diff --git a/x-pack/plugins/security_solution/server/endpoint/mocks/mocks.ts b/x-pack/plugins/security_solution/server/endpoint/mocks/mocks.ts index 6012dec151b89bc..7807dd44bddbde4 100644 --- a/x-pack/plugins/security_solution/server/endpoint/mocks/mocks.ts +++ b/x-pack/plugins/security_solution/server/endpoint/mocks/mocks.ts @@ -9,6 +9,7 @@ import type { ScopedClusterClientMock } from '@kbn/core/server/mocks'; import { + analyticsServiceMock, elasticsearchServiceMock, httpServerMock, httpServiceMock, @@ -144,6 +145,7 @@ export const createMockEndpointAppContextServiceSetupContract = securitySolutionRequestContextFactory: requestContextFactoryMock.create(), cloud: cloudMock.createSetup(), loggerFactory: loggingSystemMock.create(), + telemetry: analyticsServiceMock.createAnalyticsServiceSetup(), }; }; diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/actions/response_actions.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/actions/response_actions.test.ts index 669d3770be37dce..0fd39fa66378f7a 100644 --- a/x-pack/plugins/security_solution/server/endpoint/routes/actions/response_actions.test.ts +++ b/x-pack/plugins/security_solution/server/endpoint/routes/actions/response_actions.test.ts @@ -534,6 +534,41 @@ describe('Response actions', () => { ); }); + describe('Telemetry', () => { + it.each([ + ['execute', EXECUTE_ROUTE], + ['get-file', GET_FILE_ROUTE], + ['running-processes', GET_PROCESSES_ROUTE], + ['isolate', ISOLATE_HOST_ROUTE_V2], + ['kill-process', KILL_PROCESS_ROUTE], + ['scan', SCAN_ROUTE], + ['suspend-process', SUSPEND_PROCESS_ROUTE], + ['unisolate', UNISOLATE_HOST_ROUTE_V2], + ['upload', UPLOAD_ROUTE], + ])('sends analytics when %s action is created', async (command, route) => { + endpointContext.experimentalFeatures = { + ...endpointContext.experimentalFeatures, + responseActionsTelemetryEnabled: true, + }; + + await callRoute(route, { + body: { endpoint_ids: ['XYZ'], parameters: { path: '/home/usr/' } }, + version: '2023-10-31', + }); + + expect( + (await endpointAppContextService.getTelemetryService().reportEvent) as jest.Mock + ).toHaveBeenCalledWith('endpoint_response_action_sent', { + responseActions: expect.objectContaining({ + actionId: expect.any(String), + agentType: 'endpoint', + command, + endpointIds: ['agent-a'], + }), + }); + }); + }); + describe('With endpoint data streams', () => { it('handles unisolation', async () => { const ctx = await callRoute(