augment fake data

2025-04-24 17:59:23 -04:00 · 2022-06-17 15:10:45 +02:00 · 2022-06-17 15:10:45 +02:00 · b584ada8f5
commit b584ada8f5
parent 751e3145e5
5 changed files with 82 additions and 70 deletions
--- a/x-pack/plugins/security_solution/common/endpoint/data_generators/endpoint_action_generator.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/data_generators/endpoint_action_generator.ts
@ -5,6 +5,8 @@
 * 2.0.
 */

+// eslint-disable-next-line import/no-extraneous-dependencies
+import faker from 'faker';
 import { DeepPartial } from 'utility-types';
 import { merge } from 'lodash';
 import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
@ -26,9 +28,7 @@ const ISOLATION_COMMANDS: ISOLATION_ACTIONS[] = ['isolate', 'unisolate'];
 export class EndpointActionGenerator extends BaseDataGenerator {
  /** Generate a random endpoint Action request (isolate or unisolate) */
  generate(overrides: DeepPartial<LogsEndpointAction> = {}): LogsEndpointAction {
-    const timeStamp = overrides['@timestamp']
-      ? new Date(overrides['@timestamp'])
-      : new Date(this.randomPastDate());
+    const timeStamp = overrides['@timestamp'] ? new Date(overrides['@timestamp']) : new Date();

    return merge(
      {
@ -43,7 +43,7 @@ export class EndpointActionGenerator extends BaseDataGenerator {
          input_type: 'endpoint',
          data: {
            command: this.randomIsolateCommand(),
-            comment: this.randomString(15),
+            comment: faker.lorem.sentence(),
          },
        },
        error: undefined,
@ -77,6 +77,14 @@ export class EndpointActionGenerator extends BaseDataGenerator {
  ): LogsEndpointActionResponse {
    const timeStamp = overrides['@timestamp'] ? new Date(overrides['@timestamp']) : new Date();

+    const startedAtTimes = [2, 3, 5, 8, 13, 21].reduce<number[]>((acc, curr) => {
+      acc.push(
+        timeStamp.setMinutes(-this.randomN(curr)),
+        timeStamp.setSeconds(-this.randomN(curr))
+      );
+      return acc;
+    }, []);
+
    return merge(
      {
        '@timestamp': timeStamp.toISOString(),
@ -90,7 +98,8 @@ export class EndpointActionGenerator extends BaseDataGenerator {
            command: this.randomIsolateCommand(),
            comment: '',
          },
-          started_at: this.randomPastDate(),
+          // randomly before a few hours/minutes/seconds later
+          started_at: new Date(startedAtTimes[this.randomN(startedAtTimes.length)]).toISOString(),
        },
        error: undefined,
      },
--- a/x-pack/plugins/security_solution/common/endpoint/data_generators/fleet_action_generator.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/data_generators/fleet_action_generator.ts
@ -5,6 +5,8 @@
 * 2.0.
 */

+// eslint-disable-next-line import/no-extraneous-dependencies
+import faker from 'faker';
 import { DeepPartial } from 'utility-types';
 import { merge } from 'lodash';
 import * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
@ -24,9 +26,7 @@ const ISOLATION_COMMANDS: ISOLATION_ACTIONS[] = ['isolate', 'unisolate'];
 export class FleetActionGenerator extends BaseDataGenerator {
  /** Generate a random endpoint Action (isolate or unisolate) */
  generate(overrides: DeepPartial<EndpointAction> = {}): EndpointAction {
-    const timeStamp = overrides['@timestamp']
-      ? new Date(overrides['@timestamp'])
-      : new Date(this.randomPastDate());
+    const timeStamp = overrides['@timestamp'] ? new Date(overrides['@timestamp']) : new Date();

    return merge(
      {
@ -39,7 +39,7 @@ export class FleetActionGenerator extends BaseDataGenerator {
        user_id: 'elastic',
        data: {
          command: this.randomIsolateCommand(),
-          comment: this.randomString(15),
+          comment: faker.lorem.sentence(),
        },
      },
      overrides
@ -66,6 +66,14 @@ export class FleetActionGenerator extends BaseDataGenerator {
  generateResponse(overrides: DeepPartial<EndpointActionResponse> = {}): EndpointActionResponse {
    const timeStamp = overrides['@timestamp'] ? new Date(overrides['@timestamp']) : new Date();

+    const startedAtTimes = [2, 3, 5, 8, 13, 21].reduce<number[]>((acc, curr) => {
+      acc.push(
+        timeStamp.setMinutes(-this.randomN(curr)),
+        timeStamp.setSeconds(-this.randomN(curr))
+      );
+      return acc;
+    }, []);
+
    return merge(
      {
        action_data: {
@ -74,9 +82,9 @@ export class FleetActionGenerator extends BaseDataGenerator {
        },
        action_id: this.seededUUIDv4(),
        agent_id: this.seededUUIDv4(),
-        started_at: this.randomPastDate(),
+        started_at: new Date(startedAtTimes[this.randomN(startedAtTimes.length)]).toISOString(),
        completed_at: timeStamp.toISOString(),
-        error: 'some error happened',
+        error: undefined,
        '@timestamp': timeStamp.toISOString(),
      },
      overrides
--- a/x-pack/plugins/security_solution/common/endpoint/data_loaders/index_endpoint_fleet_actions.ts
+++ b/x-pack/plugins/security_solution/common/endpoint/data_loaders/index_endpoint_fleet_actions.ts
@ -5,6 +5,8 @@
 * 2.0.
 */

+// eslint-disable-next-line import/no-extraneous-dependencies
+import faker from 'faker';
 import { Client } from '@elastic/elasticsearch';
 import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey';
 import { AGENT_ACTIONS_INDEX, AGENT_ACTIONS_RESULTS_INDEX } from '@kbn/fleet-plugin/common';
@ -62,7 +64,7 @@ export const indexEndpointAndFleetActionsForHost = async (
  for (let i = 0; i < total; i++) {
    // create an action
    const action = fleetActionGenerator.generate({
-      data: { comment: 'data generator: this host is bad' },
+      data: { comment: faker.lorem.sentence() },
    });

    action.agents = [agentId];
@ -77,35 +79,31 @@ export const indexEndpointAndFleetActionsForHost = async (
      )
      .catch(wrapErrorAndRejectPromise);

-    if (fleetActionGenerator.randomFloat() < 0.4) {
-      const endpointActionsBody = {
-        EndpointActions: {
-          ...action,
-          '@timestamp': undefined,
-          user_id: undefined,
-        },
-        agent: {
-          id: [agentId],
-        },
-        '@timestamp': action['@timestamp'],
-        user: {
-          id: action.user_id,
-        },
-      };
+    const endpointActionsBody = {
+      EndpointActions: {
+        ...action,
+        '@timestamp': undefined,
+        user_id: undefined,
+      },
+      agent: {
+        id: [agentId],
+      },
+      '@timestamp': action['@timestamp'],
+      user: {
+        id: action.user_id,
+      },
+    };

-      await Promise.all([
-        indexFleetActions,
-        esClient
-          .index({
-            index: ENDPOINT_ACTIONS_INDEX,
-            body: endpointActionsBody,
-            refresh: 'wait_for',
-          })
-          .catch(wrapErrorAndRejectPromise),
-      ]);
-    } else {
-      await indexFleetActions;
-    }
+    await Promise.all([
+      indexFleetActions,
+      esClient
+        .index({
+          index: ENDPOINT_ACTIONS_INDEX,
+          body: endpointActionsBody,
+          refresh: 'wait_for',
+        })
+        .catch(wrapErrorAndRejectPromise),
+    ]);

    const randomFloat = fleetActionGenerator.randomFloat();
    // Create an action response for the above
@ -114,12 +112,12 @@ export const indexEndpointAndFleetActionsForHost = async (
      agent_id: agentId,
      action_response: {
        endpoint: {
-          // add ack to 2/5th of fleet response
-          ack: randomFloat < 0.4 ? true : undefined,
+          // add ack to 4/5th of fleet response
+          ack: randomFloat < 0.8 ? true : undefined,
        },
      },
-      // error for 3/10th of responses
-      error: randomFloat < 0.3 ? 'some error happened' : undefined,
+      // error for 1/10th of responses
+      error: randomFloat < 0.1 ? 'some error happened' : undefined,
    });

    const indexFleetResponses = esClient
@ -133,7 +131,8 @@ export const indexEndpointAndFleetActionsForHost = async (
      )
      .catch(wrapErrorAndRejectPromise);

-    if (randomFloat < 0.4) {
+    // 70% has endpoint response
+    if (randomFloat < 0.7) {
      const endpointActionResponseBody = {
        EndpointActions: {
          ...actionResponse,
@ -146,13 +145,13 @@ export const indexEndpointAndFleetActionsForHost = async (
        agent: {
          id: agentId,
        },
-        // error for 3/10th of responses
+        // error for 1/10th of responses
        error:
-          randomFloat < 0.3
-            ? undefined
-            : {
+          randomFloat < 0.1
+            ? {
                message: actionResponse.error,
-              },
+              }
+            : undefined,
        '@timestamp': actionResponse['@timestamp'],
      };

@ -167,6 +166,7 @@ export const indexEndpointAndFleetActionsForHost = async (
          .catch(wrapErrorAndRejectPromise),
      ]);
    } else {
+      // 30% has only fleet response
      await indexFleetResponses;
    }

@ -174,24 +174,23 @@ export const indexEndpointAndFleetActionsForHost = async (
    response.actionResponses.push(actionResponse);
  }

-  // Add edge cases (maybe)
+  // Add edge case fleet actions (maybe)
  if (fleetActionGenerator.randomFloat() < 0.3) {
    const randomFloat = fleetActionGenerator.randomFloat();

-    // 60% of the time just add either an Isolate -OR- an UnIsolate action
-    if (randomFloat < 0.6) {
+    const actionStartedAt = {
+      '@timestamp': new Date().toISOString(),
+    };
+    // 70% of the time just add either an Isolate -OR- an UnIsolate action
+    if (randomFloat < 0.7) {
      let action: EndpointAction;

      if (randomFloat < 0.3) {
        // add a pending isolation
-        action = fleetActionGenerator.generateIsolateAction({
-          '@timestamp': new Date().toISOString(),
-        });
+        action = fleetActionGenerator.generateIsolateAction(actionStartedAt);
      } else {
        // add a pending UN-isolation
-        action = fleetActionGenerator.generateUnIsolateAction({
-          '@timestamp': new Date().toISOString(),
-        });
+        action = fleetActionGenerator.generateUnIsolateAction(actionStartedAt);
      }

      action.agents = [agentId];
@ -209,13 +208,9 @@ export const indexEndpointAndFleetActionsForHost = async (

      response.actions.push(action);
    } else {
-      // Else (40% of the time) add a pending isolate AND pending un-isolate
-      const action1 = fleetActionGenerator.generateIsolateAction({
-        '@timestamp': new Date().toISOString(),
-      });
-      const action2 = fleetActionGenerator.generateUnIsolateAction({
-        '@timestamp': new Date().toISOString(),
-      });
+      // Else (30% of the time) add a pending isolate AND pending un-isolate
+      const action1 = fleetActionGenerator.generateIsolateAction(actionStartedAt);
+      const action2 = fleetActionGenerator.generateUnIsolateAction(actionStartedAt);

      action1.agents = [agentId];
      action2.agents = [agentId];
--- a/x-pack/plugins/security_solution/server/endpoint/services/actions/action_details_by_id.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/actions/action_details_by_id.test.ts
@ -55,7 +55,7 @@ describe('When using `getActionDetailsById()', () => {
              '@timestamp': '2022-04-30T16:08:47.449Z',
              EndpointActions: {
                action_id: '123',
-                completed_at: '2022-04-30T16:08:47.449Z',
+                completed_at: '2022-04-30T10:53:59.449Z',
                data: {
                  command: 'unisolate',
                  comment: '',
@ -81,7 +81,7 @@ describe('When using `getActionDetailsById()', () => {
              },
              action_id: '123',
              agent_id: 'agent-a',
-              completed_at: '2022-04-30T16:08:47.449Z',
+              completed_at: '2022-04-30T10:53:59.449Z',
              error: '',
              started_at: expect.any(String),
            },
@ -97,7 +97,7 @@ describe('When using `getActionDetailsById()', () => {
                action_id: '123',
                data: {
                  command: 'isolate',
-                  comment: '5wb6pu6kh2xix5i',
+                  comment: expect.any(String),
                },
                expiration: expect.any(String),
                input_type: 'endpoint',
--- a/x-pack/plugins/security_solution/server/endpoint/services/actions/utils.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/services/actions/utils.test.ts
@ -92,7 +92,7 @@ describe('When using Actions service utilities', () => {
        command: 'isolate',
        comment: expect.any(String),
        createdAt: '2022-04-27T16:08:47.449Z',
-        createdBy: 'Shanel',
+        createdBy: 'Ellamae',
        expiration: '2022-05-10T16:08:47.449Z',
        id: '1d6e6796-b0af-496f-92b0-25fcb06db499',
        type: 'ACTION_REQUEST',