Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Failing test: Detection Engine API Integration Tests - ESS - Rule Execution Logic.x-pack/test/security_solution_api_integration/test_suites/detections_response/default_license/rule_execution_logic/execution_logic/esql·ts - Rule execution logic API Execution logic @ess ES|QL rule type aggregating query rules should aggregate results correctly #171967

Closed
kibanamachine opened this issue Nov 27, 2023 · 3 comments
Assignees
Labels
failed-test A test failure on a tracked branch, potentially flaky-test Team:Detection Engine Security Solution Detection Engine Area Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. triage_needed

Comments

@kibanamachine
Copy link
Contributor

A test failed on a tracked branch

JestAssertionError: expect(received).toEqual(expected) // deep equality

- Expected  -  3
+ Received  + 85

- ObjectContaining {
-   "agent.name": "test-1",
-   "counted_agents": 3,
+ Object {
+   "@timestamp": "2020-10-28T06:30:00.000Z",
+   "agent.name": "test-2",
+   "counted_agents": 2,
+   "event.kind": "signal",
+   "kibana.alert.ancestors": Array [
+     Object {
+       "depth": 0,
+       "id": "",
+       "index": "",
+       "type": "event",
+     },
+   ],
+   "kibana.alert.depth": 1,
+   "kibana.alert.last_detected": "2023-11-27T10:39:17.334Z",
+   "kibana.alert.reason": "event created high alert Query with a rule id.",
+   "kibana.alert.risk_score": 55,
+   "kibana.alert.rule.actions": Array [],
+   "kibana.alert.rule.author": Array [],
+   "kibana.alert.rule.category": "ES|QL Rule",
+   "kibana.alert.rule.consumer": "siem",
+   "kibana.alert.rule.created_at": "2023-11-27T10:39:17.145Z",
+   "kibana.alert.rule.created_by": "elastic",
+   "kibana.alert.rule.description": "Detecting root and admin users",
+   "kibana.alert.rule.enabled": true,
+   "kibana.alert.rule.exceptions_list": Array [],
+   "kibana.alert.rule.execution.uuid": "99641e53-1ebf-4e30-9ff7-005d99a3b752",
+   "kibana.alert.rule.false_positives": Array [],
+   "kibana.alert.rule.from": "now-1h",
+   "kibana.alert.rule.immutable": false,
+   "kibana.alert.rule.indices": Array [],
+   "kibana.alert.rule.interval": "1h",
+   "kibana.alert.rule.max_signals": 100,
+   "kibana.alert.rule.name": "Query with a rule id",
+   "kibana.alert.rule.parameters": Object {
+     "author": Array [],
+     "description": "Detecting root and admin users",
+     "exceptions_list": Array [],
+     "false_positives": Array [],
+     "from": "now-1h",
+     "immutable": false,
+     "language": "esql",
+     "max_signals": 100,
+     "query": "from ecs_compliant | where id==\"d46ce727-07d9-442f-a429-152b8318fce1\" | stats counted_agents=count(agent.name) by agent.name",
+     "references": Array [],
+     "related_integrations": Array [],
+     "required_fields": Array [],
+     "risk_score": 55,
+     "risk_score_mapping": Array [],
+     "rule_id": "rule-1",
+     "setup": "",
+     "severity": "high",
+     "severity_mapping": Array [],
+     "threat": Array [],
+     "to": "now",
+     "type": "esql",
+     "version": 1,
+   },
+   "kibana.alert.rule.producer": "preview-producer",
+   "kibana.alert.rule.references": Array [],
+   "kibana.alert.rule.revision": 0,
+   "kibana.alert.rule.risk_score": 55,
+   "kibana.alert.rule.risk_score_mapping": Array [],
+   "kibana.alert.rule.rule_id": "rule-1",
+   "kibana.alert.rule.rule_type_id": "siem.esqlRule",
+   "kibana.alert.rule.severity": "high",
+   "kibana.alert.rule.severity_mapping": Array [],
+   "kibana.alert.rule.tags": Array [],
+   "kibana.alert.rule.threat": Array [],
+   "kibana.alert.rule.to": "now",
+   "kibana.alert.rule.type": "esql",
+   "kibana.alert.rule.updated_at": "2023-11-27T10:39:17.145Z",
+   "kibana.alert.rule.updated_by": "elastic",
+   "kibana.alert.rule.uuid": "62efba82-7495-4893-83ab-66741f9f7fec",
+   "kibana.alert.rule.version": 1,
+   "kibana.alert.severity": "high",
+   "kibana.alert.start": "2023-11-27T10:39:17.334Z",
+   "kibana.alert.status": "active",
+   "kibana.alert.uuid": "bfa25d845738f8c467b43c63c138a54ded3f1952",
+   "kibana.alert.workflow_status": "open",
+   "kibana.alert.workflow_tags": Array [],
+   "kibana.space_ids": Array [
+     "default",
+   ],
+   "kibana.version": "8.12.0-SNAPSHOT",
  }
    at Context.<anonymous> (esql.ts:391:60)
    at processTicksAndRejections (node:internal/process/task_queues:95:5)
    at Object.apply (wrap_function.js:73:16) {
  matcherResult: {
    actual: {
      'kibana.alert.start': '2023-11-27T10:39:17.334Z',
      'kibana.alert.last_detected': '2023-11-27T10:39:17.334Z',
      'kibana.version': '8.12.0-SNAPSHOT',
      'kibana.alert.rule.parameters': [Object],
      'kibana.alert.rule.category': 'ES|QL Rule',
      'kibana.alert.rule.consumer': 'siem',
      'kibana.alert.rule.execution.uuid': '99641e53-1ebf-4e30-9ff7-005d99a3b752',
      'kibana.alert.rule.name': 'Query with a rule id',
      'kibana.alert.rule.producer': 'preview-producer',
      'kibana.alert.rule.revision': 0,
      'kibana.alert.rule.rule_type_id': 'siem.esqlRule',
      'kibana.alert.rule.uuid': '62efba82-7495-4893-83ab-66741f9f7fec',
      'kibana.space_ids': [Array],
      'kibana.alert.rule.tags': [],
      '@timestamp': '2020-10-28T06:30:00.000Z',
      counted_agents: 2,
      'agent.name': 'test-2',
      'event.kind': 'signal',
      'kibana.alert.ancestors': [Array],
      'kibana.alert.status': 'active',
      'kibana.alert.workflow_status': 'open',
      'kibana.alert.depth': 1,
      'kibana.alert.reason': 'event created high alert Query with a rule id.',
      'kibana.alert.severity': 'high',
      'kibana.alert.risk_score': 55,
      'kibana.alert.rule.actions': [],
      'kibana.alert.rule.author': [],
      'kibana.alert.rule.created_at': '2023-11-27T10:39:17.145Z',
      'kibana.alert.rule.created_by': 'elastic',
      'kibana.alert.rule.description': 'Detecting root and admin users',
      'kibana.alert.rule.enabled': true,
      'kibana.alert.rule.exceptions_list': [],
      'kibana.alert.rule.false_positives': [],
      'kibana.alert.rule.from': 'now-1h',
      'kibana.alert.rule.immutable': false,
      'kibana.alert.rule.interval': '1h',
      'kibana.alert.rule.indices': [],
      'kibana.alert.rule.max_signals': 100,
      'kibana.alert.rule.references': [],
      'kibana.alert.rule.risk_score_mapping': [],
      'kibana.alert.rule.rule_id': 'rule-1',
      'kibana.alert.rule.severity_mapping': [],
      'kibana.alert.rule.threat': [],
      'kibana.alert.rule.to': 'now',
      'kibana.alert.rule.type': 'esql',
      'kibana.alert.rule.updated_at': '2023-11-27T10:39:17.145Z',
      'kibana.alert.rule.updated_by': 'elastic',
      'kibana.alert.rule.version': 1,
      'kibana.alert.uuid': 'bfa25d845738f8c467b43c63c138a54ded3f1952',
      'kibana.alert.workflow_tags': [],
      'kibana.alert.rule.risk_score': 55,
      'kibana.alert.rule.severity': 'high'
    },
    expected: ObjectContaining {
      '$$typeof': Symbol(jest.asymmetricMatcher),
      sample: [Object],
      inverse: false
    },
    message: '\x1B[2mexpect(\x1B[22m\x1B[31mreceived\x1B[39m\x1B[2m).\x1B[22mtoEqual\x1B[2m(\x1B[22m\x1B[32mexpected\x1B[39m\x1B[2m) // deep equality\x1B[22m\n' +
      '\n' +
      '\x1B[32m- Expected  -  3\x1B[39m\n' +
      '\x1B[31m+ Received  + 85\x1B[39m\n' +
      '\n' +
      '\x1B[32m- ObjectContaining {\x1B[39m\n' +
      '\x1B[32m-   "agent.name": "test-1",\x1B[39m\n' +
      '\x1B[32m-   "counted_agents": 3,\x1B[39m\n' +
      '\x1B[31m+ Object {\x1B[39m\n' +
      '\x1B[31m+   "@timestamp": "2020-10-28T06:30:00.000Z",\x1B[39m\n' +
      '\x1B[31m+   "agent.name": "test-2",\x1B[39m\n' +
      '\x1B[31m+   "counted_agents": 2,\x1B[39m\n' +
      '\x1B[31m+   "event.kind": "signal",\x1B[39m\n' +
      '\x1B[31m+   "kibana.alert.ancestors": Array [\x1B[39m\n' +
      '\x1B[31m+     Object {\x1B[39m\n' +
      '\x1B[31m+       "depth": 0,\x1B[39m\n' +
      '\x1B[31m+       "id": "",\x1B[39m\n' +
      '\x1B[31m+       "index": "",\x1B[39m\n' +
      '\x1B[31m+       "type": "event",\x1B[39m\n' +
      '\x1B[31m+     },\x1B[39m\n' +
      '\x1B[31m+   ],\x1B[39m\n' +
      '\x1B[31m+   "kibana.alert.depth": 1,\x1B[39m\n' +
      '\x1B[31m+   "kibana.alert.last_detected": "2023-11-27T10:39:17.334Z",\x1B[39m\n' +
      '\x1B[31m+   "kibana.alert.reason": "event created high alert Query with a rule id.",\x1B[39m\n' +
      '\x1B[31m+   "kibana.alert.risk_score": 55,\x1B[39m\n' +
      '\x1B[31m+   "kibana.alert.rule.actions": Array [],\x1B[39m\n' +
      '\x1B[31m+   "kibana.alert.rule.author": Array [],\x1B[39m\n' +
      '\x1B[31m+   "kibana.alert.rule.category": "ES|QL Rule",\x1B[39m\n' +
      '\x1B[31m+   "kibana.alert.rule.consumer": "siem",\x1B[39m\n' +
      '\x1B[31m+   "kibana.alert.rule.created_at": "2023-11-27T10:39:17.145Z",\x1B[39m\n' +
      '\x1B[31m+   "kibana.alert.rule.created_by": "elastic",\x1B[39m\n' +
      '\x1B[31m+   "kibana.alert.rule.de
[report_failure] output truncated to 8192 characters

First failure: CI Build - main

@kibanamachine kibanamachine added the failed-test A test failure on a tracked branch, potentially flaky-test label Nov 27, 2023
@botelastic botelastic bot added the needs-team Issues missing a team label label Nov 27, 2023
@mistic mistic added the Team:Detection Engine Security Solution Detection Engine Area label Nov 27, 2023
@botelastic botelastic bot removed the needs-team Issues missing a team label label Nov 27, 2023
@banderror banderror added triage_needed Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. labels Dec 15, 2023
@elasticmachine
Copy link
Contributor

Pinging @elastic/security-detections-response (Team:Detections and Resp)

@elasticmachine
Copy link
Contributor

Pinging @elastic/security-solution (Team: SecuritySolution)

@yctercero yctercero removed their assignment Jan 2, 2024
vitaliidm added a commit that referenced this issue Mar 4, 2024
…177226)

## Summary

Adressess:
  - #175147
  - #171967
  - #174555

All of failed tests happened only once throughout all the time they were
executed, which hints its flakiness probability is very low.

However, I made few small changes I think would help to avoid this
potential flakiness.

For FTR tests, I adde sort order when retrieving preview alerts for
their subsequent assertions. It looks like, flaky failures happened
because order of returned alerts wasn't as expected in the tests.

For Cypress test, I added additional check if input is not disabled
before typing new values in it. Looks like, flaky failure happened
because of input was not enabled on the time when new value should've
been typed in it.



Flaky test runner:

FTR:
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5232
Cypress:
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5231
@vitaliidm
Copy link
Contributor

fixed in #177226

kibanamachine pushed a commit to kibanamachine/kibana that referenced this issue Mar 4, 2024
…lastic#177226)

## Summary

Adressess:
  - elastic#175147
  - elastic#171967
  - elastic#174555

All of failed tests happened only once throughout all the time they were
executed, which hints its flakiness probability is very low.

However, I made few small changes I think would help to avoid this
potential flakiness.

For FTR tests, I adde sort order when retrieving preview alerts for
their subsequent assertions. It looks like, flaky failures happened
because order of returned alerts wasn't as expected in the tests.

For Cypress test, I added additional check if input is not disabled
before typing new values in it. Looks like, flaky failure happened
because of input was not enabled on the time when new value should've
been typed in it.

Flaky test runner:

FTR:
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5232
Cypress:
https://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5231
(cherry picked from commit 0af37ed)
kibanamachine referenced this issue Mar 4, 2024
…tests (#177226) (#177968)

# Backport

This will backport the following commits from `main` to `8.13`:
- [[Security Solution][Detection Engine] fixes potentially flaky tests
(#177226)](#177226)

<!--- Backport version: 9.4.3 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sqren/backport)

<!--BACKPORT [{"author":{"name":"Vitalii
Dmyterko","email":"[email protected]"},"sourceCommit":{"committedDate":"2024-03-04T18:14:32Z","message":"[Security
Solution][Detection Engine] fixes potentially flaky tests
(#177226)\n\n## Summary\r\n\r\nAdressess:\r\n -
https://github.com/elastic/kibana/issues/175147\r\n -
https://github.com/elastic/kibana/issues/171967\r\n -
https://github.com/elastic/kibana/issues/174555\r\n\r\nAll of failed
tests happened only once throughout all the time they were\r\nexecuted,
which hints its flakiness probability is very low.\r\n\r\nHowever, I
made few small changes I think would help to avoid this\r\npotential
flakiness.\r\n\r\nFor FTR tests, I adde sort order when retrieving
preview alerts for\r\ntheir subsequent assertions. It looks like, flaky
failures happened\r\nbecause order of returned alerts wasn't as expected
in the tests.\r\n\r\nFor Cypress test, I added additional check if input
is not disabled\r\nbefore typing new values in it. Looks like, flaky
failure happened\r\nbecause of input was not enabled on the time when
new value should've\r\nbeen typed in it.\r\n\r\n\r\n\r\nFlaky test
runner:\r\n\r\nFTR:\r\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5232\r\nCypress:\r\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5231","sha":"0af37ed2aec88dc7fd8abc328892a14aff8ecc8e","branchLabelMapping":{"^v8.14.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["release_note:skip","Team:
SecuritySolution","backport:prev-minor","Team:Detection Engine","8.13
candidate","v8.14.0"],"title":"[Security Solution][Detection Engine]
fixes potentially flaky
tests","number":177226,"url":"https://github.com/elastic/kibana/pull/177226","mergeCommit":{"message":"[Security
Solution][Detection Engine] fixes potentially flaky tests
(#177226)\n\n## Summary\r\n\r\nAdressess:\r\n -
https://github.com/elastic/kibana/issues/175147\r\n -
https://github.com/elastic/kibana/issues/171967\r\n -
https://github.com/elastic/kibana/issues/174555\r\n\r\nAll of failed
tests happened only once throughout all the time they were\r\nexecuted,
which hints its flakiness probability is very low.\r\n\r\nHowever, I
made few small changes I think would help to avoid this\r\npotential
flakiness.\r\n\r\nFor FTR tests, I adde sort order when retrieving
preview alerts for\r\ntheir subsequent assertions. It looks like, flaky
failures happened\r\nbecause order of returned alerts wasn't as expected
in the tests.\r\n\r\nFor Cypress test, I added additional check if input
is not disabled\r\nbefore typing new values in it. Looks like, flaky
failure happened\r\nbecause of input was not enabled on the time when
new value should've\r\nbeen typed in it.\r\n\r\n\r\n\r\nFlaky test
runner:\r\n\r\nFTR:\r\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5232\r\nCypress:\r\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5231","sha":"0af37ed2aec88dc7fd8abc328892a14aff8ecc8e"}},"sourceBranch":"main","suggestedTargetBranches":[],"targetPullRequestStates":[{"branch":"main","label":"v8.14.0","branchLabelMappingKey":"^v8.14.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/177226","number":177226,"mergeCommit":{"message":"[Security
Solution][Detection Engine] fixes potentially flaky tests
(#177226)\n\n## Summary\r\n\r\nAdressess:\r\n -
https://github.com/elastic/kibana/issues/175147\r\n -
https://github.com/elastic/kibana/issues/171967\r\n -
https://github.com/elastic/kibana/issues/174555\r\n\r\nAll of failed
tests happened only once throughout all the time they were\r\nexecuted,
which hints its flakiness probability is very low.\r\n\r\nHowever, I
made few small changes I think would help to avoid this\r\npotential
flakiness.\r\n\r\nFor FTR tests, I adde sort order when retrieving
preview alerts for\r\ntheir subsequent assertions. It looks like, flaky
failures happened\r\nbecause order of returned alerts wasn't as expected
in the tests.\r\n\r\nFor Cypress test, I added additional check if input
is not disabled\r\nbefore typing new values in it. Looks like, flaky
failure happened\r\nbecause of input was not enabled on the time when
new value should've\r\nbeen typed in it.\r\n\r\n\r\n\r\nFlaky test
runner:\r\n\r\nFTR:\r\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5232\r\nCypress:\r\nhttps://buildkite.com/elastic/kibana-flaky-test-suite-runner/builds/5231","sha":"0af37ed2aec88dc7fd8abc328892a14aff8ecc8e"}}]}]
BACKPORT-->

Co-authored-by: Vitalii Dmyterko <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
failed-test A test failure on a tracked branch, potentially flaky-test Team:Detection Engine Security Solution Detection Engine Area Team:Detections and Resp Security Detection Response Team Team: SecuritySolution Security Solutions Team working on SIEM, Endpoint, Timeline, Resolver, etc. triage_needed
Projects
None yet
Development

No branches or pull requests

6 participants