Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[RAC][Rule Registry] Add tests for RuleDataService and RuleDataClient #110804

Closed
Tracked by #101016
banderror opened this issue Sep 1, 2021 · 3 comments
Closed
Tracked by #101016
Labels
Team:Detection Alerts Security Detection Alerts Area Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Theme: rac label obsolete

Comments

@banderror
Copy link
Contributor

Parent ticket: #101016

Summary

The indexing logic of Rule Registry (RuleDataService and RuleDataClient) is not covered with tests, not well tested and its quality and stability is unknown.

We need to cover it with integration and unit tests, checking:

  • initial index bootstrapping
  • subsequent index bootstrapping with the same parameters
  • subsequent index bootstrapping with changed parameters (new mappings added/removed, settings changed, custom ILM policy set, etc)
  • simulated race conditions between "kibana instances" bootstrapping the same index
  • simulated race conditions between "plugins/solutions" bootstrapping different indices
  • simulated race conditions between "kibana instances" bootstrapping multiple indices
  • error handling of responses from Elasticsearch
  • error handling of network errors
  • error handling in data processing (our own code)
  • writing a lot of documents to a single index
  • writing a lot of documents to multiple indices
  • load on ES due to many calls to getWriter or getReader
  • etc, think of anything else
@banderror banderror added Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Theme: rac label obsolete labels Sep 1, 2021
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@banderror
Copy link
Contributor Author

Hey everyone, I removed this ticket from the backlog of the Detection Rules area.

We (@elastic/security-detections-response-rules) are not the owners anymore (however feel free to still ping us if you have any tech questions about the ticket). Ownership of this ticket and other tickets related to rule_registry (like #101016) now goes to the Detection Alerts area (Team:Detection Alerts label). Please ping @peluja1012 and @marshallmain if you have any questions.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Team:Detection Alerts Security Detection Alerts Area Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Theme: rac label obsolete
Projects
None yet
Development

No branches or pull requests

3 participants