/*! Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one or more contributor license agreements.
 * Licensed under the Elastic License 2.0; you may not use this file except in compliance with the Elastic License 2.0. */
(window.threatIntelligence_bundle_jsonpfunction=window.threatIntelligence_bundle_jsonpfunction||[]).push([[2],{106:function(e,t,a){e.exports=a.p+"4675c2990a45ad8bac7a3b6199bb939e.svg"},107:function(e,t){e.exports=function(e){if("function"!=typeof e)throw new TypeError("Expected a function");return function(){var t=arguments;switch(t.length){case 0:return!e.call(this);case 1:return!e.call(this,t[0]);case 2:return!e.call(this,t[0],t[1]);case 3:return!e.call(this,t[0],t[1],t[2])}return!e.apply(this,t)}}},108:function(e,t,a){e.exports=a.p+"08153df199173c3869bc5930d76c1e36.svg"},109:function(e,t,a){"use strict";a.r(t),a.d(t,"APP_ID",(function(){return ot})),a.d(t,"IndicatorsPageWrapper",(function(){return rt}));var i=a(1),n=a.n(i),s=a(55),o=a(70),r=a(78),c=a(8);var l=a(10);const u=l.i18n.translate("xpack.threatIntelligence.blocklist.flyoutTitle",{defaultMessage:"Add blocklist"});var d=a(21),b=a(0);const j=({indicatorFileHash:e})=>{const{setBlockListIndicatorValue:t}=Object(o.a)(),{blockList:a}=Object(d.a)(),i=a.getFlyoutComponent(),n=a.exceptionListApiClient,r=a.getFormComponent(),{isLoading:l,data:j}=function(){const{http:e}=Object(c.b)().services;return Object(s.useQuery)(["policies"],(()=>e.get("/api/fleet/package_policies",{query:{withAgentCount:!0,kuery:"ingest-package-policies.package.name: endpoint"}})),{select:e=>e.items})}(),g={apiClient:n,labels:{flyoutCreateTitle:u},item:{description:"",entries:[{field:"file.hash.*",operator:"included",type:"match_any",value:[e]}],list_id:"endpoint_blocklists",name:"",namespace_type:"agnostic",os_types:["windows"],tags:["policy:all"],type:"simple"},policies:j||[],policiesIsLoading:l,FormComponent:r,onClose:()=>t("")};return Object(b.jsx)(i,g)};var g=a(3),p=a(4),x=a(5);const O="tiBarchartTimelineButton",m="tiBarchartFilterInButton",h="tiBarchartFilterOutButton",f="tiBarchartCopyToClipboardButton",y=l.i18n.translate("xpack.threatIntelligence.indicator.fieldSelector.label",{defaultMessage:"Stack by"}),I=l.i18n.translate("xpack.threatIntelligence.indicator.barChart.popover",{defaultMessage:"More actions"}),C=x.b.Feed,v={asPlainText:!0},E=Object(i.memo)((({indexPattern:e,valueChange:t,defaultStackByValue:a=C})=>{const n=e.fields.find((e=>e.name===a)),[s,o]=Object(i.useState)([{label:a,value:null==n?void 0:n.type}]),r=Object(i.useMemo)((()=>e?e.fields.map((e=>({label:e.name,value:e.type}))):[]),[e]),c=Object(i.useCallback)((e=>{e&&e.length>0&&t(e[0]),o(e)}),[t]);return Object(b.jsx)(g.EuiComboBox,{css:{maxWidth:"400px",width:"400px"},"data-test-subj":"tiIndicatorFieldSelectorDropdown",prepend:y,singleSelection:v,onChange:c,options:r,selectedOptions:s,isClearable:!1})}));var S=a(57),F=a(56),T=a.n(F),P=a(71),w=a(67),k=a(68),M=a(69);const B=({data:e,field:t})=>{const[a,n]=Object(i.useState)(!1),s="date"===t.value?T()(e).toISOString():e,o=[Object(b.jsx)(w.d,{key:m,data:s,field:t.label,"data-test-subj":m}),Object(b.jsx)(k.d,{key:h,data:s,field:t.label,"data-test-subj":h}),Object(b.jsx)(M.d,{key:O,data:s,field:t.label,"data-test-subj":O}),Object(b.jsx)(P.c,{key:f,value:s,"data-test-subj":f})];return Object(b.jsx)(g.EuiPopover,{"data-test-subj":"tiBarchartPopoverButton",button:Object(b.jsx)(g.EuiToolTip,{content:I},Object(b.jsx)(g.EuiButtonIcon,{"aria-label":I,iconType:"boxesHorizontal",iconSize:"s",size:"xs",onClick:()=>n((e=>!e)),style:{height:"100%"}})),isOpen:a,closePopover:()=>n(!1),panelPaddingSize:"none",anchorPosition:"downLeft"},Object(b.jsx)(g.EuiContextMenuPanel,{size:"s",items:o}))};var z=a(75);const L="tiIndicator",A=({indicators:e,dateRange:t,field:a,height:i="200px"})=>Object(b.jsx)(g.EuiThemeProvider,null,Object(b.jsx)(S.Chart,{size:{width:"100%",height:i}},Object(b.jsx)(S.Settings,{showLegend:!0,legendPosition:S.Position.Right,legendSize:200,legendAction:({label:e})=>Object(b.jsx)(B,{field:a,data:e})}),Object(b.jsx)(S.Axis,{id:`${L}TimeAxis`,position:S.Position.Bottom,labelFormat:Object(z.a)(t)}),Object(b.jsx)(S.Axis,{id:`${L}IndicatorAxis`,position:S.Position.Left}),Object(b.jsx)(S.BarSeries,{id:`${L}BarChart`,name:"Indicators",xScaleType:S.ScaleType.Time,yScaleType:S.ScaleType.Linear,xAccessor:"x",yAccessors:["y"],stackAccessors:["x"],splitSeriesAccessors:["g"],data:e}))),R=x.b.Feed,_=Object(i.memo)((({timeRange:e,indexPattern:t,isLoading:a,isFetching:i,series:n,dateRange:s,field:o,onFieldChange:r})=>a?Object(b.jsx)(g.EuiFlexGroup,{justifyContent:"spaceAround"},Object(b.jsx)(g.EuiFlexItem,{grow:!1},Object(b.jsx)(g.EuiPanel,{hasShadow:!1,hasBorder:!1,paddingSize:"xl"},Object(b.jsx)(g.EuiLoadingSpinner,{"data-test-subj":"tiBarchartWrapper-loading",size:"xl"})))):Object(b.jsx)("div",{style:{position:"relative"}},Object(b.jsx)(g.EuiFlexGroup,{justifyContent:"spaceBetween"},Object(b.jsx)(g.EuiFlexItem,null,Object(b.jsx)(g.EuiTitle,{size:"s"},Object(b.jsx)("h2",null,Object(b.jsx)(p.FormattedMessage,{id:"xpack.threatIntelligence.indicator.barchartSection.title",defaultMessage:"Trend"})))),Object(b.jsx)(g.EuiFlexItem,{grow:!1},Object(b.jsx)(E,{indexPattern:t,defaultStackByValue:R,valueChange:r}))),i&&Object(b.jsx)(g.EuiProgress,{"data-test-subj":"tiBarchartWrapper-updating",size:"xs",color:"accent",position:"absolute"}),e&&Object(b.jsx)("div",{"data-test-subj":"tiBarchartWrapper"},Object(b.jsx)(A,{indicators:n,dateRange:s,field:o})))));var q=a(11);const Q="tiIndicatorsTable",D=`${Q}-updating`,G=({rowIndex:e,columnId:t,Component:a,indicators:i,pagination:s})=>{const o=i[e%s.pageSize],{key:r,value:c}=Object(q.b)(o,t);return Object(q.a)(r,c)?Object(b.jsx)(n.a.Fragment,null,Object(b.jsx)(w.c,{data:o,field:r,Component:a,"data-test-subj":"tiIndicatorsTableCellFilterInButton"}),Object(b.jsx)(k.c,{data:o,field:r,Component:a,"data-test-subj":"tiIndicatorsTableCellFilterOutButton"}),Object(b.jsx)(M.c,{data:o,field:r,Component:a,"data-test-subj":"tiIndicatorsTableCellTimelineButton"})):null};var H=a(59),N=a(77);const V=Object(i.createContext)(void 0);var U=a(96),K=a(90),W=a(92),Y=a(93);const $=l.i18n.translate("xpack.threatIntelligence.indicator.table.moreActions",{defaultMessage:"More actions"}),Z=l.i18n.translate("xpack.threatIntelligence.indicator.table.viewDetailsButton",{defaultMessage:"View details"}),J=({indicator:e})=>{const[t,a]=Object(i.useState)(!1),n=Object(g.useGeneratedHtmlId)({prefix:"smallContextMenuPopover"}),s=()=>{a(!1)},o=[Object(b.jsx)(W.a,{indicator:e,onClick:s,"data-test-subj":"tiIndicatorTableAddToExistingCaseContextMenu"}),Object(b.jsx)(K.a,{indicator:e,onClick:s,"data-test-subj":"tiIndicatorTableAddToNewCaseContextMenu"}),Object(b.jsx)(U.a,{data:Object(Y.a)(e),onClick:s,"data-test-subj":"tiIndicatorsTableAddToBlockListContextMenu"})],r=Object(b.jsx)(g.EuiToolTip,{content:$},Object(b.jsx)(g.EuiButtonIcon,{"aria-label":$,iconType:"boxesHorizontal",iconSize:"s",size:"xs",onClick:()=>a((e=>!e)),style:{height:"100%"},"data-test-subj":"tiIndicatorTableMoreActionsButton"}));return Object(b.jsx)(g.EuiPopover,{id:n,button:r,isOpen:t,closePopover:s,panelPaddingSize:"none",anchorPosition:"downLeft"},Object(b.jsx)(g.EuiContextMenuPanel,{size:"s",items:o}))};var X=a(97);const ee=({indicator:e,onOpen:t,isOpen:a})=>Object(b.jsx)(g.EuiToolTip,{content:Z},Object(b.jsx)(g.EuiButtonIcon,{"data-test-subj":"tiToggleIndicatorFlyoutButton",color:a?"text":"primary",iconType:a?"minimize":"expand",isSelected:a,iconSize:"s","aria-label":Z,onClick:()=>t(e)})),te=({indicator:e})=>{const t=(()=>{const e=Object(i.useContext)(V);if(!e)throw new Error("IndicatorTableContext has to be defined");return e})(),{setExpanded:a,expanded:n}=t;return Object(b.jsx)(g.EuiFlexGroup,{justifyContent:"center",gutterSize:"none"},Object(b.jsx)(g.EuiFlexItem,{grow:!1},Object(b.jsx)(ee,{indicator:e,onOpen:a,isOpen:Boolean(n&&n._id===e._id)})),Object(b.jsx)(g.EuiFlexItem,{grow:!1},Object(b.jsx)(X.a,{data:e,"data-test-subj":"tiIndicatorTableInvestigateInTimelineButtonIcon"})),Object(b.jsx)(g.EuiFlexItem,{grow:!1},Object(b.jsx)(J,{indicator:e})))};var ae=a(106),ie=a.n(ae);const ne={tall:490,short:250},se={maxWidth:500},oe=({height:e="tall"})=>Object(b.jsx)(g.EuiPanel,{color:"subdued","data-test-subj":"tiIndicatorsTableEmptyState"},Object(b.jsx)(g.EuiFlexGroup,{style:{height:ne[e]},alignItems:"center",justifyContent:"center"},Object(b.jsx)(g.EuiFlexItem,{grow:!1},Object(b.jsx)(g.EuiPanel,{hasBorder:!0,style:se},Object(b.jsx)(g.EuiFlexGroup,null,Object(b.jsx)(g.EuiFlexItem,null,Object(b.jsx)(g.EuiText,{size:"s"},Object(b.jsx)(g.EuiTitle,null,Object(b.jsx)("h3",null,Object(b.jsx)(p.FormattedMessage,{id:"xpack.threatIntelligence.empty.title",defaultMessage:"No results match your search criteria"}))),Object(b.jsx)("p",null,Object(b.jsx)(p.FormattedMessage,{id:"xpack.threatIntelligence.empty.description",defaultMessage:"Try searching over a longer period of time or modifying your search"})))),Object(b.jsx)(g.EuiFlexItem,{grow:!1},Object(b.jsx)(g.EuiImage,{size:"200",alt:"",src:ie.a})))))));var re=a(95),ce=a(62);const le=Object(i.createContext)(void 0),ue=({children:e})=>{const t=Object(i.useMemo)((()=>({requests:new ce.RequestAdapter})),[]);return Object(b.jsx)(le.Provider,{value:t},e)},de=l.i18n.translate("xpack.threatIntelligence.inspectorFlyoutTitle",{defaultMessage:"Indicators search requests"}),be=()=>{const{services:{inspector:e}}=Object(c.b)(),t=Object(i.useContext)(le);if(!t)throw new Error("Inspector Context is not available");const[a,n]=Object(i.useState)(void 0),s=Object(i.useCallback)((()=>{const a=e.open(t,{title:de});n(a)}),[t,e]);return Object(i.useEffect)((()=>()=>{a&&a.close()}),[a]),{onOpenInspector:s,inspectorAdapters:t}},je=({browserFields:e,columnIds:t,onResetColumns:a,onToggleColumn:i})=>{const{triggersActionsUi:n}=Object(c.b)().services;return n.getFieldBrowser({browserFields:e,columnIds:t,onResetColumns:a,onToggleColumn:i,options:{preselectedCategoryIds:["threat","base","event","agent"]}})};var ge=a(85),pe=a(83),xe=a(63);const Oe=e=>{switch(e){case xe.KBN_FIELD_TYPES.IP:case xe.KBN_FIELD_TYPES.GEO_SHAPE:case xe.KBN_FIELD_TYPES.NUMBER:return"numeric";case xe.KBN_FIELD_TYPES.BOOLEAN:return"boolean";case xe.KBN_FIELD_TYPES.STRING:return"string";case xe.KBN_FIELD_TYPES.DATE:return"datetime";default:return}},me={border:"horizontal",header:"underline",cellPadding:"m",fontSize:"s"},he=({indicators:e,indicatorCount:t,onChangePage:a,onChangeItemsPerPage:s,pagination:o,isLoading:r,isFetching:l,browserFields:u,columnSettings:{columns:d,columnVisibility:j,handleResetColumns:O,handleToggleColumn:m,sorting:h}})=>{const[f,y]=Object(i.useState)(),I=Object(pe.a)(),C=Object(i.useMemo)((()=>{return e=o.pageIndex*o.pageSize,({rowIndex:t,columnId:a,setCellProps:n})=>{const s=Object(i.useContext)(V);if(!s)throw new Error("this can only be used inside indicators table");const{services:{uiSettings:o}}=Object(c.b)(),r=o.get("theme:darkMode"),{indicators:l,expanded:u}=s,d=l[t-e];if(Object(i.useEffect)((()=>{u&&d&&u._id===d._id?n({style:{backgroundColor:r?H.euiDarkVars.euiColorHighlight:H.euiLightVars.euiColorHighlight}}):n({style:void 0})}),[r,u,d,n]),!d)return null;const j="Actions"===a?Object(b.jsx)(te,{indicator:d}):Object(b.jsx)(N.a,{indicator:d,field:a});return Object(b.jsx)("div",{css:{overflow:"hidden","text-overflow":"ellipsis","overflow-wrap":"initial","word-wrap":"initial","word-break":"initial"}},j)};var e}),[o.pageIndex,o.pageSize]),v=Object(i.useMemo)((()=>((e,t)=>a=>{const{rowIndex:i,columnId:s}=a,o=e[i%t.pageSize],{key:r,value:c}=Object(q.b)(o,s);return Object(q.a)(r,c)?Object(b.jsx)(n.a.Fragment,null,Object(b.jsx)(g.EuiPopoverTitle,{paddingSize:"m",css:{"max-width":"240px","word-break":"break-word"}},c),Object(b.jsx)(g.EuiFlexGroup,{gutterSize:"none"},Object(b.jsx)(g.EuiFlexItem,null,Object(b.jsx)(w.a,{data:o,field:r,"data-test-subj":"tiIndicatorsTableCellPopoverTimelineButton"})),Object(b.jsx)(g.EuiFlexItem,null,Object(b.jsx)(k.a,{data:o,field:r,"data-test-subj":"tiIndicatorsTableCellPopoverFilterInButton"}))),Object(b.jsx)(g.EuiFlexGroup,{gutterSize:"none"},Object(b.jsx)(g.EuiFlexItem,null,Object(b.jsx)(M.a,{data:o,field:r,"data-test-subj":"tiIndicatorsTableCellPopoverFilterOutButton"}))),Object(b.jsx)(g.EuiFlexGroup,{gutterSize:"none"},Object(b.jsx)(g.EuiFlexItem,null,Object(b.jsx)(P.a,{value:c})))):null})(e,o)),[e,o]),E=Object(i.useMemo)((()=>({expanded:f,setExpanded:y,indicators:e})),[f,e]),S=o.pageIndex*o.pageSize,F=S+o.pageSize,T=Object(i.useMemo)((()=>[{id:"Actions",width:84,headerCellRender:()=>Object(b.jsx)(p.FormattedMessage,{id:"xpack.threatIntelligence.indicator.table.actionColumnLabel",defaultMessage:"Actions"}),rowCellRender:C}]),[C]),B=Object(i.useMemo)((()=>d.map((t=>{var a;return{...t,isSortable:t.id!==x.b.Id&&(null===(a=u[t.id])||void 0===a?void 0:a.aggregatable),schema:Oe(I[t.id]),cellActions:[({rowIndex:t,columnId:a,Component:i})=>Object(b.jsx)(G,{rowIndex:t,columnId:a,Component:i,indicators:e,pagination:o})]}}))),[u,d,I,e,o]),z=(({browserFields:e,start:t,end:a,indicatorCount:s,columns:o,onResetColumns:r,onToggleColumn:c})=>{const{onOpenInspector:l}=be();return Object(i.useMemo)((()=>({showDisplaySelector:!1,showFullScreenSelector:!0,additionalControls:{left:{prepend:Object(b.jsx)(g.EuiText,{style:{display:"inline"},size:"xs"},s&&a?Object(b.jsx)(n.a.Fragment,null,"Showing ",t+1,"-",a>s?s:a," of"," ",s," indicators"):Object(b.jsx)(n.a.Fragment,null,"-")),append:Object(b.jsx)(je,{browserFields:e,columnIds:o.map((({id:e})=>e)),onResetColumns:r,onToggleColumn:c})},right:Object(b.jsx)(g.EuiButtonIcon,{"aria-label":ge.b,iconType:"inspect",title:ge.b,"data-test-subj":"tiIndicatorsGridInspect",onClick:l})}})),[s,a,t,e,o,r,c,l])})({browserFields:u,start:S,end:F,indicatorCount:t,columns:d,onResetColumns:O,onToggleColumn:m}),L=Object(i.useMemo)((()=>f?Object(b.jsx)(re.a,{indicator:f,closeFlyout:()=>y(void 0)}):null),[f]),A=Object(i.useMemo)((()=>r?Object(b.jsx)(g.EuiFlexGroup,{justifyContent:"spaceAround"},Object(b.jsx)(g.EuiFlexItem,{grow:!1},Object(b.jsx)(g.EuiPanel,{hasShadow:!1,hasBorder:!1,paddingSize:"xl"},Object(b.jsx)(g.EuiLoadingSpinner,{size:"xl"})))):t?Object(b.jsx)(n.a.Fragment,null,l&&Object(b.jsx)(g.EuiProgress,{"data-test-subj":D,size:"xs",color:"accent",position:"absolute"}),Object(b.jsx)(g.EuiSpacer,{size:"xs"}),Object(b.jsx)(g.EuiDataGrid,{"aria-labelledby":"indicators-table",leadingControlColumns:T,rowCount:t,renderCellValue:C,renderCellPopover:v,toolbarVisibility:z,pagination:{...o,onChangeItemsPerPage:s,onChangePage:a},gridStyle:me,"data-test-subj":Q,sorting:h,columnVisibility:j,columns:B,rowHeightsOptions:{lineHeight:"30px"}})):Object(b.jsx)(oe,null)),[r,t,l,T,C,v,z,o,s,a,h,j,B]);return Object(b.jsx)(V.Provider,{value:E},Object(b.jsx)("div",{style:{position:"relative"}},L,A))};var fe=a(66),ye=a(15),Ie=a(76),Ce=a(64),ve=a(9);const Ee=x.b.TimeStamp,Se=({filters:e,filterQuery:t,timeRange:a})=>({query:Object(Ce.buildEsQuery)(void 0,[{query:ve.d,language:"kuery"},{query:t.query,language:"kuery"}],[...e,{query:{range:{[Ee]:{gte:null==a?void 0:a.from,lte:null==a?void 0:a.to}}},meta:{}}])}),Fe=x.b.TimeStamp;var Te=a(87);const Pe=x.b.Feed,we="indicatorsBarchart",ke=[10,25,50],Me=ke[1],Be="indicatorsTable",ze=({children:e})=>{const t=Object(d.a)().getPageWrapper();return Object(b.jsx)(t,null,e)},Le=({children:e,pageTitle:t,border:a=!0,subHeader:i})=>Object(b.jsx)(ze,null,Object(b.jsx)(g.EuiPageHeader,{alignItems:"center",bottomBorder:a},Object(b.jsx)(g.EuiPageHeaderSection,null,t&&Object(b.jsx)(g.EuiText,null,Object(b.jsx)("h2",{"data-test-subj":"tiDefaultPageLayoutTitle"},t)),i?Object(b.jsx)(n.a.Fragment,null,Object(b.jsx)(g.EuiSpacer,{size:"m"}),i):null)),Object(b.jsx)(g.EuiSpacer,{size:"l"}),e);var Ae=a(72);const Re=({children:e})=>{const t=Object(d.a)().getFiltersGlobalComponent();return Object(b.jsx)(t,null,e)};var _e=a(84),qe=a(107),Qe=a.n(qe),De=a(94);const Ge=[x.b.TimeStamp,x.b.Name,x.b.Type,x.b.Feed,x.b.FirstSeen,x.b.LastSeen].map((e=>({id:e,displayAsText:Object(De.b)(e)}))),He=Ge.map((e=>e.id)),Ne="indicatorsTable",Ve=({children:e})=>{const t=Object(d.a)(),{services:{data:{query:{filterManager:a}}}}=Object(c.b)(),n=t.useFilters(),s=t.useQuery(),o=t.useGlobalTime(),r=Object(i.useMemo)((()=>({timeRange:o,filters:n,filterQuery:s,filterManager:a})),[n,s,o,a]);return Object(b.jsx)(Ae.a.Provider,{value:r},e)},Ue=l.i18n.translate("xpack.threatIntelligence.updateStatus.updating",{defaultMessage:"Updating..."}),Ke=l.i18n.translate("xpack.threatIntelligence.updateStatus.updated",{defaultMessage:"Updated"}),We=({isUpdating:e,updatedAt:t})=>Object(b.jsx)(g.EuiFlexGroup,null,Object(b.jsx)(g.EuiFlexItem,{grow:!1},Object(b.jsx)(g.EuiText,{size:"xs",color:"subdued","data-test-subj":"updateStatus"},e?Ue:Object(b.jsx)(n.a.Fragment,null,Ke," ",Object(b.jsx)(p.FormattedRelative,{value:new Date(t)}))))),Ye=({indexPattern:e,queries:t})=>{const{SiemSearchBar:a,registerQuery:n,deregisterQuery:s}=Object(d.a)();return Object(i.useEffect)((()=>(t.forEach(n),()=>t.forEach(s))),[t,s,n]),Object(b.jsx)(a,{id:"global",indexPattern:e})},$e=({children:e})=>Object(b.jsx)(Ve,null,Object(b.jsx)(_e.b,null,Object(b.jsx)(ue,null,Object(b.jsx)(r.b,null,e)))),Ze=()=>{const{blockListIndicatorValue:e}=Object(o.a)(),{browserFields:t,indexPattern:a}=Object(fe.a)(),n=(()=>{const{services:{storage:e}}=Object(c.b)(),[t,a]=Object(i.useState)([]),n=Object(i.useMemo)((()=>({columns:t,onSort:a})),[t]),[s,o]=Object(i.useState)([]),[r,l]=Object(i.useState)([]);Object(i.useEffect)((()=>{const{visibleColumns:t=[],columns:i=[],sortingState:n=[]}=e.get(Ne)||{visibleColumns:He,columns:Ge,sortingState:[]};l(t),o(i),a(n)}),[e]),Object(i.useEffect)((()=>{e.set(Ne,{visibleColumns:r,columns:s,sortingState:t})}),[s,t,e,r]);const u=Object(i.useCallback)((e=>{o((t=>{const a=({id:t})=>t===e,i=Qe()(a);return Boolean(t.find(a))?t.filter(i):[...t,{id:e,displayAsText:e}]})),l((t=>{const a=t=>t===e,i=Qe()(a);return Boolean(t.find(a))?t.filter(i):[...t,e]}))}),[]),d=Object(i.useCallback)((()=>{o(Ge),l(He)}),[]),b=Object(i.useMemo)((()=>({visibleColumns:r,setVisibleColumns:l})),[r]);return{handleResetColumns:d,handleToggleColumn:u,columns:s,columnVisibility:b,sorting:n}})(),{timeRange:r,filters:l,filterQuery:u}=(()=>{const e=Object(i.useContext)(Ae.a);if(!e)throw new Error("Filters can only be used inside IndicatorFiltersContext");return e})(),{indicatorCount:d,indicators:g,onChangeItemsPerPage:p,onChangePage:x,pagination:O,isLoading:m,isFetching:h,dataUpdatedAt:f,query:y}=(({filters:e,filterQuery:t,sorting:a,timeRange:n})=>{const{services:{data:{search:o}}}=Object(c.b)(),{selectedPatterns:r}=Object(fe.a)(),{inspectorAdapters:l}=be(),u=Object(i.useCallback)((e=>j((t=>({...t,pageSize:e,pageIndex:0})))),[]),d=Object(i.useCallback)((e=>j((t=>({...t,pageIndex:e})))),[]),[b,j]=Object(i.useState)({pageIndex:0,pageSize:Me,pageSizeOptions:ke});Object(i.useEffect)((()=>{d(0)}),[e,t,n,a,d]);const g=Object(i.useMemo)((()=>(({searchService:e,inspectorAdapter:t})=>async({pagination:a,selectedPatterns:i,timeRange:n,filterQuery:s,filters:o,sorting:r},c)=>{const l=Se({timeRange:n,filters:o,filterQuery:s}),u={size:a.pageSize,from:a.pageIndex,fields:[{field:"*",include_unmapped:!0}],sort:r.map((({id:e,direction:t})=>({[e]:t}))),...l},{hits:{hits:d,total:b}}=await Object(Ie.a)(e,{params:{index:i,body:u},factoryQueryType:ye.c.IndicatorGrid},{inspectorAdapter:t,requestName:"Indicators table",signal:c});return{indicators:d,total:b}})({searchService:o,inspectorAdapter:l.requests})),[l,o]),{isLoading:p,isFetching:x,data:O,refetch:m,dataUpdatedAt:h}=Object(s.useQuery)([Be,{timeRange:n,filterQuery:t,filters:e,selectedPatterns:r,sorting:a,pagination:b}],(({signal:e,queryKey:[t,a]})=>g(a,e)),{keepPreviousData:!0}),f=Object(i.useMemo)((()=>({refetch:m,id:Be,loading:p})),[p,m]);return{indicators:(null==O?void 0:O.indicators)||[],indicatorCount:(null==O?void 0:O.total)||0,pagination:b,onChangePage:d,onChangeItemsPerPage:u,isLoading:p,isFetching:x,dataUpdatedAt:h,query:f}})({filters:l,filterQuery:u,timeRange:r,sorting:n.sorting.columns}),{dateRange:I,series:C,selectedField:v,onFieldChange:E,isLoading:S,isFetching:F,query:P}=(({timeRange:e,filters:t,filterQuery:a})=>{const{services:{data:{search:n,query:o}}}=Object(c.b)(),r=Object(Te.b)(),l=Object(Te.a)(),{selectedPatterns:u}=Object(fe.a)(),{inspectorAdapters:d}=be(),[b,j]=Object(i.useState)({label:Pe,value:"string"}),g=Object(i.useMemo)((()=>(({inspectorAdapter:e,searchService:t,queryService:a,userTimeZone:i,userFormat:n})=>async({selectedPatterns:s,timeRange:o,field:r,filterQuery:c,filters:l},u)=>{const d=a.timefilter.timefilter.calculateBounds(o),b=d.min.toDate().getTime(),j=d.max.toDate().getTime(),g=Se({timeRange:o,filters:l,filterQuery:c}),p={fields:[Fe,r.label],size:0,...g},{aggregations:{[ye.a]:x}}=await Object(Ie.a)(t,{params:{index:s,body:p},factoryQueryType:ye.c.Barchart,dateRange:{from:b,to:j},field:r.label},{signal:u,inspectorAdapter:e,requestName:"Indicators barchart"}),O=((e,t,a,i)=>e.reduce(((e,n)=>e.concat(n.events.buckets.map((e=>({x:e.key_as_string,y:e.doc_count,g:"date"===i.value?Object(z.b)(T()(n.key),t,a):n.key}))))),[]))(null==x?void 0:x.buckets,i,n,r);return O})({queryService:o,searchService:n,inspectorAdapter:d.requests,userTimeZone:r,userFormat:l})),[d.requests,o,n,l,r]),{data:p,isLoading:x,isFetching:O,refetch:m}=Object(s.useQuery)([we,{filters:t,field:b,filterQuery:a,selectedPatterns:u,timeRange:e}],(({signal:e,queryKey:[t,a]})=>g(a,e)),{keepPreviousData:!0}),h=Object(i.useMemo)((()=>o.timefilter.timefilter.calculateBounds(e)),[o.timefilter.timefilter,e]),f=Object(i.useMemo)((()=>({refetch:m,id:we,loading:x})),[x,m]);return{dateRange:h,series:p||[],onFieldChange:j,selectedField:b,isLoading:x,isFetching:O,query:f}})({timeRange:r,filters:l,filterQuery:u});return Object(b.jsx)(_e.b,null,Object(b.jsx)(Le,{pageTitle:"Indicators",subHeader:Object(b.jsx)(We,{isUpdating:h,updatedAt:f})},Object(b.jsx)(Re,null,Object(b.jsx)(Ye,{queries:[P,y],indexPattern:a})),Object(b.jsx)(_,{dateRange:I,series:C,timeRange:r,indexPattern:a,field:v,onFieldChange:E,isFetching:F,isLoading:S}),Object(b.jsx)(he,{browserFields:t,indexPattern:a,columnSettings:n,pagination:O,indicatorCount:d,indicators:g,isLoading:m,isFetching:h,onChangeItemsPerPage:p,onChangePage:x}),e&&Object(b.jsx)(j,{indicatorFileHash:e})))},Je=()=>Object(b.jsx)($e,null,Object(b.jsx)(Ze,null)),Xe=l.i18n.translate("xpack.threatIntelligence.common.emptyPage.imgAlt",{defaultMessage:"Enable Threat Intelligence Integrations"});var et=a(108),tt=a.n(et),at=a(22);const it=()=>{const e=`${Object(c.b)().services.http.basePath.get()}/app/integrations/browse/threat_intel`,t=Object(c.b)().services.docLinks.links.securitySolution.threatIntelInt;return Object(b.jsx)(at.a,{isEmptyState:!0},Object(b.jsx)(g.EuiEmptyPrompt,{icon:Object(b.jsx)(g.EuiImage,{size:"fullWidth",alt:Xe,src:tt.a}),title:Object(b.jsx)("h3",null,Object(b.jsx)(p.FormattedMessage,{id:"xpack.threatIntelligence.common.emptyPage.title",defaultMessage:"Get started with Elastic Threat Intelligence"})),titleSize:"s",layout:"horizontal",color:"transparent",body:Object(b.jsx)(n.a.Fragment,null,Object(b.jsx)("p",null,Object(b.jsx)(p.FormattedMessage,{id:"xpack.threatIntelligence.common.emptyPage.body1",defaultMessage:"Elastic Threat Intelligence makes it easy to analyze and investigate potential security threats by aggregating data from multiple sources in one place."})),Object(b.jsx)("p",null,Object(b.jsx)(p.FormattedMessage,{id:"xpack.threatIntelligence.common.emptyPage.body2",defaultMessage:"You’ll be able to view data from all activated threat intelligence feeds and take action from this page."})),Object(b.jsx)("p",null,Object(b.jsx)(p.FormattedMessage,{id:"xpack.threatIntelligence.common.emptyPage.body3",defaultMessage:"To get started with Elastic Threat Intelligence, enable one or more Threat Intelligence Integrations from the Integrations page or ingest data using filebeat. For more information, view the {docsLink}.",values:{docsLink:Object(b.jsx)(g.EuiLink,{href:t,target:"_blank","data-test-subj":"tiEmptyPageDocsLink"},Object(b.jsx)(p.FormattedMessage,{id:"xpack.threatIntelligence.common.emptyPage.docsLinkText",defaultMessage:"Security app documentation"}))}}))),actions:Object(b.jsx)(g.EuiButton,{"data-test-subj":"tiEmptyPageIntegrationsPageLink",href:e,color:"primary",iconType:"plusInCircle",fill:!0},Object(b.jsx)(p.FormattedMessage,{id:"xpack.threatIntelligence.common.emptyPage.buttonText",defaultMessage:"Add Integrations"})),"data-test-subj":"tiEmptyPage"}))};var nt=a(58);const st=({children:e})=>{const{isLoading:t,count:a}=(()=>{const{services:{data:{search:e}}}=Object(c.b)(),[t,a]=Object(i.useState)(0),[n,s]=Object(i.useState)(!0),{selectedPatterns:o,loading:r}=Object(fe.a)();return Object(i.useEffect)((()=>{const t={params:{index:o,body:{size:0,query:{bool:{must:[{term:{"event.category":{value:"threat"}}},{term:{"event.type":{value:"indicator"}}}]}}}}};e.search(t).subscribe({next:e=>{if(Object(nt.isCompleteResponse)(e)){const t=e.rawResponse.hits.total||0;a(t),s(!1)}}})}),[e,o]),{count:t,isLoading:n||r}})(),{isLoading:o,data:r}=(()=>{const{http:e}=Object(c.b)().services,t=["integrations"],a=Object(s.useQuery)(t,(()=>e.get("/api/fleet/epm/packages")),{select:e=>e?e.items.filter((e=>"installed"===e.status&&null!=e.categories.find((e=>"threat_intel"===e))&&"ti_util"!==e.id)):[]}),i=Object(s.useQueryClient)();return setTimeout((()=>i.cancelQueries(t)),2e3),a})();return o||t?Object(b.jsx)(at.a,{isEmptyState:!0},Object(b.jsx)(g.EuiLoadingLogo,{"data-test-subj":"tiIndicatorsLoadingLogo",logo:"logoSecurity",size:"xl"})):a>0||(r||[]).length>0?Object(b.jsx)(n.a.Fragment,null,e):Object(b.jsx)(it,null)},ot="securitySolution",rt=()=>{const{cases:e}=Object(c.b)().services,t=e.ui.getCasesContext(),a=e.helpers.canUseCases(),i=new s.QueryClient;return Object(b.jsx)(t,{owner:[ot],permissions:a},Object(b.jsx)(s.QueryClientProvider,{client:i},Object(b.jsx)(st,null,Object(b.jsx)(at.a,null,Object(b.jsx)(Je,null)))))};t.default=rt}}]);