Skip to content

[Detection Engine][FTR] Audit machine learning FTRs #179768

Open

Description

Summary

We've been working on an effort to move our FTR tests from being run in trial license (an elevated license) to basic license/essentials tier. Tests in the elevated license folder should be specific to functionality only available for that license. During this work, I encountered a few behaviors that I think we need to follow up on.

ML is available in Essentials Tier in serverless, and Platinum in ESS. I think we can maintain the bulk of the ML tests in the trial_license_complete_tier folder but also add:

  • Test passed creating ML rule in serverless essentials license. @paulewing @approksiu should this match ESS where this is only for elevated tier? EDIT: confirmed it should be available in essentials.
  • Test in essentials tier ensuring you can create and run an ML rule - Serverless specifc
  • Missing test in basic to ensure that if you downgrade, can’t run ML rules that already exist in ESS
  • ML trial tier asset criticality test failing - search for this ticket number in the code
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions