File tree Expand file tree Collapse file tree 4 files changed +28
-13
lines changed
Expand file tree Collapse file tree 4 files changed +28
-13
lines changed Original file line number Diff line number Diff line change @@ -773,7 +773,11 @@ export const customAlertColumnForSavedColumn = (savedColumn) => {
773773 return null ;
774774 }
775775 const accessor = ( incident ) => {
776- const path = `alerts[*].body.cef_details.${ accessorPath } ` ;
776+ // custom details are in both body.cef_details.details and body.details for events
777+ // but only body.details is guaranteed to exist, and won't be null
778+ // body.cef_details.details can be null if the alert is from an email
779+ // const path = `alerts[*].body.cef_details.${accessorPath}`;
780+ const path = `alerts[*].body.${ accessorPath } ` ;
777781 let result = null ;
778782 try {
779783 result = JSONPath ( {
Original file line number Diff line number Diff line change @@ -22,6 +22,14 @@ const generateMockAlert = () => {
2222 const message = faker . commerce . productDescription ( ) ;
2323 const uuid = faker . string . uuid ( ) ;
2424 const link = faker . internet . url ( ) ;
25+ const customDetails = {
26+ quote,
27+ 'some obsecure field' : uuid ,
28+ link,
29+ object_details : {
30+ key1 : 'value1' ,
31+ } ,
32+ } ;
2533 return {
2634 type : 'alert' ,
2735 id : alertId ,
@@ -30,18 +38,15 @@ const generateMockAlert = () => {
3038 created_at : createdAt ,
3139 body : {
3240 contexts : [ ] ,
41+ // custom details are in both body.cef_details.details and body.details for events
42+ // but only body.details is guaranteed to exist, and won't be null
43+ // body.cef_details.details can be null if the alert is from an email
44+ details : customDetails ,
3345 cef_details : {
3446 contexts : [ ] ,
3547 dedup_key : alertId ,
3648 description : title ,
37- details : {
38- quote,
39- 'some obsecure field' : uuid ,
40- link,
41- object_details : {
42- key1 : 'value1' ,
43- } ,
44- } ,
49+ details : customDetails ,
4550 event_class : jobType ,
4651 message,
4752 mutations : [
Original file line number Diff line number Diff line change @@ -498,7 +498,10 @@ export function* filterIncidentsImpl() {
498498 // Handle case when '[*]' accessors are used
499499 const strippedAccessor = col . accessorPath . replace ( / ( [ [ * \] ] ) / g, '.' ) ;
500500 return (
501- `alerts.body.cef_details.${ strippedAccessor } `
501+ // custom details are in both body.cef_details.details and body.details for events
502+ // but only body.details is guaranteed to exist, and won't be null
503+ // body.cef_details.details can be null if the alert is from an email
504+ `alerts.body.${ strippedAccessor } `
502505 . split ( '.' )
503506 // Handle case when special character is wrapped in quotation marks
504507 . map ( ( a ) => ( a . includes ( "'" ) ? a . replaceAll ( "'" , '' ) : a ) )
@@ -523,8 +526,11 @@ export function* filterIncidentsImpl() {
523526 const incidentAlertsForSearch = incidentAlerts [ incident . id ] instanceof Array ? incidentAlerts [ incident . id ] : [ ] ;
524527 const incidentAlertsForSearchWithFlattedCustomDetails = incidentAlertsForSearch . map (
525528 ( alert ) => {
526- const flattedCustomDetails = alert . body ?. cef_details
527- ? Object . values ( flattenObject ( alert . body . cef_details ) ) . join ( ' ' )
529+ // custom details are in both body.cef_details.details and body.details for events
530+ // but only body.details is guaranteed to exist, and won't be null
531+ // body.cef_details.details can be null if the alert is from an email
532+ const flattedCustomDetails = alert . body ?. details
533+ ? Object . values ( flattenObject ( alert . body . details ) ) . join ( ' ' )
528534 : '' ;
529535 return {
530536 ...alert ,
Original file line number Diff line number Diff line change @@ -154,7 +154,7 @@ describe('Sagas: Incidents', () => {
154154 it ( 'filterIncidents: Search by Alert Custom Detail Field' , ( ) => {
155155 const mockIncident = mockIncidents [ 0 ] ;
156156 const customField = 'some obsecure field' ;
157- const customFieldValue = mockIncident . alerts [ 0 ] . body . cef_details . details [ customField ] ;
157+ const customFieldValue = mockIncident . alerts [ 0 ] . body . details [ customField ] ;
158158 const expectedIncidentResult = [ mockIncident ] ;
159159 return expectSaga ( filterIncidents )
160160 . withReducer ( incidents )
You can’t perform that action at this time.
0 commit comments