Skip to content

Commit e347562

Browse files
tomsonpltomsonpl
committed
[EDR workflows] Osquery serverless tests (#163795)
(cherry picked from commit 054cdba)
1 parent 7b1731d commit e347562

66 files changed

Lines changed: 1366 additions & 1384 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.buildkite/ftr_configs.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@ disabled:
3232
- x-pack/plugins/observability_onboarding/e2e/ftr_config_runner.ts
3333
- x-pack/plugins/observability_onboarding/e2e/ftr_config.ts
3434
- x-pack/test/osquery_cypress/cli_config.ts
35+
- x-pack/test/osquery_cypress/serverless_cli_config.ts
3536
- x-pack/test/osquery_cypress/config.ts
3637
- x-pack/test/osquery_cypress/visual_config.ts
3738
- x-pack/test/security_solution_cypress/cli_config.ts

‎.buildkite/pipelines/pull_request/osquery_cypress.yml‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,3 +22,17 @@ steps:
2222
soft_fail: true
2323
artifact_paths:
2424
- "target/kibana-osquery/**/*"
25+
26+
- command: .buildkite/scripts/steps/functional/security_serverless_osquery.sh
27+
label: 'Serverless Osquery Cypress Tests'
28+
agents:
29+
queue: n2-4-spot
30+
depends_on: build
31+
timeout_in_minutes: 50
32+
parallelism: 6
33+
retry:
34+
automatic:
35+
- exit_status: '*'
36+
limit: 1
37+
artifact_paths:
38+
- "target/kibana-osquery/**/*"

‎.buildkite/scripts/pipelines/pull_request/pipeline.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ import { execSync } from 'child_process';
1010
import fs from 'fs';
1111
import prConfigs from '../../../pull_requests.json';
1212
import { areChangesSkippable, doAnyChangesMatch } from '#pipeline-utils';
13+
1314
const prConfig = prConfigs.jobs.find((job) => job.pipelineSlug === 'kibana-pull-request');
1415

1516
if (!prConfig) {

‎.buildkite/scripts/steps/functional/security_serverless_osquery.sh‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/usr/bin/env bash
2+
3+
set -euo pipefail
4+
5+
source .buildkite/scripts/common/util.sh
6+
source .buildkite/scripts/steps/functional/common_cypress.sh
7+
8+
.buildkite/scripts/bootstrap.sh
9+
node scripts/build_kibana_platform_plugins.js
10+
11+
export JOB=kibana-osquery-cypress-serverless
12+
13+
echo "--- Security Osquery Serverless Cypress"
14+
15+
yarn --cwd x-pack/plugins/osquery cypress:serverless:run

‎x-pack/plugins/osquery/cypress.config.ts‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,19 @@
77

88
import { defineCypressConfig } from '@kbn/cypress-config';
99

10+
import path from 'path';
11+
import { safeLoad as loadYaml } from 'js-yaml';
12+
import { readFileSync } from 'fs';
13+
14+
import type { YamlRoleDefinitions } from '../../test_serverless/shared/lib';
15+
// eslint-disable-next-line @kbn/imports/no_boundary_crossing
16+
import { setupUserDataLoader } from '../../test_serverless/functional/test_suites/security/cypress/support/setup_data_loader_tasks';
17+
const ROLES_YAML_FILE_PATH = path.join(
18+
`${__dirname}/cypress/support`,
19+
'project_controller_osquery_roles.yml'
20+
);
21+
const roleDefinitions = loadYaml(readFileSync(ROLES_YAML_FILE_PATH, 'utf8')) as YamlRoleDefinitions;
22+
1023
export default defineCypressConfig({
1124
defaultCommandTimeout: 60000,
1225
execTimeout: 120000,
@@ -29,6 +42,9 @@ export default defineCypressConfig({
2942
'cypress-react-selector': {
3043
root: '#osquery-app',
3144
},
45+
grepFilterSpecs: true,
46+
grepTags: '@ess',
47+
grepOmitFiltered: true,
3248
},
3349

3450
e2e: {
@@ -37,5 +53,10 @@ export default defineCypressConfig({
3753
experimentalRunAllSpecs: true,
3854
experimentalMemoryManagement: true,
3955
numTestsKeptInMemory: 3,
56+
setupNodeEvents(on, config) {
57+
setupUserDataLoader(on, config, { roleDefinitions, additionalRoleName: 'viewer' });
58+
59+
return config;
60+
},
4061
},
4162
});

‎x-pack/plugins/osquery/cypress/e2e/all/add_integration.cy.ts‎

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
* 2.0.
66
*/
77

8+
import { tag } from '../../tags';
89
import {
910
cleanupPack,
1011
cleanupAgentPolicy,
@@ -28,11 +29,9 @@ import {
2829
interceptAgentPolicyId,
2930
policyContainsIntegration,
3031
} from '../../tasks/integrations';
31-
32-
import { login } from '../../tasks/login';
3332
import { findAndClickButton, findFormFieldByRowsLabelAndType } from '../../tasks/live_query';
3433

35-
describe('ALL - Add Integration', () => {
34+
describe('ALL - Add Integration', { tags: [tag.ESS, tag.BROKEN_IN_SERVERLESS] }, () => {
3635
let savedQueryId: string;
3736

3837
before(() => {
@@ -42,7 +41,7 @@ describe('ALL - Add Integration', () => {
4241
});
4342

4443
beforeEach(() => {
45-
login();
44+
cy.login('elastic');
4645
});
4746

4847
after(() => {
@@ -63,7 +62,7 @@ describe('ALL - Add Integration', () => {
6362
cy.get(`[url="${NAV_SEARCH_INPUT_OSQUERY_RESULTS.MANAGER}"]`).should('exist').click();
6463
});
6564

66-
describe('Add and upgrade integration', () => {
65+
describe('Add and upgrade integration', { tags: [tag.ESS] }, () => {
6766
const oldVersion = '0.7.4';
6867
const [integrationName, policyName] = generateRandomStringName(2);
6968
let policyId: string;
@@ -78,7 +77,7 @@ describe('ALL - Add Integration', () => {
7877
cleanupAgentPolicy(policyId);
7978
});
8079

81-
it('should add the old integration and be able to upgrade it', () => {
80+
it('should add the old integration and be able to upgrade it', { tags: tag.ESS }, () => {
8281
cy.visit(createOldOsqueryPath(oldVersion));
8382
addCustomIntegration(integrationName, policyName);
8483
policyContainsIntegration(integrationName, policyName);

‎x-pack/plugins/osquery/cypress/e2e/all/alerts_cases.cy.ts‎

Lines changed: 14 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
* 2.0.
66
*/
77

8+
import { LIVE_QUERY_EDITOR } from '../../screens/live_query';
89
import {
910
cleanupCase,
1011
cleanupPack,
@@ -14,17 +15,18 @@ import {
1415
loadRule,
1516
packFixture,
1617
} from '../../tasks/api_fixtures';
17-
import { ROLE, login } from '../../tasks/login';
1818
import {
1919
addToCase,
2020
checkActionItemsInResults,
21+
clickRuleName,
2122
loadRuleAlerts,
2223
submitQuery,
2324
viewRecentCaseAndCheckResults,
2425
} from '../../tasks/live_query';
2526
import { generateRandomStringName, interceptCaseId } from '../../tasks/integrations';
26-
27-
describe('Alert Event Details - Cases', () => {
27+
import { tag } from '../../tags';
28+
import { ServerlessRoleName } from '../../support/roles';
29+
describe('Alert Event Details - Cases', { tags: [tag.ESS, tag.SERVERLESS] }, () => {
2830
let ruleId: string;
2931
let ruleName: string;
3032
let packId: string;
@@ -44,9 +46,9 @@ describe('Alert Event Details - Cases', () => {
4446
});
4547

4648
beforeEach(() => {
47-
login(ROLE.soc_manager);
49+
cy.login(ServerlessRoleName.SOC_MANAGER);
4850
cy.visit('/app/security/rules');
49-
cy.contains(ruleName).click();
51+
clickRuleName(ruleName);
5052
});
5153

5254
after(() => {
@@ -72,10 +74,10 @@ describe('Alert Event Details - Cases', () => {
7274
cy.getBySel('expand-event').first().click({ force: true });
7375
cy.getBySel('take-action-dropdown-btn').click();
7476
cy.getBySel('osquery-action-item').click();
75-
cy.contains('Run a set of queries in a pack').wait(500).click();
76-
cy.getBySel('select-live-pack').within(() => {
77-
cy.getBySel('comboBoxInput').type(`${packName}{downArrow}{enter}`);
78-
});
77+
cy.contains(/^\d+ agen(t|ts) selected/);
78+
cy.contains('Run a set of queries in a pack').click();
79+
cy.get(LIVE_QUERY_EDITOR).should('not.exist');
80+
cy.getBySel('select-live-pack').click().type(`${packName}{downArrow}{enter}`);
7981
submitQuery();
8082
cy.get('[aria-label="Add to Case"]').first().click();
8183
cy.getBySel('cases-table-add-case-filter-bar').click();
@@ -91,7 +93,8 @@ describe('Alert Event Details - Cases', () => {
9193
});
9294
});
9395

94-
describe('Case', () => {
96+
// verify why calling new action doesnt add to response actions list
97+
describe.skip('Case', () => {
9598
let caseId: string;
9699

97100
before(() => {
@@ -134,6 +137,7 @@ describe('Alert Event Details - Cases', () => {
134137
cases: true,
135138
timeline: true,
136139
});
140+
137141
addToCase(caseId);
138142
viewRecentCaseAndCheckResults();
139143
});

‎x-pack/plugins/osquery/cypress/e2e/all/alerts_liked_apps.cy.ts‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,19 +7,21 @@
77

88
import { cleanupRule, loadRule } from '../../tasks/api_fixtures';
99
import { RESPONSE_ACTIONS_ITEM_0, RESPONSE_ACTIONS_ITEM_1 } from '../../tasks/response_actions';
10-
import { ROLE, login } from '../../tasks/login';
1110
import {
1211
checkActionItemsInResults,
12+
clickRuleName,
1313
inputQuery,
1414
loadRuleAlerts,
1515
submitQuery,
1616
} from '../../tasks/live_query';
1717
import { closeModalIfVisible, closeToastIfVisible } from '../../tasks/integrations';
1818
import { RESULTS_TABLE, RESULTS_TABLE_BUTTON } from '../../screens/live_query';
19+
import { tag } from '../../tags';
20+
import { ServerlessRoleName } from '../../support/roles';
1921

2022
const UUID_REGEX = '[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}';
2123

22-
describe('Alert Event Details', { browser: 'electron' }, () => {
24+
describe('Alert Event Details', { browser: 'electron', tags: [tag.ESS, tag.SERVERLESS] }, () => {
2325
let ruleId: string;
2426
let ruleName: string;
2527

@@ -36,9 +38,9 @@ describe('Alert Event Details', { browser: 'electron' }, () => {
3638
});
3739

3840
beforeEach(() => {
39-
login(ROLE.soc_manager);
41+
cy.login(ServerlessRoleName.SOC_MANAGER);
4042
cy.visit('/app/security/rules');
41-
cy.contains(ruleName).click();
43+
clickRuleName(ruleName);
4244
});
4345

4446
it('should be able to add investigation guides to response actions', () => {
@@ -98,7 +100,7 @@ describe('Alert Event Details', { browser: 'electron' }, () => {
98100
closeModalIfVisible();
99101
});
100102

101-
it('can visit discover from response action results', () => {
103+
it('can visit discover from response action results', { tags: [tag.ESS] }, () => {
102104
const discoverRegex = new RegExp(`action_id: ${UUID_REGEX}`);
103105
cy.getBySel('expand-event').first().click();
104106
cy.getBySel('securitySolutionDocumentDetailsFlyoutResponseSectionHeader').click();
@@ -124,7 +126,7 @@ describe('Alert Event Details', { browser: 'electron' }, () => {
124126
});
125127
});
126128

127-
it('can visit lens from response action results', () => {
129+
it('can visit lens from response action results', { tags: [tag.ESS] }, () => {
128130
const lensRegex = new RegExp(`Action ${UUID_REGEX} results`);
129131
cy.getBySel('expand-event').first().click();
130132
cy.getBySel('securitySolutionDocumentDetailsFlyoutResponseSectionHeader').click();
@@ -158,7 +160,7 @@ describe('Alert Event Details', { browser: 'electron' }, () => {
158160
cy.getBySel('breadcrumbs').contains(lensRegex);
159161
});
160162

161-
it('can add to timeline from response action results', () => {
163+
it('can add to timeline from response action results', { tags: [tag.ESS] }, () => {
162164
const timelineRegex = new RegExp(`Added ${UUID_REGEX} to timeline`);
163165
const filterRegex = new RegExp(`action_id: "${UUID_REGEX}"`);
164166
cy.getBySel('expand-event').first().click();

‎x-pack/plugins/osquery/cypress/e2e/all/alerts_multiple_agents.cy.ts‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,16 +5,18 @@
55
* 2.0.
66
*/
77

8+
import { tag } from '../../tags';
89
import { cleanupRule, loadRule } from '../../tasks/api_fixtures';
9-
import { ROLE, login } from '../../tasks/login';
1010
import {
11+
clickRuleName,
1112
inputQuery,
1213
loadRuleAlerts,
1314
submitQuery,
1415
takeOsqueryActionWithParams,
1516
} from '../../tasks/live_query';
17+
import { ServerlessRoleName } from '../../support/roles';
1618

17-
describe('Alert Event Details - dynamic params', () => {
19+
describe('Alert Event Details - dynamic params', { tags: [tag.ESS, tag.SERVERLESS] }, () => {
1820
let ruleId: string;
1921
let ruleName: string;
2022

@@ -31,9 +33,9 @@ describe('Alert Event Details - dynamic params', () => {
3133
});
3234

3335
beforeEach(() => {
34-
login(ROLE.soc_manager);
36+
cy.login(ServerlessRoleName.SOC_MANAGER);
3537
cy.visit('/app/security/rules');
36-
cy.contains(ruleName).click();
38+
clickRuleName(ruleName);
3739
});
3840

3941
it('should substitute parameters in investigation guide', () => {

0 commit comments

Comments
 (0)