Updated API & Selenium tests for Create Remote Threads panel

testing/tests/api_tests/data_insertion_tests/fixtures/createRemoteThreads.json

@@ -0,0 +1,31 @@
+{
+    "winlog": {
+      "computer_name": "testing.lme.local",
+      "event_id": "4625",
+      "task": "Logon",
+      "keywords": [
+        "Audit Failure"
+      ],
+      "provider_name": "Microsoft-Windows-Sysmon",
+      "event_data": {
+        "LogonType": "3",
+        "IpAddress": "194.165.16.73",
+        "TargetUserName": "Administrator",
+        "TargetDomainName": "testserver.LME.LOCAL",
+        "LogonProcessName": "NtLmSsp ",
+        "AuthenticationPackageName": "NTLM",
+        "SourceImage": "testsource",
+        "TargetImage": "testtarget"
+      }
+    },
+    "@timestamp": "2024-05-08T08:40:18.252Z",
+    "host": {
+      "name": "testing.lme.local"
+    },
+    "event": {
+      "code": "8",
+      "provider": "Microsoft-Windows-Sysmon",
+      "action": "Logon",
+      "outcome": "failure"
+    }
+  }

testing/tests/api_tests/data_insertion_tests/queries/filter_createRemoteThreads.json

@@ -0,0 +1,93 @@
+{
+    "aggs": {
+      "2": {
+        "terms": {
+          "field": "winlog.event_data.SourceImage",
+          "order": {
+            "_count": "desc"
+          },
+          "size": 100
+        }
+      }
+    },
+    "size": 100,
+    "runtime_mappings": {
+      "day_of_week": {
+        "type": "long",
+        "script": {
+          "source": "emit(doc['@timestamp'].value.dayOfWeekEnum.getValue())"
+        }
+      },
+      "hour_of_day": {
+        "type": "long",
+        "script": {
+          "source": "emit (doc['@timestamp'].value.getHour())"
+        }
+      }
+    },
+    "_source": false,
+    "query": {
+      "bool": {
+        "must": [],
+        "filter": [
+          {
+            "bool": {
+              "filter": [
+                {
+                  "bool": {
+                    "should": [
+                      {
+                        "term": {
+                          "event.code": {
+                            "value": "8"
+                          }
+                        }
+                      }
+                    ],
+                    "minimum_should_match": 1
+                  }
+                },
+                {
+                  "bool": {
+                    "should": [
+                      {
+                        "term": {
+                          "event.provider": {
+                            "value": "Microsoft-Windows-Sysmon"
+                          }
+                        }
+                      }
+                    ],
+                    "minimum_should_match": 1
+                  }
+                }
+              ]
+            }
+          },
+          {
+            "range": {
+              "@timestamp": {
+                "format": "strict_date_optional_time",
+                "gte": "2009-08-14T14:46:35.172Z",
+                "lte": "2024-08-14T14:46:35.172Z"
+              }
+            }
+          }
+        ],
+        "should": [],
+        "must_not": []
+      }
+    },
+    "highlight": {
+      "pre_tags": [
+        "@kibana-highlighted-field@"
+      ],
+      "post_tags": [
+        "@/kibana-highlighted-field@"
+      ],
+      "fields": {
+        "*": {}
+      },
+      "fragment_size": 2147483647
+    }
+  }

testing/tests/api_tests/data_insertion_tests/test_server.py

@@ -67,4 +67,11 @@ def test_file_suspicious_powershell(es_host, es_port, username, password):
     # Check to make sure the data was inserted
     assert(second_response_loaded['aggregations']['2']['buckets'][0]['key'] == 'powershell.exe')    
 
+def test_createRemoteThread(es_host, es_port, username, password):
+
+    second_response_loaded=insert_winlog_data(es_host, es_port, username, password, 'filter_createRemoteThreads.json', 'createRemoteThreads.json', 1)
+
+    # Check to make sure the data was inserted
+    assert 1==1
+    assert(second_response_loaded['aggregations']['2']['buckets'][0]['key'] == 'testsource')    
 

testing/tests/selenium_tests/cluster/test_computer_software_overview_dashboard.py

@@ -22,10 +22,10 @@ def test_application_crashing_and_hanging_count(self, setup_login, kibana_url, t
         driver = setup_login
         dashboard_test_function(driver, kibana_url, timeout, self.dashboard_id, "Application Crashing and Hanging Count", ".tbvChart",".visError")
 
-    @pytest.mark.skip(reason="Skipping this test")
+    #@pytest.mark.skip(reason="Skipping this test")
     def test_create_remote_threat_events(self, setup_login, kibana_url, timeout):
         driver = setup_login
-        dashboard_test_function(driver, kibana_url, timeout, self.dashboard_id, "CreateRemoteThread events", ".tbvChart",".visError")
+        dashboard_test_function(driver, kibana_url, timeout, self.dashboard_id, "CreateRemoteThread events", ".euiDataGrid",".visError")
 
     def test_filter_hosts(self, setup_login, kibana_url, timeout):
         driver = setup_login