Make tests deterministic by providing unique timestamps (elastic#93350)

The threat intel data that we are loading for these tests was previously copy/pasted, resulting in all docs having the same @timestamp value. This resulted in nondeterministic ordering which manifested as test failures. This fixes the issue by giving a unique timestamp to each indicator document, and then unskips/updates tests according to this new ordering.
rylnd · Mar 3, 2021 · c71e857 · c71e857
1 parent 92f82a0
commit c71e857
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 21 deletions.
diff --git a/...test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts b/...test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts
@@ -35,8 +35,7 @@ export default ({ getService }: FtrProviderContext) => {
   /**
    * Specific api integration tests for threat matching rule type
    */
-  // FLAKY: https://github.com/elastic/kibana/issues/93152
-  describe.skip('create_threat_matching', () => {
+  describe('create_threat_matching', () => {
     describe('validation errors', () => {
       it('should give an error that the index must exist first if it does not exist before creating a rule', async () => {
         const { body } = await supertest
@@ -601,6 +600,21 @@ export default ({ getService }: FtrProviderContext) => {
             },
             {
               indicator: [
+                {
+                  description: 'this should match auditbeat/hosts on both port and ip',
+                  first_seen: '2021-01-26T11:06:03.000Z',
+                  ip: '45.115.45.3',
+                  matched: {
+                    atomic: '45.115.45.3',
+                    id: '978785',
+                    index: 'filebeat-8.0.0-2021.01.26-000001',
+                    field: 'source.ip',
+                    type: 'url',
+                  },
+                  port: 57324,
+                  provider: 'geenensp',
+                  type: 'url',
+                },
                 {
                   description: "domain should match the auditbeat hosts' data's source.ip",
                   domain: '159.89.119.67',
@@ -619,21 +633,6 @@ export default ({ getService }: FtrProviderContext) => {
                     scheme: 'http',
                   },
                 },
-                {
-                  description: 'this should match auditbeat/hosts on both port and ip',
-                  first_seen: '2021-01-26T11:06:03.000Z',
-                  ip: '45.115.45.3',
-                  matched: {
-                    atomic: '45.115.45.3',
-                    id: '978785',
-                    index: 'filebeat-8.0.0-2021.01.26-000001',
-                    field: 'source.ip',
-                    type: 'url',
-                  },
-                  port: 57324,
-                  provider: 'geenensp',
-                  type: 'url',
-                },
                 {
                   description: 'this should match auditbeat/hosts on both port and ip',
                   first_seen: '2021-01-26T11:06:03.000Z',

diff --git a/x-pack/test/functional/es_archives/filebeat/threat_intel/data.json b/x-pack/test/functional/es_archives/filebeat/threat_intel/data.json
@@ -4,7 +4,7 @@
     "id": "978783",
     "index": "filebeat-8.0.0-2021.01.26-000001",
     "source": {
-      "@timestamp": "2021-01-26T11:09:05.529Z",
+      "@timestamp": "2021-01-26T11:09:00.000Z",
       "agent": {
         "ephemeral_id": "b7b56c3e-1f27-4c69-96f4-aa9ca47888d0",
         "id": "69acb5f0-1e79-4cfe-a4dc-e0dbf229ff51",
@@ -73,7 +73,7 @@
     "id": "978784",
     "index": "filebeat-8.0.0-2021.01.26-000001",
     "source": {
-      "@timestamp": "2021-01-26T11:09:05.529Z",
+      "@timestamp": "2021-01-26T11:09:01.000Z",
       "agent": {
         "ephemeral_id": "b7b56c3e-1f27-4c69-96f4-aa9ca47888d0",
         "id": "69acb5f0-1e79-4cfe-a4dc-e0dbf229ff51",
@@ -142,7 +142,7 @@
     "id": "978785",
     "index": "filebeat-8.0.0-2021.01.26-000001",
     "source": {
-      "@timestamp": "2021-01-26T11:09:05.529Z",
+      "@timestamp": "2021-01-26T11:09:02.000Z",
       "agent": {
         "ephemeral_id": "b7b56c3e-1f27-4c69-96f4-aa9ca47888d0",
         "id": "69acb5f0-1e79-4cfe-a4dc-e0dbf229ff51",
@@ -212,7 +212,7 @@
     "id": "978787",
     "index": "filebeat-8.0.0-2021.01.26-000001",
     "source": {
-      "@timestamp": "2021-01-26T11:09:05.529Z",
+      "@timestamp": "2021-01-26T11:09:03.000Z",
       "agent": {
         "ephemeral_id": "b7b56c3e-1f27-4c69-96f4-aa9ca47888d0",
         "id": "69acb5f0-1e79-4cfe-a4dc-e0dbf229ff51",