test udpate detector disabling threat intel

Signed-off-by: Surya Sashank Nistala <[email protected]>
opensearch-project · Oct 17, 2023 · a79b8ac · a79b8ac
1 parent decee51
commit a79b8ac
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 3 deletions.
diff --git a/src/main/java/org/opensearch/securityanalytics/transport/TransportIndexDetectorAction.java b/src/main/java/org/opensearch/securityanalytics/transport/TransportIndexDetectorAction.java
@@ -691,6 +691,7 @@ private void addThreatIntelBasedDocLevelQueries(Detector detector, List<DocLevel
         try {
 
             if (detector.getThreatIntelEnabled()) {
+                log.debug("threat intel enabled for detector {} . adding threat intel based doc level queries.", detector.getName());
                 List<LogType.IocFields> iocFieldsList = logTypeService.getIocFieldsList(detector.getDetectorType());
                 if (iocFieldsList == null || iocFieldsList.isEmpty()) {
 

diff --git a/src/test/java/org/opensearch/securityanalytics/resthandler/DetectorMonitorRestApiIT.java b/src/test/java/org/opensearch/securityanalytics/resthandler/DetectorMonitorRestApiIT.java
@@ -1078,7 +1078,6 @@ public void testCreateDetectorWiththreatIntelEnabled_updateDetectorWithThreatInt
         DetectorInput input = new DetectorInput("windows detector for security analytics", List.of("windows"), detectorRules,
                 Collections.emptyList());
         Detector detector = randomDetectorWithInputsAndThreatIntel(List.of(input), true);
-
         Response createResponse = makeRequest(client(), "POST", SecurityAnalyticsPlugin.DETECTOR_BASE_URI, Collections.emptyMap(), toHttpEntity(detector));
 
         String request = "{\n" +
@@ -1137,8 +1136,7 @@ public void testCreateDetectorWiththreatIntelEnabled_updateDetectorWithThreatInt
         ArrayList<String> docs = (ArrayList<String>) docLevelQueryResults.get(threatIntelDocLevelQueryId);
         assertEquals(docs.size(), 3);
 
-        detector.setThreatIntelEnabled(false);
-        Response updateResponse = makeRequest(client(), "PUT", SecurityAnalyticsPlugin.DETECTOR_BASE_URI + "/" + detectorId, Collections.emptyMap(), toHttpEntity(detector));
+        Response updateResponse = makeRequest(client(), "PUT", SecurityAnalyticsPlugin.DETECTOR_BASE_URI + "/" + detectorId, Collections.emptyMap(), toHttpEntity(randomDetectorWithInputsAndThreatIntel(List.of(input), true)));
 
         assertEquals("Update detector failed", RestStatus.OK, restStatus(updateResponse));