[Security Solution] Add unit tests for histograms (#77081)
* init tests * add unit tests for histograms * fix types Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
This commit is contained in:
parent
0c678ebada
commit
046345d896
20 changed files with 4369 additions and 0 deletions
File diff suppressed because one or more lines are too long
|
@ -0,0 +1,35 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
|
||||
import * as buildQuery from './query.host_details.dsl';
|
||||
import { hostDetails } from '.';
|
||||
import {
|
||||
mockOptions,
|
||||
mockSearchStrategyResponse,
|
||||
formattedSearchStrategyResponse,
|
||||
} from './__mocks__';
|
||||
|
||||
describe('hostDetails search strategy', () => {
|
||||
const buildHostDetailsQuery = jest.spyOn(buildQuery, 'buildHostDetailsQuery');
|
||||
|
||||
afterEach(() => {
|
||||
buildHostDetailsQuery.mockClear();
|
||||
});
|
||||
|
||||
describe('buildDsl', () => {
|
||||
test('should build dsl query', () => {
|
||||
hostDetails.buildDsl(mockOptions);
|
||||
expect(buildHostDetailsQuery).toHaveBeenCalledWith(mockOptions);
|
||||
});
|
||||
});
|
||||
|
||||
describe('parse', () => {
|
||||
test('should parse data correctly', async () => {
|
||||
const result = await hostDetails.parse(mockOptions, mockSearchStrategyResponse);
|
||||
expect(result).toMatchObject(formattedSearchStrategyResponse);
|
||||
});
|
||||
});
|
||||
});
|
|
@ -0,0 +1,13 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
import { buildHostDetailsQuery as buildQuery } from './query.host_details.dsl';
|
||||
import { mockOptions, expectedDsl } from './__mocks__/';
|
||||
|
||||
describe('buildQuery', () => {
|
||||
test('build query from options correctly', () => {
|
||||
expect(buildQuery(mockOptions)).toEqual(expectedDsl);
|
||||
});
|
||||
});
|
File diff suppressed because it is too large
Load diff
|
@ -0,0 +1,87 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
|
||||
import { MatrixHistogramType } from '../../../../../../../common/search_strategy';
|
||||
|
||||
export const mockOptions = {
|
||||
defaultIndex: [
|
||||
'apm-*-transaction*',
|
||||
'auditbeat-*',
|
||||
'endgame-*',
|
||||
'filebeat-*',
|
||||
'logs-*',
|
||||
'packetbeat-*',
|
||||
'winlogbeat-*',
|
||||
],
|
||||
filterQuery:
|
||||
'{"bool":{"must":[],"filter":[{"match_all":{}},{"bool":{"filter":[{"bool":{"should":[{"exists":{"field":"host.name"}}],"minimum_should_match":1}}]}}],"should":[],"must_not":[]}}',
|
||||
histogramType: MatrixHistogramType.alerts,
|
||||
timerange: { interval: '12h', from: '2020-09-08T14:23:04.482Z', to: '2020-09-09T14:23:04.482Z' },
|
||||
stackByField: 'event.module',
|
||||
};
|
||||
|
||||
export const expectedDsl = {
|
||||
index: [
|
||||
'apm-*-transaction*',
|
||||
'auditbeat-*',
|
||||
'endgame-*',
|
||||
'filebeat-*',
|
||||
'logs-*',
|
||||
'packetbeat-*',
|
||||
'winlogbeat-*',
|
||||
],
|
||||
allowNoIndices: true,
|
||||
ignoreUnavailable: true,
|
||||
body: {
|
||||
aggregations: {
|
||||
alertsGroup: {
|
||||
terms: {
|
||||
field: 'event.module',
|
||||
missing: 'All others',
|
||||
order: { _count: 'desc' },
|
||||
size: 10,
|
||||
},
|
||||
aggs: {
|
||||
alerts: {
|
||||
date_histogram: {
|
||||
field: '@timestamp',
|
||||
fixed_interval: '2700000ms',
|
||||
min_doc_count: 0,
|
||||
extended_bounds: { min: 1599574984482, max: 1599661384482 },
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
query: {
|
||||
bool: {
|
||||
filter: [
|
||||
'{"bool":{"must":[],"filter":[{"match_all":{}},{"bool":{"filter":[{"bool":{"should":[{"exists":{"field":"host.name"}}],"minimum_should_match":1}}]}}],"should":[],"must_not":[]}}',
|
||||
{
|
||||
bool: {
|
||||
filter: [
|
||||
{
|
||||
bool: { should: [{ match: { 'event.kind': 'alert' } }], minimum_should_match: 1 },
|
||||
},
|
||||
],
|
||||
},
|
||||
},
|
||||
{
|
||||
range: {
|
||||
'@timestamp': {
|
||||
gte: '2020-09-08T14:23:04.482Z',
|
||||
lte: '2020-09-09T14:23:04.482Z',
|
||||
format: 'strict_date_optional_time',
|
||||
},
|
||||
},
|
||||
},
|
||||
],
|
||||
},
|
||||
},
|
||||
size: 0,
|
||||
track_total_hits: true,
|
||||
},
|
||||
};
|
|
@ -0,0 +1,22 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
|
||||
import { alertsMatrixHistogramConfig } from '.';
|
||||
import { buildAlertsHistogramQuery } from './query.alerts_histogram.dsl';
|
||||
|
||||
jest.mock('./query.alerts_histogram.dsl', () => ({
|
||||
buildAlertsHistogramQuery: jest.fn(),
|
||||
}));
|
||||
|
||||
describe('alertsMatrixHistogramConfig', () => {
|
||||
test('should export alertsMatrixHistogramConfig corrrectly', () => {
|
||||
expect(alertsMatrixHistogramConfig).toEqual({
|
||||
aggName: 'aggregations.alertsGroup.buckets',
|
||||
parseKey: 'alerts.buckets',
|
||||
buildDsl: buildAlertsHistogramQuery,
|
||||
});
|
||||
});
|
||||
});
|
|
@ -0,0 +1,13 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
import { buildAlertsHistogramQuery } from './query.alerts_histogram.dsl';
|
||||
import { mockOptions, expectedDsl } from './__mocks__/';
|
||||
|
||||
describe('buildAlertsHistogramQuery', () => {
|
||||
test('build query from options correctly', () => {
|
||||
expect(buildAlertsHistogramQuery(mockOptions)).toEqual(expectedDsl);
|
||||
});
|
||||
});
|
|
@ -0,0 +1,73 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
|
||||
import { MatrixHistogramType } from '../../../../../../../common/search_strategy';
|
||||
|
||||
export const mockOptions = {
|
||||
defaultIndex: [
|
||||
'apm-*-transaction*',
|
||||
'auditbeat-*',
|
||||
'endgame-*',
|
||||
'filebeat-*',
|
||||
'logs-*',
|
||||
'packetbeat-*',
|
||||
'winlogbeat-*',
|
||||
],
|
||||
filterQuery:
|
||||
'{"bool":{"must":[],"filter":[{"match_all":{}},{"bool":{"should":[],"minimum_should_match":1}},{"match_phrase":{"result_type":"record"}},null,{"range":{"record_score":{"gte":50}}}],"should":[{"exists":{"field":"source.ip"}},{"exists":{"field":"destination.ip"}}],"must_not":[],"minimum_should_match":1}}',
|
||||
histogramType: MatrixHistogramType.anomalies,
|
||||
timerange: { interval: '12h', from: '2020-09-08T15:14:35.566Z', to: '2020-09-09T15:14:35.566Z' },
|
||||
stackByField: 'job_id',
|
||||
};
|
||||
|
||||
export const expectedDsl = {
|
||||
index: [
|
||||
'apm-*-transaction*',
|
||||
'auditbeat-*',
|
||||
'endgame-*',
|
||||
'filebeat-*',
|
||||
'logs-*',
|
||||
'packetbeat-*',
|
||||
'winlogbeat-*',
|
||||
],
|
||||
allowNoIndices: true,
|
||||
ignoreUnavailable: true,
|
||||
body: {
|
||||
aggs: {
|
||||
anomalyActionGroup: {
|
||||
terms: { field: 'job_id', order: { _count: 'desc' }, size: 10 },
|
||||
aggs: {
|
||||
anomalies: {
|
||||
date_histogram: {
|
||||
field: 'timestamp',
|
||||
fixed_interval: '2700000ms',
|
||||
min_doc_count: 0,
|
||||
extended_bounds: { min: 1599578075566, max: 1599664475566 },
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
query: {
|
||||
bool: {
|
||||
filter: [
|
||||
'{"bool":{"must":[],"filter":[{"match_all":{}},{"bool":{"should":[],"minimum_should_match":1}},{"match_phrase":{"result_type":"record"}},null,{"range":{"record_score":{"gte":50}}}],"should":[{"exists":{"field":"source.ip"}},{"exists":{"field":"destination.ip"}}],"must_not":[],"minimum_should_match":1}}',
|
||||
{
|
||||
range: {
|
||||
timestamp: {
|
||||
gte: '2020-09-08T15:14:35.566Z',
|
||||
lte: '2020-09-09T15:14:35.566Z',
|
||||
format: 'strict_date_optional_time',
|
||||
},
|
||||
},
|
||||
},
|
||||
],
|
||||
},
|
||||
},
|
||||
size: 0,
|
||||
track_total_hits: true,
|
||||
},
|
||||
};
|
|
@ -0,0 +1,22 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
|
||||
import { anomaliesMatrixHistogramConfig } from '.';
|
||||
import { buildAnomaliesHistogramQuery } from './query.anomalies_histogram.dsl';
|
||||
|
||||
jest.mock('./query.anomalies_histogram.dsl', () => ({
|
||||
buildAnomaliesHistogramQuery: jest.fn(),
|
||||
}));
|
||||
|
||||
describe('anomaliesMatrixHistogramConfig', () => {
|
||||
test('should export anomaliesMatrixHistogramConfig corrrectly', () => {
|
||||
expect(anomaliesMatrixHistogramConfig).toEqual({
|
||||
aggName: 'aggregations.anomalyActionGroup.buckets',
|
||||
parseKey: 'anomalies.buckets',
|
||||
buildDsl: buildAnomaliesHistogramQuery,
|
||||
});
|
||||
});
|
||||
});
|
|
@ -0,0 +1,13 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
import { buildAnomaliesHistogramQuery } from './query.anomalies_histogram.dsl';
|
||||
import { mockOptions, expectedDsl } from './__mocks__';
|
||||
|
||||
describe('buildAnomaliesHistogramQuery', () => {
|
||||
test('build query from options correctly', () => {
|
||||
expect(buildAnomaliesHistogramQuery(mockOptions)).toEqual(expectedDsl);
|
||||
});
|
||||
});
|
|
@ -0,0 +1,78 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
|
||||
import { MatrixHistogramType } from '../../../../../../../common/search_strategy';
|
||||
|
||||
export const mockOptions = {
|
||||
defaultIndex: [
|
||||
'apm-*-transaction*',
|
||||
'auditbeat-*',
|
||||
'endgame-*',
|
||||
'filebeat-*',
|
||||
'logs-*',
|
||||
'packetbeat-*',
|
||||
'winlogbeat-*',
|
||||
],
|
||||
filterQuery: '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
|
||||
histogramType: MatrixHistogramType.authentications,
|
||||
timerange: { interval: '12h', from: '2020-09-08T15:22:00.325Z', to: '2020-09-09T15:22:00.325Z' },
|
||||
stackByField: 'event.outcome',
|
||||
};
|
||||
|
||||
export const expectedDsl = {
|
||||
index: [
|
||||
'apm-*-transaction*',
|
||||
'auditbeat-*',
|
||||
'endgame-*',
|
||||
'filebeat-*',
|
||||
'logs-*',
|
||||
'packetbeat-*',
|
||||
'winlogbeat-*',
|
||||
],
|
||||
allowNoIndices: true,
|
||||
ignoreUnavailable: true,
|
||||
body: {
|
||||
aggregations: {
|
||||
eventActionGroup: {
|
||||
terms: {
|
||||
field: 'event.outcome',
|
||||
include: ['success', 'failure'],
|
||||
order: { _count: 'desc' },
|
||||
size: 2,
|
||||
},
|
||||
aggs: {
|
||||
events: {
|
||||
date_histogram: {
|
||||
field: '@timestamp',
|
||||
fixed_interval: '2700000ms',
|
||||
min_doc_count: 0,
|
||||
extended_bounds: { min: 1599578520325, max: 1599664920325 },
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
query: {
|
||||
bool: {
|
||||
filter: [
|
||||
'{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
|
||||
{ bool: { must: [{ term: { 'event.category': 'authentication' } }] } },
|
||||
{
|
||||
range: {
|
||||
'@timestamp': {
|
||||
gte: '2020-09-08T15:22:00.325Z',
|
||||
lte: '2020-09-09T15:22:00.325Z',
|
||||
format: 'strict_date_optional_time',
|
||||
},
|
||||
},
|
||||
},
|
||||
],
|
||||
},
|
||||
},
|
||||
size: 0,
|
||||
track_total_hits: true,
|
||||
},
|
||||
};
|
|
@ -0,0 +1,22 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
|
||||
import { authenticationsMatrixHistogramConfig } from '.';
|
||||
import { buildAuthenticationsHistogramQuery } from './query.authentications_histogram.dsl';
|
||||
|
||||
jest.mock('./query.authentications_histogram.dsl', () => ({
|
||||
buildAuthenticationsHistogramQuery: jest.fn(),
|
||||
}));
|
||||
|
||||
describe('authenticationsMatrixHistogramConfig', () => {
|
||||
test('should export authenticationsMatrixHistogramConfig corrrectly', () => {
|
||||
expect(authenticationsMatrixHistogramConfig).toEqual({
|
||||
aggName: 'aggregations.eventActionGroup.buckets',
|
||||
parseKey: 'events.buckets',
|
||||
buildDsl: buildAuthenticationsHistogramQuery,
|
||||
});
|
||||
});
|
||||
});
|
|
@ -0,0 +1,13 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
import { buildAuthenticationsHistogramQuery } from './query.authentications_histogram.dsl';
|
||||
import { mockOptions, expectedDsl } from './__mocks__/';
|
||||
|
||||
describe('buildAuthenticationsHistogramQuery', () => {
|
||||
test('build query from options correctly', () => {
|
||||
expect(buildAuthenticationsHistogramQuery(mockOptions)).toEqual(expectedDsl);
|
||||
});
|
||||
});
|
|
@ -0,0 +1,72 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
|
||||
import { MatrixHistogramType } from '../../../../../../../common/search_strategy';
|
||||
|
||||
export const mockOptions = {
|
||||
defaultIndex: [
|
||||
'apm-*-transaction*',
|
||||
'auditbeat-*',
|
||||
'endgame-*',
|
||||
'filebeat-*',
|
||||
'logs-*',
|
||||
'packetbeat-*',
|
||||
'winlogbeat-*',
|
||||
],
|
||||
filterQuery: '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
|
||||
histogramType: MatrixHistogramType.dns,
|
||||
timerange: { interval: '12h', from: '2020-09-08T15:41:15.528Z', to: '2020-09-09T15:41:15.529Z' },
|
||||
stackByField: 'dns.question.registered_domain',
|
||||
};
|
||||
|
||||
export const expectedDsl = {
|
||||
index: [
|
||||
'apm-*-transaction*',
|
||||
'auditbeat-*',
|
||||
'endgame-*',
|
||||
'filebeat-*',
|
||||
'logs-*',
|
||||
'packetbeat-*',
|
||||
'winlogbeat-*',
|
||||
],
|
||||
allowNoIndices: true,
|
||||
ignoreUnavailable: true,
|
||||
body: {
|
||||
aggregations: {
|
||||
NetworkDns: {
|
||||
date_histogram: { field: '@timestamp', fixed_interval: '2700000ms' },
|
||||
aggs: {
|
||||
dns: {
|
||||
terms: {
|
||||
field: 'dns.question.registered_domain',
|
||||
order: { orderAgg: 'desc' },
|
||||
size: 10,
|
||||
},
|
||||
aggs: { orderAgg: { cardinality: { field: 'dns.question.name' } } },
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
query: {
|
||||
bool: {
|
||||
filter: [
|
||||
'{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
|
||||
{
|
||||
range: {
|
||||
'@timestamp': {
|
||||
gte: '2020-09-08T15:41:15.528Z',
|
||||
lte: '2020-09-09T15:41:15.529Z',
|
||||
format: 'strict_date_optional_time',
|
||||
},
|
||||
},
|
||||
},
|
||||
],
|
||||
},
|
||||
},
|
||||
size: 0,
|
||||
track_total_hits: true,
|
||||
},
|
||||
};
|
|
@ -0,0 +1,28 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
|
||||
import { dnsMatrixHistogramConfig } from '.';
|
||||
import { buildDnsHistogramQuery } from './query.dns_histogram.dsl';
|
||||
import { getDnsParsedData } from './helpers';
|
||||
|
||||
jest.mock('./query.dns_histogram.dsl', () => ({
|
||||
buildDnsHistogramQuery: jest.fn(),
|
||||
}));
|
||||
|
||||
jest.mock('./helpers', () => ({
|
||||
getDnsParsedData: jest.fn(),
|
||||
}));
|
||||
|
||||
describe('dnsMatrixHistogramConfig', () => {
|
||||
test('should export dnsMatrixHistogramConfig corrrectly', () => {
|
||||
expect(dnsMatrixHistogramConfig).toEqual({
|
||||
aggName: 'aggregations.NetworkDns.buckets',
|
||||
parseKey: 'dns.buckets',
|
||||
buildDsl: buildDnsHistogramQuery,
|
||||
parser: getDnsParsedData,
|
||||
});
|
||||
});
|
||||
});
|
|
@ -0,0 +1,13 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
import { buildDnsHistogramQuery } from './query.dns_histogram.dsl';
|
||||
import { mockOptions, expectedDsl } from './__mocks__/';
|
||||
|
||||
describe('buildDnsHistogramQuery', () => {
|
||||
test('build query from options correctly', () => {
|
||||
expect(buildDnsHistogramQuery(mockOptions)).toEqual(expectedDsl);
|
||||
});
|
||||
});
|
|
@ -0,0 +1,82 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
|
||||
import {
|
||||
MatrixHistogramQuery,
|
||||
MatrixHistogramRequestOptions,
|
||||
MatrixHistogramType,
|
||||
} from '../../../../../../../common/search_strategy';
|
||||
|
||||
export const mockOptions: MatrixHistogramRequestOptions = {
|
||||
defaultIndex: [
|
||||
'apm-*-transaction*',
|
||||
'auditbeat-*',
|
||||
'endgame-*',
|
||||
'filebeat-*',
|
||||
'logs-*',
|
||||
'packetbeat-*',
|
||||
'winlogbeat-*',
|
||||
],
|
||||
factoryQueryType: MatrixHistogramQuery,
|
||||
filterQuery: '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
|
||||
histogramType: MatrixHistogramType.events,
|
||||
timerange: { interval: '12h', from: '2020-09-08T16:11:26.215Z', to: '2020-09-09T16:11:26.215Z' },
|
||||
stackByField: 'event.action',
|
||||
};
|
||||
|
||||
export const expectedDsl = {
|
||||
index: [
|
||||
'apm-*-transaction*',
|
||||
'auditbeat-*',
|
||||
'endgame-*',
|
||||
'filebeat-*',
|
||||
'logs-*',
|
||||
'packetbeat-*',
|
||||
'winlogbeat-*',
|
||||
],
|
||||
allowNoIndices: true,
|
||||
ignoreUnavailable: true,
|
||||
body: {
|
||||
aggregations: {
|
||||
eventActionGroup: {
|
||||
terms: {
|
||||
field: 'event.action',
|
||||
missing: 'All others',
|
||||
order: { _count: 'desc' },
|
||||
size: 10,
|
||||
},
|
||||
aggs: {
|
||||
events: {
|
||||
date_histogram: {
|
||||
field: '@timestamp',
|
||||
fixed_interval: '2700000ms',
|
||||
min_doc_count: 0,
|
||||
extended_bounds: { min: 1599581486215, max: 1599667886215 },
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
},
|
||||
query: {
|
||||
bool: {
|
||||
filter: [
|
||||
'{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
|
||||
{
|
||||
range: {
|
||||
'@timestamp': {
|
||||
gte: '2020-09-08T16:11:26.215Z',
|
||||
lte: '2020-09-09T16:11:26.215Z',
|
||||
format: 'strict_date_optional_time',
|
||||
},
|
||||
},
|
||||
},
|
||||
],
|
||||
},
|
||||
},
|
||||
size: 0,
|
||||
track_total_hits: true,
|
||||
},
|
||||
};
|
|
@ -0,0 +1,22 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
|
||||
import { eventsMatrixHistogramConfig } from '.';
|
||||
import { buildEventsHistogramQuery } from './query.events_histogram.dsl';
|
||||
|
||||
jest.mock('./query.events_histogram.dsl.ts', () => ({
|
||||
buildEventsHistogramQuery: jest.fn(),
|
||||
}));
|
||||
|
||||
describe('eventsMatrixHistogramConfig', () => {
|
||||
test('should export eventsMatrixHistogramConfig corrrectly', () => {
|
||||
expect(eventsMatrixHistogramConfig).toEqual({
|
||||
aggName: 'aggregations.eventActionGroup.buckets',
|
||||
parseKey: 'events.buckets',
|
||||
buildDsl: buildEventsHistogramQuery,
|
||||
});
|
||||
});
|
||||
});
|
|
@ -0,0 +1,13 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
import { buildEventsHistogramQuery } from './query.events_histogram.dsl';
|
||||
import { mockOptions, expectedDsl } from './__mocks__/';
|
||||
|
||||
describe('buildEventsHistogramQuery', () => {
|
||||
test('build query from options correctly', () => {
|
||||
expect(buildEventsHistogramQuery(mockOptions)).toEqual(expectedDsl);
|
||||
});
|
||||
});
|
|
@ -0,0 +1,211 @@
|
|||
/*
|
||||
* Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
||||
* or more contributor license agreements. Licensed under the Elastic License;
|
||||
* you may not use this file except in compliance with the Elastic License.
|
||||
*/
|
||||
|
||||
import {
|
||||
MatrixHistogramRequestOptions,
|
||||
MatrixHistogramType,
|
||||
} from '../../../../../common/search_strategy/security_solution';
|
||||
import { matrixHistogram } from '.';
|
||||
import {
|
||||
formattedAlertsSearchStrategyResponse,
|
||||
formattedAnomaliesSearchStrategyResponse,
|
||||
formattedAuthenticationsSearchStrategyResponse,
|
||||
formattedEventsSearchStrategyResponse,
|
||||
formattedDnsSearchStrategyResponse,
|
||||
mockAlertsSearchStrategyResponse,
|
||||
mockAnomaliesSearchStrategyResponse,
|
||||
mockAuthenticationsSearchStrategyResponse,
|
||||
mockEventsSearchStrategyResponse,
|
||||
mockDnsSearchStrategyResponse,
|
||||
} from './__mocks__';
|
||||
import { alertsMatrixHistogramConfig } from './alerts';
|
||||
import { anomaliesMatrixHistogramConfig } from './anomalies';
|
||||
import { authenticationsMatrixHistogramConfig } from './authentications';
|
||||
import { eventsMatrixHistogramConfig } from './events';
|
||||
import { dnsMatrixHistogramConfig } from './dns';
|
||||
|
||||
import { mockOptions as mockAlertsOptions } from './alerts/__mocks__';
|
||||
import { mockOptions as mockAnomaliesOptions } from './anomalies/__mocks__';
|
||||
import { mockOptions as mockAuthenticationsOptions } from './authentications/__mocks__';
|
||||
import { mockOptions as mockEventsOptions } from './events/__mocks__';
|
||||
import { mockOptions as mockDnsOptions } from './dns/__mocks__';
|
||||
|
||||
describe('Alerts matrixHistogram search strategy', () => {
|
||||
const buildMatrixHistogramQuery = jest.spyOn(alertsMatrixHistogramConfig, 'buildDsl');
|
||||
|
||||
afterEach(() => {
|
||||
buildMatrixHistogramQuery.mockClear();
|
||||
});
|
||||
|
||||
describe('buildDsl', () => {
|
||||
test('should build dsl query', () => {
|
||||
matrixHistogram.buildDsl(mockAlertsOptions);
|
||||
expect(buildMatrixHistogramQuery).toHaveBeenCalledWith(mockAlertsOptions);
|
||||
});
|
||||
|
||||
test('should throw error if histogramType is invalid', () => {
|
||||
const invalidOptions: MatrixHistogramRequestOptions = {
|
||||
...mockAlertsOptions,
|
||||
histogramType: 'xxx' as MatrixHistogramType,
|
||||
} as MatrixHistogramRequestOptions;
|
||||
|
||||
expect(() => {
|
||||
matrixHistogram.buildDsl(invalidOptions);
|
||||
}).toThrowError(`This histogram type xxx is unknown to the server side`);
|
||||
});
|
||||
});
|
||||
|
||||
describe('parse', () => {
|
||||
test('should parse data correctly', async () => {
|
||||
const result = await matrixHistogram.parse(
|
||||
mockAlertsOptions,
|
||||
mockAlertsSearchStrategyResponse
|
||||
);
|
||||
expect(result).toMatchObject(formattedAlertsSearchStrategyResponse);
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe('Anomalies matrixHistogram search strategy', () => {
|
||||
const buildMatrixHistogramQuery = jest.spyOn(anomaliesMatrixHistogramConfig, 'buildDsl');
|
||||
|
||||
afterEach(() => {
|
||||
buildMatrixHistogramQuery.mockClear();
|
||||
});
|
||||
|
||||
describe('buildDsl', () => {
|
||||
test('should build dsl query', () => {
|
||||
matrixHistogram.buildDsl(mockAnomaliesOptions);
|
||||
expect(buildMatrixHistogramQuery).toHaveBeenCalledWith(mockAnomaliesOptions);
|
||||
});
|
||||
|
||||
test('should throw error if histogramType is invalid', () => {
|
||||
const invalidOptions: MatrixHistogramRequestOptions = {
|
||||
...mockAnomaliesOptions,
|
||||
histogramType: 'xxx' as MatrixHistogramType,
|
||||
} as MatrixHistogramRequestOptions;
|
||||
|
||||
expect(() => {
|
||||
matrixHistogram.buildDsl(invalidOptions);
|
||||
}).toThrowError(`This histogram type xxx is unknown to the server side`);
|
||||
});
|
||||
});
|
||||
|
||||
describe('parse', () => {
|
||||
test('should parse data correctly', async () => {
|
||||
const result = await matrixHistogram.parse(
|
||||
mockAnomaliesOptions,
|
||||
mockAnomaliesSearchStrategyResponse
|
||||
);
|
||||
expect(result).toMatchObject(formattedAnomaliesSearchStrategyResponse);
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe('Authentications matrixHistogram search strategy', () => {
|
||||
const buildMatrixHistogramQuery = jest.spyOn(authenticationsMatrixHistogramConfig, 'buildDsl');
|
||||
|
||||
afterEach(() => {
|
||||
buildMatrixHistogramQuery.mockClear();
|
||||
});
|
||||
|
||||
describe('buildDsl', () => {
|
||||
test('should build dsl query', () => {
|
||||
matrixHistogram.buildDsl(mockAuthenticationsOptions);
|
||||
expect(buildMatrixHistogramQuery).toHaveBeenCalledWith(mockAuthenticationsOptions);
|
||||
});
|
||||
|
||||
test('should throw error if histogramType is invalid', () => {
|
||||
const invalidOptions = {
|
||||
...mockAuthenticationsOptions,
|
||||
histogramType: 'xxx' as MatrixHistogramType,
|
||||
} as MatrixHistogramRequestOptions;
|
||||
|
||||
expect(() => {
|
||||
matrixHistogram.buildDsl(invalidOptions);
|
||||
}).toThrowError(`This histogram type xxx is unknown to the server side`);
|
||||
});
|
||||
});
|
||||
|
||||
describe('parse', () => {
|
||||
test('should parse data correctly', async () => {
|
||||
const result = await matrixHistogram.parse(
|
||||
mockAuthenticationsOptions,
|
||||
mockAuthenticationsSearchStrategyResponse
|
||||
);
|
||||
expect(result).toMatchObject(formattedAuthenticationsSearchStrategyResponse);
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe('Events matrixHistogram search strategy', () => {
|
||||
const buildMatrixHistogramQuery = jest.spyOn(eventsMatrixHistogramConfig, 'buildDsl');
|
||||
|
||||
afterEach(() => {
|
||||
buildMatrixHistogramQuery.mockClear();
|
||||
});
|
||||
|
||||
describe('buildDsl', () => {
|
||||
test('should build dsl query', () => {
|
||||
matrixHistogram.buildDsl(mockEventsOptions);
|
||||
expect(buildMatrixHistogramQuery).toHaveBeenCalledWith(mockEventsOptions);
|
||||
});
|
||||
|
||||
test('should throw error if histogramType is invalid', () => {
|
||||
const invalidOptions = {
|
||||
...mockEventsOptions,
|
||||
histogramType: 'xxx' as MatrixHistogramType,
|
||||
} as MatrixHistogramRequestOptions;
|
||||
|
||||
expect(() => {
|
||||
matrixHistogram.buildDsl(invalidOptions);
|
||||
}).toThrowError(`This histogram type xxx is unknown to the server side`);
|
||||
});
|
||||
});
|
||||
|
||||
describe('parse', () => {
|
||||
test('should parse data correctly', async () => {
|
||||
const result = await matrixHistogram.parse(
|
||||
mockEventsOptions,
|
||||
mockEventsSearchStrategyResponse
|
||||
);
|
||||
expect(result).toMatchObject(formattedEventsSearchStrategyResponse);
|
||||
});
|
||||
});
|
||||
});
|
||||
|
||||
describe('Dns matrixHistogram search strategy', () => {
|
||||
const buildMatrixHistogramQuery = jest.spyOn(dnsMatrixHistogramConfig, 'buildDsl');
|
||||
|
||||
afterEach(() => {
|
||||
buildMatrixHistogramQuery.mockClear();
|
||||
});
|
||||
|
||||
describe('buildDsl', () => {
|
||||
test('should build dsl query', () => {
|
||||
matrixHistogram.buildDsl(mockDnsOptions);
|
||||
expect(buildMatrixHistogramQuery).toHaveBeenCalledWith(mockDnsOptions);
|
||||
});
|
||||
|
||||
test('should throw error if histogramType is invalid', () => {
|
||||
const invalidOptions = {
|
||||
...mockDnsOptions,
|
||||
histogramType: 'xxx' as MatrixHistogramType,
|
||||
} as MatrixHistogramRequestOptions;
|
||||
|
||||
expect(() => {
|
||||
matrixHistogram.buildDsl(invalidOptions);
|
||||
}).toThrowError(`This histogram type xxx is unknown to the server side`);
|
||||
});
|
||||
});
|
||||
|
||||
describe('parse', () => {
|
||||
test('should parse data correctly', async () => {
|
||||
const result = await matrixHistogram.parse(mockDnsOptions, mockDnsSearchStrategyResponse);
|
||||
expect(result).toMatchObject(formattedDnsSearchStrategyResponse);
|
||||
});
|
||||
});
|
||||
});
|
Loading…
Reference in a new issue