eric-forte-elastic
6449cecd08
* added test bbr * initial implementation * Added Unit test and exempted bbr from integrations * fixed linting * Add schema validation to building block rules * add separate error messages * fixed linting * Add testing bbr validation * fixed linting * Add default values * fixed linting * added defaults * fixed linting * cleaned up test rule * removed .gitkeep * read .gitkeep * Switch to using validates_schema * addressing some linting * fixed linting * Update detection_rules/schemas/definitions.py Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * add env variable check * fix skip function * updated name * Update detection_rules/schemas/definitions.py Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Add bbr validation unit test * Clean up comments * fix linting * Move convert time to utils * Moved to rules_building_block * Add check for only bbr in bbr dir * fix linting * additional linting fix * Changed to bbr rule loader * fixed bbr default * Updated error messages and README * fixed more linting * Updating root level README * Fixed convert_time_span calls * fixed typo in unit test logic and updated txt * fixed error message * updated comment for clarity * Update detection_rules/rule.py Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Update detection_rules/rule.py Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> * Updated validation methods for clarity * fix doctring location * Fixed typo * updated error messages. * removed excess whitespace * Add per rule bypass * Add single rule bypass * Split unit tests * Update detection_rules/rule.py Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com> * Update detection_rules/rule.py Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com> --------- Co-authored-by: Justin Ibarra <16747370+brokensound77@users.noreply.github.com> Co-authored-by: Mika Ayenson <Mikaayenson@users.noreply.github.com>
76 lines
2.4 KiB
Python
76 lines
2.4 KiB
Python
# Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
|
|
# or more contributor license agreements. Licensed under the Elastic License
|
|
# 2.0; you may not use this file except in compliance with the Elastic License
|
|
# 2.0.
|
|
|
|
"""Shared resources for tests."""
|
|
|
|
import unittest
|
|
from functools import lru_cache
|
|
from typing import Union
|
|
|
|
from detection_rules.rule import TOMLRule
|
|
from detection_rules.rule_loader import DeprecatedCollection, DeprecatedRule, RuleCollection, production_filter
|
|
|
|
|
|
RULE_LOADER_FAIL = False
|
|
RULE_LOADER_FAIL_MSG = None
|
|
RULE_LOADER_FAIL_RAISED = False
|
|
|
|
|
|
@lru_cache
|
|
def default_rules() -> RuleCollection:
|
|
return RuleCollection.default()
|
|
|
|
|
|
@lru_cache
|
|
def default_bbr() -> RuleCollection:
|
|
return RuleCollection.default_bbr()
|
|
|
|
|
|
class BaseRuleTest(unittest.TestCase):
|
|
"""Base class for shared test cases which need to load rules"""
|
|
|
|
RULE_LOADER_FAIL = False
|
|
RULE_LOADER_FAIL_MSG = None
|
|
RULE_LOADER_FAIL_RAISED = False
|
|
|
|
@classmethod
|
|
def setUpClass(cls):
|
|
global RULE_LOADER_FAIL, RULE_LOADER_FAIL_MSG
|
|
|
|
# too noisy; refactor
|
|
# os.environ["DR_NOTIFY_INTEGRATION_UPDATE_AVAILABLE"] = "1"
|
|
|
|
if not RULE_LOADER_FAIL:
|
|
try:
|
|
rc = default_rules()
|
|
rc_bbr = default_bbr()
|
|
cls.all_rules = rc.rules
|
|
cls.rule_lookup = rc.id_map
|
|
cls.production_rules = rc.filter(production_filter)
|
|
cls.bbr = rc_bbr.rules
|
|
cls.deprecated_rules: DeprecatedCollection = rc.deprecated
|
|
except Exception as e:
|
|
RULE_LOADER_FAIL = True
|
|
RULE_LOADER_FAIL_MSG = str(e)
|
|
|
|
@staticmethod
|
|
def rule_str(rule: Union[DeprecatedRule, TOMLRule], trailer=' ->') -> str:
|
|
return f'{rule.id} - {rule.name}{trailer or ""}'
|
|
|
|
def setUp(self) -> None:
|
|
global RULE_LOADER_FAIL, RULE_LOADER_FAIL_MSG, RULE_LOADER_FAIL_RAISED
|
|
|
|
if RULE_LOADER_FAIL:
|
|
# limit the loader failure to just one run
|
|
# raise a dedicated test failure for the loader
|
|
if not RULE_LOADER_FAIL_RAISED:
|
|
RULE_LOADER_FAIL_RAISED = True
|
|
with self.subTest('Test that the rule loader loaded with no validation or other failures.'):
|
|
self.fail(f'Rule loader failure: \n{RULE_LOADER_FAIL_MSG}')
|
|
|
|
self.skipTest('Rule loader failure')
|
|
else:
|
|
super().setUp()
|