diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/endpoint_task.test.ts b/x-pack/plugins/security_solution/server/lib/telemetry/endpoint_task.test.ts index 48c996d1e9eff4..7366c94ce1c571 100644 --- a/x-pack/plugins/security_solution/server/lib/telemetry/endpoint_task.test.ts +++ b/x-pack/plugins/security_solution/server/lib/telemetry/endpoint_task.test.ts @@ -74,6 +74,33 @@ describe('test', () => { .createTaskRunner; const taskRunner = createTaskRunner({ taskInstance: mockTaskInstance }); await taskRunner.run(); - expect(mockSender.fetchDiagnosticAlerts).not.toHaveBeenCalled(); + expect(mockSender.fetchEndpointMetrics).not.toHaveBeenCalled(); + expect(mockSender.fetchEndpointPolicyResponses).not.toHaveBeenCalled(); + }); + + test('endpoint task should run when opted in', async () => { + const mockSender = createMockTelemetryEventsSender(true); + const mockTaskManager = taskManagerMock.createSetup(); + const telemetryEpMetaTask = new MockTelemetryEndpointTask(logger, mockTaskManager, mockSender); + + const mockTaskInstance = { + id: TelemetryEndpointTaskConstants.TYPE, + runAt: new Date(), + attempts: 0, + ownerId: '', + status: TaskStatus.Running, + startedAt: new Date(), + scheduledAt: new Date(), + retryAt: new Date(), + params: {}, + state: {}, + taskType: TelemetryEndpointTaskConstants.TYPE, + }; + const createTaskRunner = + mockTaskManager.registerTaskDefinitions.mock.calls[0][0][TelemetryEndpointTaskConstants.TYPE] + .createTaskRunner; + const taskRunner = createTaskRunner({ taskInstance: mockTaskInstance }); + await taskRunner.run(); + expect(telemetryEpMetaTask.runTask).toHaveBeenCalled(); }); }); diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/endpoint_task.ts b/x-pack/plugins/security_solution/server/lib/telemetry/endpoint_task.ts index 71a105d1e58f5c..13b4ebf0b3efb9 100644 --- a/x-pack/plugins/security_solution/server/lib/telemetry/endpoint_task.ts +++ b/x-pack/plugins/security_solution/server/lib/telemetry/endpoint_task.ts @@ -166,6 +166,11 @@ export class TelemetryEndpointTask { body: EndpointMetricsAggregation; }; + if (endpointMetricsResponse.aggregations === undefined) { + this.logger.debug(`no endpoint metrics to report`); + return 0; + } + const endpointMetrics = endpointMetricsResponse.aggregations.endpoint_agents.buckets.map( (epMetrics) => { return { @@ -188,8 +193,10 @@ export class TelemetryEndpointTask { */ const agentsResponse = endpointData.fleetAgentsResponse; if (agentsResponse === undefined) { + this.logger.debug('no fleet agent information available'); return 0; } + const fleetAgents = agentsResponse.agents.reduce((cache, agent) => { if (agent.id === DefaultEndpointPolicyIdToIgnore) { return cache; @@ -241,14 +248,18 @@ export class TelemetryEndpointTask { const { body: failedPolicyResponses } = (endpointData.epPolicyResponse as unknown) as { body: EndpointPolicyResponseAggregation; }; - const policyResponses = failedPolicyResponses.aggregations.policy_responses.buckets.reduce( - (cache, endpointAgentId) => { - const doc = endpointAgentId.latest_response.hits.hits[0]; - cache.set(endpointAgentId.key, doc); - return cache; - }, - new Map() - ); + + // If there is no policy responses in the 24h > now then we will continue + const policyResponses = failedPolicyResponses.aggregations + ? failedPolicyResponses.aggregations.policy_responses.buckets.reduce( + (cache, endpointAgentId) => { + const doc = endpointAgentId.latest_response.hits.hits[0]; + cache.set(endpointAgentId.key, doc); + return cache; + }, + new Map() + ) + : new Map(); /** STAGE 4 - Create the telemetry log records * @@ -267,7 +278,7 @@ export class TelemetryEndpointTask { const policyInformation = fleetAgents.get(fleetAgentId); if (policyInformation) { - policyConfig = endpointPolicyCache.get(policyInformation); + policyConfig = endpointPolicyCache.get(policyInformation) || null; if (policyConfig) { failedPolicy = policyResponses.get(policyConfig?.id); @@ -319,7 +330,7 @@ export class TelemetryEndpointTask { ); return telemetryPayloads.length; } catch (err) { - this.logger.error('Could not send endpoint alert telemetry'); + this.logger.warn('could not complete endpoint alert telemetry task'); return 0; } }; diff --git a/x-pack/plugins/security_solution/server/lib/telemetry/mocks.ts b/x-pack/plugins/security_solution/server/lib/telemetry/mocks.ts index f27d22287c9d7c..6e98dcd59e3ecb 100644 --- a/x-pack/plugins/security_solution/server/lib/telemetry/mocks.ts +++ b/x-pack/plugins/security_solution/server/lib/telemetry/mocks.ts @@ -22,6 +22,8 @@ export const createMockTelemetryEventsSender = ( start: jest.fn(), stop: jest.fn(), fetchDiagnosticAlerts: jest.fn(), + fetchEndpointMetrics: jest.fn(), + fetchEndpointPolicyResponses: jest.fn(), queueTelemetryEvents: jest.fn(), processEvents: jest.fn(), isTelemetryOptedIn: jest.fn().mockReturnValue(enableTelemtry ?? jest.fn()),