@cccsaurora/howler-ui 2.19.0-cases.1122 → 2.19.0-cases.1129

package/components/elements/display/QueryResultText.d.ts

@@ -2,5 +2,6 @@ import type { FC } from 'react';
 declare const QueryResultText: FC<{
     count: number;
     query: string;
+    mb?: number;
 }>;
 export default QueryResultText;

package/components/elements/display/QueryResultText.js

@@ -2,13 +2,13 @@ import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { Typography } from '@mui/material';
 import { useTranslation } from 'react-i18next';
 import { Link } from 'react-router-dom';
-const QueryResultText = ({ count, query }) => {
+const QueryResultText = ({ count, query, mb = 0.5 }) => {
     const { t } = useTranslation();
     return (_jsxs(Typography, { sx: theme => ({
             color: theme.palette.text.secondary,
             fontSize: '0.9em',
             fontStyle: 'italic',
-            mb: 0.5,
+            mb,
             '& a': { color: theme.palette.text.secondary }
         }), variant: "body2", children: [t('search.total', { count }), " ", _jsx(Link, { to: `/hits?query=${encodeURIComponent(query)}`, children: t('search.open') })] }));
 };

package/components/routes/cases/detail/CaseRules.js

@@ -5,7 +5,6 @@ import api from '@cccsaurora/howler-ui/api';
 import { ModalContext } from '@cccsaurora/howler-ui/components/app/providers/ModalProvider';
 import ConfirmDeleteModal from '@cccsaurora/howler-ui/components/elements/display/modals/ConfirmDeleteModal';
 import useMyApi from '@cccsaurora/howler-ui/components/hooks/useMyApi';
-import dayjs from 'dayjs';
 import { useCallback, useContext, useState } from 'react';
 import { useTranslation } from 'react-i18next';
 import { useOutletContext } from 'react-router-dom';
@@ -47,11 +46,10 @@ const CaseRules = ({ case: providedCase, caseId }) => {
         return null;
     }
     const rules = _case.rules ?? [];
-    return (_jsxs(Stack, { spacing: 2, sx: { p: 2, height: '100%', overflow: 'auto' }, children: [_jsx(Button, { id: "create-rule-button", variant: "outlined", startIcon: _jsx(Add, {}), onClick: () => setDialogOpen(true), sx: { alignSelf: 'end' }, children: t('page.cases.rules.create') }), _jsx(Card, { children: rules.length === 0 ? (_jsx(Typography, { m: 2, color: "textSecondary", textAlign: "center", children: t('page.cases.rules.empty') })) : (_jsx(TableContainer, { children: _jsxs(Table, { id: "rules-table", size: "small", children: [_jsx(TableHead, { children: _jsxs(TableRow, { children: [_jsx(TableCell, { children: t('page.cases.rules.destination') }), _jsx(TableCell, { children: t('page.cases.rules.query') }), _jsx(TableCell, { children: t('hit.search.index') }), _jsx(TableCell, { children: t('page.cases.rules.timeframe') }), _jsx(TableCell, { children: t('page.cases.rules.author') }), _jsx(TableCell, { align: "center", children: t('enabled') }), _jsx(TableCell, { align: "right" })] }) }), _jsx(TableBody, { children: rules.map(rule => {
-                                    const _timeframe = rule.timeframe ? dayjs(rule.timeframe) : null;
-                                    return (_jsxs(TableRow, { id: `rule-row-${rule.rule_id}`, children: [_jsx(TableCell, { children: _jsx(Typography, { variant: "body2", sx: { fontFamily: 'monospace' }, children: rule.destination }) }), _jsx(TableCell, { children: _jsx(Typography, { variant: "body2", sx: {
-                                                        fontFamily: 'monospace'
-                                                    }, children: rule.query }) }), _jsx(TableCell, { children: _jsx(Stack, { direction: "row", spacing: 0.5, children: (rule.indexes ?? ['hit']).map(idx => (_jsx(Chip, { size: "small", label: idx, variant: "outlined" }, idx))) }) }), _jsx(TableCell, { children: _timeframe ? (_jsx(Chip, { size: "small", label: _timeframe.format('YYYY-MM-DD HH:mm'), color: _timeframe.isBefore(dayjs()) ? 'error' : 'default' })) : (_jsx(Chip, { size: "small", label: t('page.cases.rules.no_expiry'), color: "success" })) }), _jsx(TableCell, { children: _jsx(Typography, { variant: "body2", children: rule.author }) }), _jsx(TableCell, { align: "center", children: _jsx(Switch, { id: `rule-toggle-${rule.rule_id}`, checked: rule.enabled ?? true, onChange: (_e, checked) => handleToggleEnabled(rule.rule_id, checked), size: "small" }) }), _jsx(TableCell, { align: "right", children: _jsx(Tooltip, { title: t('delete'), children: _jsx(IconButton, { id: `rule-delete-${rule.rule_id}`, size: "small", onClick: () => handleDeleteRule(rule.rule_id), children: _jsx(Delete, { fontSize: "small" }) }) }) })] }, rule.rule_id));
-                                }) })] }) })) }), _jsx(CreateRuleDialog, { open: dialogOpen, onClose: () => setDialogOpen(false), onSubmit: handleCreateRule })] }));
+    return (_jsxs(Stack, { spacing: 2, sx: { p: 2, height: '100%', overflow: 'auto' }, children: [_jsx(Button, { id: "create-rule-button", variant: "outlined", startIcon: _jsx(Add, {}), onClick: () => setDialogOpen(true), sx: { alignSelf: 'end' }, children: t('page.cases.rules.create') }), _jsx(Card, { children: rules.length === 0 ? (_jsx(Typography, { m: 2, color: "textSecondary", textAlign: "center", children: t('page.cases.rules.empty') })) : (_jsx(TableContainer, { children: _jsxs(Table, { id: "rules-table", size: "small", children: [_jsx(TableHead, { children: _jsxs(TableRow, { children: [_jsx(TableCell, { children: t('page.cases.rules.destination') }), _jsx(TableCell, { children: t('page.cases.rules.query') }), _jsx(TableCell, { children: t('hit.search.index') }), _jsx(TableCell, { children: t('page.cases.rules.timeframe') }), _jsx(TableCell, { children: t('page.cases.rules.author') }), _jsx(TableCell, { align: "center", children: t('enabled') }), _jsx(TableCell, { align: "right" })] }) }), _jsx(TableBody, { children: rules.map(rule => (_jsxs(TableRow, { id: `rule-row-${rule.rule_id}`, children: [_jsx(TableCell, { children: _jsx(Typography, { variant: "body2", sx: { fontFamily: 'monospace' }, children: rule.destination }) }), _jsx(TableCell, { children: _jsx(Typography, { variant: "body2", sx: {
+                                                    fontFamily: 'monospace'
+                                                }, children: rule.query }) }), _jsx(TableCell, { children: _jsx(Stack, { direction: "row", spacing: 0.5, children: (rule.indexes ?? ['hit']).map(idx => (_jsx(Chip, { size: "small", label: idx, variant: "outlined" }, idx))) }) }), _jsx(TableCell, { children: rule.timeframe != null ? (_jsx(Chip, { size: "small", label: rule.expire_after_resolved
+                                                    ? t('page.cases.rules.timeframe.after_resolved', { days: rule.timeframe })
+                                                    : t('page.cases.rules.timeframe.days', { days: rule.timeframe }), color: rule.expire_after_resolved ? 'info' : 'default' })) : (_jsx(Chip, { size: "small", label: t('page.cases.rules.no_expiry'), color: "success" })) }), _jsx(TableCell, { children: _jsx(Typography, { variant: "body2", children: rule.author }) }), _jsx(TableCell, { align: "center", children: _jsx(Switch, { id: `rule-toggle-${rule.rule_id}`, checked: rule.enabled ?? true, onChange: (_e, checked) => handleToggleEnabled(rule.rule_id, checked), size: "small" }) }), _jsx(TableCell, { align: "right", children: _jsx(Tooltip, { title: t('delete'), children: _jsx(IconButton, { id: `rule-delete-${rule.rule_id}`, size: "small", onClick: () => handleDeleteRule(rule.rule_id), children: _jsx(Delete, { fontSize: "small" }) }) }) })] }, rule.rule_id))) })] }) })) }), _jsx(CreateRuleDialog, { open: dialogOpen, onClose: () => setDialogOpen(false), onSubmit: handleCreateRule })] }));
 };
 export default CaseRules;

package/components/routes/cases/detail/CaseRules.test.js

@@ -68,7 +68,8 @@ const makeRule = (overrides) => ({
     destination: 'alerts/{{howler.analytic}}',
     author: 'analyst1',
     enabled: true,
-    timeframe: '2026-06-01T00:00:00.000Z',
+    timeframe: 14,
+    expire_after_resolved: false,
     indexes: ['hit'],
     ...overrides
 });
@@ -104,6 +105,22 @@ describe('CaseRules', () => {
         render(_jsx(CaseRules, {}));
         expect(screen.getByText('page.cases.rules.no_expiry')).toBeInTheDocument();
     });
+    it('shows after-resolved chip when expire_after_resolved is true', () => {
+        mockCase.current = createMockCase({
+            case_id: 'case-001',
+            rules: [makeRule({ timeframe: 7, expire_after_resolved: true })]
+        });
+        render(_jsx(CaseRules, {}));
+        expect(screen.getByText('page.cases.rules.timeframe.after_resolved')).toBeInTheDocument();
+    });
+    it('shows days chip when expire_after_resolved is false', () => {
+        mockCase.current = createMockCase({
+            case_id: 'case-001',
+            rules: [makeRule({ timeframe: 14, expire_after_resolved: false })]
+        });
+        render(_jsx(CaseRules, {}));
+        expect(screen.getByText('page.cases.rules.timeframe.days')).toBeInTheDocument();
+    });
     it('renders enabled toggle for each rule', () => {
         mockCase.current = createMockCase({
             case_id: 'case-001',

package/components/routes/cases/detail/CreateRuleDialog.js

@@ -1,17 +1,14 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
 import { useMonaco } from '@monaco-editor/react';
-import { Search } from '@mui/icons-material';
-import { Box, Button, Card, Checkbox, Dialog, DialogActions, DialogContent, DialogTitle, FormControlLabel, FormGroup, IconButton, Stack, TextField, Tooltip, Typography } from '@mui/material';
+import { CheckCircleOutline, FilterList, RadioButtonUnchecked, Search } from '@mui/icons-material';
+import { Autocomplete, Box, Button, Card, Chip, Dialog, DialogActions, DialogContent, DialogTitle, IconButton, Stack, TextField, Tooltip, Typography } from '@mui/material';
 import api from '@cccsaurora/howler-ui/api';
+import ChipPopper from '@cccsaurora/howler-ui/components/elements/display/ChipPopper';
 import QueryResultText from '@cccsaurora/howler-ui/components/elements/display/QueryResultText';
 import useMyApi from '@cccsaurora/howler-ui/components/hooks/useMyApi';
 import QueryEditor from '@cccsaurora/howler-ui/components/routes/advanced/QueryEditor';
-import dayjs, {} from 'dayjs';
 import { useCallback, useEffect, useState } from 'react';
 import { useTranslation } from 'react-i18next';
-import { LocalizationProvider } from '@mui/x-date-pickers';
-import { AdapterDayjs } from '@mui/x-date-pickers/AdapterDayjs';
-import { DateTimePicker } from '@mui/x-date-pickers/DateTimePicker';
 const DEFAULT_TIMEFRAME_DAYS = 14;
 const PROMPT_CONTEXT = 'isRecordQuery && !suggestWidgetVisible && !renameInputVisible && !inSnippetMode && !quickFixWidgetVisible';
 const OPTIONS = {
@@ -26,6 +23,15 @@ const OPTIONS = {
     renderLineHighlight: 'none',
     overviewRulerLanes: 0
 };
+const INDEX_OPTIONS = ['hit', 'event'];
+const Subtitle = ({ i18nKey }) => {
+    const { t } = useTranslation();
+    return (_jsx(Typography, { sx: theme => ({
+            color: theme.palette.text.secondary,
+            fontSize: '0.9em',
+            fontStyle: 'italic'
+        }), variant: "body2", children: t(i18nKey) }));
+};
 const CreateRuleDialog = ({ open, onClose, onSubmit }) => {
     const { t } = useTranslation();
     const { dispatchApi } = useMyApi();
@@ -33,8 +39,9 @@ const CreateRuleDialog = ({ open, onClose, onSubmit }) => {
     const [query, setQuery] = useState('');
     const [destination, setDestination] = useState('');
     const [indexes, setIndexes] = useState(['hit']);
-    const [timeframe, setTimeframe] = useState(dayjs().add(DEFAULT_TIMEFRAME_DAYS, 'day'));
-    const [noExpiry, setNoExpiry] = useState(false);
+    const [timeframeDays, setTimeframeDays] = useState(DEFAULT_TIMEFRAME_DAYS);
+    const [hasExpiry, setHasExpiry] = useState(true);
+    const [expireAfterResolved, setExpireAfterResolved] = useState(false);
     const [loading, setLoading] = useState(false);
     const [searching, setSearching] = useState(false);
     const [response, setResponse] = useState(null);
@@ -42,8 +49,9 @@ const CreateRuleDialog = ({ open, onClose, onSubmit }) => {
         setQuery('');
         setDestination('');
         setIndexes(['hit']);
-        setTimeframe(dayjs().add(DEFAULT_TIMEFRAME_DAYS, 'day'));
-        setNoExpiry(false);
+        setTimeframeDays(DEFAULT_TIMEFRAME_DAYS);
+        setHasExpiry(true);
+        setExpireAfterResolved(false);
         setResponse(null);
     }, []);
     const handleSearch = useCallback(async () => {
@@ -73,7 +81,8 @@ const CreateRuleDialog = ({ open, onClose, onSubmit }) => {
             await onSubmit({
                 query: query.trim(),
                 destination: destination.trim(),
-                timeframe: noExpiry ? undefined : timeframe.toISOString(),
+                timeframe: hasExpiry ? timeframeDays : null,
+                expire_after_resolved: hasExpiry ? expireAfterResolved : false,
                 indexes
             });
             onClose();
@@ -81,7 +90,7 @@ const CreateRuleDialog = ({ open, onClose, onSubmit }) => {
         finally {
             setLoading(false);
         }
-    }, [query, destination, noExpiry, timeframe, indexes, onSubmit, onClose]);
+    }, [query, destination, hasExpiry, timeframeDays, expireAfterResolved, indexes, onSubmit, onClose]);
     const onMount = useCallback((ed) => {
         ed.createContextKey('isRecordQuery', true);
     }, []);
@@ -116,48 +125,21 @@ const CreateRuleDialog = ({ open, onClose, onSubmit }) => {
     }, [monaco, handleSearch]);
     return (_jsxs(Dialog, { open: open, onClose: onClose, maxWidth: "md", fullWidth: true, id: "create-rule-dialog", TransitionProps: { onEnter: handleOpen }, PaperProps: {
             elevation: 0
-        }, children: [_jsx(DialogTitle, { children: t('page.cases.rules.create') }), _jsx(DialogContent, { children: _jsxs(Stack, { spacing: 2, sx: { mt: 1 }, children: [_jsxs(Box, { children: [_jsx(Typography, { variant: "subtitle2", gutterBottom: true, children: t('page.cases.rules.query') }), _jsxs(Stack, { direction: "row", alignItems: "center", spacing: 1, children: [_jsx(Box, { sx: { border: 1, borderColor: 'divider', borderRadius: 1, flex: 1 }, children: _jsx(Card, { variant: "outlined", sx: theme => ({
-                                                    width: '100%',
-                                                    height: theme.spacing(5),
-                                                    p: 1,
-                                                    position: 'relative',
-                                                    overflow: 'visible',
-                                                    display: 'flex',
-                                                    alignItems: 'center',
-                                                    justifyContent: 'space-between',
-                                                    '& .monaco-editor': {
-                                                        position: 'absolute !important'
-                                                    },
-                                                    transition: theme.transitions.create('border-color')
-                                                }), onKeyDown: e => e.stopPropagation(), children: _jsx(QueryEditor, { query: query, setQuery: handleQueryChange, language: "lucene", id: "rule-query-editor", height: "20px", editorOptions: OPTIONS, onMount: onMount }) }) }), _jsx(Tooltip, { title: t('route.search'), children: _jsx("span", { children: _jsx(IconButton, { id: "rule-search-button", onClick: handleSearch, disabled: searching || !query.trim(), children: _jsx(Search, {}) }) }) })] }), response ? (_jsx(QueryResultText, { count: response.total, query: query })) : (_jsx(Typography, { sx: theme => ({
-                                        color: theme.palette.text.secondary,
-                                        fontSize: '0.9em',
-                                        fontStyle: 'italic',
-                                        mt: 0.5
-                                    }), variant: "body2", children: t('hit.search.prompt') }))] }), _jsx(TextField, { id: "rule-destination-input", label: t('page.cases.rules.destination'), value: destination, onChange: e => setDestination(e.target.value), fullWidth: true, placeholder: "alerts/{{howler.analytic}}", helperText: t('page.cases.rules.destination.help'), size: "small" }), _jsxs(Box, { children: [_jsx(Typography, { variant: "subtitle2", gutterBottom: true, children: t('page.cases.rules.indexes') }), _jsxs(FormGroup, { row: true, children: [_jsx(FormControlLabel, { control: _jsx(Checkbox, { id: "rule-index-hit", checked: indexes.includes('hit'), onChange: (_e, checked) => {
-                                                    setIndexes(prev => {
-                                                        if (checked) {
-                                                            return prev.includes('hit') ? prev : [...prev, 'hit'];
-                                                        }
-                                                        return prev.filter(i => i !== 'hit');
-                                                    });
-                                                } }), label: t('hit.search.index.hit') }), _jsx(FormControlLabel, { control: _jsx(Checkbox, { id: "rule-index-event", checked: indexes.includes('event'), onChange: (_e, checked) => {
-                                                    setIndexes(prev => {
-                                                        if (checked) {
-                                                            return prev.includes('event') ? prev : [...prev, 'event'];
-                                                        }
-                                                        return prev.filter(i => i !== 'event');
-                                                    });
-                                                } }), label: t('hit.search.index.event') })] })] }), _jsxs(Stack, { direction: "row", spacing: 2, alignItems: "center", children: [_jsx(LocalizationProvider, { dateAdapter: AdapterDayjs, children: _jsx(DateTimePicker, { slotProps: {
-                                            textField: {
-                                                id: 'rule-timeframe-input',
-                                                fullWidth: true,
-                                                size: 'small'
-                                            }
-                                        }, label: t('page.cases.rules.timeframe'), value: timeframe, onChange: nv => {
-                                            if (nv) {
-                                                setTimeframe(nv);
-                                            }
-                                        }, disabled: noExpiry, ampm: false, disablePast: true, sx: { flex: 1 } }) }), _jsx(FormControlLabel, { control: _jsx(Checkbox, { id: "rule-no-expiry-checkbox", checked: noExpiry, onChange: (_e, checked) => setNoExpiry(checked) }), label: t('page.cases.rules.no_expiry') })] })] }) }), _jsxs(DialogActions, { children: [_jsx(Button, { onClick: onClose, children: t('cancel') }), _jsx(Button, { id: "rule-submit-button", variant: "contained", onClick: handleSubmit, disabled: !response || loading || !query.trim() || !destination.trim() || indexes.length === 0, children: t('page.cases.rules.create') })] })] }));
+        }, children: [_jsx(DialogTitle, { children: t('page.cases.rules.create') }), _jsx(DialogContent, { children: _jsxs(Stack, { spacing: 3, sx: { mt: 1 }, children: [_jsxs(Box, { children: [_jsxs(Stack, { direction: "row", justifyContent: "space-between", children: [_jsx(Typography, { variant: "subtitle2", gutterBottom: true, children: t('page.cases.rules.query') }), _jsx(ChipPopper, { icon: _jsx(FilterList, { fontSize: "small" }), label: indexes.map(opt => t(`hit.search.index.${opt}`)).join(', '), minWidth: "225px", slotProps: { chip: { size: 'small' } }, children: _jsx(Autocomplete, { size: "small", multiple: true, options: INDEX_OPTIONS, value: indexes, onChange: (_ev, values) => values.length > 0 && setIndexes(values), getOptionLabel: opt => t(`hit.search.index.${opt}`), renderInput: params => _jsx(TextField, { ...params }) }) })] }), _jsx(Stack, { direction: "row", alignItems: "center", spacing: 1, children: _jsx(Box, { sx: { border: 1, borderColor: 'divider', borderRadius: 1, flex: 1 }, children: _jsxs(Card, { variant: "outlined", sx: theme => ({
+                                                width: '100%',
+                                                height: theme.spacing(5),
+                                                py: 1,
+                                                pl: 1,
+                                                pr: 0.5,
+                                                position: 'relative',
+                                                overflow: 'visible',
+                                                display: 'flex',
+                                                alignItems: 'center',
+                                                justifyContent: 'space-between',
+                                                '& .monaco-editor': {
+                                                    position: 'absolute !important'
+                                                },
+                                                transition: theme.transitions.create('border-color')
+                                            }), onKeyDown: e => e.stopPropagation(), children: [_jsx(QueryEditor, { query: query, setQuery: handleQueryChange, language: "lucene", id: "rule-query-editor", height: "20px", editorOptions: OPTIONS, onMount: onMount }), _jsx(Tooltip, { title: t('route.search'), children: _jsx("span", { children: _jsx(IconButton, { size: "small", id: "rule-search-button", onClick: handleSearch, disabled: searching || !query.trim(), children: _jsx(Search, {}) }) }) })] }) }) }), response ? (_jsx(QueryResultText, { count: response.total, query: query, mb: 0 })) : (_jsx(Subtitle, { i18nKey: "hit.search.prompt" }))] }), _jsxs(Box, { children: [_jsx(TextField, { id: "rule-destination-input", label: t('page.cases.rules.destination'), value: destination, onChange: e => setDestination(e.target.value), fullWidth: true, placeholder: "alerts/{{howler.analytic}}", size: "small" }), _jsx(Subtitle, { i18nKey: "page.cases.rules.destination.help" })] }), _jsxs(Stack, { children: [_jsx(TextField, { id: "rule-timeframe-input", type: "number", label: t('page.cases.rules.timeframe'), value: timeframeDays, onChange: e => setTimeframeDays(Math.max(1, parseInt(e.target.value, 10) || 1)), size: "small", disabled: !hasExpiry, sx: { flex: 1 }, InputProps: { inputProps: { min: 1 } } }), _jsx(Subtitle, { i18nKey: "page.cases.rules.timeframe.help" })] }), _jsxs(Stack, { direction: "row", spacing: 1, alignItems: "center", flexWrap: "wrap", children: [_jsx(Chip, { id: "rule-no-expiry-checkbox", label: t('page.cases.rules.no_expiry'), icon: !hasExpiry ? _jsx(CheckCircleOutline, {}) : _jsx(RadioButtonUnchecked, {}), variant: "filled", color: !hasExpiry ? 'primary' : 'default', clickable: true, disabled: expireAfterResolved, onClick: () => setHasExpiry(prev => !prev) }), _jsx(Chip, { id: "rule-expire-after-resolved", label: t('page.cases.rules.expire_after_resolved'), icon: expireAfterResolved ? _jsx(CheckCircleOutline, {}) : _jsx(RadioButtonUnchecked, {}), variant: "filled", color: expireAfterResolved ? 'primary' : 'default', clickable: hasExpiry, onClick: () => setExpireAfterResolved(prev => !prev), disabled: !hasExpiry })] })] }) }), _jsxs(DialogActions, { children: [_jsx(Button, { onClick: onClose, children: t('cancel') }), _jsx(Button, { id: "rule-submit-button", variant: "contained", onClick: handleSubmit, disabled: !response || loading || !query.trim() || !destination.trim() || indexes.length === 0, children: t('page.cases.rules.create') })] })] }));
 };
 export default CreateRuleDialog;

package/components/routes/cases/detail/CreateRuleDialog.test.js

@@ -35,8 +35,8 @@ vi.mock('@mui/x-date-pickers/AdapterDayjs', () => ({
     AdapterDayjs: class {
     }
 }));
-vi.mock('@mui/x-date-pickers/DateTimePicker', () => ({
-    DateTimePicker: ({ label, disabled }) => (_jsx("input", { id: "rule-timeframe-input", "aria-label": label, disabled: disabled, readOnly: true }))
+vi.mock('components/elements/display/ChipPopper', () => ({
+    default: ({ children }) => _jsx(_Fragment, { children: children })
 }));
 import api from '@cccsaurora/howler-ui/api';
 import CreateRuleDialog from './CreateRuleDialog';
@@ -60,8 +60,8 @@ describe('CreateRuleDialog', () => {
         expect(screen.getByTestId('rule-destination-input')).toBeInTheDocument();
         expect(screen.getByTestId('rule-timeframe-input')).toBeInTheDocument();
         expect(screen.getByTestId('rule-no-expiry-checkbox')).toBeInTheDocument();
-        expect(screen.getByTestId('rule-index-hit')).toBeInTheDocument();
-        expect(screen.getByTestId('rule-index-event')).toBeInTheDocument();
+        expect(screen.getByTestId('rule-expire-after-resolved')).toBeInTheDocument();
+        expect(screen.getByRole('combobox')).toBeInTheDocument();
     });
     it('disables submit when query is empty', () => {
         render(_jsx(CreateRuleDialog, { ...defaultProps }));
@@ -149,7 +149,7 @@ describe('CreateRuleDialog', () => {
         expect(screen.getByText('hit.search.prompt')).toBeInTheDocument();
         expect(screen.queryByTestId('query-result-text')).not.toBeInTheDocument();
     });
-    it('includes timeframe as ISO string when no expiry is unchecked', async () => {
+    it('includes timeframe as number when expiry is enabled', async () => {
         const user = userEvent.setup();
         const onSubmit = vi.fn().mockResolvedValue(undefined);
         mockDispatchApi.mockResolvedValueOnce({ items: [], total: 1, offset: 0, rows: 0 });
@@ -169,7 +169,7 @@ describe('CreateRuleDialog', () => {
         });
         await waitFor(() => {
             expect(onSubmit).toHaveBeenCalledWith(expect.objectContaining({
-                timeframe: expect.any(String)
+                timeframe: 14
             }));
         });
     });
@@ -198,25 +198,18 @@ describe('CreateRuleDialog', () => {
             expect(onSubmit).toHaveBeenCalledWith(expect.objectContaining({
                 query: 'event.kind:alert',
                 destination: 'alerts/incoming',
-                timeframe: undefined
+                timeframe: null
             }));
         });
     });
-    it('defaults to hit index checked', () => {
-        render(_jsx(CreateRuleDialog, { ...defaultProps }));
-        const hitCheckbox = screen.getByTestId('rule-index-hit');
-        const eventCheckbox = screen.getByTestId('rule-index-event');
-        expect(hitCheckbox).toBeChecked();
-        expect(eventCheckbox).not.toBeChecked();
-    });
-    it('includes both indexes when both are selected', async () => {
+    it('includes expire_after_resolved when checkbox is checked', async () => {
         const user = userEvent.setup();
         const onSubmit = vi.fn().mockResolvedValue(undefined);
         mockDispatchApi.mockResolvedValueOnce({ items: [], total: 1, offset: 0, rows: 0 });
         api.search.hit.post.mockReturnValue('search-request');
         render(_jsx(CreateRuleDialog, { ...defaultProps, onSubmit: onSubmit }));
         await act(async () => {
-            await user.click(screen.getByTestId('rule-index-event'));
+            await user.click(screen.getByTestId('rule-expire-after-resolved'));
         });
         await act(async () => {
             await user.type(screen.getByTestId('rule-query-editor'), 'event.kind:alert');
@@ -232,15 +225,31 @@ describe('CreateRuleDialog', () => {
         });
         await waitFor(() => {
             expect(onSubmit).toHaveBeenCalledWith(expect.objectContaining({
-                indexes: expect.arrayContaining(['hit', 'event'])
+                timeframe: 14,
+                expire_after_resolved: true
             }));
         });
     });
-    it('disables submit when no indexes are selected', async () => {
+    it('defaults to hit index checked', () => {
+        render(_jsx(CreateRuleDialog, { ...defaultProps }));
+        // With 'hit' selected by default, its chip appears in the Autocomplete input area
+        expect(screen.getAllByText('hit.search.index.hit').length).toBeGreaterThan(0);
+        // 'event' is not selected, so its chip should not appear
+        expect(screen.queryByText('hit.search.index.event')).not.toBeInTheDocument();
+    });
+    it('includes both indexes when both are selected', async () => {
         const user = userEvent.setup();
+        const onSubmit = vi.fn().mockResolvedValue(undefined);
         mockDispatchApi.mockResolvedValueOnce({ items: [], total: 1, offset: 0, rows: 0 });
         api.search.hit.post.mockReturnValue('search-request');
-        render(_jsx(CreateRuleDialog, { ...defaultProps }));
+        render(_jsx(CreateRuleDialog, { ...defaultProps, onSubmit: onSubmit }));
+        // Open the index Autocomplete and select 'event'
+        await act(async () => {
+            await user.click(screen.getByRole('combobox'));
+        });
+        await act(async () => {
+            await user.click(screen.getByRole('option', { name: 'hit.search.index.event' }));
+        });
         await act(async () => {
             await user.type(screen.getByTestId('rule-query-editor'), 'event.kind:alert');
         });
@@ -250,10 +259,26 @@ describe('CreateRuleDialog', () => {
         await act(async () => {
             await user.type(screen.getByTestId('rule-destination-input'), 'alerts/incoming');
         });
-        // Uncheck the default hit index
         await act(async () => {
-            await user.click(screen.getByTestId('rule-index-hit'));
+            await user.click(screen.getByTestId('rule-submit-button'));
         });
-        expect(screen.getByTestId('rule-submit-button')).toBeDisabled();
+        await waitFor(() => {
+            expect(onSubmit).toHaveBeenCalledWith(expect.objectContaining({
+                indexes: expect.arrayContaining(['hit', 'event'])
+            }));
+        });
+    });
+    it('prevents deselecting the last index', async () => {
+        const user = userEvent.setup();
+        render(_jsx(CreateRuleDialog, { ...defaultProps }));
+        // 'hit' is selected by default; open the dropdown and try to deselect it
+        await act(async () => {
+            await user.click(screen.getByRole('combobox'));
+        });
+        await act(async () => {
+            await user.click(screen.getByRole('option', { name: 'hit.search.index.hit' }));
+        });
+        // 'hit' should still be selected because deselecting the last index is prevented
+        expect(screen.getAllByText('hit.search.index.hit').length).toBeGreaterThan(0);
     });
 });

package/locales/en/translation.json

@@ -391,18 +391,6 @@
     "page.403.title": "403: Access Forbidden",
     "page.404.description": "The page you are looking for cannot be found...",
     "page.404.title": "404: Not found",
-    "page.cases.observables": "Observables",
-    "page.cases.observables.empty": "No observables found.",
-    "page.cases.observables.filter_by_type": "Filter by type:",
-    "page.cases.observables.seen_in": "Seen in",
-    "page.cases.observables.type.hash": "Hash",
-    "page.cases.observables.type.hosts": "Host",
-    "page.cases.observables.type.id": "ID",
-    "page.cases.observables.type.ids": "ID",
-    "page.cases.observables.type.ip": "IP",
-    "page.cases.observables.type.signature": "Signature",
-    "page.cases.observables.type.uri": "URI",
-    "page.cases.observables.type.user": "User",
     "page.cases.created": "Created",
     "page.cases.dashboard": "Dashboard",
     "page.cases.dashboard.alerts": "Alerts",
@@ -418,13 +406,25 @@
     "page.cases.dashboard.tasks.hide_child": "Hide child case tasks",
     "page.cases.dashboard.tasks.show_child": "Show child case tasks",
     "page.cases.dashboard.threat": "Threats",
+    "page.cases.detail.escalation": "Escalation",
     "page.cases.detail.participants": "Participants",
     "page.cases.detail.properties": "Properties",
     "page.cases.detail.status": "Status",
-    "page.cases.detail.escalation": "Escalation",
     "page.cases.detail.viewers": "Active Viewers",
     "page.cases.escalation": "Escalation",
     "page.cases.folder.drop.root": "Place here to move to root",
+    "page.cases.observables": "Observables",
+    "page.cases.observables.empty": "No observables found.",
+    "page.cases.observables.filter_by_type": "Filter by type:",
+    "page.cases.observables.seen_in": "Seen in",
+    "page.cases.observables.type.hash": "Hash",
+    "page.cases.observables.type.hosts": "Host",
+    "page.cases.observables.type.id": "ID",
+    "page.cases.observables.type.ids": "ID",
+    "page.cases.observables.type.ip": "IP",
+    "page.cases.observables.type.signature": "Signature",
+    "page.cases.observables.type.uri": "URI",
+    "page.cases.observables.type.user": "User",
     "page.cases.rules": "Rules",
     "page.cases.rules.author": "Author",
     "page.cases.rules.create": "Create Rule",
@@ -432,9 +432,14 @@
     "page.cases.rules.destination": "Alert Destination Path",
     "page.cases.rules.destination.help": "Handlebars template for the case item path (e.g. alerts/{{howler.analytic}})",
     "page.cases.rules.empty": "No correlation rules configured.",
+    "page.cases.rules.expire_after_resolved": "Start expiry after case is resolved",
+    "page.cases.rules.indexes": "Indexes",
     "page.cases.rules.no_expiry": "No expiry",
     "page.cases.rules.query": "Match Query",
     "page.cases.rules.timeframe": "Rule Expiry",
+    "page.cases.rules.timeframe.after_resolved": "{{days}} day(s) after resolved",
+    "page.cases.rules.timeframe.days": "{{days}} day(s)",
+    "page.cases.rules.timeframe.help": "Number of days before the rule expires",
     "page.cases.search": "Search",
     "page.cases.sidebar.folder.remove": "Remove folder",
     "page.cases.sidebar.item.open": "Open item",

package/locales/fr/translation.json

@@ -391,18 +391,6 @@
     "page.403.title": "403: Accès interdit",
     "page.404.description": "La page que vous recherchez est introuvable ...",
     "page.404.title": "404: Introuvable",
-    "page.cases.observables": "Observables",
-    "page.cases.observables.empty": "Aucun observable trouvé.",
-    "page.cases.observables.filter_by_type": "Filtrer par type :",
-    "page.cases.observables.seen_in": "Vu dans",
-    "page.cases.observables.type.hash": "Hachage",
-    "page.cases.observables.type.hosts": "Hôte",
-    "page.cases.observables.type.id": "Identifiant",
-    "page.cases.observables.type.ids": "Identifiant",
-    "page.cases.observables.type.ip": "IP",
-    "page.cases.observables.type.signature": "Signature",
-    "page.cases.observables.type.uri": "URI",
-    "page.cases.observables.type.user": "Utilisateur",
     "page.cases.created": "Créé",
     "page.cases.dashboard": "Tableau de bord",
     "page.cases.dashboard.alerts": "Alertes",
@@ -418,13 +406,25 @@
     "page.cases.dashboard.tasks.hide_child": "Masquer les tâches des cas enfants",
     "page.cases.dashboard.tasks.show_child": "Afficher les tâches des cas enfants",
     "page.cases.dashboard.threat": "Menaces",
+    "page.cases.detail.escalation": "Escalade",
     "page.cases.detail.participants": "Participants",
     "page.cases.detail.properties": "Propriétés",
     "page.cases.detail.status": "Statut",
-    "page.cases.detail.escalation": "Escalade",
     "page.cases.detail.viewers": "Spectateurs actifs",
     "page.cases.escalation": "Escalade",
     "page.cases.folder.drop.root": "Déposer ici pour déplacer à la racine",
+    "page.cases.observables": "Observables",
+    "page.cases.observables.empty": "Aucun observable trouvé.",
+    "page.cases.observables.filter_by_type": "Filtrer par type :",
+    "page.cases.observables.seen_in": "Vu dans",
+    "page.cases.observables.type.hash": "Hachage",
+    "page.cases.observables.type.hosts": "Hôte",
+    "page.cases.observables.type.id": "Identifiant",
+    "page.cases.observables.type.ids": "Identifiant",
+    "page.cases.observables.type.ip": "IP",
+    "page.cases.observables.type.signature": "Signature",
+    "page.cases.observables.type.uri": "URI",
+    "page.cases.observables.type.user": "Utilisateur",
     "page.cases.rules": "Règles",
     "page.cases.rules.author": "Auteur",
     "page.cases.rules.create": "Créer une règle",
@@ -432,9 +432,14 @@
     "page.cases.rules.destination": "Chemin de destination des alertes",
     "page.cases.rules.destination.help": "Modèle Handlebars pour le chemin de l'élément de cas (ex. alerts/{{howler.analytic}})",
     "page.cases.rules.empty": "Aucune règle de corrélation configurée.",
+    "page.cases.rules.expire_after_resolved": "Démarrer l'expiration après la résolution du cas",
+    "page.cases.rules.indexes": "Index",
     "page.cases.rules.no_expiry": "Sans expiration",
     "page.cases.rules.query": "Requête de correspondance",
     "page.cases.rules.timeframe": "Expiration de la règle",
+    "page.cases.rules.timeframe.after_resolved": "{{days}} jour(s) après résolution",
+    "page.cases.rules.timeframe.days": "{{days}} jour(s)",
+    "page.cases.rules.timeframe.help": "Nombre de jours avant l'expiration de la règle",
     "page.cases.search": "Rechercher",
     "page.cases.sidebar.folder.remove": "Supprimer le dossier",
     "page.cases.sidebar.item.open": "Ouvrir l'élément",

package/models/entities/generated/Rule.d.ts

@@ -7,6 +7,8 @@ export interface Rule {
   query?: string;
   author?: string;
   enabled?: boolean;
-  timeframe?: string;
+  created_at?: string;
+  timeframe?: number;
+  expire_after_resolved?: boolean;
   indexes?: ('hit' | 'event')[];
 }

package/package.json

@@ -96,7 +96,7 @@
     "internal-slot": "1.0.7"
   },
   "type": "module",
-  "version": "2.19.0-cases.1122",
+  "version": "2.19.0-cases.1129",
   "exports": {
     "./i18n": "./i18n.js",
     "./index.css": "./index.css",