[7.x] [SIEM][CASE] Fix dates when updating (#61603) (#61682)

Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com> Co-authored-by: Elastic Machine <elasticmachine@users.noreply.github.com>
elastic · Mar 27, 2020 · 2fb533d · 2fb533d
1 parent 0813705
commit 2fb533d
Show file tree

Hide file tree

Showing 4 changed files with 85 additions and 29 deletions.
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/action_handlers.test.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/action_handlers.test.ts
@@ -226,15 +226,19 @@ describe('handleUpdateIncident', () => {
     const res = await handleUpdateIncident({
       incidentId: '123',
       serviceNow,
-      params,
+      params: {
+        ...params,
+        updatedAt: '2020-03-15T08:34:53.450Z',
+        updatedBy: { fullName: 'Another User', username: 'anotherUser' },
+      },
       comments: [],
       mapping: finalMapping,
     });
 
     expect(serviceNow.updateIncident).toHaveBeenCalled();
     expect(serviceNow.updateIncident).toHaveBeenCalledWith('123', {
-      short_description: 'a title (updated at 2020-03-13T08:34:53.450Z by Elastic User)',
-      description: 'a description (updated at 2020-03-13T08:34:53.450Z by Elastic User)',
+      short_description: 'a title (updated at 2020-03-15T08:34:53.450Z by Another User)',
+      description: 'a description (updated at 2020-03-15T08:34:53.450Z by Another User)',
     });
     expect(serviceNow.updateIncident).toHaveReturned();
     expect(serviceNow.batchCreateComments).not.toHaveBeenCalled();
@@ -256,7 +260,11 @@ describe('handleUpdateIncident', () => {
     const res = await handleUpdateIncident({
       incidentId: '123',
       serviceNow,
-      params,
+      params: {
+        ...params,
+        updatedAt: '2020-03-15T08:34:53.450Z',
+        updatedBy: { fullName: 'Another User', username: 'anotherUser' },
+      },
       comments: [
         {
           comment: 'first comment',
@@ -278,10 +286,10 @@ describe('handleUpdateIncident', () => {
             fullName: 'Elastic User',
             username: 'elastic',
           },
-          updatedAt: '2020-03-13T08:34:53.450Z',
+          updatedAt: '2020-03-16T08:34:53.450Z',
           updatedBy: {
-            fullName: 'Elastic User',
-            username: 'elastic',
+            fullName: 'Another User',
+            username: 'anotherUser',
           },
           version: 'WzU3LDFd',
         },
@@ -291,8 +299,8 @@ describe('handleUpdateIncident', () => {
 
     expect(serviceNow.updateIncident).toHaveBeenCalled();
     expect(serviceNow.updateIncident).toHaveBeenCalledWith('123', {
-      description: 'a description (updated at 2020-03-13T08:34:53.450Z by Elastic User)',
-      short_description: 'a title (updated at 2020-03-13T08:34:53.450Z by Elastic User)',
+      description: 'a description (updated at 2020-03-15T08:34:53.450Z by Another User)',
+      short_description: 'a title (updated at 2020-03-15T08:34:53.450Z by Another User)',
     });
     expect(serviceNow.updateIncident).toHaveReturned();
     expect(serviceNow.batchCreateComments).toHaveBeenCalled();
@@ -312,17 +320,17 @@ describe('handleUpdateIncident', () => {
           version: 'WzU3LDFd',
         },
         {
-          comment: 'second comment (added at 2020-03-13T08:34:53.450Z by Elastic User)',
+          comment: 'second comment (added at 2020-03-16T08:34:53.450Z by Another User)',
           commentId: '789',
           createdAt: '2020-03-13T08:34:53.450Z',
           createdBy: {
             fullName: 'Elastic User',
             username: 'elastic',
           },
-          updatedAt: '2020-03-13T08:34:53.450Z',
+          updatedAt: '2020-03-16T08:34:53.450Z',
           updatedBy: {
-            fullName: 'Elastic User',
-            username: 'elastic',
+            fullName: 'Another User',
+            username: 'anotherUser',
           },
           version: 'WzU3LDFd',
         },

diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/helpers.test.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/helpers.test.ts
@@ -191,23 +191,31 @@ describe('transformFields', () => {
 
   test('transform fields for update correctly', () => {
     const fields = prepareFieldsForTransformation({
-      params: fullParams,
+      params: {
+        ...fullParams,
+        updatedAt: '2020-03-15T08:34:53.450Z',
+        updatedBy: { username: 'anotherUser', fullName: 'Another User' },
+      },
       mapping: finalMapping,
       defaultPipes: ['informationUpdated'],
     });
 
     const res = transformFields({
-      params: fullParams,
+      params: {
+        ...fullParams,
+        updatedAt: '2020-03-15T08:34:53.450Z',
+        updatedBy: { username: 'anotherUser', fullName: 'Another User' },
+      },
       fields,
       currentIncident: {
         short_description: 'first title (created at 2020-03-13T08:34:53.450Z by Elastic User)',
         description: 'first description (created at 2020-03-13T08:34:53.450Z by Elastic User)',
       },
     });
     expect(res).toEqual({
-      short_description: 'a title (updated at 2020-03-13T08:34:53.450Z by Elastic User)',
+      short_description: 'a title (updated at 2020-03-15T08:34:53.450Z by Another User)',
       description:
-        'first description (created at 2020-03-13T08:34:53.450Z by Elastic User) \r\na description (updated at 2020-03-13T08:34:53.450Z by Elastic User)',
+        'first description (created at 2020-03-13T08:34:53.450Z by Elastic User) \r\na description (updated at 2020-03-15T08:34:53.450Z by Another User)',
     });
   });
 
@@ -229,7 +237,7 @@ describe('transformFields', () => {
     expect(res.description?.includes('\r\n')).toBe(true);
   });
 
-  test('append username if fullname is undefined', () => {
+  test('append username if fullname is undefined when create', () => {
     const fields = prepareFieldsForTransformation({
       params: fullParams,
       mapping: finalMapping,
@@ -245,6 +253,32 @@ describe('transformFields', () => {
       description: 'a description (created at 2020-03-13T08:34:53.450Z by elastic)',
     });
   });
+
+  test('append username if fullname is undefined when update', () => {
+    const fields = prepareFieldsForTransformation({
+      params: {
+        ...fullParams,
+        updatedAt: '2020-03-15T08:34:53.450Z',
+        updatedBy: { username: 'anotherUser', fullName: 'Another User' },
+      },
+      mapping: finalMapping,
+      defaultPipes: ['informationUpdated'],
+    });
+
+    const res = transformFields({
+      params: {
+        ...fullParams,
+        updatedAt: '2020-03-15T08:34:53.450Z',
+        updatedBy: { username: 'anotherUser', fullName: null },
+      },
+      fields,
+    });
+
+    expect(res).toEqual({
+      short_description: 'a title (updated at 2020-03-15T08:34:53.450Z by anotherUser)',
+      description: 'a description (updated at 2020-03-15T08:34:53.450Z by anotherUser)',
+    });
+  });
 });
 
 describe('appendField', () => {
@@ -330,20 +364,20 @@ describe('transformComments', () => {
         comment: 'first comment',
         createdAt: '2020-03-13T08:34:53.450Z',
         createdBy: { fullName: 'Elastic User', username: 'elastic' },
-        updatedAt: null,
-        updatedBy: null,
+        updatedAt: '2020-03-15T08:34:53.450Z',
+        updatedBy: { fullName: 'Another User', username: 'anotherUser' },
       },
     ];
     const res = transformComments(comments, fullParams, ['informationUpdated']);
     expect(res).toEqual([
       {
         commentId: 'b5b4c4d0-574e-11ea-9e2e-21b90f8a9631',
         version: 'WzU3LDFd',
-        comment: 'first comment (updated at 2020-03-13T08:34:53.450Z by Elastic User)',
+        comment: 'first comment (updated at 2020-03-15T08:34:53.450Z by Another User)',
         createdAt: '2020-03-13T08:34:53.450Z',
         createdBy: { fullName: 'Elastic User', username: 'elastic' },
-        updatedAt: null,
-        updatedBy: null,
+        updatedAt: '2020-03-15T08:34:53.450Z',
+        updatedBy: { fullName: 'Another User', username: 'anotherUser' },
       },
     ]);
   });

diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/helpers.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/helpers.ts
@@ -83,8 +83,11 @@ export const transformFields = ({
     const transform = flow(...cur.pipes.map(p => t[p]));
     prev[cur.key] = transform({
       value: cur.value,
-      date: params.createdAt,
-      user: params.createdBy.fullName ?? params.createdBy.username,
+      date: params.updatedAt ?? params.createdAt,
+      user:
+        params.updatedBy != null
+          ? params.updatedBy.fullName ?? params.updatedBy.username
+          : params.createdBy.fullName ?? params.createdBy.username,
       previousValue: currentIncident ? currentIncident[cur.key] : '',
     }).value;
     return prev;
@@ -112,8 +115,11 @@ export const transformComments = (
     ...c,
     comment: flow(...pipes.map(p => t[p]))({
       value: c.comment,
-      date: params.createdAt,
-      user: params.createdBy.fullName ?? '',
+      date: c.updatedAt ?? c.createdAt,
+      user:
+        c.updatedBy != null
+          ? c.updatedBy.fullName ?? c.updatedBy.username
+          : c.createdBy.fullName ?? c.createdBy.username,
     }).value,
   }));
 };
diff --git a/x-pack/plugins/actions/server/builtin_action_types/servicenow/index.test.ts b/x-pack/plugins/actions/server/builtin_action_types/servicenow/index.test.ts
@@ -226,7 +226,11 @@ describe('execute()', () => {
     const executorOptions: ActionTypeExecutorOptions = {
       actionId,
       config: mockOptions.config,
-      params: { ...mockOptions.params, executorAction: 'updateIncident' },
+      params: {
+        ...mockOptions.params,
+        updatedAt: '2020-03-15T08:34:53.450Z',
+        updatedBy: { fullName: 'Another User', username: 'anotherUser' },
+      },
       secrets: mockOptions.secrets,
       services,
     };
@@ -244,7 +248,11 @@ describe('execute()', () => {
     const executorOptions: ActionTypeExecutorOptions = {
       actionId,
       config: mockOptions.config,
-      params: { ...mockOptions.params, executorAction: 'updateIncident' },
+      params: {
+        ...mockOptions.params,
+        updatedAt: '2020-03-15T08:34:53.450Z',
+        updatedBy: { fullName: 'Another User', username: 'anotherUser' },
+      },
       secrets: mockOptions.secrets,
       services,
     };