github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-23 17:28:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

[8.18] [EDR Workflows] Fix Osquery tests (#215507) (#218643)

Browse source 
# Backport

This will backport the following commits from `main` to `8.18`:
- [[EDR Workflows] Fix Osquery tests
(#215507)](https://github.com/elastic/kibana/pull/215507)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Tomasz
Ciecierski","email":"tomasz.ciecierski@elastic.co"},"sourceCommit":{"committedDate":"2025-04-15T07:37:58Z","message":"[EDR
Workflows] Fix Osquery tests (#215507)\n\nCloses #197335\nCloses
#192128\nCloses #181889\nCloses #178404 \nCloses
#169785","sha":"9595c1ebd519091ad3dba82f67613e6133c9a850","branchLabelMapping":{"^v9.1.0$":"main","^v8.19.0$":"8.x","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","backport
missing","Team:Defend
Workflows","backport:version","v9.1.0","v8.18.1"],"title":"[EDR
Workflows] Fix Osquery
tests","number":215507,"url":"https://github.com/elastic/kibana/pull/215507","mergeCommit":{"message":"[EDR
Workflows] Fix Osquery tests (#215507)\n\nCloses #197335\nCloses
#192128\nCloses #181889\nCloses #178404 \nCloses
#169785","sha":"9595c1ebd519091ad3dba82f67613e6133c9a850"}},"sourceBranch":"main","suggestedTargetBranches":["8.18"],"targetPullRequestStates":[{"branch":"main","label":"v9.1.0","branchLabelMappingKey":"^v9.1.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/215507","number":215507,"mergeCommit":{"message":"[EDR
Workflows] Fix Osquery tests (#215507)\n\nCloses #197335\nCloses
#192128\nCloses #181889\nCloses #178404 \nCloses
#169785","sha":"9595c1ebd519091ad3dba82f67613e6133c9a850"}},{"branch":"8.18","label":"v8.18.1","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->
This commit is contained in:
Tomasz Ciecierski 2025-04-22 09:32:12 +02:00 • committed by GitHub
parent 39241a8d9d
commit efd16d98fe
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
8 changed files with 243 additions and 219 deletions
Download patch file Download diff file Expand all files Collapse all files

208
x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_automated_action_results.cy.ts
View file

@ -7,115 +7,123 @@
import { initializeDataViews } from '../../tasks/login';
import { cleanupRule, loadRule } from '../../tasks/api_fixtures';
import { checkActionItemsInResults, loadRuleAlerts } from '../../tasks/live_query';
import { checkActionItemsInResults, loadRuleAlerts, navigateToRule } from '../../tasks/live_query';
const UUID_REGEX = '[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}';
// Failing: See https://github.com/elastic/kibana/issues/197335
// Failing: See https://github.com/elastic/kibana/issues/197328
// Failing: See https://github.com/elastic/kibana/issues/178404
describe.skip('Alert Flyout Automated Action Results', () => {
let ruleId: string;
describe(
'Alert Flyout Automated Action Results',
{ tags: ['@ess', '@serverless', '@skipInServerlessMKI'] },
() => {
let ruleId: string;
let ruleName: string;
before(() => {
initializeDataViews();
});
beforeEach(() => {
loadRule(true).then((data) => {
ruleId = data.id;
loadRuleAlerts(data.name);
});
});
afterEach(() => {
cleanupRule(ruleId);
});
it('can visit discover from response action results', { tags: ['@ess'] }, () => {
const discoverRegex = new RegExp(`action_id: ${UUID_REGEX}`);
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
});
cy.contains('View in Discover')
.should('exist')
.should('have.attr', 'href')
.then(($href) => {
// @ts-expect-error-next-line href string - check types
cy.visit($href);
cy.getBySel('discoverDocTable', { timeout: 60000 }).within(() => {
cy.contains('action_data{ "query":');
});
cy.contains(discoverRegex);
before(() => {
initializeDataViews();
loadRule(true).then((data) => {
ruleId = data.id;
ruleName = data.name;
loadRuleAlerts(ruleName);
});
});
it('can visit lens from response action results', { tags: ['@ess'] }, () => {
const lensRegex = new RegExp(`Action ${UUID_REGEX} results`);
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
});
cy.getBySel('osquery-results-comment')
.first()
.within(() => {
let lensUrl = '';
cy.window().then((win) => {
cy.stub(win, 'open')
.as('windowOpen')
.callsFake((url) => {
lensUrl = url;
beforeEach(() => {
navigateToRule(ruleName);
});
after(() => {
cleanupRule(ruleId);
});
it('can visit discover from response action results', { tags: ['@ess'] }, () => {
const discoverRegex = new RegExp(`action_id: ${UUID_REGEX}`);
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
});
cy.contains('View in Discover')
.should('exist')
.should('have.attr', 'href')
.then(($href) => {
// @ts-expect-error-next-line href string - check types
cy.visit($href);
cy.getBySel('discoverDocTable', { timeout: 60000 }).within(() => {
cy.contains(/action_data\{[^}]*"query":[^}]*\}/);
});
cy.contains(discoverRegex);
});
});
it('can visit lens from response action results', { tags: ['@ess'] }, () => {
const lensRegex = new RegExp(`Action ${UUID_REGEX} results`);
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
});
cy.getBySel('osquery-results-comment')
.first()
.within(() => {
let lensUrl = '';
cy.window().then((win) => {
cy.stub(win, 'open')
.as('windowOpen')
.callsFake((url) => {
lensUrl = url;
});
});
cy.get(`[aria-label="View in Lens"]`).click();
cy.window()
.its('open')
.then(() => {
cy.visit(lensUrl);
});
});
cy.get(`[aria-label="View in Lens"]`).click();
cy.window()
.its('open')
.then(() => {
cy.visit(lensUrl);
});
});
cy.getBySel('lnsWorkspace').should('exist');
cy.getBySel('breadcrumbs').contains(lensRegex);
});
it('can add to timeline from response action results', { tags: ['@ess', '@serverless'] }, () => {
const timelineRegex = new RegExp(`Added ${UUID_REGEX} to timeline`);
const filterRegex = new RegExp(`action_id: "${UUID_REGEX}"`);
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
cy.getBySel('lnsWorkspace').should('exist');
cy.getBySel('breadcrumbs').contains(lensRegex);
});
cy.getBySel('osquery-results-comment')
.first()
.within(() => {
cy.get('.euiTableRow')
it(
'can add to timeline from response action results',
{ tags: ['@ess', '@serverless'] },
() => {
const timelineRegex = new RegExp(`Added ${UUID_REGEX} to timeline`);
const filterRegex = new RegExp(`action_id: "${UUID_REGEX}"`);
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
});
cy.getBySel('osquery-results-comment')
.first()
.within(() => {
cy.getBySel('add-to-timeline').click();
cy.get('.euiTableRow')
.first()
.within(() => {
cy.getBySel('add-to-timeline').click();
});
});
});
cy.contains(timelineRegex);
cy.getBySel('securitySolutionFlyoutNavigationCollapseDetailButton').click();
cy.getBySel('timeline-bottom-bar').contains('Untitled timeline').click();
cy.contains(filterRegex);
});
});
cy.contains(timelineRegex);
cy.getBySel('securitySolutionFlyoutNavigationCollapseDetailButton').click();
cy.getBySel('timeline-bottom-bar').contains('Untitled timeline').click();
cy.contains(filterRegex);
}
);
}
);

197
x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_cases.cy.ts
View file

@ -25,111 +25,118 @@ import {
} from '../../tasks/live_query';
import { generateRandomStringName, interceptCaseId } from '../../tasks/integrations';
describe('Alert Event Details - Cases', { tags: ['@ess', '@serverless'] }, () => {
let ruleId: string;
let packId: string;
let packName: string;
const packData = packFixture();
beforeEach(() => {
initializeDataViews();
loadPack(packData).then((data) => {
packId = data.saved_object_id;
packName = data.name;
});
loadRule(true).then((data) => {
ruleId = data.id;
loadRuleAlerts(data.name);
});
});
afterEach(() => {
cleanupPack(packId);
cleanupRule(ruleId);
});
describe('Case creation', () => {
let caseId: string;
before(() => {
interceptCaseId((id) => {
caseId = id;
});
});
after(() => {
cleanupCase(caseId);
});
it('runs osquery against alert and creates a new case', () => {
const [caseName, caseDescription] = generateRandomStringName(2);
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutFooterDropdownButton').click();
cy.getBySel('osquery-action-item').click();
cy.contains(/^\d+ agen(t|ts) selected/);
cy.getBySel('globalLoadingIndicator').should('not.exist');
cy.wait(1000);
cy.contains('Run a set of queries in a pack').click();
cy.get(OSQUERY_FLYOUT_BODY_EDITOR).should('not.exist');
cy.getBySel('globalLoadingIndicator').should('not.exist');
cy.getBySel('select-live-pack').click().type(`${packName}{downArrow}{enter}`);
submitQuery();
cy.get('[aria-label="Add to Case"]').first().click();
cy.getBySel('cases-table-add-case-filter-bar').click();
cy.getBySel('create-case-flyout').should('be.visible');
cy.get('input[aria-describedby="caseTitle"]').type(caseName);
cy.get('textarea[aria-label="caseDescription"]').type(caseDescription);
cy.getBySel('create-case-submit').click();
cy.contains(`An alert was added to "${caseName}"`);
});
});
// FLAKY: https://github.com/elastic/kibana/issues/176783
describe.skip('Case', () => {
let caseId: string;
// Failing: See https://github.com/elastic/kibana/issues/197151
describe.skip(
'Alert Event Details - Cases',
{ tags: ['@ess', '@serverless', '@skipInServerlessMKI'] },
() => {
let ruleId: string;
let packId: string;
let packName: string;
const packData = packFixture();
beforeEach(() => {
loadCase('securitySolution').then((data) => {
caseId = data.id;
initializeDataViews();
loadPack(packData).then((data) => {
packId = data.saved_object_id;
packName = data.name;
});
loadRule(true).then((data) => {
ruleId = data.id;
loadRuleAlerts(data.name);
});
});
afterEach(() => {
cleanupCase(caseId);
cleanupPack(packId);
cleanupRule(ruleId);
});
it('sees osquery results from last action and add to a case', () => {
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
cy.contains('select * from users;');
cy.contains("SELECT * FROM os_version where name='Ubuntu';");
cy.getBySel('osquery-results-comment').each(($comment) => {
cy.wrap($comment).within(() => {
// On initial load result table might not render due to displayed error
if ($comment.find('div .euiDataGridRow').length <= 0) {
// If tabs are present try clicking between status and results to get rid of the error message
if ($comment.find('div .euiTabs').length > 0) {
cy.getBySel('osquery-status-tab').click();
cy.getBySel('osquery-results-tab').click();
cy.getBySel('dataGridRowCell', { timeout: 120000 }).should('have.lengthOf.above', 0);
}
} else {
// Result tab was rendered successfully
cy.getBySel('dataGridRowCell', { timeout: 120000 }).should('have.lengthOf.above', 0);
}
describe('Case creation', () => {
let caseId: string;
before(() => {
interceptCaseId((id) => {
caseId = id;
});
});
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
after(() => {
cleanupCase(caseId);
});
addToCase(caseId);
viewRecentCaseAndCheckResults();
it('runs osquery against alert and creates a new case', () => {
const [caseName, caseDescription] = generateRandomStringName(2);
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutFooterDropdownButton').click();
cy.getBySel('osquery-action-item').click();
cy.contains(/^\d+ agen(t|ts) selected/);
cy.getBySel('globalLoadingIndicator').should('not.exist');
cy.wait(1000);
cy.contains('Run a set of queries in a pack').click();
cy.get(OSQUERY_FLYOUT_BODY_EDITOR).should('not.exist');
cy.getBySel('globalLoadingIndicator').should('not.exist');
cy.getBySel('select-live-pack').click().type(`${packName}{downArrow}{enter}`);
submitQuery();
cy.get('[aria-label="Add to Case"]').first().click();
cy.getBySel('cases-table-add-case-filter-bar').click();
cy.getBySel('create-case-flyout').should('be.visible');
cy.get('input[aria-describedby="caseTitle"]').type(caseName);
cy.get('textarea[aria-label="caseDescription"]').type(caseDescription);
cy.getBySel('create-case-submit').click();
cy.contains(`An alert was added to "${caseName}"`);
});
});
});
});
describe('Case', () => {
let caseId: string;
beforeEach(() => {
loadCase('securitySolution').then((data) => {
caseId = data.id;
});
});
afterEach(() => {
cleanupCase(caseId);
});
it('sees osquery results from last action and add to a case', () => {
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
cy.contains('select * from users;');
cy.contains("SELECT * FROM os_version where name='Ubuntu';");
cy.getBySel('osquery-results-comment').each(($comment) => {
cy.wrap($comment).within(() => {
// On initial load result table might not render due to displayed error
if ($comment.find('div .euiDataGridRow').length <= 0) {
// If tabs are present try clicking between status and results to get rid of the error message
if ($comment.find('div .euiTabs').length > 0) {
cy.getBySel('osquery-status-tab').click();
cy.getBySel('osquery-results-tab').click();
cy.getBySel('dataGridRowCell', { timeout: 120000 }).should(
'have.lengthOf.above',
0
);
}
} else {
// Result tab was rendered successfully
cy.getBySel('dataGridRowCell', { timeout: 120000 }).should('have.lengthOf.above', 0);
}
});
});
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
});
addToCase(caseId);
viewRecentCaseAndCheckResults();
});
});
}
);

20
x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_linked_apps.cy.ts
View file

@ -16,10 +16,8 @@ import {
submitQuery,
} from '../../tasks/live_query';
import { closeModalIfVisible, closeToastIfVisible } from '../../tasks/integrations';
import { RESULTS_TABLE, RESULTS_TABLE_BUTTON } from '../../screens/live_query';
// Failing: See https://github.com/elastic/kibana/issues/181889
describe.skip(
describe(
'Alert Event Details',
{
tags: ['@ess', '@serverless', '@skipInServerlessMKI'],
@ -76,17 +74,17 @@ describe.skip(
submitQuery();
checkResults();
cy.contains('Add to timeline investigation');
cy.contains('Save for later').click();
cy.contains('Save query');
cy.get('[data-test-subj="osquery-save-query-flyout"]').within(() => {
cy.get('.euiButtonEmpty').contains('Cancel').click();
});
// cy.contains('Save for later').click();
// cy.contains('Save query');
// cy.get('[data-test-subj="osquery-save-query-flyout"]').within(() => {
// cy.get('.euiButtonEmpty').contains('Cancel').click();
// });
cy.getBySel('add-to-timeline').first().click();
cy.getBySel('globalToastList').contains('Added');
closeToastIfVisible();
cy.getBySel(RESULTS_TABLE).within(() => {
cy.getBySel(RESULTS_TABLE_BUTTON).should('not.exist');
});
// cy.getBySel(RESULTS_TABLE).within(() => {
// cy.getBySel(RESULTS_TABLE_BUTTON).should('not.exist');
// });
cy.contains('Cancel').click();
cy.getBySel('timeline-bottom-bar').within(() => {
cy.contains(TIMELINE_NAME).click();

5
x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_response_actions_form.cy.ts
View file

@ -24,10 +24,9 @@ import {
import { clickRuleName, inputQuery, typeInECSFieldInput } from '../../tasks/live_query';
import { closeDateTabIfVisible, closeToastIfVisible } from '../../tasks/integrations';
// FLAKY: https://github.com/elastic/kibana/issues/169785
describe.skip(
describe(
'Alert Event Details - Response Actions Form',
{ tags: ['@ess', '@serverless'] },
{ tags: ['@ess', '@serverless', '@skipInServerlessMKI'] },
() => {
let multiQueryPackId: string;
let multiQueryPackName: string;

3
x-pack/platform/plugins/shared/osquery/cypress/e2e/all/ecs_mappings.cy.ts
View file

@ -18,8 +18,7 @@ import {
typeInOsqueryFieldInput,
} from '../../tasks/live_query';
// Failing: See https://github.com/elastic/kibana/issues/192128
describe.skip('EcsMapping', { tags: ['@ess', '@serverless', '@skipInServerlessMKI'] }, () => {
describe('EcsMapping', { tags: ['@ess', '@serverless', '@skipInServerlessMKI'] }, () => {
beforeEach(() => {
initializeDataViews();
});

3
x-pack/platform/plugins/shared/osquery/cypress/support/project_controller_osquery_roles.yml
View file

@ -1,5 +1,8 @@
# add more functionalities just for ESS environment
soc_manager:
indices:
- names: [ '.items-default*', '.lists-default*' ]
privileges: [ 'manage', 'read', 'write' ]
applications:
- application: "kibana-.kibana"
privileges:

24
x-pack/platform/plugins/shared/osquery/cypress/tasks/live_query.ts
View file

@ -8,7 +8,11 @@
import { waitForAlertsToPopulate } from '@kbn/test-suites-xpack/security_solution_cypress/cypress/tasks/create_new_rule';
import { disableNewFeaturesTours } from './navigation';
import { getAdvancedButton } from '../screens/integrations';
import { LIVE_QUERY_EDITOR, OSQUERY_FLYOUT_BODY_EDITOR } from '../screens/live_query';
import {
LIVE_QUERY_EDITOR,
OSQUERY_FLYOUT_BODY_EDITOR,
RESULTS_TABLE,
} from '../screens/live_query';
import { ServerlessRoleName } from '../support/roles';
export const DEFAULT_QUERY = 'select * from processes;';
@ -58,13 +62,13 @@ export const verifyQueryTimeout = (timeout: string) => {
// sometimes the results get stuck in the tests, this is a workaround
export const checkResults = () => {
cy.getBySel('osqueryResultsTable', { timeout: 120000 }).then(($table) => {
cy.getBySel(RESULTS_TABLE, { timeout: 240000 }).then(($table) => {
if ($table.find('div .euiDataGridRow').length > 0) {
cy.getBySel('dataGridRowCell', { timeout: 120000 }).should('have.lengthOf.above', 0);
cy.getBySel('dataGridRowCell', { timeout: 240000 }).should('have.lengthOf.above', 0);
} else {
cy.getBySel('osquery-status-tab').click();
cy.getBySel('osquery-results-tab').click();
cy.getBySel('dataGridRowCell', { timeout: 120000 }).should('have.lengthOf.above', 0);
cy.getBySel('osquery-status-tab').click({ multiple: true });
cy.getBySel('osquery-results-tab').click({ multiple: true });
cy.getBySel('dataGridRowCell', { timeout: 240000 }).should('have.lengthOf.above', 0);
}
});
};
@ -117,7 +121,7 @@ export const toggleRuleOffAndOn = (ruleName: string) => {
});
};
export const loadRuleAlerts = (ruleName: string) => {
export const navigateToRule = (ruleName: string) => {
cy.login(ServerlessRoleName.SOC_MANAGER, false);
cy.visit('/app/security/rules', {
onBeforeLoad: (win) => disableNewFeaturesTours(win),
@ -126,6 +130,12 @@ export const loadRuleAlerts = (ruleName: string) => {
waitForAlertsToPopulate();
};
export const loadRuleAlerts = (ruleName: string) => {
navigateToRule(ruleName);
cy.getBySel('ruleSwitch').should('have.attr', 'aria-checked', 'true');
cy.getBySel('ruleSwitch').click();
};
export const addToCase = (caseId: string) => {
cy.contains('Add to Case').click();
cy.contains('Select case');

2
x-pack/platform/plugins/shared/osquery/cypress/tasks/wait_until.ts
View file

@ -6,7 +6,7 @@
*/
export const waitUntil = (fn: () => Cypress.Chainable) => {
const timeout = 120000;
const timeout = 240000;
const interval = 5000;
let attempts = timeout / interval;