add Cypress test

elastic · Mar 4, 2024 · 88ffafe · 88ffafe
1 parent 25ab821
commit 88ffafe
Show file tree

Hide file tree

Showing 2 changed files with 45 additions and 2 deletions.
diff --git a/...cypress/cypress/e2e/detection_response/detection_engine/rule_creation/esql_rule_ess.cy.ts b/...cypress/cypress/e2e/detection_response/detection_engine/rule_creation/esql_rule_ess.cy.ts
@@ -7,7 +7,11 @@
 
 import { getEsqlRule } from '../../../../objects/rule';
 
-import { RULES_MANAGEMENT_TABLE, RULE_NAME } from '../../../../screens/alerts_detection_rules';
+import {
+  RULES_MANAGEMENT_TABLE,
+  RULE_NAME,
+  INVESTIGATION_FIELDS_VALUE_ITEM,
+} from '../../../../screens/alerts_detection_rules';
 import {
   RULE_NAME_HEADER,
   RULE_TYPE_DETAILS,
@@ -29,6 +33,11 @@ import {
   fillEsqlQueryBar,
   fillAboutSpecificEsqlRuleAndContinue,
   createRuleWithoutEnabling,
+  expandAdvancedSettings,
+  fillCustomInvestigationFields,
+  fillRuleName,
+  fillDescription,
+  getAboutContinueButton,
 } from '../../../../tasks/create_new_rule';
 import { login } from '../../../../tasks/login';
 import { visit } from '../../../../tasks/navigation';
@@ -176,4 +185,38 @@ describe('Detection ES|QL rules, creation', { tags: ['@ess'] }, () => {
       cy.get(ESQL_QUERY_BAR).contains('Error validating ES|QL');
     });
   });
+
+  describe('ES|QL investigation fields', () => {
+    beforeEach(() => {
+      login();
+      visit(CREATE_RULE_URL);
+    });
+    it('shows custom ES|QL field in investigation fields autocomplete and saves it in rule', function () {
+      const CUSTOM_ESQL_FIELD = '_custom_agent_name';
+      const queryWithCustomFields = [
+        `from auditbeat* [metadata _id, _version, _index]`,
+        `eval ${CUSTOM_ESQL_FIELD} = agent.name`,
+        `keep _id, _custom_agent_name`,
+        `limit 5`,
+      ].join(' | ');
+
+      workaroundForResizeObserver();
+
+      selectEsqlRuleType();
+      expandEsqlQueryBar();
+      fillEsqlQueryBar(queryWithCustomFields);
+      getDefineContinueButton().click();
+
+      expandAdvancedSettings();
+      fillRuleName();
+      fillDescription();
+      fillCustomInvestigationFields([CUSTOM_ESQL_FIELD]);
+      getAboutContinueButton().click();
+
+      fillScheduleRuleAndContinue(rule);
+      createRuleWithoutEnabling();
+
+      cy.get(INVESTIGATION_FIELDS_VALUE_ITEM).should('have.text', CUSTOM_ESQL_FIELD);
+    });
+  });
 });
diff --git a/x-pack/test/security_solution_cypress/cypress/tasks/create_new_rule.ts b/x-pack/test/security_solution_cypress/cypress/tasks/create_new_rule.ts
@@ -684,7 +684,7 @@ export const getIndicatorAtLeastOneInvalidationText = () => cy.contains(AT_LEAST
 export const getIndexPatternInvalidationText = () => cy.contains(AT_LEAST_ONE_INDEX_PATTERN);
 
 /** Returns the continue button on the step of about */
-const getAboutContinueButton = () => cy.get(ABOUT_CONTINUE_BTN);
+export const getAboutContinueButton = () => cy.get(ABOUT_CONTINUE_BTN);
 
 /** Returns the continue button on the step of define */
 export const getDefineContinueButton = () => cy.get(DEFINE_CONTINUE_BUTTON);