tests

elastic · Sep 16, 2024 · 4cb32b0 · 4cb32b0
1 parent 48a5ab5
commit 4cb32b0
Show file tree

Hide file tree

Showing 2 changed files with 37 additions and 0 deletions.
diff --git a/x-pack/plugins/security_solution/server/endpoint/mocks/mocks.ts b/x-pack/plugins/security_solution/server/endpoint/mocks/mocks.ts
@@ -9,6 +9,7 @@
 
 import type { ScopedClusterClientMock } from '@kbn/core/server/mocks';
 import {
+  analyticsServiceMock,
   elasticsearchServiceMock,
   httpServerMock,
   httpServiceMock,
@@ -144,6 +145,7 @@ export const createMockEndpointAppContextServiceSetupContract =
       securitySolutionRequestContextFactory: requestContextFactoryMock.create(),
       cloud: cloudMock.createSetup(),
       loggerFactory: loggingSystemMock.create(),
+      telemetry: analyticsServiceMock.createAnalyticsServiceSetup(),
     };
   };
 

diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/actions/response_actions.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/actions/response_actions.test.ts
@@ -534,6 +534,41 @@ describe('Response actions', () => {
       );
     });
 
+    describe('Telemetry', () => {
+      it.each([
+        ['execute', EXECUTE_ROUTE],
+        ['get-file', GET_FILE_ROUTE],
+        ['running-processes', GET_PROCESSES_ROUTE],
+        ['isolate', ISOLATE_HOST_ROUTE_V2],
+        ['kill-process', KILL_PROCESS_ROUTE],
+        ['scan', SCAN_ROUTE],
+        ['suspend-process', SUSPEND_PROCESS_ROUTE],
+        ['unisolate', UNISOLATE_HOST_ROUTE_V2],
+        ['upload', UPLOAD_ROUTE],
+      ])('sends analytics when %s action is created', async (command, route) => {
+        endpointContext.experimentalFeatures = {
+          ...endpointContext.experimentalFeatures,
+          responseActionsTelemetryEnabled: true,
+        };
+
+        await callRoute(route, {
+          body: { endpoint_ids: ['XYZ'], parameters: { path: '/home/usr/' } },
+          version: '2023-10-31',
+        });
+
+        expect(
+          (await endpointAppContextService.getTelemetryService().reportEvent) as jest.Mock
+        ).toHaveBeenCalledWith('endpoint_response_action_sent', {
+          responseActions: expect.objectContaining({
+            actionId: expect.any(String),
+            agentType: 'endpoint',
+            command,
+            endpointIds: ['agent-a'],
+          }),
+        });
+      });
+    });
+
     describe('With endpoint data streams', () => {
       it('handles unisolation', async () => {
         const ctx = await callRoute(