Skip to content

Commit ffcd2bb

Browse files
pheyospheyos
committed
[ML] API integration tests - security_linux and security_windows modules (elastic#85743)
This PR adds API integration tests to create and setup the security_linux and security_windows modules.
1 parent f95df73 commit ffcd2bb

File tree

5 files changed

+7895
-0
lines changed

5 files changed

+7895
-0
lines changed

‎x-pack/test/api_integration/apis/ml/index.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
3434
await ml.testResources.deleteIndexPatternByTitle('ft_module_siem_packetbeat');
3535
await ml.testResources.deleteIndexPatternByTitle('ft_module_siem_winlogbeat');
3636
await ml.testResources.deleteIndexPatternByTitle('ft_farequote');
37+
await ml.testResources.deleteIndexPatternByTitle('ft_logs-endpoint.events.*');
3738

3839
await esArchiver.unload('ml/ecommerce');
3940
await esArchiver.unload('ml/categorization');
@@ -45,6 +46,7 @@ export default function ({ getService, loadTestFile }: FtrProviderContext) {
4546
await esArchiver.unload('ml/module_nginx');
4647
await esArchiver.unload('ml/module_sample_ecommerce');
4748
await esArchiver.unload('ml/module_sample_logs');
49+
await esArchiver.unload('ml/module_security_endpoint');
4850
await esArchiver.unload('ml/module_siem_auditbeat');
4951
await esArchiver.unload('ml/module_siem_packetbeat');
5052
await esArchiver.unload('ml/module_siem_winlogbeat');

‎x-pack/test/api_integration/apis/ml/modules/recognize_module.ts‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -135,6 +135,16 @@ export default ({ getService }: FtrProviderContext) => {
135135
moduleIds: ['auditbeat_process_hosts_ecs', 'security_linux', 'siem_auditbeat'],
136136
},
137137
},
138+
{
139+
testTitleSuffix: 'for security endpoint dataset',
140+
sourceDataArchive: 'ml/module_security_endpoint',
141+
indexPattern: 'ft_logs-endpoint.events.*',
142+
user: USER.ML_POWERUSER,
143+
expected: {
144+
responseCode: 200,
145+
moduleIds: ['security_linux', 'security_windows'],
146+
},
147+
},
138148
];
139149

140150
async function executeRecognizeModuleRequest(indexPattern: string, user: USER, rspCode: number) {

‎x-pack/test/api_integration/apis/ml/modules/setup_module.ts‎

Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -520,6 +520,134 @@ export default ({ getService }: FtrProviderContext) => {
520520
] as string[],
521521
},
522522
},
523+
{
524+
testTitleSuffix:
525+
'for security_linux with prefix, startDatafeed true and estimateModelMemory true',
526+
sourceDataArchive: 'ml/module_security_endpoint',
527+
indexPattern: { name: 'ft_logs-endpoint.events.*', timeField: '@timestamp' },
528+
module: 'security_linux',
529+
user: USER.ML_POWERUSER,
530+
requestBody: {
531+
prefix: 'pf15_',
532+
indexPatternName: 'ft_logs-endpoint.events.*',
533+
startDatafeed: true,
534+
end: Date.now(),
535+
},
536+
expected: {
537+
responseCode: 200,
538+
jobs: [
539+
{
540+
jobId: 'pf15_v2_rare_process_by_host_linux_ecs',
541+
jobState: JOB_STATE.CLOSED,
542+
datafeedState: DATAFEED_STATE.STOPPED,
543+
modelMemoryLimit: '11mb',
544+
},
545+
{
546+
jobId: 'pf15_v2_linux_rare_metadata_user',
547+
jobState: JOB_STATE.CLOSED,
548+
datafeedState: DATAFEED_STATE.STOPPED,
549+
modelMemoryLimit: '11mb',
550+
},
551+
{
552+
jobId: 'pf15_v2_linux_rare_metadata_process',
553+
jobState: JOB_STATE.CLOSED,
554+
datafeedState: DATAFEED_STATE.STOPPED,
555+
modelMemoryLimit: '11mb',
556+
},
557+
{
558+
jobId: 'pf15_v2_linux_anomalous_user_name_ecs',
559+
jobState: JOB_STATE.CLOSED,
560+
datafeedState: DATAFEED_STATE.STOPPED,
561+
modelMemoryLimit: '11mb',
562+
},
563+
{
564+
jobId: 'pf15_v2_linux_anomalous_process_all_hosts_ecs',
565+
jobState: JOB_STATE.CLOSED,
566+
datafeedState: DATAFEED_STATE.STOPPED,
567+
modelMemoryLimit: '11mb',
568+
},
569+
{
570+
jobId: 'pf15_v2_linux_anomalous_network_port_activity_ecs',
571+
jobState: JOB_STATE.CLOSED,
572+
datafeedState: DATAFEED_STATE.STOPPED,
573+
modelMemoryLimit: '11mb',
574+
},
575+
],
576+
searches: [] as string[],
577+
visualizations: [] as string[],
578+
dashboards: [] as string[],
579+
},
580+
},
581+
{
582+
testTitleSuffix:
583+
'for security_windows with prefix, startDatafeed true and estimateModelMemory true',
584+
sourceDataArchive: 'ml/module_security_endpoint',
585+
indexPattern: { name: 'ft_logs-endpoint.events.*', timeField: '@timestamp' },
586+
module: 'security_windows',
587+
user: USER.ML_POWERUSER,
588+
requestBody: {
589+
prefix: 'pf16_',
590+
indexPatternName: 'ft_logs-endpoint.events.*',
591+
startDatafeed: true,
592+
end: Date.now(),
593+
},
594+
expected: {
595+
responseCode: 200,
596+
jobs: [
597+
{
598+
jobId: 'pf16_v2_rare_process_by_host_windows_ecs',
599+
jobState: JOB_STATE.CLOSED,
600+
datafeedState: DATAFEED_STATE.STOPPED,
601+
modelMemoryLimit: '11mb',
602+
},
603+
{
604+
jobId: 'pf16_v2_windows_anomalous_network_activity_ecs',
605+
jobState: JOB_STATE.CLOSED,
606+
datafeedState: DATAFEED_STATE.STOPPED,
607+
modelMemoryLimit: '11mb',
608+
},
609+
{
610+
jobId: 'pf16_v2_windows_anomalous_path_activity_ecs',
611+
jobState: JOB_STATE.CLOSED,
612+
datafeedState: DATAFEED_STATE.STOPPED,
613+
modelMemoryLimit: '10mb',
614+
},
615+
{
616+
jobId: 'pf16_v2_windows_anomalous_process_all_hosts_ecs',
617+
jobState: JOB_STATE.CLOSED,
618+
datafeedState: DATAFEED_STATE.STOPPED,
619+
modelMemoryLimit: '11mb',
620+
},
621+
{
622+
jobId: 'pf16_v2_windows_anomalous_process_creation',
623+
jobState: JOB_STATE.CLOSED,
624+
datafeedState: DATAFEED_STATE.STOPPED,
625+
modelMemoryLimit: '11mb',
626+
},
627+
{
628+
jobId: 'pf16_v2_windows_anomalous_user_name_ecs',
629+
jobState: JOB_STATE.CLOSED,
630+
datafeedState: DATAFEED_STATE.STOPPED,
631+
modelMemoryLimit: '11mb',
632+
},
633+
{
634+
jobId: 'pf16_v2_windows_rare_metadata_process',
635+
jobState: JOB_STATE.CLOSED,
636+
datafeedState: DATAFEED_STATE.STOPPED,
637+
modelMemoryLimit: '11mb',
638+
},
639+
{
640+
jobId: 'pf16_v2_windows_rare_metadata_user',
641+
jobState: JOB_STATE.CLOSED,
642+
datafeedState: DATAFEED_STATE.STOPPED,
643+
modelMemoryLimit: '11mb',
644+
},
645+
],
646+
searches: [] as string[],
647+
visualizations: [] as string[],
648+
dashboards: [] as string[],
649+
},
650+
},
523651
];
524652

525653
const testDataListNegative = [

‎x-pack/test/functional/es_archives/ml/module_security_endpoint/data.json.gz‎

1.25 MB
Binary file not shown.

0 commit comments

Comments
 (0)