From 983945b8da1db8f1309db559ec74e5df7c064862 Mon Sep 17 00:00:00 2001
From: Ryland Herrick <ryalnd@gmail.com>
Date: Tue, 16 Jul 2024 14:49:19 -0500
Subject: [PATCH] Disable all suppression fields as a group

We did not previously extend our full disabling logic to all suppression
fields. Now, when we determine that alert suppression is
invalid/disabled, we disable all those relevant fields together.

This commit accomplishes the above, and also factors out some shared
boolean logic into the more general `areSuppressionFieldsDisabled`
boolean, which is shared by most of these fields.
---
 .../components/step_define_rule/index.tsx     | 36 +++++++++----------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.tsx b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.tsx
index 221f0cc7ee60c..43e93ff96394d 100644
--- a/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.tsx
+++ b/x-pack/plugins/security_solution/public/detection_engine/rule_creation_ui/components/step_define_rule/index.tsx
@@ -477,11 +477,17 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
     isEqlSequenceQuery(queryBar?.query?.query as string) &&
     groupByFields.length === 0;
 
-  const isSuppressionGroupByDisabled =
+  /**
+   * If we don't have ML field information, users can't meaningfully interact with these fields */
+  const areSuppressionFieldsDisabledByMlFields =
+    isMlRule(ruleType) && (noMlJobsStarted || mlFieldsLoading || !mlSuppressionFields.length);
+
+  const areSuppressionFieldsDisabled =
     !isAlertSuppressionLicenseValid ||
     areSuppressionFieldsDisabledBySequence ||
-    isEsqlSuppressionLoading ||
-    (isMlRule(ruleType) && (noMlJobsStarted || mlFieldsLoading || !mlSuppressionFields.length));
+    areSuppressionFieldsDisabledByMlFields;
+
+  const isSuppressionGroupByDisabled = areSuppressionFieldsDisabled || isEsqlSuppressionLoading;
 
   const suppressionGroupByDisabledText = useMemo(() => {
     if (areSuppressionFieldsDisabledBySequence) {
@@ -513,31 +519,29 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
    *  - if suppression license is not valid(i.e. less than platinum)
    *  - or for not threshold rule - when groupBy fields not selected
    * - Eql sequence is used
+   * - ML Field information is not available
    */
   const isGroupByChildrenDisabled =
-    areSuppressionFieldsDisabledBySequence || !isAlertSuppressionLicenseValid || isThresholdRule
-      ? false
-      : !groupByFields?.length;
+    areSuppressionFieldsDisabled || (isThresholdRule ? false : !groupByFields?.length);
 
   /**
    * Per rule execution radio option is disabled
    *  - if suppression license is not valid(i.e. less than platinum)
    *  - always disabled for threshold rule
    *  - Eql sequence is used and suppression fields are in the default state
+   * - ML Field information is not available
    */
-  const isPerRuleExecutionDisabled =
-    areSuppressionFieldsDisabledBySequence || !isAlertSuppressionLicenseValid || isThresholdRule;
+  const isPerRuleExecutionDisabled = areSuppressionFieldsDisabled || isThresholdRule;
 
   /**
    * Per time period execution radio option is disabled
    *  - if suppression license is not valid(i.e. less than platinum)
    *  - disabled for threshold rule when enabled suppression is not checked
    * - Eql sequence is used and suppression fields are in the default state
+   * - ML Field information is not available
    */
   const isPerTimePeriodDisabled =
-    areSuppressionFieldsDisabledBySequence ||
-    !isAlertSuppressionLicenseValid ||
-    (isThresholdRule && !enableThresholdSuppression);
+    areSuppressionFieldsDisabled || (isThresholdRule && !enableThresholdSuppression);
 
   /**
    * Suppression duration is disabled when
@@ -545,11 +549,10 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
    *  - when suppression by rule execution is selected in radio button
    *  - when threshold suppression is not enabled and no group by fields selected
    * -  Eql sequence is used and suppression fields are in the default state
+   * - ML Field information is not available
    * */
   const isDurationDisabled =
-    areSuppressionFieldsDisabledBySequence ||
-    !isAlertSuppressionLicenseValid ||
-    (!enableThresholdSuppression && groupByFields?.length === 0);
+    areSuppressionFieldsDisabled || (!enableThresholdSuppression && groupByFields?.length === 0);
 
   /**
    * Suppression missing fields is disabled when
@@ -557,10 +560,7 @@ const StepDefineRuleComponent: FC<StepDefineRuleProps> = ({
    *  - when no group by fields selected
    * -  Eql sequence is used and suppression fields are in the default state
    * */
-  const isMissingFieldsDisabled =
-    areSuppressionFieldsDisabledBySequence ||
-    !isAlertSuppressionLicenseValid ||
-    !groupByFields.length;
+  const isMissingFieldsDisabled = areSuppressionFieldsDisabled || !groupByFields.length;
 
   const GroupByChildren = useCallback(
     ({ groupByRadioSelection, groupByDurationUnit, groupByDurationValue }) => (