Takes into consideration any string value for "to".

elastic · Jan 29, 2020 · 6171df3 · 6171df3
1 parent 8d4e4c7
commit 6171df3
Show file tree

Hide file tree

Showing 2 changed files with 28 additions and 28 deletions.
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/utils.test.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/utils.test.ts
@@ -90,37 +90,33 @@ describe('utils', () => {
       expect(drift?.asMilliseconds()).toEqual(moment.duration(1, 'minute').asMilliseconds());
     });
 
-    xtest('returns a drift tolerance of 4 minutes when "to" is "now-x" and interval is 1 minute', () => {
+    test('returns a drift tolerance of 4 minutes when "to" is "now-x" and interval is 5 minute', () => {
       const drift = getDriftTolerance({
-        from: 'now-6m',
+        from: 'now-10m',
         to: 'now-1m',
         interval: moment.duration(5, 'minutes'),
-        now: nowDate.clone(),
       });
       expect(drift).not.toBeNull();
-      expect(drift?.asMilliseconds()).toEqual(0);
+      expect(drift?.asMilliseconds()).toEqual(moment.duration(4, 'minutes').asMilliseconds());
     });
 
     test('it returns expected drift tolerance when "from" is an ISO string', () => {
-      const now = moment().toISOString();
       const drift = getDriftTolerance({
-        from: moment(now)
+        from: moment()
           .subtract(10, 'minutes')
           .toISOString(),
         to: 'now',
         interval: moment.duration(5, 'minutes'),
-        now: moment(now),
       });
       expect(drift).not.toBeNull();
-      expect(drift?.asMilliseconds()).toEqual(moment.duration(5, 'm').asMilliseconds());
+      expect(drift?.asMilliseconds()).toEqual(moment.duration(5, 'minutes').asMilliseconds());
     });
 
-    xtest('it returns expected drift tolerance when "to" is an ISO string', () => {
+    test('it returns expected drift tolerance when "to" is an ISO string', () => {
       const drift = getDriftTolerance({
         from: 'now-6m',
         to: moment().toISOString(),
         interval: moment.duration(5, 'minutes'),
-        now: nowDate.clone(),
       });
       expect(drift).not.toBeNull();
       expect(drift?.asMilliseconds()).toEqual(moment.duration(1, 'minute').asMilliseconds());
@@ -264,15 +260,16 @@ describe('utils', () => {
       expect(gap?.asMilliseconds()).toEqual(moment.duration(1, 'minute').asMilliseconds());
     });
 
-    xtest('it returns null if to is an invalid string such as "invalid"', () => {
+    test('it returns the expected result when "to" is an invalid string such as "invalid"', () => {
       const gap = getGapBetweenRuns({
-        previousStartedAt: nowDate.clone(),
+        previousStartedAt: nowDate.clone().subtract(7, 'minutes'),
         interval: '5m',
-        from: 'now-5m',
-        to: 'invalid', // if not set to "now" this function returns null
+        from: 'now-6m',
+        to: 'invalid',
         now: nowDate.clone(),
       });
-      expect(gap).toBeNull();
+      expect(gap?.asMilliseconds()).not.toBeNull();
+      expect(gap?.asMilliseconds()).toEqual(moment.duration(1, 'minute').asMilliseconds());
     });
   });
 });
diff --git a/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/utils.ts b/x-pack/legacy/plugins/siem/server/lib/detection_engine/signals/utils.ts
@@ -27,6 +27,18 @@ export const parseInterval = (intervalString: string): moment.Duration | null =>
   }
 };
 
+export const parseScheduleDates = (time: string): moment.Moment | null => {
+  const isValidDateString = !isNaN(Date.parse(time));
+  const isValidInput = isValidDateString || time.trim().startsWith('now');
+  const formattedDate = isValidDateString
+    ? moment(time)
+    : isValidInput
+    ? dateMath.parse(time)
+    : null;
+
+  return formattedDate || null;
+};
+
 export const getDriftTolerance = ({
   from,
   to,
@@ -38,19 +50,10 @@ export const getDriftTolerance = ({
   interval: moment.Duration;
   now?: moment.Moment;
 }): moment.Duration | null => {
-  if (to.trim() !== 'now') {
-    // TODO: use Elastic date math
-    return null;
-  }
-  let duration: moment.Duration | null;
-  if (!from.trim().startsWith('now-')) {
-    const isStringDate = !isNaN(Date.parse(from));
-    const date = (isStringDate && dateMath.parse(from)) || from;
-    duration = (isStringDate && moment.duration(now.diff(date))) || parseInterval('6m');
-  } else {
-    const split = from.split('-');
-    duration = parseInterval(split[1]);
-  }
+  const toDate = parseScheduleDates(to) ?? now;
+  const fromDate = parseScheduleDates(from) ?? dateMath.parse('now-6m');
+  const timeSegment = toDate.diff(fromDate);
+  const duration = moment.duration(timeSegment);
 
   if (duration !== null) {
     return duration.subtract(interval);