@cccsaurora/howler-ui 2.19.0-dev.839 → 2.19.0-dev.842

package/components/routes/cases/detail/CaseTask.js

@@ -0,0 +1,66 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Check, Close, Delete, Edit } from '@mui/icons-material';
+import { Autocomplete, Card, Checkbox, Chip, IconButton, LinearProgress, Stack, TextField, Tooltip, Typography } from '@mui/material';
+import UserList from '@cccsaurora/howler-ui/components/elements/UserList';
+import { useEffect, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { Link } from 'react-router-dom';
+const CaseTask = ({ task, onEdit, onDelete, paths, newTask = false }) => {
+    const { t } = useTranslation();
+    const [loading, setLoading] = useState(false);
+    const [editing, setEditing] = useState(newTask);
+    const [summary, setSummary] = useState(task?.summary || '');
+    const [path, setPath] = useState(task?.path ?? null);
+    const [assignment, setAssignment] = useState(task?.assignment);
+    const [complete, setComplete] = useState(task?.complete ?? false);
+    const dirty = summary !== task?.summary || path !== task?.path || complete !== task?.complete || assignment !== task?.assignment;
+    const onSubmit = async () => {
+        if (dirty && editing) {
+            setLoading(true);
+            await onEdit({ summary, path: !path ? null : path, assignment, complete });
+            setLoading(false);
+        }
+    };
+    useEffect(() => {
+        if (!editing && task?.assignment !== assignment) {
+            setLoading(true);
+            onEdit({ assignment }).finally(() => setLoading(false));
+        }
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [assignment]);
+    useEffect(() => {
+        if (!editing && task?.complete !== complete) {
+            setLoading(true);
+            onEdit({ complete }).finally(() => setLoading(false));
+        }
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [complete]);
+    useEffect(() => {
+        if (!editing && task) {
+            setSummary(task.summary);
+            setPath(task.path);
+            setComplete(task.complete);
+            setAssignment(task.assignment);
+        }
+        // eslint-disable-next-line react-hooks/exhaustive-deps
+    }, [task]);
+    return (_jsxs(Card, { sx: { pl: 0.5, pr: 1, py: 0.5, position: 'relative' }, children: [_jsxs(Stack, { direction: "row", alignItems: "center", spacing: 1, children: [_jsx(Checkbox, { disabled: loading, color: "success", checked: complete, size: "small", onChange: (_ev, _complete) => setComplete(_complete) }), editing ? (_jsx(TextField, { disabled: loading, value: summary, onChange: e => setSummary(e.target.value), size: "small", fullWidth: true, sx: { minWidth: '40%' } })) : (_jsx(Typography, { sx: [complete && { textDecoration: 'line-through' }], children: task?.summary || summary })), !editing && path && _jsx(Chip, { clickable: true, component: Link, to: path, label: path }), editing && (_jsx(Autocomplete, { disabled: loading, value: path, options: paths, onChange: (_ev, value) => setPath(value), fullWidth: true, renderInput: params => _jsx(TextField, { ...params, size: "small" }) })), _jsx(UserList, { disabled: loading, userIds: [assignment], onChange: ([_assigment]) => setAssignment(_assigment), i18nLabel: "route.cases.task.set.assignment", avatarHeight: 24 }), _jsx("div", { style: { flex: 1 } }), editing && !newTask && (_jsx(Tooltip, { title: t('route.cases.task.delete'), children: _jsx(IconButton, { size: "small", color: "error", onClick: () => {
+                                setLoading(true);
+                                onDelete().then(() => setLoading(false));
+                            }, disabled: loading, children: _jsx(Delete, { fontSize: "small" }) }) })), _jsx(Tooltip, { title: t(editing ? 'route.cases.task.edit.save' : 'route.cases.task.edit'), children: _jsx("span", { children: _jsx(IconButton, { size: "small", color: editing ? 'success' : 'default', onClick: async () => {
+                                    if (!editing) {
+                                        setEditing(true);
+                                        return;
+                                    }
+                                    await onSubmit();
+                                    setEditing(false);
+                                }, disabled: (!dirty && editing) || loading || !summary, children: editing ? _jsx(Check, { fontSize: "small" }) : _jsx(Edit, { fontSize: "small" }) }) }) }), editing && (_jsx(Tooltip, { title: t('route.cases.task.edit.cancel'), children: _jsx(IconButton, { size: "small", onClick: () => {
+                                if (newTask) {
+                                    onDelete();
+                                }
+                                else {
+                                    setEditing(false);
+                                }
+                            }, disabled: loading, children: _jsx(Close, { fontSize: "small" }) }) }))] }), loading && _jsx(LinearProgress, { sx: { left: 0, bottom: 0, right: 0, position: 'absolute' } })] }));
+};
+export default CaseTask;

package/components/routes/cases/detail/CaseTimeline.d.ts

@@ -0,0 +1,12 @@
+import type { Case } from '@cccsaurora/howler-ui/models/entities/generated/Case';
+interface MitreOption {
+    id: string;
+    name: string;
+    kind: 'tactic' | 'technique';
+}
+export declare const buildFilters: (mitre: MitreOption[], escalations: string[]) => string[];
+declare const _default: import("react").NamedExoticComponent<{
+    case?: Case;
+    caseId?: string;
+}>;
+export default _default;

package/components/routes/cases/detail/CaseTimeline.js

@@ -0,0 +1,106 @@
+import { createElement as _createElement } from "react";
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { FilterList } from '@mui/icons-material';
+import { Autocomplete, Box, Chip, Divider, Skeleton, Stack, TextField, Tooltip, Typography } from '@mui/material';
+import api from '@cccsaurora/howler-ui/api';
+import { ApiConfigContext } from '@cccsaurora/howler-ui/components/app/providers/ApiConfigProvider';
+import { RecordContext } from '@cccsaurora/howler-ui/components/app/providers/RecordProvider';
+import HitCard from '@cccsaurora/howler-ui/components/elements/hit/HitCard';
+import { HitLayout } from '@cccsaurora/howler-ui/components/elements/hit/HitLayout';
+import ObservableCard from '@cccsaurora/howler-ui/components/elements/observable/ObservableCard';
+import useMyApi from '@cccsaurora/howler-ui/components/hooks/useMyApi';
+import dayjs from 'dayjs';
+import { capitalize } from 'lodash-es';
+import { memo, useContext, useEffect, useMemo, useState } from 'react';
+import { useTranslation } from 'react-i18next';
+import { Link, useOutletContext } from 'react-router-dom';
+import { useContextSelector } from 'use-context-selector';
+import { ESCALATION_COLORS } from '@cccsaurora/howler-ui/utils/constants';
+import { isHit } from '@cccsaurora/howler-ui/utils/typeUtils';
+import useCase from '../hooks/useCase';
+// builds the additional filters for the lucene query
+export const buildFilters = (mitre, escalations) => {
+    const filters = [];
+    const tacticIds = mitre.filter(o => o.kind === 'tactic').map(o => o.id);
+    const techniqueIds = mitre.filter(o => o.kind === 'technique').map(o => o.id);
+    if (tacticIds.length) {
+        filters.push(`threat.tactic.id:(${tacticIds.join(' OR ')})`);
+    }
+    if (techniqueIds.length) {
+        filters.push(`threat.technique.id:(${techniqueIds.join(' OR ')})`);
+    }
+    if (escalations.length) {
+        filters.push(`howler.escalation:(${escalations.join(' OR ')})`);
+    }
+    return filters;
+};
+const CaseTimeline = ({ case: providedCase, caseId }) => {
+    const { t } = useTranslation();
+    const { dispatchApi } = useMyApi();
+    const { config } = useContext(ApiConfigContext);
+    const routeCase = useOutletContext();
+    const { case: _case } = useCase({ case: providedCase ?? routeCase, caseId });
+    const loadRecords = useContextSelector(RecordContext, ctx => ctx.loadRecords);
+    const [mitreOptions, setMitreOptions] = useState([]);
+    const [escalationOptions, setEscalationOptions] = useState([]);
+    const [displayedEntries, setDisplayedEntries] = useState([]);
+    const [loading, setLoading] = useState(false);
+    const [selectedMitres, setSelectedMitres] = useState([]);
+    const [selectedEscalations, setSelectedEscalations] = useState(['evidence']);
+    const ids = useMemo(() => (_case?.items ?? [])
+        .filter(item => ['hit', 'observable'].includes(item.type))
+        .map(item => item.value)
+        .filter(Boolean), [_case]);
+    const getPath = (value) => _case.items.find(item => item.value === value)?.path;
+    useEffect(() => {
+        if (ids.length < 1) {
+            return;
+        }
+        dispatchApi(api.v2.search.facet.post(['hit', 'observable'], {
+            fields: ['threat.tactic.id', 'threat.technique.id', 'howler.escalation'],
+            filters: [`howler.id:(${ids.join(' OR ')})`]
+        }), { throwError: false }).then(result => {
+            if (!result) {
+                return;
+            }
+            setEscalationOptions(Object.keys(result['howler.escalation'] ?? {}));
+            const tactics = Object.keys(result['threat.tactic.id'] ?? {}).map(tactic => ({
+                id: tactic,
+                name: config.lookups?.tactics?.[tactic].name ?? tactic,
+                kind: 'tactic'
+            }));
+            const techniques = Object.keys(result['threat.technique.id'] ?? {}).map(technique => ({
+                id: technique,
+                name: config.lookups?.techniques?.[technique].name ?? technique,
+                kind: 'technique'
+            }));
+            setMitreOptions([...tactics, ...techniques]);
+        });
+    }, [config.lookups?.tactics, config.lookups?.techniques, dispatchApi, ids]);
+    useEffect(() => {
+        if (!ids.length) {
+            setDisplayedEntries([]);
+            return;
+        }
+        setLoading(true);
+        const filters = buildFilters(selectedMitres, selectedEscalations);
+        dispatchApi(api.v2.search.post(['hit', 'observable'], {
+            query: `howler.id:(${ids.join(' OR ')})`,
+            sort: 'event.created asc',
+            rows: ids.length,
+            filters
+        }), { throwError: false }).then(response => {
+            setLoading(false);
+            if (!response) {
+                return;
+            }
+            loadRecords(response.items);
+            setDisplayedEntries(response.items);
+        });
+    }, [ids, selectedMitres, selectedEscalations, dispatchApi, loadRecords]);
+    if (!_case) {
+        return null;
+    }
+    return (_jsxs(Stack, { spacing: 0, sx: { height: '100%' }, children: [_jsxs(Stack, { direction: "row", spacing: 1, alignItems: "center", flexWrap: "wrap", sx: { p: 1, gap: 1 }, children: [_jsx(Tooltip, { title: t('page.cases.timeline.filter.label'), children: _jsx(FilterList, { fontSize: "small", color: "action" }) }), _jsx(Autocomplete, { multiple: true, size: "small", options: mitreOptions, value: selectedMitres, onChange: (_e, values) => setSelectedMitres(values), getOptionLabel: opt => `${opt.id} - ${opt.name}`, isOptionEqualToValue: (opt, val) => opt.id === val.id, groupBy: opt => capitalize(opt.kind), renderTags: (value, getTagProps) => value.map((opt, index) => (_createElement(Chip, { ...getTagProps({ index }), key: opt.id, size: "small", label: opt.id, color: "primary" }))), renderInput: params => (_jsx(TextField, { ...params, label: t('page.cases.timeline.filter.mitre'), sx: { minWidth: 260 } })), noOptionsText: t('page.cases.timeline.filter.mitre.empty') }), _jsx(Autocomplete, { multiple: true, size: "small", options: escalationOptions, value: selectedEscalations, onChange: (_e, value) => setSelectedEscalations(value), getOptionLabel: opt => t(`howler.escalation.${opt}`, opt), renderTags: (value, getTagProps) => value.map((opt, index) => (_createElement(Chip, { ...getTagProps({ index }), key: opt, size: "small", label: opt, color: ESCALATION_COLORS[opt] }))), renderInput: params => (_jsx(TextField, { ...params, label: t('page.cases.timeline.filter.escalation'), sx: { minWidth: 220 } })), noOptionsText: t('page.cases.timeline.filter.escalation.empty') })] }), _jsx(Divider, {}), loading ? (_jsx(Stack, { spacing: 2, sx: { px: 2, py: 1 }, children: [0, 1, 2].map(i => (_jsxs(Stack, { direction: "row", width: "100%", spacing: 1, children: [_jsx(Skeleton, { variant: "text", width: 120, height: 24 }), _jsx(Skeleton, { variant: "rounded", height: 120, sx: { flex: 1 } })] }, i))) })) : displayedEntries.length === 0 ? (_jsx(Box, { sx: { pt: 4, textAlign: 'center' }, children: _jsx(Typography, { color: "textSecondary", children: t('page.cases.timeline.empty') }) })) : (_jsx(Stack, { component: "ol", spacing: 0, sx: { px: 2, py: 1, listStyle: 'none', m: 0, overflow: 'auto' }, children: displayedEntries.map(entry => (_jsxs(Stack, { component: "li", spacing: 1, sx: { pb: 1 }, children: [_jsxs(Stack, { direction: "row", spacing: 2, alignItems: "flex-start", children: [_jsxs(Stack, { spacing: 0.5, alignItems: "end", children: [_jsx(Typography, { variant: "caption", color: "text.secondary", sx: { whiteSpace: 'nowrap' }, children: dayjs(entry.event?.created ?? entry.timestamp).format('YYYY-MM-DD HH:mm:ss') }), entry.threat?.technique?.id && (_jsx(Tooltip, { title: `${entry.threat.technique.id}: ${config.lookups?.techniques?.[entry.threat.technique.id].name}`, children: _jsx(Typography, { component: config.lookups?.techniques?.[entry.threat.technique.id]?.url ? 'a' : undefined, href: config.lookups?.techniques?.[entry.threat.technique.id]?.url, variant: "caption", color: "text.secondary", sx: { whiteSpace: 'nowrap' }, children: entry.threat.technique.id }) })), entry.threat?.tactic?.id && (_jsx(Tooltip, { title: `${entry.threat.tactic.id}: ${config.lookups?.tactics?.[entry.threat.tactic.id]?.name ?? t('unknown')}`, children: _jsx(Typography, { component: config.lookups?.tactics?.[entry.threat.tactic.id]?.url ? 'a' : undefined, href: config.lookups?.tactics?.[entry.threat.tactic.id]?.url, variant: "caption", color: "text.secondary", sx: { whiteSpace: 'nowrap' }, children: entry.threat.tactic.id }) }))] }), _jsx(Box, { component: Link, to: `/cases/${_case.case_id}/${getPath(entry.howler.id)}`, sx: { flex: 1, minWidth: 0, textDecoration: 'none' }, children: isHit(entry) ? (_jsx(HitCard, { id: entry.howler.id, layout: HitLayout.DENSE, readOnly: true })) : (_jsx(ObservableCard, { id: entry.howler.id })) })] }), _jsx(Divider, { flexItem: true })] }, entry.howler.id))) }))] }));
+};
+export default memo(CaseTimeline);

package/components/routes/cases/detail/CaseTimeline.test.d.ts

@@ -0,0 +1 @@
+export {};

package/components/routes/cases/detail/CaseTimeline.test.js

@@ -0,0 +1,320 @@
+import { jsx as _jsx } from "react/jsx-runtime";
+/* eslint-disable react/no-children-prop */
+/// <reference types="vitest" />
+import { act, render, screen } from '@testing-library/react';
+import userEvent from '@testing-library/user-event';
+import { ApiConfigContext } from '@cccsaurora/howler-ui/components/app/providers/ApiConfigProvider';
+import { RecordContext } from '@cccsaurora/howler-ui/components/app/providers/RecordProvider';
+import { createElement } from 'react';
+import { MemoryRouter } from 'react-router-dom';
+import { createMockHit, createMockObservable } from '@cccsaurora/howler-ui/tests/utils';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { buildFilters } from './CaseTimeline';
+// ---------------------------------------------------------------------------
+// Pure logic tests
+// ---------------------------------------------------------------------------
+describe('buildFilters', () => {
+    it('returns an empty array when both lists are empty', () => {
+        expect(buildFilters([], [])).toEqual([]);
+    });
+    it('builds a tactic filter', () => {
+        const result = buildFilters([{ id: 'TA0001', name: 'Initial Access', kind: 'tactic' }], []);
+        expect(result).toEqual(['threat.tactic.id:(TA0001)']);
+    });
+    it('builds a technique filter', () => {
+        const result = buildFilters([{ id: 'T1059', name: 'Command Scripting', kind: 'technique' }], []);
+        expect(result).toEqual(['threat.technique.id:(T1059)']);
+    });
+    it('OR-combines multiple tactics in one clause', () => {
+        const result = buildFilters([
+            { id: 'TA0001', name: 'Initial Access', kind: 'tactic' },
+            { id: 'TA0002', name: 'Execution', kind: 'tactic' }
+        ], []);
+        expect(result).toEqual(['threat.tactic.id:(TA0001 OR TA0002)']);
+    });
+    it('emits separate clauses for tactics and techniques', () => {
+        const result = buildFilters([
+            { id: 'TA0001', name: 'Initial Access', kind: 'tactic' },
+            { id: 'T1059', name: 'Command Scripting', kind: 'technique' }
+        ], []);
+        expect(result).toContain('threat.tactic.id:(TA0001)');
+        expect(result).toContain('threat.technique.id:(T1059)');
+        expect(result).toHaveLength(2);
+    });
+    it('builds an escalation filter', () => {
+        const result = buildFilters([], ['evidence', 'hit']);
+        expect(result).toEqual(['howler.escalation:(evidence OR hit)']);
+    });
+    it('combines mitre and escalation filters', () => {
+        const result = buildFilters([{ id: 'TA0001', name: 'Initial Access', kind: 'tactic' }], ['evidence']);
+        expect(result).toHaveLength(2);
+        expect(result).toContain('threat.tactic.id:(TA0001)');
+        expect(result).toContain('howler.escalation:(evidence)');
+    });
+});
+// ---------------------------------------------------------------------------
+// Component rendering tests
+// ---------------------------------------------------------------------------
+const mockDispatchApi = vi.fn();
+vi.mock('components/hooks/useMyApi', () => ({
+    default: () => ({ dispatchApi: mockDispatchApi })
+}));
+vi.mock('../hooks/useCase', () => ({
+    default: ({ case: c }) => ({ case: c, update: vi.fn(), loading: false, missing: false })
+}));
+vi.mock('react-router-dom', async () => {
+    const actual = await vi.importActual('react-router-dom');
+    return { ...actual, useOutletContext: () => undefined };
+});
+// Stub card components — their internals are irrelevant to timeline tests
+vi.mock('components/elements/hit/HitCard', () => ({
+    default: ({ id }) => _jsx("div", { children: `HitCard:${id}` })
+}));
+vi.mock('components/elements/observable/ObservableCard', () => ({
+    default: ({ id }) => _jsx("div", { children: `ObservableCard:${id}` })
+}));
+// Return the request object rather than a Promise so dispatchApi's first
+// argument is JSON-serialisable (JSON.stringify(Promise) === '{}').
+vi.mock('api', () => ({
+    default: {
+        v2: {
+            search: {
+                post: (_indexes, request) => request ?? {},
+                facet: {
+                    post: (_indexes, request) => request ?? {}
+                }
+            }
+        }
+    }
+}));
+const mockLoadRecords = vi.fn();
+const mockConfig = {
+    lookups: {
+        tactics: { TA0001: { key: 'TA0001', name: 'Initial Access', url: '' } },
+        techniques: { T1059: { key: 'T1059', name: 'Command Scripting', url: '' } }
+    }
+};
+const mockCase = {
+    case_id: 'case-001',
+    items: [
+        { type: 'hit', value: 'hit-1', path: 'hits/hit-1' },
+        { type: 'observable', value: 'obs-1', path: 'observables/obs-1' }
+    ]
+};
+const Wrapper = ({ children }) => (_jsx(ApiConfigContext.Provider, { value: { config: mockConfig, setConfig: vi.fn() }, children: _jsx(RecordContext.Provider, { value: { records: {}, loadRecords: mockLoadRecords }, children: _jsx(MemoryRouter, { initialEntries: ['/cases/case-001/timeline'], children: children }) }) }));
+const mockConfigWithUrls = {
+    lookups: {
+        tactics: { TA0001: { key: 'TA0001', name: 'Initial Access', url: 'https://attack.mitre.org/tactics/TA0001' } },
+        techniques: {
+            T1059: { key: 'T1059', name: 'Command Scripting', url: 'https://attack.mitre.org/techniques/T1059' }
+        }
+    }
+};
+const WrapperWithUrl = ({ children }) => (_jsx(ApiConfigContext.Provider, { value: { config: mockConfigWithUrls, setConfig: vi.fn() }, children: _jsx(RecordContext.Provider, { value: { records: {}, loadRecords: mockLoadRecords }, children: _jsx(MemoryRouter, { initialEntries: ['/cases/case-001/timeline'], children: children }) }) }));
+const CaseTimeline = (await import('./CaseTimeline')).default;
+// Reusable mock response factories
+const mockFacetResponse = {
+    'threat.tactic.id': { TA0001: 1 },
+    'threat.technique.id': { T1059: 1 },
+    'howler.escalation': { evidence: 2, hit: 1 }
+};
+const mockSearchResponse = (items = [
+    createMockHit({ howler: { id: 'hit-1' }, event: { created: '2024-01-01T00:00:00Z' } }),
+    createMockObservable({ howler: { id: 'obs-1' } })
+]) => ({ items, total: items.length, rows: items.length, offset: 0 });
+describe('CaseTimeline component', () => {
+    beforeEach(() => {
+        mockDispatchApi.mockClear();
+        mockLoadRecords.mockClear();
+    });
+    it('renders loading skeletons while the search is pending', () => {
+        mockDispatchApi.mockReturnValue(new Promise(() => { })); // never resolves
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        expect(document.querySelectorAll('.MuiSkeleton-root').length).toBeGreaterThan(0);
+    });
+    it('shows the empty state when no entries are returned', async () => {
+        mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse([]));
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText('page.cases.timeline.empty');
+    });
+    it('renders HitCard for hit entries and ObservableCard for observable entries', async () => {
+        mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse());
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        expect(await screen.findByText('HitCard:hit-1')).toBeTruthy();
+        expect(screen.getByText('ObservableCard:obs-1')).toBeTruthy();
+    });
+    it('renders the formatted event.created timestamp for hits', async () => {
+        mockDispatchApi
+            .mockResolvedValueOnce(mockFacetResponse)
+            .mockResolvedValueOnce(mockSearchResponse([createMockHit({ howler: { id: 'hit-1' }, event: { created: '2024-06-15T12:34:56Z' } })]));
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText(/2024-06-15/);
+    });
+    it('falls back to entry.timestamp when event.created is absent', async () => {
+        const entry = createMockHit({ howler: { id: 'hit-1' } });
+        entry.timestamp = '2024-03-10T08:00:00Z';
+        delete entry.event;
+        mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse([entry]));
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText(/2024-03-10/);
+    });
+    it('calls loadRecords with the search results', async () => {
+        const items = [createMockHit({ howler: { id: 'hit-1' } })];
+        mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse(items));
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText('HitCard:hit-1');
+        expect(mockLoadRecords).toHaveBeenCalledWith(items);
+    });
+    it('renders MITRE autocomplete with options derived from the facet response', async () => {
+        mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse());
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText('HitCard:hit-1');
+        expect(screen.getByRole('combobox', { name: /page.cases.timeline.filter.mitre/i })).toBeTruthy();
+    });
+    it('renders escalation autocomplete pre-populated with "evidence"', async () => {
+        mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse());
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText('HitCard:hit-1');
+        // "evidence" chip should be pre-selected as a tag
+        expect(screen.getByText('evidence')).toBeTruthy();
+    });
+    it('re-fetches with an escalation filter when a new escalation is selected', async () => {
+        mockDispatchApi
+            .mockResolvedValueOnce(mockFacetResponse)
+            .mockResolvedValueOnce(mockSearchResponse())
+            .mockResolvedValueOnce(mockSearchResponse());
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText('HitCard:hit-1');
+        const escalationInput = screen.getByRole('combobox', { name: /page.cases.timeline.filter.escalation/i });
+        await act(async () => {
+            await userEvent.click(escalationInput);
+        });
+        const option = await screen.findByRole('option', { name: /\bhit\b/i });
+        await act(async () => {
+            await userEvent.click(option);
+        });
+        // The third dispatchApi call should carry a filter containing "hit"
+        const thirdCallArgs = mockDispatchApi.mock.calls[2];
+        expect(JSON.stringify(thirdCallArgs[0])).toContain('hit');
+    });
+    it('re-fetches when a MITRE tactic is selected', async () => {
+        mockDispatchApi
+            .mockResolvedValueOnce(mockFacetResponse)
+            .mockResolvedValueOnce(mockSearchResponse())
+            .mockResolvedValueOnce(mockSearchResponse());
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText('HitCard:hit-1');
+        const mitreInput = screen.getByRole('combobox', { name: /page.cases.timeline.filter.mitre/i });
+        await act(async () => {
+            await userEvent.click(mitreInput);
+        });
+        const tacticOption = await screen.findByRole('option', { name: /TA0001/i });
+        await act(async () => {
+            await userEvent.click(tacticOption);
+        });
+        const thirdCallArgs = mockDispatchApi.mock.calls[2];
+        expect(JSON.stringify(thirdCallArgs[0])).toContain('TA0001');
+    });
+    it('passes the case item ids in the base query on every search call', async () => {
+        mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse());
+        render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+        await screen.findByText('HitCard:hit-1');
+        const searchCallArg = mockDispatchApi.mock.calls[1][0];
+        expect(JSON.stringify(searchCallArg)).toContain('hit-1');
+        expect(JSON.stringify(searchCallArg)).toContain('obs-1');
+    });
+    it('renders nothing when _case is not yet available', () => {
+        const emptyCaseWrapper = ({ children }) => createElement(ApiConfigContext.Provider, { value: { config: mockConfig, setConfig: vi.fn() }, children: null }, createElement(RecordContext.Provider, { value: { records: {}, loadRecords: mockLoadRecords }, children: null }, createElement(MemoryRouter, null, children)));
+        const { container } = render(_jsx(CaseTimeline, {}), { wrapper: emptyCaseWrapper });
+        expect(container.firstChild).toBeNull();
+    });
+    it('renders nothing and skips fetching when the case has no items', () => {
+        mockDispatchApi.mockResolvedValue({});
+        render(_jsx(CaseTimeline, { case: { case_id: 'empty', items: [] } }), { wrapper: Wrapper });
+        expect(mockDispatchApi).not.toHaveBeenCalled();
+    });
+    describe('tactic and technique inline entries', () => {
+        it('renders the technique ID link for a hit with threat.technique', async () => {
+            mockDispatchApi
+                .mockResolvedValueOnce(mockFacetResponse)
+                .mockResolvedValueOnce(mockSearchResponse([createMockHit({ howler: { id: 'hit-1' }, threat: { technique: { id: 'T1059' } } })]));
+            render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+            expect(await screen.findByText('T1059')).toBeTruthy();
+        });
+        it('renders the tactic ID link for a hit with threat.tactic', async () => {
+            mockDispatchApi
+                .mockResolvedValueOnce(mockFacetResponse)
+                .mockResolvedValueOnce(mockSearchResponse([createMockHit({ howler: { id: 'hit-1' }, threat: { tactic: { id: 'TA0001' } } })]));
+            render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+            expect(await screen.findByText('TA0001')).toBeTruthy();
+        });
+        it('renders both technique and tactic ID links when the entry has both threat fields', async () => {
+            mockDispatchApi.mockResolvedValueOnce(mockFacetResponse).mockResolvedValueOnce(mockSearchResponse([
+                createMockHit({
+                    howler: { id: 'hit-1' },
+                    threat: { technique: { id: 'T1059' }, tactic: { id: 'TA0001' } }
+                })
+            ]));
+            render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+            await screen.findByText('T1059');
+            expect(screen.getByText('TA0001')).toBeTruthy();
+        });
+        it('does not render tactic or technique links when threat data is absent', async () => {
+            mockDispatchApi
+                .mockResolvedValueOnce(mockFacetResponse)
+                .mockResolvedValueOnce(mockSearchResponse([createMockHit({ howler: { id: 'hit-1' } })]));
+            render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+            await screen.findByText('HitCard:hit-1');
+            expect(screen.queryByText('T1059')).toBeNull();
+            expect(screen.queryByText('TA0001')).toBeNull();
+        });
+        it('sets href on the technique link from config.lookups.techniques.url', async () => {
+            mockDispatchApi
+                .mockResolvedValueOnce(mockFacetResponse)
+                .mockResolvedValueOnce(mockSearchResponse([createMockHit({ howler: { id: 'hit-1' }, threat: { technique: { id: 'T1059' } } })]));
+            render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: WrapperWithUrl });
+            const link = await screen.findByText('T1059');
+            expect(link.getAttribute('href')).toBe('https://attack.mitre.org/techniques/T1059');
+        });
+        it('sets href on the tactic link from config.lookups.tactics.url', async () => {
+            mockDispatchApi
+                .mockResolvedValueOnce(mockFacetResponse)
+                .mockResolvedValueOnce(mockSearchResponse([createMockHit({ howler: { id: 'hit-1' }, threat: { tactic: { id: 'TA0001' } } })]));
+            render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: WrapperWithUrl });
+            const link = await screen.findByText('TA0001');
+            expect(link.getAttribute('href')).toBe('https://attack.mitre.org/tactics/TA0001');
+        });
+        describe('tooltip content', () => {
+            beforeEach(() => {
+                vi.useFakeTimers({ shouldAdvanceTime: true });
+            });
+            afterEach(() => {
+                vi.useRealTimers();
+            });
+            it('shows a tooltip with technique ID and name on hover', async () => {
+                mockDispatchApi
+                    .mockResolvedValueOnce(mockFacetResponse)
+                    .mockResolvedValueOnce(mockSearchResponse([createMockHit({ howler: { id: 'hit-1' }, threat: { technique: { id: 'T1059' } } })]));
+                render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+                const link = await screen.findByText('T1059');
+                await act(async () => {
+                    await userEvent.hover(link);
+                });
+                const tooltip = await screen.findByRole('tooltip');
+                expect(tooltip.textContent).toContain('T1059: Command Scripting');
+            });
+            it('shows a tooltip with tactic ID and name on hover', async () => {
+                mockDispatchApi
+                    .mockResolvedValueOnce(mockFacetResponse)
+                    .mockResolvedValueOnce(mockSearchResponse([createMockHit({ howler: { id: 'hit-1' }, threat: { tactic: { id: 'TA0001' } } })]));
+                render(_jsx(CaseTimeline, { case: mockCase }), { wrapper: Wrapper });
+                const link = await screen.findByText('TA0001');
+                await act(async () => {
+                    await userEvent.hover(link);
+                });
+                const tooltip = await screen.findByRole('tooltip');
+                expect(tooltip.textContent).toContain('TA0001: Initial Access');
+            });
+        });
+    });
+});

package/components/routes/cases/detail/CreateRuleDialog.d.ts

@@ -0,0 +1,9 @@
+import type { Rule } from '@cccsaurora/howler-ui/models/entities/generated/Rule';
+import { type FC } from 'react';
+interface CreateRuleDialogProps {
+    open: boolean;
+    onClose: () => void;
+    onSubmit: (ruleData: Partial<Rule>) => Promise<void>;
+}
+declare const CreateRuleDialog: FC<CreateRuleDialogProps>;
+export default CreateRuleDialog;