import expect from '@kbn/expect' ; import { DETECTION_ENGINE_RULES_URL } from '../../../../plugins/security_solution/common/constants' ; import { FtrProviderContext } from '../../common/ftr_provider_context' ; import { createSignalsIndex , deleteAllAlerts , deleteSignalsIndex , getSimpleRuleOutput , removeServerGeneratedProperties , removeServerGeneratedPropertiesIncludingRuleId , getSimpleRuleOutputWithoutRuleId , getSimpleMlRule , getSimpleMlRuleOutput , getSimpleRuleUpdate , getSimpleMlRuleUpdate , createRule , getSimpleRule , createLegacyRuleAction , } from '../../utils' ; export default ( { getService } ) => { const supertest = getService ( 'supertest' ) ; const log = getService ( 'log' ) ; describe ( 'update_rules' , ( ) => { describe ( 'update rules' , ( ) => { beforeEach ( async ( ) => { await createSignalsIndex ( supertest , log ) ; } ) ; afterEach ( async ( ) => { await deleteSignalsIndex ( supertest , log ) ; await deleteAllAlerts ( supertest , log ) ; } ) ; it ( 'should update a single rule property of name using a rule_id' , async ( ) => { await createRule ( supertest , log , getSimpleRule ( 'rule-1' ) ) ; const updatedRule = getSimpleRuleUpdate ( 'rule-1' ) ; updatedRule . rule_id = 'rule-1' ; updatedRule . name = 'some other name' ; delete updatedRule . id ; const { body } = await supertest . put ( DETECTION_ENGINE_RULES_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( updatedRule ) . expect ( 200 ) ; const outputRule = getSimpleRuleOutput ( ) ; outputRule . name = 'some other name' ; outputRule . version = 2 ; const bodyToCompare = removeServerGeneratedProperties ( body ) ; expect ( bodyToCompare ) . to . eql ( outputRule ) ; } ) ; it ( "should update a rule's machine learning job ID if given a legacy job ID format" , async ( ) => { await createRule ( supertest , log , getSimpleMlRule ( 'rule-1' ) ) ; const updatedRule = getSimpleMlRuleUpdate ( 'rule-1' ) ; updatedRule . machine_learning_job_id = 'legacy_job_id' ; delete updatedRule . id ; const { body } = await supertest . put ( DETECTION_ENGINE_RULES_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( updatedRule ) . expect ( 200 ) ; const outputRule = getSimpleMlRuleOutput ( ) ; outputRule . machine_learning_job_id = [ 'legacy_job_id' ] ; outputRule . version = 2 ; const bodyToCompare = removeServerGeneratedProperties ( body ) ; expect ( bodyToCompare ) . to . eql ( outputRule ) ; } ) ; it ( 'should update a single rule property of name using a rule_id with a machine learning job' , async ( ) => { await createRule ( supertest , log , getSimpleMlRule ( 'rule-1' ) ) ; const updatedRule = getSimpleMlRuleUpdate ( 'rule-1' ) ; updatedRule . rule_id = 'rule-1' ; updatedRule . name = 'some other name' ; delete updatedRule . id ; const { body } = await supertest . put ( DETECTION_ENGINE_RULES_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( updatedRule ) . expect ( 200 ) ; const outputRule = getSimpleMlRuleOutput ( ) ; outputRule . name = 'some other name' ; outputRule . version = 2 ; const bodyToCompare = removeServerGeneratedProperties ( body ) ; expect ( bodyToCompare ) . to . eql ( outputRule ) ; } ) ; it ( 'should update a single rule property of name using an auto-generated rule_id' , async ( ) => { const rule = getSimpleRule ( 'rule-1' ) ; delete rule . rule_id ; const createRuleBody = await createRule ( supertest , log , rule ) ; const updatedRule = getSimpleRuleUpdate ( 'rule-1' ) ; updatedRule . rule_id = createRuleBody . rule_id ; updatedRule . name = 'some other name' ; delete updatedRule . id ; const { body } = await supertest . put ( DETECTION_ENGINE_RULES_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( updatedRule ) . expect ( 200 ) ; const outputRule = getSimpleRuleOutputWithoutRuleId ( ) ; outputRule . name = 'some other name' ; outputRule . version = 2 ; const bodyToCompare = removeServerGeneratedPropertiesIncludingRuleId ( body ) ; expect ( bodyToCompare ) . to . eql ( outputRule ) ; } ) ; it ( 'should update a single rule property and remove the action' , async ( ) => { const [ connector1 ] = await Promise . all ( [ supertest . post ( `/api/actions/connector` ) . set ( 'kbn-xsrf' , 'foo' ) . send ( { name : 'My action' , connector_type_id : '.slack' , secrets : { webhookUrl : 'http://localhost:1234' , } , } ) , ] ) ; const action1 = { group : 'default' , id : connector1 . body . id , action_type_id : connector1 . body . connector_type_id , params : { message : 'message' , } , } ; const ruleWithConnector = { ... getSimpleRule ( 'rule-1' ) , actions : [ action1 ] , } ; const createdRule = await createRule ( supertest , log , ruleWithConnector ) ; expect ( createdRule . actions . length ) . to . eql ( 1 ) ; const updatedRule = getSimpleRuleUpdate ( 'rule-1' ) ; updatedRule . rule_id = ruleWithConnector . rule_id ; updatedRule . name = 'some other name' ; delete updatedRule . id ; const { body } = await supertest . put ( DETECTION_ENGINE_RULES_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( updatedRule ) . expect ( 200 ) ; const outputRule = getSimpleRuleOutputWithoutRuleId ( ) ; outputRule . name = 'some other name' ; outputRule . version = 2 ; outputRule . actions = [ ] ; outputRule . throttle = 'no_actions' ; const bodyToCompare = removeServerGeneratedPropertiesIncludingRuleId ( body ) ; expect ( bodyToCompare ) . to . eql ( outputRule ) ; } ) ; it ( 'should update a single rule property of name using an auto-generated rule_id and migrate the actions' , async ( ) => { const rule = getSimpleRule ( 'rule-1' ) ; delete rule . rule_id ; const [ connector , createRuleBody ] = await Promise . all ( [ supertest . post ( `/api/actions/connector` ) . set ( 'kbn-xsrf' , 'foo' ) . send ( { name : 'My action' , connector_type_id : '.slack' , secrets : { webhookUrl : 'http://localhost:1234' , } , } ) , createRule ( supertest , log , rule ) , ] ) ; await createLegacyRuleAction ( supertest , createRuleBody . id , connector . body . id ) ; const action1 = { group : 'default' , id : connector . body . id , action_type_id : connector . body . connector_type_id , params : { message : 'Hourly\nRule {{context.rule.name}} generated {{state.signals_count}} alerts' , } , } ; const updatedRule = getSimpleRuleUpdate ( 'rule-1' ) ; updatedRule . rule_id = createRuleBody . rule_id ; updatedRule . name = 'some other name' ; updatedRule . actions = [ action1 ] ; updatedRule . throttle = '1m' ; delete updatedRule . id ; const { body } = await supertest . put ( DETECTION_ENGINE_RULES_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( updatedRule ) . expect ( 200 ) ; const outputRule = getSimpleRuleOutputWithoutRuleId ( ) ; outputRule . name = 'some other name' ; outputRule . version = 2 ; outputRule . actions = [ { action_type_id : '.slack' , group : 'default' , id : connector . body . id , params : { message : 'Hourly\nRule {{context.rule.name}} generated {{state.signals_count}} alerts' , } , } , ] ; outputRule . throttle = '1m' ; const bodyToCompare = removeServerGeneratedPropertiesIncludingRuleId ( body ) ; expect ( bodyToCompare ) . to . eql ( outputRule ) ; } ) ; it ( 'should update a single rule property of name using the auto-generated id' , async ( ) => { const createdBody = await createRule ( supertest , log , getSimpleRule ( 'rule-1' ) ) ; const updatedRule = getSimpleRuleUpdate ( 'rule-1' ) ; updatedRule . name = 'some other name' ; updatedRule . id = createdBody . id ; delete updatedRule . rule_id ; const { body } = await supertest . put ( DETECTION_ENGINE_RULES_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( updatedRule ) . expect ( 200 ) ; const outputRule = getSimpleRuleOutput ( ) ; outputRule . name = 'some other name' ; outputRule . version = 2 ; const bodyToCompare = removeServerGeneratedProperties ( body ) ; expect ( bodyToCompare ) . to . eql ( outputRule ) ; } ) ; it ( 'should change the version of a rule when it updates enabled and another property' , async ( ) => { await createRule ( supertest , log , getSimpleRule ( 'rule-1' ) ) ; const updatedRule = getSimpleRuleUpdate ( 'rule-1' ) ; updatedRule . severity = 'low' ; updatedRule . enabled = false ; const { body } = await supertest . put ( DETECTION_ENGINE_RULES_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( updatedRule ) . expect ( 200 ) ; const outputRule = getSimpleRuleOutput ( ) ; outputRule . enabled = false ; outputRule . severity = 'low' ; outputRule . version = 2 ; const bodyToCompare = removeServerGeneratedProperties ( body ) ; expect ( bodyToCompare ) . to . eql ( outputRule ) ; } ) ; it ( 'should change other properties when it does updates and effectively delete them such as timeline_title' , async ( ) => { await createRule ( supertest , log , getSimpleRule ( 'rule-1' ) ) ; const ruleUpdate = getSimpleRuleUpdate ( 'rule-1' ) ; ruleUpdate . timeline_title = 'some title' ; ruleUpdate . timeline_id = 'some id' ; await supertest . put ( DETECTION_ENGINE_RULES_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( ruleUpdate ) . expect ( 200 ) ; const ruleUpdate2 = getSimpleRuleUpdate ( 'rule-1' ) ; ruleUpdate2 . name = 'some other name' ; const { body } = await supertest . put ( DETECTION_ENGINE_RULES_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( ruleUpdate2 ) . expect ( 200 ) ; const outputRule = getSimpleRuleOutput ( ) ; outputRule . name = 'some other name' ; outputRule . version = 3 ; const bodyToCompare = removeServerGeneratedProperties ( body ) ; expect ( bodyToCompare ) . to . eql ( outputRule ) ; } ) ; it ( 'should give a 404 if it is given a fake id' , async ( ) => { const simpleRule = getSimpleRuleUpdate ( ) ; simpleRule . id = '5096dec6-b6b9-4d8d-8f93-6c2602079d9d' ; delete simpleRule . rule_id ; const { body } = await supertest . put ( DETECTION_ENGINE_RULES_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( simpleRule ) . expect ( 404 ) ; expect ( body ) . to . eql ( { status_code : 404 , message : 'id: "5096dec6-b6b9-4d8d-8f93-6c2602079d9d" not found' , } ) ; } ) ; it ( 'should give a 404 if it is given a fake rule_id' , async ( ) => { const simpleRule = getSimpleRuleUpdate ( ) ; simpleRule . rule_id = 'fake_id' ; delete simpleRule . id ; const { body } = await supertest . put ( DETECTION_ENGINE_RULES_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( simpleRule ) . expect ( 404 ) ; expect ( body ) . to . eql ( { status_code : 404 , message : 'rule_id: "fake_id" not found' , } ) ; } ) ; } ) ; } ) ; } ;