(nM={}));const iM=({http:e,notifications:{toasts:t}},{enabled:a})=>Object(Hu.useQuery)(["GET",rM],(({signal:t})=>(async(e,t)=>e.fetch("/internal/alerting/rules/maintenance_window/_active",{method:"GET",signal:t}))(e,t)),{enabled:a,refetchInterval:6e4,onError:e=>{t.addError(e,{title:sM,toastMessage:oM})}}),rM="/internal/alerting/rules/maintenance_window/_active",sM=$.i18n.translate("alertsUIShared.maintenanceWindowCallout.fetchError",{defaultMessage:"Failed to check if maintenance windows are active"}),oM=$.i18n.translate("alertsUIShared.maintenanceWindowCallout.fetchErrorDescription",{defaultMessage:"Rule notifications are stopped while the maintenance window is running."}),lM="maintenanceWindow",cM=$.i18n.translate("alertsUIShared.maintenanceWindowCallout.maintenanceWindowActive",{defaultMessage:"Maintenance window is running"}),uM=$.i18n.translate("alertsUIShared.maintenanceWindowCallout.maintenanceWindowActiveDescription",{defaultMessage:"Rule notifications are stopped while the maintenance window is running."});function dM({kibanaServices:e}){const{application:{capabilities:t}}=e,a=!t[lM].show&&!t[lM].save,{data:n}=iM(e,{enabled:!a});return a?null:(n||[]).some((({status:e})=>e===nM.Running))?Object(Pb.jsx)(U.EuiCallOut,{title:cM,color:"warning",iconType:"iInCircle","data-test-subj":"maintenanceWindowCallout"},uM):null}var pM=a(947),mM=a(694);const bM=["v2_rare_process_by_host_linux_ecs","v2_linux_rare_metadata_user","v2_linux_rare_metadata_process","v2_linux_anomalous_user_name_ecs","v2_linux_anomalous_process_all_hosts_ecs","v2_linux_anomalous_network_port_activity_ecs","v2_rare_process_by_host_windows_ecs","v2_windows_anomalous_network_activity_ecs","v2_windows_anomalous_path_activity_ecs","v2_windows_anomalous_process_all_hosts_ecs","v2_windows_anomalous_process_creation","v2_windows_anomalous_user_name_ecs","v2_windows_rare_metadata_process","v2_windows_rare_metadata_user","rare_process_by_host_linux_ecs","linux_anomalous_network_activity_ecs","linux_anomalous_network_port_activity_ecs","linux_anomalous_network_service","linux_anomalous_network_url_activity_ecs","linux_anomalous_process_all_hosts_ecs","linux_anomalous_user_name_ecs","linux_rare_metadata_process","linux_rare_metadata_user","linux_rare_user_compiler","linux_rare_kernel_module_arguments","linux_rare_sudo_user","linux_system_user_discovery","linux_system_information_discovery","linux_system_process_discovery","linux_network_connection_discovery","linux_network_configuration_discovery","rare_process_by_host_windows_ecs","windows_anomalous_network_activity_ecs","windows_anomalous_path_activity_ecs","windows_anomalous_process_all_hosts_ecs","windows_anomalous_process_creation","windows_anomalous_script","windows_anomalous_service","windows_anomalous_user_name_ecs","windows_rare_user_runas_event","windows_rare_metadata_process","windows_rare_metadata_user","windows_rare_user_type10_remote_login"];var gM=a(664);const fM=()=>i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.mlJobCompatibilityCallout.messageBody",defaultMessage:"{summary} Related documentation: {docs}",values:{summary:i.a.createElement("p",null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.mlJobCompatibilityCallout.messageBody.summary",defaultMessage:"Machine learning rules use ML jobs that in turn have dependencies on data fields populated by the Beats and Elastic Agent integrations that were current when the ML job was created. New ML jobs, prefixed with V3, have been released to operate on now-current ECS fields. If you're using multiple versions of Beats or Elastic Agent, you may need to duplicate or create new machine learning rules that specify the new ML (V3) jobs and enable them to run alongside your existing rules, to ensure continued rule coverage using V1/V2 jobs."})),docs:i.a.createElement("ul",null,i.a.createElement("li",null,i.a.createElement(gM.c,null)))}}),yM={type:"primary",id:"ml-job-compatibility",title:$.i18n.translate("xpack.securitySolution.detectionEngine.mlJobCompatibilityCallout.messageTitle",{defaultMessage:"Your ML jobs may be incompatible with your data sources and/or ML rules"}),description:i.a.createElement(fM,null)},hM=()=>{const{loading:e,jobs:t}=Object(El.b)(),a=t.some((e=>bM.includes(e.id)));return i.a.createElement(mM.c,{namespace:"detections",condition:!e&&a,message:yM})},vM=Object(n.memo)(hM);var EM=a(10),xM=a.n(EM),jM=a(908),SM=a(332);const kM=$.i18n.translate("xpack.securitySolution.detectionEngine.rules.guidedOnboarding.installPrebuiltRules.title",{defaultMessage:"Load the Elastic prebuilt rules"}),OM=$.i18n.translate("xpack.securitySolution.detectionEngine.rules.guidedOnboarding.installPrebuiltRules.content",{defaultMessage:"To get started you need to load the Elastic prebuilt rules."}),wM=$.i18n.translate("xpack.securitySolution.detectionEngine.rules.guidedOnboarding.searchFirstRule.title",{defaultMessage:"Find your first rule"}),TM=e=>$.i18n.translate("xpack.securitySolution.detectionEngine.rules.guidedOnboarding.searchFirstRule.content",{defaultMessage:'Search for "{name}" or click next.',values:{name:e}}),IM=$.i18n.translate("xpack.securitySolution.detectionEngine.rules.guidedOnboarding.enableFirstRule.title",{defaultMessage:"Enable the rule"}),CM=e=>$.i18n.translate("xpack.securitySolution.detectionEngine.rules.guidedOnboarding.enableFirstRule.content",{defaultMessage:'Enable "{name}" or click next.',values:{name:e}}),MM=$.i18n.translate("xpack.securitySolution.detectionEngine.rules.guidedOnboarding.nextButton",{defaultMessage:"Next"}),_M=e=>{const[t,a]=Object(n.useState)(!1);return Object(n.useEffect)((()=>{const n=new MutationObserver((()=>{const n=!!document.getElementById(e);n&&!t&&a(!0),!n&&t&&a(!1)}));return n.observe(document.body,{childList:!0,subtree:!0}),()=>n.disconnect()}),[t,e]),t},FM="install-prebuilt-rules-anchor",AM="search-first-rule-anchor",DM={filter:"",showCustomRules:!1,showElasticRules:!0,tags:["Guided Onboarding"]};let NM;!function(e){e.inactive="inactive",e.installRules="installRules",e.searchRules="searchRules",e.enableRules="enableRules",e.completed="completed"}(NM||(NM={}));const PM=()=>{var e;const{guidedOnboardingApi:t}=Object(m.j)().services.guidedOnboarding,{executeBulkAction:a}=Object(zg.b)(),{actions:r}=Object(_g.b)(),s=xM()(null!==(e=null==t?void 0:t.isGuideStepActive$(jM.a,"rules"))&&void 0!==e?e:Object(Ns.of)(!1),!1),{data:o}=Object(SM.a)({filterOptions:DM},{enabled:s}),l=Object(n.useMemo)((()=>{if(null!=o&&o.rules.length)return o.rules[0]}),[o]),c=l?`rule-switch-${l.id}`:"",u=_M(FM),d=_M(AM),p=_M(c),b=Object(n.useMemo)((()=>s&&o?0===o.total?NM.installRules:null!=l&&l.enabled?NM.completed:p?NM.enableRules:NM.searchRules:NM.inactive),[null==l?void 0:l.enabled,p,s,o]);Object(n.useEffect)((()=>{s&&b===NM.completed&&(null==t||t.completeGuideStep("siem","rules"))}),[t,s,b]);const g=Object(n.useCallback)((async()=>{l&&await a({type:Lg.b.enable,ids:[l.id]})}),[l,a]),f=Object(n.useCallback)((()=>{l&&r.setFilterOptions({filter:l.name})}),[r,l]);return i.a.createElement(i.a.Fragment,null,u&&i.a.createElement(U.EuiTourStep,{title:kM,content:OM,onFinish:it.noop,step:1,stepsTotal:3,isOpen:b===NM.installRules,anchor:`#${FM}`,anchorPosition:"downCenter",footerAction:i.a.createElement("div",null)}),d&&l&&i.a.createElement(U.EuiTourStep,{title:wM,content:TM(l.name),onFinish:it.noop,step:2,stepsTotal:3,isOpen:b===NM.searchRules,anchor:`#${AM}`,anchorPosition:"upCenter",footerAction:i.a.createElement(U.EuiButtonEmpty,{size:"xs",color:"text",flush:"right",onClick:f},MM)}),p&&l&&i.a.createElement(U.EuiTourStep,{title:IM,content:CM(l.name),onFinish:it.noop,step:3,stepsTotal:3,isOpen:b===NM.enableRules,anchor:`#${c}`,anchorPosition:"upCenter",footerAction:i.a.createElement(U.EuiButtonEmpty,{size:"xs",color:"text",flush:"right",onClick:g},MM)}))},RM=$.i18n.translate("xpack.securitySolution.detectionEngine.rules.prePackagedRules.emptyPromptTitle",{defaultMessage:"Load Elastic prebuilt detection rules"}),LM=$.i18n.translate("xpack.securitySolution.detectionEngine.rules.prePackagedRules.emptyPromptMessage",{defaultMessage:"Elastic Security comes with prebuilt detection rules that run in the background and create alerts when their conditions are met. By default, all prebuilt rules except the Endpoint Security rule are disabled. You can select additional rules you want to enable."}),BM=($.i18n.translate("xpack.securitySolution.detectionEngine.rules.prePackagedRules.createOwnRuletButton",{defaultMessage:"Create your own rules"}),$.i18n.translate("xpack.securitySolution.detectionEngine.rules.ruleUpdatesLinkTitle",{defaultMessage:"Rule Updates"}),$.i18n.translate("xpack.securitySolution.detectionEngine.rules.addElasticRulesButtonTitle",{defaultMessage:"Add Elastic rules"}));$.i18n.translate("xpack.securitySolution.detectionEngine.rules.dismissTitle",{defaultMessage:"Dismiss"}),$.i18n.translate("xpack.securitySolution.detectionEngine.rules.releaseNotesHelp",{defaultMessage:"Release notes"}),$.i18n.translate("xpack.securitySolution.detectionEngine.rules.loadPrePackagedRulesButton",{defaultMessage:"Load Elastic prebuilt rules"}),$.i18n.translate("xpack.securitySolution.detectionEngine.rules.loadPrePackagedTimelineTemplatesButton",{defaultMessage:"Load Elastic prebuilt timeline templates"}),$.i18n.translate("xpack.securitySolution.detectionEngine.rules.loadPrePackagedRulesAndTemplatesButton",{defaultMessage:"Load Elastic prebuilt rules and timeline templates"});var qM=a(36),zM=a(650),$M=a(304);const VM=()=>{const{addError:e}=Object(rs.a)();return Object(zM.a)({onError:t=>{e(t,{title:$M.b})}})},UM=({"data-test-subj":e="addElasticRulesButton",fill:t,isDisabled:a,showBadge:n=!0})=>{var r;const s=Object(ge.o)(),{onClick:o}=s({deepLinkId:qM.SecurityPageName.rulesAdd}),{data:l}=VM(),c=null!==(r=null==l?void 0:l.num_prebuilt_rules_to_install)&&void 0!==r?r:0,u=t?U.EuiButton:U.EuiButtonEmpty;return i.a.createElement(u,{id:FM,fill:t,iconType:"plusInCircle",color:"primary",onClick:o,"data-test-subj":e,isDisabled:a},BM,c>0&&n&&i.a.createElement(HM,{color:"#E0E5EE"},c))};var HM=G()(U.EuiBadge).withConfig({displayName:"_StyledEuiBadge",componentId:"sc-vx1kco-0"})(["margin-left:5px;"]),GM=a(156);const QM=$.i18n.translate("xpack.securitySolution.lists.importValueListTitle",{defaultMessage:"Import value lists"}),WM=$.i18n.translate("xpack.securitySolution.lists.importValueListDescription",{defaultMessage:"Import single value lists to use while writing rule exceptions."}),KM=$.i18n.translate("xpack.securitySolution.lists.uploadValueListPrompt",{defaultMessage:"Select or drag and drop a file"}),YM=$.i18n.translate("xpack.securitySolution.lists.closeValueListsModalTitle",{defaultMessage:"Close"}),JM=$.i18n.translate("xpack.securitySolution.lists.cancelValueListsImportTitle",{defaultMessage:"Cancel import"}),XM=$.i18n.translate("xpack.securitySolution.lists.valueListImportButton",{defaultMessage:"Import value list"}),ZM=$.i18n.translate("xpack.securitySolution.lists.valueListsImportSuccessTitle",{defaultMessage:"Value list imported"}),e_=$.i18n.translate("xpack.securitySolution.lists.valueListsUploadError",{defaultMessage:"There was an error uploading the value list."}),t_=$.i18n.translate("xpack.securitySolution.lists.valueListsExportError",{defaultMessage:"There was an error exporting the value list."}),a_=$.i18n.translate("xpack.securitySolution.lists.valueListsTable.fileNameColumn",{defaultMessage:"Filename"}),n_=$.i18n.translate("xpack.securitySolution.lists.valueListsTable.typeColumn",{defaultMessage:"Type"}),i_=$.i18n.translate("xpack.securitySolution.lists.valueListsTable.importDateColumn",{defaultMessage:"Import Date"}),r_=$.i18n.translate("xpack.securitySolution.lists.valueListsTable.createdByColumn",{defaultMessage:"Created by"}),s_=$.i18n.translate("xpack.securitySolution.lists.valueListsTable.actionsColumn",{defaultMessage:"Actions"}),o_=$.i18n.translate("xpack.securitySolution.lists.valueListsTable.exportActionDescription",{defaultMessage:"Export value list"}),l_=$.i18n.translate("xpack.securitySolution.lists.valueListsTable.deleteActionDescription",{defaultMessage:"Remove value list"}),c_=$.i18n.translate("xpack.securitySolution.lists.valueListsTable.title",{defaultMessage:"Value lists"}),u_=$.i18n.translate("xpack.securitySolution.lists.valueListsForm.listTypesRadioLabel",{defaultMessage:"Type of value list"}),d_=$.i18n.translate("xpack.securitySolution.lists.valueListsForm.ipRadioLabel",{defaultMessage:"IP addresses"}),p_=$.i18n.translate("xpack.securitySolution.lists.valueListsForm.keywordsRadioLabel",{defaultMessage:"Keywords"}),m_=$.i18n.translate("xpack.securitySolution.lists.valueListsForm.ipRangesRadioLabel",{defaultMessage:"IP ranges"}),b_=$.i18n.translate("xpack.securitySolution.lists.valueListsForm.textRadioLabel",{defaultMessage:"Text"}),g_=$.i18n.translate("xpack.securitySolution.lists.referenceModalTitle",{defaultMessage:"Remove value list"}),f_=$.i18n.translate("xpack.securitySolution.lists.referenceModalCancelButton",{defaultMessage:"Cancel"}),y_=$.i18n.translate("xpack.securitySolution.lists.referenceModalDeleteButton",{defaultMessage:"Remove value list"}),h_=[{value:"keyword",text:p_},{value:"ip",text:d_},{value:"ip_range",text:m_},{value:"text",text:b_}],v_="keyword",E_=["text/csv","text/plain"],x_=({onError:e,onSuccess:t})=>{const a=Object(n.useRef)(new AbortController),[r,s]=Object(n.useState)(null),[o,l]=Object(n.useState)(v_),c=Object(n.useRef)(null),{http:u}=Object(m.j)().services,{start:d,...p}=Object(ts.j)(),b=!r||E_.some((e=>r.type===e)),g=Object(n.useCallback)((e=>l(e.target.value)),[l]),f=Object(n.useCallback)((e=>{var t;s(null!==(t=null==e?void 0:e.item(0))&&void 0!==t?t:null)}),[]),y=Object(n.useCallback)((()=>{var e;null!==(e=c.current)&&void 0!==e&&e.fileInput&&(c.current.fileInput.value="",c.current.handleChange()),s(null),l(v_)}),[]),h=Object(n.useCallback)((()=>{a.current.abort()}),[]),v=Object(n.useCallback)((e=>{y(),t(e)}),[y,t]),E=Object(n.useCallback)((t=>{e(t)}),[e]),x=Object(n.useCallback)((()=>{!p.loading&&r&&(a.current=new AbortController,d({file:r,listId:void 0,http:u,signal:a.current.signal,type:o}))}),[p.loading,r,d,u,o]);return Object(n.useEffect)((()=>{!p.loading&&p.result?v(p.result):!p.loading&&p.error&&E(p.error)}),[E,v,p.error,p.loading,p.result]),Object(n.useEffect)((()=>h),[h]),i.a.createElement(U.EuiForm,null,i.a.createElement(U.EuiFormRow,{"data-test-subj":"value-list-file-picker-row",label:WM,fullWidth:!0,isInvalid:!b,error:[(j=E_.join(", "),$.i18n.translate("xpack.securitySolution.lists.uploadValueListExtensionValidationMessage",{values:{fileTypes:j},defaultMessage:"File must be one of the following types: [{fileTypes}]"}))]},i.a.createElement(U.EuiFilePicker,{accept:E_.join(),"data-test-subj":"value-list-file-picker",id:"value-list-file-picker",initialPromptText:KM,ref:c,onChange:f,fullWidth:!0,isLoading:p.loading,isInvalid:!b})),i.a.createElement(U.EuiFormRow,{fullWidth:!0},i.a.createElement(U.EuiFlexGroup,null,i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiFormRow,{label:u_},i.a.createElement(U.EuiSelect,{"data-test-subj":"value-lists-form-select-type-action",options:h_,value:o,onChange:g,name:"valueListType"}))),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiFormRow,{hasEmptyLabelSpace:!0},i.a.createElement(U.EuiFlexGroup,{alignItems:"flexEnd"},i.a.createElement(U.EuiFlexItem,null,p.loading&&i.a.createElement(U.EuiButtonEmpty,{onClick:h},JM)),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiButton,{"data-test-subj":"value-lists-form-import-action",onClick:x,disabled:null==r||!b||p.loading},XM))))))));var j};x_.displayName="ValueListsFormComponent";const j_=i.a.memo(x_);j_.displayName="ValueListsForm";const S_=G()(U.EuiLoadingSpinner).withConfig({displayName:"AlignedSpinner",componentId:"sc-clxq5z-0"})(["margin:",";vertical-align:middle;"],(({theme:e})=>e.eui.euiSizeXS)),k_={contentText:"",exceptionListReferences:[],isLoading:!1,valueListId:""},O_=({onClose:e,showFlyout:t})=>{var a,r,s,o;const[l,c]=Object(n.useState)(0),[u,d]=Object(n.useState)(5),[p,b]=Object(ts.e)({pageIndex:l,pageSize:u}),{http:g}=Object(m.j)().services,{start:f,...y}=Object(ts.h)(),{start:h,result:v,error:E}=Object(ts.f)(),[j,S]=Object(n.useState)([]),[k,O]=Object(n.useState)([]),[w,T]=Object(n.useState)({}),{addError:I,addSuccess:C}=Object(rs.a)(),[M,_]=Object(n.useState)(!1),[F,A]=Object(n.useState)(k_),D=Object(n.useCallback)((()=>{f({cursor:p,http:g,pageIndex:l+1,pageSize:u,sortOrder:"desc",sortField:"created_at"})}),[p,g,f,l,u]),N=Object(n.useCallback)((({deleteReferences:e,id:t})=>{S([...j,t]),h({deleteReferences:e,http:g,id:t})}),[h,j,g]),P=Object(n.useCallback)((async()=>{_(!1),h({deleteReferences:!0,http:g,id:F.valueListId}),A(k_),S([])}),[h,g,F.valueListId]);Object(n.useEffect)((()=>{null!=v&&(S((e=>[...e.filter((e=>e!==v.id))])),D())}),[v,D]),Object(n.useEffect)((()=>{if(!Object(x.isEmpty)(E)){var e,t,a,n,i,r,s,o;const c=null!==(e=null==E||null===(t=E.body)||void 0===t||null===(a=t.message)||void 0===a||null===(n=a.error)||void 0===n||null===(i=n.references)||void 0===i?void 0:i.map((e=>null==e?void 0:e.exception_list.name)))&&void 0!==e?e:[],u=Array.from(new Set(c));_(!0),A({contentText:(l=u.length,$.i18n.translate("xpack.securitySolution.lists.referenceModalDescription",{defaultMessage:"This value list is associated with ({referenceCount}) exception {referenceCount, plural, =1 {list} other {lists}}. Removing this list will remove all exception items that reference this value list.",values:{referenceCount:l}})),exceptionListReferences:u,isLoading:!1,valueListId:null==E||null===(r=E.body)||void 0===r||null===(s=r.message)||void 0===s||null===(o=s.error)||void 0===o?void 0:o.value_list_id})}var l}),[E]);const R=Object(n.useCallback)((async({id:e})=>{try{O((t=>[...t,e]));const t=await Object(GM.i)({http:g,listId:e,signal:(new AbortController).signal});T({name:e,blob:t})}catch(e){I(e,{title:t_})}finally{O((t=>[...t.filter((t=>t!==e))]))}}),[I,g]),L=Object(n.useCallback)((({page:{index:e,size:t}})=>{c(e),d(t)}),[c,d]),B=Object(n.useCallback)((e=>{"AbortError"!==e.name&&I(e,{title:e_})}),[I]),q=Object(n.useCallback)((e=>{var t;C({text:(t=e.name,$.i18n.translate("xpack.securitySolution.lists.valueListsImportSuccess",{defaultMessage:"Value list '{fileName}' was imported",values:{fileName:t}})),title:ZM}),D(),c(0)}),[C]);Object(n.useEffect)((()=>{t&&D()}),[t,D]),Object(n.useEffect)((()=>{var e;!y.loading&&null!==(e=y.result)&&void 0!==e&&e.cursor&&b(y.result.cursor)}),[y.loading,y.result,b]);const z=Object(n.useCallback)((()=>{S([]),_(!1),A({contentText:"",exceptionListReferences:[],isLoading:!1,valueListId:""})}),[]);if(!t)return null;const V=(null!==(a=null===(r=y.result)||void 0===r?void 0:r.data)&&void 0!==a?a:[]).map((e=>({...e,isDeleting:j.includes(e.id),isExporting:k.includes(e.id)}))),H={pageIndex:l,pageSize:u,totalItemCount:null!==(s=null===(o=y.result)||void 0===o?void 0:o.total)&&void 0!==s?s:0,showPerPageOptions:!1},G=(Q=R,W=N,[{field:"name",name:a_,truncateText:!1},{field:"type",name:n_,width:"15%",truncateText:!0,render:e=>{const t=h_.find((({value:t})=>t===e));return i.a.createElement(i.a.Fragment,null,t?t.text:e)}},{field:"created_at",name:i_,render:e=>i.a.createElement(qs.a,{value:e,fieldName:"created_at"}),width:"30%"},{field:"created_by",name:r_,truncateText:!0,width:"20%"},{name:s_,actions:[{render:e=>i.a.createElement(U.EuiToolTip,{content:o_},e.isExporting?i.a.createElement(S_,{size:"m"}):i.a.createElement(U.EuiButtonIcon,{"aria-label":o_,"data-test-subj":"action-export-value-list",iconType:"exportAction",onClick:()=>Q(e)}))},{render:e=>i.a.createElement(U.EuiToolTip,{content:l_},e.isDeleting?i.a.createElement(S_,{size:"m"}):i.a.createElement(U.EuiButtonIcon,{"aria-label":l_,"data-test-subj":`action-delete-value-list-${e.name}`,iconType:"trash",onClick:()=>W(e)}))}],width:"15%"}]);var Q,W;return i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiFlyout,{onClose:e,maxWidth:800},i.a.createElement(U.EuiFlyoutHeader,null,i.a.createElement(U.EuiTitle,null,i.a.createElement("h2",null,QM))),i.a.createElement(U.EuiFlyoutBody,null,i.a.createElement(j_,{onSuccess:q,onError:B}),i.a.createElement(U.EuiSpacer,null),i.a.createElement(U.EuiText,{size:"s"},i.a.createElement("h2",null,c_)),i.a.createElement(U.EuiBasicTable,{"data-test-subj":"value-lists-table",columns:G,items:V,loading:y.loading,onChange:L,pagination:H})),i.a.createElement(U.EuiFlyoutFooter,null,i.a.createElement(U.EuiButton,{"data-test-subj":"value-lists-flyout-close-action",onClick:e},YM))),i.a.createElement(ps,{cancelText:f_,confirmText:y_,contentText:F.contentText,onCancel:z,onClose:z,onConfirm:P,references:F.exceptionListReferences,showModal:M,titleText:g_}),i.a.createElement(is,{blob:w.blob,name:w.name,onDownload:()=>T({})}))};O_.displayName="ValueListsFlyoutComponent";const w_=i.a.memo(O_);w_.displayName="ValueListsFlyout";var T_=a(334),I_=a(397),C_=a(600),M_=a(175),__=a(588),F_=a(738),A_=a(1106);const D_=G()(U.EuiEmptyPrompt).withConfig({displayName:"EmptyPrompt",componentId:"sc-17fyd7j-0"})(["align-self:center;"]);D_.displayName="EmptyPrompt";const N_=()=>{const[{loading:e,canUserCRUD:t}]=Object(le.b)();return i.a.createElement(D_,{"data-test-subj":"rulesEmptyPrompt",title:i.a.createElement("h2",null,RM),body:i.a.createElement("p",null,LM),actions:i.a.createElement(U.EuiFlexGroup,{justifyContent:"center"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(UM,{isDisabled:!t||e,fill:!0,"data-test-subj":"add-elastc-rules-empty-empty-prompt-button",showBadge:!1})))})},P_=Object(n.memo)(N_),R_=({errorCode:e,message:t,rulesCount:a})=>{switch(e){case s.p.IMMUTABLE:return i.a.createElement("li",{key:t},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.elasticRulesEditDescription",defaultMessage:"{rulesCount, plural, =1 {# prebuilt Elastic rule} other {# prebuilt Elastic rules}} (editing prebuilt rules is not supported)",values:{rulesCount:a}}));case s.p.MACHINE_LEARNING_INDEX_PATTERN:return i.a.createElement("li",{key:t},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.machineLearningRulesIndexEditDescription",defaultMessage:"{rulesCount, plural, =1 {# custom machine learning rule} other {# custom machine learning rules}} (these rules don't have index patterns)",values:{rulesCount:a}}));case s.p.MACHINE_LEARNING_AUTH:return i.a.createElement("li",{key:t},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.machineLearningRulesAuthDescription",defaultMessage:"{rulesCount, plural, =1 {# machine learning rule} other {# machine learning rules}} can't be edited ({message})",values:{rulesCount:a,message:t}}));default:return i.a.createElement("li",{key:t},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.defaultRulesEditFailureDescription",defaultMessage:"{rulesCount, plural, =1 {# rule} other {# rules}} can't be edited ({message})",values:{rulesCount:a,message:t}}))}},L_=({errorCode:e,message:t,rulesCount:a})=>e===s.p.IMMUTABLE?i.a.createElement("li",{key:t},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.elasticRulesExportDescription",defaultMessage:"{rulesCount, plural, =1 {# prebuilt Elastic rule} other {# prebuilt Elastic rules}} (exporting prebuilt rules is not supported)",values:{rulesCount:a}})):i.a.createElement("li",{key:t},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.defaultRulesExportFailureDescription",defaultMessage:"{rulesCount, plural, =1 {# rule} other {# rules}} can't be exported ({message})",values:{rulesCount:a,message:t}})),B_=({ruleErrors:e=[],bulkAction:t})=>0===e.length?null:i.a.createElement(i.a.Fragment,null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.actionRejectionDescription",defaultMessage:"This action can't be applied to the following rules in your selection:"}),i.a.createElement(U.EuiSpacer,null),i.a.createElement("ul",null,e.map((({message:e,errorCode:a,ruleIds:n})=>{const r=n.length;switch(t){case Lg.b.edit:return i.a.createElement(R_,{message:e,errorCode:a,rulesCount:r});case Lg.b.export:return i.a.createElement(L_,{message:e,errorCode:a,rulesCount:r});default:return null}})))),q_=i.a.memo(B_);q_.displayName="BulkActionRuleErrorsList";const z_=(e,t)=>{switch(e){case Lg.b.edit:return Ig.A(t);case Lg.b.export:return Ig.Y(t);default:Object(Ux.a)(e)}},$_=(e,t)=>{switch(e){case Lg.b.edit:return Ig.z(t);case Lg.b.export:return Ig.X(t);default:Object(Ux.a)(e)}},V_=({onCancel:e,onConfirm:t,result:a,bulkAction:n})=>{const{failedRulesCount:r=0,succeededRulesCount:s=0,ruleErrors:o=[]}=null!=a?a:{};return 0===s?i.a.createElement(U.EuiConfirmModal,{title:z_(n,r),onCancel:e,onConfirm:e,confirmButtonText:Ig.k,defaultFocusedButton:"confirm","data-test-subj":"bulkActionRejectModal"},i.a.createElement(q_,{bulkAction:n,ruleErrors:o})):i.a.createElement(U.EuiConfirmModal,{title:Ig.l(s),onCancel:e,onConfirm:t,confirmButtonText:$_(n,s),cancelButtonText:Ig.y,defaultFocusedButton:"confirm","data-test-subj":"bulkActionConfirmationModal"},i.a.createElement(q_,{bulkAction:n,ruleErrors:o}))},U_=i.a.memo(V_);U_.displayName="BulkActionDryRunConfirmation";var H_=a(125);const G_=({form:e,title:t,banner:a,children:n,onClose:r,onSubmit:s,flyoutSize:o="s"})=>{const l=Object(U.useGeneratedHtmlId)({prefix:"RulesBulkEditForm"}),{isValid:c}=e;return i.a.createElement(U.EuiFlyout,{ownFocus:!0,onClose:r,"aria-labelledby":l,size:o},i.a.createElement(U.EuiFlyoutHeader,{hasBorder:!0},i.a.createElement(U.EuiTitle,{size:"m","data-test-subj":"rulesBulkEditFormTitle"},i.a.createElement("h2",{id:l},t))),i.a.createElement(U.EuiFlyoutBody,{banner:a},i.a.createElement(H_.c,{form:e},n)),i.a.createElement(U.EuiFlyoutFooter,null,i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButtonEmpty,{onClick:r,flush:"left","data-test-subj":"rulesBulkEditFormCancelBtn"},Ig.K)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{onClick:s,fill:!0,disabled:!1===c,"data-test-subj":"rulesBulkEditFormSaveBtn"},Ig.S)))))},Q_=i.a.memo(G_);Q_.displayName="BulkEditFormWrapper";const W_=Object(H_.j)({component:H_.b}),K_={index:{fieldsToValidateOnChange:["index"],type:H_.a.COMBO_BOX,validations:[{validator:H_.h.emptyField(Ig.E)}]},overwrite:{type:H_.a.CHECKBOX,label:Ig.D},overwriteDataViews:{type:H_.a.CHECKBOX,label:Ig.L}},Y_={index:[],overwrite:!1,overwriteDataViews:!1},J_=({editAction:e,rulesCount:t,onClose:a,onConfirm:n})=>{const{form:r}=Object(H_.k)({defaultValue:Y_,schema:K_}),{indexHelpText:o,indexLabel:l,formTitle:c}=(e=>e===Lg.a.add_index_patterns?{indexLabel:Ig.C,indexHelpText:Ig.B,formTitle:Ig.F}:{indexLabel:Ig.N,indexHelpText:Ig.M,formTitle:Ig.O})(e),[{overwrite:u,overwriteDataViews:d}]=Object(H_.m)({form:r,watch:["overwrite","overwriteDataViews"]}),{uiSettings:p}=Object(m.j)().services,b=p.get(s.H);return i.a.createElement(Q_,{form:r,onClose:a,onSubmit:async()=>{const{data:t,isValid:a}=await r.submit();if(!a)return;const i={value:t.index,type:t.overwrite?Lg.a.set_index_patterns:e,overwrite_data_views:t.overwriteDataViews};n(i)},title:c},i.a.createElement(W_,{path:"index",config:{...K_.index,label:l,helpText:o},componentProps:{idAria:"bulkEditRulesIndexPatterns","data-test-subj":"bulkEditRulesIndexPatterns",euiFieldProps:{fullWidth:!0,placeholder:"",noSuggestions:!1,options:b.map((e=>({label:e})))}}}),e===Lg.a.add_index_patterns&&i.a.createElement(W_,{path:"overwrite",componentProps:{idAria:"bulkEditRulesOverwriteIndexPatterns","data-test-subj":"bulkEditRulesOverwriteIndexPatterns"}}),u&&i.a.createElement(U.EuiFormRow,{fullWidth:!0},i.a.createElement(U.EuiCallOut,{color:"warning",size:"s","data-test-subj":"bulkEditRulesIndexPatternsWarning"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.setIndexPatternsWarningCallout",defaultMessage:"You’re about to overwrite index patterns for {rulesCount, plural, one {# selected rule} other {# selected rules}}, press Save to apply changes.",values:{rulesCount:t}}))),e===Lg.a.add_index_patterns&&i.a.createElement(W_,{path:"overwriteDataViews",componentProps:{idAria:"bulkEditRulesOverwriteRulesWithDataViews","data-test-subj":"bulkEditRulesOverwriteRulesWithDataViews"}}),d&&i.a.createElement(U.EuiFormRow,{fullWidth:!0},i.a.createElement(U.EuiCallOut,{color:"warning",size:"s","data-test-subj":"bulkEditRulesDataViewsWarning"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.setDataViewsOverwriteWarningCallout",defaultMessage:"If you have selected rules which depend on a data view this action will force those rules to read from the index pattern as defined after this update, not the dataview, and may result in broken rules."}))),e===Lg.a.delete_index_patterns&&i.a.createElement(U.EuiFormRow,{fullWidth:!0},i.a.createElement(U.EuiCallOut,{color:"warning",size:"s","data-test-subj":"bulkEditRulesDataViewsWarning"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.deleteIndexPattnersDataViewsOverwriteWarningCallout",defaultMessage:"If you have selected rules which depend on a data view this action will not have any effect on those rules."}))))},X_=i.a.memo(J_);X_.displayName="IndexPatternsForm";const Z_=()=>{const{addError:e}=Object(rs.a)();return Object(I_.a)({onError:t=>{e(t,{title:$M.c})}})},eF=Object(H_.j)({component:H_.b}),tF={tags:{fieldsToValidateOnChange:["tags"],type:H_.a.COMBO_BOX,validations:[{validator:H_.h.emptyField(Ig.T)}]},overwrite:{type:H_.a.CHECKBOX,label:Ig.I}},aF={tags:[],overwrite:!1},nF=({editAction:e,rulesCount:t,onClose:a,onConfirm:r})=>{const{data:s}=Z_(),{form:o}=Object(H_.k)({defaultValue:aF,schema:tF}),[{overwrite:l}]=Object(H_.m)({form:o,watch:["overwrite"]}),c=Object(n.useMemo)((()=>{var e;return Object(bs.a)(null!==(e=null==s?void 0:s.aggregated_fields.tags)&&void 0!==e?e:[])}),[s]),{tagsLabel:u,tagsHelpText:d,formTitle:p}=(e=>e===Lg.a.add_tags?{tagsLabel:Ig.H,tagsHelpText:Ig.G,formTitle:Ig.J}:{tagsLabel:Ig.Q,tagsHelpText:Ig.P,formTitle:Ig.R})(e);return i.a.createElement(Q_,{form:o,onClose:a,onSubmit:async()=>{const{data:t,isValid:a}=await o.submit();if(!a)return;const n={value:t.tags,type:t.overwrite?Lg.a.set_tags:e};r(n)},title:p},i.a.createElement(eF,{path:"tags",config:{...tF.tags,label:u,helpText:d},componentProps:{idAria:"bulkEditRulesTags","data-test-subj":"bulkEditRulesTags",euiFieldProps:{fullWidth:!0,placeholder:"",noSuggestions:!1,options:c.map((e=>({label:e})))}}}),e===Lg.a.add_tags?i.a.createElement(eF,{path:"overwrite",componentProps:{idAria:"bulkEditRulesOverwriteTags","data-test-subj":"bulkEditRulesOverwriteTags"}}):null,l&&i.a.createElement(U.EuiFormRow,null,i.a.createElement(U.EuiCallOut,{color:"warning",size:"s","data-test-subj":"bulkEditRulesTagsWarning"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.components.allRules.bulkActions.bulkEditFlyoutForm.setTagsWarningCallout",defaultMessage:"You’re about to overwrite tags for {rulesCount, plural, one {# selected rule} other {# selected rules}}, press Save to apply changes.",values:{rulesCount:t}}))))},iF=i.a.memo(nF);iF.displayName="TagsForm";var rF=a(1131),sF=a(935);const oF={timeline:{label:sF.b.TEMPLATE_SELECTOR_LABEL,helpText:sF.b.TEMPLATE_SELECTOR_HELP_TEXT}},lF={timeline:{id:null,title:sF.b.TEMPLATE_SELECTOR_DEFAULT_VALUE}},cF=e=>{const{rulesCount:t,onClose:a,onConfirm:r}=e,{form:s}=Object(H_.k)({schema:oF,defaultValue:lF}),o=Object(n.useCallback)((async()=>{const{data:e,isValid:t}=await s.submit();if(!t)return;const a=e.timeline.id||"",n=a?e.timeline.title:"";r({type:Lg.a.set_timeline,value:{timeline_id:a,timeline_title:n}})}),[s,r]),l=i.a.createElement(U.EuiCallOut,{color:"warning","data-test-subj":"bulkEditRulesTimelineTemplateWarning"},sF.b.warningCalloutMessage(t));return i.a.createElement(Q_,{form:s,title:sF.b.FORM_TITLE,banner:l,onClose:a,onSubmit:o},i.a.createElement(H_.e,{path:"timeline",component:rF.a,componentProps:{idAria:"bulkEditRulesTimelineTemplateSelector",dataTestSubj:"bulkEditRulesTimelineTemplateSelector",placeholder:sF.b.TEMPLATE_SELECTOR_PLACEHOLDER}}))},uF=i.a.memo(cF);uF.displayName="TimelineTemplateForm";var dF=a(737),pF=a(1105),mF=a(1125);const bF=Object(H_.j)({component:H_.b}),gF={actions:[],overwrite:!1},fF=({rulesCount:e,onClose:t,onConfirm:a})=>{const{services:{triggersActionsUi:{actionTypeRegistry:r}}}=Object(m.j)(),s=Object(n.useMemo)((()=>(e=>({actions:{validations:[{validator:Object(mF.a)(e)}]},overwrite:{type:H_.a.CHECKBOX,label:sF.a.OVERWRITE_LABEL}}))(r)),[r]),{form:o}=Object(H_.k)({schema:s,defaultValue:gF}),[{overwrite:l}]=Object(H_.m)({form:o,watch:["overwrite","throttle"]}),c=Object(n.useCallback)((async()=>{const{data:e,isValid:t}=await o.submit();if(!t)return;const{actions:n=[],overwrite:i}=e,r=i?Lg.a.set_rule_actions:Lg.a.add_rule_actions;a({type:r,value:{actions:n.map(dF.a)}})}),[o,a]),u=Object(n.useMemo)((()=>Object(T_.e)()),[]);return i.a.createElement(Q_,{form:o,title:sF.a.FORM_TITLE,onClose:t,onSubmit:c,flyoutSize:"l"},i.a.createElement(U.EuiCallOut,{color:"primary","data-test-subj":"bulkEditRulesRuleActionInfo",title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.addRuleActions.infoCalloutTitle",defaultMessage:"Configure actions for {rulesCount, plural, one {# rule} other {# rules}} you’ve selected",values:{rulesCount:e}})},i.a.createElement("ul",null,i.a.createElement("li",null,sF.a.RULE_VARIABLES_DETAIL))),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(H_.e,{path:"actions",component:pF.a,componentProps:{messageVariables:u,summaryMessageVariables:u}}),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(bF,{path:"overwrite",componentProps:{idAria:"bulkEditRulesOverwriteRuleActions","data-test-subj":"bulkEditRulesOverwriteRuleActions"}}),l&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiCallOut,{color:"warning","data-test-subj":"bulkEditRulesRuleActionsWarning"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.addRuleActions.warningCalloutMessage",defaultMessage:"You're about to overwrite rule actions for {rulesCount, plural, one {# selected rule} other {# selected rules}}. Click {saveButton} to apply changes.",values:{rulesCount:e,saveButton:i.a.createElement("strong",null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.allRules.bulkActions.edit.addRuleActions.warningCalloutMessage.buttonLabel",defaultMessage:"Save"}))}}))))},yF=i.a.memo(fF);yF.displayName="RuleActionsForm";var hF=a(756);const vF={interval:{label:sF.d.INTERVAL_LABEL,helpText:sF.d.INTERVAL_HELP_TEXT},lookback:{label:sF.d.LOOKBACK_LABEL,helpText:sF.d.LOOKBACK_HELP_TEXT}},EF={interval:"5m",lookback:"1m"},xF=({rulesCount:e,onClose:t,onConfirm:a})=>{const{form:r}=Object(H_.k)({schema:vF,defaultValue:EF}),s=Object(n.useCallback)((async()=>{const{data:e,isValid:t}=await r.submit();t&&a({type:Lg.a.set_schedule,value:{interval:e.interval,lookback:e.lookback}})}),[r,a]),o=i.a.createElement(U.EuiCallOut,{color:"warning","data-test-subj":"bulkEditRulesSchedulesWarning"},sF.d.warningCalloutMessage(e));return i.a.createElement(Q_,{form:r,title:sF.d.FORM_TITLE,banner:o,onClose:t,onSubmit:s},i.a.createElement(H_.e,{path:"interval",component:hF.a,componentProps:{idAria:"bulkEditRulesScheduleIntervalSelector",dataTestSubj:"bulkEditRulesScheduleIntervalSelector",fullWidth:!0,minimumValue:1}}),i.a.createElement(H_.e,{path:"lookback",component:hF.a,componentProps:{idAria:"bulkEditRulesScheduleLookbackSelector",dataTestSubj:"bulkEditRulesScheduleLookbackSelector",fullWidth:!0,minimumValue:1}}))},jF=({editAction:e,...t})=>{switch(e){case Lg.a.add_index_patterns:case Lg.a.delete_index_patterns:case Lg.a.set_index_patterns:return i.a.createElement(X_,Ni()({},t,{editAction:e}));case Lg.a.add_tags:case Lg.a.delete_tags:case Lg.a.set_tags:return i.a.createElement(iF,Ni()({},t,{editAction:e}));case Lg.a.set_timeline:return i.a.createElement(uF,t);case Lg.a.add_rule_actions:case Lg.a.set_rule_actions:return i.a.createElement(yF,t);case Lg.a.set_schedule:return i.a.createElement(xF,t);default:return null}},SF=i.a.memo(jF);SF.displayName="BulkEditFlyout";var kF=a(1503),OF=a(506);function wF(e){switch(e){case Lg.a.add_index_patterns:case Lg.a.delete_index_patterns:case Lg.a.set_index_patterns:case Lg.a.add_tags:case Lg.a.delete_tags:case Lg.a.set_tags:return[{type:e,value:[]}];case Lg.a.set_timeline:return[{type:e,value:{timeline_id:"",timeline_title:""}}];case Lg.a.add_rule_actions:case Lg.a.set_rule_actions:return[{type:e,value:{actions:[]}}];case Lg.a.set_schedule:return[{type:e,value:{interval:"5m",lookback:"1m"}}];default:Object(Ux.a)(e)}return[{type:e,value:[]}]}const TF=({dryRunResult:e,...t})=>{if("selectedRuleIds"in t){const a=new Set(null==e?void 0:e.ruleErrors.flatMap((({ruleIds:e})=>e)));return{ids:t.selectedRuleIds.filter((e=>!a.has(e)))}}let a={...t.filterOptions};return null==e||e.ruleErrors.forEach((({errorCode:e})=>{var t;switch(e){case s.p.IMMUTABLE:a={...a,showCustomRules:!0};break;case s.p.MACHINE_LEARNING_INDEX_PATTERN:case s.p.MACHINE_LEARNING_AUTH:a={...a,excludeRuleTypes:[...null!==(t=a.excludeRuleTypes)&&void 0!==t?t:[],"machine_learning"]}}})),{query:Object(kF.a)(a)}};var IF=a(863),CF=a(1483);const MF=({tags:e,selectedTags:t,onSelectedTagsChanged:a})=>{const r=Object(n.useMemo)((()=>Object(bs.a)(Array.from(new Set([...e,...t])))),[t,e]),[s,o]=Object(n.useState)(!1),[l,c]=Object(n.useState)((()=>{const e=new Set(t);return r.map((t=>({label:t,checked:e.has(t)?"on":void 0})))}));Object(n.useEffect)((()=>{const e=new Set(t),a=r.map((t=>({label:t,checked:e.has(t)?"on":void 0})));c(a)}),[r,t]);const u=i.a.createElement(U.EuiFilterButton,{grow:!0,iconType:"arrowDown",onClick:()=>o(!s),numFilters:e.length,isSelected:s,hasActiveFilters:t.length>0,numActiveFilters:t.length,"data-test-subj":"tags-filter-popover-button"},Ig.Xc);return i.a.createElement(U.EuiPopover,{ownFocus:!0,button:u,isOpen:s,closePopover:()=>o(!s),panelPaddingSize:"none",repositionOnScroll:!0,panelProps:{"data-test-subj":"tags-filter-popover"}},i.a.createElement(U.EuiSelectable,{searchable:!0,searchProps:{placeholder:Ig.Qc},"aria-label":Ig.Fc,options:l,onChange:(e,n,i)=>{c(e),Object(CF.a)(i.label,t,a)},emptyMessage:Ig.Yb,noMatchesMessage:Ig.Yb},((e,t)=>i.a.createElement("div",{style:{width:274}},i.a.createElement(U.EuiPopoverTitle,null,t),e))))};MF.displayName="TagsFilterPopoverComponent";const _F=i.a.memo(MF);_F.displayName="TagsFilterPopover";var FF=a(262),AF=a(1481);const DF=({selectedStatus:e,onSelectedStatusChanged:t})=>{const[a,r]=Object(n.useState)(!1),s=[{label:Object(Jg.a)(FF.a.succeeded)||"",data:{status:FF.a.succeeded},checked:e===FF.a.succeeded?"on":void 0},{label:Object(Jg.a)(FF.a["partial failure"])||"",data:{status:FF.a["partial failure"]},checked:e===FF.a["partial failure"]?"on":void 0},{label:Object(Jg.a)(FF.a.failed)||"",data:{status:FF.a.failed},checked:e===FF.a.failed?"on":void 0}],o=i.a.createElement(U.EuiFilterButton,{grow:!0,iconType:"arrowDown",onClick:()=>{r(!a)},numFilters:s.length,isSelected:a,hasActiveFilters:void 0!==e,numActiveFilters:void 0!==e?1:0,"data-test-subj":"executionStatusFilterButton"},Ig.hb);return i.a.createElement(U.EuiPopover,{ownFocus:!0,button:o,isOpen:a,closePopover:()=>{r(!a)},panelPaddingSize:"none",repositionOnScroll:!0},i.a.createElement(U.EuiSelectable,{"aria-label":Ig.Hc,options:s,onChange:(e,a,n)=>{var i;r(!1),n.checked&&null!=n&&null!==(i=n.data)&&void 0!==i&&i.status?t(n.data.status):n.checked||t()},singleSelection:!0,listProps:{isVirtualized:!1},renderOption:e=>{const t=e.status;return i.a.createElement(PF,{"data-test-subj":"executionStatusFilterOption"},i.a.createElement(AF.a,{status:t,showTooltip:!1}))},"data-test-subj":"executionStatusFilterSelectableList"},(e=>i.a.createElement(RF,null,e))))};DF.displayName="RuleExecutionStatusSelectorComponent";const NF=i.a.memo(DF);NF.displayName="RuleExecutionStatusSelector";var PF=G()("div").withConfig({displayName:"_StyledDiv",componentId:"sc-yxrzfj-0"})(["margin-top:4px;"]),RF=G()("div").withConfig({displayName:"_StyledDiv2",componentId:"sc-yxrzfj-1"})(["width:200px;"]);const LF=G()(U.EuiFlexItem).withConfig({displayName:"SearchBarWrapper",componentId:"sc-a8228p-0"})(["min-width:200px;& .euiPopover,& .euiPopover__anchor{display:block;}"]);function BF({initialValue:e,onSearch:t,placeholder:a}){const[r,s]=Object(n.useState)(e),o=Object(n.useCallback)((e=>s(e.target.value)),[s]);return Object(n.useEffect)((()=>{s(e)}),[e]),i.a.createElement(LF,{grow:!0},i.a.createElement(U.EuiFieldSearch,{id:AM,"aria-label":Ig.Pc,fullWidth:!0,incremental:!1,placeholder:null!=a?a:Ig.Oc,value:r,onChange:o,onSearch:t,"data-test-subj":"ruleSearchField"}))}const qF=G()(U.EuiFlexGroup).withConfig({displayName:"FilterWrapper",componentId:"sc-p9q2gl-0"})(["margin-bottom:",";"],(({theme:e})=>e.eui.euiSizeXS)),zF=()=>{var e;const{startTransaction:t}=Object($d.b)(),{state:{filterOptions:a},actions:{setFilterOptions:r}}=Object(_g.b)(),{data:s}=Z_(),o=null!==(e=null==s?void 0:s.aggregated_fields.tags)&&void 0!==e?e:[],l=null==s?void 0:s.rules_summary.custom_count,c=null==s?void 0:s.rules_summary.prebuilt_installed_count,{showCustomRules:u,showElasticRules:d,tags:p,enabled:m,ruleExecutionStatus:b}=a,g=Object(n.useCallback)((e=>{t({name:Bg.d.FILTER}),r({filter:e.trim()})}),[r,t]),f=Object(n.useCallback)((()=>{t({name:Bg.d.FILTER}),r({showElasticRules:!d,showCustomRules:!1})}),[r,d,t]),y=Object(n.useCallback)((()=>{t({name:Bg.d.FILTER}),r({showCustomRules:!u,showElasticRules:!1})}),[r,u,t]),h=Object(n.useCallback)((()=>{t({name:Bg.d.FILTER}),r(!0===m?{enabled:void 0}:{enabled:!0})}),[r,m,t]),v=Object(n.useCallback)((()=>{t({name:Bg.d.FILTER}),r(!1===m?{enabled:void 0}:{enabled:!1})}),[r,m,t]),E=Object(n.useCallback)((e=>{Object(x.isEqual)(e,p)||(t({name:Bg.d.FILTER}),r({tags:e}))}),[p,r,t]),j=Object(n.useCallback)((e=>{e!==b&&(t({name:Bg.d.FILTER}),r({ruleExecutionStatus:e}))}),[b,r,t]);return i.a.createElement(qF,{gutterSize:"m",justifyContent:"flexEnd",wrap:!0},i.a.createElement(BF,{initialValue:a.filter,onSearch:g}),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFilterGroup,null,i.a.createElement(_F,{onSelectedTagsChanged:E,selectedTags:p,tags:o,"data-test-subj":"allRulesTagPopover"}))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFilterGroup,null,i.a.createElement(NF,{onSelectedStatusChanged:j,selectedStatus:b}))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFilterGroup,null,i.a.createElement(U.EuiFilterButton,{hasActiveFilters:d,onClick:f,"data-test-subj":"showElasticRulesFilterButton",withNext:!0},Ig.Db,null!=c?` (${null!=c?c:""})`:""),i.a.createElement(U.EuiFilterButton,{hasActiveFilters:u,onClick:y,"data-test-subj":"showCustomRulesFilterButton"},Ig.rb,null!=l?` (${l})`:""))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFilterGroup,null,i.a.createElement(U.EuiFilterButton,{hasActiveFilters:!0===m,onClick:h,"data-test-subj":"showEnabledRulesFilterButton",withNext:!0},Ig.Eb),i.a.createElement(U.EuiFilterButton,{hasActiveFilters:!1===m,onClick:v,"data-test-subj":"showDisabledRulesFilterButton"},Ig.zb))))};zF.displayName="RulesTableFiltersComponent";const $F=i.a.memo(zF);$F.displayName="RulesTableFilters";var VF=a(220),UF=a(476);let HF;!function(e){e.management="management",e.monitoring="monitoring",e.updates="updates"}(HF||(HF={}));const GF=i.a.memo((()=>{var e,t,a;const{data:r}=Z_(),{data:s}=VM(),[{loading:o,canUserCRUD:l}]=Object(le.b)(),c=(null!==(e=null==r?void 0:r.rules_summary.custom_count)&&void 0!==e?e:0)+(null!==(t=null==r?void 0:r.rules_summary.prebuilt_installed_count)&&void 0!==t?t:0),u=null!==(a=null==s?void 0:s.num_prebuilt_rules_to_upgrade)&&void 0!==a?a:0,d=!o&&l&&u>0,p=Object(n.useMemo)((()=>({[HF.management]:{id:HF.management,name:Gg,disabled:!1,href:`/rules/${HF.management}`,isBeta:c>0,betaOptions:{text:`${c}`}},[HF.monitoring]:{id:HF.monitoring,name:Qg,disabled:!1,href:`/rules/${HF.monitoring}`,isBeta:c>0,betaOptions:{text:`${c}`}},...d?{[HF.updates]:{id:HF.updates,name:Wg,disabled:!1,href:`/rules/${HF.updates}`,isBeta:u>0,betaOptions:{text:`${u}`}}}:{}})),[c,u,d]),{hasAssistantPrivilege:m}=Object(lT.a)(),{state:{rules:b,selectedRuleIds:g}}=Object(_g.b)(),f=Object(n.useMemo)((()=>b.filter((e=>g.includes(e.id)))),[b,g]),y=Object(n.useCallback)((async()=>Object(UF.c)(f)),[f]);return i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(_s.a,{navTabs:p})),i.a.createElement(U.EuiFlexItem,{grow:!1},m&&f.length>0&&i.a.createElement(VF.f,{category:"detection-rules",conversationId:Ig.yb,description:Ig.Ic,getPromptContext:y,suggestedUserPrompt:Ig.Fb,tooltip:Ig.Jc})))}));GF.displayName="RulesTableToolbar";var QF=a(317);const WF=({isRefreshOn:e,isDisabled:t,reFetchRules:a,setIsRefreshOn:r})=>{const[s,o]=Object(n.useState)(!1),l=Object(n.useCallback)((()=>o(!1)),[o]),c=Object(n.useCallback)((()=>o((e=>!e))),[o]),u=Object(n.useCallback)((e=>{const t=e.target.checked;t&&a(),r(t),l()}),[a,r,l]);return i.a.createElement(U.EuiPopover,{isOpen:s,closePopover:l,button:i.a.createElement(YF,{"data-test-subj":"autoRefreshButton",color:"text",iconType:"timeRefresh",onClick:c,disabled:t},e?"On":"Off")},i.a.createElement(U.EuiContextMenuPanel,{items:[i.a.createElement(U.EuiSwitch,{key:"allRulesAutoRefreshSwitch",label:Ig.ec,checked:null!=e&&e,onChange:u,compressed:!0,disabled:t,"data-test-subj":"refreshSettingsSwitch"}),...t?[i.a.createElement("div",{key:"refreshSettingsSelectionNote"},i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement(U.EuiTextColor,{color:"subdued","data-test-subj":"refreshSettingsSelectionNote"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rules.refreshRulePopoverSelectionHelpText",defaultMessage:"Note: Refresh is disabled while there is an active selection."})))]:[]]}))};WF.displayName="AutoRefreshButtonComponent";const KF=i.a.memo(WF);KF.displayName="AutoRefreshButton";var YF=G()(U.EuiButtonEmpty).withConfig({displayName:"_StyledEuiButtonEmpty",componentId:"sc-ljfno4-0"})(["margin-left:10px;"]);const JF=i.a.memo((({canBulkEdit:e,onGetBulkItemsPopoverContent:t,onToggleSelectAll:a,isBulkActionInProgress:r})=>{const{timelines:s}=Object(m.j)().services,{startTransaction:o}=Object($d.b)(),l=Object(_g.b)(),{pagination:c,selectedRuleIds:u,isRefreshOn:d,isAllSelected:p,loadingRulesAction:b}=l.state,{reFetchRules:g,setIsRefreshOn:f}=l.actions,y=p?c.total:u.length,h=y>0,v=null!=b,E=Object(n.useCallback)((()=>{o({name:Bg.d.REFRESH}),g()}),[g,o]),x=Object(n.useCallback)((e=>null!=t?i.a.createElement(U.EuiContextMenu,{initialPanelId:0,panels:t(e)}):null),[t]);return i.a.createElement(QF.a,{border:!0},i.a.createElement(QF.d,null,i.a.createElement(QF.c,null,i.a.createElement(QF.e,{dataTestSubj:"showingRules"},Ig.Uc(...(({page:e,perPage:t,total:a})=>[0===a?0:(e-1)*t+1,e*t>a?a:e*t,a])(c)))),i.a.createElement(i.a.Fragment,null,i.a.createElement(QF.c,{"data-test-subj":"tableBulkActions"},i.a.createElement(QF.e,{dataTestSubj:"selectedRules"},Ig.Rc(y)),e&&i.a.createElement(QF.b,{disabled:v,dataTestSubj:"selectAllRules",iconType:p?"cross":"pagesSelect",iconSide:"left",onClick:a},p?Ig.ab:Ig.Sc(c.total)),e&&i.a.createElement(QF.b,{disabled:v,inProgress:r,dataTestSubj:"bulkActions",iconSide:"right",iconType:"arrowDown",popoverPanelPaddingSize:"none",popoverContent:x},Ig.f),i.a.createElement(QF.b,{disabled:v,dataTestSubj:"refreshRulesAction",iconSide:"left",iconType:"refresh",onClick:E},Ig.dc),!l.state.isDefault&&i.a.createElement(QF.b,{dataTestSubj:"clearTableFilters",iconSide:"left",iconType:"cross",onClick:l.actions.clearFilters},Ig.Z)))),i.a.createElement(QF.d,{dataTestSubj:"refreshRulesStatus"},s.getLastUpdated({showUpdating:l.state.isFetching,updatedAt:l.state.lastUpdated}),i.a.createElement(KF,{isDisabled:v||h,isRefreshOn:d,reFetchRules:g,setIsRefreshOn:f})))}));JF.displayName="RulesTableUtilityBar";var XF=a(1113),ZF=a(1114),eA=a(1052),tA=a(1434);const aA=i.a.createElement(U.EuiEmptyPrompt,{title:i.a.createElement("h3",null,Ig.Sb),titleSize:"xs",body:Ig.Xb}),nA=i.a.memo((({selectedTab:e})=>{var t,a;const[{canUserCRUD:r}]=Object(le.b)(),o=Object(bg.c)(r),l=Object(tA.a)(),c=Object(n.useRef)(null),u=Object(_g.b)(),{data:d}=Z_(),{state:{rules:p,filterOptions:b,isPreflightInProgress:g,isAllSelected:f,isFetched:y,isLoading:h,isRefetching:v,loadingRuleIds:E,loadingRulesAction:x,pagination:j,selectedRuleIds:S,sortingOptions:k},actions:{setIsAllSelected:O,setPage:w,setPerPage:T,setSelectedRuleIds:I,setSortingOptions:C}}=u,[M,_,F]=Object(Kg.a)(),[A,D,N]=Object(IF.a)({onInit:_,onFinish:F}),P=f?j.total:S.length||1,{bulkActionsDryRunResult:R,bulkAction:L,isBulkActionConfirmationVisible:B,showBulkActionConfirmation:q,cancelBulkActionConfirmation:z,approveBulkActionConfirmation:$}=(()=>{const[e,t]=Object(n.useState)(),[a,i]=Object(n.useState)(),[r,s,o]=Object(Kg.a)(),[l,c,u]=Object(IF.a)({onInit:s,onFinish:o});return{bulkActionsDryRunResult:a,bulkAction:e,isBulkActionConfirmationVisible:r,showBulkActionConfirmation:Object(n.useCallback)((async(e,a)=>{var n;if(t(a),i(e),!((null!==(n=null==e?void 0:e.failedRulesCount)&&void 0!==n?n:0)>0))return!0;const r=await l();return r&&c(),r}),[l,c]),cancelBulkActionConfirmation:u,approveBulkActionConfirmation:c}})(),{isBulkDuplicateConfirmationVisible:V,showBulkDuplicateConfirmation:H,cancelRuleDuplication:G,confirmRuleDuplication:Q}=Object(XF.a)(),{bulkEditActionType:W,isBulkEditFlyoutVisible:K,handleBulkEditFormConfirm:Y,handleBulkEditFormCancel:J,completeBulkEditForm:X}=(()=>{const e=Object(n.useRef)(null),[t,a]=Object(n.useState)(),[i,r,s]=Object(Kg.a)(),[o,l,c]=Object(IF.a)({onInit:r,onFinish:s}),u=Object(n.useCallback)((async t=>(a(t),!0===await o()?e.current:null)),[o]);return{bulkEditActionType:t,isBulkEditFlyoutVisible:i,handleBulkEditFormConfirm:Object(n.useCallback)((t=>{e.current=t,l()}),[l]),handleBulkEditFormCancel:c,completeBulkEditForm:u}})(),{isBulkActionsDryRunLoading:Z,executeBulkActionsDryRun:ee}=(()=>{const{data:e,mutateAsync:t,isLoading:a}=Object(Hu.useMutation)(["bulkActionsDryRun"],(async e=>{let t;try{t=await Object(C_.d)({bulkAction:e,dryRun:!0})}catch(e){var a,n,i;if(void 0===(null===(a=e.body)||void 0===a||null===(n=a.attributes)||void 0===n||null===(i=n.summary)||void 0===i?void 0:i.total))return;t=e.body}return{succeededRulesCount:null==(r=t)?void 0:r.attributes.summary.succeeded,failedRulesCount:null==r?void 0:r.attributes.summary.failed,ruleErrors:null!==(s=null==r||null===(o=r.attributes.errors)||void 0===o?void 0:o.map((({message:e,err_code:t,rules:a})=>({message:e,errorCode:t,ruleIds:a.map((({id:e})=>e))}))))&&void 0!==s?s:[]};var r,s,o}));return{bulkActionsDryRunResult:e,isBulkActionsDryRunLoading:a,executeBulkActionsDryRun:t}})(),te=(({filterOptions:e,confirmDeletion:t,showBulkActionConfirmation:a,showBulkDuplicateConfirmation:r,completeBulkEditForm:o,executeBulkActionsDryRun:l})=>{const c=Pg(),u=Object(_g.b)(),d=Ag(),p=Object(rs.a)(),m=Object(kF.a)(e),{startTransaction:b}=Object($d.b)(),{executeBulkAction:g}=Object(zg.b)(),{bulkExport:f}=Object(qg.a)(),y=Object($g.a)(),{state:{isAllSelected:h,rules:v,loadingRuleIds:E,selectedRuleIds:x},actions:{clearRulesSelection:j,setIsPreflightInProgress:S}}=u;return Object(n.useCallback)((n=>{const u=v.filter((({id:e})=>x.includes(e))),k=u.some((({enabled:e})=>e)),O=u.some((({enabled:e})=>!e)),w=x.some((e=>E.includes(e))),T=!d&&u.some((e=>!Object(bg.a)(e,d))),I=t=>async()=>{let r,s=!1;n(),S(!0);const c=await l({type:OF.b.edit,...h?{query:Object(kF.a)(e)}:{ids:x},editPayload:wF(t)});if(S(!1),!1===await a(c,OF.b.edit))return;const u=await o(t);if(null==u)return;b({name:Bg.b.EDIT});const d=()=>{r&&p.api.remove(r)};setTimeout((()=>{var e;s||(r=p.addWarning({title:Ig.W,text:Object($r.toMountPoint)(i.a.createElement(i.a.Fragment,null,i.a.createElement("p",null,Ig.U(null!==(e=null==c?void 0:c.succeededRulesCount)&&void 0!==e?e:0)),i.a.createElement(U.EuiFlexGroup,{justifyContent:"flexEnd",gutterSize:"s"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{color:"warning",size:"s",onClick:d},Ig.V))))),iconType:void 0},{toastLifeTimeMs:6e5}))}),5e3),await g({type:OF.b.edit,...TF({...h?{filterOptions:e}:{selectedRuleIds:x},dryRunResult:c}),editPayload:[u]}),d(),s=!0},C=w||0===x.length,M=T||w||0===x.length;return[{id:0,title:Ig.u,items:[{key:Ig.r,name:Ig.r,"data-test-subj":"enableRuleBulk",disabled:T||w||!O&&!h,onClick:async()=>{b({name:Bg.b.ENABLE}),n();const e=u.filter((({enabled:e})=>!e)),t=e.filter((({type:e})=>!Object(dg.d)(e))),a=e.length-t.length;!c&&a>0&&p.addWarning(ue.e(a));const i=c?e.map((({id:e})=>e)):t.map((({id:e})=>e));await g({type:OF.b.enable,...h?{query:m}:{ids:i}})},toolTipContent:T?Ig.Qb:void 0,toolTipPosition:"right",icon:void 0},{key:Ig.q,name:Ig.q,"data-test-subj":"duplicateRuleBulk",disabled:M,onClick:async()=>{b({name:Bg.b.DUPLICATE}),n();const e=await r();null!==e&&(await g({type:OF.b.duplicate,duplicatePayload:{include_exceptions:e===Rg.a.withExceptions||e===Rg.a.withExceptionsExcludeExpiredExceptions,include_expired_exceptions:!(e===Rg.a.withExceptionsExcludeExpiredExceptions)},...h?{query:m}:{ids:x}}),j())},toolTipContent:T?Ig.Qb:void 0,toolTipPosition:"right",icon:void 0},{key:Ig.t,name:Ig.t,"data-test-subj":"indexPatternsBulkEditRule",disabled:M,panel:2},{key:Ig.w,name:Ig.w,"data-test-subj":"tagsBulkEditRule",disabled:M,panel:1},{key:Ig.h,name:Ig.h,"data-test-subj":"addRuleActionsBulk",disabled:!d||M,onClick:I(OF.a.add_rule_actions),toolTipContent:d?void 0:Ig.Qb,toolTipPosition:"right",icon:void 0},{key:Ig.v,name:Ig.v,"data-test-subj":"setScheduleBulk",disabled:M,onClick:I(OF.a.set_schedule),toolTipContent:T?Ig.Qb:void 0,toolTipPosition:"right",icon:void 0},{key:Ig.j,name:Ig.j,"data-test-subj":"applyTimelineTemplateBulk",disabled:M,onClick:I(OF.a.set_timeline),toolTipContent:T?Ig.Qb:void 0,toolTipPosition:"right",icon:void 0},{key:Ig.s,name:Ig.s,"data-test-subj":"exportRuleBulk",disabled:w||0===x.length,onClick:async()=>{n(),b({name:Bg.b.EXPORT});const e=await f(h?{query:m}:{ids:x});if(!e)return;const t=await Object(bs.c)(e),i=await a((e=>({succeededRulesCount:e.exported_rules_count,failedRulesCount:e.missing_rules_count,ruleErrors:e.missing_rules.length?[{errorCode:s.p.IMMUTABLE,message:"Prebuilt rules can't be exported.",ruleIds:e.missing_rules.map((({rule_id:e})=>e))}]:[]}))(t),OF.b.export);!1!==i&&await y(e)},icon:void 0},{key:Ig.p,name:Ig.p,"data-test-subj":"disableRuleBulk",disabled:T||w||!k&&!h,onClick:async()=>{b({name:Bg.b.DISABLE}),n();const e=u.filter((({enabled:e})=>e)).map((({id:e})=>e));await g({type:OF.b.disable,...h?{query:m}:{ids:e}})},toolTipContent:T?Ig.Qb:void 0,toolTipPosition:"right",icon:void 0},{key:Ig.m,name:i.a.createElement(U.EuiTextColor,{color:C?Jb.euiThemeVars.euiButtonColorDisabledText:"danger"},Ig.m),"data-test-subj":"deleteRuleBulk",disabled:C,onClick:async()=>{n(),!1!==await t()&&(b({name:Bg.b.DELETE}),await g({type:OF.b.delete,...h?{query:m}:{ids:x}}))},toolTipPosition:"right",icon:void 0}]},{id:1,title:Ig.u,items:[{key:Ig.i,name:Ig.i,"data-test-subj":"addTagsBulkEditRule",onClick:I(OF.a.add_tags),disabled:M,toolTipContent:T?Ig.Qb:void 0,toolTipPosition:"right"},{key:Ig.o,name:Ig.o,"data-test-subj":"deleteTagsBulkEditRule",onClick:I(OF.a.delete_tags),disabled:M,toolTipContent:T?Ig.Qb:void 0,toolTipPosition:"right"}]},{id:2,title:Ig.u,items:[{key:Ig.g,name:Ig.g,"data-test-subj":"addIndexPatternsBulkEditRule",onClick:I(OF.a.add_index_patterns),disabled:M,toolTipContent:T?Ig.Qb:void 0,toolTipPosition:"right"},{key:Ig.n,name:Ig.n,"data-test-subj":"deleteIndexPatternsBulkEditRule",onClick:I(OF.a.delete_index_patterns),disabled:M,toolTipContent:T?Ig.Qb:void 0,toolTipPosition:"right"}]}]}),[v,x,d,h,E,b,c,g,m,p,r,j,t,f,a,y,S,l,e,o])})({filterOptions:b,confirmDeletion:A,showBulkActionConfirmation:q,showBulkDuplicateConfirmation:H,completeBulkEditForm:X,executeBulkActionsDryRun:ee}),ae=Object(n.useMemo)((()=>({pageIndex:j.page-1,pageSize:j.perPage,totalItemCount:j.total,pageSizeOptions:__.b})),[j.page,j.perPage,j.total]),ne=Object(n.useCallback)((({page:e,sort:t})=>{var a,n;C({field:null!==(a=null==t?void 0:t.field)&&void 0!==a?a:"enabled",order:null!==(n=null==t?void 0:t.direction)&&void 0!==n?n:"desc"}),w(e.index+1),T(e.size)}),[w,T,C]),{loading:ie,jobs:re,startMlJobs:se}=Object(eA.a)(),oe=(({hasCRUDPermissions:e,isLoadingJobs:t,mlJobs:a,startMlJobs:r,showExceptionsDuplicateConfirmation:o,confirmDeletion:l})=>{const c=of({showExceptionsDuplicateConfirmation:o,confirmDeletion:l}),u=af(),[d]=Object(m.p)(s.vc),p=ef({hasCRUDPermissions:e,isLoadingJobs:t,mlJobs:a,startMlJobs:r}),b=nf({sortable:!0,width:"16%",isLoadingJobs:t,mlJobs:a}),g=Object(n.useMemo)((()=>({field:"snooze",name:Ig.ob,render:(e,t)=>i.a.createElement(pg.a,{ruleId:t.id}),width:"100px",sortable:!1})),[]);return Object(n.useMemo)((()=>[u,...d?[sf]:[],rf,{field:"risk_score",name:Ig.lb,render:e=>i.a.createElement(U.EuiText,{"data-test-subj":"riskScore",size:"s"},e),sortable:!0,truncateText:!0,width:"85px"},{field:"severity",name:Ig.nb,render:e=>i.a.createElement(Tg.a,{value:e}),sortable:!0,truncateText:!0,width:"12%"},{field:"execution_summary.last_execution.date",name:Ig.gb,render:e=>i.a.createElement(U.EuiFlexGroup,{"data-test-subj":"ruleLastRun"},null==e?Object(Bs.d)():i.a.createElement(qs.b,{tooltipFieldName:Ig.gb,relativeThresholdInHrs:s.Q,value:e,tooltipAnchorClassName:"eui-textTruncate"})),sortable:!0,truncateText:!0,width:"16%"},b,{field:"updated_at",name:Ig.ib,render:e=>null==e?Object(Bs.d)():i.a.createElement(qs.b,{tooltipFieldName:Ig.ib,relativeThresholdInHrs:s.Q,value:e,tooltipAnchorClassName:"eui-textTruncate"}),sortable:!0,width:"18%",truncateText:!0},g,p,...e?[c]:[]]),[c,p,b,g,e,u,d])})({hasCRUDPermissions:o,isLoadingJobs:ie,mlJobs:re,startMlJobs:se,showExceptionsDuplicateConfirmation:H,confirmDeletion:A}),ce=(({hasCRUDPermissions:e,isLoadingJobs:t,mlJobs:a,startMlJobs:r,showExceptionsDuplicateConfirmation:o,confirmDeletion:l})=>{const c=Object(m.j)().services.docLinks,u=of({showExceptionsDuplicateConfirmation:o,confirmDeletion:l}),d=af(),[p]=Object(m.p)(s.vc),b=ef({hasCRUDPermissions:e,isLoadingJobs:t,mlJobs:a,startMlJobs:r}),g=nf({sortable:!0,width:"12%",isLoadingJobs:t,mlJobs:a});return Object(n.useMemo)((()=>[{...d,width:"28%"},...p?[sf]:[],rf,{field:"execution_summary.last_execution.metrics.total_indexing_duration_ms",name:i.a.createElement(Fg.a,{title:Ig.eb,tooltipContent:Ig.fb}),render:e=>i.a.createElement(U.EuiText,{"data-test-subj":"total_indexing_duration_ms",size:"s"},null!=e?e.toFixed():Object(Bs.d)()),sortable:!0,truncateText:!0,width:"16%"},{field:"execution_summary.last_execution.metrics.total_search_duration_ms",name:i.a.createElement(Fg.a,{title:Ig.jb,tooltipContent:Ig.kb}),render:e=>i.a.createElement(U.EuiText,{"data-test-subj":"total_search_duration_ms",size:"s"},null!=e?e.toFixed():Object(Bs.d)()),sortable:!0,truncateText:!0,width:"14%"},{field:"execution_summary.last_execution.metrics.execution_gap_duration_s",name:i.a.createElement(Fg.a,{title:Ig.cb,customTooltip:i.a.createElement("div",{style:{maxWidth:"20px"}},i.a.createElement(Mg.a,{columnName:Ig.cb},i.a.createElement(U.EuiText,{style:{width:300}},i.a.createElement("p",null,i.a.createElement(Fs.FormattedMessage,{defaultMessage:"Duration of most recent gap in Rule execution. Adjust Rule look-back or {seeDocs} for mitigating gaps.",id:"xpack.securitySolution.detectionEngine.rules.allRules.columns.gapTooltip",values:{seeDocs:i.a.createElement(U.EuiLink,{href:`${c.links.siem.troubleshootGaps}`,target:"_blank"},Ig.db)}})))))}),render:e=>i.a.createElement(U.EuiText,{"data-test-subj":"gap",size:"s"},null!=e?qr.a.duration(e,"seconds").humanize():Object(Bs.d)()),sortable:!0,truncateText:!0,width:"14%"},g,{field:"execution_summary.last_execution.date",name:Ig.gb,render:e=>i.a.createElement(U.EuiFlexGroup,{"data-test-subj":"ruleLastRun"},null==e?Object(Bs.d)():i.a.createElement(qs.b,{tooltipFieldName:Ig.gb,relativeThresholdInHrs:s.Q,value:e,tooltipAnchorClassName:"eui-textTruncate"})),sortable:!0,truncateText:!0,width:"16%"},b,...e?[u]:[]]),[u,c.links.siem.troubleshootGaps,b,g,e,d,p])})({hasCRUDPermissions:o,isLoadingJobs:ie,mlJobs:re,startMlJobs:se,showExceptionsDuplicateConfirmation:H,confirmDeletion:A}),de=Object(n.useRef)(!1);((e,t)=>{const a=Object(n.useRef)(t);Object(n.useEffect)((()=>{JSON.stringify(a.current)!==JSON.stringify(t)&&(a.current=t,e(t))}),[e,t])})((e=>{null!=c.current&&c.current.setSelection(p.filter((t=>e.includes(t.id))))}),S);const pe=o&&(e===HF.management||e===HF.monitoring),me=Object(n.useMemo)((()=>({selectable:e=>!E.includes(e.id),onSelectionChange:e=>{de.current?(de.current=!1,0===e.length&&(O(!1),I([]))):(I(e.map((({id:e})=>e))),O(!1))}})),[E,O,I]),be=Object(n.useCallback)((()=>{de.current=!0,O(!f),I(f?[]:p.map((({id:e})=>e)))}),[p,f,O,I]),ge=0===(null==d?void 0:d.rules_summary.custom_count)&&0===(null==d?void 0:d.rules_summary.prebuilt_installed_count),fe=!h&&!ge;let ye;switch(e){case HF.management:ye={"data-test-subj":"rules-management-table",columns:oe};break;case HF.monitoring:ye={"data-test-subj":"rules-monitoring-table",columns:ce};break;default:ye={"data-test-subj":"rules-management-table",columns:oe}}const he=y&&v||l,ve=!y&&v||g,Ee=Math.max(f?j.total:null!==(t=null==S?void 0:S.length)&&void 0!==t?t:0,1);return i.a.createElement(i.a.Fragment,null,he&&i.a.createElement(U.EuiProgress,{"data-test-subj":"loadingRulesInfoProgress",size:"xs",position:"absolute",color:"accent"}),ve&&i.a.createElement($s.a,{"data-test-subj":"loadingPanelAllRulesTable",overlay:!0,size:"xl"}),ge&&i.a.createElement(P_,null),M&&i.a.createElement(U.EuiConfirmModal,{title:1===P?Ig.Vc:Ig.x,onCancel:N,onConfirm:D,confirmButtonText:Ig.wb,cancelButtonText:Ig.vb,buttonColor:"danger",defaultFocusedButton:"confirm","data-test-subj":"deleteRulesConfirmationModal"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.components.allRules.deleteConfirmationModalBody",defaultMessage:'This action will delete {rulesToDeleteCount, plural, one {the chosen rule} other {{rulesToDeleteCountStrong} rules}}. Click "Delete" to continue.',values:{rulesToDeleteCount:P,rulesToDeleteCountStrong:i.a.createElement("strong",null,P)}})),B&&L&&i.a.createElement(U_,{bulkAction:L,result:R,onCancel:z,onConfirm:$}),V&&i.a.createElement(ZF.a,{onCancel:G,onConfirm:Q,rulesCount:Ee}),K&&void 0!==W&&i.a.createElement(SF,{rulesCount:null!==(a=null==R?void 0:R.succeededRulesCount)&&void 0!==a?a:0,editAction:W,onClose:J,onConfirm:Y}),fe&&i.a.createElement(i.a.Fragment,null,i.a.createElement($F,null),i.a.createElement(JF,{canBulkEdit:o,onGetBulkItemsPopoverContent:te,onToggleSelectAll:be,isBulkActionInProgress:Z||null!=x}),i.a.createElement(U.EuiBasicTable,Ni()({itemId:"id",items:p,isSelectable:pe,noItemsMessage:aA,onChange:ne,pagination:ae,ref:c,selection:pe?me:void 0,sorting:{sort:{field:k.field,direction:k.order}}},ye))))}));nA.displayName="RulesTables";const iA=i.a.memo((()=>{const{docLinks:e}=Object(m.j)().services;return i.a.createElement(U.EuiLink,{href:e.links.siem.ruleChangeLog,target:"_blank",external:!0,"data-test-subj":"rules-changelog-link"},Ig.Kc)}));iA.displayName="RulesChangelogLink";const rA=$.i18n.translate("xpack.securitySolution.detectionEngine.rules.upgradeRules.upgradeAll",{defaultMessage:"Update all"}),sA=$.i18n.translate("xpack.securitySolution.detectionEngine.rules.upgradeRules.searchBarPlaceholder",{defaultMessage:"Search by rule name"}),oA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.updateButtonLabel",{defaultMessage:"Update"});var lA=a(587),cA=a(494),uA=a(470),dA=a(856),pA=a(401);const mA=["POST","ALL_RULES",cA.c],bA=["POST","SPECIFIC_RULES",cA.c],gA=$.i18n.translate("xpack.securitySolution.detectionEngine.prebuiltRules.toast.ruleInstallationFailed",{defaultMessage:"Rule installation failed"}),fA=$.i18n.translate("xpack.securitySolution.detectionEngine.prebuiltRules.toast.ruleUpgradeFailed",{defaultMessage:"Rule update failed"}),yA=e=>{const t=[],{summary:{succeeded:a,skipped:n,failed:i}}=e;return a>0&&t.push((e=>$.i18n.translate("xpack.securitySolution.detectionEngine.prebuiltRules.toast.upgradeRuleSuccess",{defaultMessage:"{succeeded, plural, one {# rule} other {# rules}} updated successfully.",values:{succeeded:e}}))(a)),n>0&&t.push((e=>$.i18n.translate("xpack.securitySolution.detectionEngine.prebuiltRules.toast.upgradeRuleSkipped",{defaultMessage:"{skipped, plural, one {# rule was} other {# rules were}} skipped during update.",values:{skipped:e}}))(n)),i>0&&t.push((e=>$.i18n.translate("xpack.securitySolution.detectionEngine.prebuiltRules.toast.upgradeRuleFailed",{defaultMessage:"{failed, plural, one {# rule} other {# rules}} failed to update.",values:{failed:e}}))(i)),t.join(" ")},hA=e=>{const[t,a]=i.a.useState(null);return{openRulePreview:Object(n.useCallback)((t=>{const n=e.find((e=>e.id===t));Object(lA.a)(n,`Rule with id ${t} not found`),a(n)}),[e,a]),closeRulePreview:Object(n.useCallback)((()=>{a(null)}),[]),previewedRule:t}};var vA=a(180),EA=a(417),xA=a(1094);const jA=G()(U.EuiBadge).withConfig({displayName:"StyledEuiBadge",componentId:"sc-1oris7-0"})([".euiBadge__text{white-space:pre-wrap !important;}"]),SA=({badges:e})=>i.a.createElement(U.EuiFlexGroup,{responsive:!1,gutterSize:"xs",wrap:!0},e.map((e=>i.a.createElement(U.EuiFlexItem,{grow:!1,key:`badge-${e}`},i.a.createElement(jA,{color:"hollow"},e))))),kA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.overviewTabLabel",{defaultMessage:"Overview"}),OA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.investigationGuideTabLabel",{defaultMessage:"Investigation guide"}),wA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.dismissButtonLabel",{defaultMessage:"Dismiss"}),TA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.aboutSectionLabel",{defaultMessage:"About"}),IA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.definitionSectionLabel",{defaultMessage:"Definition"}),CA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.scheduleSectionLabel",{defaultMessage:"Schedule"}),MA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.setupGuideSectionLabel",{defaultMessage:"Setup guide"}),_A=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.descriptionFieldLabel",{defaultMessage:"Description"}),FA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.authorFieldLabel",{defaultMessage:"Author"}),AA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.buildingBlockFieldLabel",{defaultMessage:"Building block"}),DA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.buildingBlockFieldDescription",{defaultMessage:'All generated alerts will be marked as "building block" alerts'}),NA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.severityFieldLabel",{defaultMessage:"Severity"}),PA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.severityMappingFieldLabel",{defaultMessage:"Severity override"}),RA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.riskScoreFieldLabel",{defaultMessage:"Risk score"}),LA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.riskScoreMappingFieldLabel",{defaultMessage:"Risk score override"}),BA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.referencesFieldLabel",{defaultMessage:"Reference URLs"}),qA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.falsePositivesFieldLabel",{defaultMessage:"False positive examples"}),zA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.investigationFieldsFieldLabel",{defaultMessage:"Custom highlighted fields"}),$A=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.licenseFieldLabel",{defaultMessage:"License"}),VA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleNameOverrideFieldLabel",{defaultMessage:"Rule name override"}),UA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.threatFieldLabel",{defaultMessage:"MITRE ATT&CK\\u2122"}),HA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.threatIndicatorPathFieldLabel",{defaultMessage:"Indicator prefix override"}),GA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.timestampOverrideFieldLabel",{defaultMessage:"Timestamp override"}),QA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.tagsFieldLabel",{defaultMessage:"Tags"}),WA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.indexFieldLabel",{defaultMessage:"Index patterns"}),KA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.dataViewIdFieldLabel",{defaultMessage:"Data view"}),YA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.dataViewIndexPatternFieldLabel",{defaultMessage:"Data view index pattern"}),JA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.dataViewIndexPatternFetchErrorMessage",{defaultMessage:"Could not load data view index pattern"}),XA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.ruleTypeFieldLabel",{defaultMessage:"Rule type"}),ZA=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.thresholdFieldLabel",{defaultMessage:"Threshold"}),eD=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.machineLearningJobIdFieldLabel",{defaultMessage:"Machine Learning job"}),tD=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.anomalyThresholdFieldLabel",{defaultMessage:"Anomaly score threshold"}),aD=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.relatedIntegrationsFieldLabel",{defaultMessage:"Related integrations"}),nD=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.requiredFieldsFieldLabel",{defaultMessage:"Required fields"}),iD=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.timelineTitleFieldLabel",{defaultMessage:"Timeline template"}),rD=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.threatIndexFieldLabel",{defaultMessage:"Indicator index patterns"}),sD=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.threatMappingFieldLabel",{defaultMessage:"Indicator mapping"}),oD=($.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.threatFiltersFieldLabel",{defaultMessage:"Filters"}),$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.newTermsFieldsFieldLabel",{defaultMessage:"Fields"})),lD=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.historyWindowSizeFieldLabel",{defaultMessage:"History Window Size"}),cD=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.intervalFieldLabel",{defaultMessage:"Runs every"}),uD=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.fromFieldLabel",{defaultMessage:"Additional look-back time"}),dD=G()(U.EuiFlexItem).withConfig({displayName:"OverrideColumn",componentId:"sc-ssmf6u-0"})(["width:125px;max-width:125px;overflow:hidden;text-overflow:ellipsis;"]),pD=G()(U.EuiFlexItem).withConfig({displayName:"OverrideValueColumn",componentId:"sc-ssmf6u-1"})(["width:30px;max-width:30px;overflow:hidden;text-overflow:ellipsis;"]),mD=G()(U.EuiLink).withConfig({displayName:"StyledEuiLink",componentId:"sc-ssmf6u-2"})(["word-break:break-word;"]),bD=({description:e})=>i.a.createElement(U.EuiText,{size:"s"},e),gD=({author:e})=>i.a.createElement(SA,{badges:e}),fD=()=>i.a.createElement(U.EuiText,{size:"s"},DA),yD=({severityMappingItem:e})=>i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"s"},i.a.createElement(dD,null,i.a.createElement(U.EuiToolTip,{content:e.field,"data-test-subj":`severityOverrideField-${e.value}`},i.a.createElement(i.a.Fragment,null,`${e.field}:`))),i.a.createElement(pD,null,i.a.createElement(U.EuiToolTip,{content:e.value,"data-test-subj":`severityOverrideValue-${e.value}`},Object(Bs.a)(e.value))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiIcon,{type:"sortRight"})),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(Tg.a,{"data-test-subj":`severityOverrideSeverity-${e.value}`,value:e.severity}))),hD=({riskScore:e})=>i.a.createElement(U.EuiText,{size:"s"},e),vD=({riskScoreMappingItem:e})=>i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"s"},i.a.createElement(dD,null,i.a.createElement(U.EuiToolTip,{content:e.field,"data-test-subj":`riskScoreOverrideField-${e.value}`},i.a.createElement(i.a.Fragment,null,e.field))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiIcon,{type:"sortRight"})),i.a.createElement(U.EuiFlexItem,null,at.q)),ED=({references:e})=>i.a.createElement(U.EuiText,{size:"s"},i.a.createElement("ul",null,e.filter((e=>!Object(x.isEmpty)(e))).map(((e,t)=>i.a.createElement("li",{"data-test-subj":"urlsDescriptionReferenceLinkItem",key:`${t}-${e}`},i.a.createElement(mD,{href:e,external:!0,target:"_blank"},e)))))),xD=({falsePositives:e})=>i.a.createElement(U.EuiText,{size:"s"},i.a.createElement("ul",null,e.map((e=>i.a.createElement("li",{"data-test-subj":"unorderedListArrayDescriptionItem",key:`falsePositives-${e}`},e))))),jD=({investigationFields:e})=>i.a.createElement(SA,{badges:e}),SD=({license:e})=>i.a.createElement(U.EuiText,{size:"s"},e),kD=({ruleNameOverride:e})=>i.a.createElement(U.EuiText,{size:"s"},e),OD=({threat:e})=>i.a.createElement(xA.a,{threat:Object(EA.a)(e),label:""}),wD=({threatIndicatorPath:e})=>i.a.createElement(U.EuiText,{size:"s"},e),TD=({timestampOverride:e})=>i.a.createElement(U.EuiText,{size:"s"},e),ID=({tags:e})=>i.a.createElement(SA,{badges:e}),CD=({rule:e})=>{const t=(e=>{const t=[];return e.author.length>0&&t.push({title:FA,description:i.a.createElement(gD,{author:e.author})}),e.building_block_type&&t.push({title:AA,description:i.a.createElement(fD,null)}),t.push({title:NA,description:i.a.createElement(Tg.a,{value:e.severity})}),e.severity_mapping.length>0&&t.push(...e.severity_mapping.filter((e=>""!==e.field)).map(((e,t)=>({title:0===t?PA:"",description:i.a.createElement(yD,{severityMappingItem:e})})))),t.push({title:RA,description:i.a.createElement(hD,{riskScore:e.risk_score})}),e.risk_score_mapping.length>0&&t.push(...e.risk_score_mapping.filter((e=>""!==e.field)).map(((e,t)=>({title:0===t?LA:"",description:i.a.createElement(vD,{riskScoreMappingItem:e})})))),e.references.length>0&&t.push({title:BA,description:i.a.createElement(ED,{references:e.references})}),e.false_positives.length>0&&t.push({title:qA,description:i.a.createElement(xD,{falsePositives:e.false_positives})}),e.investigation_fields&&e.investigation_fields.length>0&&t.push({title:zA,description:i.a.createElement(jD,{investigationFields:e.investigation_fields})}),e.license&&t.push({title:$A,description:i.a.createElement(SD,{license:e.license})}),e.rule_name_override&&t.push({title:VA,description:i.a.createElement(kD,{ruleNameOverride:e.rule_name_override})}),e.threat.length>0&&t.push({title:UA,description:i.a.createElement(OD,{threat:e.threat})}),"threat_indicator_path"in e&&e.threat_indicator_path&&t.push({title:HA,description:i.a.createElement(wD,{threatIndicatorPath:e.threat_indicator_path})}),e.timestamp_override&&t.push({title:GA,description:i.a.createElement(TD,{timestampOverride:e.timestamp_override})}),e.tags.length>0&&t.push({title:QA,description:i.a.createElement(ID,{tags:e.tags})}),t})(e);return i.a.createElement("div",null,e.description&&i.a.createElement(U.EuiDescriptionList,{listItems:[{title:_A,description:i.a.createElement(bD,{description:e.description})}]}),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiDescriptionList,{type:"column",listItems:t}))};var MD=a(751),_D=a(374),FD=a(72),AD=a(415),DD=a(741),ND=a(522),PD=a(268),RD=a(956),LD=a(213),BD=a(1104),qD=a(407);const zD=({savedQueryName:e})=>i.a.createElement(U.EuiText,{size:"s"},e),$D=G()(U.EuiBadge).withConfig({displayName:"EuiBadgeWrap",componentId:"sc-1lxmnf2-0"})([".euiBadge__text{white-space:pre-wrap !important;}"]),VD=({filters:e,dataViewId:t,index:a})=>{const{indexPattern:n}=Object(RD.b)({dataSourceType:t?LD.a.DataView:LD.a.IndexPatterns,index:null!=a?a:[],dataViewId:t}),r=Object(kw.mapAndFlattenFilters)(e);return i.a.createElement(U.EuiFlexGroup,{wrap:!0,responsive:!1,gutterSize:"xs"},r.map(((e,t)=>i.a.createElement(oN,{grow:!1,key:`filter-${t}`},i.a.createElement($D,{color:"hollow"},null!=n?i.a.createElement(FD.FilterBadgeGroup,{filters:[e],dataViews:[n]}):i.a.createElement(U.EuiLoadingSpinner,{size:"m"}))))))},UD=G.a.div.withConfig({displayName:"QueryContent",componentId:"sc-1lxmnf2-1"})(["white-space:pre-wrap;"]),HD=({query:e})=>i.a.createElement(UD,null,e),GD=({index:e})=>i.a.createElement(SA,{badges:e}),QD=({dataViewId:e})=>i.a.createElement(U.EuiText,{size:"s"},e),WD=({dataViewId:e})=>{const{data:t}=Object(qD.b)().services,[a,n]=i.a.useState(""),[r,s]=i.a.useState(!1);return i.a.useEffect((()=>{t.dataViews.get(e).then((e=>{n(e.getIndexPattern())})).catch((()=>{s(!0)}))}),[t,e]),r?i.a.createElement(U.EuiText,{size:"s"},JA):a?i.a.createElement(U.EuiText,{size:"s"},a):i.a.createElement(U.EuiLoadingSpinner,{size:"m"})},KD=({threshold:e})=>i.a.createElement(i.a.Fragment,null,Object(x.isEmpty)(e.field[0])?`${AD.w} >= ${e.value}`:`${AD.v} ${Array.isArray(e.field)?e.field.join(","):e.field} >= ${e.value}`),YD=({anomalyThreshold:e})=>i.a.createElement(U.EuiText,{size:"s"},e),JD=({jobIds:e})=>{const{jobs:t}=Object(EC.a)(),a=t.filter((t=>e.includes(t.id)));return i.a.createElement(i.a.Fragment,null,a.map((e=>{var t;return i.a.createElement(BD.a,{key:e.id,jobId:e.id,jobName:null===(t=e.customSettings)||void 0===t?void 0:t.security_app_display_name})})))},XD=({type:e})=>i.a.createElement(U.EuiText,{size:"s"},(e=>{switch(e){case"machine_learning":return AD.m;case"query":case"saved_query":return AD.p;case"threshold":return AD.x;case"eql":return AD.k;case"threat_match":return AD.t;case"new_terms":return AD.n;default:return Object(Ux.a)(e)}})(e)),ZD=G()(U.EuiText).withConfig({displayName:"StyledFieldTypeText",componentId:"sc-1lxmnf2-2"})(["font-size:",";font-family:",";display:inline;"],(({theme:e})=>e.eui.euiFontSizeXS),(({theme:e})=>e.eui.euiCodeFontFamily)),eN=({requiredFields:e})=>i.a.createElement(U.EuiFlexGrid,{gutterSize:"s"},e.map(((t,a)=>i.a.createElement(U.EuiFlexItem,{grow:!1,key:t.name},i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"xs"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(MD.a,{"data-test-subj":"field-type-icon",type:Object(_D.c)(t.type),label:t.type})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(ZD,{grow:!1,size:"s"},` ${t.name}${a+1!==e.length?", ":""}`))))))),tN=({timelineTitle:e})=>i.a.createElement(U.EuiText,{size:"s"},e),aN=({threatIndex:e})=>i.a.createElement(SA,{badges:e}),nN=({threatMapping:e})=>{const t=e.reduce(((e,t,a,{length:n})=>{const i=t.entries.reduce(((e,t,a,{length:n})=>1===n?`${t.field} ${ND.d} ${t.value}`:0===a?`(${t.field} ${ND.d} ${t.value})`:`${e} ${ND.a} (${t.field} ${ND.d} ${t.value})`),"");return 1===n?`${i}`:0===a?`(${i})`:`${e} ${ND.e} (${i})`}),"");return i.a.createElement(U.EuiText,{size:"s"},t)},iN=({newTermsFields:e})=>i.a.createElement(SA,{badges:e}),rN=({historyWindowStart:e})=>{const t=e?Object(T_.b)(e):"7d";return i.a.createElement(U.EuiText,{size:"s"},t)},sN=({rule:e})=>{const{savedQuery:t}=Object(DD.a)({savedQueryId:"saved_query"===e.type?e.saved_id:"",ruleType:e.type}),a=((e,t)=>{const a=[];return"index"in e&&e.index&&e.index.length>0&&a.push({title:WA,description:i.a.createElement(GD,{index:e.index})}),"data_view_id"in e&&e.data_view_id&&a.push({title:KA,description:i.a.createElement(QD,{dataViewId:e.data_view_id})},{title:YA,description:i.a.createElement(WD,{dataViewId:e.data_view_id})}),t&&(a.push({title:AD.s,description:i.a.createElement(zD,{savedQueryName:t.attributes.title})}),t.attributes.filters&&a.push({title:AD.q,description:i.a.createElement(VD,{filters:t.attributes.filters})})),"filters"in e&&e.filters&&e.filters.length>0&&a.push({title:t?AD.q:AD.l,description:i.a.createElement(VD,{filters:e.filters,dataViewId:e.data_view_id,index:e.index})}),"query"in e&&e.query&&a.push({title:t?AD.r:AD.o,description:i.a.createElement(HD,{query:e.query})}),a.push({title:XA,description:i.a.createElement(XD,{type:e.type})}),"anomaly_threshold"in e&&e.anomaly_threshold&&a.push({title:tD,description:i.a.createElement(YD,{anomalyThreshold:e.anomaly_threshold})}),"machine_learning_job_id"in e&&a.push({title:eD,description:i.a.createElement(JD,{jobIds:e.machine_learning_job_id})}),e.related_integrations.length>0&&a.push({title:aD,description:i.a.createElement(gg.b,{relatedIntegrations:e.related_integrations})}),e.required_fields.length>0&&a.push({title:nD,description:i.a.createElement(eN,{requiredFields:e.required_fields})}),a.push({title:iD,description:i.a.createElement(tN,{timelineTitle:e.timeline_title||PD.b})}),"threshold"in e&&e.threshold&&a.push({title:ZA,description:i.a.createElement(KD,{threshold:e.threshold})}),"threat_index"in e&&e.threat_index&&a.push({title:rD,description:i.a.createElement(aN,{threatIndex:e.threat_index})}),"threat_mapping"in e&&e.threat_mapping&&a.push({title:sD,description:i.a.createElement(nN,{threatMapping:e.threat_mapping})}),"threat_filters"in e&&e.threat_filters&&e.threat_filters.length>0&&a.push({title:t?AD.q:AD.l,description:i.a.createElement(VD,{filters:e.threat_filters,dataViewId:e.data_view_id,index:e.index})}),"threat_query"in e&&e.threat_query&&a.push({title:t?AD.r:AD.u,description:i.a.createElement(HD,{query:e.threat_query})}),"new_terms_fields"in e&&e.new_terms_fields&&e.new_terms_fields.length>0&&a.push({title:oD,description:i.a.createElement(iN,{newTermsFields:e.new_terms_fields})}),("new_terms"===e.type||"history_window_start"in e)&&a.push({title:lD,description:i.a.createElement(rN,{historyWindowStart:e.history_window_start})}),a})(e,t);return i.a.createElement("div",null,i.a.createElement(U.EuiDescriptionList,{type:"column",listItems:a}))};var oN=G()(U.EuiFlexItem).withConfig({displayName:"_StyledEuiFlexItem",componentId:"sc-1lxmnf2-3"})({width:"100%"});const lN=({interval:e})=>i.a.createElement(U.EuiText,{size:"s"},e),cN=({from:e,interval:t})=>i.a.createElement(U.EuiText,{size:"s"},Object(T_.f)(e,t)),uN=({rule:e})=>{const t=[];return t.push({title:cD,description:i.a.createElement(lN,{interval:e.interval})},{title:uD,description:i.a.createElement(cN,{from:e.from,interval:e.interval})}),i.a.createElement("div",null,i.a.createElement(U.EuiDescriptionList,{type:"column",listItems:t}))};var dN=a(383);const pN=({setup:e})=>i.a.createElement("div",null,i.a.createElement(dN.b,{textSize:"s"},e)),mN={about:!0,definition:!0,schedule:!0,setup:!0},bN=({title:e,isOpen:t,toggle:a,children:n})=>{const r=Object(U.useGeneratedHtmlId)({prefix:"accordion"});return i.a.createElement(U.EuiAccordion,{forceState:t?"open":"closed",onToggle:a,paddingSize:"none",id:r,buttonContent:i.a.createElement(U.EuiTitle,{size:"s"},i.a.createElement("h3",null,e)),initialIsOpen:!0},i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiFlexGroup,{gutterSize:"none",direction:"column"},n))},gN=({rule:e,expandedOverviewSections:t,toggleOverviewSection:a})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(bN,{title:TA,isOpen:t.about,toggle:a.about},i.a.createElement(CD,{rule:e})),i.a.createElement(U.EuiHorizontalRule,{margin:"m"}),i.a.createElement(bN,{title:IA,isOpen:t.definition,toggle:a.definition},i.a.createElement(sN,{rule:e})),i.a.createElement(U.EuiHorizontalRule,{margin:"m"}),i.a.createElement(bN,{title:CA,isOpen:t.schedule,toggle:a.schedule},i.a.createElement(uN,{rule:e})),e.setup&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiHorizontalRule,{margin:"m"}),i.a.createElement(bN,{title:MA,isOpen:t.setup,toggle:a.setup},i.a.createElement(pN,{setup:e.setup})))),fN=({note:e})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(dN.b,{textSize:"s"},e)),yN=G()(U.EuiFlyoutBody).withConfig({displayName:"StyledEuiFlyoutBody",componentId:"sc-1wpvwzo-0"})([".euiFlyoutBody__overflow{display:flex;flex:1;overflow:hidden;.euiFlyoutBody__overflowContent{flex:1;overflow:hidden;padding:",";}}"],(({theme:e})=>`0 ${e.eui.euiSizeL} 0`)),hN=G()(U.EuiFlexGroup).withConfig({displayName:"StyledFlexGroup",componentId:"sc-1wpvwzo-1"})(["height:100%;"]),vN=G()(U.EuiFlexItem).withConfig({displayName:"StyledEuiFlexItem",componentId:"sc-1wpvwzo-2"})(["&.euiFlexItem{flex:1 0 0;overflow:hidden;}"]),EN=G()(U.EuiTabbedContent).withConfig({displayName:"StyledEuiTabbedContent",componentId:"sc-1wpvwzo-3"})(["display:flex;flex:1;flex-direction:column;overflow:hidden;> [role='tabpanel']{display:flex;flex:1;flex-direction:column;overflow:hidden;overflow-y:auto;::-webkit-scrollbar{-webkit-appearance:none;width:7px;}::-webkit-scrollbar-thumb{border-radius:4px;background-color:rgba(0,0,0,0.5);-webkit-box-shadow:0 0 1px rgba(255,255,255,0.5);}}"]),xN=e=>i.a.createElement(hN,{direction:"column",gutterSize:"none"},i.a.createElement(vN,{grow:!0},i.a.createElement(EN,e))),jN=vA.css`
  padding: 0 ${Jb.euiThemeVars.euiSizeM} ${Jb.euiThemeVars.euiSizeXL} ${Jb.euiThemeVars.euiSizeM};
`,SN=({children:e})=>i.a.createElement("div",{className:jN},e),kN=({rule:e,actionButtonLabel:t,isActionButtonDisabled:a,onActionButtonClick:r,closeFlyout:s})=>{var o;const{expandedOverviewSections:l,toggleOverviewSection:c}=(()=>{const[e,t]=Object(n.useState)(mN),a=Object(n.useCallback)((e=>{t((t=>({...t,[e]:!t[e]})))}),[]);return{expandedOverviewSections:e,toggleOverviewSection:Object(n.useMemo)((()=>({about:()=>a("about"),definition:()=>a("definition"),schedule:()=>a("schedule"),setup:()=>a("setup")})),[a])}})(),u=Object(n.useMemo)((()=>({id:"overview",name:kA,content:i.a.createElement(SN,null,i.a.createElement(gN,{rule:e,expandedOverviewSections:l,toggleOverviewSection:c}))})),[e,l,c]),d=Object(n.useMemo)((()=>{var t;return{id:"investigationGuide",name:OA,content:i.a.createElement(SN,null,i.a.createElement(fN,{note:null!==(t=e.note)&&void 0!==t?t:""}))}}),[e.note]),p=Object(n.useMemo)((()=>e.note?[u,d]:[u]),[u,d,e.note]),[m,b]=Object(n.useState)(p[0].id),g=null!==(o=p.find((e=>e.id===m)))&&void 0!==o?o:p[0];return Object(n.useEffect)((()=>{p.find((e=>e.id===m))||b(p[0].id)}),[p,m]),i.a.createElement(U.EuiFlyout,{size:"m",onClose:s,ownFocus:!1,key:"prebuilt-rules-flyout",paddingSize:"l"},i.a.createElement(U.EuiFlyoutHeader,null,i.a.createElement(U.EuiTitle,{size:"m"},i.a.createElement("h2",null,e.name)),i.a.createElement(U.EuiSpacer,{size:"l"})),i.a.createElement(yN,null,i.a.createElement(xN,{tabs:p,selectedTab:g,onTabClick:e=>{b(e.id)}})),i.a.createElement(U.EuiFlyoutFooter,null,i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButtonEmpty,{onClick:s,flush:"left"},wA)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{disabled:a,onClick:()=>{var t;r(null!==(t=e.rule_id)&&void 0!==t?t:""),s()},fill:!0},t)))))},ON=$.i18n.translate("xpack.securitySolution.detectionEngine.mlJobUpgradeModal.messageTitle",{defaultMessage:"ML rule updates may override your existing rules"}),wN=$.i18n.translate("xpack.securitySolution.detectionEngine.mlJobUpgradeModal.cancelTitle",{defaultMessage:"Cancel"}),TN=$.i18n.translate("xpack.securitySolution.detectionEngine.mlJobUpgradeModal.confirmTitle",{defaultMessage:"Load rules"}),IN=$.i18n.translate("xpack.securitySolution.detectionEngine.mlJobUpgradeModal.affectedJobsTitle",{defaultMessage:"Affected jobs:"}),CN=()=>i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.mlJobUpgradeModal.messageBody",defaultMessage:"{summary} Documentation: {docs}",values:{summary:i.a.createElement("p",null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.mlJobUpgradeModal.messageBody.summary",defaultMessage:"New V3 machine learning jobs have been released, and the latest corresponding prebuilt detection rules now use these new ML jobs. You're currently running one or more V1/V2 jobs, which only work with legacy prebuilt rules. To ensure continued coverage using V1/V2 jobs, you may need to duplicate or create new rules before updating your Elastic prebuilt detection rules. Check the documentation below for instructions on how to keep using the V1/V2 jobs, and how to start using the new V3 jobs."})),docs:i.a.createElement("ul",null,i.a.createElement("li",null,i.a.createElement(gM.c,null)))}}),MN=G.a.ul.withConfig({displayName:"JobsUL",componentId:"sc-pal3mu-0"})(["max-height:200px;overflow-y:auto;&::-webkit-scrollbar{height:",";width:",";}&::-webkit-scrollbar-thumb{background-clip:content-box;background-color:",";border:"," solid transparent;}&::-webkit-scrollbar-corner,&::-webkit-scrollbar-track{background-color:transparent;}"],(({theme:e})=>e.eui.euiScrollBar),(({theme:e})=>e.eui.euiScrollBar),(({theme:e})=>Object(cs.rgba)(e.eui.euiColorDarkShade,.5)),(({theme:e})=>e.eui.euiScrollBarCorner)),_N=({jobs:e,onCancel:t,onConfirm:a})=>i.a.createElement(U.EuiConfirmModal,{title:ON,onCancel:t,onConfirm:a,cancelButtonText:wN,confirmButtonText:TN,buttonColor:"danger",defaultFocusedButton:"confirm"},i.a.createElement(CN,null),IN,i.a.createElement(MN,null,e.map((e=>i.a.createElement("li",{key:e.id},e.id))))),FN=Object(n.memo)(_N),AN=Object(n.createContext)(null),DN=({children:e})=>{const[t,a]=Object(n.useState)([]),[r,s]=Object(n.useState)([]),[o,l]=Object(n.useState)({filter:"",tags:[]}),c=Object(tA.a)(),{data:{rules:u,stats:{tags:d}}={rules:[],stats:{tags:[]}},refetch:p,dataUpdatedAt:m,isFetched:b,isLoading:g,isRefetching:f}=(e=>{const{addError:t}=Object(rs.a)();return Object(dA.a)({onError:e=>t(e,{title:$M.b}),refetchInterval:!1,keepPreviousData:!0})})(),{mutateAsync:y}=(()=>{const{addError:e,addSuccess:t}=Object(rs.a)();return(e=>{const t=Object(SM.b)(),a=Object(uA.b)(),n=Object(I_.b)(),i=Object(dA.b)(),r=Object(zM.b)(),s=Object(pA.b)();return Object(Hu.useMutation)((()=>Object(ms.t)()),{...e,mutationKey:mA,onSettled:(...o)=>{t(),a(),n(),i(),r(),s(),null!=e&&e.onSettled&&e.onSettled(...o)}})})({onError:t=>{e(t,{title:fA})},onSuccess:e=>{t(yA(e))}})})(),{mutateAsync:h}=(()=>{const{addError:e,addSuccess:t}=Object(rs.a)();return(e=>{const t=Object(SM.b)(),a=Object(uA.b)(),n=Object(zM.b)(),i=Object(I_.b)(),r=Object(dA.b)(),s=Object(zM.b)(),o=Object(pA.b)();return Object(Hu.useMutation)((e=>Object(ms.u)(e)),{...e,mutationKey:bA,onSettled:(...l)=>{n(),t(),a(),i(),r(),s(),o(),null!=e&&e.onSettled&&e.onSettled(...l)}})})({onError:t=>{e(t,{title:fA})},onSuccess:e=>{t(yA(e))}})})(),v=(({rules:e,filterOptions:t})=>Object(n.useMemo)((()=>{const{filter:a,tags:n}=t;return e.filter((e=>!(a&&!e.current_rule.name.toLowerCase().includes(a.toLowerCase()))&&(!(n&&n.length>0)||n.every((t=>e.current_rule.tags.includes(t))))))}),[t,e]))({filterOptions:o,rules:u}),{openRulePreview:E,closeRulePreview:x,previewedRule:j}=hA(v.map((e=>e.target_rule))),S=Boolean((null==j?void 0:j.rule_id)&&t.includes(j.rule_id)||f||c),[k,O,w]=Object(Kg.a)(!1),{loading:T,jobs:I}=Object(El.b)(),C=I.filter((e=>bM.includes(e.id))),[M,_,F]=Object(IF.a)({onInit:O,onFinish:w}),A=C.length>0,D=Object(n.useCallback)((async e=>{const t=u.find((t=>t.rule_id===e));Object(lA.a)(t,`Rule with id ${e} not found`),a((t=>[...t,e]));try{var n,i;if(A&&!await M())return;await h([{rule_id:e,version:null!==(n=null===(i=t.diff.fields.version)||void 0===i?void 0:i.target_version)&&void 0!==n?n:t.current_rule.version,revision:t.revision}])}finally{a((t=>t.filter((t=>t!==e))))}}),[M,u,A,h]),N=Object(n.useCallback)((async()=>{const e=r.map((e=>{var t,a;return{rule_id:e.rule_id,version:null!==(t=null===(a=e.diff.fields.version)||void 0===a?void 0:a.target_version)&&void 0!==t?t:e.current_rule.version,revision:e.revision}}));a((t=>[...t,...e.map((e=>e.rule_id))]));try{if(A&&!await M())return;await h(e)}finally{a((t=>t.filter((t=>!e.some((e=>e.rule_id===t)))))),s([])}}),[M,r,A,h]),P=Object(n.useCallback)((async()=>{a((e=>[...e,...u.map((e=>e.rule_id))]));try{if(A&&!await M())return;await y()}finally{a([]),s([])}}),[M,u,A,y]),R=Object(n.useMemo)((()=>({reFetchRules:p,upgradeOneRule:D,upgradeSelectedRules:N,upgradeAllRules:P,setFilterOptions:l,selectRules:s,openRulePreview:E})),[p,D,N,P,E]),L=Object(n.useMemo)((()=>({state:{rules:u,filteredRules:v,filterOptions:o,tags:d,isFetched:b,isLoading:g&&T,isRefetching:f,isUpgradingSecurityPackages:c,selectedRules:r,loadingRules:t,lastUpdated:m},actions:R})),[u,v,o,d,b,g,T,f,c,r,t,m,R]);return i.a.createElement(AN.Provider,{value:L},i.a.createElement(i.a.Fragment,null,k&&i.a.createElement(FN,{jobs:C,onCancel:F,onConfirm:_}),e,j&&i.a.createElement(kN,{rule:j,actionButtonLabel:oA,isActionButtonDisabled:S,onActionButtonClick:D,closeFlyout:x})))},NN=()=>{const e=Object(n.useContext)(AN);return Object(lA.a)(e,"useUpgradePrebuiltRulesTableContext should be used inside UpgradePrebuiltRulesTableContextProvider"),e},PN=()=>{var e;const{state:{rules:t,selectedRules:a,loadingRules:n,isRefetching:r,isUpgradingSecurityPackages:s},actions:{upgradeAllRules:o,upgradeSelectedRules:l}}=NN(),[{loading:c,canUserCRUD:u}]=Object(le.b)(),d=u&&!c,p=t.length>0,m=null!==(e=a.length)&&void 0!==e?e:0,b=m>0,g=n.length>0,f=g||r||s;return i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"s",responsive:!1,wrap:!0},b?i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{onClick:l,disabled:!d||f,"data-test-subj":"upgradeSelectedRulesButton"},i.a.createElement(i.a.Fragment,null,(e=>$.i18n.translate("xpack.securitySolution.detectionEngine.rules.upgradeRules.upgradeSelected",{defaultMessage:"Update {numberOfSelectedRules} selected rule(s)",values:{numberOfSelectedRules:e}}))(m),g?i.a.createElement(U.EuiLoadingSpinner,{size:"s"}):void 0))):null,i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{fill:!0,iconType:"plusInCircle",onClick:o,disabled:!d||!p||f,"data-test-subj":"upgradeAllRulesButton"},rA,g?i.a.createElement(U.EuiLoadingSpinner,{size:"s"}):void 0)))},RN=G()(U.EuiFlexGroup).withConfig({displayName:"FilterWrapper",componentId:"sc-1l3u1j4-0"})(["margin-bottom:",";"],(({theme:e})=>e.eui.euiSizeM)),LN=()=>{const{state:{filterOptions:e,tags:t},actions:{setFilterOptions:a}}=NN(),{tags:r}=e,s=Object(n.useCallback)((e=>{a((t=>({...t,filter:e.trim()})))}),[a]),o=Object(n.useCallback)((e=>{Object(x.isEqual)(e,r)||a((t=>({...t,tags:e})))}),[r,a]);return i.a.createElement(RN,{gutterSize:"m",justifyContent:"flexEnd",wrap:!0},i.a.createElement(BF,{initialValue:e.filter,onSearch:s,placeholder:sA}),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFilterGroup,null,i.a.createElement(_F,{onSelectedTagsChanged:o,selectedTags:r,tags:t,"data-test-subj":"upgradeRulesTagPopover"}))))};LN.displayName="UpgradePrebuiltRulesTableFiltersComponent";const BN=i.a.memo(LN);BN.displayName="UpgradePrebuiltRulesTableFilters";const qN=({name:e,ruleId:t})=>{const{actions:{openRulePreview:a}}=NN();return i.a.createElement(U.EuiLink,{onClick:()=>{a(t)}},e)},zN={field:"current_rule.name",name:Ig.mb,render:(e,t)=>i.a.createElement(qN,{name:e,ruleId:t.id}),sortable:!0,truncateText:!0,width:"60%",align:"left"},$N={field:"current_rule.tags",name:null,align:"center",render:e=>null==e||0===e.length?null:i.a.createElement(mg.a,{items:e,popoverTitle:Ig.pb,popoverButtonTitle:e.length.toString(),popoverButtonIcon:"tag",dataTestPrefix:"tags",renderItem:(e,t)=>i.a.createElement(U.EuiBadge,{color:"hollow",key:`${e}-${t}`,"data-test-subj":"tag"},e)}),width:"65px",truncateText:!0},VN={field:"current_rule.related_integrations",name:null,align:"center",render:e=>null==e||0===e.length?null:i.a.createElement(kg,{relatedIntegrations:e}),width:"143px",truncateText:!0},UN=(e,t,a)=>({field:"rule_id",name:"",render:n=>{const r=t.includes(n),s=r||a;return i.a.createElement(U.EuiButtonEmpty,{size:"s",disabled:s,onClick:()=>e(n),"data-test-subj":`upgradeSinglePrebuiltRuleButton-${n}`},r?i.a.createElement(U.EuiLoadingSpinner,{size:"s"}):Ig.Yc)},width:"10%",align:"center"}),HN=i.a.createElement(U.EuiEmptyPrompt,{title:i.a.createElement("h3",null,Ig.Vb),titleSize:"s",body:Ig.Wb,"data-test-subj":"noPrebuiltRulesAvailableForUpgrade"}),GN=i.a.memo((()=>{const e=NN(),{state:{rules:t,filteredRules:a,isFetched:r,isLoading:o,selectedRules:l,isRefetching:c,isUpgradingSecurityPackages:u},actions:{selectRules:d}}=e,p=(()=>{const[{canUserCRUD:e}]=Object(le.b)(),t=Object(bg.c)(e),[a]=Object(m.p)(s.vc),{state:{loadingRules:r,isRefetching:o,isUpgradingSecurityPackages:l},actions:{upgradeOneRule:c}}=NN(),u=o||l;return Object(n.useMemo)((()=>[zN,...a?[VN]:[],$N,{field:"current_rule.risk_score",name:Ig.lb,render:e=>i.a.createElement(U.EuiText,{"data-test-subj":"riskScore",size:"s"},e),sortable:!0,truncateText:!0,width:"85px"},{field:"current_rule.severity",name:Ig.nb,render:e=>i.a.createElement(Tg.a,{value:e}),sortable:({current_rule:{severity:e}})=>Object(bs.d)(e),truncateText:!0,width:"12%"},...t?[UN(c,r,u)]:[]]),[t,r,u,a,c])})(),b=r&&0===t.length,g=u||c;return i.a.createElement(i.a.Fragment,null,g&&i.a.createElement(U.EuiProgress,{"data-test-subj":"loadingRulesInfoProgress",size:"xs",position:"absolute",color:"accent"}),i.a.createElement(U.EuiSkeletonLoading,{isLoading:o,loadingContent:i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSkeletonTitle,null),i.a.createElement(U.EuiSkeletonText,null)),loadedContent:b?HN:i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiFlexGroup,{direction:"column"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(iA,null)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFlexGroup,{alignItems:"flexStart",gutterSize:"s",responsive:!1,wrap:!0},i.a.createElement(U.EuiFlexItem,{grow:!0},i.a.createElement(BN,null)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(PN,null))))),i.a.createElement(U.EuiInMemoryTable,{items:a,sorting:!0,pagination:{initialPageSize:__.a,pageSizeOptions:__.b},isSelectable:!0,selection:{selectable:()=>!0,onSelectionChange:d,initialSelected:l},itemId:"rule_id","data-test-subj":"rules-upgrades-table",columns:p}))}))}));GN.displayName="UpgradePrebuiltRulesTable";const QN=i.a.memo((()=>{!function(){const{state:e}=Object(_g.b)(),{services:{sessionStorage:t}}=Object(m.j)(),a=Object(vp.f)();Object(n.useEffect)((()=>{const n={},i={};if(e.filterOptions.filter.length>0&&(n.searchTerm=e.filterOptions.filter,i.searchTerm=e.filterOptions.filter),e.filterOptions.showElasticRules||e.filterOptions.showCustomRules){const t=e.filterOptions.showCustomRules?F_.a.Custom:F_.a.Prebuilt;n.source=t,i.source=t}e.filterOptions.tags.length>0&&(n.tags=e.filterOptions.tags,i.tags=e.filterOptions.tags),void 0!==e.filterOptions.enabled&&(n.enabled=e.filterOptions.enabled,i.enabled=e.filterOptions.enabled),e.sortingOptions.field!==A_.d.field&&(n.field=e.sortingOptions.field,i.field=e.sortingOptions.field),e.sortingOptions.order!==A_.d.order&&(n.order=e.sortingOptions.order,i.order=e.sortingOptions.order),e.pagination.page!==A_.b&&(n.page=e.pagination.page),e.pagination.perPage!==A_.c&&(n.perPage=e.pagination.perPage,i.perPage=e.pagination.perPage),void 0!==e.filterOptions.ruleExecutionStatus&&(n.ruleExecutionStatus=e.filterOptions.ruleExecutionStatus,i.ruleExecutionStatus=e.filterOptions.ruleExecutionStatus);const r=Object.keys(n).length>0,s=Object.keys(i).length>0;r||a({[Ji.a.rulesTable]:null}),s||t.remove(__.c),(r||s)&&(a({[Ji.a.rulesTable]:n}),t.set(__.c,i))}),[a,t,e])}();const[{tabName:e}]=Object(M_.a)();return e!==HF.updates?i.a.createElement(i.a.Fragment,null,i.a.createElement(PM,null),i.a.createElement(GF,null),i.a.createElement(U.EuiSpacer,null),i.a.createElement(nA,{selectedTab:e})):i.a.createElement(i.a.Fragment,null,i.a.createElement(DN,null,i.a.createElement(GF,null),i.a.createElement(U.EuiSpacer,null),i.a.createElement(GN,null)))}));QN.displayName="AllRules";const WN=()=>{const[e,t,a]=Object(Kg.a)(),[r,o,l]=Object(Kg.a)(),c=Object(m.j)().services,{navigateToApp:u}=c.application,d=Object(SM.b)(),p=Object(pA.b)(),b=Object(I_.b)(),g=Object(n.useCallback)((()=>{d(),b(),p()}),[d,b,p]),[{loading:f,isSignalIndexExists:y,isAuthenticated:v,hasEncryptionKey:x,canUserCRUD:j}]=Object(le.b)(),{loading:k,canWriteIndex:O,needsConfiguration:w}=Object(me.a)(),T=f||k;return Object(T_.h)(y,v,x,w)?(u(s.l,{deepLinkId:S.a.alerts,path:Object(Z.a)()}),null):i.a.createElement(i.a.Fragment,null,i.a.createElement(wi.a,null),i.a.createElement(Ti.a,null),i.a.createElement(vM,null),i.a.createElement(w_,{showFlyout:r,onClose:l}),i.a.createElement(pM.a,{checkBoxLabel:Ig.ac,closeModal:a,description:Ig.Tc,errorMessage:Ig.Jb,failedDetailed:Ig.Kb,importComplete:g,importData:C_.c,successMessage:Ig.Wc,showModal:e,submitBtnText:Ig.Mb,subtitle:Ig.Ob,title:Ig.Lb,showExceptionsCheckBox:!0,showCheckBox:!0,showActionConnectorsCheckBox:!0}),i.a.createElement(_g.a,null,i.a.createElement(h.a,null,i.a.createElement(Ci.a,{title:Ig.bc},i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"s",responsive:!1,wrap:!0},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(UM,{isDisabled:!j||T})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiToolTip,{position:"top",content:Ig.Zc},i.a.createElement(U.EuiButtonEmpty,{"data-test-subj":"open-value-lists-modal-button",iconType:"importAction",isDisabled:!O||!j||T,onClick:o},Ig.Nb))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButtonEmpty,{"data-test-subj":"rules-import-modal-button",iconType:"importAction",isDisabled:!Object(bg.c)(j)||T,onClick:t},Ig.Lb)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(ge.l,{"data-test-subj":"create-new-rule",fill:!0,iconType:"plusInCircle",isDisabled:!Object(bg.c)(j)||T,deepLinkId:S.a.rulesCreate},Ig.d)))),i.a.createElement(dM,{kibanaServices:c}),i.a.createElement(QN,{"data-test-subj":"all-rules"}))),i.a.createElement(E.a,{pageName:S.a.rules}))},KN=i.a.memo(WN),YN=G.a.div.withConfig({displayName:"RuleStatusIconStyled",componentId:"sc-19scuzy-0"})(["position:relative;svg{position:absolute;top:8px;left:9px;}"]),JN=({name:e,type:t})=>{const a=(()=>{const[e]=Object(m.p)(s.B);return e?Jb.euiDarkVars:Jb.euiLightVars})(),n="passive"===t?a.euiColorLightestShade:a.euiColorPrimary;return i.a.createElement(YN,null,i.a.createElement(U.EuiAvatar,{color:n,name:"valid"===t?"":e,size:"l","aria-label":e}),"valid"===t?i.a.createElement(U.EuiIcon,{type:"check",color:a.euiColorEmptyShade,size:"l"}):null)},XN=Object(n.memo)(JN),ZN=({name:e,title:t,type:a})=>i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"m",responsive:!1},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(XN,{name:e,type:a})),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiTitle,{size:"s",className:"euiAccordionForm__title"},i.a.createElement("h6",null,t)))),eP=i.a.memo(ZN);var tP=a(745),aP=a(746),nP=a(740),iP=a(528);const rP=$.i18n.translate("xpack.securitySolution.detectionEngine.createRule.pageTitle",{defaultMessage:"Create new rule"}),sP=$.i18n.translate("xpack.securitySolution.detectionEngine.createRule.backToRulesButton",{defaultMessage:"Rules"}),oP=($.i18n.translate("xpack.securitySolution.detectionEngine.createRule.cancelButtonLabel",{defaultMessage:"Cancel"}),$.i18n.translate("xpack.securitySolution.detectionEngine.createRule.editRuleButton",{defaultMessage:"Edit"})),lP=$.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRule.completeWithoutEnablingTitle",{defaultMessage:"Create rule without enabling it"}),cP=$.i18n.translate("xpack.securitySolution.detectionEngine.createRule.stepScheduleRule.completeWithEnablingTitle",{defaultMessage:"Create & enable rule"});var uP=a(1049),dP=a(62),pP=a.n(dP);$.i18n.translate("xpack.securitySolution.stepDefineRule.lastHour",{defaultMessage:"Last hour"}),$.i18n.translate("xpack.securitySolution.stepDefineRule.lastDay",{defaultMessage:"Last day"}),$.i18n.translate("xpack.securitySolution.stepDefineRule.lastWeek",{defaultMessage:"Last week"}),$.i18n.translate("xpack.securitySolution.stepDefineRule.lastMonth",{defaultMessage:"Last month"}),$.i18n.translate("xpack.securitySolution.stepDefineRule.previewQueryButton",{defaultMessage:"Preview results"}),$.i18n.translate("xpack.securitySolution.stepDefineRule.quickPreviewToggleButton",{defaultMessage:"Quick query preview"}),$.i18n.translate("xpack.securitySolution.stepDefineRule.advancedPreviewToggleButton",{defaultMessage:"Advanced query preview"});const mP=$.i18n.translate("xpack.securitySolution.stepDefineRule.previewTimeoutWarning",{defaultMessage:"Preview timed out after 60 seconds"}),bP=($.i18n.translate("xpack.securitySolution.stepDefineRule.previewQueryAriaLabel",{defaultMessage:"Query preview timeframe select"}),$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.rulePreviewError",{defaultMessage:"Failed to preview rule"})),gP=$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.queryPreviewLabel",{defaultMessage:"Select a preview timeframe"}),fP=$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.queryPreviewInvocationCountWarningTitle",{defaultMessage:"Rule preview timeframe might cause timeout"}),yP=$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.queryPreviewInvocationCountWarningMessage",{defaultMessage:"The timeframe and rule interval that you selected for previewing this rule might cause timeout or take long time to execute. Try to decrease the timeframe and/or increase the interval if preview has timed out (this won't affect the actual rule run)."}),hP=$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.queryGraphCountLabel",{defaultMessage:"Count"}),vP=$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.queryPreviewTitle",{defaultMessage:"Rule Preview"}),EP=$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.queryGraphPreviewNoiseWarning",{defaultMessage:"Noise warning: This rule may cause a lot of noise. Consider narrowing your query. This is based on a linear progression of 1 alert per hour."}),xP=$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.queryGraphPreviewError",{defaultMessage:"Error fetching preview"}),jP=$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.histogramDisclaimer",{defaultMessage:"Note: Alerts with multiple event.category values will be counted more than once."}),SP=$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.mlHistogramDisclaimer",{defaultMessage:"Note: Alerts with multiple host.name values will be counted more than once."}),kP=$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.queryPreviewSeeAllErrors",{defaultMessage:"See all errors"}),OP=$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.queryPreviewSeeAllWarnings",{defaultMessage:"See all warnings"}),wP=$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.actions",{defaultMessage:"Actions"}),TP=$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.viewDetailsAriaLabel",{defaultMessage:"View details"}),IP=({ariaRowindex:e,columnValues:t})=>$.i18n.translate("xpack.securitySolution.detectionEngine.queryPreview.viewDetailsForRowAriaLabel",{values:{ariaRowindex:e,columnValues:t},defaultMessage:"View details for the alert or event in row {ariaRowindex}, with columns {columnValues}"}),CP=$.i18n.translate("xpack.securitySolution.detectionEngine.createRule.rulePreviewTitle",{defaultMessage:"Rule preview"}),MP=$.i18n.translate("xpack.securitySolution.detectionEngine.createRule.rulePreviewDescription",{defaultMessage:"Rule preview reflects the current configuration of your rule settings and exceptions, click refresh icon to see the updated preview."});var _P=a(409);const FP=({timeframeOptions:e})=>{const t=1e3*(e.timeframeEnd.valueOf()/1e3-e.timeframeStart.valueOf()/1e3),{unit:a,value:n}=Object(EA.f)(e.interval),i=qr.a.duration(n,a),r=i.asMilliseconds(),s=Math.max(Math.ceil(t/r),1),o=e.interval,{unit:l,value:c}=Object(EA.f)(e.lookback);return i.add(c,l),{invocationCount:s,interval:o,from:`now-${i.asSeconds()}s`}},AP={previewId:void 0,logs:[],isAborted:!1};var DP=a(246),NP=a.n(DP);const PP=({ruleType:e,isQueryBarValid:t,isThreatQueryBarValid:a,index:n,dataViewId:i,dataSourceType:r,threatIndex:o,threatMapping:l,machineLearningJobId:c,queryBar:u,newTermsFields:d})=>{if(!t||r===LD.a.DataView&&!i||r===LD.a.IndexPatterns&&0===n.length)return!0;if("threat_match"===e){var p;if(!a||!o.length||!l)return!0;if(!(l.length&&null!==(p=l[0].entries)&&void 0!==p&&p.length&&l[0].entries[0].field&&l[0].entries[0].value))return!0}return"machine_learning"===e?0===c.length:"eql"===e||"query"===e||"threshold"===e?Object(it.isEmpty)(u.query.query)&&Object(it.isEmpty)(u.filters):"new_terms"===e&&(e=>0===e.length||e.length>s.Kb)(d)};var RP=a(959),LP=a(1047);const BP=e=>Object(LP.a)({...e,asPlainText:!0});var qP=a(422);const zP=G.a.div.attrs((({className:e})=>({className:`siemEventsTable__tdContent ${null!=e?e:""}`}))).withConfig({displayName:"EventsTdContent",componentId:"sc-15ofhu-0"})(["font-size:",";line-height:",";min-width:0;padding:",";text-align:",";width:",";button.euiButtonIcon{margin-left:",";}"],(({theme:e})=>e.eui.euiFontSizeXS),(({theme:e})=>e.eui.euiLineHeight),(({theme:e})=>e.eui.euiSizeXS),(({textAlign:e})=>e),(({width:e})=>null!=e?`${e}px`:"100%"),(({theme:e})=>`-${e.eui.euiSizeXS}`)),$P=G.a.div.withConfig({displayName:"ActionsContainer",componentId:"sc-15ofhu-1"})(["align-items:center;display:flex;"]),VP=({ariaRowindex:e,columnValues:t,onEventDetailsPanelOpened:a})=>i.a.createElement($P,null,i.a.createElement("div",{key:"expand-event"},i.a.createElement(zP,{textAlign:"center",width:qP.b+10},i.a.createElement(U.EuiToolTip,{"data-test-subj":"expand-event-tool-tip",content:TP},i.a.createElement(U.EuiButtonIcon,{"aria-label":IP({ariaRowindex:e,columnValues:t}),"data-test-subj":"expand-event",iconType:"expand",onClick:a,size:"s"})))));VP.displayName="PreviewActionsComponent";const UP=i.a.memo(VP),HP=Object(nt.v4)(),GP=Object(nt.v4)(),QP=(e="event.category",t)=>({title:"Rule preview",description:"",visualizationType:"lnsXY",state:{visualization:{title:"Empty XY chart",legend:{isVisible:!1,position:"right"},valueLabels:"hide",preferredSeriesType:"bar_stacked",layers:[{layerId:HP,accessors:["9c89324b-0c59-4403-9698-d989a09dc5a8"],position:"top",seriesType:"bar_stacked",showGridlines:!1,layerType:"data",xAccessor:"eba07b4d-766d-49d7-8435-d40367d3d055",splitAccessor:"e92c8920-0449-4564-81f4-8945517817a4"}],valuesInLegend:!0,yTitle:"",axisTitlesVisibilitySettings:{x:!1,yLeft:!1,yRight:!0}},query:{query:"",language:"kuery"},filters:[{meta:{disabled:!1,negate:!1,alias:null,index:GP,key:"kibana.alert.rule.uuid",field:"kibana.alert.rule.uuid",params:{query:null==t?void 0:t.ruleId},type:"phrase"},query:{match_phrase:{"kibana.alert.rule.uuid":null==t?void 0:t.ruleId}}}],datasourceStates:{formBased:{layers:{[HP]:{columns:{"9c89324b-0c59-4403-9698-d989a09dc5a8":{label:"Count of records",dataType:"number",operationType:"count",isBucketed:!1,scale:"ratio",sourceField:"___records___",params:{emptyAsNull:!0}},"eba07b4d-766d-49d7-8435-d40367d3d055":{label:"@timestamp",dataType:"date",operationType:"date_histogram",sourceField:"@timestamp",isBucketed:!0,scale:"interval",params:{interval:"auto",includeEmptyRows:!0,dropPartials:!1}},"e92c8920-0449-4564-81f4-8945517817a4":{label:`Top 10 values of ${e}`,dataType:"string",operationType:"terms",scale:"ordinal",sourceField:e,isBucketed:!0,params:{size:10,orderBy:{type:"column",columnId:"9c89324b-0c59-4403-9698-d989a09dc5a8"},orderDirection:"desc",otherBucket:!0,missingBucket:!1,parentFormat:{id:"terms"},include:[],exclude:[],includeIsRegex:!1,excludeIsRegex:!1}}},columnOrder:["e92c8920-0449-4564-81f4-8945517817a4","eba07b4d-766d-49d7-8435-d40367d3d055","9c89324b-0c59-4403-9698-d989a09dc5a8"],sampling:1,incompleteColumns:{}}}},textBased:{layers:{}}},internalReferences:[{type:"index-pattern",id:GP,name:`indexpattern-datasource-layer-${HP}`}],adHocDataViews:{[GP]:{id:GP,title:`.preview.alerts-security.alerts-${null==t?void 0:t.spaceId}`,timeFieldName:"@timestamp",sourceFilters:[],fieldFormats:{},runtimeFieldMap:{},fieldAttrs:{},allowNoIndex:!1,name:`.preview.alerts-security.alerts-${null==t?void 0:t.spaceId}`}}},references:[]}),WP=G()(U.EuiLoadingChart).withConfig({displayName:"LoadingChart",componentId:"sc-1klu8jb-0"})(["display:block;margin:0 auto;"]),KP=G.a.div.withConfig({displayName:"FullScreenContainer",componentId:"sc-1klu8jb-1"})(["height:",";flex:1 1 auto;display:flex;width:100%;"],(({$isFullScreen:e})=>e?"100%":void 0)),YP=({previewId:e,addNoiseWarning:t,spaceId:a,ruleType:r,indexPattern:o,timeframeOptions:l})=>{const{uiSettings:c}=Object(m.j)().services,{setQuery:u,isInitializing:d}=Object(J.a)(),p=Object(n.useMemo)((()=>l.timeframeStart.toISOString()),[l]),b=Object(n.useMemo)((()=>l.timeframeEnd.toISOString()),[l]),y=Object(n.useMemo)((()=>l.timeframeEnd.clone().add("1","s").toISOString()),[l]),h=Object(n.useMemo)((()=>"eql"===r),[r]),v=Object(n.useMemo)((()=>"machine_learning"===r),[r]),E=Object(K.a)("alertsPreviewChartEmbeddablesEnabled"),x=Object(n.useMemo)((()=>({from:p,to:b})),[p,b]),j=Object(n.useMemo)((()=>({ruleId:e,spaceId:a})),[e,a]),[S,{data:k,inspect:O,totalCount:w,refetch:I}]=(({previewId:e,startDate:t,endDate:a,spaceId:i,ruleType:r,indexPattern:o,skip:l})=>{const{uiSettings:c}=Object(m.j)().services,[u,d]=Object(kr.i)({config:Object(Ms.getEsQueryConfig)(c),indexPattern:o,queries:[{query:`kibana.alert.rule.uuid:${e}`,language:"kuery"}],filters:[]}),p=Object(n.useMemo)((()=>"machine_learning"===r?"host.name":"event.category"),[r]),b=Object(n.useMemo)((()=>({endDate:a,errorMessage:xP,filterQuery:u,histogramType:Vo.l.preview,indexNames:[`${s.P}-${i}`],stackByField:p,startDate:t,includeMissingData:!1,skip:l||null!=d})),[a,u,i,p,t,l,d]);return Object(RP.a)(b)})({previewId:e,startDate:p,endDate:b,spaceId:a,indexPattern:o,ruleType:r,skip:E}),C=Object(fp.b)(),{browserFields:M,runtimeMappings:_}=Object(g.d)(f.SourcererScopeName.detections),{globalFullScreen:F}=Object(fe.a)(),A=NP()(e),D=`previewHistogram-${e}`;Object(n.useEffect)((()=>{var a;A!==e&&w>0&&(a=l,w/Math.max((a.timeframeEnd.valueOf()-a.timeframeStart.valueOf())/36e5,1)>1&&t())}),[w,t,A,e,l]),Object(n.useEffect)((()=>{S||d||u({id:D,inspect:O,loading:S,refetch:I})}),[u,O,S,d,I,e,E,D]);const N=Object(n.useMemo)((()=>((e,t,a=!1)=>({series:{xScaleType:Da.ScaleType.Time,yScaleType:Da.ScaleType.Linear,stackAccessors:["g"]},axis:{xTickFormatter:Object(Pp.a)([e,t]),yTickFormatter:e=>e.toLocaleString(),tickSize:8},yAxisTitle:hP,settings:{legendPosition:Da.Position.Right,showLegend:a,showLegendExtra:a,theme:{scales:{barsPadding:.08},chartMargins:{left:0,right:0,top:0,bottom:0},chartPaddings:{left:0,right:0,top:0,bottom:0}}},customHeight:200}))(b,p,!h)),[b,p,h]),P=Object(n.useMemo)((()=>[{key:"hits",value:k}]),[k]),L=Object(Ms.getEsQueryConfig)(c),B=Object(n.useMemo)((()=>[{...Object(bt.buildEsQuery)(o,[{query:`kibana.alert.rule.uuid:${e}`,language:"kuery"}],[],{nestedIgnoreUnmapped:!0,...L,dateFormatTZ:void 0}),meta:{alias:null,negate:!1,disabled:!1,type:"phrase",key:"kibana.alert.rule.uuid",params:{query:e}}}]),[L,o,e]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(Ws.a,{height:300,"data-test-subj":"preview-histogram-panel"},i.a.createElement(U.EuiFlexGroup,{gutterSize:"none",direction:"column"},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(pn.a,{id:D,title:vP,titleSize:"xs",showInspectButton:!E})),i.a.createElement(U.EuiFlexItem,{grow:1},S?i.a.createElement(WP,{size:"l","data-test-subj":"preview-histogram-loading"}):E?i.a.createElement(ci.a,{applyGlobalQueriesAndFilters:!1,extraOptions:j,getLensAttributes:QP,height:150,id:`${D}-embeddable`,inspectTitle:vP,scopeId:f.SourcererScopeName.detections,stackByField:"machine_learning"===r?"host.name":"event.category",timerange:x,withActions:!1}):i.a.createElement(Qp.a,{configs:N,barChart:P,"data-test-subj":"preview-histogram-bar-chart"})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,null),i.a.createElement(U.EuiText,{size:"s",color:"subdued"},i.a.createElement("p",null,v?SP:jP)))))),i.a.createElement(U.EuiSpacer,null),i.a.createElement(KP,{$isFullScreen:F},i.a.createElement(lp,{pageFilters:B,defaultModel:Object(ve.g)(C),end:y,tableId:R.e.rulePreview,leadingControlColumns:(1.5,[{headerCellRender:()=>i.a.createElement(i.a.Fragment,null,wP),id:"default-timeline-control-column",rowCellRender:UP,width:Object(qP.c)(1.5)}]),renderCellValue:BP,rowRenderers:mp.b,start:p,sourcererScope:f.SourcererScopeName.detections,indexNames:[`${s.P}-${a}`],bulkActions:!1})),i.a.createElement(T.a,{browserFields:M,isFlyoutView:!0,runtimeMappings:_,scopeId:R.e.rulePreview,isReadOnly:!0}))},JP=i.a.memo(YP);JP.displayName="PreviewHistogram";const XP=({message:e})=>i.a.createElement(U.EuiCallOut,{color:"warning",iconType:"warning","data-test-subj":"preview-abort"},i.a.createElement(U.EuiText,null,i.a.createElement("p",null,e))),ZP=(e,t,a,n)=>t.length?[{startedAt:e,logs:t,duration:a},...n]:n,eR=({logs:e,hasNoiseWarning:t,isAborted:a})=>{const r=Object(n.useMemo)((()=>e.reduce((({errors:e,warnings:t},a)=>({errors:ZP(a.startedAt,a.errors,a.duration,e),warnings:ZP(a.startedAt,a.warnings,a.duration,t)})),{errors:[],warnings:[]})),[e]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,{size:"s"}),null!=t?t:i.a.createElement(XP,{message:EP}),i.a.createElement(aR,{logs:r.errors,isError:!0}),i.a.createElement(aR,{logs:r.warnings},a?i.a.createElement(XP,{message:mP}):null))},tR=i.a.memo(eR);tR.displayName="PreviewLogs";const aR=({logs:e,isError:t,children:a})=>{const n=e[0];if(!a&&!n)return null;const r=a?e:e.slice(1),s=null!=a?a:i.a.createElement(nR,{logs:n.logs,startedAt:n.startedAt,isError:t,duration:n.duration});return i.a.createElement(i.a.Fragment,null,s,r.length>0?i.a.createElement(U.EuiAccordion,{id:t?"previewErrorAccordion":"previewWarningAccordion",buttonContent:t?kP:OP},r.map(((e,a)=>i.a.createElement(nR,{key:`accordion-log-${a}`,logs:e.logs,startedAt:e.startedAt,duration:e.duration,isError:t})))):null,i.a.createElement(U.EuiSpacer,{size:"m"}))},nR=({logs:e,startedAt:t,isError:a,duration:r})=>e.length>0?i.a.createElement(i.a.Fragment,null,e.map(((e,s)=>i.a.createElement(n.Fragment,{key:s},i.a.createElement(U.EuiCallOut,{color:a?"danger":"warning",iconType:"warning","data-test-subj":a?"preview-error":"preview-warning",title:`${t?`[${t}] `:""}[${r}ms]`},i.a.createElement(U.EuiText,null,i.a.createElement("p",null,e))),i.a.createElement(U.EuiSpacer,{size:"s"}))))):null,iR=G()(U.EuiLoadingChart).withConfig({displayName:"LoadingChart",componentId:"sc-gvlal3-0"})(["display:block;margin:0 auto;"]),rR=()=>i.a.createElement(Ws.a,{height:300,"data-test-subj":"preview-histogram-panel"},i.a.createElement(U.EuiFlexGroup,{gutterSize:"none",direction:"column"},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(pn.a,{title:vP,titleSize:"xs",subtitle:"loading"})),i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(iR,{size:"l","data-test-subj":"preview-histogram-loading"})),i.a.createElement(U.EuiSpacer,null))),sR=[{start:"now/d",end:"now",label:"Today"},{start:"now/w",end:"now",label:"This week"},{start:"now-15m",end:"now",label:"Last 15 minutes"},{start:"now-30m",end:"now",label:"Last 30 minutes"},{start:"now-1h",end:"now",label:"Last 1 hour"},{start:"now-24h",end:"now",label:"Last 24 hours"},{start:"now-7d",end:"now",label:"Last 7 days"},{start:"now-30d",end:"now",label:"Last 30 days"}],oR=(e,t)=>({start:pP.a.parse(e)||qr()().subtract(1,"hour"),end:pP.a.parse(t)||qr()()}),lR=({isDisabled:e,defineRuleData:t,aboutRuleData:a,scheduleRuleData:r,exceptionsList:s})=>{const{indexPattern:o,ruleType:l}=t,{spaces:c}=Object(m.j)().services,[u,d]=Object(n.useState)("");Object(n.useEffect)((()=>{c&&c.getActiveSpace().then((e=>d(e.id)))}),[c]);const[p,b]=Object(n.useState)("now-1h"),[g,f]=Object(n.useState)("now"),[y,h]=Object(n.useState)(qr()().subtract(1,"hour")),[v,E]=Object(n.useState)(qr()()),[x,j]=Object(n.useState)(!1);Object(n.useEffect)((()=>{const{start:e,end:t}=oR(p,g);h(e),E(t)}),[p,g]);const[S,k]=Object(n.useState)({timeframeOptions:{timeframeStart:y,timeframeEnd:v,interval:"5m",lookback:"1m"}}),{invocationCount:O}=FP({timeframeOptions:{timeframeStart:y,timeframeEnd:v,interval:r.interval,lookback:r.from}}),w=O>200,{addNoiseWarning:T,createPreview:I,isPreviewRequestInProgress:C,previewId:M,logs:_,hasNoiseWarning:F,isAborted:A}=(({defineRuleData:e,aboutRuleData:t,scheduleRuleData:a,exceptionsList:i,timeframeOptions:r})=>{var s,o;const[l,c]=Object(n.useState)(!1),{isLoading:u,response:d,rule:p,setRule:m}=(({timeframeOptions:e})=>{const[t,a]=Object(n.useState)(null),[i,r]=Object(n.useState)(AP),[s,o]=Object(n.useState)(!1),{addError:l}=Object(rs.a)(),{invocationCount:c,interval:u,from:d}=FP({timeframeOptions:e}),p=Object(n.useMemo)((()=>e.timeframeEnd.toISOString()),[e]);return Object(n.useEffect)((()=>{t||(r(AP),o(!1))}),[t]),Object(n.useEffect)((()=>{let e=!0;const a=new AbortController;return r(AP),(async()=>{if(null!=t){try{o(!0);const n=await Object(ms.v)({rule:{...Object(_P.b)({...t,interval:u,from:d}),invocationCount:c,timeframeEnd:p},signal:a.signal});e&&r(n)}catch(t){e&&l(t,{title:bP})}e&&o(!1)}})(),()=>{e=!1,a.abort()}}),[t,l,c,d,u,p]),{isLoading:s,response:i,rule:t,setRule:a}})({timeframeOptions:r}),[b,g]=Object(n.useState)(null!==(s=d.logs)&&void 0!==s?s:[]),[f,y]=Object(n.useState)(!!d.isAborted),[h,v]=Object(n.useState)(!1);Object(n.useEffect)((()=>{var e;g(null!==(e=d.logs)&&void 0!==e?e:[]),y(!!d.isAborted)}),[d]);const E=Object(n.useCallback)((()=>{v(!0)}),[v]),x=Object(n.useCallback)((()=>{m(null),g([]),y(!1),c(!1),v(!1)}),[m]);return Object(n.useEffect)((()=>{x()}),[x,e,t,a]),Object(n.useEffect)((()=>{e&&t&&a&&l&&null===p&&m(Object(EA.c)({defineRuleData:e,aboutRuleData:t,scheduleRuleData:a,exceptionsList:i}))}),[l,p,m,e,t,a,i]),{hasNoiseWarning:h,addNoiseWarning:E,createPreview:()=>c(!0),clearPreview:x,isPreviewRequestInProgress:u,previewId:null!==(o=d.previewId)&&void 0!==o?o:"",logs:b,isAborted:f}})({defineRuleData:S.defineRuleData,aboutRuleData:S.aboutRuleData,scheduleRuleData:S.scheduleRuleData,exceptionsList:s,timeframeOptions:S.timeframeOptions}),{startTransaction:D}=Object($d.b)(),[N,P]=Object(n.useState)(!1);Object(n.useEffect)((()=>{N&&(I(),P(!1))}),[N,I]),Object(n.useEffect)((()=>{const{start:e,end:t}=oR(p,g);h(e),E(t)}),[g,p]);const R=Object(n.useCallback)((({start:e,end:t,isInvalid:a})=>{j(a),a||(b(e),f(t))}),[]),L=Object(n.useCallback)((()=>{D({name:Bg.e.PREVIEW});const{start:e,end:n}=oR(p,g);h(e),E(n),k({defineRuleData:t,aboutRuleData:a,scheduleRuleData:r,timeframeOptions:{timeframeStart:e,timeframeEnd:n,interval:r.interval,lookback:r.from}}),P(!0)}),[a,t,g,r,p,D]),B=Object(n.useMemo)((()=>!(y.isSame(S.timeframeOptions.timeframeStart)&&v.isSame(S.timeframeOptions.timeframeEnd)&&Object(it.isEqual)(t,S.defineRuleData)&&Object(it.isEqual)(a,S.aboutRuleData)&&Object(it.isEqual)(r,S.scheduleRuleData))),[a,t,S.aboutRuleData,S.defineRuleData,S.scheduleRuleData,S.timeframeOptions.timeframeEnd,S.timeframeOptions.timeframeStart,r,v,y]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiTitle,{size:"m"},i.a.createElement("h2",null,CP)),i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement(U.EuiText,{color:"subdued"},i.a.createElement("p",null,MP)),i.a.createElement(U.EuiSpacer,{size:"s"}),w&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiCallOut,{color:"warning",title:fP,"data-test-subj":"previewInvocationCountWarning"},yP),i.a.createElement(U.EuiSpacer,null)),i.a.createElement(U.EuiText,{size:"xs","data-test-subj":"rule-preview"},i.a.createElement("h4",null,gP)),i.a.createElement(U.EuiSpacer,{size:"xs"}),i.a.createElement(U.EuiFlexGroup,{alignItems:"center",responsive:!1,gutterSize:"s"},i.a.createElement(U.EuiSuperDatePicker,{start:p,end:g,isDisabled:e,onTimeChange:R,showUpdateButton:!1,commonlyUsedRanges:sR,onRefresh:L,"data-test-subj":"preview-time-frame"}),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiSuperUpdateButton,{isDisabled:x||e,iconType:B?"kqlFunction":"refresh",onClick:L,color:B?"success":"primary",fill:!0,"data-test-subj":"previewSubmitButton"}))),i.a.createElement(U.EuiSpacer,{size:"l"}),C&&i.a.createElement(rR,null),!C&&M&&u&&i.a.createElement(JP,{ruleType:l,previewId:M,addNoiseWarning:T,spaceId:u,indexPattern:o,timeframeOptions:S.timeframeOptions}),i.a.createElement(tR,{logs:_,hasNoiseWarning:F,isAborted:A}))},cR=i.a.memo(lR),uR=i.a.memo((({onClick:e,isDisabled:t,dataTestSubj:a="nextStep-continue"})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiHorizontalRule,{margin:"m"}),i.a.createElement(U.EuiFlexGroup,{alignItems:"center",justifyContent:"flexEnd",gutterSize:"xs",responsive:!1},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{fill:!0,onClick:e,isDisabled:t,"data-test-subj":a},Ig.qb))))));uR.displayName="NextStep";const dR=$.i18n.translate("xpack.securitySolution.detectionEngine.createRule.rulePreviewTitle",{defaultMessage:"Rule preview"}),pR=({backOptions:e,isLoading:t,title:a,togglePanel:n,isRulePreviewVisible:r,setIsRulePreviewVisible:s})=>i.a.createElement(Ci.a,{backOptions:e,isLoading:t,title:a},i.a.createElement(U.EuiButton,{"data-test-subj":"preview-container",isSelected:r,fill:r,iconType:"visBarVerticalStacked",onClick:()=>{null==n||n("preview",{direction:"left"}),s((e=>!e))}},dR)),mR=Object(n.memo)(pR),bR=G()(U.EuiPanel).withConfig({displayName:"MyEuiPanel",componentId:"sc-1d21fri-0"})(["position:relative;z-index:",";> .euiAccordion > .euiAccordion__triggerWrapper{.euiAccordion__button{cursor:default !important;&:hover{text-decoration:none !important;}}.euiAccordion__iconWrapper{display:none;}}.euiAccordion__childWrapper{transform:none;}"],(e=>e.zindex));bR.displayName="MyEuiPanel";const gR=()=>{const[{loading:e,isSignalIndexExists:t,isAuthenticated:a,hasEncryptionKey:r,canUserCRUD:o}]=Object(le.b)(),{loading:l,needsConfiguration:c}=Object(me.a)(),{addSuccess:u}=Object(rs.a)(),{navigateToApp:d}=Object(m.j)().services.application,{application:p,data:{dataViews:b}}=Object(m.j)().services,g=e||l,[f,y]=Object(n.useState)(LD.c.defineRule),v=e=>uP.d[uP.d.indexOf(e)+1],x=Object(n.useRef)(null),j=Object(n.useRef)(null),k=Object(n.useRef)(null),O=Object(n.useRef)(null),[w]=Object(m.p)(s.H),[T]=Object(m.p)(s.T),I=Object(n.useMemo)((()=>({...uP.f,index:w,threatIndex:T})),[w,T]),C=Object(n.useMemo)((()=>p.getUrlForApp(`${s.l}`,{absolute:!0})),[p]),M=Object(n.useMemo)((()=>({...iP.c,kibanaSiemAppUrl:C})),[C]),{defineStepForm:_,defineStepData:F,aboutStepForm:A,aboutStepData:D,scheduleStepForm:N,scheduleStepData:P,actionsStepForm:R,actionsStepData:L,eqlOptionsSelected:B,setEqlOptionsSelected:q}=Object(RD.a)({defineStepDefault:I,aboutStepDefault:uP.e,scheduleStepDefault:uP.b,actionsStepDefault:M}),z=Object(n.useMemo)((()=>Object(Yg.f)(F.ruleType)),[F.ruleType]),[V,H]=Object(n.useState)({[LD.c.defineRule]:!1,[LD.c.aboutRule]:!1,[LD.c.scheduleRule]:!1,[LD.c.ruleActions]:!1}),{mutateAsync:G,isLoading:Q}=Object(C_.e)(),W=F.ruleType,K=Object(n.useMemo)((()=>Object(T_.d)(W)),[W]),[Y,J]=Object(n.useState)({}),[X,ee]=Object(n.useState)(!0),te=Object(n.useRef)(),[ae,ne]=Object(n.useState)(),[ie,re]=Object(n.useState)(!1),[se,oe]=Object(n.useState)(!1),ce=PP({ruleType:W,isQueryBarValid:ie,isThreatQueryBarValid:se,index:F.index,dataViewId:F.dataViewId,dataSourceType:F.dataSourceType,threatIndex:F.threatIndex,threatMapping:F.threatMapping,machineLearningJobId:F.machineLearningJobId,queryBar:F.queryBar,newTermsFields:F.newTermsFields});Object(n.useEffect)((()=>{ae!==W&&(A.updateFieldValues({threatIndicatorPath:z?s.I:void 0}),N.updateFieldValues(z?uP.c:uP.b),ne(W))}),[A,N,z,ae,W]);const{starting:ue,startMlJobs:de}=Object(eA.a)();Object(n.useEffect)((()=>{(async()=>{const e=(await b.getIdsWithTitle()).reduce(((e,t)=>({...e,[t.id]:t})),{});J(e)})()}),[b]);const{indexPattern:pe,isIndexPatternLoading:be,browserFields:ge}=Object(RD.b)({dataSourceType:F.dataSourceType,index:F.index,dataViewId:F.dataViewId}),fe=Object(Z.e)(),ye=Object(n.useMemo)((()=>({path:fe,text:sP,pageId:S.a.rules})),[fe]),he=Object(n.useCallback)(((e,t)=>H((a=>({...a,[e]:t})))),[]),ve=Object(n.useCallback)((e=>he(LD.c.defineRule,e)),[he]),Ee=Object(n.useCallback)((e=>he(LD.c.aboutRule,e)),[he]),xe=Object(n.useCallback)((e=>he(LD.c.scheduleRule,e)),[he]),je=Object(n.useCallback)((e=>he(LD.c.ruleActions,e)),[he]),Se=Object(n.useCallback)((e=>{uP.d.indexOf(e)>uP.d.indexOf(f)&&!V[e]&&ke(e),y(e)}),[f,V]),ke=e=>{var t;if(e===LD.c.defineRule)null===(t=x.current)||void 0===t||t.onToggle();else if(e===LD.c.aboutRule){var a;null===(a=j.current)||void 0===a||a.onToggle()}else if(e===LD.c.scheduleRule){var n;null===(n=k.current)||void 0===n||n.onToggle()}else if(e===LD.c.ruleActions){var i;null===(i=O.current)||void 0===i||i.onToggle()}},Oe=Object(n.useCallback)((async e=>{switch(e){case LD.c.defineRule:return _.validate();case LD.c.aboutRule:return A.validate();case LD.c.scheduleRule:return N.validate();case LD.c.ruleActions:return R.validate()}}),[A,R,_,N]),we=Object(n.useCallback)((async e=>{await Oe(f)&&Se(e)}),[f,Oe,Se]),Te=Object(n.useCallback)((async(e,t)=>{if(await Oe(e)){const e={..._.getFormData(),eqlOptions:B},n=A.getFormData(),i=N.getFormData(),r=R.getFormData(),o=async()=>{Object(Yg.c)(W)&&t&&await de(e.machineLearningJobId)},[,l]=await Promise.all([o(),G(Object(EA.d)(e,n,i,{...r,enabled:t}))]);u((a=l.name,$.i18n.translate("xpack.securitySolution.detectionEngine.rules.create.successfullyCreatedRuleTitle",{values:{ruleName:a},defaultMessage:"{ruleName} was created"}))),d(s.l,{deepLinkId:S.a.rules,path:Object(Z.d)(l.id)})}var a}),[Oe,_,B,A,N,R,G,u,d,W,de]),Ie=f===LD.c.defineRule?"active":_.isValid?"valid":"passive",Ce=Object(n.useMemo)((()=>i.a.createElement(eP,{name:"1",title:Ig.sb,type:Ie})),[Ie]),Me=Object(n.useCallback)((async()=>{if(await _.validate()){const e=v(LD.c.defineRule);e&&Se(e)}}),[_,Se]),_e=f===LD.c.aboutRule?"active":A.isValid?"valid":"passive",Fe=Object(n.useMemo)((()=>i.a.createElement(eP,{name:"2",title:Ig.b,type:_e})),[_e]),Ae=Object(n.useCallback)((async()=>{if(await A.validate()){const e=v(LD.c.aboutRule);e&&Se(e)}}),[A,Se]),De=f===LD.c.scheduleRule?"active":N.isValid?"valid":"passive",Ne=Object(n.useMemo)((()=>i.a.createElement(eP,{name:"3",title:Ig.Nc,type:De})),[De]),Pe=Object(n.useCallback)((async()=>{if(await N.validate()){const e=v(LD.c.scheduleRule);e&&Se(e)}}),[N,Se]),Re=f===LD.c.ruleActions?"active":R.isValid?"valid":"passive",Le=Object(n.useMemo)((()=>i.a.createElement(eP,{name:"4",title:Ig.Gc,type:Re})),[Re]),Be=Object(n.useCallback)((()=>{Te(LD.c.ruleActions,!1)}),[Te]),qe=Object(n.useCallback)((()=>{Te(LD.c.ruleActions,!0)}),[Te]),ze=Object(n.useMemo)((()=>f!==LD.c.defineRule&&i.a.createElement(tP.c,{addPadding:!0,defaultValues:F,descriptionColumns:"singleSplit",indexPattern:pe})),[f,F,pe]),$e=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiHorizontalRule,{margin:"m"}),i.a.createElement("div",{style:{display:f===LD.c.defineRule?void 0:"none"}},i.a.createElement(tP.b,{isLoading:Q||g,kibanaDataViews:Y,indicesConfig:w,threatIndicesConfig:T,form:_,optionsSelected:B,setOptionsSelected:q,indexPattern:pe,isIndexPatternLoading:be,browserFields:ge,isQueryBarValid:ie,setIsQueryBarValid:re,setIsThreatQueryBarValid:oe,ruleType:F.ruleType,index:F.index,threatIndex:F.threatIndex,groupByFields:F.groupByFields,dataSourceType:F.dataSourceType,shouldLoadQueryDynamically:F.shouldLoadQueryDynamically,queryBarTitle:F.queryBar.title,queryBarSavedId:F.queryBar.saved_id}),i.a.createElement(uR,{dataTestSubj:"define-continue",onClick:Me,isDisabled:Q})),ze)),[f,ge,Y,Me,F.dataSourceType,F.groupByFields,F.index,F.queryBar.saved_id,F.queryBar.title,F.ruleType,F.shouldLoadQueryDynamically,F.threatIndex,_,B,pe,w,Q,be,ie,g,ze,q,T]),Ve=Object(n.useMemo)((()=>_.isValid&&i.a.createElement(U.EuiButtonEmpty,{"data-test-subj":"edit-define-rule",iconType:"pencil",size:"xs",onClick:()=>we(LD.c.defineRule)},oP)),[_.isValid,we]),Ue=Object(n.useMemo)((()=>f!==LD.c.aboutRule&&i.a.createElement(aP.b,{addPadding:!0,defaultValues:D,descriptionColumns:"singleSplit"})),[D,f]),He=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiHorizontalRule,{margin:"m"}),i.a.createElement("div",{style:{display:f===LD.c.aboutRule?void 0:"none"}},i.a.createElement(aP.a,{ruleType:F.ruleType,machineLearningJobId:F.machineLearningJobId,index:F.index,dataViewId:F.dataViewId,timestampOverride:D.timestampOverride,isLoading:Q||g,isActive:f===LD.c.aboutRule,form:A}),i.a.createElement(uR,{dataTestSubj:"about-continue",onClick:Ae,isDisabled:Q})),Ue)),[Ae,D.timestampOverride,A,f,F.dataViewId,F.index,F.machineLearningJobId,F.ruleType,Q,g,Ue]),Ge=Object(n.useMemo)((()=>A.isValid&&i.a.createElement(U.EuiButtonEmpty,{"data-test-subj":"edit-about-rule",iconType:"pencil",size:"xs",onClick:()=>we(LD.c.aboutRule)},oP)),[A.isValid,we]),Qe=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiHorizontalRule,{margin:"m"}),i.a.createElement("div",{style:{display:f===LD.c.scheduleRule?void 0:"none"}},i.a.createElement(nP.a,{isLoading:Q||g,form:N}),i.a.createElement(uR,{dataTestSubj:"schedule-continue",onClick:Pe,isDisabled:Q})),i.a.createElement("div",{style:{display:f===LD.c.scheduleRule?"none":void 0}},i.a.createElement(nP.b,{addPadding:!0,descriptionColumns:"singleSplit",defaultValues:P})))),[f,Q,g,Pe,P,N]),We=Object(n.useMemo)((()=>N.isValid&&i.a.createElement(U.EuiButtonEmpty,{iconType:"pencil",size:"xs",onClick:()=>we(LD.c.scheduleRule)},oP)),[we,N.isValid]),Ke=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiHorizontalRule,{margin:"m"}),i.a.createElement("div",{style:{display:f===LD.c.ruleActions?void 0:"none"}},i.a.createElement(iP.a,{isLoading:Q||g||ue,actionMessageParams:K,summaryActionMessageParams:K,ruleType:W,form:R}),i.a.createElement(U.EuiHorizontalRule,{margin:"m"}),i.a.createElement(U.EuiFlexGroup,{alignItems:"center",justifyContent:"flexEnd",gutterSize:"xs",responsive:!1},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{fill:!1,isDisabled:Q,isLoading:Q,onClick:Be,"data-test-subj":"create-enabled-false"},lP)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{fill:!0,isDisabled:Q,isLoading:Q,onClick:qe,"data-test-subj":"create-enable"},cP)))),i.a.createElement("div",{style:{display:f===LD.c.ruleActions?"none":void 0}},i.a.createElement(iP.b,{addPadding:!0,defaultValues:L})))),[K,L,R,f,Q,ue,g,W,Be,qe]),Ye=Object(n.useMemo)((()=>R.isValid&&i.a.createElement(U.EuiButtonEmpty,{iconType:"pencil",size:"xs",onClick:()=>we(LD.c.ruleActions)},oP)),[R.isValid,we]),Je=Object(n.useCallback)((()=>ee((e=>!e))),[]);return Object(T_.h)(t,a,r,c)?(d(s.l,{deepLinkId:S.a.alerts,path:Object(Z.a)()}),null):Object(bg.c)(o)?i.a.createElement(i.a.Fragment,null,i.a.createElement(h.a,null,i.a.createElement(U.EuiResizableContainer,null,((e,t,{togglePanel:a})=>(te.current=()=>null==a?void 0:a("preview",{direction:"left"}),i.a.createElement(i.a.Fragment,null,i.a.createElement(e,{initialSize:70,minSize:"40%",mode:"main"},i.a.createElement(U.EuiFlexGroup,{direction:"row",justifyContent:"spaceAround"},i.a.createElement(T_.a,null,i.a.createElement(mR,{backOptions:ye,isLoading:Q||g,title:rP,isRulePreviewVisible:X,setIsRulePreviewVisible:ee,togglePanel:a}),i.a.createElement(bR,{zindex:4,hasBorder:!0},i.a.createElement(yR,{initialIsOpen:!0,id:LD.c.defineRule,buttonContent:Ce,paddingSize:"xs",ref:x,onToggle:ve,extraAction:Ve},$e)),i.a.createElement(U.EuiSpacer,{size:"l"}),i.a.createElement(bR,{hasBorder:!0,zindex:3},i.a.createElement(yR,{initialIsOpen:!1,id:LD.c.aboutRule,buttonContent:Fe,paddingSize:"xs",ref:j,onToggle:Ee,extraAction:Ge},He)),i.a.createElement(U.EuiSpacer,{size:"l"}),i.a.createElement(bR,{hasBorder:!0,zindex:2},i.a.createElement(yR,{initialIsOpen:!1,id:LD.c.scheduleRule,buttonContent:Ne,paddingSize:"xs",ref:k,onToggle:xe,extraAction:We},Qe)),i.a.createElement(U.EuiSpacer,{size:"l"}),i.a.createElement(bR,{hasBorder:!0,zindex:1},i.a.createElement(yR,{initialIsOpen:!1,id:LD.c.ruleActions,buttonContent:Le,paddingSize:"xs",ref:O,onToggle:je,extraAction:Ye},Ke))))),i.a.createElement(t,null),i.a.createElement(e,{id:"preview",mode:"collapsible",initialSize:30,minSize:"20%",onToggleCollapsed:Je},i.a.createElement(cR,{isDisabled:ce&&f===LD.c.defineRule,defineRuleData:F,aboutRuleData:D,scheduleRuleData:P}))))))),i.a.createElement(E.a,{pageName:S.a.rulesCreate})):(d(s.l,{deepLinkId:S.a.rules,path:Object(Z.e)()}),null)},fR=i.a.memo(gR),yR=Object(n.memo)(U.EuiAccordion);var hR=a(1108);const vR=$.i18n.translate("xpack.securitySolution.detectionEngine.editRule.pageTitle",{defaultMessage:"Edit rule settings"}),ER=$.i18n.translate("xpack.securitySolution.detectionEngine.editRule.cancelTitle",{defaultMessage:"Cancel"}),xR=$.i18n.translate("xpack.securitySolution.detectionEngine.editRule.saveChangeTitle",{defaultMessage:"Save changes"}),jR=$.i18n.translate("xpack.securitySolution.detectionEngine.editRule.errorMsgDescription",{defaultMessage:"Sorry"}),SR=$.i18n.translate("xpack.securitySolution.detectionEngine.editRule.backToDescription",{defaultMessage:"Back to"}),kR=({rule:e})=>{const[,t]=Object(Vs.f)(),[{loading:a,isSignalIndexExists:r,isAuthenticated:o,hasEncryptionKey:l,canUserCRUD:c}]=Object(le.b)(),{loading:u,needsConfiguration:d}=Object(me.a)(),{data:p,application:b}=Object(m.j)().services,{navigateToApp:g}=b,{detailName:f}=Object(B.useParams)(),[y,v]=Object(n.useState)(e.immutable?LD.c.ruleActions:LD.c.defineRule),{mutateAsync:x,isLoading:j}=Object(C_.g)(),[k,O]=Object(n.useState)({}),[w,T]=Object(n.useState)(!0),I=Object(n.useRef)(),[C,M]=Object(n.useState)(!1),[_,F]=Object(n.useState)(!1);Object(n.useEffect)((()=>{(async()=>{const e=(await p.dataViews.getIdsWithTitle()).reduce(((e,t)=>({...e,[t.id]:t})),{});O(e)})()}),[p.dataViews]);const A=Object(n.useMemo)((()=>{var t;return{path:Object(Z.d)(null!=f?f:""),text:`${SR} ${null!==(t=null==e?void 0:e.name)&&void 0!==t?t:""}`,pageId:S.a.rules,dataTestSubj:"ruleEditBackToRuleDetails"}}),[null==e?void 0:e.name,f]),[D]=Object(m.p)(s.H),[N]=Object(m.p)(s.T),{aboutRuleData:P,defineRuleData:R,scheduleRuleData:L,ruleActionsData:q}=Object(T_.g)({rule:e}),{defineStepForm:z,defineStepData:V,aboutStepForm:H,aboutStepData:G,scheduleStepForm:Q,scheduleStepData:W,actionsStepForm:K,actionsStepData:Y,eqlOptionsSelected:J,setEqlOptionsSelected:X}=Object(RD.a)({defineStepDefault:R,aboutStepDefault:P,scheduleStepDefault:L,actionsStepDefault:q}),ee=PP({ruleType:V.ruleType,isQueryBarValid:C,isThreatQueryBarValid:_,index:V.index,dataViewId:V.dataViewId,dataSourceType:V.dataSourceType,threatIndex:V.threatIndex,threatMapping:V.threatMapping,machineLearningJobId:V.machineLearningJobId,queryBar:V.queryBar,newTermsFields:V.newTermsFields}),te=a||u,{isSavedQueryLoading:ae,savedQuery:ne}=Object(DD.a)({savedQueryId:null==e?void 0:e.saved_id,ruleType:null==e?void 0:e.type}),ie=Object(n.useCallback)((e=>{var t,a,n,i;switch(e){case LD.c.defineRule:return null===(t=z.isValid)||void 0===t||t;case LD.c.aboutRule:return null===(a=H.isValid)||void 0===a||a;case LD.c.scheduleRule:return null===(n=Q.isValid)||void 0===n||n;case LD.c.ruleActions:return null===(i=K.isValid)||void 0===i||i;default:return!0}}),[H.isValid,K.isValid,z.isValid,Q.isValid]),re=uP.d.filter((e=>!ie(e))),se=Object(n.useMemo)((()=>Object(T_.d)(null==e?void 0:e.type)),[null==e?void 0:e.type]),{indexPattern:oe,isIndexPatternLoading:ce,browserFields:ue}=Object(RD.b)({dataSourceType:V.dataSourceType,index:V.index,dataViewId:V.dataViewId}),de=Object(n.useMemo)((()=>[{"data-test-subj":"edit-rule-define-tab",id:LD.c.defineRule,name:Ig.tb,disabled:null==e?void 0:e.immutable,content:i.a.createElement("div",{style:{display:y===LD.c.defineRule?void 0:"none"}},i.a.createElement(U.EuiSpacer,null),i.a.createElement(hR.a,{loading:te||ae,title:Ig.tb},!ae&&i.a.createElement(tP.b,{isLoading:te||j||ae,isUpdateView:!0,kibanaDataViews:k,indicesConfig:D,threatIndicesConfig:N,defaultSavedQuery:ne,form:z,optionsSelected:J,setOptionsSelected:X,key:"defineStep",indexPattern:oe,isIndexPatternLoading:ce,browserFields:ue,isQueryBarValid:C,setIsQueryBarValid:M,setIsThreatQueryBarValid:F,ruleType:V.ruleType,index:V.index,threatIndex:V.threatIndex,groupByFields:V.groupByFields,dataSourceType:V.dataSourceType,shouldLoadQueryDynamically:V.shouldLoadQueryDynamically,queryBarTitle:V.queryBar.title,queryBarSavedId:V.queryBar.saved_id}),i.a.createElement(U.EuiSpacer,null)))},{"data-test-subj":"edit-rule-about-tab",id:LD.c.aboutRule,name:Ig.a,disabled:null==e?void 0:e.immutable,content:i.a.createElement("div",{style:{display:y===LD.c.aboutRule?void 0:"none"}},i.a.createElement(U.EuiSpacer,null),i.a.createElement(hR.a,{loading:te,title:Ig.a},null!=G&&null!=V&&i.a.createElement(aP.a,{isLoading:j,isUpdateView:!0,isActive:y===LD.c.aboutRule,ruleType:V.ruleType,machineLearningJobId:V.machineLearningJobId,index:V.index,dataViewId:V.dataViewId,timestampOverride:G.timestampOverride,form:H,key:"aboutStep"}),i.a.createElement(U.EuiSpacer,null)))},{"data-test-subj":"edit-rule-schedule-tab",id:LD.c.scheduleRule,name:Ig.Mc,disabled:null==e?void 0:e.immutable,content:i.a.createElement("div",{style:{display:y===LD.c.scheduleRule?void 0:"none"}},i.a.createElement(U.EuiSpacer,null),i.a.createElement(hR.a,{loading:te,title:Ig.Mc},null!=W&&i.a.createElement(nP.a,{isLoading:j,isUpdateView:!0,form:Q,key:"scheduleStep"}),i.a.createElement(U.EuiSpacer,null)))},{"data-test-subj":"edit-rule-actions-tab",id:LD.c.ruleActions,name:Ig.c,content:i.a.createElement("div",{style:{display:y===LD.c.ruleActions?void 0:"none"}},i.a.createElement(U.EuiSpacer,null),i.a.createElement(hR.a,{loading:te},null!=Y&&i.a.createElement(iP.a,{ruleId:null==e?void 0:e.id,isLoading:j,isUpdateView:!0,actionMessageParams:se,summaryActionMessageParams:se,ruleType:null==e?void 0:e.type,form:K,key:"actionsStep"}),i.a.createElement(U.EuiSpacer,null)))}]),[null==e?void 0:e.immutable,null==e?void 0:e.id,null==e?void 0:e.type,y,te,ae,j,k,D,N,ne,z,J,X,oe,ce,ue,C,V,G,H,W,Q,Y,se,K]),{startTransaction:pe}=Object($d.b)(),be=Object(n.useCallback)((async()=>{const a=await z.validate(),n=await H.validate(),i=await Q.validate(),r=await K.validate();var o,l;a&&n&&i&&r&&(pe({name:Bg.e.SAVE}),await x({...Object(EA.d)(V,G,W,Y,null==e?void 0:e.exceptions_list),...f?{id:f}:{},...null!=e?{max_signals:e.max_signals}:{}}),Object(Vs.d)((l=null!==(o=null==e?void 0:e.name)&&void 0!==o?o:"",$.i18n.translate("xpack.securitySolution.detectionEngine.rules.update.successfullySavedRuleTitle",{values:{ruleName:l},defaultMessage:"{ruleName} was saved"})),t),g(s.l,{deepLinkId:S.a.rules,path:Object(Z.d)(null!=f?f:"")}))}),[z,H,Q,K,pe,x,V,G,W,Y,e,f,t,g]),ge=Object(n.useCallback)((async e=>{const t=e.id;v(t)}),[]),fe=Object(n.useCallback)((e=>{e.preventDefault(),g(s.l,{deepLinkId:S.a.rules,path:Object(Z.d)(null!=f?f:"")})}),[g,f]);return Object(T_.h)(r,o,l,d)?(g(s.l,{deepLinkId:S.a.alerts,path:Object(Z.a)()}),null):Object(bg.c)(c)?i.a.createElement(i.a.Fragment,null,i.a.createElement(h.a,null,i.a.createElement(U.EuiResizableContainer,null,((t,a,{togglePanel:n})=>(I.current=()=>null==n?void 0:n("preview",{direction:"left"}),i.a.createElement(i.a.Fragment,null,i.a.createElement(t,{initialSize:70,minSize:"40%",mode:"main"},i.a.createElement(U.EuiFlexGroup,{direction:"row",justifyContent:"spaceAround"},i.a.createElement(T_.a,null,i.a.createElement(mR,{backOptions:A,isLoading:j,title:vR,isRulePreviewVisible:w,setIsRulePreviewVisible:T,togglePanel:n}),re.length>0&&i.a.createElement(U.EuiCallOut,{title:jR,color:"danger",iconType:"warning"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.detectionEngine.rule.editRule.errorMsgDescription",defaultMessage:"You have an invalid input in {countError, plural, one {this tab} other {these tabs}}: {tabHasError}",values:{countError:re.length,tabHasError:re.map((e=>e===LD.c.aboutRule?Ig.a:e===LD.c.defineRule?Ig.tb:e===LD.c.scheduleRule?Ig.Mc:e===LD.c.ruleActions?Ig.Gc:e)).join(", ")}})),i.a.createElement(U.EuiTabs,null,de.map(((e,t)=>i.a.createElement(U.EuiTab,{key:t,onClick:()=>ge(e),isSelected:e.id===y,disabled:e.disabled,"data-test-subj":e["data-test-subj"]},e.name)))),de.map((e=>e.content)),i.a.createElement(U.EuiSpacer,null),i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"s",justifyContent:"flexEnd",responsive:!1},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{iconType:"cross",onClick:fe},ER)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{"data-test-subj":"ruleEditSubmitButton",fill:!0,onClick:be,iconType:"save",isLoading:j,isDisabled:te},xR)))))),i.a.createElement(a,null),i.a.createElement(t,{id:"preview",mode:"collapsible",initialSize:30,minSize:"20%",onToggleCollapsed:()=>T((e=>!e))},i.a.createElement(cR,{isDisabled:ee,defineRuleData:V,aboutRuleData:G,scheduleRuleData:W,exceptionsList:null==e?void 0:e.exceptions_list}))))))),i.a.createElement(E.a,{pageName:S.a.rules,state:{ruleName:null==e?void 0:e.name}})):(g(s.l,{deepLinkId:S.a.rules,path:Object(Z.d)(null!=f?f:"")}),null)},OR=()=>{const{detailName:e}=Object(B.useParams)(),{data:t}=Object(C_.f)(e,!0);return null!=t?i.a.createElement(kR,{rule:t}):i.a.createElement(i.a.Fragment,null)},wR=Object(n.memo)(OR),TR=$.i18n.translate("xpack.securitySolution.detectionEngine.rules.addRules.pageTitle",{defaultMessage:"Add Elastic Rules"}),IR=()=>{const e=Object(ge.o)(),{onClick:t}=e({deepLinkId:qM.SecurityPageName.rules});return i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"s",responsive:!1,direction:"column",wrap:!0},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiEmptyPrompt,{title:i.a.createElement("h3",null,Ig.Tb),titleSize:"s",body:Ig.Ub,"data-test-subj":"noPrebuiltRulesAvailableForInstall"})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{fill:!0,iconType:"arrowLeft",color:"primary",onClick:t,"data-test-subj":"addRulesGoBackToRulesTableBtn"},Ig.Ib)))},CR=i.a.memo(IR);var MR=a(857);const _R=["POST","ALL_RULES",cA.b],FR=["POST","SPECIFIC_RULES",cA.b],AR=e=>{const t=[],{summary:{succeeded:a,skipped:n,failed:i}}=e;return a>0&&t.push((e=>$.i18n.translate("xpack.securitySolution.detectionEngine.prebuiltRules.toast.installRuleSuccess",{defaultMessage:"{succeeded, plural, one {# rule} other {# rules}} installed successfully.",values:{succeeded:e}}))(a)),n>0&&t.push((e=>$.i18n.translate("xpack.securitySolution.detectionEngine.prebuiltRules.toast.installRuleSkipped",{defaultMessage:"{skipped, plural, one {# rule was} other {# rules were}} skipped during installation.",values:{skipped:e}}))(n)),i>0&&t.push((e=>$.i18n.translate("xpack.securitySolution.detectionEngine.prebuiltRules.toast.installRuleFailed",{defaultMessage:"{failed, plural, one {# rule} other {# rules}} failed to install.",values:{failed:e}}))(i)),t.join(" ")},DR=$.i18n.translate("xpack.securitySolution.detectionEngine.rules.addRules.installAllButtonTitle",{defaultMessage:"Install all"}),NR=$.i18n.translate("xpack.securitySolution.detectionEngine.rules.addRules.searchBarPlaceholder",{defaultMessage:"Search by rule name"}),PR=$.i18n.translate("xpack.securitySolution.detectionEngine.ruleDetails.installButtonLabel",{defaultMessage:"Install"}),RR=Object(n.createContext)(null),LR=({children:e})=>{const[t,a]=Object(n.useState)([]),[r,s]=Object(n.useState)([]),[o,l]=Object(n.useState)({filter:"",tags:[]}),{data:c}=Object(zM.a)(),u=Object(tA.a)(),{data:{rules:d,stats:{tags:p}}={rules:[],stats:{tags:[]}},refetch:m,dataUpdatedAt:b,isFetched:g,isLoading:f,isRefetching:y}=(e=>{const{addError:t}=Object(rs.a)();return Object(MR.a)({onError:e=>t(e,{title:$M.b}),...e})})({refetchInterval:6e4,keepPreviousData:!0,enabled:Boolean(!u&&c&&c.num_prebuilt_rules_total_in_package>0)}),{mutateAsync:h}=(()=>{const{addError:e,addSuccess:t}=Object(rs.a)();return(e=>{const t=Object(SM.b)(),a=Object(uA.b)(),n=Object(I_.b)(),i=Object(MR.b)(),r=Object(zM.b)(),s=Object(pA.b)();return Object(Hu.useMutation)((()=>Object(ms.r)()),{...e,mutationKey:_R,onSettled:(...o)=>{t(),a(),n(),i(),r(),s(),null!=e&&e.onSettled&&e.onSettled(...o)}})})({onError:t=>{e(t,{title:gA})},onSuccess:e=>{t(AR(e))}})})(),{mutateAsync:v}=(()=>{const{addError:e,addSuccess:t}=Object(rs.a)();return(e=>{const t=Object(SM.b)(),a=Object(uA.b)(),n=Object(zM.b)(),i=Object(I_.b)(),r=Object(MR.b)(),s=Object(zM.b)(),o=Object(pA.b)();return Object(Hu.useMutation)((e=>Object(ms.s)(e)),{...e,mutationKey:FR,onSettled:(...l)=>{n(),t(),a(),i(),r(),s(),o(),null!=e&&e.onSettled&&e.onSettled(...l)}})})({onError:t=>{e(t,{title:gA})},onSuccess:e=>{t(AR(e))}})})(),E=(({rules:e,filterOptions:t})=>Object(n.useMemo)((()=>{const{filter:a,tags:n}=t;return e.filter((e=>!(a&&!e.name.toLowerCase().includes(a.toLowerCase()))&&(!(n&&n.length>0)||n.every((t=>e.tags.includes(t))))))}),[t,e]))({filterOptions:o,rules:d}),{openRulePreview:x,closeRulePreview:j,previewedRule:S}=hA(E),k=Boolean((null==S?void 0:S.rule_id)&&t.includes(S.rule_id)||y||u),O=Object(n.useCallback)((async e=>{const t=d.find((t=>t.rule_id===e));Object(lA.a)(t,`Rule with id ${e} not found`),a((t=>[...t,e]));try{await v([{rule_id:e,version:t.version}])}finally{a((t=>t.filter((t=>t!==e))))}}),[v,d]),w=Object(n.useCallback)((async()=>{const e=r.map((e=>({rule_id:e.rule_id,version:e.version})));a((t=>[...t,...e.map((e=>e.rule_id))]));try{await v(e)}finally{a((t=>t.filter((t=>!e.some((e=>e.rule_id===t)))))),s([])}}),[v,r]),T=Object(n.useCallback)((async()=>{a((e=>[...e,...d.map((e=>e.rule_id))]));try{await h()}finally{a([]),s([])}}),[h,d]),I=Object(n.useMemo)((()=>({setFilterOptions:l,installAllRules:T,installOneRule:O,installSelectedRules:w,reFetchRules:m,selectRules:s,openRulePreview:x})),[T,O,w,m,x]),C=Object(n.useMemo)((()=>({state:{rules:d,filteredRules:E,filterOptions:o,tags:p,isFetched:g,isLoading:f,loadingRules:t,isRefetching:y,isUpgradingSecurityPackages:u,selectedRules:r,lastUpdated:b},actions:I})),[d,E,o,p,g,f,t,y,u,r,b,I]);return i.a.createElement(RR.Provider,{value:C},i.a.createElement(i.a.Fragment,null,e,S&&i.a.createElement(kN,{rule:S,actionButtonLabel:PR,isActionButtonDisabled:k,onActionButtonClick:O,closeFlyout:j})))},BR=()=>{const e=Object(n.useContext)(RR);return Object(lA.a)(e,"useAddPrebuiltRulesTableContext should be used inside AddPrebuiltRulesTableContextProvider"),e},qR=G()(U.EuiFlexGroup).withConfig({displayName:"FilterWrapper",componentId:"sc-1188j36-0"})(["margin-bottom:",";"],(({theme:e})=>e.eui.euiSizeM)),zR=()=>{const{state:{filterOptions:e,tags:t},actions:{setFilterOptions:a}}=BR(),{tags:r}=e,s=Object(n.useCallback)((e=>{a((t=>({...t,filter:e.trim()})))}),[a]),o=Object(n.useCallback)((e=>{Object(x.isEqual)(e,r)||a((t=>({...t,tags:e})))}),[r,a]);return i.a.createElement(qR,{gutterSize:"m",justifyContent:"flexEnd",wrap:!0},i.a.createElement(BF,{initialValue:e.filter,onSearch:s,placeholder:NR}),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFilterGroup,null,i.a.createElement(_F,{onSelectedTagsChanged:o,selectedTags:r,tags:t,"data-test-subj":"allRulesTagPopover"}))))};zR.displayName="AddPrebuiltRulesTableFiltersComponent";const $R=i.a.memo(zR);$R.displayName="AddPrebuiltRulesTableFilters";const VR=({name:e,ruleId:t})=>{const{actions:{openRulePreview:a}}=BR();return i.a.createElement(U.EuiLink,{onClick:()=>{a(t)}},e)},UR={field:"name",name:Ig.mb,render:(e,t)=>i.a.createElement(VR,{name:e,ruleId:t.id}),sortable:!0,truncateText:!0,width:"40%",align:"left"},HR={field:"tags",name:null,align:"center",render:e=>null==e||0===e.length?null:i.a.createElement(mg.a,{items:e,popoverTitle:Ig.pb,popoverButtonTitle:e.length.toString(),popoverButtonIcon:"tag",dataTestPrefix:"tags",renderItem:(e,t)=>i.a.createElement(U.EuiBadge,{color:"hollow",key:`${e}-${t}`,"data-test-subj":"tag"},e)}),width:"65px",truncateText:!0},GR={field:"related_integrations",name:null,align:"center",render:e=>null==e||0===e.length?null:i.a.createElement(kg,{relatedIntegrations:e}),width:"143px",truncateText:!0},QR=(e,t,a)=>({field:"rule_id",name:"",render:n=>{const r=t.includes(n),s=r||a;return i.a.createElement(U.EuiButtonEmpty,{size:"s",disabled:s,onClick:()=>e(n),"data-test-subj":`installSinglePrebuiltRuleButton-${n}`},r?i.a.createElement(U.EuiLoadingSpinner,{size:"s"}):Ig.Pb)},width:"10%",align:"center"}),WR=i.a.memo((()=>{const e=BR(),{state:{rules:t,filteredRules:a,isFetched:r,isLoading:o,isRefetching:l,selectedRules:c,isUpgradingSecurityPackages:u},actions:{selectRules:d}}=e,p=(()=>{const[{canUserCRUD:e}]=Object(le.b)(),t=Object(bg.c)(e),[a]=Object(m.p)(s.vc),{state:{loadingRules:r,isRefetching:o,isUpgradingSecurityPackages:l},actions:{installOneRule:c}}=BR(),u=o||l;return Object(n.useMemo)((()=>[UR,...a?[GR]:[],HR,{field:"risk_score",name:Ig.lb,render:e=>i.a.createElement(U.EuiText,{"data-test-subj":"riskScore",size:"s"},e),sortable:!0,truncateText:!0,width:"85px"},{field:"severity",name:Ig.nb,render:e=>i.a.createElement(Tg.a,{value:e}),sortable:({severity:e})=>Object(bs.d)(e),truncateText:!0,width:"12%"},...t?[QR(c,r,u)]:[]]),[t,c,r,u,a])})(),b=r&&0===t.length,g=u||l;return i.a.createElement(i.a.Fragment,null,g&&i.a.createElement(U.EuiProgress,{"data-test-subj":"loadingRulesInfoProgress",size:"xs",position:"absolute",color:"accent"}),i.a.createElement(U.EuiSkeletonLoading,{isLoading:o,loadingContent:i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSkeletonTitle,null),i.a.createElement(U.EuiSkeletonText,null)),loadedContent:b?i.a.createElement(CR,null):i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiFlexGroup,{direction:"column"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(iA,null)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement($R,null))),i.a.createElement(U.EuiInMemoryTable,{items:a,sorting:!0,pagination:{initialPageSize:__.a,pageSizeOptions:__.b},isSelectable:!0,selection:{selectable:()=>!0,onSelectionChange:d,initialSelected:c},itemId:"rule_id","data-test-subj":"add-prebuilt-rules-table",columns:p}))}))}));WR.displayName="AddPrebuiltRulesTable";const KR=()=>{var e;const{state:{rules:t,selectedRules:a,loadingRules:n,isRefetching:r,isUpgradingSecurityPackages:s},actions:{installAllRules:o,installSelectedRules:l}}=BR(),[{loading:c,canUserCRUD:u}]=Object(le.b)(),d=u&&!c,p=t.length>0,m=null!==(e=a.length)&&void 0!==e?e:0,b=m>0,g=n.length>0,f=g||r||s;return i.a.createElement(U.EuiFlexGroup,{alignItems:"center",gutterSize:"s",responsive:!1,wrap:!0},b?i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{onClick:l,disabled:!d||f,"data-test-subj":"installSelectedRulesButton"},(e=>$.i18n.translate("xpack.securitySolution.detectionEngine.rules.addRules.installSelectedRules",{defaultMessage:"Install {numberOfSelectedRules} selected rule(s)",values:{numberOfSelectedRules:e}}))(m),g?i.a.createElement(U.EuiLoadingSpinner,{size:"s"}):void 0)):null,i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{fill:!0,iconType:"plusInCircle","data-test-subj":"installAllRulesButton",onClick:o,disabled:!d||!p||f},DR,g?i.a.createElement(U.EuiLoadingSpinner,{size:"s"}):void 0)))},YR=()=>{const{navigateToApp:e}=Object(m.j)().services.application,[{isSignalIndexExists:t,isAuthenticated:a,hasEncryptionKey:n}]=Object(le.b)(),{needsConfiguration:r}=Object(me.a)();return Object(T_.h)(t,a,n,r)?(e(qM.APP_UI_ID,{deepLinkId:S.a.alerts,path:Object(p.d)()}),null):i.a.createElement(i.a.Fragment,null,i.a.createElement(wi.a,null),i.a.createElement(Ti.a,null),i.a.createElement(LR,null,i.a.createElement(h.a,null,i.a.createElement(Ci.a,{title:TR},i.a.createElement(KR,null)),i.a.createElement(WR,null))),i.a.createElement(E.a,{pageName:S.a.rulesAdd}))},JR=i.a.memo(YR);JR.displayName="AddRulesPage";var XR=a(1051);const ZR=$.i18n.translate("xpack.securitySolution.rules.landing.pageTitle",{defaultMessage:"Rules"});var eL=a(373);const tL="setShowExpandedCells",aL="setRuleActivityFilter",nL="setRuleSourceFilter",iL="setRuleSearchFilter",rL=Object(n.createContext)(null),sL={showExpandedCells:!1,filter:{activity:[eL.b.Enabled],source:[eL.c.Prebuilt,eL.c.Custom]},data:void 0,isLoading:!1},oL=({children:e})=>{const[t,a]=Object(n.useReducer)(((e,t)=>{switch(t.type){case tL:{const{value:a}=t;return{...e,showExpandedCells:a}}case aL:{const{value:a}=t,n={...e.filter,activity:0!==a.length?a:void 0};return{...e,filter:n}}case nL:{const{value:a}=t,n={...e.filter,source:0!==a.length?a:void 0};return{...e,filter:n}}case iL:{const{value:a}=t,n={...e.filter,search_term:0!==a.length?a:void 0};return{...e,filter:n}}default:return e}}),sL),{data:r,isLoading:s,refetch:o}=Object(pA.a)(t.filter),{executeBulkAction:l}=Object(zg.b)();Object(n.useEffect)((()=>{o()}),[o,t.filter]);const c=Object(n.useCallback)((e=>{a({type:tL,value:e})}),[a]),u=Object(n.useCallback)((e=>{a({type:aL,value:e})}),[a]),d=Object(n.useCallback)((e=>{a({type:nL,value:e})}),[a]),p=Object(n.useCallback)((e=>{a({type:iL,value:e})}),[a]),m=Object(n.useCallback)((async e=>{await l({type:eL.a.enable,ids:e})}),[l]),b=Object(n.useMemo)((()=>({refetch:o,setShowExpandedCells:c,setRuleActivityFilter:u,setRuleSourceFilter:d,setRuleSearchFilter:p,enableAllDisabled:m})),[o,u,p,d,c,m]),g=Object(n.useMemo)((()=>({state:{...t,isLoading:s,data:r},actions:b})),[b,r,s,t]);return i.a.createElement(rL.Provider,{value:g},e)},lL=()=>{const e=Object(n.useContext)(rL);return Object(lA.a)(e,"useCoverageOverviewDashboardContext should be used inside CoverageOverviewDashboardContextProvider"),e},cL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.pageTitle",{defaultMessage:"MITRE ATT&CK® coverage"}),uL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.collapseCellsButton",{defaultMessage:"Collapse cells"}),dL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.expandCellsButton",{defaultMessage:"Expand cells"}),pL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.disabledRulesMetadataLabel",{defaultMessage:"Disabled Rules:"}),mL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.enabledRulesMetadataLabel",{defaultMessage:"Enabled Rules:"}),bL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.subtechniques",{defaultMessage:"Sub-techniques"}),gL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.enableAllDisabledButtonLabel",{defaultMessage:"Enable all disabled"}),fL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.disabledRulesListLabel",{defaultMessage:"Disabled rules"}),yL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.enabledRulesListLabel",{defaultMessage:"Enabled rules"}),hL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.legendTitle",{defaultMessage:"Legend"}),vL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.legendSubtitle",{defaultMessage:"(count will include all rules selected)"}),EL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.legendRulesLabel",{defaultMessage:"rules"}),xL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.enabledRuleActivity",{defaultMessage:"Enabled rules"}),jL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.disabledRuleActivity",{defaultMessage:"Disabled rules"}),SL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.elasticRuleSource",{defaultMessage:"Elastic rules"}),kL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.customRuleSource",{defaultMessage:"Custom rules"}),OL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.ruleActivityFilterLabel",{defaultMessage:"Installed rule status"}),wL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.ruleSourceFilterLabel",{defaultMessage:"Installed rule type"}),TL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.searchBarPlaceholder",{defaultMessage:'Search for the tactic, technique (e.g.,"defense evasion" or "TA0005") or rule name'}),IL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.filterPopoverTitle",{defaultMessage:"Select to view on framework"}),CL=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.filterPopoverClearAll",{defaultMessage:"Clear all"}),ML=$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.dashboardInformation",{defaultMessage:"Your current coverage of MITRE ATT&CK® tactics and techniques, based on installed rules. Click a cell to view and enable a technique's rules. Rules must be mapped to the MITRE ATT&CK® framework to be displayed."}),_L=300,FL=[{threshold:10,color:"#00BFB3"},{threshold:7,color:"#00BFB399"},{threshold:3,color:"#00BFB34D"},{threshold:1,color:"#00BFB326"}],AL=[{label:eL.b.Enabled},{label:eL.b.Disabled}],DL={[eL.b.Enabled]:xL,[eL.b.Disabled]:jL},NL=[{label:eL.c.Prebuilt},{label:eL.c.Custom}],PL={[eL.c.Prebuilt]:SL,[eL.c.Custom]:kL},RL=e=>e.filter((e=>"on"===e.checked)).map((e=>e.label)),LL=(e,t)=>e.map((e=>t.includes(e.label)?{...e,checked:"on"}:e)),BL=vA.css`
  white-space: nowrap;
  overflow: hidden;
  text-overflow: ellipsis;
`,qL=({disabledRules:e,enabledRules:t})=>i.a.createElement(U.EuiFlexGroup,{"data-test-subj":"coverageOverviewPanelRuleStats",direction:"column",gutterSize:"xs"},i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiText,{className:Object(vA.cx)(BL),size:"xs"},pL)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiNotificationBadge,{"data-test-subj":"ruleStatsDisabledRulesCount",color:"subdued"},e))),i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiText,{className:Object(vA.cx)(BL),size:"xs"},mL)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiNotificationBadge,{"data-test-subj":"ruleStatsEnabledRulesCount",color:"subdued"},t)))),zL=({tactic:e})=>{const t=Object(n.useMemo)((()=>(e=>e.techniques.filter((e=>0!==e.enabledRules.length)).length)(e)),[e]),a=Object(n.useMemo)((()=>{return i.a.createElement(U.EuiText,{size:"xs",color:"success"},i.a.createElement("h5",null,(a=t,n=e.techniques.length,$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.coveredMitreTechniques",{values:{enabledTechniques:a,totalTechniques:n},defaultMessage:"{enabledTechniques}/{totalTechniques} techniques"}))));var a,n}),[e.techniques,t]);return i.a.createElement(U.EuiPanel,{"data-test-subj":"coverageOverviewTacticPanel",hasShadow:!1,hasBorder:!0,paddingSize:"s",className:vA.css`
        background: ${Jb.euiThemeVars.euiColorLightestShade};
        border-color: ${Jb.euiThemeVars.euiColorMediumShade};
        width: ${160}px;
      `},i.a.createElement(U.EuiToolTip,{content:e.name},i.a.createElement(U.EuiText,{className:vA.css`
            h4 {
              white-space: nowrap;
              overflow: hidden;
              text-overflow: ellipsis;
            }
          `,"aria-label":e.name,title:e.name,grow:!1,size:"xs"},i.a.createElement("h4",null,e.name))),i.a.createElement(U.EuiProgress,{color:"success",value:t,label:a,max:e.techniques.length}),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(qL,{enabledRules:e.enabledRules.length,disabledRules:e.disabledRules.length}))},$L=Object(n.memo)(zL),VL=({listTitle:e,listLength:t})=>i.a.createElement(U.EuiFlexGroup,{alignItems:"center",justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiText,{size:"s"},i.a.createElement("h4",null,e))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiNotificationBadge,{size:"m",color:"subdued"},t))),UL=({technique:e,coveredSubtechniques:t,setIsPopoverOpen:a,isPopoverOpen:r,isExpanded:s})=>{const{state:{filter:o}}=lL(),l=((e,t)=>{if(!t)return e.enabledRules.length+e.disabledRules.length;let a=0;return t.includes(eL.b.Enabled)&&(a+=e.enabledRules.length),t.includes(eL.b.Disabled)&&(a+=e.disabledRules.length),a})(e,o.activity),c=Object(n.useMemo)((()=>(e=>{for(const{threshold:t,color:a}of FL)if(e>=t)return a})(l)),[l]),u=Object(n.useCallback)((()=>a(!r)),[r,a]),d=Object(n.useMemo)((()=>i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,{className:vA.css`
            white-space: nowrap;
          `,grow:!1},i.a.createElement(U.EuiText,{size:"xs"},bL)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiText,{size:"xs"},`${t}/${e.subtechniques.length}`)))),[e.subtechniques,t]);return i.a.createElement(U.EuiPanel,{"data-test-subj":"coverageOverviewTechniquePanel",className:vA.css`
        background: ${c};
        width: ${160}px;
      `,hasShadow:!1,hasBorder:!c,paddingSize:"s",onClick:u,element:"div"},i.a.createElement(GL,{direction:"column",justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiText,{size:"xs"},i.a.createElement("h4",null,e.name)),d),s&&i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(qL,{enabledRules:e.enabledRules.length,disabledRules:e.disabledRules.length}))))},HL=Object(n.memo)(UL);var GL=G()(U.EuiFlexGroup).withConfig({displayName:"_StyledEuiFlexGroup",componentId:"sc-1c69mn4-0"})({height:"100%"});const QL=({technique:e})=>{const[{loading:t,canUserCRUD:a}]=Object(le.b)(),[r,s]=Object(n.useState)(!1),[o,l]=Object(n.useState)(!1),c=Object(n.useCallback)((()=>s(!1)),[]),u=Object(n.useMemo)((()=>(e=>e.subtechniques.filter((e=>0!==e.enabledRules.length)).length)(e)),[e]),d=Object(n.useMemo)((()=>!a||0===e.disabledRules.length),[a,e.disabledRules.length]),p=Object(n.useMemo)((()=>o||t),[o,t]),{state:{showExpandedCells:m},actions:{enableAllDisabled:b}}=lL(),g=Object(n.useCallback)((async()=>{l(!0);const t=e.disabledRules.map((e=>e.id));await b(t),l(!1),c()}),[c,b,e.disabledRules]),f=i.a.createElement(HL,{setIsPopoverOpen:s,isPopoverOpen:r,technique:e,isExpanded:m,coveredSubtechniques:u}),y=Object(n.useMemo)((()=>{return i.a.createElement(U.EuiText,{color:"success",size:"s"},i.a.createElement("h4",null,(t=u,a=e.subtechniques.length,$.i18n.translate("xpack.securitySolution.coverageOverviewDashboard.coveredMitreSubtechniques",{values:{enabledSubtechniques:t,totalSubtechniques:a},defaultMessage:"Sub-techniques {enabledSubtechniques}/{totalSubtechniques}"}))));var t,a}),[u,e.subtechniques.length]),h=Object(n.useMemo)((()=>e.enabledRules.map((e=>({label:i.a.createElement(tf,{name:e.name,id:e.id}),color:"primary"})))),[e.enabledRules]),v=Object(n.useMemo)((()=>e.disabledRules.map((e=>({label:i.a.createElement(tf,{name:e.name,id:e.id}),color:"primary"})))),[e.disabledRules]),E=Object(n.useMemo)((()=>i.a.createElement(VL,{listTitle:yL,listLength:e.enabledRules.length})),[e.enabledRules.length]),x=Object(n.useMemo)((()=>i.a.createElement(VL,{listTitle:fL,listLength:e.disabledRules.length})),[e.disabledRules.length]);return i.a.createElement(U.EuiPopover,{button:f,isOpen:r,closePopover:c,anchorPosition:"rightCenter","data-test-subj":"coverageOverviewPopover",ownFocus:!1},i.a.createElement(U.EuiPopoverTitle,{className:vA.css`
          min-width: 30em;
        `},i.a.createElement(U.EuiFlexGroup,{gutterSize:"xs",alignItems:"flexStart",direction:"column"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiButtonEmpty,{flush:"left",iconType:"popout",iconSide:"right",href:e.reference,target:"_blank"},i.a.createElement(U.EuiText,null,i.a.createElement("h3",null,e.name)))),i.a.createElement(U.EuiFlexItem,null,y))),i.a.createElement("div",{className:Object(vA.cx)(Object(vA.css)({maxHeight:"40em",padding:"5px 0px"}),"eui-yScrollWithShadows")},i.a.createElement(U.EuiAccordion,{id:"enabledRulesListAccordion",initialIsOpen:e.enabledRules.length>0,buttonContent:E},i.a.createElement(U.EuiListGroup,{"data-test-subj":"coverageOverviewEnabledRulesList",flush:!0,listItems:h,size:"s"})),i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement(U.EuiAccordion,{id:"disabledRulesListAccordion",initialIsOpen:e.disabledRules.length>0,buttonContent:x},i.a.createElement(U.EuiListGroup,{"data-test-subj":"coverageOverviewDisabledRulesList",flush:!0,listItems:v,size:"s"})),i.a.createElement(U.EuiSpacer,{size:"s"})),i.a.createElement(U.EuiPopoverFooter,null,i.a.createElement(U.EuiFlexGroup,null,i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiButton,{"data-test-subj":"enableAllDisabledButton",isLoading:p,disabled:d,onClick:g,size:"s",iconType:"checkInCircleFilled"},gL)))))},WL=Object(n.memo)(QL),KL=({label:e,color:t})=>i.a.createElement(JL,{size:"xs",element:"span",icon:i.a.createElement(XL,{label:e,iconType:"empty",size:"s",$_css:t,$_css2:null!=t?"none":void 0})},e),YL=()=>{const e=Object(n.useMemo)((()=>FL.map((({threshold:e,color:t},a,n)=>i.a.createElement(KL,{label:`${0===a?`>${e}`:`${e}-${n[a-1].threshold}`} ${EL}`,key:a,color:t})))),[]);return i.a.createElement(ZL,{hasBorder:!0,$_css3:"380px"},i.a.createElement(U.EuiFlexGroup,{gutterSize:"xs"},i.a.createElement(U.EuiText,{size:"s"},i.a.createElement("h4",null,hL)),i.a.createElement(U.EuiText,{size:"s"},i.a.createElement("small",null,vL))),i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement(U.EuiFlexGroup,{gutterSize:"xs",wrap:!0},e,i.a.createElement(KL,{label:`0 ${EL}`})))};var JL=G()(U.EuiFacetButton).withConfig({displayName:"_StyledEuiFacetButton",componentId:"sc-1tbv5az-0"})({padding:0}),XL=G()(U.EuiBetaBadge).withConfig({displayName:"_StyledEuiBetaBadge",componentId:"sc-1tbv5az-1"})((e=>({background:e.$_css,boxShadow:e.$_css2}))),ZL=G()(U.EuiPanel).withConfig({displayName:"_StyledEuiPanel",componentId:"sc-1tbv5az-2"})((e=>({maxWidth:e.$_css3})));const eB=({selected:e,onChange:t,isLoading:a})=>{const[r,s]=Object(n.useState)(!1),o=Object(n.useCallback)((()=>{s(!r)}),[r]),l=Object(n.useMemo)((()=>e.length),[e]),c=LL(AL,e),u=Object(n.useCallback)((e=>{const a=RL(e);t(a)}),[t]),d=Object(n.useCallback)((()=>{t([])}),[t]),p=Object(n.useMemo)((()=>i.a.createElement(U.EuiFilterButton,{"data-test-subj":"coverageOverviewRuleActivityFilterButton",isLoading:a,iconType:"arrowDown",onClick:o,isSelected:r,hasActiveFilters:l>0,numActiveFilters:l},OL)),[r,l,o,a]);return i.a.createElement(aB,null,i.a.createElement(U.EuiPopover,{id:"ruleActivityFilterPopover",button:p,isOpen:r,closePopover:()=>{s(!1)},panelPaddingSize:"none"},i.a.createElement(U.EuiPopoverTitle,{paddingSize:"s"},IL),i.a.createElement(U.EuiSelectable,{"data-test-subj":"coverageOverviewFilterList",options:c,onChange:u,renderOption:e=>DL[e.label]},(e=>i.a.createElement(nB,null,e))),i.a.createElement(U.EuiPopoverFooter,{paddingSize:"xs"},i.a.createElement(iB,{iconType:"cross",color:"danger",size:"xs",isDisabled:0===l,onClick:d},CL))))},tB=i.a.memo(eB);var aB=G()(U.EuiFilterGroup).withConfig({displayName:"_StyledEuiFilterGroup",componentId:"sc-1q2ahpl-0"})(["width:","px;"],_L),nB=G()("div").withConfig({displayName:"_StyledDiv",componentId:"sc-1q2ahpl-1"})(["width:","px;"],_L),iB=G()(U.EuiButtonEmpty).withConfig({displayName:"_StyledEuiButtonEmpty",componentId:"sc-1q2ahpl-2"})(["width:100%;"]);const rB=({selected:e,onChange:t,isLoading:a})=>{const[r,s]=Object(n.useState)(!1),o=Object(n.useCallback)((()=>{s(!r)}),[r]),l=Object(n.useMemo)((()=>e.length),[e]),c=LL(NL,e),u=Object(n.useCallback)((e=>{const a=RL(e);t(a)}),[t]),d=Object(n.useCallback)((()=>{t([])}),[t]),p=Object(n.useMemo)((()=>i.a.createElement(U.EuiFilterButton,{"data-test-subj":"coverageOverviewRuleSourceFilterButton",isLoading:a,iconType:"arrowDown",onClick:o,isSelected:r,hasActiveFilters:l>0,numActiveFilters:l},wL)),[r,l,o,a]);return i.a.createElement(oB,null,i.a.createElement(U.EuiPopover,{id:"ruleActivityFilterPopover",button:p,isOpen:r,closePopover:()=>{s(!1)},panelPaddingSize:"none"},i.a.createElement(U.EuiPopoverTitle,{paddingSize:"s"},IL),i.a.createElement(U.EuiSelectable,{"data-test-subj":"coverageOverviewFilterList",options:c,onChange:u,renderOption:e=>PL[e.label]},(e=>i.a.createElement(lB,null,e))),i.a.createElement(U.EuiPopoverFooter,{paddingSize:"xs"},i.a.createElement(cB,{iconType:"cross",color:"danger",size:"xs",isDisabled:0===l,onClick:d},CL))))},sB=i.a.memo(rB);var oB=G()(U.EuiFilterGroup).withConfig({displayName:"_StyledEuiFilterGroup",componentId:"sc-1mn2kfe-0"})(["width:","px;"],_L),lB=G()("div").withConfig({displayName:"_StyledDiv",componentId:"sc-1mn2kfe-1"})(["width:","px;"],_L),cB=G()(U.EuiButtonEmpty).withConfig({displayName:"_StyledEuiButtonEmpty",componentId:"sc-1mn2kfe-2"})(["width:100%;"]);const uB=()=>{var e,t;const{state:{filter:a,isLoading:r,showExpandedCells:s},actions:{setShowExpandedCells:o,setRuleActivityFilter:l,setRuleSourceFilter:c,setRuleSearchFilter:u}}=lL(),d=Object(n.useCallback)((({queryText:e})=>{u(e)}),[u]);return i.a.createElement(U.EuiPanel,null,i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(pB,null,i.a.createElement(tB,{onChange:l,isLoading:r,selected:null!==(e=a.activity)&&void 0!==e?e:[]}),i.a.createElement(sB,{onChange:c,isLoading:r,selected:null!==(t=a.source)&&void 0!==t?t:[]})),i.a.createElement(U.EuiFlexGroup,{alignItems:"center"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiSearchBar,{box:{placeholder:TL,"data-test-subj":"coverageOverviewFilterSearchBar"},onChange:d})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFilterGroup,null,i.a.createElement(U.EuiFilterButton,{withNext:!0,hasActiveFilters:!s,onClick:()=>o(!1)},uL),i.a.createElement(U.EuiFilterButton,{hasActiveFilters:s,onClick:()=>o(!0)},dL))))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(YL,null))))},dB=Object(n.memo)(uB);var pB=G()(U.EuiFlexGroup).withConfig({displayName:"_StyledEuiFlexGroup",componentId:"sc-6bjtg1-0"})(["flex-grow:0;"]);const mB=()=>i.a.createElement(Ci.a,{title:cL,subtitle:i.a.createElement(U.EuiText,{color:"subdued",size:"s"},i.a.createElement("span",null,ML)," ",i.a.createElement(gM.a,null))}),bB=i.a.memo(mB),gB=()=>{const{state:{data:e}}=lL();return i.a.createElement(i.a.Fragment,null,i.a.createElement(bB,null),i.a.createElement(dB,null),i.a.createElement(U.EuiSpacer,null),i.a.createElement(U.EuiFlexGroup,{gutterSize:"m",className:"eui-xScroll"},null==e?void 0:e.mitreTactics.map((e=>i.a.createElement(U.EuiFlexGroup,{direction:"column",key:e.id,gutterSize:"s"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement($L,{tactic:e})),e.techniques.map(((e,t)=>i.a.createElement(U.EuiFlexItem,{grow:!1,key:`${e.id}-${t}`},i.a.createElement(WL,{technique:e})))))))))},fB=()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(oL,null,i.a.createElement(h.a,{"data-test-subj":"coverageOverviewPage"},i.a.createElement(gB,null))),i.a.createElement(E.a,{pageName:S.a.coverageOverview})),yB=[{path:"/rules/id/:detailName/edit",main:wR,exact:!0},{path:`/rules/id/:detailName/:tabName(${Cg.b.alerts}|${Cg.b.exceptions}|${Cg.b.endpointExceptions}|${Cg.b.executionResults}|${Cg.b.executionEvents})`,main:Cg.c,exact:!0},{path:"/rules/create",main:fR,exact:!0},{path:`/rules/:tabName(${HF.management}|${HF.monitoring}|${HF.updates})`,main:KN,exact:!0},{path:"/rules/add_rules",main:JR,exact:!0}],hB=()=>(Lr(aM),i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:s.wc.rules},i.a.createElement(q.c,null,i.a.createElement(q.a,{path:"/rules/id/:detailName",exact:!0,render:({match:{params:{detailName:e}},location:t})=>i.a.createElement(B.Redirect,{to:{...t,pathname:`/rules/id/${e}/${Cg.b.alerts}`,search:t.search}})}),i.a.createElement(q.a,{path:"/rules",exact:!0},i.a.createElement(B.Redirect,{to:`/rules/${HF.management}`})),yB.map((e=>{var t;return i.a.createElement(q.a,{key:`rules-route-${e.path}`,path:e.path,exact:null!==(t=null==e?void 0:e.exact)&&void 0!==t&&t},i.a.createElement(e.main,null))})),i.a.createElement(q.a,{component:z.a}),i.a.createElement(E.a,{pageName:s.wc.rules}))))),vB=i.a.memo(hB),EB=[{path:s.lc,component:()=>{var e;const{links:t=[],categories:a=[]}=null!==(e=Object(wk.c)(qM.SecurityPageName.rulesLanding))&&void 0!==e?e:{},n=Object(Yi.a)();return i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:qM.SecurityPageName.rulesLanding},i.a.createElement(h.a,null,i.a.createElement(XR.a,{title:ZR}),i.a.createElement(U.EuiSpacer,{size:"xl"}),i.a.createElement(Sk,{links:t,categories:a,onLinkClick:Ck,urlState:n}),i.a.createElement(E.a,{pageName:qM.SecurityPageName.rulesLanding}))))}},{path:s.mc,component:vB},{path:s.s,component:()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:s.wc.coverageOverview},i.a.createElement(fB,null)))}];var xB=a(939),jB=a(248),SB=a(912),kB=a(412),OB=a(710);const wB=G.a.div.withConfig({displayName:"TimelinesContainer",componentId:"sc-7jial6-0"})(["width:100%;"]),TB=()=>{const{tabName:e}=Object(B.useParams)(),[t,a]=Object(n.useState)(!1),r=Object(n.useCallback)((()=>{a(!0)}),[a]),{indicesExist:s}=Object(g.d)(),o=!!Object(m.j)().services.application.capabilities.siem.crud;return i.a.createElement(i.a.Fragment,null,s?i.a.createElement(i.a.Fragment,null,i.a.createElement(h.a,null,i.a.createElement(Ci.a,{title:OB.d},o&&i.a.createElement(U.EuiFlexGroup,{gutterSize:"s",alignItems:"center"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiButton,{iconType:"indexOpen",onClick:r,"data-test-subj":"open-import-data-modal-btn"},OB.a)),e===Dd.l.default?i.a.createElement(U.EuiFlexItem,null,i.a.createElement(kB.c,{timelineId:d.c.active,outline:!0,"data-test-subj":"create-default-btn"})):i.a.createElement(U.EuiFlexItem,null,i.a.createElement(SB.a,{outline:!0,title:jB.g,"data-test-subj":"create-template-btn"})))),i.a.createElement(wB,{"data-test-subj":"timelines-container"},i.a.createElement(xB.a,{defaultPageSize:10,isModal:!1,importDataModalToggle:t&&o,setImportDataModalToggle:a,title:OB.b,"data-test-subj":"stateful-open-timeline"})))):i.a.createElement(Mi.a,null),i.a.createElement(E.a,{pageName:S.a.timelines}))},IB=i.a.memo(TB),CB=`${s.yc}/:tabName(${Dd.l.default}|${Dd.l.template})`,MB=`${s.yc}/${Dd.l.default}`,_B=i.a.memo((()=>i.a.createElement(q.c,null,i.a.createElement(q.a,{exact:!0,path:CB},i.a.createElement(IB,null)),i.a.createElement(q.a,{path:s.yc,render:({location:{search:e=""}})=>i.a.createElement(B.Redirect,{to:`${MB}${Object(qI.a)(e)}`})}))));_B.displayName="Timelines";const FB=[{path:s.yc,component:()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:S.a.timelines},i.a.createElement(_B,null)))}];var AB=a(208),DB=a(711);const NB={timelineById:{},autoSavedWarningMsg:{timelineId:null,newTimelineModel:null},showCallOutUnauthorizedMsg:!1,insertTimeline:null},PB=Object(AB.reducerWithInitialState)(NB).case(k.addTimeline,((e,{id:t,timeline:a,resolveTimelineConfig:n})=>({...e,timelineById:Object(DB.e)({id:t,timeline:a,resolveTimelineConfig:n,timelineById:e.timelineById})}))).case(k.createTimeline,((e,{id:t,timelineType:a=Dd.l.default,...n})=>({...e,timelineById:Object(DB.a)({id:t,timelineById:e.timelineById,timelineType:a,...n})}))).case(k.addNote,((e,{id:t,noteId:a})=>({...e,timelineById:Object(DB.b)({id:t,noteId:a,timelineById:e.timelineById})}))).case(k.addNoteToEvent,((e,{id:t,noteId:a,eventId:n})=>({...e,timelineById:Object(DB.c)({id:t,noteId:a,eventId:n,timelineById:e.timelineById})}))).case(k.addProvider,((e,{id:t,providers:a})=>({...e,timelineById:Object(DB.d)({id:t,providers:a,timelineById:e.timelineById})}))).case(k.applyKqlFilterQuery,((e,{id:t,filterQuery:a})=>({...e,timelineById:Object(DB.g)({id:t,filterQuery:a,timelineById:e.timelineById})}))).case(k.showTimeline,((e,{id:t,show:a})=>({...e,timelineById:Object(DB.I)({id:t,show:a,timelineById:e.timelineById})}))).case(k.updateGraphEventId,((e,{id:t,graphEventId:a})=>({...e,timelineById:Object(DB.w)({id:t,graphEventId:a,timelineById:e.timelineById})}))).case(k.updateSessionViewConfig,((e,{id:t,sessionViewConfig:a})=>({...e,timelineById:Object(DB.H)({id:t,sessionViewConfig:a,timelineById:e.timelineById})}))).case(k.pinEvent,((e,{id:t,eventId:a})=>({...e,timelineById:Object(DB.i)({id:t,eventId:a,timelineById:e.timelineById})}))).case(k.removeProvider,((e,{id:t,providerId:a,andProviderId:n})=>({...e,timelineById:Object(DB.k)({id:t,providerId:a,timelineById:e.timelineById,andProviderId:n})}))).case(k.startTimelineSaving,((e,{id:t})=>({...e,timelineById:{...e.timelineById,[t]:{...e.timelineById[t],isSaving:!0}}}))).case(k.endTimelineSaving,((e,{id:t})=>({...e,timelineById:{...e.timelineById,[t]:{...e.timelineById[t],isSaving:!1}}}))).case(k.setExcludedRowRendererIds,((e,{id:t,excludedRowRendererIds:a})=>({...e,timelineById:Object(DB.q)({id:t,excludedRowRendererIds:a,timelineById:e.timelineById})}))).case(k.updateTimeline,((e,{id:t,timeline:a})=>({...e,timelineById:{...e.timelineById,[t]:a}}))).case(k.unPinEvent,((e,{id:t,eventId:a})=>({...e,timelineById:Object(DB.p)({id:t,eventId:a,timelineById:e.timelineById})}))).case(k.updateIsFavorite,((e,{id:t,isFavorite:a})=>({...e,timelineById:Object(DB.x)({id:t,isFavorite:a,timelineById:e.timelineById})}))).case(k.updateKqlMode,((e,{id:t,kqlMode:a})=>({...e,timelineById:Object(DB.z)({id:t,kqlMode:a,timelineById:e.timelineById})}))).case(k.updateTitleAndDescription,((e,{id:t,title:a,description:n})=>({...e,timelineById:Object(DB.J)({id:t,title:a,description:n,timelineById:e.timelineById})}))).case(k.updateProviders,((e,{id:t,providers:a})=>({...e,timelineById:Object(DB.F)({id:t,providers:a,timelineById:e.timelineById})}))).case(k.updateRange,((e,{id:t,start:a,end:n})=>({...e,timelineById:Object(DB.G)({id:t,start:a,end:n,timelineById:e.timelineById})}))).case(k.updateDataProviderEnabled,((e,{id:t,enabled:a,providerId:n,andProviderId:i})=>({...e,timelineById:Object(DB.B)({id:t,enabled:a,providerId:n,timelineById:e.timelineById,andProviderId:i})}))).case(k.updateDataProviderExcluded,((e,{id:t,excluded:a,providerId:n,andProviderId:i})=>({...e,timelineById:Object(DB.C)({id:t,excluded:a,providerId:n,timelineById:e.timelineById,andProviderId:i})}))).case(k.dataProviderEdited,((e,{andProviderId:t,excluded:a,field:n,id:i,operator:r,providerId:s,value:o})=>({...e,timelineById:Object(DB.D)({andProviderId:t,excluded:a,field:n,id:i,operator:r,providerId:s,timelineById:e.timelineById,value:o})}))).case(k.updateDataProviderType,((e,{id:t,type:a,providerId:n,andProviderId:i})=>({...e,timelineById:Object(DB.E)({id:t,type:a,providerId:n,timelineById:e.timelineById,andProviderId:i})}))).case(k.updateAutoSaveMsg,((e,{timelineId:t,newTimelineModel:a})=>({...e,autoSavedWarningMsg:{timelineId:t,newTimelineModel:a}}))).case(k.showCallOutUnauthorizedMsg,(e=>({...e,showCallOutUnauthorizedMsg:!0}))).case(k.setSavedQueryId,((e,{id:t,savedQueryId:a})=>({...e,timelineById:Object(DB.s)({id:t,savedQueryId:a,timelineById:e.timelineById})}))).case(k.setFilters,((e,{id:t,filters:a})=>({...e,timelineById:Object(DB.r)({id:t,filters:a,timelineById:e.timelineById})}))).case(k.setInsertTimeline,((e,t)=>({...e,insertTimeline:t}))).case(k.updateDataView,((e,{id:t,dataViewId:a,indexNames:n})=>({...e,timelineById:{...e.timelineById,[t]:{...e.timelineById[t],dataViewId:a,indexNames:n}}}))).case(k.setActiveTabTimeline,((e,{id:t,activeTab:a,scrollToTop:n})=>({...e,timelineById:{...e.timelineById,[t]:{...e.timelineById[t],activeTab:a,prevActiveTab:e.timelineById[t].activeTab,scrollToTop:n?{timestamp:Math.floor(Date.now()/1e3)}:void 0}}}))).case(k.toggleModalSaveTimeline,((e,{id:t,showModalSaveTimeline:a})=>({...e,timelineById:{...e.timelineById,[t]:{...e.timelineById[t],showSaveModal:a}}}))).case(k.updateEqlOptions,((e,{id:t,field:a,value:n})=>{var i;return{...e,timelineById:{...e.timelineById,[t]:{...e.timelineById[t],eqlOptions:{...null!==(i=e.timelineById[t].eqlOptions)&&void 0!==i?i:{},[a]:n}}}}})).case(k.setTimelineUpdatedAt,((e,{id:t,updated:a})=>({...e,timelineById:{...e.timelineById,[t]:{...e.timelineById[t],updated:a}}}))).case(k.toggleDetailPanel,((e,t)=>({...e,timelineById:{...e.timelineById,[t.id]:{...e.timelineById[t.id],expandedDetail:{...e.timelineById[t.id].expandedDetail,...Object(DB.v)(t)}}}}))).case(k.setEventsLoading,((e,{id:t,eventIds:a,isLoading:n})=>({...e,timelineById:Object(DB.n)({id:t,eventIds:a,timelineById:e.timelineById,isLoading:n})}))).case(k.removeColumn,((e,{id:t,columnId:a})=>({...e,timelineById:Object(DB.j)({id:t,columnId:a,timelineById:e.timelineById})}))).case(k.upsertColumn,((e,{column:t,id:a,index:n})=>({...e,timelineById:Object(DB.K)({column:t,id:a,index:n,timelineById:e.timelineById})}))).case(k.updateColumns,((e,{id:t,columns:a})=>({...e,timelineById:Object(DB.t)({id:t,columns:a,timelineById:e.timelineById})}))).case(k.updateIsLoading,((e,{id:t,isLoading:a})=>({...e,timelineById:{...e.timelineById,[t]:{...e.timelineById[t],isLoading:a}}}))).case(k.updateSort,((e,{id:t,sort:a})=>({...e,timelineById:Object(DB.u)({id:t,sort:a,timelineById:e.timelineById})}))).case(k.setSelected,((e,{id:t,eventIds:a,isSelected:n,isSelectAllChecked:i})=>({...e,timelineById:Object(DB.o)({id:t,eventIds:a,timelineById:e.timelineById,isSelected:n,isSelectAllChecked:i})}))).case(k.clearSelected,((e,{id:t})=>({...e,timelineById:{...e.timelineById,[t]:{...e.timelineById[t],selectedEventIds:{},isSelectAllChecked:!1}}}))).case(k.setEventsDeleted,((e,{id:t,eventIds:a,isDeleted:n})=>({...e,timelineById:Object(DB.l)({id:t,eventIds:a,timelineById:e.timelineById,isDeleted:n})}))).case(k.initializeTimelineSettings,((e,{id:t,...a})=>({...e,timelineById:Object(DB.m)({id:t,timelineById:e.timelineById,timelineSettingsProps:a})}))).case(k.updateItemsPerPage,((e,{id:t,itemsPerPage:a})=>({...e,timelineById:Object(DB.y)({id:t,itemsPerPage:a,timelineById:e.timelineById})}))).case(k.updateItemsPerPageOptions,((e,{id:t,itemsPerPageOptions:a})=>({...e,timelineById:Object(DB.A)({id:t,itemsPerPageOptions:a,timelineById:e.timelineById})}))).case(k.applyDeltaToColumnWidth,((e,{id:t,columnId:a,delta:n})=>({...e,timelineById:Object(DB.f)({id:t,columnId:a,delta:n,timelineById:e.timelineById})}))).case(k.clearEventsDeleted,((e,{id:t})=>({...e,timelineById:{...e.timelineById,[t]:{...e.timelineById[t],deletedEventIds:[]}}}))).case(k.clearEventsLoading,((e,{id:t})=>({...e,timelineById:{...e.timelineById,[t]:{...e.timelineById[t],loadingEventIds:[]}}}))).build();var RB=a(173),LB=a(139),BB=a(215),qB=a(1046);const zB=Object(n.memo)((({hasNoPolicyData:e,metadataTransformStats:t})=>{const[a,r]=Object(n.useState)(!1),[l,c]=Object(n.useState)(!0),{services:u}=Object(m.j)(),d=Object(o.useDispatch)();Object(n.useEffect)((()=>{l&&!e&&(d({type:"loadMetadataTransformStats"}),c(!1))}),[d,e,l]),Object(n.useEffect)((()=>{const e=t.some((e=>s.Kc.has(null==e?void 0:e.state)));r(e)}),[t]);const p=Object(n.useCallback)((()=>{r(!1)}),[]),b=Object(n.useMemo)((()=>t.reduce(((e,t)=>(s.Kc.has(t.state)&&e.push(t.id),e)),[]).join(", ")),[t]),g=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.list.transformFailed.message",defaultMessage:"A required transform, {transformId}, is currently failing. Most of the time this can be fixed by {transformsPage}. For additional help, please visit the {docsPage}",values:{transformId:b||BB.B,transformsPage:i.a.createElement(qB.a,{"data-test-subj":"failed-transform-restart-link",appId:"management",appPath:"/data/transform"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.list.transformFailed.restartLink",defaultMessage:"restarting the transform"})),docsPage:i.a.createElement(U.EuiLink,{"data-test-subj":"failed-transform-docs-link",href:u.docLinks.links.endpoints.troubleshooting,target:"_blank"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.list.transformFailed.docsLink",defaultMessage:"troubleshooting documentation"}))}}),i.a.createElement(U.EuiSpacer,{size:"s"}))),[b,u.docLinks.links.endpoints.troubleshooting]);return a?i.a.createElement(i.a.Fragment,null,i.a.createElement(mM.a,{message:{id:"endpoints-list-transform-failed",type:"warning",title:$.i18n.translate("xpack.securitySolution.endpoint.list.transformFailed.title",{defaultMessage:"Required transform failed"}),description:g},dismissButtonText:$.i18n.translate("xpack.securitySolution.endpoint.list.transformFailed.dismiss",{defaultMessage:"Dismiss"}),onDismiss:p,showDismissButton:!0}),i.a.createElement(U.EuiSpacer,{size:"m"})):i.a.createElement(i.a.Fragment,null)}));zB.displayName="TransformFailedCallout";var $B=a(1054);const VB=Object(n.memo)((({name:e,href:t,route:a,dataTestSubj:n})=>{const r=Object($B.a)(a);return i.a.createElement(U.EuiLink,{"data-test-subj":n,className:"eui-displayInline eui-textTruncate",href:t,onClick:r},e)}));VB.displayName="EndpointListNavLink";var UB=a(889),HB=a(884),GB=a(527),QB=a(693),WB=a(1494),KB=a(1495);const YB=$.i18n.translate("xpack.securitySolution.endpointDetails.overview",{defaultMessage:"Overview"}),JB={tabTitle:$.i18n.translate("xpack.securitySolution.endpointDetails.responseActionsHistory",{defaultMessage:"Response actions history"}),LogEntry:{endOfLog:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.action.endOfLog",{defaultMessage:"Nothing more to show"}),dateRangeMessage:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.dateRangeMessage.title",{defaultMessage:"Nothing to show for selected date range, please select another and try again."}),emptyState:{title:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.emptyState.title",{defaultMessage:"No logged actions"}),body:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.emptyState.body",{defaultMessage:"No actions have been logged for this endpoint."})},action:{isolatedAction:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.action.isolated",{defaultMessage:"submitted request: Isolate host"}),unisolatedAction:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.action.unisolated",{defaultMessage:"submitted request: Release host"}),failedEndpointReleaseAction:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.action.failedEndpointReleaseAction",{defaultMessage:"failed to submit request: Release host"}),failedEndpointIsolateAction:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.action.failedEndpointIsolateAction",{defaultMessage:"failed to submit request: Isolate host"})},response:{isolationCompletedAndSuccessful:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.response.isolationCompletedAndSuccessful",{defaultMessage:"Host isolation request completed by Endpoint"}),isolationCompletedAndUnsuccessful:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.response.isolationCompletedAndUnsuccessful",{defaultMessage:"Host isolation request completed by Endpoint with errors"}),unisolationCompletedAndSuccessful:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.response.unisolationCompletedAndSuccessful",{defaultMessage:"Release request completed by Endpoint"}),unisolationCompletedAndUnsuccessful:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.response.unisolationCompletedAndUnsuccessful",{defaultMessage:"Release request completed by Endpoint with errors"}),isolationSuccessful:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.response.isolationSuccessful",{defaultMessage:"Host isolation request received by Endpoint"}),isolationFailed:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.response.isolationFailed",{defaultMessage:"Host isolation request received by Endpoint with errors"}),unisolationSuccessful:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.response.unisolationSuccessful",{defaultMessage:"Release host request received by Endpoint"}),unisolationFailed:$.i18n.translate("xpack.securitySolution.endpointDetails.activityLog.logEntry.response.unisolationFailed",{defaultMessage:"Release host request received by Endpoint with errors"})}}};var XB=a(502);const ZB=Object(n.memo)((({hostMetadata:e})=>{const t=Object(HB.a)(e),[a,r]=Object(n.useState)(!1),s=Object(n.useCallback)((()=>{r(!1)}),[]),o=Object(n.useMemo)((()=>t.map((e=>i.a.createElement(XB.a,Ni()({},e,{onClick:t=>{s(),e.onClick&&e.onClick(t)}}))))),[s,t]),l=Object(n.useMemo)((()=>i.a.createElement(U.EuiButton,{iconSide:"right",fill:!0,iconType:"arrowDown","data-test-subj":"endpointDetailsActionsButton",onClick:()=>{r(!a)}},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.detailsActions.buttonLabel",defaultMessage:"Take action"}))),[a]);return i.a.createElement(U.EuiPopover,{id:"endpointDetailsActionsPanel",button:l,isOpen:a,closePopover:s,panelPaddingSize:"none",anchorPosition:"downLeft","data-test-subj":"endpointDetailsActionsPopover"},i.a.createElement(U.EuiContextMenuPanel,{size:"s",items:o}))}));ZB.displayName="ActionMenu";var eq=a(1442),tq=a(399);const aq=Object(n.memo)((({hostMeta:e})=>{const t=Object(B.useHistory)(),a=Object(o.useDispatch)(),{show:r,...s}=Object(HB.b)(GB.uiQueryParams),l=Object(qm.b)(e),c=Object(HB.b)(GB.getIsIsolationRequestPending),u=Object(HB.b)(GB.getWasIsolationRequestSuccessful),d=Object(HB.b)(GB.getIsolationRequestError),[p,m]=Object(n.useState)({comment:""}),b=l?tq.d:tq.b,g=Object(n.useCallback)((()=>{t.push(Object(v.d)({name:"endpointDetails",...s,selected_endpoint:e.agent.id}))}),[t,e.agent.id,s]),f=Object(n.useCallback)((()=>{a({type:"endpointIsolationRequest",payload:{type:l?"unisolate":"isolate",data:{endpoint_ids:[e.agent.id],comment:p.comment}}})}),[a,p.comment,e.agent.id,l]),y=Object(n.useCallback)((e=>{m((t=>({...t,...e})))}),[]);return i.a.createElement(i.a.Fragment,null,u&&i.a.createElement(tq.c,{hostName:e.host.name,isolateAction:l?"unisolateHost":"isolateHost"}),i.a.createElement(U.EuiFlyoutBody,null,u?i.a.createElement(tq.a,{onClick:g,buttonText:$.i18n.translate("xpack.securitySolution.endpoint.hostIsolation.successProceedButton",{defaultMessage:"Return to endpoint details"})}):i.a.createElement(U.EuiForm,{isInvalid:!!d,error:null==d?void 0:d.message,"data-test-subj":"endpointIsolationForm"},i.a.createElement(b,{comment:p.comment,isLoading:c,hostName:e.host.name,onCancel:g,onConfirm:f,onChange:y}))))}));aq.displayName="EndpointIsolateFlyoutPanel";var nq=a(1447);const iq=(e,t)=>!(!t||!e.id||e.id===t.endpoint.id&&t.agent.configured.id===t.agent.applied.id&&e.version>=t.agent.applied.revision&&e.version>=t.agent.configured.revision&&e.endpoint_policy_version>=t.endpoint.revision);var rq=a(1440);const sq=Object(n.memo)((({policyId:e,backLink:t,children:a,missingPolicies:r={},...s})=>{const{getAppUrl:o}=Object(ry.a)(),{toRoutePath:l,toRouteUrl:c}=Object(n.useMemo)((()=>{const a=e?Object(v.j)(e):"";return{toRoutePath:t?{pathname:a,state:{backLink:t}}:a,toRouteUrl:o({path:a})}}),[e,o,t]),u=Object($B.a)(l);return!e||r[e]?i.a.createElement("span",{className:s.className,"data-test-subj":s["data-test-subj"]},a,i.a.createElement(U.EuiText,{color:"subdued",size:"xs",className:"eui-textNoWrap"},i.a.createElement(U.EuiIcon,{size:"m",type:"warning",color:"warning"})," ",i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyNotFound",defaultMessage:"Policy not found!"}))):i.a.createElement(U.EuiLink,Ni()({href:c,onClick:u},s),a)}));sq.displayName="EndpointPolicyLink";const oq=i.a.memo((({style:e,...t})=>i.a.createElement(U.EuiText,Ni()({color:"subdued",size:"xs",className:"eui-textNoWrap eui-displayInlineBlock",style:e},t),i.a.createElement(U.EuiIcon,{className:"eui-alignTop",size:"m",type:"warning",color:"warning"}),i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.outOfDateLabel",defaultMessage:"Out-of-date"}))));oq.displayName="OutOfDate";const lq=G.a.div.withConfig({displayName:"EndpointDetailsContentStyled",componentId:"sc-16oisg3-0"})(["dl dt{max-width:27%;}dl dd{max-width:73%;}.policyLineText{padding-right:5px;}"]),cq=({children:e})=>i.a.createElement(U.EuiText,{size:"s"},i.a.createElement("h5",null,e)),uq=Object(n.memo)((({hostInfo:e,policyInfo:t})=>{const a=Object(HB.b)(GB.uiQueryParams),r=Object(n.useMemo)((()=>e.metadata.Endpoint.policy.applied.status),[e]),s=Object(HB.b)(GB.getEndpointPendingActionsCallback),o=Object(HB.b)(GB.nonExistingPolicies),l=Object(n.useMemo)((()=>{const{selected_endpoint:t,show:n,...i}=a;return Object(v.d)({name:"endpointPolicyResponse",...i,selected_endpoint:e.metadata.agent.id})}),[e.metadata.agent.id,a]),c=Object($B.a)(l),u=Object(n.useMemo)((()=>[{title:i.a.createElement(cq,null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.details.os",defaultMessage:"OS"})),description:i.a.createElement(U.EuiText,{size:"xs"},e.metadata.host.os.full)},{title:i.a.createElement(cq,null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.details.agentStatus",defaultMessage:"Agent Status"})),description:i.a.createElement(UB.a,{pendingActions:s(e.metadata.agent.id),endpointHostInfo:e})},{title:i.a.createElement(cq,null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.details.lastSeen",defaultMessage:"Last Seen"})),description:i.a.createElement(U.EuiText,{size:"xs"},i.a.createElement(qs.a,{value:e.last_checkin||e.metadata["@timestamp"],fieldName:""}))},{title:i.a.createElement(cq,null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.details.policy",defaultMessage:"Policy"})),description:i.a.createElement(U.EuiText,{size:"xs",className:"eui-textBreakWord"},i.a.createElement(sq,{policyId:e.metadata.Endpoint.policy.applied.id,"data-test-subj":"policyDetailsValue",className:"policyLineText",missingPolicies:o},e.metadata.Endpoint.policy.applied.name),e.metadata.Endpoint.policy.applied.endpoint_policy_version&&i.a.createElement(U.EuiText,{color:"subdued",size:"xs",className:"eui-displayInlineBlock eui-textNoWrap policyLineText","data-test-subj":"policyDetailsRevNo"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.details.policy.revisionNumber",defaultMessage:"rev. {revNumber}",values:{revNumber:e.metadata.Endpoint.policy.applied.endpoint_policy_version}})),iq(e.metadata.Endpoint.policy.applied,t)&&i.a.createElement(oq,null))},{title:i.a.createElement(cq,null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.details.policyStatus",defaultMessage:"Policy Status"})),description:i.a.createElement(U.EuiHealth,{"data-test-subj":`policyStatusValue-${r}`,color:rq.b[r]||"default"},i.a.createElement(U.EuiLink,{onClick:c,"data-test-subj":"policyStatusValue"},i.a.createElement(U.EuiText,{size:"xs"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.details.policyStatusValue",defaultMessage:"{policyStatus, select, success {Success} warning {Warning} failure {Failed} other {Unknown}}",values:{policyStatus:r}}))))},{title:i.a.createElement(cq,null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.details.endpointVersion",defaultMessage:"Endpoint Version"})),description:i.a.createElement(U.EuiText,{size:"xs"},e.metadata.agent.version)},{title:i.a.createElement(cq,null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.details.ipAddress",defaultMessage:"IP Address"})),description:i.a.createElement(U.EuiFlexGroup,{direction:"column",gutterSize:"s"},e.metadata.host.ip.map(((e,t)=>i.a.createElement(U.EuiFlexItem,{key:t},i.a.createElement(U.EuiText,{size:"xs"},e)))))}]),[e,s,o,t,r,c]);return i.a.createElement(lq,null,i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement(U.EuiDescriptionList,{compressed:!0,type:"column",listItems:u,"data-test-subj":"endpointDetailsList"}))}));uq.displayName="EndpointDetailsContent";const dq=Object(n.memo)((()=>{var e,t,a,r;const s=Object(m.n)(),o=Object(HB.b)(GB.uiQueryParams),{data:l,error:c,isFetching:u}=Object(QB.c)(null!==(e=o.selected_endpoint)&&void 0!==e?e:""),d=Object(HB.b)(GB.showView),{canAccessEndpointActionsLogManagement:p}=Object(ch.a)().endpointPrivileges,b=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSkeletonText,{lines:3}),i.a.createElement(U.EuiSpacer,{size:"l"}),i.a.createElement(U.EuiSkeletonText,{lines:3}))),[]),g=Object(n.useCallback)((e=>{const t=[{id:eq.b.overview,name:YB,route:Object(v.d)({...o,name:"endpointDetails",selected_endpoint:e}),content:void 0===l?b:i.a.createElement(uq,{hostInfo:l,policyInfo:l.policy_info})}];return p&&t.push({id:eq.b.activityLog,name:JB.tabTitle,route:Object(v.d)({...o,name:"endpointActivityLog",selected_endpoint:e}),content:i.a.createElement(WB.a,{agentIds:e})}),t}),[p,b,l,o]),f="details"===d||"policy_response"===d||"activity_log"===d;return Object(n.useEffect)((()=>{null!==c&&s.addDanger({title:$.i18n.translate("xpack.securitySolution.endpoint.details.errorTitle",{defaultMessage:"Could not find host"}),text:$.i18n.translate("xpack.securitySolution.endpoint.details.errorBody",{defaultMessage:"Please exit the flyout and select an available host."})})}),[c,d,s]),i.a.createElement(i.a.Fragment,null,("policy_response"===d||"isolate"===d||"unisolate"===d)&&i.a.createElement(nq.a,{endpointId:null==l||null===(t=l.metadata)||void 0===t?void 0:t.agent.id,hasBorder:!0,hostname:null==l||null===(a=l.metadata)||void 0===a||null===(r=a.host)||void 0===r?void 0:r.hostname,isHostInfoLoading:u}),void 0===l?i.a.createElement(U.EuiFlyoutBody,null,i.a.createElement(U.EuiSkeletonText,{lines:3})," ",i.a.createElement(U.EuiSpacer,{size:"l"})," ",i.a.createElement(U.EuiSkeletonText,{lines:3})):i.a.createElement(i.a.Fragment,null,("details"===d||"activity_log"===d)&&i.a.createElement(eq.a,{hostname:l.metadata.host.hostname,isHostInfoLoading:u,show:p?d:"details",tabs:g(l.metadata.agent.id)}),"policy_response"===d&&i.a.createElement(pq,{hostMeta:l.metadata}),("isolate"===d||"unisolate"===d)&&i.a.createElement(aq,{hostMeta:l.metadata}),f&&i.a.createElement(U.EuiFlyoutFooter,{className:"eui-textRight","data-test-subj":"endpointDetailsFlyoutFooter"},i.a.createElement(ZB,{hostMetadata:l.metadata}))))}));dq.displayName="EndpointDetails";const pq=Object(n.memo)((({hostMeta:e})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiFlyoutBody,{"data-test-subj":"endpointDetailsPolicyResponseFlyoutBody",className:"endpointDetailsPolicyResponseFlyoutBody"},i.a.createElement(KB.a,{endpointId:e.agent.id})))));pq.displayName="PolicyResponseFlyoutPanel";const mq=Object(n.memo)((()=>{const e=Object(B.useHistory)(),t=Object(HB.b)(GB.uiQueryParams),{selected_endpoint:a,...r}=t,s=Object(n.useCallback)((()=>{const{show:t,...a}=r;e.push(Object(v.e)({name:"endpointList",...a}))}),[e,r]);return i.a.createElement(U.EuiFlyout,{onClose:s,"data-test-subj":"endpointDetailsFlyout",size:"m",paddingSize:"l",ownFocus:!1},i.a.createElement(dq,null))}));mq.displayName="EndpointDetailsFlyout";var bq=a(185),gq=a(1622),fq=a.n(gq);const yq=Object.freeze({textAlign:"center"}),hq=Object.freeze({maxWidth:550,maxHeight:420}),vq=i.a.memo((()=>{const{services:e}=Object(m.j)();return i.a.createElement(U.EuiText,{size:"s",color:"subdued","data-test-subj":"noFleetAccess"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.onboarding.enableFleetAccess",defaultMessage:"Deploying Agents for the first time requires Fleet access. For more information, "}),i.a.createElement(U.EuiLink,{external:!0,href:`${e.docLinks.links.securitySolution.privileges}`},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.onboarding.onboardingDocsLink",defaultMessage:"view the Elastic Security documentation"})))}));vq.displayName="MissingFleetAccessInfo";const Eq=i.a.memo((({loading:e,onActionClick:t,actionDisabled:a,policyEntryPoint:n=!1})=>{const r=Object(m.j)().services.docLinks,{canAccessFleet:s,loading:o}=Object(ch.a)().endpointPrivileges;return i.a.createElement("div",{"data-test-subj":"emptyPolicyTable"},e?i.a.createElement(U.EuiFlexGroup,{alignItems:"center",justifyContent:"center"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiLoadingSpinner,{size:"xl",className:"essentialAnimation"}))):i.a.createElement(U.EuiFlexGroup,{"data-test-subj":"policyOnboardingInstructions",alignItems:"center"},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(U.EuiText,null,i.a.createElement("h1",null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyList.onboardingTitle",defaultMessage:"Get started with Elastic Defend"}))),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiText,{size:"s",color:"subdued"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyList.onboardingSectionOne",defaultMessage:"Protect your hosts with threat prevention, detection, and deep security data visibility."})),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiText,{size:"s",color:"subdued"},n?i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyList.onboardingSectionTwo.fromPolicyPage",defaultMessage:"From this page, you’ll be able to view and manage the Elastic Defend Integration policies in your environment running Elastic Defend."}):i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyList.onboardingSectionTwo.fromEndpointPage",defaultMessage:"From this page, you’ll be able to view and manage the hosts in your environment running Elastic Defend."})),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiText,{size:"s",color:"subdued"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyList.onboardingSectionThree",defaultMessage:"To get started, add the Elastic Defend integration to your Agents. For more information, "}),i.a.createElement(U.EuiLink,{external:!0,href:`${r.links.siem.guide}`},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyList.onboardingDocsLink",defaultMessage:"view the Elastic Security documentation"}))),i.a.createElement(U.EuiSpacer,{size:"m"}),o&&i.a.createElement(U.EuiSkeletonText,{lines:1}),!o&&s&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement(U.EuiFlexGroup,null,i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{fill:!0,iconType:"plusInCircle",onClick:t,isDisabled:a,"data-test-subj":"onboardingStartButton"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyList.actionButtonText",defaultMessage:"Add Elastic Defend"}))))),!o&&!s&&i.a.createElement(vq,null)),i.a.createElement(U.EuiFlexItem,{grow:2},i.a.createElement(U.EuiIcon,{type:fq.a,size:"original",style:hq}))))})),xq=i.a.memo((({loading:e,onActionClick:t,actionDisabled:a,handleSelectableOnChange:r,selectionOptions:s})=>{const o=Object(n.useMemo)((()=>[{title:$.i18n.translate("xpack.securitySolution.endpoint.list.stepOneTitle",{defaultMessage:"Select the integration you want to use"}),children:i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiText,{color:"subdued",size:"m",grow:!1},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.list.stepOne",defaultMessage:"Select from existing integrations. This can be changed later."})),i.a.createElement(U.EuiSpacer,{size:"xxl"}),i.a.createElement(U.EuiSelectable,{options:s,singleSelection:"always",isLoading:e,height:100,listProps:{bordered:!0,singleSelection:!0},onChange:r,"data-test-subj":"onboardingPolicySelect"},(t=>e?i.a.createElement(U.EuiSelectableMessage,null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.list.loadingPolicies",defaultMessage:"Loading integrations"})):s.length?t:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.list.noPolicies",defaultMessage:"There are no integrations."}))))},{title:$.i18n.translate("xpack.securitySolution.endpoint.list.stepTwoTitle",{defaultMessage:"Enroll your agents enabled with Elastic Defend through Fleet"}),status:a?"disabled":"",children:i.a.createElement(U.EuiFlexGroup,{alignItems:"center"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiText,{color:"subdued",size:"m",grow:!1},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.list.stepTwo",defaultMessage:"You’ll be provided with the necessary commands to get started."}))),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{fill:!0,onClick:t,isDisabled:a,"data-test-subj":"onboardingStartButton"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policyList.emptyCreateNewButton",defaultMessage:"Enroll Agent"}))))}]),[s,r,e,a,t]);return i.a.createElement(jq,{loading:e,dataTestSubj:"emptyHostsTable",steps:o,headerComponent:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.list.noEndpointsPrompt",defaultMessage:"Next step: Enroll an Agent with Elastic Defend"}),bodyComponent:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.list.noEndpointsInstructions",defaultMessage:"You’ve added the Elastic Defend integration. Now enroll your agents using the steps below."})})})),jq=i.a.memo((({loading:e,dataTestSubj:t,steps:a,headerComponent:n,bodyComponent:r})=>i.a.createElement("div",{"data-test-subj":t},e?i.a.createElement(U.EuiFlexGroup,{alignItems:"center",justifyContent:"center"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiLoadingSpinner,{size:"xl",className:"essentialAnimation"}))):i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,{size:"xxl"}),i.a.createElement(U.EuiTitle,{size:"m"},i.a.createElement("h2",{style:yq},n)),i.a.createElement(U.EuiSpacer,{size:"xxl"}),i.a.createElement(U.EuiText,{textAlign:"center",color:"subdued",size:"m"},r),i.a.createElement(U.EuiSpacer,{size:"xxl"}),a&&i.a.createElement(U.EuiFlexGroup,{alignItems:"center",justifyContent:"center"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiSteps,{steps:a,"data-test-subj":"onboardingSteps"})))))));Eq.displayName="PolicyEmptyState",xq.displayName="HostsEmptyState",jq.displayName="ManagementEmptyState";var Sq=a(933),kq=a.n(Sq);const Oq=Object(n.memo)((()=>{const e=Object(B.useHistory)(),{admin_query:t,...a}=Object(HB.b)(GB.uiQueryParams),r=Object(HB.b)(GB.patterns),s=Object(HB.b)(GB.searchBarQuery),o=Object(n.useMemo)((()=>r.map((e=>{return t=e,Object(hl.all)([t]);var t}))),[r]),l=Object(n.useCallback)((t=>{var n,i;e.push(function(e){return{search:kq.a.stringify(e)}}({...a,page_index:(null===(n=t.query)||void 0===n?void 0:n.query)===s.query?a.page_index:"0",...null!==(i=t.query)&&void 0!==i&&i.query.trim()?{admin_query:Object(zr.encode)(t.query)}:{}}))}),[e,a,s.query]),c=Object(n.useMemo)((()=>new kw.TimeHistory(new ir.Storage(localStorage))),[]);return i.a.createElement("div",null,r&&r.length>0&&i.a.createElement("div",null,i.a.createElement(FD.SearchBar,{dataTestSubj:"adminSearchBar",query:s,indexPatterns:o,timeHistory:c,onQuerySubmit:l,fillSubmitButton:!0,isLoading:!1,iconType:"search",showFilterBar:!1,showDatePicker:!1,showQueryInput:!0})))}));Oq.displayName="AdminSearchBar";var wq=a(828);const Tq=Object(n.memo)((({endpointMetadata:e})=>{const[t,a]=Object(n.useState)(!1),r=Object(HB.a)(e,{isEndpointList:!0}),s=Object(n.useCallback)((()=>a(!1)),[a]),o=Object(n.useCallback)((()=>a(!t)),[t]),l=Object(n.useMemo)((()=>r.map((e=>i.a.createElement(XB.a,Ni()({},e,{onClick:t=>{s(),e.onClick&&e.onClick(t)}}))))),[s,r]),c=Object(n.useMemo)((()=>({"data-test-subj":"tableRowActionsMenuPanel"})),[]);return i.a.createElement(U.EuiPopover,{anchorPosition:"downRight",panelPaddingSize:"none",panelProps:c,button:i.a.createElement(U.EuiButtonIcon,{"data-test-subj":"endpointTableRowActions",iconType:"boxesHorizontal",onClick:o,"aria-label":$.i18n.translate("xpack.securitySolution.endpoint.list.actionmenu",{defaultMessage:"Open"})}),isOpen:t,closePopover:s},i.a.createElement(U.EuiContextMenuPanel,{items:l}))}));Tq.displayName="EndpointTableRowActions";var Iq=a(1036),Cq=a(685);const Mq=Object(n.memo)((({backLink:e})=>{const{getAppUrl:t}=Object(m.c)(),a=Object(n.useMemo)((()=>{if(e){const{navigateTo:t,label:a,href:n}=e;return{onBackButtonNavigateTo:t,backButtonLabel:a,backButtonUrl:n}}const a=Object(v.h)();return{backButtonLabel:$.i18n.translate("xpack.securitySolution.endpoint.list.backToPolicyButton",{defaultMessage:"Back to policy list"}),backButtonUrl:t({path:a}),onBackButtonNavigateTo:[qM.APP_UI_ID,{path:a}]}}),[t,e]);return e?i.a.createElement(Cq.a,Ni()({},a,{"data-test-subj":"endpointListBackLink"})):null}));Mq.displayName="BackToPolicyListButton";const _q=G.a.div.withConfig({displayName:"StyledDatePicker",componentId:"sc-iwyqb6-0"})([".euiFormControlLayout--group{background-color:rgba(0,119,204,0.2);}"]),Fq={[bq.a.HOSTNAME]:"18%",[bq.a.HOST_STATUS]:"15%",[bq.a.POLICY_NAME]:"20%",[bq.a.POLICY_STATUS]:"150px",[bq.a.HOST_OS_NAME]:"90px",[bq.a.HOST_IP]:"22%",[bq.a.AGENT_VERSION]:"10%",[bq.a.LAST_SEEN]:"15%",actions:"65px"},Aq=Object(LB.createStructuredSelector)(GB),Dq={onDoneNavigateTo:[s.l,{path:Object(v.e)({name:"endpointList"})}]},Nq=()=>{const e=Object(B.useHistory)(),{listData:t,pageIndex:a,pageSize:r,sortField:l,sortDirection:c,totalHits:u,listLoading:d,listError:m,uiQueryParams:b,hasSelectedEndpoint:g,policyItems:f,selectedPolicyId:y,policyItemsLoading:h,endpointPackageVersion:E,endpointsExist:x,autoRefreshInterval:j,isAutoRefreshEnabled:k,patternsError:O,metadataTransformStats:w}=Object(HB.b)(Aq),T=Object(HB.b)(GB.getEndpointPendingActionsCallback),{canReadEndpointList:I,canAccessFleet:C,canReadPolicyManagement:M,loading:_}=Object(ch.a)().endpointPrivileges,{search:F}=Object(p.m)(S.a.administration),{search:A}=Object(B.useLocation)(),{state:D={}}=Object(B.useLocation)(),{getAppUrl:N}=Object(ry.a)(),P=Object(o.useDispatch)(),R=u>9999?9999:u,L=Object(n.useMemo)((()=>f&&f.length>0),[f]),q=Object(n.useMemo)((()=>t&&t.length>0),[t]),z=Object(n.useMemo)((()=>({display:x?"flex":"none",maxWidth:200})),[x]),V=Object(n.useMemo)((()=>!(!x||!g&&k)),[x,g,k]),H=Object(n.useMemo)((()=>x?j:RB.a),[x,j]),G=Object(n.useMemo)((()=>x&&!O),[x,O]),Q=Object(n.useMemo)((()=>({pageIndex:a,pageSize:r,totalItemCount:R,pageSizeOptions:[...RB.f],showPerPageOptions:!0})),[a,r,R]),W=Object(n.useCallback)((({page:t,sort:a})=>{const{index:n,size:i}=t;e.push(Object(v.e)({name:"endpointList",...b,page_index:JSON.stringify(n),page_size:JSON.stringify(i),sort_direction:null==a?void 0:a.direction,sort_field:null==a?void 0:a.field}))}),[e,b]),K=Object(n.useMemo)((()=>({onCancelNavigateTo:[s.l,{path:Object(v.e)({name:"endpointList"})}],onCancelUrl:N({path:Object(v.e)({name:"endpointList"})}),onSaveNavigateTo:[s.l,{path:Object(v.e)({name:"endpointList"})}]})),[N]),Y=Object(vw.a)("fleet",{path:`/integrations/${E?`/endpoint-${E}`:""}/add-integration`,state:K}),J=Object(n.useMemo)((()=>{const e=Object(v.e)({name:"endpointList"},A);return{navigateTo:[s.l,{path:e}],label:$.i18n.translate("xpack.securitySolution.endpoint.policy.details.backToListTitle",{defaultMessage:"View all endpoints"}),href:N({path:e})}}),[N,A]),X=Object(n.useCallback)((()=>{P({type:"appRequestedEndpointList"})}),[P]),Z=Object(n.useCallback)((e=>{P({type:"userUpdatedEndpointListRefreshOptions",payload:{isAutoRefreshEnabled:!e.isPaused,autoRefreshInterval:e.refreshInterval}})}),[P]),ee=Object(n.useCallback)((()=>{}),[]),te=Object(vw.a)("fleet",{path:`/policies/${y}?openEnrollmentFlyout=true`,state:Dq}),ae=Object(n.useCallback)((e=>e.some((e=>"checked"in e&&"on"===e.checked&&(P({type:"userSelectedEndpointPolicy",payload:{selectedPolicyId:e.key}}),!0)))),[P]),ne=Object(n.useCallback)((e=>({"data-endpoint-id":e.metadata.agent.id})),[]),ie=Object(n.useMemo)((()=>(({canReadPolicyManagement:e,backToEndpointList:t,getHostPendingActions:a,queryParams:n,search:r,getAppUrl:s})=>{const o=$.i18n.translate("xpack.securitySolution.endpoint.list.lastActive",{defaultMessage:"Last active"}),l={paddingLeft:"6px"};return[{field:bq.a.HOSTNAME,width:Fq[bq.a.HOSTNAME],name:$.i18n.translate("xpack.securitySolution.endpoint.list.hostname",{defaultMessage:"Endpoint"}),sortable:!0,render:(e,t)=>{const a=Object(v.d)({...n,name:"endpointDetails",selected_endpoint:t.metadata.agent.id},r),o=s({path:a});return i.a.createElement(U.EuiToolTip,{content:e,anchorClassName:"eui-textTruncate"},i.a.createElement(VB,{name:e,href:o,route:a,dataTestSubj:"hostnameCellLink"}))}},{field:bq.a.HOST_STATUS,width:Fq[bq.a.HOST_STATUS],name:$.i18n.translate("xpack.securitySolution.endpoint.list.hostStatus",{defaultMessage:"Agent status"}),sortable:!0,render:(e,t)=>i.a.createElement(UB.a,{endpointHostInfo:t,pendingActions:a(t.metadata.agent.id),"data-test-subj":"rowHostStatus"})},{field:bq.a.POLICY_NAME,width:Fq[bq.a.POLICY_NAME],name:$.i18n.translate("xpack.securitySolution.endpoint.list.policy",{defaultMessage:"Policy"}),sortable:!0,truncateText:!0,render:(a,n)=>{const r=n.metadata.Endpoint.policy.applied;return i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiToolTip,{content:a,anchorClassName:"eui-textTruncate"},e?i.a.createElement(sq,{policyId:r.id,className:"eui-textTruncate","data-test-subj":"policyNameCellLink",backLink:t},a):i.a.createElement(i.a.Fragment,null,a)),r.endpoint_policy_version&&i.a.createElement(U.EuiText,{color:"subdued",size:"xs",style:{whiteSpace:"nowrap",...l},className:"eui-textTruncate","data-test-subj":"policyListRevNo"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.list.policy.revisionNumber",defaultMessage:"rev. {revNumber}",values:{revNumber:r.endpoint_policy_version}})),iq(r,n.policy_info)&&i.a.createElement(oq,{style:l,"data-test-subj":"rowPolicyOutOfDate"}))}},{field:bq.a.POLICY_STATUS,width:Fq[bq.a.POLICY_STATUS],name:$.i18n.translate("xpack.securitySolution.endpoint.list.policyStatus",{defaultMessage:"Policy status"}),sortable:!0,render:(e,t)=>{const a=Object(v.d)({name:"endpointPolicyResponse",...n,selected_endpoint:t.metadata.agent.id}),r=s({path:a});return i.a.createElement(U.EuiToolTip,{content:rq.d[e],anchorClassName:"eui-textTruncate"},i.a.createElement(U.EuiHealth,{color:rq.c[e],className:"eui-textTruncate eui-fullWidth","data-test-subj":"rowPolicyStatus"},i.a.createElement(VB,{name:rq.d[e],href:r,route:a,dataTestSubj:"policyStatusCellLink"})))}},{field:bq.a.HOST_OS_NAME,width:Fq[bq.a.HOST_OS_NAME],name:$.i18n.translate("xpack.securitySolution.endpoint.list.os",{defaultMessage:"OS"}),sortable:!0,render:e=>i.a.createElement(U.EuiToolTip,{content:e,anchorClassName:"eui-textTruncate"},i.a.createElement(U.EuiText,{size:"s",className:"eui-textTruncate eui-fullWidth"},i.a.createElement("p",{className:"eui-displayInline eui-TextTruncate"},e)))},{field:bq.a.HOST_IP,width:Fq[bq.a.HOST_IP],name:$.i18n.translate("xpack.securitySolution.endpoint.list.ip",{defaultMessage:"IP address"}),sortable:!0,render:e=>i.a.createElement(U.EuiToolTip,{content:e.toString().replace(",",", "),anchorClassName:"eui-textTruncate"},i.a.createElement(U.EuiText,{size:"s",className:"eui-textTruncate eui-fullWidth"},i.a.createElement("p",{className:"eui-displayInline eui-textTruncate"},e.toString().replace(",",", "))))},{field:bq.a.AGENT_VERSION,width:Fq[bq.a.AGENT_VERSION],name:$.i18n.translate("xpack.securitySolution.endpoint.list.endpointVersion",{defaultMessage:"Version"}),sortable:!0,render:e=>i.a.createElement(U.EuiToolTip,{content:e,anchorClassName:"eui-textTruncate"},i.a.createElement(U.EuiText,{size:"s",className:"eui-textTruncate eui-fullWidth"},i.a.createElement("p",{className:"eui-displayInline eui-TextTruncate"},e)))},{field:bq.a.LAST_SEEN,width:Fq[bq.a.LAST_SEEN],name:o,sortable:!0,render:e=>i.a.createElement(qs.a,{fieldName:o,value:e,className:"eui-textTruncate"})},{field:"",width:Fq.actions,name:$.i18n.translate("xpack.securitySolution.endpoint.list.actions",{defaultMessage:"Actions"}),actions:[{render:e=>i.a.createElement(Tq,{endpointMetadata:e.metadata})}]}]})({canReadPolicyManagement:M,backToEndpointList:J,getAppUrl:N,getHostPendingActions:T,queryParams:b,search:F})),[J,M,N,T,b,F]),re=Object(n.useMemo)((()=>({sort:{field:l,direction:c}})),[c,l]),se=Object(n.useMemo)((()=>[...t]),[t]),oe=Object(n.useMemo)((()=>{if(x)return i.a.createElement(U.EuiBasicTable,{"data-test-subj":"endpointListTable",items:se,columns:ie,error:null==m?void 0:m.message,pagination:Q,onChange:W,loading:d,rowProps:ne,sorting:re});if(I&&!C)return i.a.createElement(Iq.a,null,i.a.createElement(Eq,{loading:_}));if(!h&&L){const e=f.map((e=>({key:e.policy_id,label:e.name,checked:y===e.policy_id?"on":void 0})));return i.a.createElement(xq,{loading:d,onActionClick:te,actionDisabled:!y,handleSelectableOnChange:ae,selectionOptions:e})}return i.a.createElement(Iq.a,null,i.a.createElement(Eq,{loading:h,onActionClick:Y}))}),[C,I,ie,x,_,Y,te,ae,L,null==m?void 0:m.message,d,se,W,Q,h,f,y,ne,re]);return i.a.createElement(wq.a,{"data-test-subj":"endpointPage",hideHeader:!x,title:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.list.pageTitle",defaultMessage:"Endpoints"}),subtitle:i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.list.pageSubTitle",defaultMessage:"Hosts running Elastic Defend"}),headerBackComponent:i.a.createElement(Mq,{backLink:D.backLink})},g&&i.a.createElement(mq,null),i.a.createElement(i.a.Fragment,null,i.a.createElement(zB,{metadataTransformStats:w,hasNoPolicyData:!L}),i.a.createElement(U.EuiFlexGroup,{gutterSize:"s",alignItems:"center"},G&&i.a.createElement(U.EuiFlexItem,null,i.a.createElement(Oq,null)),i.a.createElement(U.EuiFlexItem,{grow:!1,style:z},i.a.createElement(_q,null,i.a.createElement(U.EuiSuperDatePicker,{className:"endpointListDatePicker",onTimeChange:ee,isDisabled:g,onRefresh:X,isPaused:V,refreshInterval:H,onRefreshChange:Z,isAutoRefreshOnly:!0})))),i.a.createElement(U.EuiSpacer,{size:"m"})),q&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiText,{color:"subdued",size:"xs","data-test-subj":"endpointListTableTotal"},u>1e4?i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.list.totalCount.limited",defaultMessage:"Showing {limit} of {totalItemCount, plural, one {# endpoint} other {# endpoints}}",values:{totalItemCount:u,limit:1e4}}):i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.list.totalCount",defaultMessage:"Showing {totalItemCount, plural, one {# endpoint} other {# endpoints}}",values:{totalItemCount:u}})),i.a.createElement(U.EuiHorizontalRule,{margin:"xs"})),oe)},Pq=Object(n.memo)((()=>i.a.createElement(q.c,null,i.a.createElement(q.a,{path:RB.h,exact:!0,component:Nq}),i.a.createElement(q.a,{path:"*",component:z.a}))));Pq.displayName="EndpointsContainer";var Rq=a(81),Lq=a(720),Bq=a(503);const qq=Object(n.memo)((({policyId:e,nonLinkCondition:t,"data-test-subj":a,children:r,...o})=>{const l=`(language:kuery,query:'united.endpoint.Endpoint.policy.applied.id : "${e}"')`,{search:c}=Object(B.useLocation)(),{getAppUrl:u}=Object(m.c)(),{toRoutePathWithBackOptions:d,toRouteUrl:p}=Object(n.useMemo)((()=>{const e=Object(v.e)({name:"endpointList",admin_query:l}),t=Object(v.h)(c),a={navigateTo:[s.l,{path:t}],label:$.i18n.translate("xpack.securitySolution.policy.backToPolicyList",{defaultMessage:"Back to policy list"}),href:u({path:t})};return{toRoutePathWithBackOptions:{pathname:Object(v.e)({name:"endpointList"}),search:`?admin_query=${l}`,state:{backLink:a}},toRouteUrl:u({path:e})}}),[u,l,c]),b=Object($B.a)(d);return t?i.a.createElement(U.EuiText,{size:"s","data-test-subj":`${a}_nonLink`},r):i.a.createElement(U.EuiLink,Ni()({href:p,"data-test-subj":a,onClick:b},o),r)}));qq.displayName="PolicyEndpointCount";const zq=Object(n.memo)((()=>{const{canReadEndpointList:e,loading:t}=Object(ch.a)().endpointPrivileges,{pagination:a,pageSizeOptions:r,setPagination:o}=Object(Lq.b)(),{search:l}=Object(B.useLocation)(),{getAppUrl:c}=Object(m.c)(),u=Object(m.n)(),{data:d,isFetching:p,error:b}=Object(Bq.b)({page:a.page,perPage:a.pageSize}),{data:g,isFetching:f}=Object(Bq.a)({customQueryOptions:{onError:e=>{u.addDanger($.i18n.translate("xpack.securitySolution.policyList.packageVersionError",{defaultMessage:"Error retrieving the endpoint package version"}))}}}),y=Object(n.useMemo)((()=>{var e;return null!==(e=null==d?void 0:d.total)&&void 0!==e?e:0}),[d]),h=Object(n.useMemo)((()=>Object(v.h)(l)),[l]),E=Object(n.useMemo)((()=>({navigateTo:[s.l,{path:h}],label:$.i18n.translate("xpack.securitySolution.policy.backToPolicyList",{defaultMessage:"Back to policy list"}),href:c({path:h})})),[c,h]),x=Object(vw.a)("fleet",{path:Rq.pagePathGetters.add_integration_to_policy({pkgkey:g?`/endpoint-${null==g?void 0:g.version}`:""})[1],state:{onCancelNavigateTo:[s.l,{path:h}],onCancelUrl:c({path:Object(v.h)()}),onSaveNavigateTo:[s.l,{path:h}]}}),j=Object(n.useMemo)((()=>{const a=$.i18n.translate("xpack.securitySolution.policy.list.updatedAt",{defaultMessage:"Last Updated"}),n=$.i18n.translate("xpack.securitySolution.policy.list.createdAt",{defaultMessage:"Date Created"});return[{field:"",name:$.i18n.translate("xpack.securitySolution.policy.list.name",{defaultMessage:"Name"}),truncateText:!0,render:e=>i.a.createElement(U.EuiToolTip,{content:e.name,anchorClassName:"eui-textTruncate"},i.a.createElement(sq,{policyId:e.id,className:"eui-textTruncate","data-test-subj":"policyNameCellLink",backLink:E},e.name))},{field:"created_by",name:$.i18n.translate("xpack.securitySolution.policy.list.createdBy",{defaultMessage:"Created by"}),truncateText:!0,render:e=>i.a.createElement(U.EuiFlexGroup,{responsive:!1,gutterSize:"xs",alignItems:"center"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiAvatar,{name:e,"data-test-subj":"created-by-avatar",size:"s"})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiText,{size:"s","data-test-subj":"created-by-name"},e)))},{field:"created_at",name:n,truncateText:!0,render:e=>i.a.createElement(qs.a,{fieldName:n,value:e,className:"eui-textTruncate"})},{field:"updated_by",name:$.i18n.translate("xpack.securitySolution.policy.list.lastUpdatedBy",{defaultMessage:"Last updated by"}),truncateText:!0,render:e=>i.a.createElement(U.EuiFlexGroup,{responsive:!1,gutterSize:"xs",alignItems:"center"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiAvatar,{name:e,"data-test-subj":"updated-by-avatar",size:"s"})),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiText,{size:"s","data-test-subj":"updated-by-name"},e)))},{field:"updated_at",name:a,truncateText:!0,render:e=>i.a.createElement(qs.a,{fieldName:a,value:e,className:"eui-textTruncate"})},{field:"",name:$.i18n.translate("xpack.securitySolution.policy.list.endpoints",{defaultMessage:"Endpoints"}),width:"8%",render:a=>{var n;const r=null!==(n=a.agents)&&void 0!==n?n:0;return i.a.createElement(qq,{className:"eui-textTruncate","data-test-subj":"policyEndpointCountLink",policyId:a.id,nonLinkCondition:t||!e||0===r},r)}}]}),[E,t,e]),S=Object(n.useCallback)((({page:e})=>{o({page:e.index+1,pageSize:e.size})}),[o]),k=Object(n.useMemo)((()=>({pageIndex:a.page-1,pageSize:a.pageSize,totalItemCount:y,pageSizeOptions:r})),[y,r,a.page,a.pageSize]),O=$.i18n.translate("xpack.securitySolution.policy.list.errorMessage",{defaultMessage:"Error while retrieving list of policies"});return i.a.createElement(wq.a,{"data-test-subj":"policyListPage",hideHeader:0===y,title:$.i18n.translate("xpack.securitySolution.policy.list.title",{defaultMessage:"Policies"}),subtitle:$.i18n.translate("xpack.securitySolution.policy.list.subtitle",{defaultMessage:"Use policies to customize endpoint and cloud workload protections and other configurations"})},y>0?i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiText,{color:"subdued",size:"xs","data-test-subj":"endpointListTableTotal"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.policy.list.totalCount",defaultMessage:"Showing {totalItemCount, plural, one {# policy} other {# policies}}",values:{totalItemCount:y}})),i.a.createElement(U.EuiHorizontalRule,{margin:"xs"}),i.a.createElement(U.EuiBasicTable,{"data-test-subj":"policyListTable",items:(null==d?void 0:d.items)||[],columns:j,pagination:k,onChange:S,loading:p,error:null!==b?O:""})):i.a.createElement(Iq.a,null,i.a.createElement(Eq,{loading:f,onActionClick:x,policyEntryPoint:!0})))}));zq.displayName="PolicyList";var $q=a(1380),Vq=a(1426);const Uq=Object(n.memo)((e=>{const t=Object(n.useMemo)((()=>[{key:"total",title:$.i18n.translate("xpack.securitySolution.endpoint.policyDetails.agentsSummary.totalTitle",{defaultMessage:"Total agents"}),health:""},{key:"online",title:$.i18n.translate("xpack.securitySolution.endpoint.policyDetails.agentsSummary.onlineTitle",{defaultMessage:"Healthy"}),health:"success"},{key:"error",title:$.i18n.translate("xpack.securitySolution.endpoint.policyDetails.agentsSummary.errorTitle",{defaultMessage:"Unhealthy"}),health:"warning"},{key:"offline",title:$.i18n.translate("xpack.securitySolution.endpoint.policyDetails.agentsSummary.offlineTitle",{defaultMessage:"Offline"}),health:"subdued"}]),[]),a=Object(n.useContext)(H.ThemeContext);return i.a.createElement(U.EuiFlexGroup,{gutterSize:"l",responsive:!1,"data-test-subj":"policyAgentsSummary"},t.map((({key:t,title:n,health:r})=>i.a.createElement(U.EuiFlexItem,{grow:!1,key:t,style:{marginRight:"total"===t?a.eui.euiSizeXXL:void 0}},i.a.createElement(U.EuiDescriptionList,{textStyle:"reverse",style:{textAlign:"right"},listItems:[{title:n,description:i.a.createElement(i.a.Fragment,null,r&&i.a.createElement(U.EuiHealth,{color:"warning"===r?a.eui.euiColorWarning:r,className:"eui-alignMiddle"}),i.a.createElement(U.EuiI18nNumber,{value:e[t]}))}]})))))}));Uq.displayName="AgentsSummary";var Hq=a(1491),Gq=a(65),Qq=a(1133),Wq=a(1492);const Kq=i.a.memo((({endpointCount:e,onCancel:t,onConfirm:a})=>i.a.createElement(U.EuiConfirmModal,{"data-test-subj":"policyDetailsConfirmModal",title:$.i18n.translate("xpack.securitySolution.endpoint.policy.details.updateConfirm.title",{defaultMessage:"Save and deploy changes"}),onCancel:t,onConfirm:a,confirmButtonText:$.i18n.translate("xpack.securitySolution.endpoint.policy.details.updateConfirm.confirmButtonTitle",{defaultMessage:"Save and deploy changes"}),cancelButtonText:$.i18n.translate("xpack.securitySolution.endpoint.policy.details.updateConfirm.cancelButtonTitle",{defaultMessage:"Cancel"})},e>0&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiCallOut,{"data-test-subj":"policyDetailsWarningCallout",title:$.i18n.translate("xpack.securitySolution.endpoint.policy.details.updateConfirm.warningTitle",{defaultMessage:"This action will update {endpointCount, plural, one {# endpoint} other {# endpoints}}",values:{endpointCount:e}})},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.details.updateConfirm.warningMessage",defaultMessage:"Saving these changes will apply updates to all endpoints assigned to this agent policy."})),i.a.createElement(U.EuiSpacer,{size:"xl"})),i.a.createElement("p",null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.details.updateConfirm.message",defaultMessage:"This action cannot be undone. Are you sure you wish to continue?"})))));Kq.displayName="ConfirmUpdate";const Yq=Object(n.memo)((({policy:e})=>{var t;const a=e,{services:{application:{navigateToApp:r}}}=Object(m.j)(),s=Object(m.n)(),l=Object(o.useDispatch)(),{state:c}=Object(B.useLocation)(),{canWritePolicyManagement:u}=Object(ch.a)().endpointPrivileges,{isLoading:d,mutateAsync:p}=(e=>{const t=Object(m.i)();return Object(Hu.useMutation)((({policy:e})=>{const a=Object(Qq.a)(e);return t.put(Gq.packagePolicyRouteService.getUpdatePath(e.id),{body:JSON.stringify(a)})}),void 0)})(),{data:b}=((e,t={})=>{const a=Object(m.i)();return Object(Hu.useQuery)({queryKey:["get-policy-agent-summary",e],...t,queryFn:async()=>(await a.get(Gq.agentRouteService.getStatusPath(),{query:{policyId:e}})).results})})(a.policy_id),[g,f]=Object(n.useState)(Object(it.cloneDeep)(a.inputs[0].config.policy.value)),[y,h]=Object(n.useState)(!1),[E,x]=Object(n.useState)(),j=u,S=null!==(t=null==a?void 0:a.name)&&void 0!==t?t:"",k=null==E?void 0:E.onCancelNavigateTo,O=Object(n.useMemo)((()=>k||[qM.APP_UI_ID,{path:Object(v.h)()}]),[k]),w=Object(n.useCallback)((e=>{f(e.updatedPolicy)}),[]),T=Object(vw.a)(...O),I=Object(n.useCallback)((()=>{h(!0)}),[]),C=Object(n.useCallback)((()=>{h(!1)}),[]),M=Object(n.useCallback)((()=>{const e=Object(it.cloneDeep)(a);e.inputs[0].config.policy.value=g,p({policy:e}).then((({item:e})=>{s.addSuccess({"data-test-subj":"policyDetailsSuccessMessage",title:$.i18n.translate("xpack.securitySolution.endpoint.policy.details.updateSuccessTitle",{defaultMessage:"Success!"}),text:$.i18n.translate("xpack.securitySolution.endpoint.policy.details.updateSuccessMessage",{defaultMessage:"Integration {name} has been updated.",values:{name:S}})}),E&&E.onSaveNavigateTo?r(...E.onSaveNavigateTo):l({type:"serverReturnedPolicyDetailsData",payload:{policyItem:e}})})).catch((e=>{s.addDanger({"data-test-subj":"policyDetailsFailureMessage",title:$.i18n.translate("xpack.securitySolution.endpoint.policy.details.updateErrorTitle",{defaultMessage:"Failed!"}),text:e.message})})),C()}),[l,C,r,a,S,g,E,p,s]);return Object(n.useEffect)((()=>{!E&&c&&x(c)}),[c,E]),i.a.createElement(i.a.Fragment,null,y&&i.a.createElement(Kq,{endpointCount:b?b.all:0,onCancel:C,onConfirm:M}),i.a.createElement(Wq.a,{policy:g,onChange:w,mode:j?"edit":"view","data-test-subj":"endpointPolicyForm"}),i.a.createElement(U.EuiSpacer,{size:"xxl"}),i.a.createElement(Hq.a.BottomBar,{paddingSize:"s"},i.a.createElement(U.EuiFlexGroup,{justifyContent:"flexEnd",gutterSize:"s"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButtonEmpty,{color:"text",onClick:T,"data-test-subj":"policyDetailsCancelButton",disabled:d},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.details.cancel",defaultMessage:"Cancel"}))),j&&i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{fill:!0,iconType:"save","data-test-subj":"policyDetailsSaveButton",onClick:I,isLoading:d},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.details.save",defaultMessage:"Save"}))))))}));Yq.displayName="PolicySettingsLayout";var Jq=a(794),Xq=a(290),Zq=a(381);const ez=(e,t,a,i,r)=>{const{getAppUrl:o}=Object(ry.a)(),{toRoutePath:l,toRouteUrl:c}=Object(n.useMemo)((()=>{const e=i(r);return{toRoutePath:e,toRouteUrl:o({path:e})}}),[o,i,r]),u=a(e),d=Object(n.useMemo)((()=>({backButtonLabel:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.empty.unassigned.backButtonLabel",{defaultMessage:"Back to {policyName} policy",values:{policyName:t}}),onBackButtonNavigateTo:[s.l,{path:u}],backButtonUrl:o({appId:s.l,path:u})})),[o,t,u]);return{onClickHandler:Object(vw.a)(s.l,{state:d,path:l}),toRouteUrl:c,state:d}},tz=Object(n.memo)((({policyId:e,policyName:t,listId:a,labels:r,canWriteArtifact:s=!1,getPolicyArtifactsPath:o,getArtifactPath:l})=>{const{canCreateArtifactsByPolicy:c}=Object(ch.a)().endpointPrivileges,{onClickHandler:u,toRouteUrl:d}=ez(e,t,o,l),p=Object($q.b)(a),m=Object(n.useCallback)((()=>p({show:"list"})),[p]);return i.a.createElement(U.EuiPageTemplate_Deprecated,{template:"centeredContent"},i.a.createElement(U.EuiEmptyPrompt,{iconType:"plusInCircle","data-test-subj":"policy-artifacts-empty-unassigned",title:i.a.createElement("h2",null,r.emptyUnassignedTitle),body:s?r.emptyUnassignedMessage(t):r.emptyUnassignedNoPrivilegesMessage(t),actions:[...c&&s?[i.a.createElement(U.EuiButton,{color:"primary",fill:!0,onClick:m,"data-test-subj":"unassigned-assign-artifacts-button"},r.emptyUnassignedPrimaryActionButtonTitle)]:[],s?i.a.createElement(U.EuiLink,{onClick:u,href:d,"data-test-subj":"unassigned-manage-artifacts-button"},r.emptyUnassignedSecondaryActionButtonTitle):null]}))}));tz.displayName="PolicyArtifactsEmptyUnassigned";const az=Object(n.memo)((({policyId:e,policyName:t,labels:a,canWriteArtifact:n=!1,getPolicyArtifactsPath:r,getArtifactPath:s})=>{const{onClickHandler:o,toRouteUrl:l}=ez(e,t,r,s,{show:"create"});return i.a.createElement(U.EuiPageTemplate_Deprecated,{template:"centeredContent"},i.a.createElement(U.EuiEmptyPrompt,{iconType:"plusInCircle","data-test-subj":"policy-artifacts-empty-unexisting",title:i.a.createElement("h2",null,a.emptyUnexistingTitle),body:a.emptyUnexistingMessage,actions:n?i.a.createElement(U.EuiButton,{color:"primary",fill:!0,onClick:o,href:l,"data-test-subj":"unexisting-manage-artifacts-button"},a.emptyUnexistingPrimaryActionButtonTitle):null}))}));az.displayName="PolicyArtifactsEmptyUnexisting";const nz=Object.freeze({emptyUnassignedTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.empty.unassigned.title",{defaultMessage:"No assigned artifacts"}),emptyUnassignedMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.empty.unassigned.content",{defaultMessage:"There are currently no artifacts assigned to {policyName}. Assign artifacts now or add and manage them on the artifacts page.",values:{policyName:e}}),emptyUnassignedPrimaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.empty.unassigned.primaryAction",{defaultMessage:"Assign artifacts"}),emptyUnassignedSecondaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.empty.unassigned.secondaryAction",{defaultMessage:"Manage artifacts"}),emptyUnassignedNoPrivilegesMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.empty.unassigned.noPrivileges.content",{defaultMessage:"There are currently no artifacts assigned to {policyName}.",values:{policyName:e}})}),iz=Object.freeze({emptyUnexistingTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.empty.unexisting.title",{defaultMessage:"No artifacts exist"}),emptyUnexistingMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.empty.unexisting.content",{defaultMessage:"There are currently no artifacts applied to your endpoints."}),emptyUnexistingPrimaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.empty.unexisting.action",{defaultMessage:"Add artifacts"})});var rz=a(1062),sz=a(731),oz=a(653),lz=a(1135),cz=a(107);const uz=G()(oz.e).withConfig({displayName:"GridHeaderContainer",componentId:"sc-cbi88a-0"})(["padding-top:0;padding-bottom:",";"],(({theme:e})=>e.eui.euiSizeS)),dz=Object(n.memo)((({"data-test-subj":e,expandAllIconType:t,onExpandCollapseAll:a})=>{const r=Object(cz.a)(e),s=Object(n.useMemo)((()=>i.a.createElement(U.EuiButtonIcon,{"data-test-subj":r("expandCollapseAllButton"),"aria-label":$.i18n.translate("xpack.securitySolution.artifactCardGrid.expandCollapseLabel",{defaultMessage:"{action} all cards",values:{action:"Expand"}}),iconType:t,onClick:()=>a(),style:{marginLeft:"-5px"}})),[r,t,a]);return i.a.createElement(uz,{"data-test-subj":e},i.a.createElement(oz.d,{expanded:!1,expandToggle:s,"data-test-subj":r("layout"),flushTop:!0,name:i.a.createElement(U.EuiText,{size:"xs","data-test-subj":r("name")},i.a.createElement("strong",null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.artifactCardGrid.nameColumn",defaultMessage:"Name"}))),description:i.a.createElement(U.EuiText,{size:"xs","data-test-subj":r("description")},i.a.createElement("strong",null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.artifactCardGrid.DescriptionColumn",defaultMessage:"Description"}))),effectScope:i.a.createElement(U.EuiText,{size:"xs","data-test-subj":r("assignment")},i.a.createElement("strong",null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.artifactCardGrid.assignmentColumn",defaultMessage:"Assignment"}))),actionMenu:!0}))}));dz.displayName="GridHeader";const pz=lz.a,mz=Object(n.memo)((({items:e,cardComponentProps:t,onPageChange:a,onExpandCollapse:r,"data-test-subj":s,...o})=>{const l=Object(cz.a)(s),c=e,u=Object(n.useMemo)((()=>{const e=new Map;for(const a of c)e.set(a,t?t(a):{});return e}),[t,c]),d=Object(n.useCallback)((e=>{const t=[],a=[];for(const[n,i]of u){const r=Boolean(i.expanded);(n===e?!r:r)?t.push(n):a.push(n)}r({expanded:t,collapsed:a})}),[u,r]),p=Object(n.useMemo)((()=>{for(const[e,t]of u)if(!Boolean(t.expanded))return!1;return!0}),[u]),m=Object(n.useCallback)((()=>{let e=[],t=[];p?t=Array.from(u.keys()):e=Array.from(u.keys()),r({expanded:e,collapsed:t})}),[u,r,p]),b=Object(n.useMemo)((()=>{const e=new Map;for(const[a,n]of u){var t;e.set(a,{...n,item:a,onExpandCollapse:()=>d(a),"data-test-subj":null!==(t=n["data-test-subj"])&&void 0!==t?t:l("card")})}return e}),[u,l,d]),g=Object(n.useCallback)((e=>b.get(e)),[b]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(dz,{expandAllIconType:p?"fold":"unfold",onExpandCollapseAll:m,"data-test-subj":l("header")}),i.a.createElement(pz,Ni()({},o,{"data-test-subj":s,items:c,ItemComponent:oz.c,itemComponentProps:g,onChange:a})))}));mz.displayName="ArtifactCardGrid";var bz=a(830);const gz=i.a.memo((({policy:e,apiClient:t,searchableFields:a,getArtifactPath:r,getPolicyArtifactsPath:o,labels:l,onDeleteActionCallback:c,canWriteArtifact:u=!1})=>{var d;(()=>{const e=Object(B.useHistory)(),{urlParams:t}=Object(Xq.a)();Object(n.useEffect)((()=>{(t.page_index&&!t.page||t.page_size&&!t.pageSize)&&e.replace(`${e.location.pathname}${e.location.search.replaceAll("page_size","pageSize").replaceAll(`page_index=${t.page_index}`,`page=${Number(t.page_index)+1}`)}`)}),[e,t.page,t.pageSize,t.page_index,t.page_size])})();const{getAppUrl:p}=Object(m.c)(),{canCreateArtifactsByPolicy:b}=Object(ch.a)().endpointPrivileges,g=Object(Bq.b)({perPage:1e3}),f=Object($q.b)(t.listId),{urlParams:y}=Object(Xq.a)(),[h,v]=Object(n.useState)(new Map),{state:E}=ez(e.id,e.name,o,r),{pageSizeOptions:x,pagination:j,setPagination:S}=Object(Lq.b)(),{data:k,isLoading:O,isRefetching:w}=Object(Zq.e)(t,{page:j.page,perPage:j.pageSize,filter:y.filter,policies:[e.id,"all"]},a),T=Object(n.useMemo)((()=>({pageSize:j.pageSize,pageIndex:j.page-1,pageSizeOptions:x,totalItemCount:(null==k?void 0:k.total)||0})),[null==k?void 0:k.total,x,j.page,j.pageSize]),I=Object(n.useCallback)((e=>{f({filter:e})}),[f]),C=Object(n.useCallback)((({expanded:e,collapsed:t})=>{const a=new Map(h);for(const t of e)a.set(t.id,!0);for(const e of t)a.set(e.id,!1);v(a)}),[h]),M=Object(n.useCallback)((({pageIndex:e,pageSize:t})=>{null!=k&&k.total&&S({page:e+1,pageSize:t})}),[null==k?void 0:k.total,S]),_=Object(n.useMemo)((()=>l.listTotalItemCountMessage((null==k?void 0:k.data.length)||0)),[null==k?void 0:k.data.length,l]),F=Object(sz.a)(null===(d=g.data)||void 0===d?void 0:d.items),A=Object(n.useCallback)((e=>{const t=r({filter:e.item_id}),a={icon:"controlsHorizontal",children:l.listFullDetailsActionTitle,href:p({appId:s.l,path:t}),navigateAppId:s.l,navigateOptions:{path:t,state:E},"data-test-subj":"view-full-details-action"},n=e,i=Object(bz.d)(n.tags),o={icon:"trash",children:l.listRemoveActionTitle,onClick:()=>{c(n)},disabled:i,toolTipContent:i?l.listRemoveActionNotAllowedMessage:void 0,toolTipPosition:"top","data-test-subj":"remove-from-policy-action"};return{expanded:h.get(n.id)||!1,actions:b&&u?[a,o]:[a],policies:F}}),[F,b,h,u,p,r,l.listFullDetailsActionTitle,l.listRemoveActionNotAllowedMessage,l.listRemoveActionTitle,c,E]);return i.a.createElement(i.a.Fragment,null,i.a.createElement(rz.a,{placeholder:l.listSearchPlaceholderMessage,defaultValue:y.filter,hideRefreshButton:!0,onSearch:I}),i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement(U.EuiText,{color:"subdued",size:"xs","data-test-subj":"policyDetailsArtifactsSearchCount"},_),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(mz,{items:(null==k?void 0:k.data)||[],onPageChange:M,onExpandCollapse:C,cardComponentProps:A,pagination:k?T:void 0,loading:O||w,"data-test-subj":"artifacts-collapsed-list"}))}));gz.displayName="PolicyArtifactsList";const fz=Object.freeze({listTotalItemCountMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.list.totalItemCount",{defaultMessage:"Showing {totalItemsCount, plural, one {# artifact} other {# artifacts}}",values:{totalItemsCount:e}}),listFullDetailsActionTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.list.fullDetailsAction",{defaultMessage:"View full details"}),listRemoveActionTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.list.removeAction",{defaultMessage:"Remove from policy"}),listRemoveActionNotAllowedMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.list.removeActionNotAllowed",{defaultMessage:"Globally applied artifact cannot be removed from policy."}),listSearchPlaceholderMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.list.search.placeholder",{defaultMessage:"Search on the fields below: name, description, value"})}),yz=i.a.memo((({artifacts:e,isListLoading:t,selectedArtifactIds:a,selectedArtifactsUpdated:r})=>{const s=Object(n.useMemo)((()=>a.reduce(((e,t)=>({...e,[t]:!0})),{})),[a]),o=Object(n.useMemo)((()=>{if(!e||!e.data.length)return null;const t=e.data;return i.a.createElement("div",{"data-test-subj":"artifactsList"},t.map((e=>i.a.createElement(oz.b,{key:e.id,item:e,isSelected:s[e.id]||!1,onToggleSelectedArtifact:t=>r(e.id,t)}))))}),[e,s,r]);return i.a.createElement(i.a.Fragment,null,t&&i.a.createElement(U.EuiProgress,{size:"xs",color:"primary","data-test-subj":"artifactsAssignableListLoader"}),i.a.createElement("div",null,o))}));yz.displayName="PolicyArtifactsAssignableList";const hz=i.a.memo((({policyItem:e,apiClient:t,searchableFields:a,onClose:r,labels:s})=>{const o=Object(m.n)(),l=Object(Hu.useQueryClient)(),[c,u]=Object(n.useState)([]),[d,p]=Object(n.useState)(""),b=Object(Zq.a)(t,{onSuccess:e=>{o.addSuccess({title:s.flyoutSuccessMessageTitle,text:s.flyoutSuccessMessageText(e)}),l.invalidateQueries(["list",t]),r()},onError:()=>{o.addDanger(s.flyoutErrorMessage)}}),{data:g,isLoading:f,isRefetching:y}=Object(Zq.e)(t,{perPage:100,filter:d,excludedPolicies:[e.id,"all"]},a),{data:h,isLoading:v}=Object(Zq.e)(t,{excludedPolicies:[e.id,"all"]},a),E=Object(n.useCallback)((e=>{u([]),p(e)}),[]),j=Object(n.useCallback)((()=>{if(!g)return;const t=[];c.forEach((a=>{const n=g.data.find((e=>e.id===a));n&&(n.tags=[...n.tags,`policy:${e.id}`],t.push(n))})),b.mutate(t)}),[b,g,e.id,c]),S=Object(n.useMemo)((()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiCallOut,{"data-test-subj":"artifacts-too-many-results",color:"warning",size:"s",heading:"h4",title:s.flyoutWarningCalloutTitle},s.flyoutWarningCalloutMessage(100)),i.a.createElement(U.EuiSpacer,{size:"m"}))),[s]),k=Object(n.useMemo)((()=>0!==(null==h?void 0:h.total)&&(0!==(null==g?void 0:g.total)||""!==d)),[null==h?void 0:h.total,null==g?void 0:g.total,d]),O=Object(n.useMemo)((()=>f||y||v),[v,f,y]),w=Object(n.useMemo)((()=>O?null:k?0===(null==g?void 0:g.total)?i.a.createElement(U.EuiEmptyPrompt,{titleSize:"xs","data-test-subj":"artifacts-no-items-found",body:i.a.createElement("p",null,s.flyoutNoSearchResultsMessage)}):void 0:i.a.createElement(U.EuiEmptyPrompt,{titleSize:"xs","data-test-subj":"artifacts-no-assignable-items",body:i.a.createElement("p",null,s.flyoutNoArtifactsToBeAssignedMessage)})),[O,k,null==g?void 0:g.total,s.flyoutNoArtifactsToBeAssignedMessage,s.flyoutNoSearchResultsMessage]);return i.a.createElement(U.EuiFlyout,{onClose:r,"data-test-subj":"artifacts-assign-flyout"},i.a.createElement(U.EuiFlyoutHeader,{hasBorder:!0},i.a.createElement(U.EuiTitle,{size:"m"},i.a.createElement("h2",null,s.flyoutTitle)),i.a.createElement(U.EuiSpacer,{size:"m"}),s.flyoutSubtitle(e.name)),i.a.createElement(U.EuiFlyoutBody,null,((null==g?void 0:g.total)||0)>100?S:null,!v&&k&&i.a.createElement(rz.a,{onSearch:E,placeholder:s.flyoutSearchPlaceholder,hideRefreshButton:!0}),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(yz,{"data-test-subj":"artifacts-assignable-list",artifacts:g,selectedArtifactIds:c,isListLoading:f||y,selectedArtifactsUpdated:(e,t)=>{u((a=>t?[...a,e]:Object(x.without)([e],a)))}}),w),i.a.createElement(U.EuiFlyoutFooter,null,i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceBetween"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButtonEmpty,{"data-test-subj":"artifacts-assign-cancel-button",onClick:r},s.flyoutCancelButtonTitle)),i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiButton,{className:"eui-textTruncate",style:{maxWidth:"300px"},"data-test-subj":"artifacts-assign-confirm-button",fill:!0,onClick:j,isLoading:b.isLoading||f||y,disabled:Object(x.isEmpty)(c),title:e.name},s.flyoutSubmitButtonTitle(e.name))))))}));hz.displayName="PolicyArtifactsFlyout";const vz=Object.freeze({flyoutWarningCalloutTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.flyout.searchWarning.title",{defaultMessage:"Limited search results"}),flyoutWarningCalloutMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.flyout.searchWarning.text",{defaultMessage:"Only the first {maxNumber} artifacts are displayed. Please use the search bar to refine the results.",values:{maxNumber:e}}),flyoutNoArtifactsToBeAssignedMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.flyout.noAssignable",{defaultMessage:"There are no artifacts that can be assigned to this policy."}),flyoutNoSearchResultsMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.flyout.noResults",{defaultMessage:"No items found"}),flyoutTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.flyout.title",{defaultMessage:"Assign artifacts"}),flyoutSubtitle:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.flyout.subtitle",{defaultMessage:"Select artifacts to add to {policyName}",values:{policyName:e}}),flyoutSearchPlaceholder:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.search.label",{defaultMessage:"Search artifacts"}),flyoutCancelButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.flyout.cancel",{defaultMessage:"Cancel"}),flyoutSubmitButtonTitle:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.flyout.confirm",{defaultMessage:"Assign to {policyName}",values:{policyName:e}}),flyoutErrorMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.flyout.toastError.text",{defaultMessage:"An error occurred updating artifacts"}),flyoutSuccessMessageTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.flyout.toastSuccess.title",{defaultMessage:"Success"}),flyoutSuccessMessageText:e=>e.length>1?$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.flyout.toastSuccess.textMultiples",{defaultMessage:"{count} artifacts have been added to your list.",values:{count:e.length}}):$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.flyout.toastSuccess.textSingle",{defaultMessage:'"{name}" has been added to your artifacts list.',values:{name:e[0].name}})});var Ez=a(487);const xz=i.a.memo((({policyId:e,policyName:t,apiClient:a,exception:r,onClose:s,labels:o})=>{const l=Object(m.n)(),c=Object(Hu.useQueryClient)(),{mutate:u,isLoading:d}=Object(Zq.a)(a,{onSuccess:()=>{l.addSuccess({title:o.deleteModalSuccessMessageTitle,text:o.deleteModalSuccessMessageText(r,t)}),c.invalidateQueries(["list",a]),s()},onError:e=>{l.addError(e,{title:o.deleteModalErrorMessage})}}),p=Object(n.useCallback)((()=>{const t={...r,tags:r.tags.filter((t=>t!==`${Ez.a}${e}`))};u([t])}),[r,e,u]),b=Object(n.useCallback)((()=>{d||s()}),[d,s]);return i.a.createElement(U.EuiConfirmModal,{onCancel:b,onConfirm:p,title:o.deleteModalTitle,cancelButtonText:o.deleteModalCancelButtonTitle,confirmButtonText:o.deleteModalSubmitButtonTitle,isLoading:d,"data-test-subj":"remove-from-policy-dialog"},i.a.createElement(U.EuiCallOut,{color:"warning",iconType:"help"},i.a.createElement("p",null,o.deleteModalImpactInfo)),i.a.createElement(U.EuiSpacer,null),i.a.createElement(U.EuiText,{size:"s"},i.a.createElement("p",null,o.deleteModalConfirmInfo)))})),jz=Object.freeze({deleteModalTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.list.removeDialog.title",{defaultMessage:"Remove artifact from policy"}),deleteModalImpactInfo:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.list.removeDialog.messageCallout",{defaultMessage:"This artifact will be removed only from this policy and can still be found and managed from the artifact page."}),deleteModalConfirmInfo:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.list.removeDialog.message",{defaultMessage:"Are you sure you wish to continue?"}),deleteModalSubmitButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.list.removeDialog.confirmLabel",{defaultMessage:"Remove from policy"}),deleteModalCancelButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.list.removeDialog.cancelLabel",{defaultMessage:"Cancel"}),deleteModalSuccessMessageTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.list.removeDialog.successToastTitle",{defaultMessage:"Successfully removed"}),deleteModalSuccessMessageText:(e,t)=>$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.list.removeDialog.successToastText",{defaultMessage:'"{artifactName}" has been removed from {policyName} policy',values:{artifactName:e.name,policyName:t}}),deleteModalErrorMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.list.removeDialog.errorToastTitle",{defaultMessage:"Error while attempting to remove artifact"})}),Sz=Object.freeze({layoutTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.title",{defaultMessage:"Assigned artifacts"}),layoutAssignButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.assignToPolicy",{defaultMessage:"Assign artifact to policy"}),layoutViewAllLinkMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.about.viewAllLinkLabel",{defaultMessage:"view all artifacts"}),layoutAboutMessage:(e,t)=>$.i18n.translate("xpack.securitySolution.endpoint.policy.artifacts.layout.about",{defaultMessage:"There {count, plural, one {is} other {are}} {count} {count, plural, =1 {artifact} other {artifacts}} associated with this policy. Click here to view all artifacts",values:{count:e}})}),kz=Object.freeze({...Sz,...jz,...vz,...nz,...iz,...fz}),Oz=i.a.memo((({policyItem:e,labels:t={},getExceptionsListApiClient:a,searchableFields:r,getArtifactPath:o,getPolicyArtifactsPath:l,canWriteArtifact:c=!1})=>{const u=Object(n.useMemo)((()=>a()),[a]),{getAppUrl:d}=Object(m.c)(),p=Object($q.b)(u.listId),{canCreateArtifactsByPolicy:b}=Object(ch.a)().endpointPrivileges,{urlParams:g}=Object(Xq.a)(),[f,y]=Object(n.useState)(),h=Object(n.useMemo)((()=>({...kz,...t})),[t]),{data:v,isLoading:E}=Object(Zq.e)(u,{policies:e?[e.id,"all"]:[]},r),{data:x,isLoading:j,isRefetching:S}=Object(Zq.e)(u,{},r,{},["allExisting"]),k=Object(n.useCallback)((()=>{p({show:"list"})}),[p]),O=Object(n.useCallback)((()=>{p({show:void 0})}),[p]),w=Object(n.useCallback)((()=>{y(void 0)}),[y]),T=Object(n.useCallback)((e=>{y(e)}),[y]),I=Object(n.useMemo)((()=>i.a.createElement(U.EuiButton,{fill:!0,iconType:"plusInCircle","data-test-subj":"artifacts-assign-button",onClick:k},h.layoutAssignButtonTitle)),[k,h.layoutAssignButtonTitle]),C=Object(n.useMemo)((()=>{const e=i.a.createElement(U.EuiLink,{href:d({appId:s.l,path:o()}),target:"_blank"},h.layoutViewAllLinkMessage);return h.layoutAboutMessage((null==v?void 0:v.total)||0,e)}),[d,o,h,null==v?void 0:v.total]),M=Object(n.useMemo)((()=>E||j||S),[E,j,S]),_=Object(n.useMemo)((()=>v&&0===v.total),[v]);return!e||M?i.a.createElement(Jq.a,{"data-test-subj":"policy-artifacts-loading-spinner"}):_?i.a.createElement(i.a.Fragment,null,b&&"list"===g.show&&i.a.createElement(hz,{policyItem:e,apiClient:u,searchableFields:[...r],onClose:O,labels:h}),x&&0!==x.total?i.a.createElement(tz,{policyId:e.id,policyName:e.name,listId:u.listId,labels:h,canWriteArtifact:c,getPolicyArtifactsPath:l,getArtifactPath:o}):i.a.createElement(az,{policyId:e.id,policyName:e.name,labels:h,canWriteArtifact:c,getPolicyArtifactsPath:l,getArtifactPath:o})):i.a.createElement("div",null,i.a.createElement(U.EuiPageHeader,{alignItems:"center"},i.a.createElement(U.EuiPageHeaderSection,{"data-test-subj":"policy-artifacts-header-section"},i.a.createElement(U.EuiTitle,{size:"m"},i.a.createElement("h2",null,h.layoutTitle)),i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement(U.EuiText,{size:"xs","data-test-subj":"policy-artifacts-layout-about"},i.a.createElement("p",null,C))),i.a.createElement(U.EuiPageHeaderSection,null,b&&c&&I)),b&&c&&"list"===g.show&&i.a.createElement(hz,{policyItem:e,apiClient:u,searchableFields:[...r],onClose:O,labels:h}),f&&i.a.createElement(xz,{policyId:e.id,policyName:e.name,apiClient:u,exception:f,onClose:w,labels:h}),i.a.createElement(U.EuiSpacer,{size:"l"}),i.a.createElement(U.EuiPageContent_Deprecated,{hasBorder:!1,hasShadow:!1,paddingSize:"none",color:"transparent",borderRadius:"none"},i.a.createElement(gz,{policy:e,apiClient:u,searchableFields:[...r],labels:h,onDeleteActionCallback:T,canWriteArtifact:c,getPolicyArtifactsPath:l,getArtifactPath:o})))}));Oz.displayName="PolicyArtifactsLayout";const wz=Object.freeze({deleteModalTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.list.removeDialog.title",{defaultMessage:"Remove event filter from policy"}),deleteModalImpactInfo:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.list.removeDialog.messageCallout",{defaultMessage:"This event filter will be removed only from this policy and can still be found and managed from the artifact page."}),deleteModalErrorMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.list.removeDialog.errorToastTitle",{defaultMessage:"Error while attempting to remove event filter"}),flyoutWarningCalloutMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.layout.flyout.searchWarning.text",{defaultMessage:"Only the first {maxNumber} event filters are displayed. Please use the search bar to refine the results.",values:{maxNumber:e}}),flyoutNoArtifactsToBeAssignedMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.layout.flyout.noAssignable",{defaultMessage:"There are no event filters that can be assigned to this policy."}),flyoutTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.layout.flyout.title",{defaultMessage:"Assign event filters"}),flyoutSubtitle:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.layout.flyout.subtitle",{defaultMessage:"Select event filters to add to {policyName}",values:{policyName:e}}),flyoutSearchPlaceholder:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.layout.search.label",{defaultMessage:"Search event filters"}),flyoutErrorMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.layout.flyout.toastError.text",{defaultMessage:"An error occurred updating event filters"}),flyoutSuccessMessageText:e=>e.length>1?$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.layout.flyout.toastSuccess.textMultiples",{defaultMessage:"{count} event filters have been added to your list.",values:{count:e.length}}):$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.layout.flyout.toastSuccess.textSingle",{defaultMessage:'"{name}" has been added to your event filter list.',values:{name:e[0].name}}),emptyUnassignedTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.empty.unassigned.title",{defaultMessage:"No assigned event filters"}),emptyUnassignedMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.empty.unassigned.content",{defaultMessage:"There are currently no event filters assigned to {policyName}. Assign event filters now or add and manage them on the event filters page.",values:{policyName:e}}),emptyUnassignedPrimaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.empty.unassigned.primaryAction",{defaultMessage:"Assign event filters"}),emptyUnassignedSecondaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.empty.unassigned.secondaryAction",{defaultMessage:"Manage event filters"}),emptyUnassignedNoPrivilegesMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.empty.unassigned.noPrivileges.content",{defaultMessage:"There are currently no event filters assigned to {policyName}",values:{policyName:e}}),emptyUnexistingTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.empty.unexisting.title",{defaultMessage:"No event filters exist"}),emptyUnexistingMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.empty.unexisting.content",{defaultMessage:"There are currently no event filters applied to your endpoints."}),emptyUnexistingPrimaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.empty.unexisting.action",{defaultMessage:"Add event filters"}),listTotalItemCountMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.list.totalItemCount",{defaultMessage:"Showing {totalItemsCount, plural, one {# event filter} other {# event filters}}",values:{totalItemsCount:e}}),listRemoveActionNotAllowedMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.list.removeActionNotAllowed",{defaultMessage:"Globally applied event filter cannot be removed from policy."}),listSearchPlaceholderMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.list.search.placeholder",{defaultMessage:"Search on the fields below: name, description, comments, value"}),layoutTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.layout.title",{defaultMessage:"Assigned event filters"}),layoutAssignButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.layout.assignToPolicy",{defaultMessage:"Assign event filters to policy"}),layoutViewAllLinkMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.eventFilters.layout.about.viewAllLinkLabel",{defaultMessage:"view all event filters"})}),Tz=Object.freeze({deleteModalTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.list.removeDialog.title",{defaultMessage:"Remove trusted application from policy"}),deleteModalImpactInfo:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.list.removeDialog.messageCallout",{defaultMessage:"This trusted application will be removed only from this policy and can still be found and managed from the artifact page."}),deleteModalErrorMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.list.removeDialog.errorToastTitle",{defaultMessage:"Error while attempting to remove trusted app"}),flyoutWarningCalloutMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.searchWarning.text",{defaultMessage:"Only the first {maxNumber} trusted applications are displayed. Please use the search bar to refine the results.",values:{maxNumber:e}}),flyoutNoArtifactsToBeAssignedMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.noAssignable",{defaultMessage:"There are no trusted applications that can be assigned to this policy."}),flyoutTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.title",{defaultMessage:"Assign trusted applications"}),flyoutSubtitle:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.subtitle",{defaultMessage:"Select trusted applications to add to {policyName}",values:{policyName:e}}),flyoutSearchPlaceholder:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.layout.search.label",{defaultMessage:"Search trusted applications"}),flyoutErrorMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.toastError.text",{defaultMessage:"An error occurred updating trusted applications"}),flyoutSuccessMessageText:e=>e.length>1?$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.toastSuccess.textMultiples",{defaultMessage:"{count} trusted applications have been added to your list.",values:{count:e.length}}):$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.layout.flyout.toastSuccess.textSingle",{defaultMessage:'"{name}" has been added to your trusted application list.',values:{name:e[0].name}}),emptyUnassignedTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.empty.unassigned.title",{defaultMessage:"No assigned trusted applications"}),emptyUnassignedMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.empty.unassigned.content",{defaultMessage:"There are currently no trusted applications assigned to {policyName}. Assign trusted applications now or add and manage them on the trusted applications page.",values:{policyName:e}}),emptyUnassignedPrimaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.empty.unassigned.primaryAction",{defaultMessage:"Assign trusted applications"}),emptyUnassignedSecondaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.empty.unassigned.secondaryAction",{defaultMessage:"Manage trusted applications"}),emptyUnassignedNoPrivilegesMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.empty.unassigned.noPrivileges.content",{defaultMessage:"There are currently no trusted applications assigned to {policyName}.",values:{policyName:e}}),emptyUnexistingTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.empty.unexisting.title",{defaultMessage:"No trusted applications exist"}),emptyUnexistingMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.empty.unexisting.content",{defaultMessage:"There are currently no trusted applications applied to your endpoints."}),emptyUnexistingPrimaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.empty.unexisting.action",{defaultMessage:"Add trusted applications"}),listTotalItemCountMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.list.totalItemCount",{defaultMessage:"Showing {totalItemsCount, plural, one {# trusted app} other {# trusted applications}}",values:{totalItemsCount:e}}),listRemoveActionNotAllowedMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.list.removeActionNotAllowed",{defaultMessage:"Globally applied trusted application cannot be removed from policy."}),listSearchPlaceholderMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.list.search.placeholder",{defaultMessage:"Search on the fields below: name, description, value"}),layoutTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.layout.title",{defaultMessage:"Assigned trusted applications"}),layoutAssignButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.layout.assignToPolicy",{defaultMessage:"Assign trusted applications to policy"}),layoutViewAllLinkMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.trustedApps.layout.about.viewAllLinkLabel",{defaultMessage:"view all trusted applications"})}),Iz=Object.freeze({deleteModalTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.list.removeDialog.title",{defaultMessage:"Remove host isolation exception from policy"}),deleteModalImpactInfo:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.list.removeDialog.messageCallout",{defaultMessage:"This host isolation exception will be removed only from this policy and can still be found and managed from the artifact page."}),deleteModalErrorMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.list.removeDialog.errorToastTitle",{defaultMessage:"Error while attempting to remove host isolation exception"}),flyoutWarningCalloutMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.layout.flyout.searchWarning.text",{defaultMessage:"Only the first {maxNumber} host isolation exceptions are displayed. Please use the search bar to refine the results.",values:{maxNumber:e}}),flyoutNoArtifactsToBeAssignedMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.layout.flyout.noAssignable",{defaultMessage:"There are no host isolation exceptions that can be assigned to this policy."}),flyoutTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.layout.flyout.title",{defaultMessage:"Assign host isolation exceptions"}),flyoutSubtitle:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.layout.flyout.subtitle",{defaultMessage:"Select host isolation exceptions to add to {policyName}",values:{policyName:e}}),flyoutSearchPlaceholder:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.layout.search.label",{defaultMessage:"Search host isolation exceptions"}),flyoutErrorMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.layout.flyout.toastError.text",{defaultMessage:"An error occurred updating host isolation exceptions"}),flyoutSuccessMessageText:e=>e.length>1?$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.layout.flyout.toastSuccess.textMultiples",{defaultMessage:"{count} host isolation exceptions have been added to your list.",values:{count:e.length}}):$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.layout.flyout.toastSuccess.textSingle",{defaultMessage:'"{name}" has been added to your host isolation exception list.',values:{name:e[0].name}}),emptyUnassignedTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.empty.unassigned.title",{defaultMessage:"No assigned host isolation exceptions"}),emptyUnassignedMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.empty.unassigned.content",{defaultMessage:"There are currently no host isolation exceptions assigned to {policyName}. Assign host isolation exceptions now or add and manage them on the host isolation exceptions page.",values:{policyName:e}}),emptyUnassignedPrimaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.empty.unassigned.primaryAction",{defaultMessage:"Assign host isolation exceptions"}),emptyUnassignedSecondaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.empty.unassigned.secondaryAction",{defaultMessage:"Manage host isolation exceptions"}),emptyUnassignedNoPrivilegesMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.empty.unassigned.noPrivileges.content",{defaultMessage:"There are currently no host isolation exceptions assigned to {policyName}.",values:{policyName:e}}),emptyUnexistingTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.empty.unexisting.title",{defaultMessage:"No host isolation exceptions exist"}),emptyUnexistingMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.empty.unexisting.content",{defaultMessage:"There are currently no host isolation exceptions applied to your endpoints."}),emptyUnexistingPrimaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.empty.unexisting.action",{defaultMessage:"Add host isolation exceptions"}),listTotalItemCountMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.list.totalItemCount",{defaultMessage:"Showing {totalItemsCount, plural, one {# host isolation exception} other {# host isolation exceptions}}",values:{totalItemsCount:e}}),listRemoveActionNotAllowedMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.list.removeActionNotAllowed",{defaultMessage:"Globally applied host isolation exception cannot be removed from policy."}),listSearchPlaceholderMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.list.search.placeholder",{defaultMessage:"Search on the fields below: name, description, IP"}),layoutTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.layout.title",{defaultMessage:"Assigned host isolation exceptions"}),layoutAssignButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.layout.assignToPolicy",{defaultMessage:"Assign host isolation exceptions to policy"}),layoutViewAllLinkMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.hostIsolationException.layout.about.viewAllLinkLabel",{defaultMessage:"view all host isolation exceptions"})}),Cz=Object.freeze({deleteModalTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.list.removeDialog.title",{defaultMessage:"Remove blocklist entry from policy"}),deleteModalImpactInfo:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.list.removeDialog.messageCallout",{defaultMessage:"This blocklist entry will be removed only from this policy and can still be found and managed from the artifact page."}),deleteModalErrorMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.list.removeDialog.errorToastTitle",{defaultMessage:"Error while attempting to remove blocklist entry"}),flyoutWarningCalloutMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.layout.flyout.searchWarning.text",{defaultMessage:"Only the first {maxNumber} blocklist entries are displayed. Please use the search bar to refine the results.",values:{maxNumber:e}}),flyoutNoArtifactsToBeAssignedMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.layout.flyout.noAssignable",{defaultMessage:"There are no blocklist entries that can be assigned to this policy."}),flyoutTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.layout.flyout.title",{defaultMessage:"Assign blocklist entries"}),flyoutSubtitle:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.layout.flyout.subtitle",{defaultMessage:"Select blocklist entries to add to {policyName}",values:{policyName:e}}),flyoutSearchPlaceholder:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.layout.search.label",{defaultMessage:"Search blocklist entries"}),flyoutErrorMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.layout.flyout.toastError.text",{defaultMessage:"An error occurred updating blocklist entry"}),flyoutSuccessMessageText:e=>e.length>1?$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.layout.flyout.toastSuccess.textMultiples",{defaultMessage:"{count} blocklist entries have been added to your list.",values:{count:e.length}}):$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.layout.flyout.toastSuccess.textSingle",{defaultMessage:'"{name}" blocklist has been added to your list.',values:{name:e[0].name}}),emptyUnassignedTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.empty.unassigned.title",{defaultMessage:"No assigned blocklist entries"}),emptyUnassignedMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.empty.unassigned.content",{defaultMessage:"There are currently no blocklist entries assigned to {policyName}. Assign blocklist entries now or add and manage them on the blocklist page.",values:{policyName:e}}),emptyUnassignedPrimaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.empty.unassigned.primaryAction",{defaultMessage:"Assign blocklist entry"}),emptyUnassignedSecondaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.empty.unassigned.secondaryAction",{defaultMessage:"Manage blocklist entries"}),emptyUnassignedNoPrivilegesMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.empty.unassigned.noPrivileges.content",{defaultMessage:"There are currently no blocklist entries assigned to {policyName}.",values:{policyName:e}}),emptyUnexistingTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.empty.unexisting.title",{defaultMessage:"No blocklists entries exist"}),emptyUnexistingMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.empty.unexisting.content",{defaultMessage:"There are currently no blocklist entries applied to your endpoints."}),emptyUnexistingPrimaryActionButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.empty.unexisting.action",{defaultMessage:"Add blocklist entry"}),listTotalItemCountMessage:e=>$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklists.list.totalItemCount",{defaultMessage:"Showing {totalItemsCount, plural, one {# blocklist entry} other {# blocklist entries}}",values:{totalItemsCount:e}}),listRemoveActionNotAllowedMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.list.removeActionNotAllowed",{defaultMessage:"Globally applied blocklist cannot be removed from policy."}),listSearchPlaceholderMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.list.search.placeholder",{defaultMessage:"Search on the fields below: name, description, value"}),layoutTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.layout.title",{defaultMessage:"Assigned blocklist entries"}),layoutAssignButtonTitle:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.layout.assignToPolicy",{defaultMessage:"Assign blocklist entry to policy"}),layoutViewAllLinkMessage:$.i18n.translate("xpack.securitySolution.endpoint.policy.blocklist.layout.about.viewAllLinkLabel",{defaultMessage:"view all blocklist entries"})});var Mz,_z=a(1118),Fz=a(574),Az=a(1055),Dz=a(1120),Nz=a(1119),Pz=a(575),Rz=a(937),Lz=a(1381);!function(e){e.SETTINGS="settings",e.TRUSTED_APPS="trustedApps",e.EVENT_FILTERS="eventFilters",e.HOST_ISOLATION_EXCEPTIONS="hostIsolationExceptions",e.BLOCKLISTS="blocklists"}(Mz||(Mz={}));const Bz=i.a.memo((()=>{const e=Object(B.useHistory)(),t=Object(m.i)(),a=Object(m.n)(),r=Object($q.c)(Vq.g),s=Object($q.c)(Vq.h),o=Object($q.c)(Vq.f),l=Object($q.c)(Vq.e),c=Object($q.c)(Vq.d),u=Object($q.c)(Vq.j),d=Object($q.c)(Vq.i),{canReadTrustedApplications:p,canWriteTrustedApplications:b,canReadEventFilters:g,canWriteEventFilters:f,canReadHostIsolationExceptions:y,canWriteHostIsolationExceptions:h,canReadBlocklist:E,canWriteBlocklist:x,loading:j}=Object(ch.a)().endpointPrivileges,{state:S={}}=Object(B.useLocation)();Object(n.useEffect)((()=>{(s&&!p||o&&!g||l&&!y||c&&!E)&&(e.replace(Object(v.j)(u)),a.addDanger($.i18n.translate("xpack.securitySolution.policyDetails.missingArtifactAccess",{defaultMessage:"You do not have the required Kibana permissions to use the given artifact."})))}),[E,g,y,p,e,c,o,l,s,u,a]);const k=Object(n.useCallback)((()=>_z.a.getInstance(t)),[t]),O=Object(n.useCallback)((()=>Fz.a.getInstance(t)),[t]),w=Object(n.useCallback)((()=>Dz.a.getInstance(t)),[t]),T=Object(n.useCallback)((()=>Az.a.getInstance(t)),[t]),I=Object(n.useMemo)((()=>{const e={...Tz,layoutAboutMessage:(e,t)=>i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.trustedApps.list.about",defaultMessage:"There {count, plural, one {is} other {are}} {count} trusted {count, plural, =1 {application} other {applications}} associated with this policy. Click here to {link}",values:{count:e,link:t}})},t={...wz,layoutAboutMessage:(e,t)=>i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.eventFilters.list.about",defaultMessage:"There {count, plural, one {is} other {are}} {count} event {count, plural, =1 {filter} other {filters}} associated with this policy. Click here to {link}",values:{count:e,link:t}})},a={...Iz,layoutAboutMessage:(e,t)=>i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.hostIsolationExceptions.list.about",defaultMessage:"There {count, plural, one {is} other {are}} {count} host isolation {count, plural, =1 {exception} other {exceptions}} associated with this policy. Click here to {link}",values:{count:e,link:t}})},n={...Cz,layoutAboutMessage:(e,t)=>i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.endpoint.policy.blocklist.list.about",defaultMessage:"There {count, plural, one {is} other {are}} {count} {count, plural, =1 {blocklist} other {blocklist entries}} associated with this policy. Click here to {link}",values:{count:e,link:t}})};return{[Mz.SETTINGS]:{id:Mz.SETTINGS,name:$.i18n.translate("xpack.securitySolution.endpoint.policy.details.tabs.policyForm",{defaultMessage:"Policy settings"}),content:i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,null),i.a.createElement(Yq,{policy:d}))},[Mz.TRUSTED_APPS]:p?{id:Mz.TRUSTED_APPS,name:$.i18n.translate("xpack.securitySolution.endpoint.policy.details.tabs.trustedApps",{defaultMessage:"Trusted applications"}),content:i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,null),i.a.createElement(Oz,{policyItem:d,labels:e,getExceptionsListApiClient:k,searchableFields:Nz.a,getArtifactPath:v.o,getPolicyArtifactsPath:v.k,canWriteArtifact:b}))}:void 0,[Mz.EVENT_FILTERS]:g?{id:Mz.EVENT_FILTERS,name:$.i18n.translate("xpack.securitySolution.endpoint.policy.details.tabs.eventFilters",{defaultMessage:"Event filters"}),content:i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,null),i.a.createElement(Oz,{policyItem:d,labels:t,getExceptionsListApiClient:O,searchableFields:Pz.d,getArtifactPath:v.f,getPolicyArtifactsPath:v.l,canWriteArtifact:f}))}:void 0,[Mz.HOST_ISOLATION_EXCEPTIONS]:y?{id:Mz.HOST_ISOLATION_EXCEPTIONS,name:$.i18n.translate("xpack.securitySolution.endpoint.policy.details.tabs.isInHostIsolationExceptions",{defaultMessage:"Host isolation exceptions"}),content:i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,null),i.a.createElement(Oz,{policyItem:d,labels:a,getExceptionsListApiClient:w,searchableFields:Rz.b,getArtifactPath:v.g,getPolicyArtifactsPath:v.m,canWriteArtifact:h}))}:void 0,[Mz.BLOCKLISTS]:E?{id:Mz.BLOCKLISTS,name:$.i18n.translate("xpack.securitySolution.endpoint.policy.details.tabs.blocklists",{defaultMessage:"Blocklist"}),content:i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,null),i.a.createElement(Oz,{policyItem:d,labels:n,getExceptionsListApiClient:T,searchableFields:Lz.b,getArtifactPath:v.c,getPolicyArtifactsPath:v.i,canWriteArtifact:x}))}:void 0}}),[p,b,g,f,y,h,E,x,O,w,T,k,d]),C=Object(n.useMemo)((()=>Object.values(I).filter((e=>void 0!==e))),[I]),M=Object(n.useMemo)((()=>{const e=I[Mz.SETTINGS];let t;return r?t=I[Mz.SETTINGS]:s?t=I[Mz.TRUSTED_APPS]:o?t=I[Mz.EVENT_FILTERS]:l?t=I[Mz.HOST_ISOLATION_EXCEPTIONS]:c&&(t=I[Mz.BLOCKLISTS]),t||e}),[I,r,s,o,l,c]),_=Object(n.useCallback)((t=>{let a="";switch(t.id){case Mz.SETTINGS:a=Object(v.j)(u);break;case Mz.TRUSTED_APPS:a=Object(v.n)(u);break;case Mz.EVENT_FILTERS:a=Object(v.l)(u);break;case Mz.HOST_ISOLATION_EXCEPTIONS:a=Object(v.m)(u);break;case Mz.BLOCKLISTS:a=Object(v.i)(u)}e.push(a,null!=S&&S.backLink?{backLink:S.backLink}:null)}),[e,u,S]);return j?i.a.createElement(Jq.a,{"data-test-subj":"privilegesLoading"}):i.a.createElement(U.EuiTabbedContent,{tabs:C,selectedTab:M,size:"l",onTabClick:_})}));Bz.displayName="PolicyTabs";const qz=i.a.memo((()=>{var e,t,a,r,o,l;const{state:c={}}=Object(B.useLocation)(),{getAppUrl:u}=Object(m.c)(),d=Object($q.c)(Vq.b),p=Object($q.c)(Vq.i),b=Object($q.c)(Vq.a),g=null!==(e=null==p?void 0:p.name)&&void 0!==e?e:"",f=null!==(t=null==p?void 0:p.description)&&void 0!==t?t:void 0,y=Object(n.useMemo)((()=>{if(null!=c&&c.backLink)return{onBackButtonNavigateTo:c.backLink.navigateTo,backButtonLabel:c.backLink.label,backButtonUrl:c.backLink.href};const e=Object(v.h)();return{backButtonLabel:$.i18n.translate("xpack.securitySolution.policyDetails.backToPolicyButton",{defaultMessage:"Back to policy list"}),backButtonUrl:u({path:e}),onBackButtonNavigateTo:[s.l,{path:e}]}}),[u,null==c?void 0:c.backLink]),h=i.a.createElement(Uq,{total:null!==(a=null==b?void 0:b.total)&&void 0!==a?a:0,online:null!==(r=null==b?void 0:b.online)&&void 0!==r?r:0,offline:null!==(o=null==b?void 0:b.offline)&&void 0!==o?o:0,error:null!==(l=null==b?void 0:b.error)&&void 0!==l?l:0}),E=i.a.createElement(Cq.a,Ni()({},y,{"data-test-subj":"policyDetailsBackLink"})),x=Object(n.useMemo)((()=>d?i.a.createElement(U.EuiPageTemplate_Deprecated,{template:"centeredContent"},i.a.createElement(U.EuiCallOut,{color:"danger",title:null==d?void 0:d.error},i.a.createElement("span",{"data-test-subj":"policyDetailsIdNotFoundMessage"},null==d?void 0:d.message))):p?i.a.createElement(Bz,null):i.a.createElement(U.EuiPageTemplate_Deprecated,{template:"centeredContent"},i.a.createElement(U.EuiLoadingSpinner,{className:"essentialAnimation",size:"xl","data-test-subj":"policyDetailsLoading"}))),[d,p]);return i.a.createElement(wq.a,{"data-test-subj":"policyDetailsPage",title:g,subtitle:f,headerBackComponent:E,actions:d?void 0:h,restrictWidth:!0,hasBottomBorder:!1},x)}));qz.displayName="PolicyDetails";const zz=Object(n.memo)((()=>i.a.createElement(q.c,null,i.a.createElement(q.a,{path:[RB.n,RB.q,RB.m,RB.o,RB.l],exact:!0,component:qz}),i.a.createElement(q.a,{path:RB.p,exact:!0,render:e=>i.a.createElement(B.Redirect,{to:Object(v.j)(e.match.params.policyId)})}),i.a.createElement(q.a,{path:RB.k,exact:!0,component:zq}),i.a.createElement(q.a,{path:"*",component:z.a}))));zz.displayName="PolicyContainer";var $z=a(940),Vz=a(1485),Uz=a(174);const Hz=[32,40,64],Gz=/[^0-9a-f]/i,Qz=e=>Hz.includes(e.length)&&!Gz.test(e),Wz=e=>e.field!==Uz.a.SIGNER,Kz=$.i18n.translate("xpack.securitySolution.trustedApps.name.label",{defaultMessage:"Name"}),Yz=$.i18n.translate("xpack.securitySolution.trustedApps.details.header",{defaultMessage:"Details"}),Jz=$.i18n.translate("xpack.securitySolution.trustedApps.details.header.description",{defaultMessage:"Add a trusted application to improve performance or alleviate conflicts with other applications running on your hosts. Trusted applications may still generate alerts in some cases."}),Xz=$.i18n.translate("xpack.securitySolution.trustedapps.create.description",{defaultMessage:"Description"}),Zz=$.i18n.translate("xpack.securitySolution.trustedApps.conditions.header",{defaultMessage:"Conditions"}),e$=$.i18n.translate("xpack.securitySolution.trustedApps.conditions.header.description",{defaultMessage:"Select an operating system and add conditions. Availability of conditions may depend on your chosen OS."}),t$=$.i18n.translate("xpack.securitySolution.trustedApps.os.label",{defaultMessage:"Select operating system"}),a$={[Uz.a.HASH]:$.i18n.translate("xpack.securitySolution.trustedapps.logicalConditionBuilder.entry.field.hash",{defaultMessage:"Hash"}),[Uz.a.PATH]:$.i18n.translate("xpack.securitySolution.trustedapps.logicalConditionBuilder.entry.field.path",{defaultMessage:"Path"}),[Uz.a.SIGNER]:$.i18n.translate("xpack.securitySolution.trustedapps.logicalConditionBuilder.entry.field.signature",{defaultMessage:"Signature"})},n$={[Uz.a.HASH]:$.i18n.translate("xpack.securitySolution.trustedapps.logicalConditionBuilder.entry.field.description.hash",{defaultMessage:"md5, sha1, or sha256"}),[Uz.a.PATH]:$.i18n.translate("xpack.securitySolution.trustedapps.logicalConditionBuilder.entry.field.description.path",{defaultMessage:"The full path of the application"}),[Uz.a.SIGNER]:$.i18n.translate("xpack.securitySolution.trustedapps.logicalConditionBuilder.entry.field.description.signature",{defaultMessage:"The signer of the application"})},i$={is:$.i18n.translate("xpack.securitySolution.trustedapps.card.operator.is",{defaultMessage:"is"}),matches:$.i18n.translate("xpack.securitySolution.trustedapps.card.operator.matches",{defaultMessage:"matches"})},r$={field:$.i18n.translate("xpack.securitySolution.trustedapps.trustedapp.entry.field",{defaultMessage:"Field"}),operator:$.i18n.translate("xpack.securitySolution.trustedapps.trustedapp.entry.operator",{defaultMessage:"Operator"}),value:$.i18n.translate("xpack.securitySolution.trustedapps.trustedapp.entry.value",{defaultMessage:"Value"})},s$=$.i18n.translate("xpack.securitySolution.trustedApps.assignmentSectionDescription",{defaultMessage:"Assign this trusted application globally across all policies, or assign it to specific policies."}),o$={name:$.i18n.translate("xpack.securitySolution.trustedapps.create.nameRequiredMsg",{defaultMessage:"Name is required"}),os:$.i18n.translate("xpack.securitySolution.trustedapps.create.osRequiredMsg",{defaultMessage:"Operating System is required"}),field:$.i18n.translate("xpack.securitySolution.trustedapps.create.conditionRequiredMsg",{defaultMessage:"At least one Field definition is required"}),noDuplicateField:e=>$.i18n.translate("xpack.securitySolution.trustedapps.create.conditionFieldDuplicatedMsg",{defaultMessage:"{field} cannot be added more than once",values:{field:a$[e]}}),mustHaveValue:e=>$.i18n.translate("xpack.securitySolution.trustedapps.create.conditionFieldValueRequiredMsg",{defaultMessage:"[{row}] Field entry must have a value",values:{row:e+1}}),invalidHash:e=>$.i18n.translate("xpack.securitySolution.trustedapps.create.conditionFieldInvalidHashMsg",{defaultMessage:"[{row}] Invalid hash value",values:{row:e+1}}),pathWarning:e=>$.i18n.translate("xpack.securitySolution.trustedapps.create.conditionFieldInvalidPathMsg",{defaultMessage:"[{row}] Path may be formed incorrectly; verify value",values:{row:e+1}}),wildcardPathWarning:e=>$.i18n.translate("xpack.securitySolution.trustedapps.create.conditionFieldDegradedPerformanceMsg",{defaultMessage:"[{row}] A wildcard in the filename will affect the endpoint's performance",values:{row:e+1}})};var l$=a(347),c$=a(603);const u$=({os:e,field:t,type:a})=>{if(t===Uz.a.PATH)return e===Uz.c.WINDOWS?"wildcard"===a?"C:\\sample\\*\\path.exe":"C:\\sample\\path.exe":"wildcard"===a?"/opt/*/app":"/opt/bin"},d$=Object(n.memo)((({showLabel:e,label:t="",children:a})=>e?i.a.createElement(U.EuiFormRow,{label:t,fullWidth:!0},a):i.a.createElement(i.a.Fragment,null,a)));d$.displayName="ConditionEntryCell";const p$=G.a.div.withConfig({displayName:"InputGroup",componentId:"sc-1uhidgu-0"})(["display:grid;grid-template-columns:25% 25% 45% 5%;grid-template-areas:'field operator value remove';"]),m$=G.a.div.withConfig({displayName:"InputItem",componentId:"sc-1uhidgu-1"})(["grid-area:",";align-self:center;margin:4px;vertical-align:baseline;"],(({gridArea:e})=>e)),b$=Object.keys(bq.d).map((e=>({dropdownDisplay:i$[e],inputDisplay:i$[e],value:"matches"===e?"wildcard":"match"}))),g$=Object(n.memo)((({os:e,entry:t,showLabels:a=!1,onRemove:r,onChange:s,isRemoveDisabled:o=!1,onVisited:l,"data-test-subj":c})=>{const u=Object(cz.a)(c),[d,p]=Object(n.useState)(!1),m=Object(n.useCallback)((()=>{null==l||l(t),d||p(!0)}),[t,d,l]),b=Object(n.useMemo)((()=>{const t=e=>i.a.createElement(i.a.Fragment,null,a$[e],i.a.createElement(U.EuiText,{size:"xs",color:"subdued"},n$[e]));return[{dropdownDisplay:t(Uz.a.HASH),inputDisplay:a$[Uz.a.HASH],value:Uz.a.HASH,"data-test-subj":u(`field-type-${a$[Uz.a.HASH]}`)},{dropdownDisplay:t(Uz.a.PATH),inputDisplay:a$[Uz.a.PATH],value:Uz.a.PATH,"data-test-subj":u(`field-type-${a$[Uz.a.PATH]}`)},...e===Uz.c.WINDOWS?[{dropdownDisplay:t(Uz.a.SIGNER),inputDisplay:a$[Uz.a.SIGNER],value:Uz.a.SIGNER,"data-test-subj":u(`field-type-${a$[Uz.a.SIGNER]}`)}]:[]]}),[u,e]),g=Object(n.useCallback)((e=>s({...t,value:e.target.value},t)),[t,s]),f=Object(n.useCallback)((e=>{s({...t,field:e},t),t.value&&m()}),[m,t,s]),y=Object(n.useCallback)((e=>s({...t,type:e},t)),[t,s]),h=Object(n.useCallback)((()=>r(t)),[t,r]),v=Object(n.useCallback)((()=>{m()}),[m]);return i.a.createElement(p$,{"data-test-subj":c},i.a.createElement(m$,{gridArea:"field"},i.a.createElement(d$,{showLabel:a,label:r$.field},i.a.createElement(U.EuiSuperSelect,{options:b,valueOfSelected:t.field,onChange:f,"data-test-subj":u("field")}))),i.a.createElement(m$,{gridArea:"operator"},i.a.createElement(d$,{showLabel:a,label:r$.operator},t.field===Uz.a.PATH?i.a.createElement(U.EuiSuperSelect,{options:b$,onChange:y,valueOfSelected:t.type,"data-test-subj":u("operator")}):i.a.createElement(U.EuiFieldText,{name:"operator",value:i$.is,"data-test-subj":u("operator"),readOnly:!0}))),i.a.createElement(m$,{gridArea:"value"},i.a.createElement(d$,{showLabel:a,label:r$.value},i.a.createElement(U.EuiFieldText,{name:"value",value:t.value,placeholder:u$({os:e,field:t.field,type:t.type}),fullWidth:!0,required:d,onChange:g,onBlur:v,"data-test-subj":u("value")}))),i.a.createElement(m$,{gridArea:"remove"},i.a.createElement(d$,{showLabel:a,label:" "},i.a.createElement(U.EuiButtonIcon,{color:"danger",iconType:"trash",onClick:h,isDisabled:o,"aria-label":$.i18n.translate("xpack.securitySolution.trustedapps.logicalConditionBuilder.entry.removeLabel",{defaultMessage:"Remove Entry"}),"data-test-subj":u("remove")}))))}));g$.displayName="ConditionEntryInput";const f$=G()(U.EuiFlexGroup).withConfig({displayName:"ConditionGroupFlexGroup",componentId:"sc-1w3ghq9-0"})([".and-badge{padding-top:20px;padding-bottom:",";}.group-entries{margin-bottom:",";& > *{margin-bottom:",";&:last-child{margin-bottom:0;}}}.and-button{min-width:95px;}"],(({theme:e})=>`calc(${e.eui.euiButtonHeightSmall} + (${e.eui.euiSizeS} * 2) + 3px);`),(({theme:e})=>e.eui.euiSizeS),(({theme:e})=>e.eui.euiSizeS)),y$=Object(n.memo)((({os:e,entries:t,onEntryRemove:a,onEntryChange:n,onAndClicked:r,isAndDisabled:s,onVisited:o,"data-test-subj":l})=>{const c=Object(cz.a)(l);return i.a.createElement(f$,{gutterSize:"xs","data-test-subj":l},t.length>1&&i.a.createElement(U.EuiHideFor,{sizes:["xs","s"]},i.a.createElement(U.EuiFlexItem,{grow:!1,"data-test-subj":c("andConnector"),className:"and-badge"},i.a.createElement(c$.a,{type:"and",includeAntennas:!0}))),i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement("div",{"data-test-subj":c("entries"),className:"group-entries"},t.map(((r,s)=>i.a.createElement(g$,{key:s,os:e,entry:r,showLabels:0===s,isRemoveDisabled:0===s&&t.length<=1,onRemove:a,onChange:n,onVisited:o,"data-test-subj":c(`entry${s}`)})))),i.a.createElement("div",null,i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement(U.EuiButton,{size:"s",iconType:"plusInCircle",onClick:r,"data-test-subj":c("AndButton"),isDisabled:s,className:"and-button"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.trustedapps.logicalConditionBuilder.group.andOperator",defaultMessage:"AND"})))))}));y$.displayName="ConditionGroup";const h$=Object(n.memo)((({entries:e,os:t,className:a,isAndDisabled:n=!1,onAndClicked:r,onEntryRemove:s,onEntryChange:o,onVisited:l,"data-test-subj":c})=>{const u=Object(cz.a)(c);return i.a.createElement("div",{"data-test-subj":c,className:a},i.a.createElement("div",null,0===e.length?i.a.createElement(v$,null):i.a.createElement(y$,{os:t,entries:e,onEntryRemove:s,onEntryChange:o,onAndClicked:r,isAndDisabled:n,onVisited:l,"data-test-subj":u("group1")})))}));h$.displayName="LogicalConditionBuilder";const v$=Object(n.memo)((()=>i.a.createElement(U.EuiPanel,{paddingSize:"l"},i.a.createElement(U.EuiText,{textAlign:"center",size:"s",color:"subdued"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.trustedapps.logicalConditionBuilder.noEntries",defaultMessage:"No conditions defined"})))));v$.displayName="NoEntries";var E$=a(953);const x$=Object(n.memo)((()=>{const{docLinks:{links:{securitySolution:e}}}=Object(m.j)().services;return i.a.createElement(i.a.Fragment,null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.trustedApps.docsLinkInfoStart",defaultMessage:"Have too many alerts? Add an "}),i.a.createElement(U.EuiLink,{target:"_blank",href:`${e.endpointArtifacts}`},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.trustedApps.docsLinkText",defaultMessage:"endpoint alert exception"})),i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.trustedApps.docsLinkInfoEnd",defaultMessage:" instead."}))}));x$.displayName="TrustedAppsArtifactsDocsLink";const j$=(e,t,a,n)=>{e.result[t]||(e.result[t]={isInvalid:!1,errors:[],warnings:[]});const r="warnings"===a?i.a.createElement("div",null,n):n;e.result[t][a].push(r),e.result[t].isInvalid=!0},S$=e=>{var t,a;let n=!0;const i={isValid:n,result:{}};e.name.trim()||(n=!1,j$(i,"name","errors",o$.name)),e.os_types||(n=!1,j$(i,"os","errors",o$.os));const r=null!==(t=(null!==(a=e.os_types)&&void 0!==a?a:[])[0])&&void 0!==t?t:Uz.c.WINDOWS;if(e.entries.length){const t=(e=>{const t=new Map;return e.forEach((e=>{const a=e.field.startsWith("process.hash")?Uz.a.HASH:e.field;t.set(a,[...t.get(a)||[],e])})),[...t.entries()].filter((e=>e[1].length>1)).map((e=>e[0]))})(e.entries);t.length&&(n=!1,t.forEach((e=>{j$(i,"entries","errors",o$.noDuplicateField(e))}))),e.entries.forEach(((e,t)=>{const a=Object(Uz.f)({os:r,field:e.field,type:e.type,value:e.value});e.field&&e.value.trim()?e.field!==Uz.a.HASH||Qz(e.value)?a?a&&!Object(Uz.e)({os:r,value:e.value,type:e.type})&&j$(i,"entries","warnings",o$.wildcardPathWarning(t)):j$(i,"entries","warnings",o$.pathWarning(t)):(n=!1,j$(i,"entries","errors",o$.invalidHash(t))):(n=!1,j$(i,"entries","errors",o$.mustHaveValue(t)))}))}else n=!1,j$(i,"entries","errors",o$.field);return i.isValid=n,i},k$=()=>({field:Uz.a.HASH,operator:"included",type:"match",value:""}),O$=Object(n.memo)((({item:e,policies:t,policiesIsLoading:a,onChange:r,mode:s})=>{var o,l,c,u,d,p,m;const b=Object(cz.a)("trustedApps-form"),[g,f]=Object(n.useState)({}),[y,h]=Object(n.useState)([]),v=Object(fp.b)().isPlatinumPlus(),E=Object(n.useMemo)((()=>Object(Ez.e)(e)),[e]),[x,j]=Object(n.useState)(!Object(bz.d)(e.tags)),[S,k]=Object(n.useState)(!1);Object(n.useEffect)((()=>{!S&&e.tags&&j(!Object(bz.d)(e.tags))}),[e.tags,S]),Object(n.useEffect)((()=>{if(S)return;const a=e.tags?Object(Ez.c)({tags:e.tags}):[];if(!a.length)return;const n=t.filter((e=>a.includes(e.id)));h(n)}),[S,e,t]);const O=Object(n.useMemo)((()=>v||"edit"===s&&(!E||x&&E&&S)),[s,E,S,v,x]),[w,T]=Object(n.useState)((()=>S$(e))),I=Object(n.useCallback)((e=>{const t=S$(e);T(t),r({item:e,isValid:t.isValid})}),[r]),C=Object(n.useCallback)((t=>{const a=t.isGlobal?[gs.d]:t.selected.map((e=>`${gs.b}${e.id}`)),n={...e,tags:a};t.isGlobal||h(t.selected),I(n),k(!0)}),[e,I]),M=Object(n.useCallback)((t=>{const a={...e,[t.target.name]:t.target.value};I(a),k(!0)}),[e,I]),_=Object(n.useCallback)((({target:{name:t}})=>{I(e),f((e=>({...e,[t]:!0})))}),[e,I]),F=Object(n.useMemo)((()=>[Uz.c.LINUX,Uz.c.MAC,Uz.c.WINDOWS].map((e=>({value:e,inputDisplay:l$.a[e]})))),[]),A=Object(n.useCallback)((t=>{f((e=>({...e,os:!0})));const a={...e,os_types:[t],entries:[]};if(t!==Uz.c.WINDOWS){const t=e.entries.filter((e=>Wz(e)));a.entries.push(...t),0===e.entries.length&&a.entries.push(k$())}else a.entries.push(...e.entries);I(a),k(!0)}),[e,I]),D=Object(n.useCallback)((()=>{f((e=>({...e,entries:!0})))}),[]),N=Object(n.useCallback)(((t,a)=>{const n={...e,entries:e.entries.map((e=>e===a?t:e))};I(n),k(!0)}),[e,I]),P=Object(n.useCallback)((t=>{const a={...e,entries:e.entries.filter((e=>e!==t))};I(a),k(!0)}),[e,I]),R=Object(n.useCallback)((()=>{var t,a;const n={...e,entries:[]};(null!==(t=(null!==(a=e.os_types)&&void 0!==a?a:[])[0])&&void 0!==t?t:Uz.c.WINDOWS)===Uz.c.WINDOWS?n.entries=[...e.entries,k$()].filter((e=>e.field===Uz.a.SIGNER||!0)):n.entries=[...e.entries.filter((e=>Wz(e))),k$()],I(n),k(!0)}),[e,I]),L=Object(n.useMemo)((()=>{var t;return null!=e&&null!==(t=e.os_types)&&void 0!==t&&t.length?e.os_types[0]:Uz.c.WINDOWS}),[null==e?void 0:e.os_types]),B=Object(n.useMemo)((()=>{const t=e;return t.entries=e.entries.length?e.entries:[k$()],t}),[e]);return i.a.createElement(U.EuiForm,{component:"div","data-test-subj":b("")},i.a.createElement(U.EuiTitle,{size:"xs"},i.a.createElement("h3",null,Yz)),i.a.createElement(U.EuiSpacer,{size:"xs"}),"create"===s&&i.a.createElement(U.EuiText,{size:"s","data-test-subj":b("about")},i.a.createElement("p",null,Jz,i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(x$,null)))),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiFormRow,{label:Kz,fullWidth:!0,"data-test-subj":b("nameRow"),isInvalid:g.name&&(null===(o=w.result.name)||void 0===o?void 0:o.isInvalid),error:null===(l=w.result.name)||void 0===l?void 0:l.errors},i.a.createElement(U.EuiFieldText,{name:"name",value:e.name,onChange:M,onBlur:_,fullWidth:!0,required:g.name,maxLength:256,"data-test-subj":b("nameTextField")})),i.a.createElement(U.EuiFormRow,{label:Xz,fullWidth:!0,"data-test-subj":b("descriptionRow")},i.a.createElement(U.EuiTextArea,{name:"description",value:e.description,onChange:M,fullWidth:!0,compressed:!0,maxLength:256,"data-test-subj":b("descriptionField")})),i.a.createElement(U.EuiHorizontalRule,null),i.a.createElement(U.EuiText,{size:"xs"},i.a.createElement("h3",null,Zz)),i.a.createElement(U.EuiSpacer,{size:"xs"}),i.a.createElement(U.EuiText,{size:"s"},e$),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiFormRow,{label:t$,fullWidth:!0,"data-test-subj":b("OsRow"),isInvalid:(null==g?void 0:g.os)&&(null===(c=w.result.os)||void 0===c?void 0:c.isInvalid),error:null===(u=w.result.os)||void 0===u?void 0:u.errors},i.a.createElement(U.EuiSuperSelect,{name:"os",options:F,valueOfSelected:L,onChange:A,fullWidth:!0,"data-test-subj":b("osSelectField")})),i.a.createElement(U.EuiFormRow,{fullWidth:!0,"data-test-subj":b("conditionsRow"),isInvalid:g.entries&&(null===(d=w.result.entries)||void 0===d?void 0:d.isInvalid),error:null===(p=w.result.entries)||void 0===p?void 0:p.errors,helpText:null===(m=w.result.entries)||void 0===m?void 0:m.warnings},i.a.createElement(h$,{entries:B.entries,os:L,onAndClicked:R,onEntryRemove:P,onEntryChange:N,onVisited:D,"data-test-subj":b("conditionsBuilder")})),O?i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiHorizontalRule,null),i.a.createElement(U.EuiFormRow,{fullWidth:!0,"data-test-subj":b("policySelection")},i.a.createElement(E$.a,{isGlobal:E,isPlatinumPlus:v,selected:y,options:t,onChange:C,isLoading:a,description:s$,"data-test-subj":b("effectedPolicies")}))):null)}));O$.displayName="TrustedAppsForm";const w$={pageTitle:$.i18n.translate("xpack.securitySolution.trustedApps.pageTitle",{defaultMessage:"Trusted applications"}),pageAboutInfo:$.i18n.translate("xpack.securitySolution.trustedApps.pageAboutInfo",{defaultMessage:"Add a trusted application to improve performance or alleviate conflicts with other applications running on your hosts. Trusted applications may still generate alerts in some cases."}),pageAddButtonTitle:$.i18n.translate("xpack.securitySolution.trustedApps.pageAddButtonTitle",{defaultMessage:"Add trusted application"}),getShowingCountLabel:e=>$.i18n.translate("xpack.securitySolution.trustedApps.showingTotal",{defaultMessage:"Showing {total} {total, plural, one {trusted application} other {trusted applications}}",values:{total:e}}),cardActionEditLabel:$.i18n.translate("xpack.securitySolution.trustedApps.cardActionEditLabel",{defaultMessage:"Edit trusted application"}),cardActionDeleteLabel:$.i18n.translate("xpack.securitySolution.trustedApps.cardActionDeleteLabel",{defaultMessage:"Delete trusted application"}),flyoutCreateTitle:$.i18n.translate("xpack.securitySolution.trustedApps.flyoutCreateTitle",{defaultMessage:"Add trusted application"}),flyoutEditTitle:$.i18n.translate("xpack.securitySolution.trustedApps.flyoutEditTitle",{defaultMessage:"Edit trusted application"}),flyoutCreateSubmitButtonLabel:$.i18n.translate("xpack.securitySolution.trustedApps.flyoutCreateSubmitButtonLabel",{defaultMessage:"Add trusted application"}),flyoutCreateSubmitSuccess:({name:e})=>$.i18n.translate("xpack.securitySolution.trustedApps.flyoutCreateSubmitSuccess",{defaultMessage:'"{name}" has been added to your trusted applications.',values:{name:e}}),flyoutEditSubmitSuccess:({name:e})=>$.i18n.translate("xpack.securitySolution.trustedApps.flyoutEditSubmitSuccess",{defaultMessage:'"{name}" has been updated.',values:{name:e}}),flyoutDowngradedLicenseDocsInfo:e=>i.a.createElement(i.a.Fragment,null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.trustedApps.flyoutDowngradedLicenseDocsInfo",defaultMessage:"For more information, see our "}),i.a.createElement(U.EuiLink,{target:"_blank",href:`${e.trustedApps}`},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.trustedApps.flyoutDowngradedLicenseDocsLink",defaultMessage:"Trusted applications documentation"}))),deleteActionSuccess:e=>$.i18n.translate("xpack.securitySolution.trustedApps.deleteSuccess",{defaultMessage:'"{itemName}" has been removed from trusted applications.',values:{itemName:e}}),emptyStateTitleNoEntries:$.i18n.translate("xpack.securitySolution.trustedApps.emptyStateTitleNoEntries",{defaultMessage:"There are no trusted applications to display."}),emptyStateTitle:$.i18n.translate("xpack.securitySolution.trustedApps.emptyStateTitle",{defaultMessage:"Add your first trusted application"}),emptyStateInfo:$.i18n.translate("xpack.securitySolution.trustedApps.emptyStateInfo",{defaultMessage:"Add a trusted application to improve performance or alleviate conflicts with other applications running on your hosts. Trusted applications may still generate alerts in some cases."}),emptyStatePrimaryButtonLabel:$.i18n.translate("xpack.securitySolution.trustedApps.emptyStatePrimaryButtonLabel",{defaultMessage:"Add trusted application"}),searchPlaceholderInfo:$.i18n.translate("xpack.securitySolution.trustedApps.searchPlaceholderInfo",{defaultMessage:"Search on the fields below: name, description, value"})},T$=Object(n.memo)((()=>{const{canWriteTrustedApplications:e}=Object(ch.a)().endpointPrivileges,t=Object(m.i)(),a=Vz.a.getInstance(t);return i.a.createElement($z.a,{apiClient:a,ArtifactFormComponent:O$,labels:w$,"data-test-subj":"trustedAppsListPage",searchableFields:Nz.a,secondaryPageInfo:i.a.createElement(x$,null),allowCardDeleteAction:e,allowCardEditAction:e,allowCardCreateAction:e})}));T$.displayName="TrustedAppsList";const I$=Object(n.memo)((()=>i.a.createElement(q.c,null,i.a.createElement(q.a,{path:RB.s,exact:!0,component:T$}),i.a.createElement(q.a,{path:"*",component:z.a}))));I$.displayName="TrustedAppsContainer";var C$=a(1097);const M$=()=>i.a.createElement(q.c,null,i.a.createElement(q.a,{path:RB.i,exact:!0,component:C$.c}),i.a.createElement(q.a,{path:"*",component:z.a}));var _$=a(9),F$=a(1623),A$=a.n(F$);const D$=$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.form.name.placeholder",{defaultMessage:"Host isolation exception name"}),N$=$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.form.name.label",{defaultMessage:"Name your host isolation exceptions"}),P$=$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.form.name.error",{defaultMessage:"The name can't be empty"}),R$=$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.form.description.placeholder",{defaultMessage:"Describe your host isolation exception"}),L$=$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.form.description.label",{defaultMessage:"Description"}),B$=$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.form.ip.placeholder",{defaultMessage:"Ex 0.0.0.0/24"}),q$=$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.form.ip.label",{defaultMessage:"Enter IP Address"}),z$=$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.form.ip.error",{defaultMessage:"The IP is invalid. Only IPv4 with optional CIDR is supported"});var $$=a(1446);const V$=Object(n.memo)((({item:e,onChange:t,policies:a,disabled:r,mode:s,error:o})=>{var l;const c=Object(n.useMemo)((()=>e.entries[0]||{field:"destination.ip",operator:"included",type:"match",value:""}),[e.entries]),[u,d]=Object(n.useState)(!1),[p,m]=Object(n.useState)(!1),[b,g]=Object(n.useState)(!e.name),[f,y]=Object(n.useState)(!c.value),h=Object(cz.a)("hostIsolationExceptions-form"),[v,E]=Object(n.useState)({isGlobal:Object(bz.d)(e.tags),selected:[]}),x=Object(n.useMemo)((()=>!b&&!f),[f,b]),j=Object(n.useCallback)((a=>{t({item:a?{...e,...a}:e,isValid:x})}),[e,x,t]),S=Object(n.useCallback)((e=>{const t=e.target.value;t.trim()?g(!1):g(!0),j({name:t})}),[j]),k=Object(n.useCallback)((e=>{const t=e.target.value;!function(e){if(/^([0-9]{1,3}\.){3}[0-9]{1,3}(\/([0-9]|[1-2][0-9]|3[0-2]))?$/.test(e))try{return A$.a.IPv4.parseCIDR(e),!0}catch(t){return A$.a.IPv4.isValid(e)}return!1}(t)?y(!0):y(!1),j({entries:[{...c,value:t}]})}),[c,j]),O=Object(n.useCallback)((t=>{t.isGlobal?E({isGlobal:!0,selected:t.selected}):E(t),j({tags:Object(bz.a)(t,Object(bz.b)(e.tags))})}),[e.tags,j]),w=Object(n.useCallback)((e=>{j({description:e.target.value})}),[j]),T=Object(n.useMemo)((()=>{var t;return i.a.createElement(U.EuiFormRow,{label:N$,fullWidth:!0,isInvalid:b&&u,error:P$,isDisabled:r,"data-test-subj":"hostIsolationExceptions-form-name-input-formRow"},i.a.createElement(U.EuiFieldText,{id:"eventFiltersFormInputName",placeholder:D$,defaultValue:null!==(t=e.name)&&void 0!==t?t:"",onChange:S,fullWidth:!0,"aria-label":D$,required:u,maxLength:256,"data-test-subj":"hostIsolationExceptions-form-name-input",onBlur:()=>!u&&d(!0),disabled:r}))}),[r,e.name,S,u,b]),I=Object(n.useMemo)((()=>{var t,a,n;return i.a.createElement(U.EuiFormRow,{label:q$,fullWidth:!0,isInvalid:f&&p,error:z$,isDisabled:r,"data-test-subj":"hostIsolationExceptions-form-ip-input-formRow"},i.a.createElement(U.EuiFieldText,{id:"eventFiltersFormInputName",placeholder:B$,defaultValue:null!==(t=null===(a=e.entries)||void 0===a||null===(n=a[0])||void 0===n?void 0:n.value)&&void 0!==t?t:"",onChange:k,fullWidth:!0,"aria-label":B$,required:p,maxLength:256,"data-test-subj":"hostIsolationExceptions-form-ip-input",onBlur:()=>!p&&m(!0),disabled:r}))}),[r,e.entries,k,p,f]),C=Object(n.useMemo)((()=>{var t;return i.a.createElement(U.EuiFormRow,{label:L$,fullWidth:!0,isDisabled:r,"data-test-subj":"hostIsolationExceptions-form-description-input-formRow"},i.a.createElement(U.EuiTextArea,{id:"eventFiltersFormInputName",placeholder:R$,defaultValue:null!==(t=e.description)&&void 0!==t?t:"",onChange:w,fullWidth:!0,"data-test-subj":"hostIsolationExceptions-form-description-input","aria-label":R$,maxLength:256,disabled:r}))}),[r,e.description,w]);return Object(n.useEffect)((()=>{0===v.selected.length&&e.tags&&E(Object(bz.c)(e.tags,a))}),[e.tags,a,v.selected.length]),Object(n.useEffect)((()=>{j()}),[j]),Object(n.useEffect)((()=>{var t,a;"create"===s&&3!==(null!==(t=null===(a=e.os_types)||void 0===a?void 0:a.length)&&void 0!==t?t:0)&&j({os_types:["windows","linux","macos"]})}),[null===(l=e.os_types)||void 0===l?void 0:l.length,s,j]),i.a.createElement(U.EuiForm,{component:"div",error:o&&i.a.createElement($$.a,{error:o}),isInvalid:!!o,"data-test-subj":"hostIsolationExceptions-form"},i.a.createElement(U.EuiTitle,{size:"xs"},i.a.createElement("h2",null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.hostIsolationExceptions.form.title",defaultMessage:"Details"}))),i.a.createElement(U.EuiText,{size:"s"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.hostIsolationExceptions.form.description",defaultMessage:"Allows isolated hosts to connect to these IP addresses. Only accepts IPv4 with optional CIDR."})),i.a.createElement(U.EuiSpacer,{size:"m"}),T,C,i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiHorizontalRule,null),i.a.createElement(U.EuiTitle,{size:"xs"},i.a.createElement("h2",null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.hostIsolationExceptions.form.conditions.title",defaultMessage:"Conditions"}))),i.a.createElement(U.EuiText,{size:"s"},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.hostIsolationExceptions.form.conditions.subtitle",defaultMessage:"Host Isolation exceptions will apply to all operating systems."})),i.a.createElement(U.EuiSpacer,{size:"m"}),I,i.a.createElement(U.EuiHorizontalRule,null),i.a.createElement(U.EuiFormRow,{fullWidth:!0,"data-test-subj":"effectedPolicies-container",isDisabled:r},i.a.createElement(E$.a,{isGlobal:v.isGlobal,isPlatinumPlus:!0,selected:v.selected,options:a,onChange:O,"data-test-subj":h("effectedPolicies"),disabled:r})))}));V$.displayName="HostIsolationExceptionsForm";const U$=Object.freeze({pageTitle:$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.pageTitle",{defaultMessage:"Host isolation exceptions"}),pageAboutInfo:$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.pageAboutInfo",{defaultMessage:"Add a host isolation exception to allow isolated hosts to communicate with specific IPs."}),pageAddButtonTitle:$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.pageAddButtonTitle",{defaultMessage:"Add host isolation exception"}),getShowingCountLabel:e=>$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.showingTotal",{defaultMessage:"Showing {total} {total, plural, one {host isolation exception} other {host isolation exceptions}}",values:{total:e}}),cardActionEditLabel:$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.cardActionEditLabel",{defaultMessage:"Edit exception"}),cardActionDeleteLabel:$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.cardActionDeleteLabel",{defaultMessage:"Delete exception"}),flyoutCreateTitle:$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.flyoutCreateTitle",{defaultMessage:"Add host isolation exception"}),flyoutEditTitle:$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.flyoutEditTitle",{defaultMessage:"Edit host isolation exception"}),flyoutCreateSubmitButtonLabel:$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.flyoutCreateSubmitButtonLabel",{defaultMessage:"Add host isolation exception"}),flyoutCreateSubmitSuccess:({name:e})=>$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.flyoutCreateSubmitSuccess",{defaultMessage:'"{name}" has been added to your host isolation exception list.',values:{name:e}}),flyoutEditSubmitSuccess:({name:e})=>$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.flyoutEditSubmitSuccess",{defaultMessage:'"{name}" has been updated.',values:{name:e}}),flyoutDowngradedLicenseDocsInfo:()=>null,deleteModalTitle:()=>$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.deleteModtalTitle",{defaultMessage:"Delete host isolation exception"}),deleteActionSuccess:e=>$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.deleteSuccess",{defaultMessage:'"{itemName}" has been removed from host isolation exception list.',values:{itemName:e}}),emptyStateTitleNoEntries:$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.emptyStateTitleNoEntries",{defaultMessage:"There are no host isolation exceptions to display."}),emptyStateTitle:$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.emptyStateTitle",{defaultMessage:"Add your first host isolation exception"}),emptyStateInfo:$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.emptyStateInfo",{defaultMessage:"Add a host isolation exception to allow isolated hosts to communicate with specific IPs."}),emptyStatePrimaryButtonLabel:$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.emptyStatePrimaryButtonLabel",{defaultMessage:"Add host isolation exception"}),searchPlaceholderInfo:$.i18n.translate("xpack.securitySolution.hostIsolationExceptions.searchPlaceholderInfo",{defaultMessage:"Search on the fields below: name, description, IP"})}),H$=Object(n.memo)((()=>{const e=Object(m.i)(),t=Dz.a.getInstance(e),{canWriteHostIsolationExceptions:a,canDeleteHostIsolationExceptions:n}=Object(ch.a)().endpointPrivileges;return i.a.createElement($z.a,{apiClient:t,ArtifactFormComponent:V$,labels:U$,"data-test-subj":"hostIsolationExceptionsListPage",searchableFields:Rz.b,allowCardCreateAction:a,allowCardEditAction:a,allowCardDeleteAction:n})}));H$.displayName="HostIsolationExceptionsList";const G$=Object(n.memo)((()=>Object(_$.h)(s.wc.hostIsolationExceptions)?i.a.createElement(q.c,null,i.a.createElement(q.a,{path:RB.j,exact:!0,component:H$}),i.a.createElement(q.a,{path:"*",component:z.a})):i.a.createElement(Ii.b,{docLinkSelector:({securitySolution:e})=>e.privileges})));G$.displayName="HostIsolationExceptionsContainer";var Q$=a(1392),W$=a(210);const K$=$.i18n.translate("xpack.securitySolution.blocklist.details.header",{defaultMessage:"Details"}),Y$=$.i18n.translate("xpack.securitySolution.blocklist.details.header.description",{defaultMessage:"The blocklist prevents selected applications from running on your hosts by extending the list of processes the Endpoint considers malicious."}),J$=$.i18n.translate("xpack.securitySolution.blocklist.name.label",{defaultMessage:"Name"}),X$=$.i18n.translate("xpack.securitySolution.blocklist.description.label",{defaultMessage:"Description"}),Z$=$.i18n.translate("xpack.securitySolution.blocklist.conditions.header",{defaultMessage:"Conditions"}),eV=$.i18n.translate("xpack.securitySolution.blocklist.conditions.header.description",{defaultMessage:"Select an operating system and add conditions. Availability of conditions may depend on your chosen OS."}),tV=$.i18n.translate("xpack.securitySolution.blocklist.os.label",{defaultMessage:"Select operating system"}),aV=$.i18n.translate("xpack.securitySolution.blocklist.field.label",{defaultMessage:"Field"}),nV=$.i18n.translate("xpack.securitySolution.blocklist.operator.label",{defaultMessage:"Operator"}),iV=$.i18n.translate("xpack.securitySolution.blocklist.value.label",{defaultMessage:"Value"}),rV=$.i18n.translate("xpack.securitySolution.blocklist.value.label.helper",{defaultMessage:"Type or copy & paste one or multiple comma delimited values"}),sV={"file.hash.*":$.i18n.translate("xpack.securitySolution.blocklist.entry.field.hash",{defaultMessage:"Hash"}),"file.path":$.i18n.translate("xpack.securitySolution.blocklist.entry.field.path",{defaultMessage:"Path"}),"file.path.caseless":$.i18n.translate("xpack.securitySolution.blocklist.entry.field.path.caseless",{defaultMessage:"Path"}),"file.Ext.code_signature":$.i18n.translate("xpack.securitySolution.blocklist.entry.field.signature",{defaultMessage:"Signature"})},oV={"file.hash.*":$.i18n.translate("xpack.securitySolution.blocklist.entry.field.description.hash",{defaultMessage:"md5, sha1, or sha256"}),"file.path":$.i18n.translate("xpack.securitySolution.blocklist.entry.field.description.path",{defaultMessage:"The full path of the application"}),"file.path.caseless":$.i18n.translate("xpack.securitySolution.blocklist.entry.field.description.path.caseless",{defaultMessage:"The full path of the application (case insenstive)"}),"file.Ext.code_signature":$.i18n.translate("xpack.securitySolution.blocklist.entry.field.description.signature",{defaultMessage:"The signer of the application"})},lV=$.i18n.translate("xpack.securitySolution.blocklist.policyAssignmentSectionDescription",{defaultMessage:"Assign this blocklist globally across all policies, or assign it to specific policies."}),cV={NAME_REQUIRED:$.i18n.translate("xpack.securitySolution.blocklist.errors.name.required",{defaultMessage:"Name is required"}),VALUE_REQUIRED:$.i18n.translate("xpack.securitySolution.blocklist.errors.values.required",{defaultMessage:"Field entry must have a value"}),INVALID_HASH:$.i18n.translate("xpack.securitySolution.blocklist.errors.values.invalidHash",{defaultMessage:"Invalid hash value"}),INVALID_PATH:$.i18n.translate("xpack.securitySolution.blocklist.warnings.values.invalidPath",{defaultMessage:"Path may be formed incorrectly; verify value"}),WILDCARD_PRESENT:$.i18n.translate("xpack.securitySolution.blocklist.warnings.values.wildcardPresent",{defaultMessage:"A wildcard in the filename will affect the endpoint's performance"}),DUPLICATE_VALUE:$.i18n.translate("xpack.securitySolution.blocklist.warnings.values.duplicateValue",{defaultMessage:"This value already exists"}),DUPLICATE_VALUES:$.i18n.translate("xpack.securitySolution.blocklist.warnings.values.duplicateValues",{defaultMessage:"One or more duplicate values removed"})};function uV(e){return i.a.createElement("div",null,e)}function dV(e){return i.a.createElement(i.a.Fragment,null,sV[e],i.a.createElement(U.EuiText,{size:"xs",color:"subdued"},oV[e]))}function pV(e){return!Object.values(e).some((e=>Object.keys(e).length))}const mV=Object(n.memo)((({item:e,policies:t,policiesIsLoading:a,onChange:r,mode:s})=>{const[o,l]=Object(n.useState)({name:!1,value:!1}),c=Object(n.useRef)({name:{},value:{}}),u=Object(n.useRef)({name:{},value:{}}),[d,p]=Object(n.useState)([]),m=Object(fp.b)().isPlatinumPlus(),b=Object(n.useMemo)((()=>Object(Ez.e)(e)),[e]),[g,f]=Object(n.useState)(!Object(bz.d)(e.tags)),[y,h]=Object(n.useState)(!1),v=Object(n.useMemo)((()=>m||"edit"===s&&(!b||g&&b&&y)),[s,b,y,m,g]);Object(n.useEffect)((()=>{!y&&e.tags&&f(!Object(bz.d)(e.tags))}),[e.tags,y]),Object(n.useEffect)((()=>{var a,n;if(y)return;const i=null!==(a=null===(n=e.tags)||void 0===n?void 0:n.map((e=>e.split(":")[1])))&&void 0!==a?a:[];if(!i.length)return;const r=t.filter((e=>i.includes(e.id)));p(r)}),[y,e.tags,t]);const E=Object(cz.a)("blocklist-form"),x=Object(n.useMemo)((()=>e.entries.length?e.entries[0]:{field:"file.hash.*",operator:"included",type:"match_any",value:[]}),[e.entries]),j=Object(n.useMemo)((()=>{var t;return null!=e&&null!==(t=e.os_types)&&void 0!==t&&t.length?e.os_types[0]:Uz.c.WINDOWS}),[null==e?void 0:e.os_types]),S=Object(n.useMemo)((()=>x.value.map((e=>({label:e,"data-test-subj":E(`values-input-${e}`)})))),[x.value,E]),k=Object(n.useMemo)((()=>[Uz.c.LINUX,Uz.c.MAC,Uz.c.WINDOWS].map((e=>({value:e,inputDisplay:l$.a[e]})))),[]),O=Object(n.useMemo)((()=>{const e=[];return e.push({value:"file.hash.*",inputDisplay:sV["file.hash.*"],dropdownDisplay:dV("file.hash.*"),"data-test-subj":E("file.hash.*")}),j===Uz.c.LINUX?e.push({value:"file.path",inputDisplay:sV["file.path"],dropdownDisplay:dV("file.path"),"data-test-subj":E("file.path")}):e.push({value:"file.path.caseless",inputDisplay:sV["file.path.caseless"],dropdownDisplay:dV("file.path.caseless"),"data-test-subj":E("file.path.caseless")}),j===Uz.c.WINDOWS&&e.push({value:"file.Ext.code_signature",inputDisplay:sV["file.Ext.code_signature"],dropdownDisplay:dV("file.Ext.code_signature"),"data-test-subj":E("file.Ext.code_signature")}),e}),[j,E]),w=Object(n.useMemo)((()=>i.a.createElement("div",null,i.a.createElement(U.EuiToolTip,{content:rV},i.a.createElement(i.a.Fragment,null,iV," ",i.a.createElement(U.EuiIcon,{color:"subdued",type:"iInCircle",className:"eui-alignTop"}))))),[]),T=Object(n.useCallback)((e=>{var t,a,n;const i=null!==(t=(null!==(a=e.os_types)&&void 0!==a?a:[])[0])&&void 0!==t?t:Uz.c.WINDOWS,{field:r="file.hash.*",type:s="match_any",value:o=[]}=null!==(n=e.entries[0])&&void 0!==n?n:{},l={},d={},p={};e.name.trim()||(d.NAME_REQUIRED=uV(cV.NAME_REQUIRED)),o.length||(p.VALUE_REQUIRED=uV(cV.VALUE_REQUIRED)),"file.hash.*"===r&&o.some((e=>!Qz(e)))&&(p.INVALID_HASH=uV(cV.INVALID_HASH));const m=o.some((e=>!Object(Uz.f)({os:i,field:r,type:s,value:e})));"file.hash.*"!==r&&m&&(l.INVALID_PATH=uV(cV.INVALID_PATH)),o.length!==Object(it.uniq)(o).length&&(l.DUPLICATE_VALUES=uV(cV.DUPLICATE_VALUES)),c.current={...c.current,value:l},u.current={name:d,value:p}}),[]),I=Object(n.useCallback)((()=>{T(e),l((e=>({...e,name:!0})))}),[e,T]),C=Object(n.useCallback)((()=>{T(e),l((e=>({...e,value:!0})))}),[e,T]),M=Object(n.useCallback)((t=>{const a={...e,name:t.target.value};T(a),r({isValid:pV(u.current),item:a}),h(!0)}),[T,r,e]),_=Object(n.useCallback)((t=>{const a={...e,description:t.target.value};T(a),r({isValid:pV(u.current),item:a}),h(!0)}),[r,e,T]),F=Object(n.useCallback)((t=>{const a={...e,os_types:[t],entries:[{...x,field:t!==Uz.c.WINDOWS&&"file.Ext.code_signature"===x.field?"file.hash.*":x.field}]};T(a),r({isValid:pV(u.current),item:a}),h(!0)}),[T,x,r,e]),A=Object(n.useCallback)((t=>{const a={...e,entries:[{...x,field:t}]};T(a),r({isValid:pV(u.current),item:a}),h(!0)}),[T,r,e,x]),D=Object(n.useCallback)((e=>{const t={...c.current.value};x.value.includes(e)?t.DUPLICATE_VALUE=uV(cV.DUPLICATE_VALUE):delete t.DUPLICATE_VALUE,c.current={...c.current,value:t},l((e=>({...e})))}),[x]),N=Object(n.useCallback)((t=>{const a=t.map((e=>e.label)),n={...e,entries:[{...x,value:a}]};T(n),r({isValid:pV(u.current),item:n}),h(!0)}),[T,r,e,x]),P=Object(n.useCallback)((t=>{const a=t.split(",").filter((e=>e.trim())),n=[...x.value,...a],i={...e,entries:[{...x,value:n}]};T(i),i.entries[0].value=Object(it.uniq)(i.entries[0].value),l((e=>({...e,value:!0}))),r({isValid:pV(u.current),item:i}),h(!0)}),[T,r,e,x]),R=Object(n.useCallback)((t=>{const a=t.isGlobal?[gs.d]:t.selected.map((e=>`${gs.b}${e.id}`)),n={...e,tags:a};t.isGlobal||p(t.selected),T(n),r({isValid:pV(u.current),item:n}),h(!0)}),[T,r,e]);return i.a.createElement(U.EuiForm,{component:"div"},i.a.createElement(U.EuiTitle,{size:"xs"},i.a.createElement("h3",null,K$)),i.a.createElement(U.EuiSpacer,{size:"xs"}),"create"===s&&i.a.createElement(U.EuiText,{size:"s","data-test-subj":E("header-description")},i.a.createElement("p",null,Y$)),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiFormRow,{label:J$,isInvalid:o.name&&!!Object.keys(u.current.name).length,error:Object.values(u.current.name),fullWidth:!0},i.a.createElement(U.EuiFieldText,{name:"name",value:e.name,onChange:M,onBlur:I,required:o.name,maxLength:256,"data-test-subj":E("name-input"),fullWidth:!0})),i.a.createElement(U.EuiFormRow,{label:X$,fullWidth:!0},i.a.createElement(U.EuiTextArea,{name:"description",value:e.description,onChange:_,"data-test-subj":E("description-input"),fullWidth:!0,compressed:!0,maxLength:256})),i.a.createElement(U.EuiHorizontalRule,null),i.a.createElement(U.EuiTitle,{size:"xs"},i.a.createElement("h3",null,Z$)),i.a.createElement(U.EuiSpacer,{size:"xs"}),i.a.createElement(U.EuiText,{size:"s"},i.a.createElement("p",null,eV)),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiFormRow,{label:tV,fullWidth:!0},i.a.createElement(U.EuiSuperSelect,{name:"os",options:k,valueOfSelected:j,onChange:F,"data-test-subj":E("os-select"),fullWidth:!0})),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiFormRow,{fullWidth:!0},i.a.createElement(U.EuiFlexGroup,{gutterSize:"s"},i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(U.EuiFormRow,{label:aV,fullWidth:!0},i.a.createElement(U.EuiSuperSelect,{name:"field",options:O,valueOfSelected:x.field,onChange:A,"data-test-subj":E("field-select"),fullWidth:!0}))),i.a.createElement(U.EuiFlexItem,{grow:1},i.a.createElement(U.EuiFormRow,{label:nV,fullWidth:!0},i.a.createElement(U.EuiFieldText,{name:"operator",value:W$.p.message,readOnly:!0}))),i.a.createElement(U.EuiFlexItem,{grow:2}))),i.a.createElement(U.EuiFormRow,{label:w,isInvalid:o.value&&!!Object.keys(u.current.value).length,helpText:Object.values(c.current.value),error:Object.values(u.current.value),fullWidth:!0},i.a.createElement(U.EuiComboBox,{selectedOptions:S,onBlur:C,onSearchChange:D,onChange:N,onCreateOption:P,"data-test-subj":E("values-input"),fullWidth:!0,noSuggestions:!0})),v&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiHorizontalRule,null),i.a.createElement(U.EuiFormRow,{fullWidth:!0},i.a.createElement(E$.a,{isGlobal:b,isPlatinumPlus:m,selected:d,options:t,onChange:R,isLoading:a,description:lV,"data-test-subj":E("effectedPolicies")}))))})),bV={pageTitle:$.i18n.translate("xpack.securitySolution.blocklist.pageTitle",{defaultMessage:"Blocklist"}),pageAboutInfo:$.i18n.translate("xpack.securitySolution.blocklist.pageAboutInfo",{defaultMessage:"The blocklist prevents selected applications from running on your hosts by extending the list of processes the Endpoint considers malicious."}),pageAddButtonTitle:$.i18n.translate("xpack.securitySolution.blocklist.pageAddButtonTitle",{defaultMessage:"Add blocklist entry"}),getShowingCountLabel:e=>$.i18n.translate("xpack.securitySolution.blocklist.showingTotal",{defaultMessage:"Showing {total} {total, plural, one {blocklist entry} other {blocklist entries}}",values:{total:e}}),cardActionEditLabel:$.i18n.translate("xpack.securitySolution.blocklist.cardActionEditLabel",{defaultMessage:"Edit blocklist"}),cardActionDeleteLabel:$.i18n.translate("xpack.securitySolution.blocklist.cardActionDeleteLabel",{defaultMessage:"Delete blocklist"}),flyoutCreateTitle:$.i18n.translate("xpack.securitySolution.blocklist.flyoutCreateTitle",{defaultMessage:"Add blocklist"}),flyoutEditTitle:$.i18n.translate("xpack.securitySolution.blocklist.flyoutEditTitle",{defaultMessage:"Edit blocklist"}),flyoutCreateSubmitButtonLabel:$.i18n.translate("xpack.securitySolution.blocklist.flyoutCreateSubmitButtonLabel",{defaultMessage:"Add blocklist"}),flyoutCreateSubmitSuccess:({name:e})=>$.i18n.translate("xpack.securitySolution.blocklist.flyoutCreateSubmitSuccess",{defaultMessage:'"{name}" has been added to your blocklist.',values:{name:e}}),flyoutEditSubmitSuccess:({name:e})=>$.i18n.translate("xpack.securitySolution.blocklist.flyoutEditSubmitSuccess",{defaultMessage:'"{name}" has been updated.',values:{name:e}}),flyoutDowngradedLicenseDocsInfo:e=>i.a.createElement(i.a.Fragment,null,i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.blocklist.flyoutDowngradedLicenseDocsInfo",defaultMessage:"For more information, see our "}),i.a.createElement(U.EuiLink,{target:"_blank",href:`${e.blocklist}`},i.a.createElement(Fs.FormattedMessage,{id:"xpack.securitySolution.blocklist.flyoutDowngradedLicenseDocsLink",defaultMessage:"blocklist documentation."}))),deleteActionSuccess:e=>$.i18n.translate("xpack.securitySolution.blocklist.deleteSuccess",{defaultMessage:'"{itemName}" has been removed from blocklist.',values:{itemName:e}}),emptyStateTitleNoEntries:$.i18n.translate("xpack.securitySolution.blocklist.emptyStateTitleNoEntries",{defaultMessage:"There are no blocklist entries to display."}),emptyStateTitle:$.i18n.translate("xpack.securitySolution.blocklist.emptyStateTitle",{defaultMessage:"Add your first blocklist entry"}),emptyStateInfo:$.i18n.translate("xpack.securitySolution.blocklist.emptyStateInfo",{defaultMessage:"The blocklist prevents specified applications from running on your hosts, extending the list of processes that Endpoint Security considers malicious."}),emptyStatePrimaryButtonLabel:$.i18n.translate("xpack.securitySolution.blocklist.emptyStatePrimaryButtonLabel",{defaultMessage:"Add blocklist entry"}),searchPlaceholderInfo:$.i18n.translate("xpack.securitySolution.blocklist.searchPlaceholderInfo",{defaultMessage:"Search on the fields below: name, description, value"})},gV=Object(n.memo)((()=>{const{canWriteBlocklist:e}=Object(ch.a)().endpointPrivileges,t=Object(m.i)(),a=Q$.a.getInstance(t);return i.a.createElement($z.a,{apiClient:a,ArtifactFormComponent:mV,labels:bV,"data-test-subj":"blocklistPage",flyoutSize:"l",allowCardCreateAction:e,allowCardEditAction:e,allowCardDeleteAction:e})}));gV.displayName="Blocklist";const fV=Object(n.memo)((()=>i.a.createElement(r.TrackApplicationView,{viewId:S.a.blocklist},i.a.createElement(q.c,null,i.a.createElement(q.a,{path:RB.g,exact:!0,component:gV}),i.a.createElement(q.a,{path:"*",component:z.a})),i.a.createElement(E.a,{pageName:S.a.blocklist}))));fV.displayName="BlocklistContainer";var yV=a(793);const hV=()=>{const[e,t]=Object(n.useState)(!0),a=Object(n.useCallback)((e=>{t(!e)}),[]);return i.a.createElement(wq.a,{"data-test-subj":"responseActionsPage",title:bC.x,subtitle:yV.g.pageSubTitle,hideHeader:e},i.a.createElement(WB.a,{showHostNames:!0,isFlyout:!1,setIsDataInResponse:a}))};hV.displayName="ResponseActionsListPage";const vV=Object(n.memo)((()=>i.a.createElement(q.c,null,i.a.createElement(q.a,{path:RB.r,exact:!0,component:hV}),i.a.createElement(q.a,{path:"*",component:z.a}))));vV.displayName="ResponseActionsContainer";const EV=Object(n.memo)((({component:e,hasPrivilege:t,path:a})=>{const r=Object(n.useCallback)((e=>e.securitySolution.privileges),[]),s=Object(n.useMemo)((()=>t?e:()=>i.a.createElement(Ii.b,{docLinkSelector:r})),[e,r,t]);return i.a.createElement(q.a,{path:a,component:s})}));EV.displayName="PrivilegedRoute";const xV=()=>i.a.createElement(r.TrackApplicationView,{viewId:s.wc.endpoints},i.a.createElement(Pq,null),i.a.createElement(E.a,{pageName:s.wc.endpoints})),jV=()=>i.a.createElement(r.TrackApplicationView,{viewId:s.wc.policies},i.a.createElement(zz,null),i.a.createElement(E.a,{pageName:s.wc.policies})),SV=()=>i.a.createElement(r.TrackApplicationView,{viewId:s.wc.trustedApps},i.a.createElement(I$,null),i.a.createElement(E.a,{pageName:s.wc.trustedApps})),kV=()=>i.a.createElement(r.TrackApplicationView,{viewId:s.wc.eventFilters},i.a.createElement(M$,null),i.a.createElement(E.a,{pageName:s.wc.eventFilters})),OV=()=>i.a.createElement(r.TrackApplicationView,{viewId:s.wc.hostIsolationExceptions},i.a.createElement(G$,null),i.a.createElement(E.a,{pageName:s.wc.hostIsolationExceptions})),wV=()=>i.a.createElement(r.TrackApplicationView,{viewId:s.wc.responseActionsHistory},i.a.createElement(vV,null),i.a.createElement(E.a,{pageName:s.wc.responseActionsHistory})),TV=Object(n.memo)((()=>{const{loading:e,canReadPolicyManagement:t,canReadBlocklist:a,canReadTrustedApplications:n,canReadEventFilters:r,canReadActionsLogManagement:o,canReadEndpointList:l,canReadHostIsolationExceptions:c}=Object(ch.a)().endpointPrivileges;return e?i.a.createElement(U.EuiLoadingSpinner,null):i.a.createElement(q.c,null,i.a.createElement(EV,{path:RB.h,component:xV,hasPrivilege:l}),i.a.createElement(EV,{path:RB.k,component:jV,hasPrivilege:t}),i.a.createElement(EV,{path:RB.s,component:SV,hasPrivilege:n}),i.a.createElement(EV,{path:RB.i,component:kV,hasPrivilege:r}),i.a.createElement(EV,{path:RB.j,component:OV,hasPrivilege:c}),i.a.createElement(EV,{path:RB.g,component:fV,hasPrivilege:a}),i.a.createElement(EV,{path:RB.r,component:wV,hasPrivilege:o}),l&&i.a.createElement(q.a,{path:s.Ib,exact:!0},i.a.createElement(B.Redirect,{to:Object(v.e)({name:"endpointList"})})),i.a.createElement(q.a,{path:"*",component:z.a}))}));TV.displayName="ManagementContainer";var IV=a(1486);const CV=$.i18n.translate("xpack.securitySolution.management.landing.title",{defaultMessage:"Manage"}),MV=()=>{var e;const{links:t=[],categories:a=[]}=null!==(e=Object(wk.c)(S.a.administration))&&void 0!==e?e:{},n=Object(Yi.a)();return i.a.createElement(h.a,null,i.a.createElement(Ci.a,{title:CV}),i.a.createElement(Sk,{links:t,categories:a,onLinkClick:Ck,urlState:n}),i.a.createElement(E.a,{pageName:S.a.administration}))},_V=()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:S.a.administration},i.a.createElement(MV,null))),FV=()=>i.a.createElement(N,null,i.a.createElement(IV.a,null,i.a.createElement(TV,null))),AV=[{path:s.Jb,component:i.a.memo(_V)},{path:s.Ib,component:i.a.memo(FV)}];var DV=a(1498),NV=a(1502),PV=a(88);const RV=({pageName:e,...t})=>i.a.createElement(E.a,Ni()({pageName:e},t)),LV={getFiltersGlobalComponent:()=>X.a,getSpyRouteComponent:()=>RV},BV=()=>{const{cloudDefend:e}=Object(m.j)().services,t=e.getCloudDefendRouter();return i.a.createElement(N,null,i.a.createElement(h.a,{noPadding:!0,noTimeline:!0},i.a.createElement(t,{securitySolutionContext:LV})))};BV.displayName="CloudDefend";const qV=[{path:PV.CLOUD_DEFEND_BASE_PATH,component:BV}];var zV=a(89);const $V=({pageName:e,...t})=>i.a.createElement(E.a,Ni()({pageName:e},t)),VV={getFiltersGlobalComponent:()=>X.a,getSpyRouteComponent:()=>$V},UV=()=>{const{cloudSecurityPosture:e}=Object(m.j)().services,t=e.getCloudSecurityPostureRouter();return i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:"cloud_security_posture"},i.a.createElement(h.a,{noPadding:!0,noTimeline:!0},i.a.createElement(t,{securitySolutionContext:VV}))))};UV.displayName="CloudSecurityPosture";const HV=[{path:zV.CLOUD_SECURITY_POSTURE_BASE_PATH,component:UV}];var GV=a(90),QV=a(732);const WV=({dataProviders:e,from:t,to:a})=>{const{data:{query:i}}=Object(m.j)().services,r=Object(o.useDispatch)(),{startTransaction:l}=Object($d.b)(),c=Object(n.useMemo)((()=>i.filterManager),[i.filterManager]),u=Object(n.useMemo)((()=>b.b.getTimelineByIdSelector()),[]),{filterManager:p}=Object(j.a)((e=>{var t;return u(e,null!==(t=d.c.active)&&void 0!==t?t:"")})),g=Object(n.useMemo)((()=>null!=p?p:c),[p,c]),f=Object(n.useCallback)((e=>r(b.a.updateIsLoading(e))),[r]),y=Object(Xm.a)({timelineId:d.c.active,timelineType:Dd.l.default}),h=Object(n.useCallback)((({from:e,timeline:t,to:a,ruleNote:n})=>{var i;y(),f({id:d.c.active,isLoading:!1}),Object(LO.b)(r)({duplicate:!0,from:e,id:d.c.active,notes:[],timeline:{...t,filterManager:g,indexNames:null!==(i=t.indexNames)&&void 0!==i?i:[],show:!0},to:a,ruleNote:n})()}),[r,g,f,y]);return Object(n.useCallback)((async()=>{l({name:`${s.l} threat indicator investigateInTimeline`}),await h({from:t,notes:null,timeline:{...Of.b,dataProviders:e,id:d.c.active,indexNames:[],dateRange:{start:t,end:a},eventType:"all",filters:[],kqlQuery:{filterQuery:{kuery:{kind:"kuery",expression:""},serializedQuery:""}}},to:a,ruleNote:""})}),[l,h,e,t,a])};var KV=a(755);const YV=Object(n.memo)((()=>{const{threatIntelligence:e,http:t}=Object(m.j)().services,a=e.getComponent(),n=Object(g.d)(),r=Object(Vr.c)(),s={securitySolutionStore:r,getFiltersGlobalComponent:()=>X.a,getPageWrapper:()=>h.a,licenseService:fp.a,sourcererDataView:n,getUseInvestigateInTimeline:WV,blockList:{canWriteBlocklist:Object(ch.a)().endpointPrivileges.canWriteBlocklist,exceptionListApiClient:Q$.a.getInstance(t),useSetUrlParams:QV.a,getFlyoutComponent:()=>KV.b,getFormComponent:()=>mV},useQuery:()=>Object(o.useSelector)(Vr.d.globalQuerySelector()),useFilters:()=>Object(o.useSelector)(Vr.d.globalFiltersQuerySelector()),useGlobalTime:J.a,registerQuery:e=>r.dispatch(Object(ae.setQuery)({inputId:Y.a.global,id:e.id,refetch:e.refetch,inspect:null,loading:e.loading})),deregisterQuery:e=>r.dispatch(Object(ae.deleteOneQuery)({inputId:Y.a.global,id:e.id})),SiemSearchBar:ee.a};return i.a.createElement(JC,{pageName:S.a.threatIntelligence},i.a.createElement(a,{securitySolutionContext:s}),i.a.createElement(E.a,{pageName:S.a.threatIntelligence}))}));YV.displayName="ThreatIntelligence";const JV=[{path:GV.THREAT_INTELLIGENCE_BASE_PATH,render:()=>i.a.createElement(YV,null)}];var XV=a(86),ZV=a(318);const eU=$.i18n.translate("xpack.securitySolution.dashboards.landing.createButton",{defaultMessage:"Create Dashboard"}),tU=$.i18n.translate("xpack.securitySolution.dashboards.landing.section.default",{defaultMessage:"DEFAULT"}),aU=$.i18n.translate("xpack.securitySolution.dashboards.landing.section.custom",{defaultMessage:"CUSTOM"});var nU=a(18);const iU=$.i18n.translate("xpack.securitySolution.dashboards.pageTitle",{defaultMessage:"Dashboards"}),rU=i.a.createContext({securityTags:null}),sU=({children:e})=>{const{tags:t,isLoading:a}=(()=>{const{http:e,savedObjectsTagging:t}=Object(m.j)().services,a=Object(n.useRef)(!1),{data:i,isLoading:r,error:o}=Object(du.b)(du.a.SECURITY_TAGS,Rw,{initialParameters:{http:e,tagName:s.sc}}),{fetch:l,data:c,isLoading:u,error:d}=Object(du.b)(du.a.SECURITY_CREATE_TAG,Lw);return Object(n.useEffect)((()=>{!t||r||o||!i||0!==i.length||a.current||(a.current=!0,l({savedObjectsTaggingClient:t.client,tag:{name:s.sc,description:s.rc,color:`#${String(Math.floor(16777215*Math.random()).toString(16)).padStart(6,"0")}`}}))}),[o,l,t,r,i]),{tags:Object(n.useMemo)((()=>null!=i&&i.length?i.map((e=>({id:e.id,type:"tag",...e.attributes}))):c?[{type:"tag",...c}]:void 0),[i,c]),isLoading:r||u,error:o||d}})(),r=a||!t?null:t;return i.a.createElement(rU.Provider,{value:{securityTags:r}},e)},oU=()=>(()=>{const e=i.a.useContext(rU);if(!e)throw new Error("useDashboardContext must be used within a DashboardContextProvider");return e})().securityTags,lU=()=>{const{dashboard:e}=Object(m.j)().services,t=oU();return Object(n.useMemo)((()=>{var a,n,i;const r=null==t||null===(a=t[0])||void 0===a?void 0:a.id;return r?{isLoading:!1,url:null!==(n=null==e||null===(i=e.locator)||void 0===i?void 0:i.getRedirectUrl({tags:[r]}))&&void 0!==n?n:""}:{isLoading:!0,url:""}}),[t,null==e?void 0:e.locator])},cU=({canCreateDashboard:e})=>{const{isLoading:t,url:a}=lU(),{navigateTo:n}=Object(m.k)();return i.a.createElement(U.EuiFlexGroup,{gutterSize:"none",direction:"row"},i.a.createElement(U.EuiFlexItem,null,i.a.createElement(XR.a,{title:iU})),e&&i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(ZV.d,{isDisabled:t,color:"primary",fill:!0,iconType:"plusInCircle",href:a,onClick:e=>{e.preventDefault(),Object(nU.h)(nU.a.CLICK,`${nU.c.CREATE_DASHBOARD}`),n({url:a})},"data-test-subj":"createDashboardButton"},eU)))},uU=()=>{var e;const{links:t=[]}=null!==(e=Object(wk.c)(s.wc.dashboards))&&void 0!==e?e:{},a=Object(Yi.a)(),{show:r,createNew:o}=Object(m.e)(XV.LEGACY_DASHBOARD_APP_ID),{navigateTo:l}=Object(m.k)(),c=Object(p.n)(),u=Object(n.useCallback)((e=>`${c({deepLinkId:s.wc.dashboards,path:e})}`),[c]),{isLoading:d,url:b}=lU(),g=Object(n.useCallback)((e=>e?u(e):b),[b,u]),f=Object(n.useCallback)((e=>{Object(nU.h)(nU.a.CLICK,nU.c.DASHBOARD),l({url:g(e)})}),[g,l]),y=oU(),v=y&&(null==y?void 0:y.length)>0,x=Object(n.useMemo)((()=>(e=>{if(e)return`tag:(${[...null==e?void 0:e.reduce(((e,{name:t})=>{const a=`"${t}"`;return t&&!e.has(a)&&e.add(a),e}),new Set)].join(" or")})`})(y)),[y]);return i.a.createElement(h.a,null,i.a.createElement(cU,{canCreateDashboard:o}),i.a.createElement(U.EuiSpacer,{size:"xl"}),i.a.createElement(U.EuiTitle,{size:"xxxs"},i.a.createElement("h2",null,tU)),i.a.createElement(U.EuiHorizontalRule,{margin:"s"}),i.a.createElement(Ok,{items:t,urlState:a,onLinkClick:Ck}),i.a.createElement(U.EuiSpacer,{size:"m"}),r&&v&&x&&i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiTitle,{size:"xxxs"},i.a.createElement("h2",null,aU)),i.a.createElement(U.EuiHorizontalRule,{margin:"s"}),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(XV.DashboardListingTable,{disableCreateDashboardButton:d,getDashboardUrl:u,goToDashboard:f,initialFilter:x,urlStateEnabled:!1,showCreateDashboardButton:!1})),r&&!v&&i.a.createElement(U.EuiEmptyPrompt,{icon:i.a.createElement(U.EuiLoadingSpinner,{size:"l","data-test-subj":"dashboardLoadingIcon"})}),i.a.createElement(E.a,{pageName:s.wc.dashboards}))},dU=$.i18n.translate("xpack.securitySolution.dashboards.dashboard.viewPorpmpt.noReadPermission.title",{defaultMessage:"You have no permission to read the dashboard"}),pU=$.i18n.translate("xpack.securitySolution.dashboards.dashboard.viewPorpmpt.noReadPermission.description",{defaultMessage:"Contact your administrator for help."}),mU=($.i18n.translate("xpack.securitySolution.dashboards.dashboard.viewPorpmpt.indicesNotFound.title",{defaultMessage:"Indices not found"}),$.i18n.translate("xpack.securitySolution.dashboards.dashboard.notFound.title",{defaultMessage:"Not found"})),bU=$.i18n.translate("xpack.securitySolution.dashboards.dashboard.editDashboardButtonTitle",{defaultMessage:"Edit"});let gU;!function(e){e.NoReadPermission="NoReadPermission"}(gU||(gU={}));const fU={[gU.NoReadPermission]:{color:"danger",iconType:"error",title:i.a.createElement("h2",null,dU),body:i.a.createElement("p",null,pU)}},yU=({canReadDashboard:e,filters:t,id:a,inputId:r=Y.a.global,onDashboardContainerLoaded:s,query:l,savedObjectId:c,timeRange:u})=>{const d=Object(o.useDispatch)(),[p,m]=Object(n.useState)(),b=Object(n.useCallback)((()=>Promise.resolve({getInitialInput:()=>({timeRange:u,viewMode:Ki.ViewMode.VIEW,query:l,filters:t}),useControlGroupIntegration:!0})),[t,l,u]),g=Object(n.useCallback)((()=>{null==p||p.forceRefresh()}),[p]);Object(n.useEffect)((()=>(d(te.b.setQuery({inputId:r,id:a,refetch:g,loading:!1,inspect:null})),()=>{d(te.b.deleteOneQuery({inputId:r,id:a}))})),[d,a,r,g]),Object(n.useEffect)((()=>{null==p||p.updateInput({timeRange:u,query:l,filters:t})}),[p,t,l,u]);const f=Object(n.useCallback)((e=>{m(e),null==s||s(e)}),[s]);return c&&e?i.a.createElement(XV.DashboardRenderer,{ref:f,savedObjectId:c,getCreationOptions:b}):null};yU.displayName="DashboardRendererComponent";const hU=i.a.memo(yU),vU=({currentState:e})=>{const t=(e=>e?fU[e]:null)(e);return t&&e?i.a.createElement(U.EuiPageTemplate,{"data-test-subj":`dashboardViewEmpty${e}`},i.a.createElement(U.EuiPageTemplate.EmptyPrompt,t)):null};vU.displayName="StatusPromptComponent";const EU=i.a.memo(vU),xU=({filters:e,query:t,savedObjectId:a,timeRange:r})=>{const{services:{dashboard:s}}=Object(m.j)(),{navigateTo:o}=Object(m.l)(),l=Object(n.useCallback)((n=>{var i;n.preventDefault();const l=null==s||null===(i=s.locator)||void 0===i?void 0:i.getRedirectUrl({query:t,filters:e,timeRange:r,dashboardId:a,viewMode:Ki.ViewMode.EDIT});l&&o({url:l})}),[null==s?void 0:s.locator,t,e,r,a,o]);return i.a.createElement(U.EuiButton,{color:"primary","data-test-subj":"dashboardEditButton",fill:!0,iconType:"pencil",onClick:l},bU)};xU.displayName="EditDashboardComponent";const jU=i.a.memo(xU),SU={minHeight:"calc(100vh - 140px)"},kU=()=>{var e;const{fromStr:t,toStr:a,from:r,to:o}=Object(j.a)((e=>Object(x.pick)(["fromStr","toStr","from","to"],Vr.d.globalTimeRangeSelector(e)))),l=Object(n.useMemo)((()=>({from:r,to:o,fromStr:t,toStr:a})),[r,t,o,a]),c=Object(n.useMemo)((()=>Vr.d.globalQuerySelector()),[]),u=Object(n.useMemo)((()=>Vr.d.globalFiltersQuerySelector()),[]),d=Object(j.a)(c),p=Object(j.a)(u),{indexPattern:b,indicesExist:f}=Object(g.d)(),{show:y,showWriteControls:v}=Object(m.e)(XV.LEGACY_DASHBOARD_APP_ID),S=Object(n.useMemo)((()=>y?null:gU.NoReadPermission),[y]),[k,O]=Object(n.useState)(),w=Object(n.useCallback)((e=>{if(e){const t=e.getTitle().trim();O(t?{title:t}:{title:mU})}}),[]),T=Object(n.useMemo)((()=>null!=k),[k]),{detailName:I}=Object(B.useParams)();return i.a.createElement(i.a.Fragment,null,f&&i.a.createElement(X.a,null,i.a.createElement(ee.a,{id:Y.a.global,indexPattern:b})),i.a.createElement(h.a,null,i.a.createElement(U.EuiFlexGroup,{direction:"column",style:SU,gutterSize:"none","data-test-subj":"dashboard-view-wrapper"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(Ci.a,{border:!0,title:null!==(e=null==k?void 0:k.title)&&void 0!==e?e:i.a.createElement(U.EuiLoadingSpinner,{size:"m"})},v&&T&&i.a.createElement(jU,{filters:p,query:d,savedObjectId:I,timeRange:l}))),!S&&i.a.createElement(U.EuiFlexItem,{grow:!0},i.a.createElement(hU,{query:d,filters:p,canReadDashboard:y,id:`dashboard-view-${I}`,onDashboardContainerLoaded:w,savedObjectId:I,timeRange:l})),S&&i.a.createElement(U.EuiFlexItem,{"data-test-subj":"dashboard-view-error-prompt-wrapper",grow:!0},i.a.createElement(EU,{currentState:S})),i.a.createElement(E.a,{pageName:s.wc.dashboards,state:{dashboardName:null==k?void 0:k.title}}))))};kU.displayName="DashboardViewComponent";const OU=i.a.memo(kU),wU=()=>i.a.createElement(sU,null,i.a.createElement(q.c,null,i.a.createElement(q.a,{strict:!0,path:`${s.t}/:detailName`},i.a.createElement(OU,null)),i.a.createElement(q.a,{path:`${s.t}`},i.a.createElement(uU,null)))),TU=i.a.memo(wU),IU=[{path:s.t,component:()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:s.wc.dashboards},i.a.createElement(TU,null)))}],CU=({items:e,type:t})=>{const a=[{field:"id_value",name:"Name",render:e=>t===pf.c.host?i.a.createElement(ge.d,{hostName:e}):i.a.createElement(ge.m,{userName:e})},{field:"calculated_level",name:"Level",render:e=>null!=e?i.a.createElement(no.b,{severity:e}):""},{field:"calculated_score_norm",name:"Score norm",render:e=>null!=e?Math.round(100*e)/100:""}];return i.a.createElement(U.EuiInMemoryTable,{"data-test-subj":t===pf.c.host?"host-risk-preview-table":"user-risk-preview-table",responsive:!1,items:e,columns:a,loading:!1})},MU=(e=[],t)=>{var a,n;return(null==e||null===(a=e.filter((e=>(null==e?void 0:e.id_field)===t)))||void 0===a||null===(n=a.sort(((e,t)=>(null==t?void 0:t.calculated_score_norm)-(null==e?void 0:e.calculated_score_norm))))||void 0===n?void 0:n.slice(0,5))||[]},_U=({items:e,showMessage:t,hideMessage:a,isLoading:r,type:s})=>{const[o,l]=Object(n.useState)("open");return i.a.createElement(U.EuiPanel,{hasBorder:!0},i.a.createElement(U.EuiAccordion,{initialIsOpen:!0,isLoading:r,id:"host-table",buttonContent:"closed"===o?t:a,forceState:o,onToggle:e=>{l(e?"open":"closed")},extraAction:i.a.createElement(U.EuiIcon,{type:s===pf.c.host?"storage":"user"})},i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(CU,{items:e,type:s}))))},FU=()=>{const[e,t]=Object(n.useState)({from:"now-24h",to:"now"}),[a,r]=Object(n.useState)({bool:{must:[],filter:[],should:[],must_not:[]}}),{unifiedSearch:{ui:{SearchBar:o}}}=Object(m.j)().services,{addError:l}=Object(rs.a)(),{indexPattern:c}=Object(g.d)(f.SourcererScopeName.detections),{data:u,isLoading:d,refetch:p,isError:b}=(({data_view_id:e,range:t,filter:a})=>Object(Hu.useQuery)(["POST","FETCH_PREVIEW_RISK_SCORE",t,a],(async({signal:n})=>{const i={data_view_id:e};if(t){var r,o;const e=null===(r=pP.a.parse(t.start))||void 0===r?void 0:r.utc().toISOString(),a=null===(o=pP.a.parse(t.end,{roundUp:!0}))||void 0===o?void 0:o.utc().toISOString();e&&a&&(i.range={start:e,end:a})}a&&(i.filter=a);const l=await(async({signal:e,params:t})=>m.b.get().http.fetch(s.ic,{method:"POST",body:JSON.stringify(t),signal:e}))({signal:n,params:i});return l})))({data_view_id:c.title,filter:a,range:{start:e.from,end:e.to}}),y=MU(null==u?void 0:u.scores.host,"host.name"),h=MU(null==u?void 0:u.scores.user,"user.name"),v=Object(n.useCallback)((e=>{t({from:e.dateRange.from,to:e.dateRange.to});try{var a;const t=Object(bt.buildEsQuery)(void 0,null!==(a=e.query)&&void 0!==a?a:{query:"",language:"kuery"},[]);r(t)}catch(e){l(e,{title:md})}}),[l,t,r]);return b?i.a.createElement(U.EuiCallOut,{"data-test-subj":"risk-preview-error",title:ud,color:"danger",iconType:"error"},i.a.createElement("p",null,dd),i.a.createElement(U.EuiButton,{"data-test-subj":"risk-preview-error-button",color:"danger",onClick:()=>p()},pd)):i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiTitle,null,i.a.createElement("h2",null,ld)),i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement(U.EuiText,null,cd),i.a.createElement(U.EuiSpacer,null),i.a.createElement(U.EuiFormRow,{fullWidth:!0,"data-test-subj":"risk-score-preview-search-bar"},c&&i.a.createElement(o,{appName:"siem",isLoading:d,indexPatterns:[c],dateRangeFrom:e.from,dateRangeTo:e.to,onQuerySubmit:v,showFilterBar:!1,showDatePicker:!0,displayStyle:"inPage",submitButtonStyle:"iconOnly"})),i.a.createElement(U.EuiSpacer,null),i.a.createElement(_U,{items:y,showMessage:Yu,hideMessage:Ju,isLoading:d,type:pf.c.host}),i.a.createElement(U.EuiSpacer,null),i.a.createElement(_U,{items:h,showMessage:Xu,hideMessage:Zu,isLoading:d,type:pf.c.user}))},AU=["POST","INIT_RISK_ENGINE"],DU=["POST","ENABLE_RISK_ENGINE"],NU=["POST","DISABLE_RISK_ENGINE"],PU=[{link:s.jb,label:rd},{link:s.Xb,label:sd},{link:s.Zb,label:od}],RU=({errors:e})=>i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiCallOut,{title:kd,color:"danger",iconType:"error","data-test-subj":"risk-score-error-panel"},i.a.createElement("p",null,Od),i.a.createElement(U.EuiAccordion,{id:"risk-engine-erros",buttonContent:wd},i.a.createElement(i.a.Fragment,null,e.map((e=>i.a.createElement("div",{key:e},i.a.createElement(U.EuiText,{size:"s"},e),i.a.createElement(U.EuiSpacer,{size:"s"})))))))),LU=()=>{const[e,t]=Object(n.useState)(!1),{data:a}=Ku(),r=(e=>{const t=Wu();return Object(Hu.useMutation)((()=>(async()=>m.b.get().http.fetch(s.dc,{method:"POST"}))()),{...e,mutationKey:AU,onSettled:(...a)=>{t(),null!=e&&e.onSettled&&e.onSettled(...a)}})})({onSettled:()=>{t(!1)}}),o=(e=>{const t=Wu();return Object(Hu.useMutation)((()=>(async()=>m.b.get().http.fetch(s.cc,{method:"POST"}))()),{...e,mutationKey:DU,onSettled:(...a)=>{t(),null!=e&&e.onSettled&&e.onSettled(...a)}})})(),l=(e=>{const t=Wu();return Object(Hu.useMutation)((()=>(async()=>m.b.get().http.fetch(s.bc,{method:"POST"}))()),{...e,mutationKey:NU,onSettled:(...a)=>{t(),null!=e&&e.onSettled&&e.onSettled(...a)}})})(),c=null==a?void 0:a.risk_engine_status,u=()=>t(!1),d=r.isLoading||o.isLoading||l.isLoading,p=null==a?void 0:a.isUpdateAvailable,b=!c||d;let g;e&&(g=i.a.createElement(U.EuiModal,{onClose:u},r.isLoading?i.a.createElement(U.EuiModalHeader,null,i.a.createElement(U.EuiFlexGroup,{gutterSize:"m",alignItems:"center"},i.a.createElement(U.EuiLoadingSpinner,{size:"m"}),i.a.createElement(U.EuiModalHeaderTitle,null,fd))):i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiModalHeader,null,i.a.createElement(U.EuiModalHeaderTitle,null,yd)),i.a.createElement(U.EuiModalBody,null,i.a.createElement(U.EuiText,null,i.a.createElement("p",null,i.a.createElement("b",null,hd),vd),i.a.createElement(U.EuiSpacer,{size:"s"}),i.a.createElement("p",null,i.a.createElement("b",null,Ed),xd)),i.a.createElement(U.EuiSpacer,null)),i.a.createElement(U.EuiModalFooter,null,i.a.createElement(U.EuiButtonEmpty,{color:"primary","data-test-subj":"risk-score-update-cancel",onClick:u},jd),i.a.createElement(U.EuiButton,{color:"primary","data-test-subj":"risk-score-update-confirm",onClick:()=>r.mutate(),fill:!0},Sd)))));let f=[];if(r.isError){var y;const e=r.error.body.message;var h;f=null!=e&&null!==(y=e.full_error)&&void 0!==y&&y.errors?null===(h=e.full_error)||void 0===h?void 0:h.errors:[e]}return c!==pf.b.ENABLED&&null!=a&&a.is_max_amount_of_risk_engines_reached?i.a.createElement(U.EuiCallOut,{title:(v=pf.a,$.i18n.translate("xpack.securitySolution.riskScore.maxSpacePanel.title",{defaultMessage:"Entity Risk Scoring in the current version can run in {maxSpaces} Kibana spaces.",values:{maxSpaces:v}})),color:"warning",iconType:"error","data-test-subj":"risk-score-warning-panel"},i.a.createElement("p",null,Md)):i.a.createElement(i.a.Fragment,null,i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiTitle,null,i.a.createElement("h2",null,ed)),r.isError&&i.a.createElement(RU,{errors:f}),l.isError&&i.a.createElement(RU,{errors:[l.error.body.message.message]}),o.isError&&i.a.createElement(RU,{errors:[o.error.body.message.message]}),i.a.createElement(U.EuiSpacer,{size:"m"}),i.a.createElement(U.EuiFlexItem,{grow:0},g,i.a.createElement(U.EuiHorizontalRule,{margin:"s"}),i.a.createElement(U.EuiFlexGroup,{justifyContent:"spaceBetween",alignItems:"center"},i.a.createElement(U.EuiFlexItem,{grow:!1},i.a.createElement(U.EuiFlexGroup,{gutterSize:"s",alignItems:"baseline"},nd,p&&i.a.createElement(U.EuiBadge,{color:"success"},bd))),i.a.createElement(U.EuiFlexItem,{grow:!1},p&&i.a.createElement(U.EuiFlexGroup,{gutterSize:"s",alignItems:"center"},i.a.createElement(U.EuiFlexItem,null,r.isLoading&&!e&&i.a.createElement(U.EuiLoadingSpinner,{size:"m"})),i.a.createElement(U.EuiButtonEmpty,{disabled:r.isLoading,color:"primary",onClick:()=>t(!0),"data-test-subj":"risk-score-update-button"},gd)),!p&&i.a.createElement(U.EuiFlexGroup,{gutterSize:"s",alignItems:"center"},i.a.createElement(U.EuiFlexItem,null,d&&i.a.createElement(U.EuiLoadingSpinner,{size:"m"})),i.a.createElement(BU,{"data-test-subj":"risk-score-status",$_css:"50px"},c===pf.b.ENABLED?i.a.createElement(U.EuiHealth,{color:"success"},td):i.a.createElement(U.EuiHealth,{color:"subdued"},ad)),i.a.createElement(U.EuiFlexItem,null,i.a.createElement(U.EuiSwitch,{label:"","data-test-subj":"risk-score-switch",checked:c===pf.b.ENABLED,onChange:()=>{b||(c===pf.b.NOT_INSTALLED?r.mutate():c===pf.b.ENABLED?l.mutate():c===pf.b.DISABLED&&o.mutate())},compressed:!0,disabled:b,"aria-describedby":"switchRiskModule"}))))),i.a.createElement(U.EuiHorizontalRule,{margin:"s"}))),i.a.createElement(U.EuiSpacer,null),i.a.createElement(i.a.Fragment,null,i.a.createElement(U.EuiTitle,null,i.a.createElement("h2",null,id)),i.a.createElement(U.EuiSpacer,null),i.a.createElement("ul",null,PU.map((({link:e,label:t})=>i.a.createElement("li",{key:e},i.a.createElement(U.EuiLink,{href:e,target:"_blank",external:!0},t),i.a.createElement(U.EuiSpacer,{size:"s"})))))));var v};var BU=G()(U.EuiFlexItem).withConfig({displayName:"_StyledEuiFlexItem",componentId:"sc-zswf7b-0"})((e=>({minWidth:e.$_css})));const qU=()=>i.a.createElement(i.a.Fragment,null,i.a.createElement(Ti.a,null),i.a.createElement(U.EuiPageHeader,{"data-test-subj":"entityAnalyticsManagmentPageTitle",pageTitle:bC.l}),i.a.createElement(U.EuiSpacer,{size:"l"}),i.a.createElement(U.EuiFlexGroup,{gutterSize:"xl"},i.a.createElement(U.EuiFlexItem,{grow:2},i.a.createElement(LU,null)),i.a.createElement(U.EuiFlexItem,{grow:2},i.a.createElement(FU,null))));qU.displayName="EntityAnalyticsManagementPage";const zU=()=>i.a.createElement(N,null,i.a.createElement(r.TrackApplicationView,{viewId:s.wc.entityAnalyticsManagement},i.a.createElement(qU,null),i.a.createElement(E.a,{pageName:s.wc.entityAnalyticsManagement}))),$U=()=>i.a.createElement(B.Switch,null,i.a.createElement(q.a,{path:s.qb,exact:!0,component:zU}),i.a.createElement(q.a,{component:z.a})),VU=i.a.memo($U),UU=[{path:s.qb,render:()=>i.a.createElement(VU,null)}],HU={Detections:class detections_Detections{setup(){}start(e){return{storageDataTables:{tableById:Object(L.b)(e,Xr)},routes:Jr}}},Cases:class cases_Cases{setup(){}start(){return{routes:P}}},Exceptions:class exceptions_Exceptions{setup(){}start(e){return{storageDataTables:{tableById:Object(L.b)(e,Xr)},routes:Is}}},Explore:class explore_Explore{setup(){}start(e){return{routes:Fk,exploreDataTables:{network:{tableById:Object(L.b)(e,[R.e.networkPageEvents])},hosts:{tableById:Object(L.b)(e,[R.e.hostsPageEvents,R.e.hostsPageSessions])},users:{tableById:Object(L.b)(e,[R.e.usersPageEvents])}},store:{initialState:{network:kv.a,users:ao.a,hosts:Nb.e},reducer:{network:kv.d,users:ao.d,hosts:Nb.c}}}}},Kubernetes:class kubernetes_Kubernetes{setup(){}start(){return{routes:$k}}},Overview:class overview_Overview{setup(){}start(){return{routes:tM}}},Rules:class rules_Rules{setup(){}start(e){return{storageDataTables:{tableById:Object(L.b)(e,Xr)},routes:EB}}},Timelines:class timelines_Timelines{setup(){}start(){return{routes:FB,store:{initialState:{timeline:NB},reducer:{timeline:PB}}}}},Management:class management_Management{setup(){}start(e,t){return{routes:AV,store:{initialState:{management:{}},reducer:{management:DV.a},middleware:Object(NV.a)(e,t)}}}},Dashboards:class dashboards_Dashboards{setup(){}start(){return{routes:IU}}},CloudDefend:class cloud_defend_CloudDefend{setup(){}start(){return{routes:qV}}},CloudSecurityPosture:class cloud_security_posture_CloudSecurityPosture{setup(){}start(){return{routes:HV}}},ThreatIntelligence:class threat_intelligence_ThreatIntelligence{setup(){}start(){return{routes:JV}}},EntityAnalytics:class entity_analytics_EntityAnalytics{setup(){}start(e=!1){return{routes:e?UU:[]}}}}}])]);