Sergey Polzunov
1fb60d6475
* first pass * Adding a dedicated code checking workflow * Type fixes * linting config and python version bump * Type hints * Drop incorrect config option * More fixes * Style fixes * CI adjustments * Pyproject fixes * CI & pyproject fixes * Proper version bump * Tests formatting * Resolve cirtular dependency * Test fixes * Make sure the tests are formatted correctly * Check tweaks * Bumping python version in CI images * Pin marshmallow do 3.x because 4.x is not supported * License fix * Convert path to str * Making myself a codeowner * Missing kwargs param * Adding a missing kwargs to `set_score` * Update .github/CODEOWNERS Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> * Dropping unnecessary raise * Dropping skipped test * Drop unnecessary var * Drop unused commented-out func * Disable typehinting for the whole func * Update linting command * Invalid type hist on the input param * Incorrect field type * Incorrect value used fix * Stricter values check * Simpler function call * Type condition fix * TOML formatter fix * Simpligy output conditions * Formatting * Use proper types instead of aliases * MITRE attack fixes * Using pathlib.Path for an argument * Use proper method to update a set from a dict * First round of `ruff` fixes * More fixes * More fixes * Hack against cyclic dependency * Ignore `PLC0415` * Remove unused markers * Cleanup * Fixing the incorrect condition * Update .github/CODEOWNERS Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> * Set explicit default values for optional fields * Update the guidelines * Adding None Defaults --------- Co-authored-by: Mika Ayenson, PhD <Mikaayenson@users.noreply.github.com> Co-authored-by: eric-forte-elastic <eric.forte@elastic.co>
67 lines
2.6 KiB
Python
67 lines
2.6 KiB
Python
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
|
# or more contributor license agreements. Licensed under the Elastic License
|
|
# 2.0; you may not use this file except in compliance with the Elastic License
|
|
# 2.0.
|
|
|
|
from detection_rules.rule_loader import RuleCollection
|
|
|
|
from .base import BaseRuleTest
|
|
|
|
|
|
class TestEQLInSet(BaseRuleTest):
|
|
"""Test EQL rule query in set override."""
|
|
|
|
def test_eql_in_set(self):
|
|
"""Test that the query validation is working correctly."""
|
|
rc = RuleCollection()
|
|
eql_rule = {
|
|
"metadata": {
|
|
"creation_date": "2020/12/15",
|
|
"integration": ["endpoint", "windows"],
|
|
"maturity": "production",
|
|
"min_stack_comments": "New fields added: required_fields, related_integrations, setup",
|
|
"min_stack_version": "8.3.0",
|
|
"updated_date": "2024/03/26",
|
|
},
|
|
"rule": {
|
|
"author": ["Elastic"],
|
|
"description": """
|
|
Test Rule.
|
|
""",
|
|
"false_positives": ["Fake."],
|
|
"from": "now-9m",
|
|
"index": ["winlogbeat-*", "logs-endpoint.events.*", "logs-windows.sysmon_operational-*"],
|
|
"language": "eql",
|
|
"license": "Elastic License v2",
|
|
"name": "Fake Test Rule",
|
|
"references": [
|
|
"https://example.com",
|
|
],
|
|
"risk_score": 47,
|
|
"rule_id": "4fffae5d-8b7d-4e48-88b1-979ed42fd9a3",
|
|
"severity": "medium",
|
|
"tags": [
|
|
"Domain: Endpoint",
|
|
"OS: Windows",
|
|
"Use Case: Threat Detection",
|
|
"Tactic: Execution",
|
|
"Data Source: Elastic Defend",
|
|
"Data Source: Sysmon",
|
|
],
|
|
"type": "eql",
|
|
"query": """
|
|
sequence by host.id, process.entity_id with maxspan = 5s
|
|
[network where destination.ip in ("127.0.0.1", "::1")]
|
|
""",
|
|
},
|
|
}
|
|
expected_error_message = r"Error in both stack and integrations checks"
|
|
with self.assertRaisesRegex(ValueError, expected_error_message):
|
|
rc.load_dict(eql_rule)
|
|
# Change to appropriate destination.address field
|
|
eql_rule["rule"]["query"] = """
|
|
sequence by host.id, process.entity_id with maxspan = 10s
|
|
[network where destination.address in ("192.168.1.1", "::1")]
|
|
"""
|
|
rc.load_dict(eql_rule)
|