import expect from '@kbn/expect' ; import { DETECTION_ENGINE_RULES_URL } from '../../../../plugins/security_solution/common/constants' ; import { FtrProviderContext } from '../../common/ftr_provider_context' ; import { createRule , createSignalsIndex , deleteAllAlerts , deleteSignalsIndex , getSimpleRule , getSimpleRuleOutput , getSimpleRuleOutputWithoutRuleId , getSimpleRuleWithoutRuleId , getWebHookAction , removeServerGeneratedProperties , removeServerGeneratedPropertiesIncludingRuleId , } from '../../utils' ; export default ( { getService } ) => { const supertest = getService ( 'supertest' ) ; const log = getService ( 'log' ) ; describe ( 'read_rules' , ( ) => { describe ( 'reading rules' , ( ) => { beforeEach ( async ( ) => { await createSignalsIndex ( supertest , log ) ; } ) ; afterEach ( async ( ) => { await deleteSignalsIndex ( supertest , log ) ; await deleteAllAlerts ( supertest , log ) ; } ) ; it ( 'should be able to read a single rule using rule_id' , async ( ) => { await createRule ( supertest , log , getSimpleRule ( ) ) ; const { body } = await supertest . get ( `${ DETECTION_ENGINE_RULES_URL }?rule_id=rule-1` ) . set ( 'kbn-xsrf' , 'true' ) . send ( getSimpleRule ( ) ) . expect ( 200 ) ; const bodyToCompare = removeServerGeneratedProperties ( body ) ; expect ( bodyToCompare ) . to . eql ( getSimpleRuleOutput ( ) ) ; } ) ; it ( 'should be able to read a single rule using id' , async ( ) => { const createRuleBody = await createRule ( supertest , log , getSimpleRule ( ) ) ; const { body } = await supertest . get ( `${ DETECTION_ENGINE_RULES_URL }?id=${ createRuleBody . id }` ) . set ( 'kbn-xsrf' , 'true' ) . send ( getSimpleRule ( ) ) . expect ( 200 ) ; const bodyToCompare = removeServerGeneratedProperties ( body ) ; expect ( bodyToCompare ) . to . eql ( getSimpleRuleOutput ( ) ) ; } ) ; it ( 'should be able to read a single rule with an auto-generated rule_id' , async ( ) => { const createRuleBody = await createRule ( supertest , log , getSimpleRuleWithoutRuleId ( ) ) ; const { body } = await supertest . get ( `${ DETECTION_ENGINE_RULES_URL }?rule_id=${ createRuleBody . rule_id }` ) . set ( 'kbn-xsrf' , 'true' ) . send ( getSimpleRule ( ) ) . expect ( 200 ) ; const bodyToCompare = removeServerGeneratedPropertiesIncludingRuleId ( body ) ; expect ( bodyToCompare ) . to . eql ( getSimpleRuleOutputWithoutRuleId ( ) ) ; } ) ; it ( 'should return 404 if given a fake id' , async ( ) => { const { body } = await supertest . get ( `${ DETECTION_ENGINE_RULES_URL }?id=c1e1b359-7ac1-4e96-bc81-c683c092436f` ) . set ( 'kbn-xsrf' , 'true' ) . send ( getSimpleRule ( ) ) . expect ( 404 ) ; expect ( body ) . to . eql ( { status_code : 404 , message : 'id: "c1e1b359-7ac1-4e96-bc81-c683c092436f" not found' , } ) ; } ) ; it ( 'should return 404 if given a fake rule_id' , async ( ) => { const { body } = await supertest . get ( `${ DETECTION_ENGINE_RULES_URL }?rule_id=fake_id` ) . set ( 'kbn-xsrf' , 'true' ) . send ( getSimpleRule ( ) ) . expect ( 404 ) ; expect ( body ) . to . eql ( { status_code : 404 , message : 'rule_id: "fake_id" not found' , } ) ; } ) ; it ( 'should be able to a read a execute immediately action correctly' , async ( ) => { const { body : hookAction } = await supertest . post ( '/api/actions/action' ) . set ( 'kbn-xsrf' , 'true' ) . send ( getWebHookAction ( ) ) . expect ( 200 ) ; const action = { group : 'default' , id : hookAction . id , action_type_id : hookAction . actionTypeId , params : { } , } ; const rule = { ... getSimpleRule ( 'rule-1' ) , actions : [ action ] , } ; const createRuleBody = await createRule ( supertest , log , rule ) ; const { body } = await supertest . get ( `${ DETECTION_ENGINE_RULES_URL }?id=${ createRuleBody . id }` ) . set ( 'kbn-xsrf' , 'true' ) . send ( getSimpleRule ( ) ) . expect ( 200 ) ; const bodyToCompare = removeServerGeneratedProperties ( body ) ; const ruleWithActions = { ... getSimpleRuleOutput ( ) , actions : [ action ] , throttle : 'rule' , } ; expect ( bodyToCompare ) . to . eql ( ruleWithActions ) ; } ) ; it ( 'should be able to a read a scheduled action correctly' , async ( ) => { const { body : hookAction } = await supertest . post ( '/api/actions/action' ) . set ( 'kbn-xsrf' , 'true' ) . send ( getWebHookAction ( ) ) . expect ( 200 ) ; const action = { group : 'default' , id : hookAction . id , action_type_id : hookAction . actionTypeId , params : { } , } ; const rule = { ... getSimpleRule ( 'rule-1' ) , throttle : '1h' , actions : [ action ] , } ; const createRuleBody = await createRule ( supertest , log , rule ) ; const { body } = await supertest . get ( `${ DETECTION_ENGINE_RULES_URL }?id=${ createRuleBody . id }` ) . set ( 'kbn-xsrf' , 'true' ) . send ( getSimpleRule ( ) ) . expect ( 200 ) ; const bodyToCompare = removeServerGeneratedProperties ( body ) ; const ruleWithActions = { ... getSimpleRuleOutput ( ) , actions : [ action ] , throttle : '1h' , } ; expect ( bodyToCompare ) . to . eql ( ruleWithActions ) ; } ) ; deprecated describe ( 'legacy_notification_system' , ( ) => { it ( 'should be able to a read a scheduled action correctly' , async ( ) => { const { body : hookAction } = await supertest . post ( '/api/actions/action' ) . set ( 'kbn-xsrf' , 'true' ) . send ( getWebHookAction ( ) ) . expect ( 200 ) ; const createRuleBody = await createRule ( supertest , log , getSimpleRule ( 'rule-1' ) ) ; await supertest . post ( `/internal/api/detection/legacy/notifications?alert_id=${ createRuleBody . id }` ) . set ( 'kbn-xsrf' , 'true' ) . send ( { name : 'Legacy notification with one action' , interval : '1h' , actions : [ { id : hookAction . id , group : 'default' , params : { message : 'Hourly\nRule {{context.rule.name}} generated {{state.signals_count}} alerts' , } , actionTypeId : hookAction . actionTypeId , } , ] , } ) . expect ( 200 ) ; const { body } = await supertest . get ( `${ DETECTION_ENGINE_RULES_URL }?id=${ createRuleBody . id }` ) . set ( 'kbn-xsrf' , 'true' ) . send ( getSimpleRule ( ) ) . expect ( 200 ) ; const bodyToCompare = removeServerGeneratedProperties ( body ) ; const ruleWithActions = { ... getSimpleRuleOutput ( ) , actions : [ { id : hookAction . id , group : 'default' , params : { message : 'Hourly\nRule {{context.rule.name}} generated {{state.signals_count}} alerts' , } , action_type_id : hookAction . actionTypeId , } , ] , throttle : '1h' , } ; expect ( bodyToCompare ) . to . eql ( ruleWithActions ) ; } ) ; } ) ; } ) ; } ) ; } ;