import expect from '@kbn/expect' ; import { ALERT_WORKFLOW_STATUS } from '@kbn/rule-data-utils' ; import type * as estypes from '@elastic/elasticsearch/lib/api/typesWithBodyKey' ; import { DETECTION_ENGINE_SIGNALS_STATUS_URL , DETECTION_ENGINE_QUERY_SIGNALS_URL , } from '../../../../plugins/security_solution/common/constants' ; import { FtrProviderContext } from '../../common/ftr_provider_context' ; import { createSignalsIndex , deleteSignalsIndex , setSignalStatus , getSignalStatusEmptyResponse , getQuerySignalIds , deleteAllAlerts , createRule , waitForSignalsToBePresent , getSignalsByIds , waitForRuleSuccessOrStatus , getRuleForSignalTesting , } from '../../utils' ; import { createUserAndRole , deleteUserAndRole } from '../../../common/services/security_solution' ; import { ROLES } from '../../../../plugins/security_solution/common/test' ; import { RACAlert } from '../../../../plugins/security_solution/server/lib/detection_engine/rule_types/types' ; export default ( { getService } ) => { const supertest = getService ( 'supertest' ) ; const esArchiver = getService ( 'esArchiver' ) ; const supertestWithoutAuth = getService ( 'supertestWithoutAuth' ) ; const log = getService ( 'log' ) ; describe ( 'open_close_signals' , ( ) => { describe . skip ( 'validation checks' , ( ) => { it ( 'should not give errors when querying and the signals index does not exist yet' , async ( ) => { const { body } = await supertest . post ( DETECTION_ENGINE_SIGNALS_STATUS_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( setSignalStatus ( { signalIds : [ '123' ] , status : 'open' } ) ) . expect ( 200 ) ; delete body . took ; expect ( body ) . to . eql ( getSignalStatusEmptyResponse ( ) ) ; } ) ; it ( 'should not give errors when querying and the signals index does exist and is empty' , async ( ) => { await createSignalsIndex ( supertest , log ) ; const { body } = await supertest . post ( DETECTION_ENGINE_SIGNALS_STATUS_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( setSignalStatus ( { signalIds : [ '123' ] , status : 'open' } ) ) . expect ( 200 ) ; delete body . took ; expect ( body ) . to . eql ( getSignalStatusEmptyResponse ( ) ) ; await deleteSignalsIndex ( supertest , log ) ; } ) ; describe ( 'tests with auditbeat data' , ( ) => { before ( async ( ) => { await esArchiver . load ( 'x-pack/test/functional/es_archives/auditbeat/hosts' ) ; } ) ; after ( async ( ) => { await esArchiver . unload ( 'x-pack/test/functional/es_archives/auditbeat/hosts' ) ; } ) ; beforeEach ( async ( ) => { await deleteAllAlerts ( supertest , log ) ; await createSignalsIndex ( supertest , log ) ; } ) ; afterEach ( async ( ) => { await deleteSignalsIndex ( supertest , log ) ; await deleteAllAlerts ( supertest , log ) ; } ) ; it ( 'should be able to execute and get 10 signals' , async ( ) => { const rule = getRuleForSignalTesting ( [ 'auditbeat-*' ] ) ; const { id } = await createRule ( supertest , log , rule ) ; await waitForRuleSuccessOrStatus ( supertest , log , id ) ; await waitForSignalsToBePresent ( supertest , log , 10 , [ id ] ) ; const signalsOpen = await getSignalsByIds ( supertest , log , [ id ] ) ; expect ( signalsOpen . hits . hits . length ) . equal ( 10 ) ; } ) ; it ( 'should be have set the signals in an open state initially' , async ( ) => { const rule = getRuleForSignalTesting ( [ 'auditbeat-*' ] ) ; const { id } = await createRule ( supertest , log , rule ) ; await waitForRuleSuccessOrStatus ( supertest , log , id ) ; await waitForSignalsToBePresent ( supertest , log , 10 , [ id ] ) ; const signalsOpen = await getSignalsByIds ( supertest , log , [ id ] ) ; const everySignalOpen = signalsOpen . hits . hits . every ( ( hit ) => hit . _source ?. [ ALERT_WORKFLOW_STATUS ] === 'open' ) ; expect ( everySignalOpen ) . to . eql ( true ) ; } ) ; it ( 'should be able to get a count of 10 closed signals when closing 10' , async ( ) => { const rule = getRuleForSignalTesting ( [ 'auditbeat-*' ] ) ; const { id } = await createRule ( supertest , log , rule ) ; await waitForRuleSuccessOrStatus ( supertest , log , id ) ; await waitForSignalsToBePresent ( supertest , log , 10 , [ id ] ) ; const signalsOpen = await getSignalsByIds ( supertest , log , [ id ] ) ; const signalIds = signalsOpen . hits . hits . map ( ( signal ) => signal . _id ) ; await supertest . post ( DETECTION_ENGINE_SIGNALS_STATUS_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( setSignalStatus ( { signalIds , status : 'closed' } ) ) . expect ( 200 ) ; const { body : signalsClosed } = await supertest . post ( DETECTION_ENGINE_QUERY_SIGNALS_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( getQuerySignalIds ( signalIds ) ) . expect ( 200 ) ; expect ( signalsClosed . hits . hits . length ) . to . equal ( 10 ) ; } ) ; it ( 'should be able close signals immediately and they all should be closed' , async ( ) => { const rule = getRuleForSignalTesting ( [ 'auditbeat-*' ] ) ; const { id } = await createRule ( supertest , log , rule ) ; await waitForRuleSuccessOrStatus ( supertest , log , id ) ; await waitForSignalsToBePresent ( supertest , log , 1 , [ id ] ) ; const signalsOpen = await getSignalsByIds ( supertest , log , [ id ] ) ; const signalIds = signalsOpen . hits . hits . map ( ( signal ) => signal . _id ) ; await supertest . post ( DETECTION_ENGINE_SIGNALS_STATUS_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( setSignalStatus ( { signalIds , status : 'closed' } ) ) . expect ( 200 ) ; const { body : signalsClosed } = await supertest . post ( DETECTION_ENGINE_QUERY_SIGNALS_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( getQuerySignalIds ( signalIds ) ) . expect ( 200 ) ; const everySignalClosed = signalsClosed . hits . hits . every ( ( hit ) => hit . _source ?. [ 'kibana.alert.workflow_status' ] === 'closed' ) ; expect ( everySignalClosed ) . to . eql ( true ) ; } ) ; it ( 'should be able to close signals with t1 analyst user' , async ( ) => { const rule = getRuleForSignalTesting ( [ 'auditbeat-*' ] ) ; const { id } = await createRule ( supertest , log , rule ) ; await waitForRuleSuccessOrStatus ( supertest , log , id ) ; await waitForSignalsToBePresent ( supertest , log , 1 , [ id ] ) ; await createUserAndRole ( getService , ROLES . t1_analyst ) ; const signalsOpen = await getSignalsByIds ( supertest , log , [ id ] ) ; const signalIds = signalsOpen . hits . hits . map ( ( signal ) => signal . _id ) ; await supertestWithoutAuth . post ( DETECTION_ENGINE_SIGNALS_STATUS_URL ) . set ( 'kbn-xsrf' , 'true' ) . auth ( ROLES . t1_analyst , 'changeme' ) . send ( setSignalStatus ( { signalIds , status : 'closed' } ) ) . expect ( 200 ) ; const { body : signalsClosed } = await supertest . post ( DETECTION_ENGINE_QUERY_SIGNALS_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( getQuerySignalIds ( signalIds ) ) . expect ( 200 ) ; const everySignalClosed = signalsClosed . hits . hits . every ( ( hit ) => hit . _source ?. [ 'kibana.alert.workflow_status' ] === 'closed' ) ; expect ( everySignalClosed ) . to . eql ( true ) ; await deleteUserAndRole ( getService , ROLES . t1_analyst ) ; } ) ; it ( 'should be able to close signals with soc_manager user' , async ( ) => { const rule = getRuleForSignalTesting ( [ 'auditbeat-*' ] ) ; const { id } = await createRule ( supertest , log , rule ) ; await waitForRuleSuccessOrStatus ( supertest , log , id ) ; await waitForSignalsToBePresent ( supertest , log , 1 , [ id ] ) ; const userAndRole = ROLES . soc_manager ; await createUserAndRole ( getService , userAndRole ) ; const signalsOpen = await getSignalsByIds ( supertest , log , [ id ] ) ; const signalIds = signalsOpen . hits . hits . map ( ( signal ) => signal . _id ) ; await supertestWithoutAuth . post ( DETECTION_ENGINE_SIGNALS_STATUS_URL ) . set ( 'kbn-xsrf' , 'true' ) . auth ( userAndRole , 'changeme' ) . send ( setSignalStatus ( { signalIds , status : 'closed' } ) ) . expect ( 200 ) ; const { body : signalsClosed } = await supertest . post ( DETECTION_ENGINE_QUERY_SIGNALS_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( getQuerySignalIds ( signalIds ) ) . expect ( 200 ) ; const everySignalClosed = signalsClosed . hits . hits . every ( ( hit ) => hit . _source ?. [ 'kibana.alert.workflow_status' ] === 'closed' ) ; expect ( everySignalClosed ) . to . eql ( true ) ; await deleteUserAndRole ( getService , userAndRole ) ; } ) ; } ) ; } ) ; } ) ; } ;