Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Security Solution] Cover rule snoozing functionality by automated tests #158196

Open
2 of 3 tasks
Tracked by #161509
maximpn opened this issue May 22, 2023 · 5 comments
Open
2 of 3 tasks
Tracked by #161509

[Security Solution] Cover rule snoozing functionality by automated tests #158196

maximpn opened this issue May 22, 2023 · 5 comments
Assignees
@maximpn
Labels
Feature:Rule Actions Security Solution Rule Actions feature Feature:Rule Management Security Solution Detection Rule Management Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. technical debt Improvement of the software architecture and operational architecture test test-coverage issues & PRs for improving code test coverage v8.9.0

Comments

@maximpn
Copy link
Contributor

maximpn commented May 22, 2023 •
edited by banderror

Epics: #153633, https://github.com/elastic/security-team/issues/5308 (internal)
Relates to: #147735, #155406, #147737, #147736

Summary

The rule snoozing feature adopted from Alerting Framework has to be properly tested. Add automated tests to cover the functionality.

Todo
@maximpn maximpn added Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. Team:Detection Rule Management Security Detection Rule Management Team 8.9 candidate labels May 22, 2023
@maximpn maximpn self-assigned this May 22, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@maximpn maximpn mentioned this issue May 22, 2023
Merged
@maximpn maximpn added Feature:Rule Actions Security Solution Rule Actions feature Feature:Rule Management Security Solution Detection Rule Management labels May 22, 2023
@banderror banderror added test technical debt Improvement of the software architecture and operational architecture test-coverage issues & PRs for improving code test coverage labels May 23, 2023
maximpn added a commit that referenced this issue Jun 7, 2023
@maximpn
[Security Solution] Add snooze rule tests (#158195)
dc953c7 
**Addresses:** #158196

## Summary

This PR mostly implements a test plan to cover rule snoozing functionality by automation tests.
@banderror
Copy link
Contributor

Should be resolved by #158195
@maximpn Is there anything else left to do regarding the test coverage, besides #159349?

@maximpn
Copy link
Contributor Author

maximpn commented Jun 20, 2023

Is there anything else left to do regarding the test coverage, besides #159349?

@banderror the following cases and scenarios aren't covered by #158195

  • Run the whole cycle to verify actions are snoozed for generated alerts (existing tests just make sure snooze settings are saved correctly)
  • User can snooze a rule indefinitely
  • User can snooze a rule according to a schedule
  • User can specify a timezone when snoozing a rule according to a schedule
  • User with read privileges on security solution cannot snooze or unsnooze rules
  • Snooze status is setup by default state when user upgrades from version 8.7 to 8.8 version

@banderror
Copy link
Contributor

I see, thanks for the info @maximpn. I think we should increase the coverage in the 8.10 cycle. Let's keep the ticket open.

@banderror banderror mentioned this issue Jun 20, 2023
Open
@banderror banderror mentioned this issue Jul 8, 2023
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@maximpn maximpn

Labels
Feature:Rule Actions Security Solution Rule Actions feature Feature:Rule Management Security Solution Detection Rule Management Team:Detection Rule Management Security Detection Rule Management Team Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. technical debt Improvement of the software architecture and operational architecture test test-coverage issues & PRs for improving code test coverage v8.9.0
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@maximpn @banderror @elasticmachine