tests for detection engine get/put utils

elastic · Nov 11, 2019 · c555d0f · c555d0f
1 parent d86b6c7
commit c555d0f
Show file tree

Hide file tree

Showing 5 changed files with 527 additions and 4 deletions.
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/__mocks__/es_results.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/__mocks__/es_results.ts
@@ -0,0 +1,93 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { SignalSourceHit, SignalSearchResponse, SignalAlertParams, BulkResponse } from '../types';
+
+export const sampleSignalAlertParams = (): SignalAlertParams => ({
+  id: 'rule-1',
+  description: 'Detecting root and admin users',
+  index: ['auditbeat-*', 'filebeat-*', 'packetbeat-*', 'winlogbeat-*'],
+  interval: '5m',
+  name: 'Detect Root/Admin Users',
+  type: 'query',
+  from: 'now-6m',
+  to: 'now',
+  severity: 'high',
+  query: 'user.name: root or user.name: admin',
+  language: 'kuery',
+  references: ['http://google.com'],
+  maxSignals: 100,
+  enabled: true,
+  filter: undefined,
+  filters: undefined,
+  savedId: undefined,
+  size: undefined,
+});
+
+export const sampleDocNoSortId: SignalSourceHit = {
+  _index: 'myFakeSignalIndex',
+  _type: 'doc',
+  _score: 100,
+  _version: 1,
+  _id: 'someFakeId',
+  _source: {
+    someKey: 'someValue',
+    '@timestamp': 'someTimeStamp',
+  },
+};
+
+export const sampleDocWithSortId: SignalSourceHit = {
+  _index: 'myFakeSignalIndex',
+  _type: 'doc',
+  _score: 100,
+  _version: 1,
+  _id: 'someFakeId',
+  _source: {
+    someKey: 'someValue',
+    '@timestamp': 'someTimeStamp',
+  },
+  sort: ['1234567891111'],
+};
+
+export const sampleDocSearchResultsNoSortId: SignalSearchResponse = {
+  took: 10,
+  timed_out: false,
+  _shards: {
+    total: 10,
+    successful: 10,
+    failed: 0,
+    skipped: 0,
+  },
+  hits: {
+    total: 100,
+    max_score: 100,
+    hits: [
+      {
+        ...sampleDocNoSortId,
+      },
+    ],
+  },
+};
+
+export const sampleDocSearchResultsWithSortId: SignalSearchResponse = {
+  took: 10,
+  timed_out: false,
+  _shards: {
+    total: 10,
+    successful: 10,
+    failed: 0,
+    skipped: 0,
+  },
+  hits: {
+    total: 1,
+    max_score: 100,
+    hits: [
+      {
+        ...sampleDocWithSortId,
+      },
+    ],
+  },
+};
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/build_events_query.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/build_events_query.test.ts
@@ -147,4 +147,148 @@ describe('create_signals', () => {
       },
     });
   });
+  test('if searchAfterSortId is a valid sortId string', () => {
+    const fakeSortId = '123456789012';
+    const query = buildEventsSearchQuery({
+      index: ['auditbeat-*'],
+      from: 'now-5m',
+      to: 'today',
+      filter: {},
+      size: 100,
+      searchAfterSortId: fakeSortId,
+    });
+    expect(query).toEqual({
+      allowNoIndices: true,
+      index: ['auditbeat-*'],
+      size: 100,
+      ignoreUnavailable: true,
+      body: {
+        query: {
+          bool: {
+            filter: [
+              {},
+              {
+                bool: {
+                  filter: [
+                    {
+                      bool: {
+                        should: [
+                          {
+                            range: {
+                              '@timestamp': {
+                                gte: 'now-5m',
+                              },
+                            },
+                          },
+                        ],
+                        minimum_should_match: 1,
+                      },
+                    },
+                    {
+                      bool: {
+                        should: [
+                          {
+                            range: {
+                              '@timestamp': {
+                                lte: 'today',
+                              },
+                            },
+                          },
+                        ],
+                        minimum_should_match: 1,
+                      },
+                    },
+                  ],
+                },
+              },
+              {
+                match_all: {},
+              },
+            ],
+          },
+        },
+        track_total_hits: true,
+        sort: [
+          {
+            '@timestamp': {
+              order: 'asc',
+            },
+          },
+        ],
+        search_after: [fakeSortId],
+      },
+    });
+  });
+  test('if searchAfterSortId is a valid sortId number', () => {
+    const fakeSortIdNumber = 123456789012;
+    const query = buildEventsSearchQuery({
+      index: ['auditbeat-*'],
+      from: 'now-5m',
+      to: 'today',
+      filter: {},
+      size: 100,
+      searchAfterSortId: fakeSortIdNumber,
+    });
+    expect(query).toEqual({
+      allowNoIndices: true,
+      index: ['auditbeat-*'],
+      size: 100,
+      ignoreUnavailable: true,
+      body: {
+        query: {
+          bool: {
+            filter: [
+              {},
+              {
+                bool: {
+                  filter: [
+                    {
+                      bool: {
+                        should: [
+                          {
+                            range: {
+                              '@timestamp': {
+                                gte: 'now-5m',
+                              },
+                            },
+                          },
+                        ],
+                        minimum_should_match: 1,
+                      },
+                    },
+                    {
+                      bool: {
+                        should: [
+                          {
+                            range: {
+                              '@timestamp': {
+                                lte: 'today',
+                              },
+                            },
+                          },
+                        ],
+                        minimum_should_match: 1,
+                      },
+                    },
+                  ],
+                },
+              },
+              {
+                match_all: {},
+              },
+            ],
+          },
+        },
+        track_total_hits: true,
+        sort: [
+          {
+            '@timestamp': {
+              order: 'asc',
+            },
+          },
+        ],
+        search_after: [fakeSortIdNumber],
+      },
+    });
+  });
 });
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/build_events_query.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/alerts/build_events_query.ts
@@ -10,7 +10,7 @@ interface BuildEventsSearchQuery {
   to: string;
   filter: unknown;
   size: number;
-  searchAfterSortId?: string;
+  searchAfterSortId?: string | number;
 }
 
 export const buildEventsSearchQuery = ({