import { errors } from '@elastic/elasticsearch' ; import { Client } from '@elastic/elasticsearch' ; import { FtrService } from '../../functional/ftr_provider_context' ; import { metadataCurrentIndexPattern , metadataTransformPrefix , } from '../../../plugins/security_solution/common/endpoint/constants' ; import { deleteIndexedHostsAndAlerts , IndexedHostsAndAlertsResponse , indexHostsAndAlerts , } from '../../../plugins/security_solution/common/endpoint/index_data' ; import { TransformConfigUnion } from '../../../plugins/transform/common/types/transform' ; import { GetTransformsResponseSchema } from '../../../plugins/transform/common/api_schemas/transforms' ; import { catchAndWrapError } from '../../../plugins/security_solution/server/endpoint/utils' ; import { installOrUpgradeEndpointFleetPackage } from '../../../plugins/security_solution/common/endpoint/data_loaders/setup_fleet_for_endpoint' ; import { EndpointError } from '../../../plugins/security_solution/common/endpoint/errors' ; export class EndpointTestResources extends FtrService { private readonly esClient = this . ctx . getService ( 'es' ) ; private readonly retry = this . ctx . getService ( 'retry' ) ; private readonly kbnClient = this . ctx . getService ( 'kibanaServer' ) ; private readonly transform = this . ctx . getService ( 'transform' ) ; private generateTransformId ( endpointPackageVersion ? ) { return `${ metadataTransformPrefix }-${ endpointPackageVersion ?? '' }` ; } param endpointPackageVersion async getTransform ( endpointPackageVersion ? ) { const transformId = this . generateTransformId ( endpointPackageVersion ) ; let transform ; if ( endpointPackageVersion ) { await this . transform . api . waitForTransformToExist ( transformId ) ; transform = ( ( await this . transform . api . getTransform ( transformId ) . catch ( catchAndWrapError ) . then ( ( response ) => response ) ) . body as GetTransformsResponseSchema ) . transforms [ 0 ] ; } else { transform = ( await this . transform . api . getTransformList ( 100 ) . catch ( catchAndWrapError ) ) . transforms . find ( ( t ) => t . id . startsWith ( transformId ) ) ; } if ( ! transform ) { throw new EndpointError ( 'Endpoint metadata transform not found' ) ; } return transform ; } async setMetadataTransformFrequency ( frequency , /** Used to update the transform installed with the given package version */ endpointPackageVersion ? ) { const transform = await this . getTransform ( endpointPackageVersion ) . catch ( catchAndWrapError ) ; await this . transform . api . updateTransform ( transform . id , { frequency } ) . catch ( catchAndWrapError ) ; } param options param options . numHosts param options . numHostDocs param options . alertsPerHost param options . enableFleetIntegration param options . generatorSeed param options . waitUntilTransformed async loadEndpointData ( options = { } ) { const { numHosts = 1 , numHostDocs = 1 , alertsPerHost = 1 , enableFleetIntegration = true , logsEndpoint = false , generatorSeed = 'seed' , waitUntilTransformed = true , } = options ; const indexedData = await indexHostsAndAlerts ( this . esClient as Client , this . kbnClient , generatorSeed , numHosts , numHostDocs , 'metrics-endpoint.metadata-default' , 'metrics-endpoint.policy-default' , 'logs-endpoint.events.process-default' , 'logs-endpoint.alerts-default' , alertsPerHost , enableFleetIntegration , logsEndpoint ) ; if ( waitUntilTransformed ) { await this . waitForEndpoints ( indexedData . hosts . map ( ( host ) => host . agent . id ) ) ; } return indexedData ; } param indexedData async unloadEndpointData ( indexedData ) { return deleteIndexedHostsAndAlerts ( this . esClient as Client , this . kbnClient , indexedData ) ; } param ids async waitForEndpoints ( ids = [ ] ) { const body = ids . length ? { query : { bool : { filter : [ { terms : { 'agent.id' : ids , } , } , ] , } , } , } : { query : { match_all : { } , } , } ; const size = ids . length || 1 ; await this . retry . waitFor ( 'endpoint hosts' , async ( ) => { try { const searchResponse = await this . esClient . search ( { index : metadataCurrentIndexPattern , size , body , rest_total_hits_as_int : true , } ) ; return searchResponse . hits . total === size ; } catch ( error ) { if ( error instanceof errors . ResponseError && error . statusCode === 404 ) { return false ; } throw new EndpointError ( error . message , error ) ; } } ) ; } /**
     * installs (or upgrades) the Endpoint Fleet package
     * (NOTE: ensure that fleet is setup first before calling this function)
     */ async installOrUpgradeEndpointFleetPackage ( ) { return installOrUpgradeEndpointFleetPackage ( this . kbnClient ) ; } }