EQL: Update queries blacklist

Author: rw-access

x-pack/plugin/eql/qa/common/src/main/resources/test_queries_unsupported.toml

@@ -13,17 +13,6 @@
 ##########################
 # FAILING SEQUENCE TESTS #
 ##########################
-[[queries]]
-case_sensitive = true
-case_insensitive = true
-note = "Sequence: many-1 match."
-query = '''
-sequence
-  [process where serial_event_id < 5]
-  [process where serial_event_id = 5]
-'''
-expected_event_ids  = [4, 5]
-
 [[queries]]
 case_sensitive = true
 case_insensitive = true
@@ -209,6 +198,74 @@ sequence by user_name
 '''
 expected_event_ids  = [61, 62]
 
+[[queries]]
+case_sensitive = true
+case_insensitive = true
+query = '''
+sequence
+  [process where opcode == 1] by unique_pid
+  [file where opcode == 0]    by unique_pid
+  [file where opcode == 0]    by unique_pid
+  [file where opcode == 0]    by unique_pid
+'''
+expected_event_ids  = [54, 55, 61, 67]
+
+[[queries]]
+case_sensitive = true
+case_insensitive = true
+query = '''
+sequence
+  [process where opcode == 1] by unique_pid,  process_path
+  [file where opcode == 0]    by unique_pid,  process_path
+  [file where opcode == 0]    by unique_pid,  process_path
+  [file where opcode == 0]    by unique_pid,  process_path
+'''
+expected_event_ids  = [54, 55, 61, 67]
+
+[[queries]]
+case_sensitive = true
+case_insensitive = true
+query = '''
+sequence
+  [process where opcode == 1] by unique_pid
+  [file where opcode == 0]    by unique_pid
+  [file where opcode == 0]    by unique_pid
+  [file where opcode == 0]    by unique_pid
+until
+  [file where opcode == 2]    by unique_pid
+'''
+expected_event_ids  = []
+
+[[queries]]
+case_sensitive = true
+case_insensitive = true
+query = '''
+sequence
+  [process where opcode == 1] by unique_pid
+  [file where opcode == 0]    by unique_pid
+  [file where opcode == 0]    by unique_pid
+  [file where opcode == 0]    by unique_pid
+until
+  [file where opcode == 200]  by unique_pid
+'''
+expected_event_ids  = [54, 55, 61, 67]
+
+[[queries]]
+case_sensitive = true
+case_insensitive = true
+query = '''
+sequence
+  [process where opcode == 1] by unique_pid,  process_path
+  [file where opcode == 0]    by unique_pid,  process_path
+  [file where opcode == 0]    by unique_pid,  process_path
+  [file where opcode == 0]    by unique_pid,  process_path
+until
+  [file where opcode == 200]  by unique_pid,  process_path
+'''
+expected_event_ids  = [54, 55, 61, 67]
+
+
+
 #############################
 # NOT (YET) SUPPORTED TESTS #
 #############################
@@ -566,71 +623,6 @@ process where true
 | sort serial_event_id
 '''
 
-[[queries]]
-case_sensitive = true
-case_insensitive = true
-query = '''
-sequence
-  [process where opcode == 1] by unique_pid
-  [file where opcode == 0]    by unique_pid
-  [file where opcode == 0]    by unique_pid
-  [file where opcode == 0]    by unique_pid
-'''
-expected_event_ids  = [54, 55, 61, 67]
-
-[[queries]]
-case_sensitive = true
-case_insensitive = true
-query = '''
-sequence
-  [process where opcode == 1] by unique_pid,  process_path
-  [file where opcode == 0]    by unique_pid,  process_path
-  [file where opcode == 0]    by unique_pid,  process_path
-  [file where opcode == 0]    by unique_pid,  process_path
-'''
-expected_event_ids  = [54, 55, 61, 67]
-
-[[queries]]
-case_sensitive = true
-case_insensitive = true
-query = '''
-sequence
-  [process where opcode == 1] by unique_pid
-  [file where opcode == 0]    by unique_pid
-  [file where opcode == 0]    by unique_pid
-  [file where opcode == 0]    by unique_pid
-until
-  [file where opcode == 2]    by unique_pid
-'''
-expected_event_ids  = []
-
-[[queries]]
-case_sensitive = true
-case_insensitive = true
-query = '''
-sequence
-  [process where opcode == 1] by unique_pid
-  [file where opcode == 0]    by unique_pid
-  [file where opcode == 0]    by unique_pid
-  [file where opcode == 0]    by unique_pid
-until
-  [file where opcode == 200]  by unique_pid
-'''
-expected_event_ids  = [54, 55, 61, 67]
-
-[[queries]]
-case_sensitive = true
-case_insensitive = true
-query = '''
-sequence
-  [process where opcode == 1] by unique_pid,  process_path
-  [file where opcode == 0]    by unique_pid,  process_path
-  [file where opcode == 0]    by unique_pid,  process_path
-  [file where opcode == 0]    by unique_pid,  process_path
-until
-  [file where opcode == 200]  by unique_pid,  process_path
-'''
-
 
 [[queries]]
 case_sensitive = true