(t *testing.T)
| 29 | ) |
| 30 | |
| 31 | func TestLoadRulesFromPaths(t *testing.T) { |
| 32 | filters := Filters{ |
| 33 | Rules{ |
| 34 | FromPaths: []string{ |
| 35 | "_fixtures/filters/default.yml", |
| 36 | "_fixtures/filters/default1.yml", |
| 37 | }, |
| 38 | }, |
| 39 | Macros{FromPaths: nil}, |
| 40 | false, |
| 41 | map[string]*Macro{}, |
| 42 | []*FilterConfig{}, |
| 43 | } |
| 44 | err := filters.LoadFilters() |
| 45 | require.NoError(t, err) |
| 46 | require.Len(t, filters.filters, 2) |
| 47 | |
| 48 | f1 := filters.filters[0] |
| 49 | assert.Equal(t, "only network category", f1.Name) |
| 50 | assert.Equal(t, "313933e7-8eb9-45d9-81af-0305fee70e29", f1.ID) |
| 51 | assert.Equal(t, "1.0.0", f1.Version) |
| 52 | assert.True(t, *f1.Enabled) |
| 53 | assert.Contains(t, f1.Tags, "TE") |
| 54 | assert.Equal(t, "evt.category = 'net'", f1.Condition) |
| 55 | assert.Equal(t, "this rule matches all network signals", f1.Description) |
| 56 | assert.Equal(t, "low", f1.Severity) |
| 57 | assert.Equal(t, "`%ps.exe` attempted to reach out to `%net.sip` IP address\n", f1.Output) |
| 58 | assert.NotNil(t, f1.Action) |
| 59 | assert.Contains(t, f1.References, "ref2") |
| 60 | assert.NotEmpty(t, f1.Notes) |
| 61 | assert.Len(t, f1.Authors, 2) |
| 62 | |
| 63 | acts, err := f1.DecodeActions() |
| 64 | require.NoError(t, err) |
| 65 | require.IsType(t, KillAction{}, acts[0]) |
| 66 | require.IsType(t, IsolateAction{}, acts[1]) |
| 67 | |
| 68 | isolate := acts[1].(IsolateAction) |
| 69 | require.Len(t, isolate.Whitelist, 2) |
| 70 | require.Contains(t, isolate.Whitelist, net.ParseIP("127.0.0.1")) |
| 71 | |
| 72 | assert.Equal(t, "2.0.0", f1.MinEngineVersion) |
| 73 | |
| 74 | f2 := filters.filters[1] |
| 75 | assert.False(t, f2.IsDisabled()) |
| 76 | assert.Equal(t, "suspicious network ACTIVITY", f2.Name) |
| 77 | assert.Equal(t, "evt.category = 'net' and ps.name in ('at.exe', 'java.exe')", f2.Condition) |
| 78 | } |
| 79 | |
| 80 | func TestLoadRulesFromPathsWithTemplate(t *testing.T) { |
| 81 | filters := Filters{ |
nothing calls this directly
no test coverage detected