Skip to content

Commit e335205

Browse files
MadameSheemakibanamachine
MadameSheema
and
kibanamachine
authored
[Security Solution] [Detections] Improves custom query rule upgrade test (#114454) (#114801)
* improves upgrade test * fixes type check issues Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com> Co-authored-by: Kibana Machine <42973632+kibanamachine@users.noreply.github.com>
1 parent 0e3853a commit e335205

4 files changed

Lines changed: 142 additions & 18 deletions

File tree

‎x-pack/plugins/security_solution/cypress/screens/alerts_detection_rules.ts‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -103,3 +103,7 @@ export const RULES_DELETE_CONFIRMATION_MODAL = '[data-test-subj="allRulesDeleteC
103103
export const MODAL_CONFIRMATION_BTN = '[data-test-subj="confirmModalConfirmButton"]';
104104

105105
export const RULE_DETAILS_DELETE_BTN = '[data-test-subj="rules-details-delete-rule"]';
106+
107+
export const ALERT_DETAILS_CELLS = '[data-test-subj="dataGridRowCell"]';
108+
109+
export const SERVER_SIDE_EVENT_COUNT = '[data-test-subj="server-side-event-count"]';

‎x-pack/plugins/security_solution/cypress/tasks/common.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@
77

88
import { esArchiverResetKibana } from './es_archiver';
99
import { RuleEcs } from '../../common/ecs/rule';
10+
import { LOADING_INDICATOR } from '../screens/security_header';
1011

1112
const primaryButton = 0;
1213

@@ -155,3 +156,8 @@ export const deleteCases = () => {
155156
};
156157

157158
export const scrollToBottom = () => cy.scrollTo('bottom');
159+
160+
export const waitForPageToBeLoaded = () => {
161+
cy.get(LOADING_INDICATOR).should('exist');
162+
cy.get(LOADING_INDICATOR).should('not.exist');
163+
};

‎x-pack/plugins/security_solution/cypress/upgrade_integration/custom_query_rule.spec.ts‎

Lines changed: 131 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -5,25 +5,138 @@
55
* 2.0.
66
*/
77

8-
import { RULE_NAME } from '../screens/alerts_detection_rules';
9-
8+
import { ALERT_DETAILS_CELLS, SERVER_SIDE_EVENT_COUNT } from '../screens/alerts_detection_rules';
109
import {
11-
goToManageAlertsDetectionRules,
12-
waitForAlertsIndexToBeCreated,
13-
waitForAlertsPanelToBeLoaded,
14-
} from '../tasks/alerts';
15-
import { waitForRulesTableToBeLoaded } from '../tasks/alerts_detection_rules';
16-
import { loginAndWaitForPageWithoutDateRange } from '../tasks/login';
17-
18-
import { ALERTS_URL } from '../urls/navigation';
19-
20-
describe('After an upgrade, the cusom query rule', () => {
21-
it('Displays the rule', function () {
22-
loginAndWaitForPageWithoutDateRange(ALERTS_URL);
23-
waitForAlertsPanelToBeLoaded();
24-
waitForAlertsIndexToBeCreated();
25-
goToManageAlertsDetectionRules();
10+
ADDITIONAL_LOOK_BACK_DETAILS,
11+
ABOUT_DETAILS,
12+
ABOUT_RULE_DESCRIPTION,
13+
CUSTOM_QUERY_DETAILS,
14+
DEFINITION_DETAILS,
15+
getDetails,
16+
INDEX_PATTERNS_DETAILS,
17+
RISK_SCORE_DETAILS,
18+
RULE_NAME_HEADER,
19+
RULE_TYPE_DETAILS,
20+
RUNS_EVERY_DETAILS,
21+
SCHEDULE_DETAILS,
22+
SEVERITY_DETAILS,
23+
TIMELINE_TEMPLATE_DETAILS,
24+
} from '../screens/rule_details';
25+
26+
import { waitForPageToBeLoaded } from '../tasks/common';
27+
import { waitForRulesTableToBeLoaded, goToRuleDetails } from '../tasks/alerts_detection_rules';
28+
import { loginAndWaitForPage } from '../tasks/login';
29+
30+
import { DETECTIONS_RULE_MANAGEMENT_URL } from '../urls/navigation';
31+
32+
const EXPECTED_NUMBER_OF_ALERTS = '1';
33+
34+
const alert = {
35+
rule: 'Custom query rule for upgrade',
36+
severity: 'low',
37+
riskScore: '7',
38+
reason:
39+
'file event with process test, file The file to test, by Security Solution on security-solution.local created low alert Custom query rule for upgrade.',
40+
hostName: 'security-solution.local',
41+
username: 'test',
42+
processName: 'The file to test',
43+
fileName: 'The file to test',
44+
sourceIp: '127.0.0.1',
45+
destinationIp: '127.0.0.2',
46+
};
47+
48+
const rule = {
49+
customQuery: '*:*',
50+
name: 'Custom query rule for upgrade',
51+
description: 'My description',
52+
index: ['auditbeat-*'],
53+
severity: 'Low',
54+
riskScore: '7',
55+
timelineTemplate: 'none',
56+
runsEvery: '10s',
57+
lookBack: '179999990s',
58+
timeline: 'None',
59+
};
60+
61+
describe('After an upgrade, the custom query rule', () => {
62+
before(() => {
63+
loginAndWaitForPage(DETECTIONS_RULE_MANAGEMENT_URL);
2664
waitForRulesTableToBeLoaded();
27-
cy.get(RULE_NAME).should('have.text', 'Custom query rule for upgrade');
65+
goToRuleDetails();
66+
waitForPageToBeLoaded();
67+
});
68+
69+
it('Has the expected alerts number', () => {
70+
cy.get(SERVER_SIDE_EVENT_COUNT).contains(EXPECTED_NUMBER_OF_ALERTS);
71+
});
72+
73+
it('Displays the rule details', () => {
74+
cy.get(RULE_NAME_HEADER).should('contain', `${rule.name}`);
75+
cy.get(ABOUT_RULE_DESCRIPTION).should('have.text', rule.description);
76+
cy.get(ABOUT_DETAILS).within(() => {
77+
getDetails(SEVERITY_DETAILS).should('have.text', rule.severity);
78+
getDetails(RISK_SCORE_DETAILS).should('have.text', rule.riskScore);
79+
});
80+
cy.get(DEFINITION_DETAILS).within(() => {
81+
getDetails(INDEX_PATTERNS_DETAILS).should('have.text', rule.index.join(''));
82+
getDetails(CUSTOM_QUERY_DETAILS).should('have.text', rule.customQuery);
83+
getDetails(RULE_TYPE_DETAILS).should('have.text', 'Query');
84+
getDetails(TIMELINE_TEMPLATE_DETAILS).should('have.text', rule.timeline);
85+
});
86+
cy.get(SCHEDULE_DETAILS).within(() => {
87+
getDetails(RUNS_EVERY_DETAILS).should('have.text', rule.runsEvery);
88+
getDetails(ADDITIONAL_LOOK_BACK_DETAILS).should('have.text', rule.lookBack);
89+
});
90+
});
91+
92+
it('Displays the alert details', () => {
93+
cy.get(ALERT_DETAILS_CELLS).first().focus();
94+
cy.get(ALERT_DETAILS_CELLS).first().type('{rightarrow}');
95+
cy.get(ALERT_DETAILS_CELLS)
96+
.contains(alert.rule)
97+
.then(($el) => {
98+
cy.wrap($el).type('{rightarrow}');
99+
});
100+
cy.get(ALERT_DETAILS_CELLS)
101+
.contains(alert.severity)
102+
.then(($el) => {
103+
cy.wrap($el).type('{rightarrow}');
104+
});
105+
cy.get(ALERT_DETAILS_CELLS)
106+
.contains(alert.riskScore)
107+
.then(($el) => {
108+
cy.wrap($el).type('{rightarrow}');
109+
});
110+
cy.get(ALERT_DETAILS_CELLS)
111+
.contains(alert.reason)
112+
.then(($el) => {
113+
cy.wrap($el).type('{rightarrow}');
114+
});
115+
cy.get(ALERT_DETAILS_CELLS)
116+
.contains(alert.hostName)
117+
.then(($el) => {
118+
cy.wrap($el).type('{rightarrow}');
119+
});
120+
cy.get(ALERT_DETAILS_CELLS)
121+
.contains(alert.username)
122+
.then(($el) => {
123+
cy.wrap($el).type('{rightarrow}');
124+
});
125+
cy.get(ALERT_DETAILS_CELLS)
126+
.contains(alert.processName)
127+
.then(($el) => {
128+
cy.wrap($el).type('{rightarrow}');
129+
});
130+
cy.get(ALERT_DETAILS_CELLS)
131+
.contains(alert.fileName)
132+
.then(($el) => {
133+
cy.wrap($el).type('{rightarrow}');
134+
});
135+
cy.get(ALERT_DETAILS_CELLS)
136+
.contains(alert.sourceIp)
137+
.then(($el) => {
138+
cy.wrap($el).type('{rightarrow}');
139+
});
140+
cy.get(ALERT_DETAILS_CELLS).contains(alert.destinationIp);
28141
});
29142
});

‎x-pack/plugins/security_solution/package.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
"cypress:open": "yarn cypress open --config-file ./cypress/cypress.json",
1212
"cypress:open:ccs": "yarn cypress:open --config integrationFolder=./cypress/ccs_integration",
1313
"cypress:open-as-ci": "node ../../../scripts/functional_tests --config ../../test/security_solution_cypress/visual_config.ts",
14+
"cypress:open:upgrade": "yarn cypress:open --config integrationFolder=./cypress/upgrade_integration",
1415
"cypress:run": "yarn cypress:run:reporter --browser chrome --spec './cypress/integration/**/*.spec.ts'; status=$?; yarn junit:merge && exit $status",
1516
"cypress:run:firefox": "yarn cypress:run:reporter --browser firefox --spec './cypress/integration/**/*.spec.ts'; status=$?; yarn junit:merge && exit $status",
1617
"cypress:run:reporter": "yarn cypress run --config-file ./cypress/cypress.json --reporter ../../../node_modules/cypress-multi-reporters --reporter-options configFile=./cypress/reporter_config.json",

0 commit comments

Comments
 (0)