Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Binary file modified security-analytics-commons-1.0.0.jar
Binary file not shown.
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,6 @@
import org.opensearch.client.Request;
import org.opensearch.client.Response;
import org.opensearch.client.ResponseException;
import org.opensearch.commons.alerting.model.Monitor;
import org.opensearch.commons.alerting.model.action.Action;
import org.opensearch.core.rest.RestStatus;
import org.opensearch.search.SearchHit;
Expand All @@ -45,9 +44,7 @@
import static org.opensearch.securityanalytics.TestHelpers.netFlowMappings;
import static org.opensearch.securityanalytics.TestHelpers.randomAction;
import static org.opensearch.securityanalytics.TestHelpers.randomAggregationRule;
import static org.opensearch.securityanalytics.TestHelpers.randomDetector;
import static org.opensearch.securityanalytics.TestHelpers.randomDetectorType;
import static org.opensearch.securityanalytics.TestHelpers.randomDetectorWithInputs;
import static org.opensearch.securityanalytics.TestHelpers.randomDetectorWithInputsAndTriggers;
import static org.opensearch.securityanalytics.TestHelpers.randomDetectorWithTriggers;
import static org.opensearch.securityanalytics.TestHelpers.randomDoc;
Expand Down Expand Up @@ -795,7 +792,7 @@ public void testAlertHistoryRollover_maxAge() throws IOException, InterruptedExc
*
* @throws IOException
*/
public void testMultipleAggregationAndDocRules_alertSuccess() throws IOException {
public void testMultipleAggregationAndDocRules_alertSuccess() throws IOException, InterruptedException {
String index = createTestIndex(randomIndex(), windowsIndexMapping());

Request createMappingRequest = new Request("POST", SecurityAnalyticsPlugin.MAPPER_BASE_URI);
Expand All @@ -808,7 +805,7 @@ public void testMultipleAggregationAndDocRules_alertSuccess() throws IOException

Response createMappingResponse = client().performRequest(createMappingRequest);

assertEquals(org.apache.http.HttpStatus.SC_OK, createMappingResponse.getStatusLine().getStatusCode());
assertEquals(HttpStatus.SC_OK, createMappingResponse.getStatusLine().getStatusCode());

String infoOpCode = "Info";

Expand Down Expand Up @@ -949,17 +946,28 @@ public void testMultipleAggregationAndDocRules_alertSuccess() throws IOException
}
}

assertTrue(Arrays.asList("1", "2", "3", "4", "5", "6", "7", "8").containsAll(docLevelFinding));

params1 = new HashMap<>();
params1.put("detector_id", detectorId);
getAlertsResponse = makeRequest(client(), "GET", SecurityAnalyticsPlugin.ALERTS_BASE_URI, params1, null);
getAlertsBody = asMap(getAlertsResponse);
// TODO enable asserts here when able
Assert.assertEquals(2, getAlertsBody.get("total_alerts"));
AtomicBoolean alertRespStatus = new AtomicBoolean(false);
OpenSearchRestTestCase.waitUntil(
() -> {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("detector_id", detectorId);
try {
Response alertsResponse = makeRequest(client(), "GET", SecurityAnalyticsPlugin.ALERTS_BASE_URI, queryParams, null);
Map<String, Object> alertsBody = asMap(alertsResponse);
// TODO enable asserts here when able
if (Integer.parseInt(alertsBody.get("total_alerts").toString()) == 2) {
alertRespStatus.set(true);
return true;
}
return false;
} catch (IOException e) {
return false;
}
}, 2, TimeUnit.MINUTES);
Assert.assertTrue(alertRespStatus.get());
}

public void test_detectorWith1AggRuleAndTriggeronRule_updateWithSecondAggRule() throws IOException {
public void test_detectorWith1AggRuleAndTriggeronRule_updateWithSecondAggRule() throws IOException, InterruptedException {
String index = createTestIndex(randomIndex(), windowsIndexMapping());

Request createMappingRequest = new Request("POST", SecurityAnalyticsPlugin.MAPPER_BASE_URI);
Expand All @@ -972,7 +980,7 @@ public void test_detectorWith1AggRuleAndTriggeronRule_updateWithSecondAggRule()

Response createMappingResponse = client().performRequest(createMappingRequest);

assertEquals(org.apache.http.HttpStatus.SC_OK, createMappingResponse.getStatusLine().getStatusCode());
assertEquals(HttpStatus.SC_OK, createMappingResponse.getStatusLine().getStatusCode());

String infoOpCode = "Info";
/** 1st agg rule*/
Expand Down Expand Up @@ -1071,11 +1079,24 @@ public void test_detectorWith1AggRuleAndTriggeronRule_updateWithSecondAggRule()
assertNotNull(getFindingsBody);
assertEquals(3, getFindingsBody.get("total_findings"));

params1 = new HashMap<>();
params1.put("detector_id", detectorId);
getAlertsResponse = makeRequest(client(), "GET", SecurityAnalyticsPlugin.ALERTS_BASE_URI, params1, null);
getAlertsBody = asMap(getAlertsResponse);
Assert.assertEquals(3, getAlertsBody.get("total_alerts"));
AtomicBoolean alertsCondSatisfy = new AtomicBoolean(false);
OpenSearchRestTestCase.waitUntil(
() -> {
try {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("detector_id", detectorId);
Response alertsResponse = makeRequest(client(), "GET", SecurityAnalyticsPlugin.ALERTS_BASE_URI, queryParams, null);
Map<String, Object> alertsBody = asMap(alertsResponse);
if (Integer.parseInt(alertsBody.get("total_alerts").toString()) == 3) {
alertsCondSatisfy.set(true);
}
return 3 == Integer.parseInt(alertsBody.get("total_alerts").toString());
} catch (Exception e) {
return false;
}
}, 2, TimeUnit.MINUTES
);
Assert.assertTrue(alertsCondSatisfy.get());
}

@Ignore
Expand Down
Original file line number Diff line number Diff line change
@@ -1,8 +1,8 @@
package org.opensearch.securityanalytics.resthandler;

import org.apache.hc.core5.http.ContentType;
import org.apache.hc.core5.http.HttpStatus;
import org.apache.hc.core5.http.io.entity.StringEntity;
import org.apache.http.HttpStatus;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.junit.Assert;
Expand Down
Loading