From b2d9ffcc5c780f9d7c9012a162c4426a1484e6a2 Mon Sep 17 00:00:00 2001
From: Bohdan Tsymbala <bohdan.tsymbala@elastic.co>
Date: Mon, 23 Nov 2020 15:26:44 +0100
Subject: [PATCH] Added test for lowercasing hash value.

---
 .../routes/trusted_apps/mapping.test.ts       | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.test.ts b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.test.ts
index 0a63ac042a6e6..ea7fd09b0888f 100644
--- a/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.test.ts
+++ b/x-pack/plugins/security_solution/server/endpoint/routes/trusted_apps/mapping.test.ts
@@ -206,6 +206,25 @@ describe('mapping', () => {
         })
       );
     });
+
+    it('should lowercase hash condition value', function () {
+      testMapping(
+        {
+          name: 'MD5 trusted app',
+          description: 'MD5 Trusted App',
+          os: 'linux',
+          entries: [
+            createConditionEntry(ConditionEntryField.HASH, '1234234659Af249ddf3e40864E9FB241'),
+          ],
+        },
+        createExceptionListItemOptions({
+          name: 'MD5 trusted app',
+          description: 'MD5 Trusted App',
+          osTypes: ['linux'],
+          entries: [createEntryMatch('process.hash.md5', '1234234659af249ddf3e40864e9fb241')],
+        })
+      );
+    });
   });
 
   describe('exceptionListItemToTrustedApp', () => {