From ff8a41fdf43e748c214b6b1e535aaac4bc28669a Mon Sep 17 00:00:00 2001
From: Vitalii Dmyterko <92328789+vitaliidm@users.noreply.github.com>
Date: Mon, 8 Apr 2024 11:20:28 +0100
Subject: [PATCH] CR: add more test cases

---
 .../utils/suppression_utils.test.ts           | 22 ++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/utils/suppression_utils.test.ts b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/utils/suppression_utils.test.ts
index f2c417a1b982b..df83321b1a25e 100644
--- a/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/utils/suppression_utils.test.ts
+++ b/x-pack/plugins/security_solution/server/lib/detection_engine/rule_types/utils/suppression_utils.test.ts
@@ -89,7 +89,17 @@ describe('getSuppressionTerms', () => {
       })
     ).toEqual([{ field: 'host.name', value: 'localhost-1' }]);
   });
-  it('should return sorted suppression terms array', () => {
+  it('should return suppression terms array when fields do not have matches', () => {
+    expect(
+      getSuppressionTerms({
+        alertSuppression: {
+          groupBy: ['host.name'],
+        },
+        fields: { 'host.ip': '127.0.0.1' },
+      })
+    ).toEqual([{ field: 'host.name', value: null }]);
+  });
+  it('should return sorted suppression terms array value', () => {
     expect(
       getSuppressionTerms({
         alertSuppression: {
@@ -99,4 +109,14 @@ describe('getSuppressionTerms', () => {
       })
     ).toEqual([{ field: 'host.name', value: ['localhost-1', 'localhost-2'] }]);
   });
+  it('should return multiple suppression terms', () => {
+    expect(
+      getSuppressionTerms({
+        alertSuppression: {
+          groupBy: ['host.name', 'host.ip'],
+        },
+        fields: { 'host.name': ['localhost-1'], 'agent.name': 'test', 'host.ip': '127.0.0.1' },
+      })
+    ).toEqual([{ field: 'host.name', value: ['localhost-1'] }, { 'host.ip': '127.0.0.1' }]);
+  });
 });