Skip to content

Commit 2a07837

Browse files
elasticmachineelasticmachine
authored
Merge branch 'master' into feat/siem-untitled-timeline
2 parents d92c871 + 42d2443 commit 2a07837

3 files changed

Lines changed: 61 additions & 13 deletions

File tree

‎x-pack/plugins/endpoint/common/generate_data.test.ts‎

Lines changed: 24 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -101,20 +101,38 @@ describe('data generator', () => {
101101
});
102102

103103
it('with n-1 process events', () => {
104-
for (let i = 1; i < events.length - 1; i++) {
105-
expect(events[i].process.parent?.entity_id).toEqual(events[i - 1].process.entity_id);
106-
expect(events[i].event.kind).toEqual('event');
107-
expect(events[i].event.category).toEqual('process');
104+
for (let i = events.length - 2; i > 0; ) {
105+
const parentEntityIdOfChild = events[i].process.parent?.entity_id;
106+
for (
107+
;
108+
--i >= -1 && (events[i].event.kind !== 'event' || events[i].event.category !== 'process');
109+
110+
) {
111+
// related event - skip it
112+
}
113+
expect(i).toBeGreaterThanOrEqual(0);
114+
expect(parentEntityIdOfChild).toEqual(events[i].process.entity_id);
108115
}
109116
});
110117

111118
it('with a corresponding alert at the end', () => {
119+
let previousProcessEventIndex = events.length - 2;
120+
for (
121+
;
122+
previousProcessEventIndex >= -1 &&
123+
(events[previousProcessEventIndex].event.kind !== 'event' ||
124+
events[previousProcessEventIndex].event.category !== 'process');
125+
previousProcessEventIndex--
126+
) {
127+
// related event - skip it
128+
}
129+
expect(previousProcessEventIndex).toBeGreaterThanOrEqual(0);
112130
// The alert should be last and have the same entity_id as the previous process event
113131
expect(events[events.length - 1].process.entity_id).toEqual(
114-
events[events.length - 2].process.entity_id
132+
events[previousProcessEventIndex].process.entity_id
115133
);
116134
expect(events[events.length - 1].process.parent?.entity_id).toEqual(
117-
events[events.length - 2].process.parent?.entity_id
135+
events[previousProcessEventIndex].process.parent?.entity_id
118136
);
119137
expect(events[events.length - 1].event.kind).toEqual('alert');
120138
expect(events[events.length - 1].event.category).toEqual('malware');

‎x-pack/plugins/endpoint/common/generate_data.ts‎

Lines changed: 34 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -339,13 +339,17 @@ export class EndpointDocGenerator {
339339
percentNodesWithRelated?: number,
340340
percentChildrenTerminated?: number
341341
) {
342-
const ancestry = this.createAlertEventAncestry(alertAncestors);
342+
const ancestry = this.createAlertEventAncestry(
343+
alertAncestors,
344+
relatedEventsPerNode,
345+
percentNodesWithRelated
346+
);
343347
for (let i = 0; i < ancestry.length; i++) {
344348
yield ancestry[i];
345349
}
346-
// ancestry will always have at least 2 elements, and the second to last element will be the process associated with the alert
350+
// ancestry will always have at least 2 elements, and the last element will be the alert
347351
yield* this.descendantsTreeGenerator(
348-
ancestry[ancestry.length - 2],
352+
ancestry[ancestry.length - 1],
349353
childGenerations,
350354
maxChildrenPerNode,
351355
relatedEventsPerNode,
@@ -358,18 +362,44 @@ export class EndpointDocGenerator {
358362
* Creates an alert event and associated process ancestry. The alert event will always be the last event in the return array.
359363
* @param alertAncestors - number of ancestor generations to create
360364
*/
361-
public createAlertEventAncestry(alertAncestors = 3): Event[] {
365+
public createAlertEventAncestry(
366+
alertAncestors = 3,
367+
relatedEventsPerNode = 5,
368+
pctWithRelated = 30
369+
): Event[] {
362370
const events = [];
363371
const startDate = new Date().getTime();
364372
const root = this.generateEvent({ timestamp: startDate + 1000 });
365373
events.push(root);
366374
let ancestor = root;
375+
// generate related alerts for root
376+
const processDuration: number = 6 * 3600;
377+
if (this.randomN(100) < pctWithRelated) {
378+
for (const relatedEvent of this.relatedEventsGenerator(
379+
ancestor,
380+
relatedEventsPerNode,
381+
processDuration
382+
)) {
383+
events.push(relatedEvent);
384+
}
385+
}
367386
for (let i = 0; i < alertAncestors; i++) {
368387
ancestor = this.generateEvent({
369388
timestamp: startDate + 1000 * (i + 1),
370389
parentEntityID: ancestor.process.entity_id,
371390
});
372391
events.push(ancestor);
392+
393+
// generate related alerts for ancestor
394+
if (this.randomN(100) < pctWithRelated) {
395+
for (const relatedEvent of this.relatedEventsGenerator(
396+
ancestor,
397+
relatedEventsPerNode,
398+
processDuration
399+
)) {
400+
events.push(relatedEvent);
401+
}
402+
}
373403
}
374404
events.push(
375405
this.generateAlert(

‎x-pack/test/functional/apps/machine_learning/anomaly_detection/single_metric_job.ts‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,8 @@ export default function({ getService }: FtrProviderContext) {
7171

7272
const calendarId = `wizard-test-calendar_${Date.now()}`;
7373

74-
describe('single metric', function() {
74+
// Breaking latest ES snapshots: https://github.com/elastic/kibana/issues/65377
75+
describe.skip('single metric', function() {
7576
this.tags(['mlqa']);
7677
before(async () => {
7778
await esArchiver.loadIfNeeded('ml/farequote');
@@ -325,8 +326,7 @@ export default function({ getService }: FtrProviderContext) {
325326
await ml.jobWizardCommon.advanceToValidationSection();
326327
});
327328

328-
// https://github.com/elastic/kibana/issues/65377
329-
it.skip('job cloning displays the summary step', async () => {
329+
it('job cloning displays the summary step', async () => {
330330
await ml.jobWizardCommon.advanceToSummarySection();
331331
});
332332

0 commit comments

Comments
 (0)