Skip to content

Commit

Permalink
improves eql test (#79014)
Browse files Browse the repository at this point in the history
Co-authored-by: Elastic Machine <[email protected]>
  • Loading branch information
MadameSheema and elasticmachine authored Oct 2, 2020
1 parent 09b0b66 commit b01140f
Show file tree
Hide file tree
Showing 2 changed files with 26 additions and 1 deletion.
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,14 @@

import { eqlRule, indexPatterns } from '../objects/rule';

import {
ALERT_RULE_METHOD,
ALERT_RULE_NAME,
ALERT_RULE_RISK_SCORE,
ALERT_RULE_SEVERITY,
ALERT_RULE_VERSION,
NUMBER_OF_ALERTS,
} from '../screens/alerts';
import {
CUSTOM_RULES_BTN,
RISK_SCORE,
Expand Down Expand Up @@ -59,9 +67,11 @@ import {
fillDefineEqlRuleAndContinue,
fillScheduleRuleAndContinue,
selectEqlRuleType,
waitForTheRuleToBeExecuted,
} from '../tasks/create_new_rule';
import { esArchiverLoad, esArchiverUnload } from '../tasks/es_archiver';
import { loginAndWaitForPageWithoutDateRange } from '../tasks/login';
import { refreshPage } from '../tasks/security_header';

import { DETECTIONS_URL } from '../urls/navigation';

Expand All @@ -74,6 +84,7 @@ const expectedMitre = eqlRule.mitre
})
.join('');
const expectedNumberOfRules = 1;
const expectedNumberOfAlerts = 7;

describe('Detection rules, EQL', () => {
before(() => {
Expand Down Expand Up @@ -146,5 +157,19 @@ describe('Detection rules, EQL', () => {
`${eqlRule.lookBack.interval}${eqlRule.lookBack.type}`
);
});

refreshPage();
waitForTheRuleToBeExecuted();

cy.get(NUMBER_OF_ALERTS)
.invoke('text')
.then((numberOfAlertsText) => {
cy.wrap(parseInt(numberOfAlertsText, 10)).should('eql', expectedNumberOfAlerts);
});
cy.get(ALERT_RULE_NAME).first().should('have.text', eqlRule.name);
cy.get(ALERT_RULE_VERSION).first().should('have.text', '1');
cy.get(ALERT_RULE_METHOD).first().should('have.text', 'eql');
cy.get(ALERT_RULE_SEVERITY).first().should('have.text', eqlRule.severity.toLowerCase());
cy.get(ALERT_RULE_RISK_SCORE).first().should('have.text', eqlRule.riskScore);
});
});
2 changes: 1 addition & 1 deletion x-pack/plugins/security_solution/cypress/objects/rule.ts
Original file line number Diff line number Diff line change
Expand Up @@ -215,7 +215,7 @@ export const machineLearningRule: MachineLearningRule = {
};

export const eqlRule: CustomRule = {
customQuery: 'process where process_name == "explorer.exe"',
customQuery: 'any where process.name == "which"',
name: 'New EQL Rule',
description: 'New EQL rule description.',
severity: 'High',
Expand Down

0 comments on commit b01140f

Please sign in to comment.