[Security Solution][RAC][Cypress] Unskip some tests #117596

madirey · 2021-11-04T20:52:42Z

Summary

Critical fixes for 8.0

EQL alert generation: Ensures parent alert does not have a building_block_type and sets kibana.alert.original_time to the timestamp of the first event in the sequence.
Updates several references in the UI code to support both legacy siem.signals (for backward compatibility) and new AAD fields in alerts
Reenables tests that were either fixed by the above, or fixed prior to this PR. See Unskip tests for RAC rule migration #116460

Checklist

Delete any items that are not applicable to this PR.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Unit or functional tests were updated or added to match the most common scenarios

For maintainers

This was checked for breaking API changes and was labeled appropriately

elasticmachine · 2021-11-10T19:34:11Z

Pinging @elastic/security-solution (Team: SecuritySolution)

madirey · 2021-11-18T15:44:54Z

@elasticmachine merge upstream

kibanamachine · 2021-11-18T15:44:56Z

merge conflict between base and head

ecezalp

LGTM - left a few comments for my own understanding, code looks great

ecezalp · 2021-11-18T15:53:29Z

...plugins/security_solution/cypress/integration/detection_rules/event_correlation_rule.spec.ts

@@ -219,7 +219,6 @@ describe('Detection rules, sequence EQL', () => {
        cy.log('ALERT_DATA_GRID', text);
        expect(text).contains(this.rule.name);
        expect(text).contains(this.rule.severity.toLowerCase());
-        expect(text).contains(this.rule.riskScore);


is there a particular reason we are removing the riskScore checks

ecezalp · 2021-11-18T15:54:49Z

...lugins/security_solution/public/common/components/event_details/investigation_guide_view.tsx

@@ -25,7 +26,7 @@ const InvestigationGuideViewComponent: React.FC<{
  data: TimelineEventsDetailsItem[];
 }> = ({ data }) => {
  const ruleId = useMemo(() => {
-    const item = data.find((d) => d.field === 'signal.rule.id');
+    const item = data.find((d) => d.field === 'signal.rule.id' || d.field === ALERT_RULE_UUID);


why do we have an or here? don't we need just d.field === ALERT_RULE_UUID

ecezalp · 2021-11-18T15:57:42Z

x-pack/plugins/security_solution/public/common/components/event_details/reason.tsx

-    [data]
-  );
+  const ruleId = useMemo(() => {
+    const siemSignalsRuleId = getFieldValue({ category: 'signal', field: 'signal.rule.id' }, data);


so rules continue to have signal.rule.id - does that include newly created rules in 8.0 as well?

ecezalp · 2021-11-18T16:07:33Z

x-pack/plugins/security_solution/public/detections/components/host_isolation/helpers.ts

+      : category === 'kibana'
+      ? field.replace('kibana.alert', 'signal').replace('rule.uuid', 'rule.id')
+      : field;
+  return (


I think it's coming together now. We keep both versions and search for each if we can't find one or the other. very interesting

ecezalp · 2021-11-18T16:09:25Z

...solution/public/detections/configurations/examples/observablity_alerts/render_cell_value.tsx

@@ -53,9 +58,12 @@ export const RenderCellValue: React.FC<EuiDataGridCellValueElementProps & CellVa
          <Status data-test-subj="alert-status" status={random(0, 1) ? 'recovered' : 'active'} />
        );
      case ALERT_DURATION:
+      case 'signal.duration.us':


it would be nice if the older versions were consts as well

ecezalp · 2021-11-18T16:10:14Z

...ck/plugins/security_solution/public/timelines/components/side_panel/event_details/footer.tsx

-      () => find({ category: 'signal', field: 'signal.rule.index' }, detailsData)?.values,
+      () =>
+        find({ category: 'signal', field: 'signal.rule.index' }, detailsData)?.values ??
+        find({ category: 'kibana', field: 'kibana.alert.rule.index' }, detailsData)?.values,


is there an ALERT_RULE_INDEX?

ecezalp · 2021-11-18T16:11:10Z

...urity_solution/public/timelines/components/timeline/cell_rendering/default_cell_renderer.tsx

@@ -18,7 +18,7 @@ import {
  StyledContent,
 } from '../../../../common/lib/cell_actions/expanded_cell_value_actions';

-const FIELDS_WITHOUT_CELL_ACTIONS = ['signal.rule.risk_score', 'signal.reason'];
+const FIELDS_WITHOUT_CELL_ACTIONS = ['kibana.alert.rule.risk_score', 'kibana.alert.reason'];


interesting, so for the cells the data only appears with the new field name (even if it might be read from an older field)?

madirey · 2021-11-18T21:03:21Z

jenkins test this

madirey · 2021-11-18T21:03:57Z

@elasticmachine merge upstream

michaelolo24

Tested with @MadameSheema. Thanks @madirey !

kibana-ci · 2021-11-23T20:28:23Z

💛 Build succeeded, but was flaky

Test Failures

[job] [logs] Security Solution Tests / Detection rules, machine learning "before each" hook for "Creates and activates a new ml rule"

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	2754	2758	+4

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	4.5MB	4.5MB	+3.0KB
`timelines`	202.3KB	202.5KB	+221.0B
total			+3.2KB

History

💔 Build #8741 failed afb25e9
💔 Build #8722 failed 38b1b52
💚 Build #7821 succeeded 740111c
💛 Build #7707 was flaky a42166a
💚 Build #7032 succeeded 896621d

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

* Reenable cypress tests for rules * Indicator match is not yet passing * Update refs * Fix eql alert generation original_time and building_block_type * Unskip a few more tests * Update field names in jest tests * Fix unit tests / cypress tests * Have to keep this one skipped for now * Fix some more tests? * cleanup * Fix translation

kibanamachine · 2021-11-23T20:31:45Z

💚 Backport successful

Status	Branch	Result
✅	8.0

This backport PR will be merged automatically after passing CI.

* Reenable cypress tests for rules * Indicator match is not yet passing * Update refs * Fix eql alert generation original_time and building_block_type * Unskip a few more tests * Update field names in jest tests * Fix unit tests / cypress tests * Have to keep this one skipped for now * Fix some more tests? * cleanup * Fix translation Co-authored-by: Madison Caldwell <[email protected]>

* Reenable cypress tests for rules * Indicator match is not yet passing * Update refs * Fix eql alert generation original_time and building_block_type * Unskip a few more tests * Update field names in jest tests * Fix unit tests / cypress tests * Have to keep this one skipped for now * Fix some more tests? * cleanup * Fix translation

Reenable cypress tests for rules

9c5c4cf

madirey added v8.0.0 release_note:skip Skip the PR/issue when compiling release notes Team:Detection Alerts Security Detection Alerts Area Team labels Nov 4, 2021

madirey requested a review from a team as a code owner November 4, 2021 20:52

madirey changed the title ~~[Security Solution][RAC][Cypress]~~ [Security Solution][RAC][Cypress] Unskip tests Nov 4, 2021

madirey added the auto-backport Deprecated - use backport:version if exact versions are needed label Nov 4, 2021

madirey added 4 commits November 4, 2021 19:46

Indicator match is not yet passing

4502afa

Merge branch 'main' of github.com:elastic/kibana into unskip-aad-tests

ea9ffc9

Merge branch 'main' of github.com:elastic/kibana into unskip-aad-tests

847ee6a

Update refs

7f4f2cd

madirey requested a review from a team as a code owner November 9, 2021 20:18

madirey added 4 commits November 9, 2021 15:18

Merge branch 'main' of github.com:elastic/kibana into unskip-aad-tests

4208753

Fix eql alert generation original_time and building_block_type

39b682d

Merge branch 'main' of github.com:elastic/kibana into unskip-aad-tests

e7598b0

Unskip a few more tests

9102699

madirey added the Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. label Nov 10, 2021

madirey changed the title ~~[Security Solution][RAC][Cypress] Unskip tests~~ [WIP][Security Solution][RAC][Cypress] Unskip tests Nov 10, 2021

madirey added 7 commits November 10, 2021 15:26

Update field names in jest tests

caa573e

Fix unit tests / cypress tests

accc297

Merge branch 'main' of github.com:elastic/kibana into unskip-aad-tests

80f1353

Have to keep this one skipped for now

7f17b0c

Fix some more tests?

a9aaaad

cleanup

025e2c6

Merge branch 'main' of github.com:elastic/kibana into unskip-aad-tests

eb65f8a

elastic deleted a comment from kibanamachine Nov 16, 2021

madirey added 2 commits November 16, 2021 09:41

Merge branch 'main' of github.com:elastic/kibana into unskip-aad-tests

6239eea

Fix translation

896621d

madirey mentioned this pull request Nov 16, 2021

Unskip tests for RAC rule migration #116460

Closed

20 tasks

madirey changed the title ~~[WIP][Security Solution][RAC][Cypress] Unskip tests~~ [Security Solution][RAC][Cypress] Unskip tests Nov 16, 2021

madirey requested a review from marshallmain November 16, 2021 17:15

madirey added the v8.1.0 label Nov 16, 2021

Merge branch 'main' of github.com:elastic/kibana into unskip-aad-tests

a42166a

madirey changed the title ~~[Security Solution][RAC][Cypress] Unskip tests~~ [Security Solution][RAC][Cypress] Unskip some tests Nov 18, 2021

ecezalp approved these changes Nov 18, 2021

View reviewed changes

madirey enabled auto-merge (squash) November 18, 2021 20:36

kibanamachine and others added 4 commits November 18, 2021 16:04

Merge branch 'main' into unskip-aad-tests

740111c

Merge branch 'main' into unskip-aad-tests

38b1b52

fixes conflict issue

afb25e9

remove unused code and added signal refs

2c1a31c

michaelolo24 approved these changes Nov 23, 2021

View reviewed changes

madirey merged commit c3484ae into elastic:main Nov 23, 2021

kibanamachine mentioned this pull request Nov 23, 2021

[8.0] [Security Solution][RAC][Cypress] Unskip some tests (#117596) #119542

Merged

madirey deleted the unskip-aad-tests branch November 29, 2021 14:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[Security Solution][RAC][Cypress] Unskip some tests #117596

[Security Solution][RAC][Cypress] Unskip some tests #117596

madirey commented Nov 4, 2021 •

edited

Loading

elasticmachine commented Nov 10, 2021

madirey commented Nov 18, 2021

kibanamachine commented Nov 18, 2021

ecezalp left a comment

ecezalp Nov 18, 2021

ecezalp Nov 18, 2021

ecezalp Nov 18, 2021

ecezalp Nov 18, 2021

ecezalp Nov 18, 2021

ecezalp Nov 18, 2021

ecezalp Nov 18, 2021

madirey commented Nov 18, 2021

madirey commented Nov 18, 2021

michaelolo24 left a comment

kibana-ci commented Nov 23, 2021

kibanamachine commented Nov 23, 2021

[Security Solution][RAC][Cypress] Unskip some tests #117596

[Security Solution][RAC][Cypress] Unskip some tests #117596

Conversation

madirey commented Nov 4, 2021 • edited Loading

Summary

Critical fixes for 8.0

Checklist

For maintainers

elasticmachine commented Nov 10, 2021

madirey commented Nov 18, 2021

kibanamachine commented Nov 18, 2021

ecezalp left a comment

Choose a reason for hiding this comment

ecezalp Nov 18, 2021

Choose a reason for hiding this comment

ecezalp Nov 18, 2021

Choose a reason for hiding this comment

ecezalp Nov 18, 2021

Choose a reason for hiding this comment

ecezalp Nov 18, 2021

Choose a reason for hiding this comment

ecezalp Nov 18, 2021

Choose a reason for hiding this comment

ecezalp Nov 18, 2021

Choose a reason for hiding this comment

ecezalp Nov 18, 2021

Choose a reason for hiding this comment

madirey commented Nov 18, 2021

madirey commented Nov 18, 2021

michaelolo24 left a comment

Choose a reason for hiding this comment

kibana-ci commented Nov 23, 2021

💛 Build succeeded, but was flaky

Test Failures

Metrics [docs]

Module Count

Async chunks

History

kibanamachine commented Nov 23, 2021

💚 Backport successful

madirey commented Nov 4, 2021 •

edited

Loading