Skip to content

[EDR Workflows] Fix Osquery tests #215507

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
tomsonpl merged 17 commits into from
Apr 15, 2025
Merged

[EDR Workflows] Fix Osquery tests #215507

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
7208af7
increase timeout and change permissions
tomsonpl Mar 21, 2025
47e39e1
fix
tomsonpl Mar 21, 2025
210e2db
fix
tomsonpl Mar 21, 2025
024b104
Merge branch 'main' into fix-osquery-tests-march
tomsonpl Mar 24, 2025
02fafaf
fix
tomsonpl Mar 24, 2025
fc9075e
specs for flaky test runner
tomsonpl Mar 24, 2025
a106e92
Merge remote-tracking branch 'origin/fix-osquery-tests-march' into fi…
tomsonpl Mar 24, 2025
3047330
specs for flaky test runner
tomsonpl Mar 24, 2025
ec1f9f7
Merge branch 'main' into fix-osquery-tests-march
tomsonpl Apr 10, 2025
4373ae8
fix
tomsonpl Apr 11, 2025
45f66ac
fix
tomsonpl Apr 11, 2025
93af4bf
fix
tomsonpl Apr 11, 2025
60acac6
Merge branch 'main' into fix-osquery-tests-march
tomsonpl Apr 11, 2025
2b3a007
Merge branch 'main' into fix-osquery-tests-march
tomsonpl Apr 13, 2025
8a5bb30
Merge branch 'main' into fix-osquery-tests-march
tomsonpl Apr 14, 2025
29a2ac7
Merge remote-tracking branch 'origin/fix-osquery-tests-march' into fi…
tomsonpl Apr 14, 2025
2d61c64
Merge branch 'main' into fix-osquery-tests-march
tomsonpl Apr 14, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
201 changes: 104 additions & 97 deletions x-pack/platform/plugins/shared/osquery/cypress/e2e/all/alerts_automated_action_results.cy.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,116 +7,123 @@

import { initializeDataViews } from '../../tasks/login';
import { cleanupRule, loadRule } from '../../tasks/api_fixtures';
import { checkActionItemsInResults, loadRuleAlerts } from '../../tasks/live_query';
import { checkActionItemsInResults, loadRuleAlerts, navigateToRule } from '../../tasks/live_query';

const UUID_REGEX = '[0-9A-Fa-f]{8}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{4}-[0-9A-Fa-f]{12}';

// FLAKY: https://github.com/elastic/kibana/issues/178404
// FLAKY: https://github.com/elastic/kibana/issues/197335
// Failing: See https://github.com/elastic/kibana/issues/197335
// Failing: See https://github.com/elastic/kibana/issues/178404
describe.skip('Alert Flyout Automated Action Results', () => {
let ruleId: string;
describe(
'Alert Flyout Automated Action Results',
{ tags: ['@ess', '@serverless', '@skipInServerlessMKI'] },
() => {
let ruleId: string;
let ruleName: string;

before(() => {
initializeDataViews();
});

beforeEach(() => {
loadRule(true).then((data) => {
ruleId = data.id;
loadRuleAlerts(data.name);
before(() => {
initializeDataViews();
loadRule(true).then((data) => {
ruleId = data.id;
ruleName = data.name;
loadRuleAlerts(ruleName);
});
});
});

afterEach(() => {
cleanupRule(ruleId);
});
beforeEach(() => {
navigateToRule(ruleName);
});

it('can visit discover from response action results', { tags: ['@ess'] }, () => {
const discoverRegex = new RegExp(`action_id: ${UUID_REGEX}`);
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
after(() => {
cleanupRule(ruleId);
});
cy.contains('View in Discover')
.should('exist')
.should('have.attr', 'href')
.then(($href) => {
// @ts-expect-error-next-line href string - check types
cy.visit($href);
cy.getBySel('discoverDocTable', { timeout: 60000 }).within(() => {
cy.contains('action_data{ "query":');
});
cy.contains(discoverRegex);
});
});

it('can visit lens from response action results', { tags: ['@ess'] }, () => {
const lensRegex = new RegExp(`Action ${UUID_REGEX} results`);
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
it('can visit discover from response action results', { tags: ['@ess'] }, () => {
const discoverRegex = new RegExp(`action_id: ${UUID_REGEX}`);
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
});
cy.contains('View in Discover')
.should('exist')
.should('have.attr', 'href')
.then(($href) => {
// @ts-expect-error-next-line href string - check types
cy.visit($href);
cy.getBySel('discoverDocTable', { timeout: 60000 }).within(() => {
cy.contains(/action_data\{[^}]*"query":[^}]*\}/);
});
cy.contains(discoverRegex);
});
});
cy.getBySel('osquery-results-comment')
.first()
.within(() => {
let lensUrl = '';
cy.window().then((win) => {
cy.stub(win, 'open')
.as('windowOpen')
.callsFake((url) => {
lensUrl = url;

it('can visit lens from response action results', { tags: ['@ess'] }, () => {
const lensRegex = new RegExp(`Action ${UUID_REGEX} results`);
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
});
cy.getBySel('osquery-results-comment')
.first()
.within(() => {
let lensUrl = '';
cy.window().then((win) => {
cy.stub(win, 'open')
.as('windowOpen')
.callsFake((url) => {
lensUrl = url;
});
});
cy.get(`[aria-label="View in Lens"]`).click();
cy.window()
.its('open')
.then(() => {
cy.visit(lensUrl);
});
});
cy.get(`[aria-label="View in Lens"]`).click();
cy.window()
.its('open')
.then(() => {
cy.visit(lensUrl);
});
});
cy.getBySel('lnsWorkspace').should('exist');
cy.getBySel('breadcrumbs').contains(lensRegex);
});

it('can add to timeline from response action results', { tags: ['@ess', '@serverless'] }, () => {
const timelineRegex = new RegExp(`Added ${UUID_REGEX} to timeline`);
const filterRegex = new RegExp(`action_id: "${UUID_REGEX}"`);
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
cy.getBySel('lnsWorkspace').should('exist');
cy.getBySel('breadcrumbs').contains(lensRegex);
});
cy.getBySel('osquery-results-comment')
.first()
.within(() => {
cy.get('.euiTableRow')

it(
'can add to timeline from response action results',
{ tags: ['@ess', '@serverless'] },
() => {
const timelineRegex = new RegExp(`Added ${UUID_REGEX} to Timeline`);

@tomsonpl tomsonpl Mar 21, 2025 •
edited
Loading

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

changed timeline to Timeline

const filterRegex = new RegExp(`action_id: "${UUID_REGEX}"`);
cy.getBySel('expand-event').first().click();
cy.getBySel('securitySolutionFlyoutResponseSectionHeader').click();
cy.getBySel('securitySolutionFlyoutResponseButton').click();
cy.getBySel('responseActionsViewWrapper').should('exist');
checkActionItemsInResults({
lens: true,
discover: true,
cases: true,
timeline: true,
});
cy.getBySel('osquery-results-comment')
.first()
.within(() => {
cy.getBySel('add-to-timeline').click();
cy.get('.euiTableRow')
.first()
.within(() => {
cy.getBySel('add-to-timeline').click();
});
});
});
cy.contains(timelineRegex);
cy.getBySel('securitySolutionFlyoutNavigationCollapseDetailButton').click();
cy.getBySel('timeline-bottom-bar').contains('Untitled timeline').click();
cy.contains(filterRegex);
});
});
cy.contains(timelineRegex);
cy.getBySel('securitySolutionFlyoutNavigationCollapseDetailButton').click();
cy.getBySel('timeline-bottom-bar').contains('Untitled timeline').click();
cy.contains(filterRegex);
}
);
}
);
Loading