Skip to content

Commit

Permalink
enable threshold rule type for KQL inline query tests
Browse files Browse the repository at this point in the history
  • Loading branch information
@maximpn
maximpn committed Feb 4, 2025
1 parent 904a73d commit 32c9e2a
Showing 1 changed file with 146 additions and 2 deletions.
148 changes: 146 additions & 2 deletions ...t_rule_customization/customization_enabled/diffable_rule_fields/kql_query.inline_query.ts
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@ import {
setUpRuleUpgrade,
} from '../../../../../utils/rules/prebuilt_rules/set_up_rule_upgrade';

const RULE_TYPES = ['query', 'threat_match', /* 'threshold',*/ 'new_terms'] as const;
const RULE_TYPES = ['query', 'threat_match', 'threshold', 'new_terms'] as const;

export function inlineQueryKqlQueryField({ getService }: FtrProviderContext): void {
const es = getService('es');
Expand All @@ -35,7 +35,7 @@ export function inlineQueryKqlQueryField({ getService }: FtrProviderContext): vo
};

for (const ruleType of RULE_TYPES) {
describe('"kql_query" with inline query', () => {
describe(`"kql_query" with inline query for ${ruleType} rule`, () => {
describe('non-customized w/o an upgrade (AAA diff case)', () => {
describe('without filters', () => {
beforeEach(async () => {
Expand Down Expand Up @@ -140,6 +140,14 @@ export function inlineQueryKqlQueryField({ getService }: FtrProviderContext): vo
installed: {
type: ruleType,
filters: [FILTER],
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
patch: {
type: ruleType,
Expand All @@ -152,10 +160,26 @@ export function inlineQueryKqlQueryField({ getService }: FtrProviderContext): vo
},
},
],
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
upgrade: {
type: ruleType,
filters: [FILTER],
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
},
deps,
Expand Down Expand Up @@ -328,15 +352,39 @@ export function inlineQueryKqlQueryField({ getService }: FtrProviderContext): vo
type: ruleType,
query: 'process.name:*.exe',
language: 'kuery',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
patch: {
type: ruleType,
query: '*:*',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
upgrade: {
type: ruleType,
query: 'process.name:*.exe',
language: 'kuery',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
},
deps,
Expand Down Expand Up @@ -470,15 +518,39 @@ export function inlineQueryKqlQueryField({ getService }: FtrProviderContext): vo
type: ruleType,
query: 'process.name:*.exe',
language: 'kuery',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
patch: {
type: ruleType,
query: '*:*',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
upgrade: {
type: ruleType,
query: '*:*',
language: 'kuery',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
},
deps,
Expand Down Expand Up @@ -612,15 +684,39 @@ export function inlineQueryKqlQueryField({ getService }: FtrProviderContext): vo
type: ruleType,
query: 'process.name:*.exe',
language: 'kuery',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
patch: {
type: ruleType,
query: '*:*',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
upgrade: {
type: ruleType,
query: 'process.name:*.sys',
language: 'kuery',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
},
deps,
Expand Down Expand Up @@ -722,15 +818,39 @@ export function inlineQueryKqlQueryField({ getService }: FtrProviderContext): vo
type: ruleType,
query: 'process.name:*.exe',
language: 'kuery',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
patch: {
type: ruleType,
query: 'process.name:*.sys',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
upgrade: {
type: ruleType,
query: 'process.name:*.sys',
language: 'kuery',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
},
removeInstalledAssets: true,
Expand Down Expand Up @@ -802,15 +922,39 @@ export function inlineQueryKqlQueryField({ getService }: FtrProviderContext): vo
type: ruleType,
query: 'process.name:*.exe',
language: 'kuery',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
patch: {
type: ruleType,
query: '*:*',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
upgrade: {
type: ruleType,
query: 'process.name:*.sys',
language: 'kuery',
...(ruleType === 'threshold'
? {
threshold: {
value: 10,
field: 'fieldA',
},
}
: {}),
},
},
removeInstalledAssets: true,
Expand Down

0 comments on commit 32c9e2a

Please sign in to comment.