[Security Solution] [Timeline] Bugfix to include unmapped fields in the timeline event details JSON

x-pack/plugins/security_solution/public/common/components/event_details/json_view.tsx

@@ -54,12 +54,14 @@ export const JsonView = React.memo<Props>(({ data }) => {
 JsonView.displayName = 'JsonView';
 
 export const buildJsonView = (data: TimelineEventsDetailsItem[]) =>
-  data.reduce(
-    (accumulator, item) =>
-      set(
-        item.field,
-        Array.isArray(item.originalValue) ? item.originalValue.join() : item.originalValue,
-        accumulator
-      ),
-    {}
-  );
+  data
+    .sort((a, b) => (a.field > b.field ? 1 : b.field > a.field ? -1 : 0))
+    .reduce(
+      (accumulator, item) =>
+        set(
+          item.field,
+          item.originalValue instanceof Array ? item.originalValue.join() : item.originalValue,
+          accumulator
+        ),
+      {}
+    );

x-pack/plugins/security_solution/public/common/mock/mock_detail_item.ts

@@ -46,29 +46,29 @@ export const mockDetailItemData: TimelineEventsDetailsItem[] = [
     values: ['siem-kibana'],
   },
   {
-    field: 'agent.id',
-    originalValue: '5de03d5f-52f3-482e-91d4-853c7de073c3',
-    values: ['5de03d5f-52f3-482e-91d4-853c7de073c3'],
+    field: 'cloud.project.id',
+    originalValue: 'elastic-beats',
+    values: ['elastic-beats'],
   },
   {
-    field: 'agent.type',
-    originalValue: 'filebeat',
-    values: ['filebeat'],
+    field: 'cloud.provider',
+    originalValue: 'gce',
+    values: ['gce'],
   },
   {
-    field: 'agent.version',
-    originalValue: '8.0.0',
-    values: ['8.0.0'],
+    field: 'destination.bytes',
+    originalValue: 584,
+    values: ['584'],
   },
   {
-    field: 'cloud.availability_zone',
-    originalValue: 'projects/189716325846/zones/us-east1-b',
-    values: ['projects/189716325846/zones/us-east1-b'],
+    field: 'destination.ip',
+    originalValue: '10.47.8.200',
+    values: ['10.47.8.200'],
   },
   {
-    field: 'cloud.instance.id',
-    originalValue: '5412578377715150143',
-    values: ['5412578377715150143'],
+    field: 'agent.id',
+    originalValue: '5de03d5f-52f3-482e-91d4-853c7de073c3',
+    values: ['5de03d5f-52f3-482e-91d4-853c7de073c3'],
   },
   {
     field: 'cloud.instance.name',
@@ -81,24 +81,9 @@ export const mockDetailItemData: TimelineEventsDetailsItem[] = [
     values: ['projects/189716325846/machineTypes/n1-standard-1'],
   },
   {
-    field: 'cloud.project.id',
-    originalValue: 'elastic-beats',
-    values: ['elastic-beats'],
-  },
-  {
-    field: 'cloud.provider',
-    originalValue: 'gce',
-    values: ['gce'],
-  },
-  {
-    field: 'destination.bytes',
-    originalValue: 584,
-    values: ['584'],
-  },
-  {
-    field: 'destination.ip',
-    originalValue: '10.47.8.200',
-    values: ['10.47.8.200'],
+    field: 'agent.type',
+    originalValue: 'filebeat',
+    values: ['filebeat'],
   },
   {
     field: 'destination.packets',
@@ -115,4 +100,19 @@ export const mockDetailItemData: TimelineEventsDetailsItem[] = [
     originalValue: 'event',
     values: ['event'],
   },
+  {
+    field: 'agent.version',
+    originalValue: '8.0.0',
+    values: ['8.0.0'],
+  },
+  {
+    field: 'cloud.availability_zone',
+    originalValue: 'projects/189716325846/zones/us-east1-b',
+    values: ['projects/189716325846/zones/us-east1-b'],
+  },
+  {
+    field: 'cloud.instance.id',
+    originalValue: '5412578377715150143',
+    values: ['5412578377715150143'],
+  },
 ];

x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/details/index.ts

@@ -5,7 +5,7 @@
  * 2.0.
  */
 
-import { cloneDeep, merge } from 'lodash/fp';
+import { cloneDeep, merge, unionBy } from 'lodash/fp';
 
 import { IEsSearchResponse } from '../../../../../../../../../src/plugins/data/common';
 import {
@@ -17,7 +17,7 @@ import {
 import { inspectStringifyObject } from '../../../../../utils/build_query';
 import { SecuritySolutionTimelineFactory } from '../../types';
 import { buildTimelineDetailsQuery } from './query.events_details.dsl';
-import { getDataFromSourceHits } from './helpers';
+import { getDataFromFieldsHits, getDataFromSourceHits } from './helpers';
 
 export const timelineEventsDetails: SecuritySolutionTimelineFactory<TimelineEventsQueries.details> = {
   buildDsl: (options: TimelineEventsDetailsRequestOptions) => {
@@ -29,7 +29,7 @@ export const timelineEventsDetails: SecuritySolutionTimelineFactory<TimelineEven
     response: IEsSearchResponse<EventHit>
   ): Promise<TimelineEventsDetailsStrategyResponse> => {
     const { indexName, eventId, docValueFields = [] } = options;
-    const { _source, ...hitsData } = cloneDeep(response.rawResponse.hits.hits[0] ?? {});
+    const { _source, fields, ...hitsData } = cloneDeep(response.rawResponse.hits.hits[0] ?? {});
     const inspect = {
       dsl: [inspectStringifyObject(buildTimelineDetailsQuery(indexName, eventId, docValueFields))],
     };
@@ -42,11 +42,14 @@ export const timelineEventsDetails: SecuritySolutionTimelineFactory<TimelineEven
       };
     }
 
-    const sourceData = getDataFromSourceHits(merge(_source, hitsData));
+    const sourceData = getDataFromSourceHits(_source);
+    const fieldsData = getDataFromFieldsHits(merge(fields, hitsData));
+
+    const data = unionBy('field', fieldsData, sourceData);
 
     return {
       ...response,
-      data: sourceData,
+      data,
       inspect,
     };
   },

x-pack/plugins/security_solution/server/search_strategy/timeline/factory/events/details/query.events_details.dsl.ts

@@ -22,6 +22,8 @@ export const buildTimelineDetailsQuery = (
         _id: [id],
       },
     },
+    fields: ['*'],
+    _source: true,
   },
   size: 1,
 });