add unit tests for histograms

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/__mocks__/index.ts

@@ -0,0 +1,83 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const mockOptions = {
+  filterQuery: '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+  timerange: { from: '2020-09-08T13:32:02.875Z', to: '2020-09-09T13:32:02.875Z' },
+  defaultIndex: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  stackByField: 'event.module',
+};
+
+export const expectedDsl = {
+  index: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  allowNoIndices: true,
+  ignoreUnavailable: true,
+  body: {
+    aggregations: {
+      alertsGroup: {
+        terms: {
+          field: 'event.module',
+          missing: 'All others',
+          order: { _count: 'desc' },
+          size: 10,
+        },
+        aggs: {
+          alerts: {
+            date_histogram: {
+              field: '@timestamp',
+              fixed_interval: '2700000ms',
+              min_doc_count: 0,
+              extended_bounds: { min: 1599571922875, max: 1599658322875 },
+            },
+          },
+        },
+      },
+    },
+    query: {
+      bool: {
+        filter: [
+          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          {
+            bool: {
+              filter: [
+                {
+                  bool: { should: [{ match: { 'event.kind': 'alert' } }], minimum_should_match: 1 },
+                },
+              ],
+            },
+          },
+          {
+            range: {
+              '@timestamp': {
+                gte: '2020-09-08T13:32:02.875Z',
+                lte: '2020-09-09T13:32:02.875Z',
+                format: 'strict_date_optional_time',
+              },
+            },
+          },
+        ],
+      },
+    },
+    size: 0,
+    track_total_hits: true,
+  },
+};

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/index.test.ts

@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { alertsMatrixHistogramConfig } from '.';
+import { buildAlertsHistogramQuery } from './query.alerts_histogram.dsl';
+
+jest.mock('./query.alerts_histogram.dsl', () => ({
+  buildAlertsHistogramQuery: jest.fn(),
+}));
+
+describe('alertsMatrixHistogramConfig', () => {
+  test('should export alertsMatrixHistogramConfig corrrectly', () => {
+    expect(alertsMatrixHistogramConfig).toEqual({
+      aggName: 'aggregations.alertsGroup.buckets',
+      parseKey: 'alerts.buckets',
+      buildDsl: buildAlertsHistogramQuery,
+    });
+  });
+});

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/alerts/query.alerts_histogram.dsl.test.ts

@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { buildAlertsHistogramQuery } from './query.alerts_histogram.dsl';
+import { mockOptions, expectedDsl } from './__mocks__/';
+
+describe('buildAlertsHistogramQuery', () => {
+  test('build query from options correctly', () => {
+    expect(buildAlertsHistogramQuery(mockOptions)).toEqual(expectedDsl);
+  });
+});

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/__mocks__/index.ts

@@ -0,0 +1,70 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const mockOptions = {
+  filterQuery:
+    '{"bool":{"must":[],"filter":[{"match_all":{}},{"bool":{"should":[],"minimum_should_match":1}},{"match_phrase":{"result_type":"record"}},null,{"range":{"record_score":{"gte":50}}}],"should":[],"must_not":[]}}',
+  timerange: { from: '2020-09-08T13:51:04.932Z', to: '2020-09-09T13:51:04.933Z' },
+  defaultIndex: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  stackByField: 'job_id',
+};
+
+export const expectedDsl = {
+  index: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  allowNoIndices: true,
+  ignoreUnavailable: true,
+  body: {
+    aggs: {
+      anomalyActionGroup: {
+        terms: { field: 'job_id', order: { _count: 'desc' }, size: 10 },
+        aggs: {
+          anomalies: {
+            date_histogram: {
+              field: 'timestamp',
+              fixed_interval: '2700000ms',
+              min_doc_count: 0,
+              extended_bounds: { min: 1599573064932, max: 1599659464933 },
+            },
+          },
+        },
+      },
+    },
+    query: {
+      bool: {
+        filter: [
+          '{"bool":{"must":[],"filter":[{"match_all":{}},{"bool":{"should":[],"minimum_should_match":1}},{"match_phrase":{"result_type":"record"}},null,{"range":{"record_score":{"gte":50}}}],"should":[],"must_not":[]}}',
+          {
+            range: {
+              timestamp: {
+                gte: '2020-09-08T13:51:04.932Z',
+                lte: '2020-09-09T13:51:04.933Z',
+                format: 'strict_date_optional_time',
+              },
+            },
+          },
+        ],
+      },
+    },
+    size: 0,
+    track_total_hits: true,
+  },
+};

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/index.test.ts

@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { anomaliesMatrixHistogramConfig } from '.';
+import { buildAnomaliesHistogramQuery } from './query.anomalies_histogram.dsl';
+
+jest.mock('./query.anomalies_histogram.dsl', () => ({
+  buildAnomaliesHistogramQuery: jest.fn(),
+}));
+
+describe('anomaliesMatrixHistogramConfig', () => {
+  test('should export anomaliesMatrixHistogramConfig corrrectly', () => {
+    expect(anomaliesMatrixHistogramConfig).toEqual({
+      aggName: 'aggregations.anomalyActionGroup.buckets',
+      parseKey: 'anomalies.buckets',
+      buildDsl: buildAnomaliesHistogramQuery,
+    });
+  });
+});

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/anomalies/query.anomalies_histogram.dsl.test.ts

@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { buildAnomaliesHistogramQuery } from './query.anomalies_histogram.dsl';
+import { mockOptions, expectedDsl } from './__mocks__';
+
+describe('buildAnomaliesHistogramQuery', () => {
+  test('build query from options correctly', () => {
+    expect(buildAnomaliesHistogramQuery(mockOptions)).toEqual(expectedDsl);
+  });
+});

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/__mocks__/index.ts

@@ -0,0 +1,75 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+export const mockOptions = {
+  filterQuery: '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+  timerange: { from: '2020-09-08T14:03:36.140Z', to: '2020-09-09T14:03:36.140Z' },
+  defaultIndex: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  stackByField: 'event.outcome',
+};
+
+export const expectedDsl = {
+  index: [
+    'apm-*-transaction*',
+    'auditbeat-*',
+    'endgame-*',
+    'filebeat-*',
+    'logs-*',
+    'packetbeat-*',
+    'winlogbeat-*',
+  ],
+  allowNoIndices: true,
+  ignoreUnavailable: true,
+  body: {
+    aggregations: {
+      eventActionGroup: {
+        terms: {
+          field: 'event.outcome',
+          include: ['success', 'failure'],
+          order: { _count: 'desc' },
+          size: 2,
+        },
+        aggs: {
+          events: {
+            date_histogram: {
+              field: '@timestamp',
+              fixed_interval: '2700000ms',
+              min_doc_count: 0,
+              extended_bounds: { min: 1599573816140, max: 1599660216140 },
+            },
+          },
+        },
+      },
+    },
+    query: {
+      bool: {
+        filter: [
+          '{"bool":{"must":[],"filter":[{"match_all":{}}],"should":[],"must_not":[]}}',
+          { bool: { must: [{ term: { 'event.category': 'authentication' } }] } },
+          {
+            range: {
+              '@timestamp': {
+                gte: '2020-09-08T14:03:36.140Z',
+                lte: '2020-09-09T14:03:36.140Z',
+                format: 'strict_date_optional_time',
+              },
+            },
+          },
+        ],
+      },
+    },
+    size: 0,
+    track_total_hits: true,
+  },
+};

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/index.test.ts

@@ -0,0 +1,22 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+
+import { authenticationsMatrixHistogramConfig } from '.';
+import { buildAuthenticationsHistogramQuery } from './query.authentications_histogram.dsl';
+
+jest.mock('./query.authentications_histogram.dsl', () => ({
+  buildAuthenticationsHistogramQuery: jest.fn(),
+}));
+
+describe('authenticationsMatrixHistogramConfig', () => {
+  test('should export authenticationsMatrixHistogramConfig corrrectly', () => {
+    expect(authenticationsMatrixHistogramConfig).toEqual({
+      aggName: 'aggregations.eventActionGroup.buckets',
+      parseKey: 'events.buckets',
+      buildDsl: buildAuthenticationsHistogramQuery,
+    });
+  });
+});

x-pack/plugins/security_solution/server/search_strategy/security_solution/factory/matrix_histogram/authentications/query.authentications_histogram.dsl.test.ts

@@ -0,0 +1,13 @@
+/*
+ * Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
+ * or more contributor license agreements. Licensed under the Elastic License;
+ * you may not use this file except in compliance with the Elastic License.
+ */
+import { buildAuthenticationsHistogramQuery } from './query.authentications_histogram.dsl';
+import { mockOptions, expectedDsl } from './__mocks__/';
+
+describe('buildAuthenticationsHistogramQuery', () => {
+  test('build query from options correctly', () => {
+    expect(buildAuthenticationsHistogramQuery(mockOptions)).toEqual(expectedDsl);
+  });
+});