[Security Solution] Data view override for sourcerer (#125116)

This commit is contained in:
Steph Milovic 2022-02-11 08:36:48 -07:00 committed by GitHub
parent 2f008c5200
commit b0e534b1cd
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 40 additions and 6 deletions

View file

@ -168,6 +168,35 @@ describe('sourcerer route', () => {
expect(response.body).toEqual(mockDataViewsTransformed);
});
test('passes override=true on create and save', async () => {
const getMock = jest.fn();
getMock.mockResolvedValueOnce(null);
getMock.mockResolvedValueOnce(mockPattern);
const mockCreateAndSave = jest.fn();
const getStartServicesSpecial = jest.fn().mockResolvedValue([
null,
{
data: {
indexPatterns: {
dataViewsServiceFactory: () => ({
getIdsWithTitle: () =>
new Promise((rs) => rs(mockDataViews.filter((v) => v.id !== mockPattern.id))),
get: getMock,
createAndSave: mockCreateAndSave.mockImplementation(
() => new Promise((rs) => rs(mockPattern))
),
updateSavedObject: () => new Promise((rs, rj) => rj(new Error('error'))),
}),
},
},
},
] as unknown) as StartServicesAccessor<StartPlugins>;
createSourcererDataViewRoute(server.router, getStartServicesSpecial);
await server.inject(getSourcererRequest(mockPatternList), context);
expect(mockCreateAndSave).toHaveBeenCalled();
expect(mockCreateAndSave.mock.calls[0][1]).toEqual(true);
});
test('returns sourcerer formatted Data Views when SIEM Data View exists', async () => {
createSourcererDataViewRoute(server.router, getStartServices);
const response = await server.inject(getSourcererRequest(mockPatternList), context);

View file

@ -72,12 +72,17 @@ export const createSourcererDataViewRoute = (
const siemDataViewTitle = siemDataView ? siemDataView.title.split(',').sort().join() : '';
if (siemDataView == null) {
try {
siemDataView = await dataViewService.createAndSave({
allowNoIndex: true,
id: dataViewId,
title: patternListAsTitle,
timeFieldName: DEFAULT_TIME_FIELD,
});
siemDataView = await dataViewService.createAndSave(
{
allowNoIndex: true,
id: dataViewId,
title: patternListAsTitle,
timeFieldName: DEFAULT_TIME_FIELD,
},
// Override property - if a data view exists with the security solution pattern
// delete it and replace it with our data view
true
);
} catch (err) {
const error = transformError(err);
if (err.name === 'DuplicateDataViewError' || error.statusCode === 409) {