[Security Solution][Detections] Improves indicator match Cypress tests #94913

MadameSheema · 2021-03-18T13:09:18Z

Summary

In this PR we are extending the current Indicator Match rules cypress tests:

Using filebeat threat intel data
Adding a test to check the enriched fields are correctly displayed on the timeline
Adding a test to check the enrichment is properly displayed on the json view

Pending to add a test to test the investigate on timeline as soon as the following bug is fixed: #95095

rylnd · 2021-03-18T21:56:11Z

x-pack/plugins/security_solution/cypress/objects/rule.ts

-  indicatorMapping: 'agent.id',
-  indicatorIndexField: 'agent.threat',
+  indicatorIndexPattern: ['filebeat-*'],
+  indicatorMapping: 'myhash.mysha256',


I realize this isn't a new field, but the data structure we're using here conflicts with the terminology in the application: a mapping contains a "field" and a "value", which here correspond to `indicatorMapping" and "indicatorIndexField", respectively

I assume that the disconnect between cypress' typings and the actual application typings is expected/desired, but I wanted to call this out as a potential source of confusion moving forward.

rylnd · 2021-03-18T22:02:11Z

x-pack/test/security_solution_cypress/es_archives/threat_data/data.json

+  "type": "doc",
+  "value": {
+    "id": "_eZE7mwBOpWiDweStB_c",
+    "index": "threat-data-001",


threat-data is not very descriptive, especially when paired with threat_indicator. Perhaps we could call this suspicious_source_events or something like that?

rylnd · 2021-03-18T22:42:01Z

x-pack/plugins/security_solution/cypress/screens/alerts_details.ts

+
+export const JSON_CONTENT = '.ace_content';
+
+export const JSON_VIEW_TAB = '#json-view';


We should be able to add data-test-subjs for these tabs, but it looks like it would have to go into the tab's contents.

rylnd · 2021-03-18T22:44:57Z

x-pack/test/security_solution_cypress/es_archives/threat_indicator/data.json

-    "id": "_uZE6nwBOpWiDweSth_D",
-    "index": "threat-indicator-0001",
+    "id": "84cf452c1e0375c3d4412cb550bd1783358468a3b3b777da4829d72c7d6fb74f",
+    "index": "filebeat-7.12.0-2021.03.10-000001",


The mappings for this index is currently 25k LOC; I think you can copy/paste/slightly modify the FTR mappings to reduce that file by two orders of magnitude 😉

MadameSheema · 2021-03-24T09:20:08Z

@elasticmachine merge upstream

…bana into improves-indicator-match

elasticmachine · 2021-03-24T19:12:29Z

Pinging @elastic/security-solution (Team: SecuritySolution)

elasticmachine · 2021-03-24T19:12:30Z

Pinging @elastic/security-detections-response (Team:Detections and Resp)

kibanamachine · 2021-03-24T19:29:07Z

💚 Build Succeeded

Metrics [docs]

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	7.2MB	7.2MB	+31.0B

History

💔 Build #114902 failed d8da4a387b3ea47fd5652899359a517205a74536
💔 Build #114835 failed e48abe2
💔 Build #114818 failed 0657f03
💔 Build #114054 failed 3a801df
💔 Build #114000 failed 6613141

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

cc @MadameSheema

rylnd

Mostly style questions here, nothing that should block this from getting merged since it's now green! 🍏 📗 💚

I would really like to try and keep the mappings as minimal as possible for these archives, but we can do that in a followup if need be; better to have the coverage now.

rylnd · 2021-03-24T19:36:53Z

...k/plugins/security_solution/cypress/integration/detection_rules/indicator_match_rule.spec.ts

+      const expectedEnrichment = [
+        { line: 4, text: '  "threat": {' },


Nit: this is an array so the subsequent .forEach reads a little odd.

Suggested change

const expectedEnrichment = [

{ line: 4, text: ' "threat": {' },

const expectedJsonViewRows = [

{ index: 4, text: ' "threat": {' },

rylnd · 2021-03-24T19:58:02Z

x-pack/plugins/security_solution/cypress/tasks/alerts_details.ts

+
+export const scrollJsonViewToBottom = () => {
+  cy.get(JSON_CONTENT).click({ force: true });
+  cy.get(JSON_CONTENT).type('{pagedown}{pagedown}{pagedown}');


Interesting! Are there no prebuilt scroll helpers in cypress that would work here?

There is but does not work with that concrete element (I don't know why)

rylnd · 2021-03-24T20:03:24Z

x-pack/plugins/security_solution/cypress/tasks/fields_browser.ts

 } from '../screens/fields_browser';
-import { KQL_SEARCH_BAR } from '../screens/hosts/main';
+
+export const addsFields = (fields: string[]) => {


Nit: the tense on these helpers is a little strange; most of these use imperative tense ("add", "remove", "delete"), but several in this file use simple present tense ("adds"). Not the end of the world, just a discrepancy that gave me pause while reviewing.

rylnd · 2021-03-25T17:07:31Z

x-pack/plugins/security_solution/cypress/screens/rule_details.ts

@@ -92,6 +95,10 @@ export const TIMELINE_TEMPLATE_DETAILS = 'Timeline template';

 export const TIMESTAMP_OVERRIDE_DETAILS = 'Timestamp override';

+export const TIMELINE_FIELD = (field: string) => {


Do we have any standards/guidelines for when to use all caps vs when to use camel case, here? I had assumed that functions would use camelcase as in getDetails below.

rylnd · 2021-03-25T17:07:56Z

x-pack/test/security_solution_cypress/es_archives/threat_indicator/data.json

+      "fileset": {
+        "name": "abusemalware"
+      },
+      "threatintel": {


rylnd · 2021-03-25T17:11:19Z

x-pack/test/security_solution_cypress/es_archives/threat_indicator/mappings.json

      "properties": {
        "@timestamp": {
          "type": "date"
        },
        "agent": {
          "properties": {
+            "build": {


Do we want to trim this down further to only the fields that we're using in the accompanying data.json ? I thought that was the consensus but maybe I misunderstood.

MadameSheema · 2021-03-25T18:25:43Z

Thanks for the review @rylnd I'll merge it to have coverage as soon as possible and we can do all the mentioned changes in a future PR.

elastic#94913) * updates the data used in the test * adds matches test * adds enrichment test * improves speed and adds missing files * fixes type check issue * adds 'data-test-subj' for the json view tab * refactor * fixes typecheck issue * updates tests with latest master changes Co-authored-by: Kibana Machine <[email protected]>

#94913) (#95449) * updates the data used in the test * adds matches test * adds enrichment test * improves speed and adds missing files * fixes type check issue * adds 'data-test-subj' for the json view tab * refactor * fixes typecheck issue * updates tests with latest master changes Co-authored-by: Kibana Machine <[email protected]> Co-authored-by: Kibana Machine <[email protected]>

MadameSheema added 5 commits March 10, 2021 16:55

updates the data used in the test

9a9402a

adds matches test

bff66fa

adds enrichment test

6613141

improves speed and adds missing files

65314c2

fixes type check issue

3a801df

rylnd reviewed Mar 18, 2021

View reviewed changes

MadameSheema added 2 commits March 23, 2021 16:40

adds 'data-test-subj' for the json view tab

4ca82cf

refactor

5b127f3

kibanamachine and others added 4 commits March 24, 2021 05:20

Merge branch 'master' into improves-indicator-match

0657f03

fixes typecheck issue

88c6c2d

Merge branch 'improves-indicator-match' of github.com:MadameSheema/ki…

e48abe2

…bana into improves-indicator-match

updates tests with latest master changes

9e7968b

MadameSheema force-pushed the improves-indicator-match branch from d8da4a3 to 9e7968b Compare March 24, 2021 17:21

MadameSheema changed the title ~~Improves indicator match Cypress tests~~ [Security Solution][Detections] Improves indicator match Cypress tests Mar 24, 2021

MadameSheema requested review from ecezalp and FrankHassanabad March 24, 2021 19:11

MadameSheema self-assigned this Mar 24, 2021

MadameSheema added release_note:skip Skip the PR/issue when compiling release notes v7.13.0 v8.0.0 Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detections and Resp Security Detection Response Team labels Mar 24, 2021

MadameSheema marked this pull request as ready for review March 24, 2021 19:12

MadameSheema requested a review from a team as a code owner March 24, 2021 19:12

rylnd approved these changes Mar 25, 2021

View reviewed changes

MadameSheema merged commit 6a57148 into elastic:master Mar 25, 2021

MadameSheema deleted the improves-indicator-match branch March 25, 2021 18:25

MadameSheema mentioned this pull request Mar 25, 2021

[7.x] [Security Solution][Detections] Improves indicator match Cypress tests (#94913) #95449

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][Detections] Improves indicator match Cypress tests #94913

[Security Solution][Detections] Improves indicator match Cypress tests #94913

MadameSheema commented Mar 18, 2021 •

edited

Loading

rylnd Mar 18, 2021

rylnd Mar 18, 2021

rylnd Mar 18, 2021

rylnd Mar 18, 2021

rylnd Mar 18, 2021

MadameSheema commented Mar 24, 2021

elasticmachine commented Mar 24, 2021

elasticmachine commented Mar 24, 2021

kibanamachine commented Mar 24, 2021

rylnd left a comment

rylnd Mar 24, 2021

rylnd Mar 24, 2021

MadameSheema Mar 25, 2021

rylnd Mar 24, 2021

rylnd Mar 25, 2021

rylnd Mar 25, 2021

rylnd Mar 25, 2021

MadameSheema commented Mar 25, 2021


		export const JSON_CONTENT = '.ace_content';

		export const JSON_VIEW_TAB = '#json-view';

		const expectedEnrichment = [
		{ line: 4, text: ' "threat": {' },

		@@ -92,6 +95,10 @@ export const TIMELINE_TEMPLATE_DETAILS = 'Timeline template';

		export const TIMESTAMP_OVERRIDE_DETAILS = 'Timestamp override';

		export const TIMELINE_FIELD = (field: string) => {

[Security Solution][Detections] Improves indicator match Cypress tests #94913

[Security Solution][Detections] Improves indicator match Cypress tests #94913

Conversation

MadameSheema commented Mar 18, 2021 • edited Loading

Summary

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

MadameSheema commented Mar 24, 2021

elasticmachine commented Mar 24, 2021

elasticmachine commented Mar 24, 2021

kibanamachine commented Mar 24, 2021

💚 Build Succeeded

Metrics [docs]

Async chunks

History

rylnd left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

MadameSheema commented Mar 25, 2021

MadameSheema commented Mar 18, 2021 •

edited

Loading