@oneuptime/common 13.0.6 → 13.0.8

package/Tests/Server/Utils/SecurityEvent/DetectionRuleEvaluator.test.ts

@@ -45,6 +45,15 @@ import logger from "../../../../Server/Utils/Logger";
 import { Statement } from "../../../../Server/Utils/AnalyticsDatabase/Statement";
 import { MAX_CONNECTOR_ERROR_MESSAGE_LENGTH } from "../../../../Server/Utils/SecurityEvent/ConnectorErrorMessage";
 import MetricSeriesFingerprint from "../../../../Utils/Metrics/MetricSeriesFingerprint";
+import {
+  DETECTION_MAX_GROUPS_PER_EVALUATION,
+  DETECTION_MAX_LOOKBACK_IN_MINUTES,
+} from "../../../../Types/SecurityEvent/DetectionFindingConstants";
+import {
+  SIGMA_DEFAULT_LEVEL,
+  SIGMA_LEVEL_TO_OCSF_SEVERITY,
+  SigmaLevel,
+} from "../../../../Types/SecurityEvent/SigmaRule";
 import ObjectID from "../../../../Types/ObjectID";
 import OneUptimeDate from "../../../../Types/Date";
 import ServiceType from "../../../../Types/Telemetry/ServiceType";
@@ -1144,6 +1153,139 @@ describe("DetectionRuleEvaluator", () => {
     });
   });
 
+  describe("evaluation window", () => {
+    /*
+     * The Detection Rules guide tells customers exactly which events a
+     * run sees: the first run looks back one interval, later runs resume
+     * where the previous one stopped, and a gap is caught up at most
+     * DETECTION_MAX_LOOKBACK_IN_MINUTES back. Pinned here so the guide
+     * and the engine cannot drift apart.
+     */
+    const NOW: Date = new Date("2026-09-18T12:00:00.000Z");
+
+    function freezeNow(): void {
+      getJestSpyOn(OneUptimeDate, "getCurrentDate").mockReturnValue(
+        NOW as never,
+      );
+    }
+
+    test("the first run looks back one evaluation interval", async () => {
+      freezeNow();
+
+      const spies: EvaluationSpies = installSpies();
+
+      await DetectionRuleEvaluator.evaluateRule(
+        buildRule({ evaluationIntervalInMinutes: 10 }),
+      );
+
+      const args: FindDetectionMatchesData = findMatchesArg(spies);
+
+      expect(args.endTime.getTime()).toBe(NOW.getTime());
+      expect(args.startTime.getTime()).toBe(
+        OneUptimeDate.addRemoveMinutes(NOW, -10).getTime(),
+      );
+    });
+
+    test("a later run resumes exactly where the previous one stopped", async () => {
+      freezeNow();
+
+      const lastEvaluatedAt: Date = OneUptimeDate.addRemoveMinutes(NOW, -37);
+      const spies: EvaluationSpies = installSpies();
+
+      await DetectionRuleEvaluator.evaluateRule(
+        buildRule({ evaluationIntervalInMinutes: 10, lastEvaluatedAt }),
+      );
+
+      expect(findMatchesArg(spies).startTime.getTime()).toBe(
+        lastEvaluatedAt.getTime(),
+      );
+    });
+
+    test("a gap longer than the lookback cap is caught up only that far", async () => {
+      freezeNow();
+
+      const spies: EvaluationSpies = installSpies();
+
+      await DetectionRuleEvaluator.evaluateRule(
+        buildRule({
+          lastEvaluatedAt: OneUptimeDate.addRemoveMinutes(NOW, -3 * 24 * 60),
+        }),
+      );
+
+      expect(findMatchesArg(spies).startTime.getTime()).toBe(
+        OneUptimeDate.addRemoveMinutes(
+          NOW,
+          -DETECTION_MAX_LOOKBACK_IN_MINUTES,
+        ).getTime(),
+      );
+      expect(DETECTION_MAX_LOOKBACK_IN_MINUTES).toBe(24 * 60);
+    });
+
+    test("the next run starts where this one ended", async () => {
+      freezeNow();
+
+      const spies: EvaluationSpies = installSpies();
+
+      await DetectionRuleEvaluator.evaluateRule(buildRule());
+
+      const updateArg: { data: JSONObject } = spies.updateOneById.mock
+        .calls[0]?.[0] as { data: JSONObject };
+
+      expect((updateArg.data["lastEvaluatedAt"] as Date).getTime()).toBe(
+        findMatchesArg(spies).endTime.getTime(),
+      );
+    });
+
+    test("at most DETECTION_MAX_GROUPS_PER_EVALUATION groups are asked for", async () => {
+      const spies: EvaluationSpies = installSpies();
+
+      await DetectionRuleEvaluator.evaluateRule(buildRule());
+
+      expect(findMatchesArg(spies).maxGroups).toBe(
+        DETECTION_MAX_GROUPS_PER_EVALUATION,
+      );
+    });
+  });
+
+  describe("finding severity follows the Sigma level", () => {
+    test.each(Object.values(SigmaLevel))(
+      "a %s rule writes findings at the mapped OCSF severity",
+      async (level: SigmaLevel) => {
+        const spies: EvaluationSpies = installSpies({
+          groups: [buildGroup("alice", 1)],
+        });
+
+        await DetectionRuleEvaluator.evaluateRule(
+          buildRule({ level, shouldCreateAlert: false }),
+        );
+
+        const rows: Array<JSONObject> = spies.insertJsonRows.mock
+          .calls[0]?.[0] as Array<JSONObject>;
+
+        expect(rows[0]?.["severityName"]).toBe(
+          SIGMA_LEVEL_TO_OCSF_SEVERITY[level],
+        );
+      },
+    );
+
+    test("an unrecognized level writes findings at the default level's severity", async () => {
+      const spies: EvaluationSpies = installSpies({
+        groups: [buildGroup("alice", 1)],
+      });
+
+      await DetectionRuleEvaluator.evaluateRule(
+        buildRule({ level: "apocalyptic", shouldCreateAlert: false }),
+      );
+
+      const rows: Array<JSONObject> = spies.insertJsonRows.mock
+        .calls[0]?.[0] as Array<JSONObject>;
+
+      expect(rows[0]?.["severityName"]).toBe(
+        SIGMA_LEVEL_TO_OCSF_SEVERITY[SIGMA_DEFAULT_LEVEL],
+      );
+    });
+  });
+
   describe("distinct count and match count threshold", () => {
     /*
      * matchCountThreshold holds a rule back until a group reaches N

package/Tests/Server/Utils/SecurityEvent/GoogleSecOpsSeverityRepair.test.ts

@@ -0,0 +1,140 @@
+import { describe, expect, test } from "@jest/globals";
+import GoogleSecOpsSeverityRepair from "../../../../Server/Utils/SecurityEvent/GoogleSecOpsSeverityRepair";
+import OcsfSeverity, {
+  OCSF_SEVERITY_ALIASES,
+  OcsfSeverityId,
+} from "../../../../Types/SecurityEvent/OcsfSeverity";
+import { GOOGLE_SECOPS_RISK_SCORE_BANDS } from "../../../../Utils/SecurityEvent/GoogleSecOpsAlertNormalizer";
+
+/*
+ * The SQL that re-grades Google SecOps detections stored as Unknown before
+ * the normalizer read custom-rule severities. What it computes is pinned
+ * against a real ClickHouse in GoogleSecOpsSeverityRepairClickhouseIntegration;
+ * these tests pin the statement's shape: the guards that keep it to Google
+ * SecOps findings that are still Unknown, that it writes the name and the id
+ * together from one grade, and that its tables are the normalizer's own.
+ */
+
+const STATEMENT: string = GoogleSecOpsSeverityRepair.repairStatement({
+  storageTable: "SecurityEventItemV1Local",
+  onCluster: " ON CLUSTER 'oneuptime'",
+});
+const GRADE: string = GoogleSecOpsSeverityRepair.gradeExpression();
+
+describe("GoogleSecOpsSeverityRepair.repairStatement", () => {
+  test("mutates the local storage table ON CLUSTER", () => {
+    expect(
+      STATEMENT.startsWith(
+        "ALTER TABLE SecurityEventItemV1Local ON CLUSTER 'oneuptime' UPDATE ",
+      ),
+    ).toBe(true);
+  });
+
+  test("writes the severity name and its id from the same grade", () => {
+    const names: Array<OcsfSeverity> = Object.keys(
+      OcsfSeverityId,
+    ) as Array<OcsfSeverity>;
+    const idTransform: string = `transform(${GRADE}, [${names
+      .map((name: OcsfSeverity): string => {
+        return `'${name}'`;
+      })
+      .join(", ")}], [${names
+      .map((name: OcsfSeverity): string => {
+        return String(OcsfSeverityId[name]);
+      })
+      .join(", ")}], 0)`;
+
+    expect(STATEMENT).toContain(
+      `UPDATE severityName = ${GRADE}, severityId = ${idTransform} WHERE `,
+    );
+  });
+
+  test("only touches Google SecOps findings still stored as Unknown that now grade", () => {
+    const condition: string = GoogleSecOpsSeverityRepair.condition();
+
+    expect(STATEMENT.endsWith(` WHERE ${condition}`)).toBe(true);
+    expect(condition).toBe(
+      [
+        "vendorName = 'Google'",
+        "productName = 'Google SecOps'",
+        "classUid = 2004",
+        "severityId = 0",
+        `${GRADE} != ''`,
+      ].join(" AND "),
+    );
+  });
+
+  test("uses no non-deterministic function a mutation would reject", () => {
+    for (const fn of ["now(", "rand", "today(", "generateUUID"]) {
+      expect(STATEMENT).not.toContain(fn);
+    }
+  });
+
+  test("is the same statement every time, so a re-run is the same mutation", () => {
+    expect(
+      GoogleSecOpsSeverityRepair.repairStatement({
+        storageTable: "SecurityEventItemV1Local",
+        onCluster: " ON CLUSTER 'oneuptime'",
+      }),
+    ).toBe(STATEMENT);
+  });
+});
+
+describe("GoogleSecOpsSeverityRepair.gradeExpression", () => {
+  test("reads the four sources in the normalizer's order", () => {
+    const order: Array<number> = [
+      GRADE.indexOf("attributes['detection.0.severity']"),
+      GRADE.indexOf("attributes['severity']"),
+      GRADE.indexOf("(ruleLabels|rule_labels)"),
+      GRADE.indexOf("outcomes"),
+    ];
+
+    for (const position of order) {
+      expect(position).toBeGreaterThan(-1);
+    }
+
+    expect(
+      [...order].sort((a: number, b: number): number => {
+        return a - b;
+      }),
+    ).toEqual(order);
+    expect(GRADE.startsWith("arrayFirst(grade -> grade != '', [")).toBe(true);
+  });
+
+  test("grades text with every OCSF alias except Unknown", () => {
+    for (const [alias, severity] of Object.entries(OCSF_SEVERITY_ALIASES)) {
+      if (severity === OcsfSeverity.Unknown) {
+        expect(GRADE).not.toContain(`'${alias}'`);
+      } else {
+        expect(GRADE).toContain(`'${alias}'`);
+      }
+    }
+
+    expect(GRADE).not.toContain("'Unknown'");
+  });
+
+  test("grades risk scores with the normalizer's bands, highest first", () => {
+    const bands: string = GOOGLE_SECOPS_RISK_SCORE_BANDS.map(
+      (band: { minimum: number; severity: OcsfSeverity }): string => {
+        return `score >= ${band.minimum}, '${band.severity}'`;
+      },
+    ).join(", ");
+
+    expect(GRADE).toContain(
+      `multiIf(NOT isFinite(score) OR score <= 0, '', ${bands}, '')`,
+    );
+  });
+
+  test("reads only the first detection entry's labels and outcomes", () => {
+    expect(GRADE).toContain(
+      "'^detection[.](0[.])?(ruleLabels|rule_labels)[.][0-9]+[.]key$'",
+    );
+    expect(GRADE).toContain("'^detection[.](0[.])?outcomes[.][0-9]+[.]key$'");
+  });
+
+  test("walks list entries by their numeric index, not the map's key order", () => {
+    expect(GRADE).toContain(
+      "arraySort(entryKey -> toUInt64OrZero(extract(entryKey, '[.]([0-9]+)[.]key$'))",
+    );
+  });
+});