EQL: Add integration tests harness to test EQL feature parity with original implementation #52248

aleksmaus · 2020-02-12T02:55:45Z

The tests use the original test queries from
https://github.com/endgameinc/eql/blob/master/eql/etc/test_queries.toml
for EQL implementation correctness validation.
The file test_queries_unsupported.toml serves as a "blacklist" for the
queries that we do not support. Currently all of the queries are
blacklisted. Over the time the expectation is to eventually have an
empty "blacklist" when all of the queries are fully supported.

The tests use the original test vector from
https://raw.githubusercontent.com/endgameinc/eql/master/eql/etc/test_data.json
that was translated to ECS format that matches the latest mapping being
used for Endgame platform event streaming and is loaded from endgame.dat
file. The endgame.json file contains the matching index
mappings/setting.

Only one EQL spec response is stubbed for now to match the expected
output for that spec query. This part would need some tweaking after EQL is
fully wired.

The input .toml file is parsed by hand for now, which is sufficient for
our purposes and avoids introducing another dependency just for this
particular test case.

Related to #49581

@imotov could you take a look first before I promote this from draft PR?
Thanks!

elasticmachine · 2020-02-12T02:55:47Z

Pinging @elastic/es-search (:Search/EQL)

aleksmaus · 2020-02-12T13:39:07Z

@elasticmachine run elasticsearch-ci/packaging-sample-matrix-unix

…iginal implementation The tests use the original test queries from https://github.com/endgameinc/eql/blob/master/eql/etc/test_queries.toml for EQL implementation correctness validation. The file test_queries_unsupported.toml serves as a "blacklist" for the queries that we do not support. Currently all of the queries are blacklisted. Over the time the expectation is to eventually have an empty "blacklist" when all of the queries are fully supported. The tests use the original test vector from https://raw.githubusercontent.com/endgameinc/eql/master/eql/etc/test_data.json that was translated to ECS format that matches the latest mapping being used for Endgame platform event streaming and is loaded from endgame.dat file. The endgame.json file contains the matching index mappings/setting. Only one EQL and the response is stubbed for now to match the expected output from that query. This part would need some tweaking after EQL is fully wired. The input .toml file is parsed by hand for now, which is sufficient for our purposes and avoids introducing another dependency just for this particular test case. Related to elastic#49581

rw-access · 2020-02-12T15:36:33Z

x-pack/plugin/eql/src/test/resources/endgame.dat

@@ -0,0 +1,102 @@
+{"user":{"group":{}},"host":{"os":{"platform":"windows","name":"Windows"},"ip":"127.0.0.1","hostname":"localhost","name":"localhost"},"event":{"module":"endgame","dataset":"esensor","action":"already_running","category":"process","kind":"event"},"labels":{"account_id":"f6c123dc-b6d9-4849-937b-08c444ce7d96","endpoint_id":"6a19472c-f0ab-4f3a-b83d-dc3698a5ff66"},"agent":{"type":"endgame","id":"6a19472c-f0ab-4f3a-b83d-dc3698a5ff66","version":"3.54.0"},"ecs":{"version":"1.1.0"},"@timestamp":0,"process":{"thread":{},"parent":{},"hash":{},"name":"System Idle Process"},"endgame":{"name":"localhost","eid":"6a19472c-f0ab-4f3a-b83d-dc3698a5ff66","MID":"","ip":"127.0.0.1","sver":"3.54.0","os_type":"windows","serial_event_id":1,"opcode":3,"event_type_full":"process_event","event_subtype_full":"already_running","timestamp":116444736000000000,"process_name":"System Idle Process","unique_pid":1,"xml_message":"","provider_name":"","provider_guid":"","channel_name":"","subject_user_sid":"","subject_user_name":"","subject_domain_name":"","subject_logon_id":"","target_domain_name":"","target_user_name":"","target_logon_id":"","ip_address":"","computer_name":"","privilege_list":"","logon_type":null,"system_thread_id":null,"system_pid":null,"system_process_name":"","query_name":"","query_type":null,"query_results":null,"metadata":{"collection_time":0}}}


two q's

why the .dat extension?

I don't think this needs to be in ECS, other than the event.category field. Otherwise all of the queries need to be rewritten

it's not quite a valid json, it's a collection of jsons. open for suggestions on the file extension.

wanted to use the exact same ECS data format that is currently established for events streaming from SMP, so we could potentially flesh out the details applicable to our data format first.

We typically use *.json for that, even though *.ndjson is probably a better choice.

Updated to .ndjson

rw-access · 2020-02-12T15:39:29Z

x-pack/plugin/eql/src/test/resources/test_queries_unsupported.toml

+# official EQL implementation
+
+[[queries]]
+query = 'process where serial_event_id < 4'


this one is supported

yeah, but not hooked up to the query engine yet. Once it is, we can validate the results and update the .toml files.

expecting the test_queries_unsupported.toml file to become empty and eventually dropped when we reach the feature parity

oh, I didn't realize that. in that case, this file is missing the first query from test_queries.toml. i just looked at the top and saw the discrepancy and reached the wrong conclusion

[[queries]] query = 'process where serial_event_id = 1' expected_event_ids = [1]

Added the comment into the file per @rw-access recommendation.

… the plugin actions behind the feature flag

imotov

I think @costin and @nik9000 might be better reviews for this since they had more experience with sql-spec tests.

imotov · 2020-02-13T22:35:13Z

x-pack/plugin/eql/src/test/resources/endgame.dat

@@ -0,0 +1,102 @@
+{"user":{"group":{}},"host":{"os":{"platform":"windows","name":"Windows"},"ip":"127.0.0.1","hostname":"localhost","name":"localhost"},"event":{"module":"endgame","dataset":"esensor","action":"already_running","category":"process","kind":"event"},"labels":{"account_id":"f6c123dc-b6d9-4849-937b-08c444ce7d96","endpoint_id":"6a19472c-f0ab-4f3a-b83d-dc3698a5ff66"},"agent":{"type":"endgame","id":"6a19472c-f0ab-4f3a-b83d-dc3698a5ff66","version":"3.54.0"},"ecs":{"version":"1.1.0"},"@timestamp":0,"process":{"thread":{},"parent":{},"hash":{},"name":"System Idle Process"},"endgame":{"name":"localhost","eid":"6a19472c-f0ab-4f3a-b83d-dc3698a5ff66","MID":"","ip":"127.0.0.1","sver":"3.54.0","os_type":"windows","serial_event_id":1,"opcode":3,"event_type_full":"process_event","event_subtype_full":"already_running","timestamp":116444736000000000,"process_name":"System Idle Process","unique_pid":1,"xml_message":"","provider_name":"","provider_guid":"","channel_name":"","subject_user_sid":"","subject_user_name":"","subject_domain_name":"","subject_logon_id":"","target_domain_name":"","target_user_name":"","target_logon_id":"","ip_address":"","computer_name":"","privilege_list":"","logon_type":null,"system_thread_id":null,"system_pid":null,"system_process_name":"","query_name":"","query_type":null,"query_results":null,"metadata":{"collection_time":0}}}


We typically use *.json for that, even though *.ndjson is probably a better choice.

imotov · 2020-02-13T23:03:08Z

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/action/EqlActionIT.java

+
+    @BeforeClass
+    public static void checkForSnapshot() {
+        assumeTrue("Only works on snapshot builds for now", Build.CURRENT.isSnapshot());


I don't think we need this anymore.

aleksmaus · 2020-02-14T03:22:22Z

@imotov, I talked to @costin before and got few suggestions. Basically, wanted to keep the original test spec from EQL unchanged, so we can easily follow any original EQL implementation changes by copying the toml file over into our test harness. Also tried to avoid adding any toml library dependency, since the format of the file is pretty simple to parse as is without the need for a full toml parser implementation yet, especially for testing.

nik9000

I'm certainly ok reusing the tests from other spots so the toml is fine by me. I think it'd be better to pull in an apache licensed toml parser as a test dependency for this project rather than build it by hand. Test dependencies are generally not so big a deal, especially when we isolate them into a specific sub-project.

The fancy CSV tests that SQL has have the nice property of being able to include them in the docs because they look just like output from the command line sql util. toml doesn't have that property, but that seems like a small price to pay for being able to reuse tests from a mature project.

costin

Left some comments.

I'm on the fence with the TOML reader. On one hand the parser is already written and we can customize it appropriately - on the other hand using an existing library would reduce (theoretically) the maintenance burdon.

I don't know enough about TOML to tell how much standard/non-standard it can get.
Regardless, reusing the test queries and results in the docs is something that's valuable to pursue in the future.

costin · 2020-02-14T14:52:19Z

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/plugin/EqlPlugin.java

-    public Collection<Object> createComponents(Client client, ClusterService clusterService, ThreadPool threadPool,
-            ResourceWatcherService resourceWatcherService, ScriptService scriptService, NamedXContentRegistry xContentRegistry,
-            Environment environment, NodeEnvironment nodeEnvironment, NamedWriteableRegistry namedWriteableRegistry) {
+    public Collection<Object> createComponents(Client client, ClusterService clusterService,


Why format the above?
In general, PRs should touch only lines that were modified not format the entire file. Both IntelliJ and Eclipse have this option.

Just making it easier to read, also because it just was just brought to my attention that some of the code that I had some formatting issues.

costin · 2020-02-14T14:56:14Z

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/plugin/EqlPlugin.java

+    }
+
+    @Override
+    public List<ActionHandler<? extends ActionRequest, ? extends ActionResponse>> getActions() {


I'm confused about why the method was moved...

consistent with other plugins. can undo

costin · 2020-02-14T14:59:41Z

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/plugin/EqlPlugin.java

+            );
+        }
+        return List.of(
+            new ActionHandler<>(XPackUsageFeatureAction.EQL, EqlUsageTransportAction.class),


If EQL is disabled, why register an action for it?
Also if these two actions are returned always, I would put them in a list and only add the extra 2 if enabled:

List<> actions = Arrays.asList(1,2) if (enabled) { actions.add(3); actions.add(4); } return list

If you really want it immutable, it can be wrapped inside another collection but considering its for internal consumption it's no need imo.

@costin see #52328 for why those two action have to be registered. At least, for the moment.

I would not sweat about this particular code, it will be cleaner once we remove the feature flag.

costin · 2020-02-14T15:03:12Z

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/plugin/EqlPlugin.java

@@ -103,9 +102,24 @@
    public List<Setting<?>> getSettings() {


Either we use enabled or this method. On one hand enabled checks the property presence statically but this method tries to do it dynamic when a class is instantiated.
There's there are multiple pieces of isSnapshot in this class that need simplification.

tried to follow the autoscaling plugin pattern, that I was told should be an example of handling the feature flag.

costin · 2020-02-14T15:04:06Z

...ck/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/plugin/TransportEqlSearchAction.java

@@ -41,7 +40,7 @@

    @Inject
    public TransportEqlSearchAction(Settings settings, ClusterService clusterService, TransportService transportService,
-            ThreadPool threadPool, ActionFilters actionFilters, PlanExecutor planExecutor) {
+                                    ThreadPool threadPool, ActionFilters actionFilters, PlanExecutor planExecutor) {


Same as above, formatting on non-modified lines is noise.

this is the formatting misalignment that I missed in my previous PR, now trying to fix it

costin · 2020-02-14T15:06:44Z

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/action/EqlSpecLoader.java

+
+    private static String[] readArray(String line) throws Exception {
+        line = readValueLine(line);
+        if (!line.startsWith("[") && !line.endsWith("]")) {


nit: the preference in general is not to negate but instead use == false for clarity.

will update

this is no longer relevant, replacing with toml library

costin · 2020-02-14T15:08:35Z

x-pack/plugin/sql/build.gradle

@@ -26,6 +26,10 @@ configurations {

 archivesBaseName = 'x-pack-sql'

+test {
+  testLogging.showStandardStreams = true


will remove

nik9000 · 2020-02-14T16:26:32Z

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/action/EqlActionIT.java

+                }
+            }
+
+            if (supported) {


I think this test should use @ParametersFactory so each example becomes a test that we can address individually.

astefan

Good stuff. Left some comments.

astefan · 2020-02-13T16:35:41Z

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/EqlTestUtils.java

+            randomAlphaOfLength(16));
+    }
+
+    public static Tuple<String, String> pathAndName(String string) {


Is this method used anywhere?

No longer used indeed, will remove

astefan · 2020-02-14T15:00:04Z

...ck/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/action/AbstractEqlIntegTestCase.java

+    @Override
+    protected Settings nodeSettings(int nodeOrdinal) {
+        Settings.Builder settings = Settings.builder().put(super.nodeSettings(nodeOrdinal));
+        settings.put(XPackSettings.SECURITY_ENABLED.getKey(), false);


At one point we'll have to test EQL in a security enabled context as well, right?

Probably. Was following AbstractSqlIntegTestCase as example in this case.

astefan · 2020-02-14T15:38:51Z

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/plugin/EqlPlugin.java

+            );
+        }
+        return List.of(
+            new ActionHandler<>(XPackUsageFeatureAction.EQL, EqlUsageTransportAction.class),


@costin see #52328 for why those two action have to be registered. At least, for the moment.

astefan · 2020-02-14T15:42:05Z

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/action/EqlActionIT.java

+        InputStream is = EqlActionIT.class.getResourceAsStream("/endgame.dat");
+        BulkRequestBuilder bulkBuilder = client().prepareBulk();
+        try (BufferedReader reader = new BufferedReader(
+            new InputStreamReader(is, StandardCharsets.UTF_8))) {


Doesn't this line fit on the try ( one?

No longer relevant, replaced with the toml parser library

astefan · 2020-02-14T16:04:33Z

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/action/EqlActionIT.java

+            while ((line = reader.readLine()) != null) {
+                bulkBuilder.add(new IndexRequest(testIndexName).source(line.trim(), XContentType.JSON));
+            }
+            BulkResponse response = bulkBuilder.setRefreshPolicy(WriteRequest.RefreshPolicy.IMMEDIATE).get();


Import static for IMMEDIATE?

Seems like this is consistent with 100+ other places

astefan · 2020-02-14T16:22:08Z

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/action/EqlSpecLoader.java

+
+    private static String readString(String line, BufferedReader reader) throws Exception {
+        line = readValueLine(line);
+        String delim = "";


I don't think this initialization is necessary. A simple String delim; should be enough.

IDE was complaining on unitialized var delim otherwise

astefan · 2020-02-14T16:23:29Z

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/action/EqlSpecLoader.java

+        List<EqlSpec> testSpecs = new ArrayList<>();
+
+        EqlSpec spec = null;
+        try (BufferedReader reader = new BufferedReader(


Single try() line.

No longer relevant, replaced with toml parser.

astefan · 2020-02-14T16:27:49Z

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/action/EqlSpecLoader.java

+            }
+        }
+
+        if (StringUtil.isNullOrEmpty(delim)) {


There is a class org.elasticsearch.common.Strings that has the same method and I think we prefer that one.

No longer relevant, replaced with toml parser.

astefan · 2020-02-14T16:28:17Z

x-pack/plugin/eql/src/test/java/org/elasticsearch/xpack/eql/action/EqlSpecLoader.java

+    }
+
+    private static void validateAndAddSpec(List<EqlSpec> specs, EqlSpec spec, boolean supported) throws Exception {
+        if (StringUtil.isNullOrEmpty(spec.query)) {


Same here about Strings class.

astefan · 2020-02-14T16:30:52Z

x-pack/plugin/eql/src/main/java/org/elasticsearch/xpack/eql/action/EqlSearchResponse.java

@@ -71,6 +70,7 @@
 *         EqlSearchResponse.Hits hits = new EqlSearchResponse.Hits(null, null, counts, totals);
 *         EqlSearchResponse response = new EqlSearchResponse(hits, 5, false);
 */
+


Can you remove this, please?

Sure. It was initially useful to have while we were iterating on the response shape.

aleksmaus · 2020-02-18T18:51:37Z

@nik9000 replacing the manual toml parsing with io.ous:jtoml:2.0.0.
The other couple of libraries that I looked at depend on antlr4 4.7.1 which breaks compatibility with existing 4.5.3.

…ed toml parser library

rw-access · 2020-02-19T16:43:01Z

x-pack/plugin/eql/src/test/resources/endgame.json

@@ -0,0 +1,2531 @@
+{


nit: a more descriptive filename. i.e. endgame_mappings.json

rw-access · 2020-02-19T16:45:19Z

x-pack/plugin/eql/src/test/resources/endgame.ndjson

@@ -0,0 +1,102 @@
+{"user":{"group":{}},"host":{"os":{"platform":"windows","name":"Windows"},"ip":"127.0.0.1","hostname":"localhost","name":"localhost"},"event":{"module":"endgame","dataset":"esensor","action":"already_running","category":"process","kind":"event"},"labels":{"account_id":"f6c123dc-b6d9-4849-937b-08c444ce7d96","endpoint_id":"6a19472c-f0ab-4f3a-b83d-dc3698a5ff66"},"agent":{"type":"endgame","id":"6a19472c-f0ab-4f3a-b83d-dc3698a5ff66","version":"3.54.0"},"ecs":{"version":"1.1.0"},"@timestamp":0,"process":{"thread":{},"parent":{},"hash":{},"name":"System Idle Process"},"endgame":{"name":"localhost","eid":"6a19472c-f0ab-4f3a-b83d-dc3698a5ff66","MID":"","ip":"127.0.0.1","sver":"3.54.0","os_type":"windows","serial_event_id":1,"opcode":3,"event_type_full":"process_event","event_subtype_full":"already_running","timestamp":116444736000000000,"process_name":"System Idle Process","unique_pid":1,"xml_message":"","provider_name":"","provider_guid":"","channel_name":"","subject_user_sid":"","subject_user_name":"","subject_domain_name":"","subject_logon_id":"","target_domain_name":"","target_user_name":"","target_logon_id":"","ip_address":"","computer_name":"","privilege_list":"","logon_type":null,"system_thread_id":null,"system_pid":null,"system_process_name":"","query_name":"","query_type":null,"query_results":null,"metadata":{"collection_time":0}}}


the mappings are consistent with the data, but the queries are not. EQL is independent of ECS, so I think it's okay to leave the data in the same schema that it was in

using this format mostly in order to validate and work through any possible issues with covering our particular use case

that means we have to manually rewrite all of the queries though, which is likely more error prone.

Discussed with @rw-access on Slack.
Originally I was under impression that we will keep the queries/rules the same and use some internal mapping to adopt them for ECS. It looks like in the first iteration this will not be the case and the queries/rules will be rewritten for ECS.
I will update this PR to use the same flat json data from the original EQL tests and remove the ECS mapping template creation for now.

…L implementation

aleksmaus · 2020-02-19T20:19:25Z

Updated PR with the latest recommendations from @rw-access, also including @nik9000 suggestion to use @ParametersFactory for the test harness.

The fake response change was done in order to test the EQL validation harness imlementation. This code will be replaced once we have the actualy EQL implementation wired.

aleksmaus · 2020-02-20T03:25:13Z

Added a small adjustment after merging the latest master changes that included @imotov HL client test against the currently hardcoded EQL response. I changed the shape of the response for the first of the EQL validation harness test queries expected response, while Igor was working on HL client.

astefan

LGTM

aleksmaus · 2020-02-21T22:22:39Z

Had to merge master again and resolve conflicts. Will merge once it clears CI build.

…iginal implementation (elastic#52248) The tests use the original test queries from https://github.com/endgameinc/eql/blob/master/eql/etc/test_queries.toml for EQL implementation correctness validation. The file test_queries_unsupported.toml serves as a "blacklist" for the queries that we do not support. Currently all of the queries are blacklisted. Over the time the expectation is to eventually have an empty "blacklist" when all of the queries are fully supported. The tests use the original test vector from https://raw.githubusercontent.com/endgameinc/eql/master/eql/etc/test_data.json. Only one EQL and the response is stubbed for now to match the expected output from that query. This part would need some tweaking after EQL is fully wired. Related to elastic#49581

…iginal implementation (#52248) (#52675) The tests use the original test queries from https://github.com/endgameinc/eql/blob/master/eql/etc/test_queries.toml for EQL implementation correctness validation. The file test_queries_unsupported.toml serves as a "blacklist" for the queries that we do not support. Currently all of the queries are blacklisted. Over the time the expectation is to eventually have an empty "blacklist" when all of the queries are fully supported. The tests use the original test vector from https://raw.githubusercontent.com/endgameinc/eql/master/eql/etc/test_data.json. Only one EQL and the response is stubbed for now to match the expected output from that query. This part would need some tweaking after EQL is fully wired. Related to #49581

aleksmaus added the :Analytics/EQL EQL querying label Feb 12, 2020

aleksmaus requested a review from imotov February 12, 2020 02:55

aleksmaus requested a review from costin February 12, 2020 14:25

aleksmaus force-pushed the feature/eql_validation_tests branch from f944369 to 032b699 Compare February 12, 2020 14:44

aleksmaus force-pushed the feature/eql_validation_tests branch from 032b699 to 47aaef7 Compare February 12, 2020 15:08

rw-access reviewed Feb 12, 2020

View reviewed changes

Rollback this PR change that caused the failure in telemetry checks

8631384

costin requested a review from astefan February 12, 2020 16:38

Fix code formatting

cd4a55d

aleksmaus marked this pull request as ready for review February 13, 2020 14:21

Test the Andrei's suggested change to still support telemetry and put…

7edf6c7

… the plugin actions behind the feature flag

aleksmaus force-pushed the feature/eql_validation_tests branch from 9b14a36 to 7edf6c7 Compare February 13, 2020 14:51

imotov reviewed Feb 13, 2020

View reviewed changes

nik9000 reviewed Feb 14, 2020

View reviewed changes

costin reviewed Feb 14, 2020

View reviewed changes

nik9000 reviewed Feb 14, 2020

View reviewed changes

astefan reviewed Feb 14, 2020

View reviewed changes

aleksmaus added 2 commits February 18, 2020 14:44

Addressed code review. Replaced manual toml parser with Apache licens…

b6b7f53

…ed toml parser library

Merge branch 'master' into feature/eql_validation_tests

595f316

rw-access reviewed Feb 19, 2020

View reviewed changes

aleksmaus added 2 commits February 19, 2020 14:21

Replace the ECS test data with the flat json test data from origin EQ…

9f3da81

…L implementation

Convert EqlActionIT to parameterized test

09260e6

aleksmaus added 2 commits February 19, 2020 21:34

Merge branch 'master' into feature/eql_validation_tests

2d6111f

Adjust the HL client test for a change in emulated EQL search response.

6db4617

The fake response change was done in order to test the EQL validation harness imlementation. This code will be replaced once we have the actualy EQL implementation wired.

Addressed Ross' remaining code review comment

384cfd8

aleksmaus force-pushed the feature/eql_validation_tests branch from efb551b to 384cfd8 Compare February 20, 2020 15:04

astefan approved these changes Feb 21, 2020

View reviewed changes

Merge branch 'master' into feature/eql_validation_tests

54035b1

aleksmaus merged commit e06f2af into elastic:master Feb 22, 2020

astefan added the backport pending label Feb 24, 2020

		@@ -0,0 +1,102 @@
		{"user":{"group":{}},"host":{"os":{"platform":"windows","name":"Windows"},"ip":"127.0.0.1","hostname":"localhost","name":"localhost"},"event":{"module":"endgame","dataset":"esensor","action":"already_running","category":"process","kind":"event"},"labels":{"account_id":"f6c123dc-b6d9-4849-937b-08c444ce7d96","endpoint_id":"6a19472c-f0ab-4f3a-b83d-dc3698a5ff66"},"agent":{"type":"endgame","id":"6a19472c-f0ab-4f3a-b83d-dc3698a5ff66","version":"3.54.0"},"ecs":{"version":"1.1.0"},"@timestamp":0,"process":{"thread":{},"parent":{},"hash":{},"name":"System Idle Process"},"endgame":{"name":"localhost","eid":"6a19472c-f0ab-4f3a-b83d-dc3698a5ff66","MID":"","ip":"127.0.0.1","sver":"3.54.0","os_type":"windows","serial_event_id":1,"opcode":3,"event_type_full":"process_event","event_subtype_full":"already_running","timestamp":116444736000000000,"process_name":"System Idle Process","unique_pid":1,"xml_message":"","provider_name":"","provider_guid":"","channel_name":"","subject_user_sid":"","subject_user_name":"","subject_domain_name":"","subject_logon_id":"","target_domain_name":"","target_user_name":"","target_logon_id":"","ip_address":"","computer_name":"","privilege_list":"","logon_type":null,"system_thread_id":null,"system_pid":null,"system_process_name":"","query_name":"","query_type":null,"query_results":null,"metadata":{"collection_time":0}}}

EQL: Add integration tests harness to test EQL feature parity with original implementation #52248

EQL: Add integration tests harness to test EQL feature parity with original implementation #52248

Conversation

aleksmaus commented Feb 12, 2020 • edited Loading

elasticmachine commented Feb 12, 2020

aleksmaus commented Feb 12, 2020

Choose a reason for hiding this comment

aleksmaus Feb 12, 2020 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

imotov left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aleksmaus commented Feb 14, 2020

nik9000 left a comment

Choose a reason for hiding this comment

costin left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

astefan left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aleksmaus commented Feb 18, 2020

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aleksmaus Feb 19, 2020 • edited Loading

Choose a reason for hiding this comment

aleksmaus commented Feb 19, 2020

aleksmaus commented Feb 20, 2020

astefan left a comment

Choose a reason for hiding this comment

aleksmaus commented Feb 21, 2020

aleksmaus commented Feb 12, 2020 •

edited

Loading

aleksmaus Feb 12, 2020 •

edited

Loading

aleksmaus Feb 19, 2020 •

edited

Loading