[Defend Workflows][E2E]Endpoint isolate e2e coverage multipass backport

x-pack/plugins/security_solution/public/management/cypress/e2e/endpoint/isolate.cy.ts

@@ -0,0 +1,286 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License
+ * 2.0; you may not use this file except in compliance with the Elastic License
+ * 2.0.
+ */
+
+import type { Agent } from '@kbn/fleet-plugin/common';
+import { APP_CASES_PATH, APP_ENDPOINTS_PATH } from '../../../../../common/constants';
+import { closeAllToasts } from '../../tasks/close_all_toasts';
+import {
+  checkEndpointListForIsolatedHosts,
+  checkFlyoutEndpointIsolation,
+  createAgentPolicyTask,
+  filterOutEndpoints,
+  filterOutIsolatedHosts,
+  isolateHostWithComment,
+  openAlertDetails,
+  openCaseAlertDetails,
+  releaseHostWithComment,
+  toggleRuleOffAndOn,
+  visitRuleAlerts,
+  waitForReleaseOption,
+} from '../../tasks/isolate';
+import { cleanupCase, cleanupRule, loadCase, loadRule } from '../../tasks/api_fixtures';
+import { ENDPOINT_VM_NAME } from '../../tasks/common';
+import { login } from '../../tasks/login';
+import type { IndexedFleetEndpointPolicyResponse } from '../../../../../common/endpoint/data_loaders/index_fleet_endpoint_policy';
+import {
+  getAgentByHostName,
+  getEndpointIntegrationVersion,
+  reassignAgentPolicy,
+} from '../../tasks/fleet';
+
+describe('Isolate command', () => {
+  const endpointHostname = Cypress.env(ENDPOINT_VM_NAME);
+  const isolateComment = `Isolating ${endpointHostname}`;
+  const releaseComment = `Releasing ${endpointHostname}`;
+
+  beforeEach(() => {
+    login();
+  });
+
+  describe('From manage', () => {
+    let response: IndexedFleetEndpointPolicyResponse;
+    let initialAgentData: Agent;
+
+    before(() => {
+      getAgentByHostName(endpointHostname).then((agentData) => {
+        initialAgentData = agentData;
+      });
+
+      getEndpointIntegrationVersion().then((version) => {
+        createAgentPolicyTask(version, (data) => {
+          response = data;
+        });
+      });
+    });
+
+    after(() => {
+      if (initialAgentData?.policy_id) {
+        reassignAgentPolicy(initialAgentData.id, initialAgentData.policy_id);
+      }
+      if (response) {
+        cy.task('deleteIndexedFleetEndpointPolicies', response);
+      }
+    });
+
+    it('should allow filtering endpoint by Isolated status', () => {
+      cy.visit(APP_ENDPOINTS_PATH);
+      closeAllToasts();
+      checkEndpointListForIsolatedHosts(false);
+
+      filterOutIsolatedHosts();
+      cy.contains('No items found');
+      cy.getByTestSubj('adminSearchBar').click().type('{selectall}{backspace}');
+      cy.getByTestSubj('querySubmitButton').click();
+      cy.getByTestSubj('endpointTableRowActions').click();
+      cy.getByTestSubj('isolateLink').click();
+
+      cy.contains(`Isolate host ${endpointHostname} from network.`);
+      cy.getByTestSubj('endpointHostIsolationForm');
+      cy.getByTestSubj('host_isolation_comment').type(isolateComment);
+      cy.getByTestSubj('hostIsolateConfirmButton').click();
+      cy.contains(`Isolation on host ${endpointHostname} successfully submitted`);
+      cy.getByTestSubj('euiFlyoutCloseButton').click();
+      cy.getByTestSubj('rowHostStatus-actionStatuses').should('contain.text', 'Isolated');
+      filterOutIsolatedHosts();
+
+      checkEndpointListForIsolatedHosts();
+
+      cy.getByTestSubj('endpointTableRowActions').click();
+      cy.getByTestSubj('unIsolateLink').click();
+      releaseHostWithComment(releaseComment, endpointHostname);
+      cy.contains('Confirm').click();
+      cy.getByTestSubj('euiFlyoutCloseButton').click();
+      cy.getByTestSubj('adminSearchBar').click().type('{selectall}{backspace}');
+      cy.getByTestSubj('querySubmitButton').click();
+      checkEndpointListForIsolatedHosts(false);
+    });
+  });
+
+  describe('From alerts', () => {
+    let response: IndexedFleetEndpointPolicyResponse;
+    let initialAgentData: Agent;
+    let ruleId: string;
+    let ruleName: string;
+
+    before(() => {
+      getAgentByHostName(endpointHostname).then((agentData) => {
+        initialAgentData = agentData;
+      });
+
+      getEndpointIntegrationVersion().then((version) => {
+        createAgentPolicyTask(version, (data) => {
+          response = data;
+        });
+      });
+      loadRule(false).then((data) => {
+        ruleId = data.id;
+        ruleName = data.name;
+      });
+    });
+
+    after(() => {
+      if (initialAgentData?.policy_id) {
+        reassignAgentPolicy(initialAgentData.id, initialAgentData.policy_id);
+      }
+      if (response) {
+        cy.task('deleteIndexedFleetEndpointPolicies', response);
+      }
+      if (ruleId) {
+        cleanupRule(ruleId);
+      }
+    });
+
+    it('should have generated endpoint and rule', () => {
+      cy.visit(APP_ENDPOINTS_PATH);
+      cy.contains(endpointHostname).should('exist');
+
+      toggleRuleOffAndOn(ruleName);
+    });
+
+    it('should isolate and release host', () => {
+      visitRuleAlerts(ruleName);
+
+      filterOutEndpoints(endpointHostname);
+
+      closeAllToasts();
+      openAlertDetails();
+
+      isolateHostWithComment(isolateComment, endpointHostname);
+
+      cy.getByTestSubj('hostIsolateConfirmButton').click();
+      cy.contains(`Isolation on host ${endpointHostname} successfully submitted`);
+
+      cy.getByTestSubj('euiFlyoutCloseButton').click();
+      openAlertDetails();
+
+      checkFlyoutEndpointIsolation();
+
+      releaseHostWithComment(releaseComment, endpointHostname);
+      cy.contains('Confirm').click();
+
+      cy.contains(`Release on host ${endpointHostname} successfully submitted`);
+      cy.getByTestSubj('euiFlyoutCloseButton').click();
+      openAlertDetails();
+      cy.getByTestSubj('event-field-agent.status').within(() => {
+        cy.get('[title="Isolated"]').should('not.exist');
+      });
+    });
+  });
+
+  describe('From cases', () => {
+    let response: IndexedFleetEndpointPolicyResponse;
+    let initialAgentData: Agent;
+    let ruleId: string;
+    let ruleName: string;
+    let caseId: string;
+
+    const caseOwner = 'securitySolution';
+
+    before(() => {
+      getAgentByHostName(endpointHostname).then((agentData) => {
+        initialAgentData = agentData;
+      });
+      getEndpointIntegrationVersion().then((version) => {
+        createAgentPolicyTask(version, (data) => {
+          response = data;
+        });
+      });
+
+      loadRule(false).then((data) => {
+        ruleId = data.id;
+        ruleName = data.name;
+      });
+      loadCase(caseOwner).then((data) => {
+        caseId = data.id;
+      });
+    });
+
+    beforeEach(() => {
+      login();
+    });
+
+    after(() => {
+      if (initialAgentData?.policy_id) {
+        reassignAgentPolicy(initialAgentData.id, initialAgentData.policy_id);
+      }
+      if (response) {
+        cy.task('deleteIndexedFleetEndpointPolicies', response);
+      }
+      if (ruleId) {
+        cleanupRule(ruleId);
+      }
+      if (caseId) {
+        cleanupCase(caseId);
+      }
+    });
+
+    it('should have generated endpoint and rule', () => {
+      cy.visit(APP_ENDPOINTS_PATH);
+      cy.contains(endpointHostname).should('exist');
+
+      toggleRuleOffAndOn(ruleName);
+    });
+
+    it('should isolate and release host', () => {
+      visitRuleAlerts(ruleName);
+      filterOutEndpoints(endpointHostname);
+      closeAllToasts();
+
+      openAlertDetails();
+
+      cy.getByTestSubj('add-to-existing-case-action').click();
+      cy.getByTestSubj(`cases-table-row-select-${caseId}`).click();
+      cy.contains(`An alert was added to \"Test ${caseOwner} case`);
+
+      cy.intercept('GET', `/api/cases/${caseId}/user_actions/_find*`).as('case');
+      cy.visit(`${APP_CASES_PATH}/${caseId}`);
+      cy.wait('@case', { timeout: 30000 }).then(({ response: res }) => {
+        const caseAlertId = res?.body.userActions[1].id;
+
+        closeAllToasts();
+        openCaseAlertDetails(caseAlertId);
+        isolateHostWithComment(isolateComment, endpointHostname);
+        cy.getByTestSubj('hostIsolateConfirmButton').click();
+
+        cy.getByTestSubj('euiFlyoutCloseButton').click();
+
+        cy.getByTestSubj('user-actions-list').within(() => {
+          cy.contains(isolateComment);
+          cy.get('[aria-label="lock"]').should('exist');
+          cy.get('[aria-label="lockOpen"]').should('not.exist');
+        });
+
+        waitForReleaseOption(caseAlertId);
+
+        releaseHostWithComment(releaseComment, endpointHostname);
+
+        cy.contains('Confirm').click();
+
+        cy.contains(`Release on host ${endpointHostname} successfully submitted`);
+        cy.getByTestSubj('euiFlyoutCloseButton').click();
+
+        cy.getByTestSubj('user-actions-list').within(() => {
+          cy.contains(releaseComment);
+          cy.contains(isolateComment);
+          cy.get('[aria-label="lock"]').should('exist');
+          cy.get('[aria-label="lockOpen"]').should('exist');
+        });
+
+        openCaseAlertDetails(caseAlertId);
+
+        cy.getByTestSubj('event-field-agent.status').then(($status) => {
+          if ($status.find('[title="Isolated"]').length > 0) {
+            cy.getByTestSubj('euiFlyoutCloseButton').click();
+            cy.getByTestSubj(`comment-action-show-alert-${caseAlertId}`).click();
+            cy.getByTestSubj('take-action-dropdown-btn').click();
+          }
+          cy.get('[title="Isolated"]').should('not.exist');
+        });
+      });
+    });
+  });
+});

x-pack/plugins/security_solution/public/management/cypress/e2e/mocked_data/isolate.cy.ts

@@ -7,6 +7,9 @@
 
 import { getEndpointListPath } from '../../../common/routing';
 import {
+  checkEndpointListForIsolatedHosts,
+  checkFlyoutEndpointIsolation,
+  filterOutIsolatedHosts,
   interceptActionRequests,
   isolateHostWithComment,
   openAlertDetails,
@@ -67,18 +70,9 @@ describe('Isolate command', () => {
     it('should allow filtering endpoint by Isolated status', () => {
       cy.visit(APP_PATH + getEndpointListPath({ name: 'endpointList' }));
       closeAllToasts();
-      cy.getByTestSubj('adminSearchBar')
-        .click()
-        .type('united.endpoint.Endpoint.state.isolation: true');
-      cy.getByTestSubj('querySubmitButton').click();
+      filterOutIsolatedHosts();
       cy.contains('Showing 2 endpoints');
-      cy.getByTestSubj('endpointListTable').within(() => {
-        cy.get('tbody tr').each(($tr) => {
-          cy.wrap($tr).within(() => {
-            cy.get('td').eq(1).should('contain.text', 'Isolated');
-          });
-        });
-      });
+      checkEndpointListForIsolatedHosts();
     });
   });
 
@@ -161,18 +155,8 @@ describe('Isolate command', () => {
       cy.getByTestSubj('euiFlyoutCloseButton').click();
       cy.wait(1000);
       openAlertDetails();
-      cy.getByTestSubj('event-field-agent.status').then(($status) => {
-        if ($status.find('[title="Isolated"]').length > 0) {
-          cy.contains('Release host').click();
-        } else {
-          cy.getByTestSubj('euiFlyoutCloseButton').click();
-          openAlertDetails();
-          cy.getByTestSubj('event-field-agent.status').within(() => {
-            cy.contains('Isolated');
-          });
-          cy.contains('Release host').click();
-        }
-      });
+
+      checkFlyoutEndpointIsolation();
 
       releaseHostWithComment(releaseComment, hostname);