Testing 4.0.4-7.10.0 #2801

Desvelao · 2021-01-21T12:28:24Z

Wazuh	Elastic	Rev
4.0.4	7.10.0	4016

Description
Testing.

Test with browsers:

Chrome
Firefox
Safari

Test with the theme:

Light
Dark

Checks:

General checks
ODFE 1.12.0
X-Pack

Desvelao · 2021-01-21T12:31:10Z

General checks

Chrome

Filter checks (Modules)

Modules views

Review that we are not showing non-applicable modules depending on the agent OS.
Check the FIM table inside FIM is showing information properly.
Check all SCA tables.

Query bar

Simple search, example: "ssh".
Left wildcard search, example: "*ssh".
Right wildcard search, example: "ssh*".
Both sides wildcard search, example: "*ssh*". (its slowness is a known issue)
Filter search, example: "rule.level >= 10".
Multiple queries, example "rule.level >= 10 and agent.name : "pop-os"".

Visualizations

Click on the lens of a field to apply a filter.
Using the mouse, select a period of time on a time-based visualization.
Dashboards with no alerts for the selected time range should not be broken.
Dashboards with no alerts for any time range should not be broken and should not show any toaster.
See at least one time every visualization of every dashboard. None of the visualizations should be broken (obviously).

Events related checks

View surrounding documents should work
View single document should work
View the source of a document should work
New links to flyouts works
New redirection should work.

Overview UI

Check the settings modules tab for enabling/disabling extensions.
Metrics for agents should show values (including 0 if there are no agents).
F5 on the page should keep the selected extensions.
If an extension is disabled, it should not appear in menus.

Reporting

Should work with no custom filters.
Using custom filters, the report must apply the custom filters.
Using custom filters and custom query, the report must apply the custom filters and the custom query.
Using a custom query, the report must apply the custom query.
Generate a report for Inventory.

Management - Status

Metrics for agents should show values (including 0 if there are no agents).
If the cluster is enabled, it should show a node selector.
If the cluster is enabled, it should show a button for restarting the cluster, it should restart it after pressing the button.
If the cluster is enabled, changing node should refresh the view.
Check that every daemon metric is consistent.
If there are one or more agents, it should show the "Last registered agent" box next to the manager box.

Management home UI

Should show two cards with the different sections

Management - Cluster

The load time should be fast, with no timeouts.
Timelions should show data.
The Overview should show Top 5 nodes visualization and information about the cluster.
The nodes list should show all nodes.
The node detail should show Alerts over time visualization and information about the node.

Management - Logs

If the cluster is enabled, it should show a node selector.
If the cluster is enabled, changing the node should refresh the view.
Daemon selector should filter the output by the selected daemon.
Level selector should filter the output by the selected level.
Descending sort should apply a descending sort.
Search bar should filter the output.
Play real-time should append new logs on the fly.
Formatted should export the output in a file for downloading it.

Management - Reporting

If there are no reports, the table should be empty.
If there are reports, they should be downloadable and removable.

Management - Ruleset

Management - Groups

Management - Configuration

Check that all sections are working as expected.
Edit the "ossec.conf" using the Edit configuration link. Edit, Save, Restart a node, Change node should be working as expected.

DevTools

If admin mode is enabled:

Check autocomplete is working for endpoint url suggestions
Check autocomplete is working for endpoint parameters suggestions
Check the request is working
The history must be stored in the browser session storage.
Malformed queries should show information messages about the error.
The output should be the same as doing a direct "curl".
The download button should show a tooltip and download the output JSON.

Agents preview

Agent specific view UI

The configuration can't be edited.
Export the agent configuration in PDF using granular options.
Export the agent configuration in PDF with no granular options.
Check all the Inventory tables.
Check the agent status indicator on top of the view.
If a plugin is disabled or not compatible, it should not appear in More menu.

App menu

Should be visible always, even if we change the state.
Should show the index pattern.
If there is more than one index pattern, show a list selector.
Should show the selected API.
If there is more than one API, show a list selector.
Every link should redirect you to the right section.

Settings

Change the index pattern.
Edit app settings.
Show app logs.
Review the About section. Check the app version, Kibana version, app revision, and installation date values.

Firefox

Filter checks (Modules)

Modules views

Review that we are not showing non-applicable modules depending on the agent OS.
Check the FIM table inside FIM is showing information properly.
Check all SCA tables.

Query bar

Simple search, example: "ssh".
Left wildcard search, example: "*ssh".
Right wildcard search, example: "ssh*".
Both sides wildcard search, example: "*ssh*". (its slowness is a known issue)
Filter search, example: "rule.level >= 10".
Multiple queries, example "rule.level >= 10 and agent.name : "pop-os"".

Visualizations

Click on the lens of a field to apply a filter.
Using the mouse, select a period of time on a time-based visualization.
Dashboards with no alerts for the selected time range should not be broken.
Dashboards with no alerts for any time range should not be broken and should not show any toaster.
See at least one time every visualization of every dashboard. None of the visualizations should be broken (obviously).

Events related checks

View surrounding documents should work
View single document should work
View the source of a document should work
New links to flyouts works
New redirection should work.

Overview UI

Check the settings modules tab for enabling/disabling extensions.
Metrics for agents should show values (including 0 if there are no agents).
F5 on the page should keep the selected extensions.
If an extension is disabled, it should not appear in menus.

Reporting

Should work with no custom filters.
Using custom filters, the report must apply the custom filters.
Using custom filters and custom query, the report must apply the custom filters and the custom query.
Using a custom query, the report must apply the custom query.
Generate a report for Inventory.

Management - Status

Metrics for agents should show values (including 0 if there are no agents).
If the cluster is enabled, it should show a node selector.
If the cluster is enabled, it should show a button for restarting the cluster, it should restart it after pressing the button.
If the cluster is enabled, changing node should refresh the view.
Check that every daemon metric is consistent.
If there are one or more agents, it should show the "Last registered agent" box next to the manager box.

Management home UI

Should show two cards with the different sections

Management - Cluster

The load time should be fast, with no timeouts.
Timelions should show data.
The Overview should show Top 5 nodes visualization and information about the cluster.
The nodes list should show all nodes.
The node detail should show Alerts over time visualization and information about the node.

Management - Logs

If the cluster is enabled, it should show a node selector.
If the cluster is enabled, changing the node should refresh the view.
Daemon selector should filter the output by the selected daemon.
Level selector should filter the output by the selected level.
Descending sort should apply a descending sort.
Search bar should filter the output.
Play real-time should append new logs on the fly.
Formatted should export the output in a file for downloading it.

Management - Reporting

If there are no reports, the table should be empty.
If there are reports, they should be downloadable and removable.

Management - Ruleset

Management - Groups

Management - Configuration

Check that all sections are working as expected.
Edit the "ossec.conf" using the Edit configuration link. Edit, Save, Restart a node, Change node should be working as expected.

DevTools

If admin mode is enabled:

Check autocomplete is working for endpoint url suggestions
Check autocomplete is working for endpoint parameters suggestions
Check the request is working
The history must be stored in the browser session storage.
Malformed queries should show information messages about the error.
The output should be the same as doing a direct "curl".
The download button should show a tooltip and download the output JSON.

Agents preview

Agent specific view UI

The configuration can't be edited.
Export the agent configuration in PDF using granular options.
Export the agent configuration in PDF with no granular options.
Check all the Inventory tables.
Check the agent status indicator on top of the view.
If a plugin is disabled or not compatible, it should not appear in More menu.

App menu

Should be visible always, even if we change the state.
Should show the index pattern.
If there is more than one index pattern, show a list selector.
Should show the selected API.
If there is more than one API, show a list selector.
Every link should redirect you to the right section.

Settings

Change the index pattern.
Edit app settings.
Show app logs.
Review the About section. Check the app version, Kibana version, app revision, and installation date values.

Misc

Test all settings from wazuh.yml.
Kibana dark mode should work properly, all the app theme should be consistent with the dark theme of Kibana.

Backend Jobs

Monitoring
- Create wazuh-agent template
- Indices are created. (The internal user needs permissions for manage this indices.)
Statistics
- Indices are created. (The internal user needs permissions to manage these indices.)

Infrastructure and others

Installing the plugin using kibana-plugin install file:///wazuhapp.zip should work.
Installing the plugin using kibana-plugin install https://plugin/url/wazuhapp.zip should work.

Desvelao · 2021-01-21T13:26:39Z

ODFE 1.12.0 checks

Index patterns creations

alerts, monitoring and statistics index pattern should be created in the health check
- Global tenant
- Private tenant

RBAC

Check the app works with the run_as host setting using the authentication context. Create a user and assign a specific role. For example, a user with the readonly Wazuh API role.
Some sections can't be accessed without administrator role.

Desvelao · 2021-01-21T13:27:39Z

X-Pack checks

Index patterns creations

alerts, monitoring and statistics index pattern should be created in the health check
- Default space
- Custom space

RBAC

Check the app works with the run_as host setting using the authentication context. Create a user and assign a specific role. For example, a user with the readonly Wazuh API role.
Some sections can't be accessed without administrator role.

frankeros · 2021-01-21T18:11:09Z

The table pagination doesn't work in SCA check list
When a page number is clicked.

Update:
PR to resolve: #2815

frankeros · 2021-01-21T18:13:41Z

The Kibana pop up should not be displayed

Update:
PR to resolve #2806

frankeros · 2021-01-21T18:16:13Z

When you try to change a rule or decoder and restart the cluster this happens

Update:
PR to resolve #2820

s-ocando · 2021-01-22T11:32:23Z

RBAC fails to provide access to specific agents

A user with access to a limited number of agents (2 out of 4) gets a correct agent count in the "Modules overview" page but can't access the Agents section (and in consequence can't see the agents summary or SCA information).

A very common use-case is to provide access to a group of agents to specific users associated with those endpoints (departments, MSSP customers, etc)

PR #2838

jctello · 2021-01-22T14:34:31Z

Related to what is mentioned here the Rows per page selector doesn't work (it's always stuck at 10 rows):

Update:
PR to resolve: #2815

jctello · 2021-01-22T14:41:47Z

Selecting Security configuration assessment breaks the formatting of the Modules directory in the drop-down menu.

I mean that the Auditing and Policy Monitoring section of modules gets moved to a second row below the Security information management section.

frankeros · 2021-01-22T15:06:30Z

RBAC fails to provide access to specific agents

@ s-ocando This is the current behavior for this section, we agree that an enhancement is needed, but we will work out of this issue in a future sprint.
Please feel free to open an enhancement issue with this approach.

Thanks for reporting!

Update:
It was tested in 4.0.3 4014, but it works on 4.0.4 4015

s-ocando · 2021-01-22T16:27:01Z

I'm attaching a gif to show the current RBAC behaviour (app version 4.0.4-7.9.1 revision 4015). A user is able to see the list of its allowed agents, at first is only able to see agent 001 and by adding permissions to read agent 002 it appears in its list after refreshing. This feature is currently malfunctioning in app 4.0.4-7.10.0 revision 4016.

frankeros · 2021-01-22T16:57:55Z

I'm attaching a gif to show the current RBAC behaviour (app version 4.0.4-7.9.1 revision 4015). A user is able to see the list of its allowed agents, at first is only able to see agent 001 and by adding permissions to read agent 002 it appears in its list after refreshing. This feature is currently malfunctioning in app 4.0.4-7.10.0 revision 4016.

You're right, we are working on this issue right now.
Thank you very much.

frankeros · 2021-01-25T17:35:05Z

Selecting Security configuration assessment breaks the formatting of the Modules directory in the drop-down menu.

@jctello I can't reproduce it in Chrome in any reasonable resolution

can you share what browser and resolution are you using to check it, please?

PR #2861

jctello · 2021-01-25T20:48:49Z

Selecting Security configuration assessment breaks the formatting of the Modules directory in the drop-down menu.

@jctello I can't reproduce it in Chrome in any reasonable resolution

can you share what browser and resolution are you using to check it, please?

Yes, this observed only on Firefox (I'm using 84.0.2) on Linux. It is not observed on Chromium (on Linux) or Firefox 83 on Windows.

jctello · 2021-01-25T20:53:49Z

The search functionality in file editor is gone. To reproduce go to Management > Configuration > Edit configuration, click on the text box and press Ctrl+F. On the previous version this would give a handy search box within the file.
Console output is:


GEThttps://192.168.40.4/app/ext-searchbox.js
[HTTP/1.1 200 OK 22ms]

The script from “https://192.168.40.4/app/ext-searchbox.js” was loaded even though its MIME type (“text/html”) is not a valid JavaScript MIME type. wazuh
Some cookies are misusing the recommended “SameSite“ attribute 2
Uncaught SyntaxError: expected expression, got '<' ext-searchbox.js:1
Uncaught TypeError: t is undefined
    exec https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    s https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    s https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    i https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    o https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    s https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    onreadystatechange https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    loadScript https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    loadModule https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    exec https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    a https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    _dispatchEvent https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    exec https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    $callKeyboardHandlers https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    onCommandKey https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    onCommandKey https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    l https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
    addCommandKeyListener https://192.168.40.4/35949/bundles/kbn-ui-shared-deps/kbn-ui-shared-deps.js:380
kbn-ui-shared-deps.js:380:1175239

PR #2843

Desvelao · 2021-01-26T14:43:09Z

The Techniques container for the MITRE's Framework tab goes out of the window size. This could be happening in the Modules > PCI DSS GDPR HIPAA NIST 800-53 and TSC Controls' tabs too.

PR #2861

Desvelao · 2021-01-28T09:21:33Z

The statistics indices are being wrongly created with:

1 shard
1 replica
Ignore the configuration.

This should be fixed here #2779, but it not working in my environment.

Fixed: #2858

CPAlejandro · 2021-01-28T15:09:25Z

I have found an error with styles using Open Distro.

PR #2865

pablomarga · 2021-01-28T15:39:54Z

Hi team! Testing the app I have found an error when you pinned a filter and then going to Agents section. When you return to any "Module" the dashboard is not displayed.

Grabacion.de.pantalla.2021-01-28.a.las.16.02.59.mov

PR #2864

Desvelao · 2021-01-29T13:45:50Z

Click in the rule details links don't add a filter in the Management > Rules search bar when access from Modules/any/Events

How to reproduce:

frankeros · 2021-01-29T19:00:48Z

We need to move the Wazuh menu upper in the Kibana menu

And set the `wazuh-alerts-*` as the default index pattern when it's created.

PR #2867

jctello · 2021-02-01T12:17:03Z

PDF reporting can reflect wrong filters as reported here: #2874

Desvelao added the testing label Jan 21, 2021

Desvelao changed the title ~~Testing 4.0.4 - 7.10.0~~ Testing 4.0.4-7.10.0 Jan 21, 2021

Desvelao added this to the Sprint 123 - WUI milestone Jan 21, 2021

frankeros assigned frankeros, gabiwassan, CPAlejandro and Desvelao Jan 21, 2021

frankeros added the newPlatform label Jan 21, 2021

frankeros pinned this issue Jan 21, 2021

frankeros mentioned this issue Jan 21, 2021

[4.0-7.10] Removed kibana alert for security #2806

Merged

frankeros added the 4.0.4-7.10.0 label Jan 22, 2021

frankeros assigned pablomarga Jan 22, 2021

Desvelao mentioned this issue Jan 22, 2021

4.0-7.10 Fix the pagination in SCA ckecks table #2815

Merged

This was linked to pull requests Jan 22, 2021

[4.0-7.10] Removed kibana alert for security #2806

Merged

Changed ping request to default request. Added delay and while to che… #2820

Merged

gabiwassan mentioned this issue Jan 25, 2021

Fixed permissions to access agents #2838

Merged

frankeros mentioned this issue Jan 25, 2021

Rows per page selector in SCA doesn't work #2835

Closed

jctello mentioned this issue Jan 25, 2021

The search functionality in file editor is gone #2840

Closed

s-ocando mentioned this issue Jan 26, 2021

SCA information is not shown for authorized agents #2842

Closed

frankeros linked a pull request Jan 26, 2021 that will close this issue

Fixed permissions to access agents #2838

Merged

Desvelao mentioned this issue Jan 28, 2021

4.0-7.10 - Fix the settings of statistics indices creation #2858

Merged

frankeros mentioned this issue Jan 28, 2021

Fixed bug in sca and regulatory compliance tables and in wz menu on f… #2861

Merged

frankeros mentioned this issue Jan 28, 2021

[4.0.4-7.10] Fixed filter pinned crash returning from agents #2864

Merged

CPAlejandro mentioned this issue Jan 29, 2021

Fixed css of layouts because of conflicts with kibana flyouts #2865

Merged

frankeros mentioned this issue Jan 29, 2021

Move upper the Wazuh item in the Kibana menu and default index pattern #2867

Merged

frankeros closed this as completed Feb 1, 2021

frankeros unpinned this issue Feb 1, 2021

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Testing 4.0.4-7.10.0 #2801

Testing 4.0.4-7.10.0 #2801

Desvelao commented Jan 21, 2021 •

edited

Loading

Desvelao commented Jan 21, 2021 •

edited

Loading

Desvelao commented Jan 21, 2021 •

edited

Loading

Desvelao commented Jan 21, 2021

frankeros commented Jan 21, 2021 •

edited by Desvelao

Loading

frankeros commented Jan 21, 2021 •

edited

Loading

frankeros commented Jan 21, 2021 •

edited

Loading

s-ocando commented Jan 22, 2021 •

edited by frankeros

Loading

jctello commented Jan 22, 2021 •

edited by Desvelao

Loading

jctello commented Jan 22, 2021

frankeros commented Jan 22, 2021 •

edited

Loading

s-ocando commented Jan 22, 2021 •

edited

Loading

frankeros commented Jan 22, 2021

frankeros commented Jan 25, 2021 •

edited

Loading

jctello commented Jan 25, 2021 •

edited

Loading

jctello commented Jan 25, 2021 •

edited by frankeros

Loading

Desvelao commented Jan 26, 2021 •

edited by frankeros

Loading

Desvelao commented Jan 28, 2021 •

edited

Loading

CPAlejandro commented Jan 28, 2021 •

edited by frankeros

Loading

pablomarga commented Jan 28, 2021 •

edited by frankeros

Loading

Desvelao commented Jan 29, 2021

frankeros commented Jan 29, 2021 •

edited

Loading

jctello commented Feb 1, 2021

Testing 4.0.4-7.10.0 #2801

Testing 4.0.4-7.10.0 #2801

Comments

Desvelao commented Jan 21, 2021 • edited Loading

Desvelao commented Jan 21, 2021 • edited Loading

General checks

Chrome

Filter checks (Modules)

Modules views

Query bar

Visualizations

Events related checks

Overview UI

Reporting

Management - Status

Management home UI

Management - Cluster

Management - Logs

Management - Reporting

Management - Ruleset

Management - Groups

Management - Configuration

DevTools

Agents preview

Agent specific view UI

App menu

Settings

Firefox

Filter checks (Modules)

Modules views

Query bar

Visualizations

Events related checks

Overview UI

Reporting

Management - Status

Management home UI

Management - Cluster

Management - Logs

Management - Reporting

Management - Ruleset

Management - Groups

Management - Configuration

DevTools

Agents preview

Agent specific view UI

App menu

Settings

Misc

Backend Jobs

Infrastructure and others

Desvelao commented Jan 21, 2021 • edited Loading

ODFE 1.12.0 checks

Index patterns creations

RBAC

Desvelao commented Jan 21, 2021

X-Pack checks

Index patterns creations

RBAC

frankeros commented Jan 21, 2021 • edited by Desvelao Loading

frankeros commented Jan 21, 2021 • edited Loading

frankeros commented Jan 21, 2021 • edited Loading

s-ocando commented Jan 22, 2021 • edited by frankeros Loading

jctello commented Jan 22, 2021 • edited by Desvelao Loading

jctello commented Jan 22, 2021

frankeros commented Jan 22, 2021 • edited Loading

s-ocando commented Jan 22, 2021 • edited Loading

frankeros commented Jan 22, 2021

frankeros commented Jan 25, 2021 • edited Loading

can you share what browser and resolution are you using to check it, please?

jctello commented Jan 25, 2021 • edited Loading

jctello commented Jan 25, 2021 • edited by frankeros Loading

Desvelao commented Jan 26, 2021 • edited by frankeros Loading

Desvelao commented Jan 28, 2021 • edited Loading

CPAlejandro commented Jan 28, 2021 • edited by frankeros Loading

I have found an error with styles using Open Distro.

pablomarga commented Jan 28, 2021 • edited by frankeros Loading

Desvelao commented Jan 29, 2021

frankeros commented Jan 29, 2021 • edited Loading

And set the wazuh-alerts-* as the default index pattern when it's created.

Desvelao commented Jan 21, 2021 •

edited

Loading

Desvelao commented Jan 21, 2021 •

edited

Loading

Desvelao commented Jan 21, 2021 •

edited

Loading

frankeros commented Jan 21, 2021 •

edited by Desvelao

Loading

frankeros commented Jan 21, 2021 •

edited

Loading

frankeros commented Jan 21, 2021 •

edited

Loading

s-ocando commented Jan 22, 2021 •

edited by frankeros

Loading

jctello commented Jan 22, 2021 •

edited by Desvelao

Loading

frankeros commented Jan 22, 2021 •

edited

Loading

s-ocando commented Jan 22, 2021 •

edited

Loading

frankeros commented Jan 25, 2021 •

edited

Loading

jctello commented Jan 25, 2021 •

edited

Loading

jctello commented Jan 25, 2021 •

edited by frankeros

Loading

Desvelao commented Jan 26, 2021 •

edited by frankeros

Loading

Desvelao commented Jan 28, 2021 •

edited

Loading

CPAlejandro commented Jan 28, 2021 •

edited by frankeros

Loading

pablomarga commented Jan 28, 2021 •

edited by frankeros

Loading

frankeros commented Jan 29, 2021 •

edited

Loading

And set the `wazuh-alerts-*` as the default index pattern when it's created.