diff --git a/codegen/functional/generator.ts b/codegen/functional/generator.ts index 0591fcf0..a4f78e1d 100644 --- a/codegen/functional/generator.ts +++ b/codegen/functional/generator.ts @@ -487,6 +487,10 @@ function buildCommand (mapped: MappedAction, step: DoStep): string { } if (originalBodyStr != null) { extraArgs.push(`--${singleBodyArg.cliFlag}`, shellEscape(originalBodyStr)) + } else if (containsVarRef(body)) { + // Whole-body arg carrying $var references (e.g. patch_rule's body.id + // set from a create step) — expand vars instead of quoting literally. + extraArgs.push(`--${singleBodyArg.cliFlag}`, buildVarExpandingJson(body)) } else { extraArgs.push(`--${singleBodyArg.cliFlag}`, toShellArg(body)) } diff --git a/codegen/functional/kb.ts b/codegen/functional/kb.ts index bdb12a88..7f945e22 100644 --- a/codegen/functional/kb.ts +++ b/codegen/functional/kb.ts @@ -316,11 +316,6 @@ const skippedFilesServerless = new Set([ "elastic_agent_actions_post_fleet_agents_bulk_upgrade.yml", "elastic_agents_post_fleet_agents_bulk_privilege_level_change.yml", - // Serverless env only permits the `testprefix` namespace; test payloads use another. - "elastic_agent_actions_post_fleet_agents_bulk_reassign.yml", - "elastic_agent_actions_reassign.yml", - "elastic_agent_policies_get_fleet_agent_policies_agentpolicyid_download.yml", - // `.fleet-*` indices are absent in the serverless env (nothing enrolled), // so the op 404s with index_not_found_exception. "elastic_agent_actions_post_fleet_agents_bulk_update_agent_tags.yml", @@ -528,6 +523,8 @@ const skippedFilesStack = new Set([ "elastic_agent_actions_rollback.yml", "elastic_agent_actions_unenroll.yml", "elastic_agent_actions_upgrade.yml", + "elastic_agent_actions_reassign.yml", + "elastic_agent_actions_post_fleet_agents_bulk_reassign.yml", "elastic_agents_delete_fleet_agents_agentid.yml", "elastic_agents_delete_fleet_agents_files_fileid.yml", "elastic_agents_get_fleet_agents_agentid.yml", @@ -554,20 +551,6 @@ const skippedFilesStack = new Set([ "elastic_agent_actions_post_fleet_agents_bulk_upgrade.yml", "elastic_agents_post_fleet_agents_bulk_privilege_level_change.yml", - // Stack env only permits the `testprefix` namespace; test payloads use another. - "elastic_agent_actions_post_fleet_agents_bulk_reassign.yml", - "elastic_agent_actions_reassign.yml", - "elastic_agent_policies_get_fleet_agent_policies_agentpolicyid_download.yml", - - // Watchlist schema mismatch: upstream caps riskModifier at 2, but the test - // payload exceeds it (too_big: expected number to be <=2). - "security_entity_analytics_api_create_watchlist.yml", - "security_entity_analytics_api_get_watchlist.yml", - "security_entity_analytics_api_list_watchlists.yml", - "security_entity_analytics_api_unassign_watchlist_entities.yml", - "security_entity_analytics_api_update_watchlist.yml", - "security_entity_analytics_api_upload_watchlist_csv.yml", - // Entity Store is not installed in the stack env; every entity-store op 400s // asking for POST /api/security/entity_store/install first. "security_entity_store_delete_security_entity_store_entities.yml", @@ -585,20 +568,6 @@ const skippedFilesStack = new Set([ "security_entity_analytics_api_configure_risk_engine_saved_object.yml", "security_entity_analytics_api_schedule_risk_engine_now.yml", - // Prerequisite exception lists are never created (endpoint_blocklists / shared - // list id), so every dependent op 404s. - "security_exceptions_api_create_exception_list_item.yml", - "security_exceptions_api_create_rule_exception_list_items.yml", - "security_exceptions_api_create_shared_exception_list.yml", - "security_exceptions_api_delete_exception_list_item.yml", - "security_exceptions_api_find_exception_list_items.yml", - "security_exceptions_api_read_exception_list_item.yml", - "security_exceptions_api_update_exception_list_item.yml", - - // Test supplies a non-UUID rule id, rejected by body validation (Invalid UUID). - "security_detections_api_patch_rule.yml", - "security_detections_api_update_rule.yml", - // Significant events feature is disabled (403); requires enabling // observability:streamsEnableSignificantEvents in Advanced Settings. "significantevents_delete_streams_name_queries_queryid.yml", @@ -624,26 +593,23 @@ const skippedFilesStack = new Set([ "streams_put_streams_name_query.yml", "streams_put_streams_streamname_attachments_attachmenttype_attachmentid.yml", - // No SLO definitions exist in the env (404) or the op sends unsupported args - // (purgePolicy validation, cannot delete instance '*'). + // No SLO definitions exist in the env (404); slo_bulk_snapshot and slo_get_snapshot + // depend on data that is never provisioned. "slo_bulk_snapshot_op.yml", - "slo_delete_rollup_data_op.yml", - "slo_delete_slo_instances_op.yml", "slo_get_definitions_op.yml", "slo_get_snapshot_op.yml", - // APM setup state: config already exists / expected settings missing / - // annotation body fails upstream validation. - "apm_agent_configuration_get_environments_for_service.yml", - "apm_agent_configuration_search_single_configuration.yml", - "apm_annotations_get_annotation.yml", - // Feature or route gated off in this stack config (404 / not available with // current configuration). "agent_builder_get_plugins.yml", - "alerting_get_alerting_rule_id_query_inspector.yml", - "elastic_package_manager_epm_delete_fleet_epm_packages_pkgname_pkgversion_kibana_assets.yml", "security_timeline_api_copy_timeline.yml", + "security_entity_analytics_api_create_watchlist.yml", + "security_entity_analytics_api_get_watchlist.yml", + "security_entity_analytics_api_list_watchlists.yml", + "security_entity_analytics_api_unassign_watchlist_entities.yml", + "security_entity_analytics_api_update_watchlist.yml", + "security_entity_analytics_api_upload_watchlist_csv.yml", + "alerting_get_alerting_rule_id_query_inspector.yml", // Assertions fail or the response is unparseable: required objects were never // provisioned in the stack env, or the body isn't the JSON/YAML the check expects. @@ -654,6 +620,13 @@ const skippedFilesStack = new Set([ "security_entity_analytics_api_bulk_upsert_asset_criticality_records.yml", "security_lists_api_export_list_items.yml", "security_timeline_api_resolve_timeline.yml", + "apm_agent_configuration_search_single_configuration.yml", + "security_exceptions_api_create_shared_exception_list.yml", + + // Kibana forbids deleting EPM package kibana assets from the space where the + // package is installed (400: "you must uninstall the package"); the op is not + // exercisable without a separate space, which the test does not provision. + "elastic_package_manager_epm_delete_fleet_epm_packages_pkgname_pkgversion_kibana_assets.yml", // @elastic/schemas defect: // Upstream bugs tracked at: @@ -667,6 +640,14 @@ const skippedFilesStack = new Set([ 'ml_ml_update_jobs_spaces.yml', 'ml_ml_update_trained_models_spaces.yml', 'visualizations_create_visualization.yml', + // create/read/update/delete/find exception-list-item request schemas restrict + // `list_id` to the enum ["endpoint_blocklists"], so any real list id fails CLI + // input validation before the request is sent. + "security_exceptions_api_create_exception_list_item.yml", + "security_exceptions_api_read_exception_list_item.yml", + "security_exceptions_api_update_exception_list_item.yml", + "security_exceptions_api_delete_exception_list_item.yml", + "security_exceptions_api_find_exception_list_items.yml", ]) const skippedFiles = env === 'serverless' ? skippedFilesServerless : skippedFilesStack diff --git a/codegen/functional/test/fixtures/body-var.yml b/codegen/functional/test/fixtures/body-var.yml new file mode 100644 index 00000000..9c924f6d --- /dev/null +++ b/codegen/functional/test/fixtures/body-var.yml @@ -0,0 +1,17 @@ +--- +requires: + serverless: true + stack: true +--- +setup: + - do: + index: + index: 'bv_test' + body: { name: 'seed' } + - set: { _id: doc_id } +--- +'body var': + - do: + index: + index: 'bv_test' + body: { id: $doc_id, name: 'updated' } diff --git a/codegen/functional/test/generator.test.ts b/codegen/functional/test/generator.test.ts index 28d42444..fc40f21e 100644 --- a/codegen/functional/test/generator.test.ts +++ b/codegen/functional/test/generator.test.ts @@ -133,6 +133,22 @@ describe('generateScript', () => { assert.ok(result.script.includes('# SKIPPED: catch not supported')) }) + it('expands $var references inside a whole-body arg', () => { + const content = readFileSync(join(fixturesDir, 'body-var.yml'), 'utf-8') + const testFile = parseTestFile(content, 'body-var.yml') + const result = generateScript(testFile, testDefs) + // The body maps to the single --document flag; the $doc_id reference must + // be emitted as an expanding "$DOC_ID" break-out, not a literal $doc_id. + assert.ok( + result.script.includes('"$DOC_ID"'), + 'whole-body $var must expand to the bash variable' + ) + assert.ok( + !result.script.includes('$doc_id'), + 'literal $doc_id must not survive into the generated script' + ) + }) + it('generates comparison assertions', () => { const content = readFileSync(join(fixturesDir, 'comparisons.yml'), 'utf-8') const testFile = parseTestFile(content, 'comparisons.yml') diff --git a/test/functional/kb/definitions/alerting_get_alerting_rule_id_query_inspector.yml b/test/functional/kb/definitions/alerting_get_alerting_rule_id_query_inspector.yml index 16450acf..5bd2e9b1 100644 --- a/test/functional/kb/definitions/alerting_get_alerting_rule_id_query_inspector.yml +++ b/test/functional/kb/definitions/alerting_get_alerting_rule_id_query_inspector.yml @@ -2,18 +2,13 @@ # SPDX-License-Identifier: Apache-2.0 # # Kibana alerting API: inspect the Elasticsearch query for a rule. +# Uses searchType esQuery (not esqlQuery) which supports query inspection. --- requires: serverless: true stack: true --- -teardown: - - do: - alerting.delete_alerting_rule_id: - id: cli-ft-rule-qi - ignore: [404] ---- -"alerting get rule query inspector": +setup: - do: alerting.post_alerting_rule_id: id: cli-ft-rule-qi @@ -23,16 +18,24 @@ teardown: rule_type_id: ".es-query" schedule: {interval: "1m"} params: - searchType: esqlQuery - esqlQuery: {esql: "FROM * | LIMIT 1"} + searchType: esQuery + esQuery: "{\"query\":{\"match_all\":{}}}" + index: + - "*" timeWindowSize: 5 timeWindowUnit: m threshold: [0] thresholdComparator: ">" size: 0 timeField: "@timestamp" - - match: {id: cli-ft-rule-qi} - +--- +teardown: + - do: + alerting.delete_alerting_rule_id: + id: cli-ft-rule-qi + ignore: [404] +--- +"alerting get rule query inspector": - do: alerting.get_alerting_rule_id_query_inspector: id: cli-ft-rule-qi diff --git a/test/functional/kb/definitions/apm_agent_configuration_get_environments_for_service.yml b/test/functional/kb/definitions/apm_agent_configuration_get_environments_for_service.yml index 5a7e1059..dc2c6f34 100644 --- a/test/functional/kb/definitions/apm_agent_configuration_get_environments_for_service.yml +++ b/test/functional/kb/definitions/apm_agent_configuration_get_environments_for_service.yml @@ -2,30 +2,40 @@ # SPDX-License-Identifier: Apache-2.0 # # Kibana apm-agent-configuration API: get environments for a service. +# Deletes any stale config first, creates one, then verifies environments are returned. --- requires: serverless: true stack: true --- -teardown: +setup: - do: apm-agent-configuration.delete_agent_configuration: body: service: - name: cli-ft-apm-svc + name: cli-ft-apm-env-svc + environment: production ignore: [404] ---- -"apm-agent-configuration get environments for service": - do: apm-agent-configuration.create_update_agent_configuration: body: service: - name: cli-ft-apm-svc + name: cli-ft-apm-env-svc environment: production settings: transaction_sample_rate: "0.5" - +--- +teardown: + - do: + apm-agent-configuration.delete_agent_configuration: + body: + service: + name: cli-ft-apm-env-svc + environment: production + ignore: [404] +--- +"apm-agent-configuration get environments for service": - do: apm-agent-configuration.get_environments_for_service: - service_name: cli-ft-apm-svc + service_name: cli-ft-apm-env-svc - is_true: "" diff --git a/test/functional/kb/definitions/apm_agent_configuration_search_single_configuration.yml b/test/functional/kb/definitions/apm_agent_configuration_search_single_configuration.yml index 90756bd1..4029a441 100644 --- a/test/functional/kb/definitions/apm_agent_configuration_search_single_configuration.yml +++ b/test/functional/kb/definitions/apm_agent_configuration_search_single_configuration.yml @@ -8,11 +8,17 @@ requires: stack: true --- setup: + - do: + apm-agent-configuration.delete_agent_configuration: + body: + service: + name: cli-ft-apm-search-svc + ignore: [404] - do: apm-agent-configuration.create_update_agent_configuration: body: service: - name: cli-ft-apm-svc + name: cli-ft-apm-search-svc settings: transaction_sample_rate: "0.5" --- @@ -21,12 +27,12 @@ teardown: apm-agent-configuration.delete_agent_configuration: body: service: - name: cli-ft-apm-svc + name: cli-ft-apm-search-svc ignore: [404] --- "apm-agent-configuration search single configuration": - do: apm-agent-configuration.search_single_configuration: service: - name: cli-ft-apm-svc + name: cli-ft-apm-search-svc - is_true: settings diff --git a/test/functional/kb/definitions/apm_annotations_get_annotation.yml b/test/functional/kb/definitions/apm_annotations_get_annotation.yml index d2e96555..7f49adc6 100644 --- a/test/functional/kb/definitions/apm_annotations_get_annotation.yml +++ b/test/functional/kb/definitions/apm_annotations_get_annotation.yml @@ -1,7 +1,7 @@ # Copyright Elasticsearch B.V. and contributors # SPDX-License-Identifier: Apache-2.0 # -# Kibana apm-annotations API: create an annotation then search for it by service name. +# Kibana apm-annotations API: create an annotation then retrieve it by service name and time range. --- requires: serverless: true @@ -19,4 +19,7 @@ requires: - do: apm-annotations.get_annotation: service_name: cli-ft-apm-svc + start: "2024-01-01T00:00:00.000Z" + end: "2024-01-02T00:00:00.000Z" + environment: all - is_true: "" diff --git a/test/functional/kb/definitions/elastic_agent_actions_post_fleet_agents_bulk_reassign.yml b/test/functional/kb/definitions/elastic_agent_actions_post_fleet_agents_bulk_reassign.yml index 876c46d4..62ea083b 100644 --- a/test/functional/kb/definitions/elastic_agent_actions_post_fleet_agents_bulk_reassign.yml +++ b/test/functional/kb/definitions/elastic_agent_actions_post_fleet_agents_bulk_reassign.yml @@ -16,7 +16,7 @@ setup: elastic-agent-policies.post_fleet_agent_policies: body: name: cli-ft-ea-bulk-reassign - namespace: default + namespace: testprefix - set: {"item.id": new_policy_id} --- teardown: diff --git a/test/functional/kb/definitions/elastic_agent_actions_reassign.yml b/test/functional/kb/definitions/elastic_agent_actions_reassign.yml index cadbad6b..4b3a0892 100644 --- a/test/functional/kb/definitions/elastic_agent_actions_reassign.yml +++ b/test/functional/kb/definitions/elastic_agent_actions_reassign.yml @@ -16,7 +16,7 @@ setup: elastic-agent-policies.post_fleet_agent_policies: body: name: cli-ft-ea-reassign - namespace: default + namespace: testprefix - set: {"item.id": new_policy_id} --- teardown: diff --git a/test/functional/kb/definitions/elastic_agent_policies_get_fleet_agent_policies_agentpolicyid_download.yml b/test/functional/kb/definitions/elastic_agent_policies_get_fleet_agent_policies_agentpolicyid_download.yml index d39a2ceb..719fbf54 100644 --- a/test/functional/kb/definitions/elastic_agent_policies_get_fleet_agent_policies_agentpolicyid_download.yml +++ b/test/functional/kb/definitions/elastic_agent_policies_get_fleet_agent_policies_agentpolicyid_download.yml @@ -12,7 +12,7 @@ setup: elastic-agent-policies.post_fleet_agent_policies: body: name: cli-ft-ea-policy-download - namespace: default + namespace: testprefix - set: {"item.id": policy_id} --- teardown: diff --git a/test/functional/kb/definitions/elastic_package_manager_epm_delete_fleet_epm_packages_pkgname_pkgversion_kibana_assets.yml b/test/functional/kb/definitions/elastic_package_manager_epm_delete_fleet_epm_packages_pkgname_pkgversion_kibana_assets.yml index 2659a05d..a45f4447 100644 --- a/test/functional/kb/definitions/elastic_package_manager_epm_delete_fleet_epm_packages_pkgname_pkgversion_kibana_assets.yml +++ b/test/functional/kb/definitions/elastic_package_manager_epm_delete_fleet_epm_packages_pkgname_pkgversion_kibana_assets.yml @@ -2,6 +2,7 @@ # SPDX-License-Identifier: Apache-2.0 # # Kibana elastic-package-manager-epm API: delete Kibana assets for a package version. +# Installs just the kibana assets via POST first, then deletes them. --- requires: serverless: true @@ -16,6 +17,10 @@ setup: elastic-package-manager-epm.post_fleet_epm_packages_pkgname_pkgversion: pkg_name: apache pkg_version: $pkg_version + - do: + elastic-package-manager-epm.post_fleet_epm_packages_pkgname_pkgversion_kibana_assets: + pkg_name: apache + pkg_version: $pkg_version --- teardown: - do: diff --git a/test/functional/kb/definitions/security_entity_analytics_api_assign_watchlist_entities.yml b/test/functional/kb/definitions/security_entity_analytics_api_assign_watchlist_entities.yml index 468d4a7b..390191b2 100644 --- a/test/functional/kb/definitions/security_entity_analytics_api_assign_watchlist_entities.yml +++ b/test/functional/kb/definitions/security_entity_analytics_api_assign_watchlist_entities.yml @@ -14,7 +14,7 @@ setup: security-entity-analytics-api.create_watchlist: body: name: cli-ft-assign-watchlist-entities-test - riskModifier: 10 + riskModifier: 2 - set: {id: watchlist_id} --- teardown: diff --git a/test/functional/kb/definitions/security_entity_analytics_api_create_watchlist.yml b/test/functional/kb/definitions/security_entity_analytics_api_create_watchlist.yml index c002dbb7..e48eb2c9 100644 --- a/test/functional/kb/definitions/security_entity_analytics_api_create_watchlist.yml +++ b/test/functional/kb/definitions/security_entity_analytics_api_create_watchlist.yml @@ -14,7 +14,7 @@ requires: security-entity-analytics-api.create_watchlist: body: name: cli-ft-create-watchlist-test - riskModifier: 10 + riskModifier: 2 - is_true: id - match: {name: cli-ft-create-watchlist-test} - - match: {risk_modifier: 10} + - match: {risk_modifier: 2} diff --git a/test/functional/kb/definitions/security_entity_analytics_api_get_watchlist.yml b/test/functional/kb/definitions/security_entity_analytics_api_get_watchlist.yml index ff3aaed6..298b80e1 100644 --- a/test/functional/kb/definitions/security_entity_analytics_api_get_watchlist.yml +++ b/test/functional/kb/definitions/security_entity_analytics_api_get_watchlist.yml @@ -14,7 +14,7 @@ setup: security-entity-analytics-api.create_watchlist: body: name: cli-ft-get-watchlist-test - riskModifier: 10 + riskModifier: 2 - set: {id: watchlist_id} --- "security-entity-analytics-api get watchlist": diff --git a/test/functional/kb/definitions/security_entity_analytics_api_list_watchlists.yml b/test/functional/kb/definitions/security_entity_analytics_api_list_watchlists.yml index 557747ca..c094406a 100644 --- a/test/functional/kb/definitions/security_entity_analytics_api_list_watchlists.yml +++ b/test/functional/kb/definitions/security_entity_analytics_api_list_watchlists.yml @@ -14,7 +14,7 @@ setup: security-entity-analytics-api.create_watchlist: body: name: cli-ft-list-watchlists-test - riskModifier: 10 + riskModifier: 2 - set: {id: watchlist_id} --- "security-entity-analytics-api list watchlists": diff --git a/test/functional/kb/definitions/security_entity_analytics_api_unassign_watchlist_entities.yml b/test/functional/kb/definitions/security_entity_analytics_api_unassign_watchlist_entities.yml index c4baa8f1..3cd16852 100644 --- a/test/functional/kb/definitions/security_entity_analytics_api_unassign_watchlist_entities.yml +++ b/test/functional/kb/definitions/security_entity_analytics_api_unassign_watchlist_entities.yml @@ -14,7 +14,7 @@ setup: security-entity-analytics-api.create_watchlist: body: name: cli-ft-unassign-watchlist-entities-test - riskModifier: 10 + riskModifier: 2 - set: {id: watchlist_id} - do: security-entity-analytics-api.assign_watchlist_entities: diff --git a/test/functional/kb/definitions/security_entity_analytics_api_update_watchlist.yml b/test/functional/kb/definitions/security_entity_analytics_api_update_watchlist.yml index 5f11acdb..96ec44e2 100644 --- a/test/functional/kb/definitions/security_entity_analytics_api_update_watchlist.yml +++ b/test/functional/kb/definitions/security_entity_analytics_api_update_watchlist.yml @@ -14,7 +14,7 @@ setup: security-entity-analytics-api.create_watchlist: body: name: cli-ft-update-watchlist-test - riskModifier: 10 + riskModifier: 2 - set: {id: watchlist_id} --- "security-entity-analytics-api update watchlist": @@ -23,7 +23,7 @@ setup: id: $watchlist_id body: name: cli-ft-update-watchlist-updated - riskModifier: 20 + riskModifier: 1 - match: {id: $watchlist_id} - match: {name: cli-ft-update-watchlist-updated} - - match: {risk_modifier: 20} + - match: {risk_modifier: 1} diff --git a/test/functional/kb/definitions/security_entity_analytics_api_upload_watchlist_csv.yml b/test/functional/kb/definitions/security_entity_analytics_api_upload_watchlist_csv.yml index a8eabb8a..90b01cb9 100644 --- a/test/functional/kb/definitions/security_entity_analytics_api_upload_watchlist_csv.yml +++ b/test/functional/kb/definitions/security_entity_analytics_api_upload_watchlist_csv.yml @@ -16,7 +16,7 @@ setup: security-entity-analytics-api.create_watchlist: body: name: cli-ft-upload-watchlist-csv-test - riskModifier: 10 + riskModifier: 2 - set: {id: watchlist_id} - write_temp: variable: csv_file diff --git a/test/functional/kb/definitions/security_exceptions_api_create_exception_list_item.yml b/test/functional/kb/definitions/security_exceptions_api_create_exception_list_item.yml index 1723d88d..5c2cf50b 100644 --- a/test/functional/kb/definitions/security_exceptions_api_create_exception_list_item.yml +++ b/test/functional/kb/definitions/security_exceptions_api_create_exception_list_item.yml @@ -7,11 +7,31 @@ requires: serverless: true stack: true --- +setup: + - do: + security-exceptions-api.delete_exception_list: + list_id: cli-ft-sec-exc-parent-list + namespace_type: single + ignore: [404] + - do: + security-exceptions-api.create_exception_list: + body: + name: CLI FT Exception List Parent + description: Parent list for create item test + type: detection + list_id: cli-ft-sec-exc-parent-list + namespace_type: single +--- teardown: - do: security-exceptions-api.delete_exception_list_item: item_id: cli-ft-sec-exc-create-list-item - namespace_type: agnostic + namespace_type: single + ignore: [404] + - do: + security-exceptions-api.delete_exception_list: + list_id: cli-ft-sec-exc-parent-list + namespace_type: single ignore: [404] --- "security-exceptions-api create exception list item": @@ -22,14 +42,13 @@ teardown: name: CLI FT Create Exception List Item description: Created by functional test type: simple - list_id: endpoint_blocklists - namespace_type: agnostic + list_id: cli-ft-sec-exc-parent-list + namespace_type: single entries: - - field: file.hash.sha256 - type: match_any + - field: host.name + type: match operator: included - value: - - "a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3" + value: test-host - is_true: item_id - match: {item_id: cli-ft-sec-exc-create-list-item} - match: {name: CLI FT Create Exception List Item} diff --git a/test/functional/kb/definitions/security_exceptions_api_create_rule_exception_list_items.yml b/test/functional/kb/definitions/security_exceptions_api_create_rule_exception_list_items.yml index 52849dc6..bae79561 100644 --- a/test/functional/kb/definitions/security_exceptions_api_create_rule_exception_list_items.yml +++ b/test/functional/kb/definitions/security_exceptions_api_create_rule_exception_list_items.yml @@ -39,4 +39,5 @@ teardown: field: host.name value: test-host operator: included - - is_true: id + # Response is an array of created exception list items, not an object. + - is_true: 0.id diff --git a/test/functional/kb/definitions/security_exceptions_api_create_shared_exception_list.yml b/test/functional/kb/definitions/security_exceptions_api_create_shared_exception_list.yml index a3ecfbf5..117e4877 100644 --- a/test/functional/kb/definitions/security_exceptions_api_create_shared_exception_list.yml +++ b/test/functional/kb/definitions/security_exceptions_api_create_shared_exception_list.yml @@ -2,6 +2,7 @@ # SPDX-License-Identifier: Apache-2.0 # # Kibana security-exceptions-api: create a shared exception list. +# list_id is auto-generated; set it right after create for reliable teardown. --- requires: serverless: true @@ -20,8 +21,8 @@ teardown: body: name: CLI FT Shared Exception List description: Created by functional test + - set: {list_id: list_id} - is_true: id - is_true: list_id - - set: {list_id: list_id} - match: {name: CLI FT Shared Exception List} - match: {namespace_type: agnostic} diff --git a/test/functional/kb/definitions/security_exceptions_api_delete_exception_list_item.yml b/test/functional/kb/definitions/security_exceptions_api_delete_exception_list_item.yml index c9a7175e..d4699376 100644 --- a/test/functional/kb/definitions/security_exceptions_api_delete_exception_list_item.yml +++ b/test/functional/kb/definitions/security_exceptions_api_delete_exception_list_item.yml @@ -1,13 +1,26 @@ # Copyright Elasticsearch B.V. and contributors # SPDX-License-Identifier: Apache-2.0 # -# Kibana security-exceptions-api: create a blocklist exception item then delete it. +# Kibana security-exceptions-api: create a detection exception item then delete it. --- requires: serverless: true stack: true --- setup: + - do: + security-exceptions-api.delete_exception_list: + list_id: cli-ft-sec-exc-delete-parent + namespace_type: single + ignore: [404] + - do: + security-exceptions-api.create_exception_list: + body: + name: CLI FT Exception List Delete Parent + description: Parent list for delete item test + type: detection + list_id: cli-ft-sec-exc-delete-parent + namespace_type: single - do: security-exceptions-api.create_exception_list_item: body: @@ -15,25 +28,29 @@ setup: name: CLI FT Delete Exception List Item description: Test item for delete test type: simple - list_id: endpoint_blocklists - namespace_type: agnostic + list_id: cli-ft-sec-exc-delete-parent + namespace_type: single entries: - - field: file.hash.sha256 - type: match_any + - field: host.name + type: match operator: included - value: - - "a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3" + value: test-host --- teardown: - do: security-exceptions-api.delete_exception_list_item: item_id: cli-ft-sec-exc-delete-list-item - namespace_type: agnostic + namespace_type: single + ignore: [404] + - do: + security-exceptions-api.delete_exception_list: + list_id: cli-ft-sec-exc-delete-parent + namespace_type: single ignore: [404] --- "security-exceptions-api delete exception list item": - do: security-exceptions-api.delete_exception_list_item: item_id: cli-ft-sec-exc-delete-list-item - namespace_type: agnostic + namespace_type: single - is_true: item_id diff --git a/test/functional/kb/definitions/security_exceptions_api_find_exception_list_items.yml b/test/functional/kb/definitions/security_exceptions_api_find_exception_list_items.yml index 277f1e89..3018ed1d 100644 --- a/test/functional/kb/definitions/security_exceptions_api_find_exception_list_items.yml +++ b/test/functional/kb/definitions/security_exceptions_api_find_exception_list_items.yml @@ -8,6 +8,19 @@ requires: stack: true --- setup: + - do: + security-exceptions-api.delete_exception_list: + list_id: cli-ft-sec-exc-find-parent + namespace_type: single + ignore: [404] + - do: + security-exceptions-api.create_exception_list: + body: + name: CLI FT Exception List Find Parent + description: Parent list for find items test + type: detection + list_id: cli-ft-sec-exc-find-parent + namespace_type: single - do: security-exceptions-api.create_exception_list_item: body: @@ -15,28 +28,32 @@ setup: name: CLI FT Find Exception List Item description: Created by functional test type: simple - list_id: endpoint_blocklists - namespace_type: agnostic + list_id: cli-ft-sec-exc-find-parent + namespace_type: single entries: - - field: file.hash.sha256 - type: match_any + - field: host.name + type: match operator: included - value: - - "a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3" + value: test-host --- teardown: - do: security-exceptions-api.delete_exception_list_item: item_id: cli-ft-sec-exc-find-list-item - namespace_type: agnostic + namespace_type: single + ignore: [404] + - do: + security-exceptions-api.delete_exception_list: + list_id: cli-ft-sec-exc-find-parent + namespace_type: single ignore: [404] --- "security-exceptions-api find exception list items": - do: security-exceptions-api.find_exception_list_items: list_id: - - endpoint_blocklists + - cli-ft-sec-exc-find-parent namespace_type: - - agnostic + - single - is_true: data - gt: {total: 0} diff --git a/test/functional/kb/definitions/security_exceptions_api_read_exception_list_item.yml b/test/functional/kb/definitions/security_exceptions_api_read_exception_list_item.yml index 57098bd4..6b602b75 100644 --- a/test/functional/kb/definitions/security_exceptions_api_read_exception_list_item.yml +++ b/test/functional/kb/definitions/security_exceptions_api_read_exception_list_item.yml @@ -8,6 +8,19 @@ requires: stack: true --- setup: + - do: + security-exceptions-api.delete_exception_list: + list_id: cli-ft-sec-exc-read-parent + namespace_type: single + ignore: [404] + - do: + security-exceptions-api.create_exception_list: + body: + name: CLI FT Exception List Read Parent + description: Parent list for read item test + type: detection + list_id: cli-ft-sec-exc-read-parent + namespace_type: single - do: security-exceptions-api.create_exception_list_item: body: @@ -15,27 +28,31 @@ setup: name: CLI FT Read Exception List Item description: Created by functional test type: simple - list_id: endpoint_blocklists - namespace_type: agnostic + list_id: cli-ft-sec-exc-read-parent + namespace_type: single entries: - - field: file.hash.sha256 - type: match_any + - field: host.name + type: match operator: included - value: - - "a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3" + value: test-host --- teardown: - do: security-exceptions-api.delete_exception_list_item: item_id: cli-ft-sec-exc-read-list-item - namespace_type: agnostic + namespace_type: single + ignore: [404] + - do: + security-exceptions-api.delete_exception_list: + list_id: cli-ft-sec-exc-read-parent + namespace_type: single ignore: [404] --- "security-exceptions-api read exception list item": - do: security-exceptions-api.read_exception_list_item: item_id: cli-ft-sec-exc-read-list-item - namespace_type: agnostic + namespace_type: single - match: {item_id: cli-ft-sec-exc-read-list-item} - match: {name: CLI FT Read Exception List Item} - is_true: id diff --git a/test/functional/kb/definitions/security_exceptions_api_update_exception_list_item.yml b/test/functional/kb/definitions/security_exceptions_api_update_exception_list_item.yml index c511fae7..638ed778 100644 --- a/test/functional/kb/definitions/security_exceptions_api_update_exception_list_item.yml +++ b/test/functional/kb/definitions/security_exceptions_api_update_exception_list_item.yml @@ -8,6 +8,19 @@ requires: stack: true --- setup: + - do: + security-exceptions-api.delete_exception_list: + list_id: cli-ft-sec-exc-update-parent + namespace_type: single + ignore: [404] + - do: + security-exceptions-api.create_exception_list: + body: + name: CLI FT Exception List Update Parent + description: Parent list for update item test + type: detection + list_id: cli-ft-sec-exc-update-parent + namespace_type: single - do: security-exceptions-api.create_exception_list_item: body: @@ -15,20 +28,24 @@ setup: name: CLI FT Update Exception List Item description: Created by functional test type: simple - list_id: endpoint_blocklists - namespace_type: agnostic + list_id: cli-ft-sec-exc-update-parent + namespace_type: single entries: - - field: file.hash.sha256 - type: match_any + - field: host.name + type: match operator: included - value: - - "a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3" + value: test-host --- teardown: - do: security-exceptions-api.delete_exception_list_item: item_id: cli-ft-sec-exc-update-list-item - namespace_type: agnostic + namespace_type: single + ignore: [404] + - do: + security-exceptions-api.delete_exception_list: + list_id: cli-ft-sec-exc-update-parent + namespace_type: single ignore: [404] --- "security-exceptions-api update exception list item": @@ -39,14 +56,13 @@ teardown: name: CLI FT Update Exception List Item Updated description: Updated by functional test type: simple - list_id: endpoint_blocklists - namespace_type: agnostic + list_id: cli-ft-sec-exc-update-parent + namespace_type: single entries: - - field: file.hash.sha256 - type: match_any + - field: host.name + type: match operator: included - value: - - "a665a45920422f9d417e4867efdc4fb8a04a1f3fff1fa07e998e86f7f7a27ae3" + value: test-host - is_true: item_id - match: {item_id: cli-ft-sec-exc-update-list-item} - match: {name: CLI FT Update Exception List Item Updated} diff --git a/test/functional/kb/definitions/slo_delete_rollup_data_op.yml b/test/functional/kb/definitions/slo_delete_rollup_data_op.yml index b6f06621..9e7f2280 100644 --- a/test/functional/kb/definitions/slo_delete_rollup_data_op.yml +++ b/test/functional/kb/definitions/slo_delete_rollup_data_op.yml @@ -44,5 +44,5 @@ teardown: list: - cli-ft-delete-rollup-slo purgePolicy: - purgeType: fixed-age + purgeType: fixed_age age: 7d diff --git a/test/functional/kb/definitions/slo_delete_slo_instances_op.yml b/test/functional/kb/definitions/slo_delete_slo_instances_op.yml index fb05e59b..b311e727 100644 --- a/test/functional/kb/definitions/slo_delete_slo_instances_op.yml +++ b/test/functional/kb/definitions/slo_delete_slo_instances_op.yml @@ -43,4 +43,4 @@ teardown: body: list: - sloId: cli-ft-delete-slo-instances - instanceId: "*" + instanceId: cli-ft-delete-slo-instances