Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Failing ES Promotion: FTR Configs #22 / detection engine api security and spaces enabled - rule execution logic Non ECS fields in alert document source should fail creating alert when ECS field mapping is geo_point #162247

Merged
merged 2 commits into from Jul 20, 2023
Merged

Failing ES Promotion: FTR Configs #22 / detection engine api security and spaces enabled - rule execution logic Non ECS fields in alert document source should fail creating alert when ECS field mapping is geo_point #162247

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
527c2e9
Failing ES Promotion: FTR Configs #22 / detection engine api security…
e40pud Jul 19, 2023
382da99
Fix dynamic error message failure
e40pud Jul 19, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
9 changes: 5 additions & 4 deletions ...tection_engine_api_integration/security_and_spaces/rule_execution_logic/non_ecs_fields.ts
View file
Open in desktop
Expand Up @@ -57,7 +57,7 @@ export default ({ getService }: FtrProviderContext) => {
};

// FAILING ES PROMOTION: https://github.com/elastic/kibana/issues/154277
describe.skip('Non ECS fields in alert document source', () => {
describe('Non ECS fields in alert document source', () => {
before(async () => {
await esArchiver.load(
'x-pack/test/functional/es_archives/security_solution/ecs_non_compliant'
Expand Down Expand Up @@ -232,7 +232,7 @@ export default ({ getService }: FtrProviderContext) => {
// invalid ECS field is getting removed
expect(alertSource).toHaveProperty('threat.enrichments', []);

expect(alertSource).toHaveProperty('threat.indicator.port', 443);
expect(alertSource).toHaveProperty(['threat', 'indicator.port'], 443);
});

// source client.bytes is text, ECS mapping for client.bytes is long
Expand Down Expand Up @@ -271,8 +271,9 @@ export default ({ getService }: FtrProviderContext) => {

const { errors } = await indexAndCreatePreviewAlert(document);

expect(errors).toContain(
'Bulk Indexing of signals failed: failed to parse field [client.geo.location] of type [geo_point]'
expect(errors[0]).toContain('Bulk Indexing of signals failed');
expect(errors[0]).toContain(
'failed to parse field [client.geo.location] of type [geo_point]'
);
});

Expand Down