diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/constants.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/constants.tsx index 030005b45ac62..a51763ba61137 100644 --- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/constants.tsx +++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/constants.tsx @@ -21,4 +21,5 @@ export const SIGNAL_STATUS_FIELD_NAME = 'kibana.alert.workflow_status'; export const AGENT_STATUS_FIELD_NAME = 'agent.status'; export const QUARANTINED_PATH_FIELD_NAME = 'quarantined.path'; export const REASON_FIELD_NAME = 'kibana.alert.reason'; +export const RISK_SCORE = 'kibana.alert.risk_score'; export const EVENT_SUMMARY_FIELD_NAME = 'eventSummary'; diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx index 299bb736ec4f2..423c40effa996 100644 --- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx +++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field.tsx @@ -39,12 +39,18 @@ import { IP_FIELD_TYPE, MESSAGE_FIELD_NAME, REFERENCE_URL_FIELD_NAME, + RISK_SCORE, RULE_REFERENCE_FIELD_NAME, SIGNAL_RULE_NAME_FIELD_NAME, SIGNAL_STATUS_FIELD_NAME, USER_NAME_FIELD_NAME, } from './constants'; -import { renderEventModule, RenderRuleName, renderUrl } from './formatted_field_helpers'; +import { + renderEventModule, + RenderRiskScore, + RenderRuleName, + renderUrl, +} from './formatted_field_helpers'; import { RuleStatus } from './rule_status'; import { HostName } from './host_name'; import { UserName } from './user_name'; @@ -239,6 +245,8 @@ const FormattedFieldValueComponent: React.FC<{ value={value} /> ); + } else if (fieldName === RISK_SCORE) { + return value ? : null; } else if (fieldName === EVENT_MODULE_FIELD_NAME) { return renderEventModule({ contextId, diff --git a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field_helpers.tsx b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field_helpers.tsx index d41c0238ce592..1a1f8f22500cf 100644 --- a/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field_helpers.tsx +++ b/x-pack/plugins/security_solution/public/timelines/components/timeline/body/renderers/formatted_field_helpers.tsx @@ -12,6 +12,7 @@ import type { SyntheticEvent } from 'react'; import React, { useCallback, useMemo, useContext } from 'react'; import styled from 'styled-components'; import { useExpandableFlyoutApi } from '@kbn/expandable-flyout'; +import { formatRiskScore } from '../../../../../entity_analytics/common'; import { DefaultDraggable } from '../../../../../common/components/draggables'; import { getEmptyTagValue } from '../../../../../common/components/empty_value'; import { getRuleDetailsUrl } from '../../../../../common/components/link_to/redirect_to_detection_engine'; @@ -382,3 +383,16 @@ export const renderUrl = ({ getEmptyTagValue() ); }; + +interface RenderRiskScoreProps { + value: number | string; +} + +export const RenderRiskScore: React.FC = ({ value }) => { + return ( + + {/* Usually is a string */} + {formatRiskScore(Number(value))} + + ); +};