Skip to content

[9.2] [Security Solution] Add FTR tests for prebuilt rules OOM testing (#236891)#238438

Closed
kibanamachine wants to merge 1 commit into
elastic:9.2from
kibanamachine:backport/9.2/pr-236891
Closed

[9.2] [Security Solution] Add FTR tests for prebuilt rules OOM testing (#236891)#238438
kibanamachine wants to merge 1 commit into
elastic:9.2from
kibanamachine:backport/9.2/pr-236891

Conversation

@kibanamachine
Copy link
Copy Markdown
Contributor

Backport

This will backport the following commits from main to 9.2:

Questions ?

Please refer to the Backport tool documentation

…stic#236891)

**Partially addresses:** elastic#188090

## Summary

This PR contains FTR tests designed to expose potential Out of Memory (OOM) issues in Kibana when performing memory-intensive operations related to **Detection Prebuilt Rules**. The tests open a possibility to test against any Prebuilt Rules fleet package version including prerelease packages.

## Running test instructions

- Set up QAF by following to the [instructions](https://docs.elastic.dev/appex-qa/qaf/getting-started) (internal)
- Place the following Elastic Cloud plan in `~/.qaf/config/cloud_plans/prebuilt_rules_oom_testing.yml`
```yaml
---
name: {{ deployment_name }}
settings:
  autoscaling_enabled: {{ autoscaling_enabled }}
metadata:
  system_owned: false
resources:
  elasticsearch:
    - region: {{ region }}
      settings:
        dedicated_masters_threshold: 6
      plan:
        cluster_topology:
          - zone_count: 1
            elasticsearch:
              node_attributes:
                data: hot
            instance_configuration_id: gcp.es.datahot.n2.68x10x45
            node_roles:
              - master
              - ingest
              - remote_cluster_client
              - data_hot
              - transform
              - data_content
            id: hot_content
            size:
              value: 1024
              resource: memory
        elasticsearch:
          version: {{ stack_version }}
        deployment_template:
          id: gcp-storage-optimized
      ref_id: main-elasticsearch
  enterprise_search: []
  kibana:
    - elasticsearch_cluster_ref_id: main-elasticsearch
      region: {{ region }}
      plan:
        cluster_topology:
          - instance_configuration_id: gcp.kibana.n2.68x32x45
            zone_count: 1
            size:
              value: 1024
              resource: memory
        kibana:
          version: {{ stack_version }}
      ref_id: main-kibana
```

- Create an ECH deployment by running the following command

```bash
qaf elastic-cloud deployments create --stack-version 9.3.0 --version-validation --deployment-name prebuilt-rules-oom-test-9.3.0 --environment production --no-autoscaling --no-sso --region gcp-us-west2 --plan prebuilt_rules_oom_testing
```

- Run the tests by running the following command

```bash
qaf kibana ftr run-config --ec-deployment-name prebuilt-rules-oom-test-9.3.0 --kibana-repo-root <kibana-root> <kibana-root>/x-pack/solutions/security/test/security_solution_api_integration/test_suites/detections_response/rules_management/prebuilt_rules/oom_testing/configs/ess_basic_license.config.ts
```

where `<kibana-root>` is the absolute path to the Kibana's root folder.

(cherry picked from commit d99c5b4)
@maximpn maximpn disabled auto-merge October 10, 2025 13:17
Copy link
Copy Markdown
Contributor

@nikitaindik nikitaindik left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I reviewed the main PR. The diff is identical in this backport. I approve.

@elasticmachine
Copy link
Copy Markdown
Contributor

💚 Build Succeeded

Metrics [docs]

✅ unchanged

cc @maximpn

@banderror banderror closed this Oct 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

backport This PR is a backport of another PR

Projects

None yet

Development

Successfully merging this pull request may close these issues.

6 participants