Failing test: X-Pack Detection Engine API Integration Tests.x-pack/test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching·ts - detection engine api security and spaces enabled create_threat_matching tests with auditbeat data indicator enrichment generates multiple signals with multiple matches #93152
Description
A test failed on a tracked branch
Error: expected [ { indicator: [ [Object] ] },
{ indicator: [ [Object], [Object], [Object] ] } ] to sort of equal [ { indicator: [ [Object] ] },
{ indicator: [ [Object], [Object], [Object] ] } ]
at Assertion.assert (/dev/shm/workspace/parallel/23/kibana/packages/kbn-expect/expect.js:100:11)
at Assertion.eql (/dev/shm/workspace/parallel/23/kibana/packages/kbn-expect/expect.js:244:8)
at Context.<anonymous> (test/detection_engine_api_integration/security_and_spaces/tests/create_threat_matching.ts:578:30)
at Object.apply (/dev/shm/workspace/parallel/23/kibana/packages/kbn-test/src/functional_test_runner/lib/mocha/wrap_function.js:73:16) {
actual: '[\n' +
' {\n' +
' "indicator": [\n' +
' {\n' +
` "description": "domain should match the auditbeat hosts' data's source.ip"\n` +
' "domain": "159.89.119.67"\n' +
' "first_seen": "2021-01-26T11:09:04.000Z"\n' +
' "matched": {\n' +
' "atomic": "159.89.119.67"\n' +
' "field": "destination.ip"\n' +
' "id": "978783"\n' +
' "index": "filebeat-8.0.0-2021.01.26-000001"\n' +
' "type": "url"\n' +
' }\n' +
' "provider": "geenensp"\n' +
' "type": "url"\n' +
' "url": {\n' +
' "full": "http://159.89.119.67:59600/bin.sh"\n' +
' "scheme": "http"\n' +
' }\n' +
' }\n' +
' ]\n' +
' }\n' +
' {\n' +
' "indicator": [\n' +
' {\n' +
' "description": "this should match auditbeat/hosts on both port and ip"\n' +
' "first_seen": "2021-01-26T11:06:03.000Z"\n' +
' "ip": "45.115.45.3"\n' +
' "matched": {\n' +
' "atomic": "45.115.45.3"\n' +
' "field": "source.ip"\n' +
' "id": "978785"\n' +
' "index": "filebeat-8.0.0-2021.01.26-000001"\n' +
' "type": "url"\n' +
' }\n' +
' "port": 57324\n' +
' "provider": "geenensp"\n' +
' "type": "url"\n' +
' }\n' +
' {\n' +
` "description": "domain should match the auditbeat hosts' data's source.ip"\n` +
' "domain": "159.89.119.67"\n' +
' "first_seen": "2021-01-26T11:09:04.000Z"\n' +
' "matched": {\n' +
' "atomic": "159.89.119.67"\n' +
' "field": "destination.ip"\n' +
' "id": "978783"\n' +
' "index": "filebeat-8.0.0-2021.01.26-000001"\n' +
' "type": "url"\n' +
' }\n' +
' "provider": "geenensp"\n' +
' "type": "url"\n' +
' "url": {\n' +
' "full": "http://159.89.119.67:59600/bin.sh"\n' +
' "scheme": "http"\n' +
' }\n' +
' }\n' +
' {\n' +
' "description": "this should match auditbeat/hosts on both port and ip"\n' +
' "first_seen": "2021-01-26T11:06:03.000Z"\n' +
' "ip": "45.115.45.3"\n' +
' "matched": {\n' +
' "atomic": 57324\n' +
' "field": "source.port"\n' +
' "id": "978785"\n' +
' "index": "filebeat-8.0.0-2021.01.26-000001"\n' +
' "type": "url"\n' +
' }\n' +
' "port": 57324\n' +
' "provider": "geenensp"\n' +
' "type": "url"\n' +
' }\n' +
' ]\n' +
' }\n' +
']',
expected: '[\n' +
' {\n' +
' "indicator": [\n' +
' {\n' +
` "description": "domain should match the auditbeat hosts' data's source.ip"\n` +
' "domain": "159.89.119.67"\n' +
' "first_seen": "2021-01-26T11:09:04.000Z"\n' +
' "matched": {\n' +
' "atomic": "159.89.119.67"\n' +
' "field": "destination.ip"\n' +
' "id": "978783"\n' +
' "index": "filebeat-8.0.0-2021.01.26-000001"\n' +
' "type": "url"\n' +
' }\n' +
' "provider": "geenensp"\n' +
' "type": "url"\n' +
' "url": {\n' +
' "full": "http://159.89.119.67:59600/bin.sh"\n' +
' "scheme": "http"\n' +
' }\n' +
' }\n' +
' ]\n' +
' }\n' +
' {\n' +
' "indicator": [\n' +
' {\n' +
` "description": "domain should match the auditbeat hosts' data's source.ip"\n` +
' "domain": "159.89.119.67"\n' +
' "first_seen": "2021-01-26T11:09:04.000Z"\n' +
' "matched": {\n' +
' "atomic": "159.89.119.67"\n' +
' "field": "destination.ip"\n' +
' "id": "978783"\n' +
' "index": "filebeat-8.0.0-2021.01.26-000001"\n' +
' "type": "url"\n' +
' }\n' +
' "provider": "geenensp"\n' +
' "type": "url"\n' +
' "url": {\n' +
' "full": "http://159.89.119.67:59600/bin.sh"\n' +
' "scheme": "http"\n' +
' }\n' +
' }\n' +
' {\n' +
' "description": "this should match auditbeat/hosts on both port and ip"\n' +
' "first_seen": "2021-01-26T11:06:03.000Z"\n' +
' "ip": "45.115.45.3"\n' +
' "matched": {\n' +
' "atomic": "45.115.45.3"\n' +
' "field": "source.ip"\n' +
' "id": "978785"\n' +
' "index": "filebeat-8.0.0-2021.01.26-000001"\n' +
' "type": "url"\n' +
' }\n' +
' "port": 57324\n' +
' "provider": "geenensp"\n' +
' "type": "url"\n' +
' }\n' +
' {\n' +
' "description": "this should match auditbeat/hosts on both port and ip"\n' +
' "first_seen": "2021-01-26T11:06:03.000Z"\n' +
' "ip": "45.115.45.3"\n' +
' "matched": {\n' +
' "atomic": 57324\n' +
' "field": "source.port"\n' +
' "id": "978785"\n' +
' "index": "filebeat-8.0.0-2021.01.26-000001"\n' +
' "type": "url"\n' +
' }\n' +
' "port": 57324\n' +
' "provider": "geenensp"\n' +
' "type": "url"\n' +
' }\n' +
' ]\n' +
' }\n' +
']',
showDiff: true
}
First failure: Jenkins Build