import expect from '@kbn/expect' ; import { DETECTION_ENGINE_RULES_URL } from '../../../../plugins/security_solution/common/constants' ; import { FtrProviderContext } from '../../common/ftr_provider_context' ; import { createRule , createSignalsIndex , deleteAllAlerts , deleteSignalsIndex , getComplexRule , getComplexRuleOutput , getSimpleRule , getSimpleRuleOutput , getWebHookAction , removeServerGeneratedProperties , } from '../../utils' ; export default ( { getService } ) : void => { const supertest = getService ( 'supertest' ) ; const log = getService ( 'log' ) ; describe ( 'find_rules' , ( ) => { beforeEach ( async ( ) => { await createSignalsIndex ( supertest , log ) ; } ) ; afterEach ( async ( ) => { await deleteSignalsIndex ( supertest , log ) ; await deleteAllAlerts ( supertest , log ) ; } ) ; it ( 'should return an empty find body correctly if no rules are loaded' , async ( ) => { const { body } = await supertest . get ( `${ DETECTION_ENGINE_RULES_URL }/_find` ) . set ( 'kbn-xsrf' , 'true' ) . send ( ) . expect ( 200 ) ; expect ( body ) . to . eql ( { data : [ ] , page : 1 , perPage : 20 , total : 0 , } ) ; } ) ; it ( 'should return a single rule when a single rule is loaded from a find with defaults added' , async ( ) => { await createRule ( supertest , log , getSimpleRule ( ) ) ; const { body } = await supertest . get ( `${ DETECTION_ENGINE_RULES_URL }/_find` ) . set ( 'kbn-xsrf' , 'true' ) . send ( ) . expect ( 200 ) ; body . data = [ removeServerGeneratedProperties ( body . data [ 0 ] ) ] ; expect ( body ) . to . eql ( { data : [ getSimpleRuleOutput ( ) ] , page : 1 , perPage : 20 , total : 1 , } ) ; } ) ; it ( 'should return a single rule when a single rule is loaded from a find with everything for the rule added' , async ( ) => { await supertest . post ( DETECTION_ENGINE_RULES_URL ) . set ( 'kbn-xsrf' , 'true' ) . send ( getComplexRule ( ) ) . expect ( 200 ) ; const { body } = await supertest . get ( `${ DETECTION_ENGINE_RULES_URL }/_find` ) . set ( 'kbn-xsrf' , 'true' ) . send ( ) . expect ( 200 ) ; body . data = [ removeServerGeneratedProperties ( body . data [ 0 ] ) ] ; expect ( body ) . to . eql ( { data : [ getComplexRuleOutput ( ) ] , page : 1 , perPage : 20 , total : 1 , } ) ; } ) ; it ( 'should find a single rule with a execute immediately action correctly' , async ( ) => { const { body : hookAction } = await supertest . post ( '/api/actions/action' ) . set ( 'kbn-xsrf' , 'true' ) . send ( getWebHookAction ( ) ) . expect ( 200 ) ; const action = { group : 'default' , id : hookAction . id , action_type_id : hookAction . actionTypeId , params : { } , } ; const rule = { ... getSimpleRule ( 'rule-1' ) , actions : [ action ] , } ; await createRule ( supertest , log , rule ) ; const { body } = await supertest . get ( `${ DETECTION_ENGINE_RULES_URL }/_find` ) . set ( 'kbn-xsrf' , 'true' ) . send ( ) . expect ( 200 ) ; const ruleWithActions = { ... getSimpleRuleOutput ( ) , actions : [ action ] , throttle : 'rule' , } ; body . data = [ removeServerGeneratedProperties ( body . data [ 0 ] ) ] ; expect ( body ) . to . eql ( { data : [ ruleWithActions ] , page : 1 , perPage : 20 , total : 1 , } ) ; } ) ; it ( 'should be able to find a scheduled action correctly' , async ( ) => { const { body : hookAction } = await supertest . post ( '/api/actions/action' ) . set ( 'kbn-xsrf' , 'true' ) . send ( getWebHookAction ( ) ) . expect ( 200 ) ; const action = { group : 'default' , id : hookAction . id , action_type_id : hookAction . actionTypeId , params : { } , } ; const rule = { ... getSimpleRule ( 'rule-1' ) , throttle : '1h' , actions : [ action ] , } ; await createRule ( supertest , log , rule ) ; const { body } = await supertest . get ( `${ DETECTION_ENGINE_RULES_URL }/_find` ) . set ( 'kbn-xsrf' , 'true' ) . send ( ) . expect ( 200 ) ; const ruleWithActions = { ... getSimpleRuleOutput ( ) , actions : [ action ] , throttle : '1h' , } ; body . data = [ removeServerGeneratedProperties ( body . data [ 0 ] ) ] ; expect ( body ) . to . eql ( { data : [ ruleWithActions ] , page : 1 , perPage : 20 , total : 1 , } ) ; } ) ; deprecated describe ( 'legacy_notification_system' , async ( ) => { it ( 'should be able to a read a scheduled action correctly' , async ( ) => { const { body : hookAction } = await supertest . post ( '/api/actions/action' ) . set ( 'kbn-xsrf' , 'true' ) . send ( getWebHookAction ( ) ) . expect ( 200 ) ; const createRuleBody = await createRule ( supertest , log , getSimpleRule ( 'rule-1' ) ) ; await supertest . post ( `/internal/api/detection/legacy/notifications?alert_id=${ createRuleBody . id }` ) . set ( 'kbn-xsrf' , 'true' ) . send ( { name : 'Legacy notification with one action' , interval : '1h' , actions : [ { id : hookAction . id , group : 'default' , params : { message : 'Hourly\nRule {{context.rule.name}} generated {{state.signals_count}} alerts' , } , actionTypeId : hookAction . actionTypeId , } , ] , } ) . expect ( 200 ) ; const { body } = await supertest . get ( `${ DETECTION_ENGINE_RULES_URL }/_find` ) . set ( 'kbn-xsrf' , 'true' ) . send ( ) . expect ( 200 ) ; const ruleWithActions = { ... getSimpleRuleOutput ( ) , actions : [ { id : hookAction . id , group : 'default' , params : { message : 'Hourly\nRule {{context.rule.name}} generated {{state.signals_count}} alerts' , } , action_type_id : hookAction . actionTypeId , } , ] , throttle : '1h' , } ; body . data = [ removeServerGeneratedProperties ( body . data [ 0 ] ) ] ; expect ( body ) . to . eql ( { data : [ ruleWithActions ] , page : 1 , perPage : 20 , total : 1 , } ) ; } ) ; } ) ; } ) ; } ;