Handling the case where start is not at the front

x-pack/plugins/security_solution/common/endpoint/models/event.test.ts

@@ -57,13 +57,32 @@ describe('Generated documents', () => {
       expect(isStart(event)).toBeTruthy();
     });
 
+    it('is a start event when event.type is an array of strings and contains start', () => {
+      let event: ResolverEvent = generator.generateEvent({
+        eventType: ['bogus', 'start', 'creation'],
+      });
+      expect(isStart(event)).toBeTruthy();
+
+      event = generator.generateEvent({
+        eventType: ['start', 'bogus'],
+      });
+      expect(isStart(event)).toBeTruthy();
+    });
+
     it('is not a start event when event.type is not start', () => {
       const event: ResolverEvent = generator.generateEvent({
         eventType: ['end'],
       });
       expect(isStart(event)).toBeFalsy();
     });
 
+    it('is not a start event when event.type is empty', () => {
+      const event: ResolverEvent = generator.generateEvent({
+        eventType: [],
+      });
+      expect(isStart(event)).toBeFalsy();
+    });
+
     it('is not a start event when event.type is bogus', () => {
       const event: ResolverEvent = generator.generateEvent({
         eventType: ['bogus'],

x-pack/plugins/security_solution/common/endpoint/models/event.ts

@@ -15,7 +15,7 @@ export function isStart(event: ResolverEvent): boolean {
   }
 
   if (Array.isArray(event.event.type)) {
-    return event.event.type.length === 1 && event.event.type[0] === 'start';
+    return event.event.type.includes('start');
   }
 
   return event.event.type === 'start';