[8.18] Unflatten doc before applying filterlist (#235988) (#236007)

kibanamachine · szaffarano · web-flow · commit c37592fad2ae · 2025-09-23T03:51:55.000+02:00
# Backport This will backport the following commits from `main` to `8.18`: - [Unflatten doc before applying filterlist (#235988)](#235988)  ### Questions ? Please refer to the [Backport tool documentation](https://github.com/sorenlouv/backport)  Co-authored-by: Sebastián Zaffarano <sebastian.zaffarano@elastic.co>
diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/diagnostic/health_diagnostic_utils.test.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/diagnostic/health_diagnostic_utils.test.ts
@@ -27,6 +27,20 @@ describe('Security Solution - Health Diagnostic Queries - utils', () => {
       });
     });
 
+    test('should keep fields marked with KEEP action in flat doc', async () => {
+      const data = [{ 'kibana.alert.rule.name': 'Endpoint Security (Elastic Defend)' }];
+      const rules = {
+        'user.name': Action.KEEP,
+        'kibana.alert.rule.name': Action.KEEP,
+      };
+
+      const result = await applyFilterlist(data, rules, mockSalt);
+
+      expect(result).toEqual([
+        { kibana: { alert: { rule: { name: 'Endpoint Security (Elastic Defend)' } } } },
+      ]);
+    });
+
     test('should keep fields marked with KEEP action', async () => {
       const data = [{ user: { name: 'john', email: 'john@example.com' } }];
       const rules = {
@@ -98,31 +112,6 @@ describe('Security Solution - Health Diagnostic Queries - utils', () => {
       expect((result[0] as any).meta.host.ip).not.toBe('192.168.1.1');
     });
 
-    test('should handle arrays of documents', async () => {
-      const data = [
-        [
-          { user: 'alice', token: 'abc123' },
-          { user: 'bob', token: 'xyz789' },
-        ],
-      ];
-      const rules = {
-        user: Action.KEEP,
-        token: Action.MASK,
-      };
-
-      const result = await applyFilterlist(data, rules, mockSalt);
-
-      expect(result).toHaveLength(1);
-      expect(Array.isArray(result[0])).toBe(true);
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const docs = result[0] as any[];
-      expect(docs).toHaveLength(2);
-      expect(docs[0].user).toBe('alice');
-      expect(docs[1].user).toBe('bob');
-      expect(docs[0].token).not.toBe('abc123');
-      expect(docs[1].token).not.toBe('xyz789');
-    });
-
     test('should handle arrays of complex documents', async () => {
       const data = [
         {
@@ -301,30 +290,6 @@ describe('Security Solution - Health Diagnostic Queries - utils', () => {
       ]);
     });
 
-    test('should handle mixed document types', async () => {
-      const data = [
-        { type: 'user', name: 'john', password: 'secret' },
-        [{ type: 'admin', name: 'admin', token: 'admin123' }],
-      ];
-      const rules = {
-        name: Action.KEEP,
-        password: Action.MASK,
-        token: Action.MASK,
-      };
-
-      const result = await applyFilterlist(data, rules, mockSalt);
-
-      expect(result).toHaveLength(2);
-      expect(result[0]).toMatchObject({ name: 'john' });
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      expect((result[0] as any).password).not.toBe('secret');
-      expect(Array.isArray(result[1])).toBe(true);
-      // eslint-disable-next-line @typescript-eslint/no-explicit-any
-      const adminDocs = result[1] as any[];
-      expect(adminDocs[0].name).toBe('admin');
-      expect(adminDocs[0].token).not.toBe('admin123');
-    });
-
     test('should handle numeric and boolean values', async () => {
       const data = [
         {
diff --git a/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/diagnostic/health_diagnostic_utils.ts b/x-pack/solutions/security/plugins/security_solution/server/lib/telemetry/diagnostic/health_diagnostic_utils.ts
@@ -13,6 +13,8 @@ import {
   type HealthDiagnosticQuery,
   type HealthDiagnosticQueryStats,
 } from './health_diagnostic_service.types';
+import { unflatten } from '../helpers';
+import type { AnyObject } from '../types';
 
 export function shouldExecute(startDate: Date, endDate: Date, interval: Interval): boolean {
   const nextDate = intervalFromDate(startDate, interval);
@@ -131,7 +133,8 @@ export async function applyFilterlist(
     }
   };
 
-  for (const doc of data) {
+  for (const rawDoc of data) {
+    const doc = unflatten(rawDoc as AnyObject);
     if (Array.isArray(doc)) {
       const docs = doc as unknown[];
       const result = await Promise.all(
