Function BenchmarkRunRules

pkg/rules/engine_test.go:513–580

(b *testing.B)

}

func BenchmarkRunRules(b *testing.B) {
	b.ReportAllocs()
	e := NewEngine(new(ps.SnapshotterMock), newConfig("_fixtures/default/*.yml"))
	rs, err := e.Compile()
	require.NoError(b, err)
	require.NotNil(b, rs)

	b.ResetTimer()

	evts := []*event.Event{
		{
			Type:     event.ConnectTCPv4,
			Name:     "Recv",
			Tid:      2484,
			PID:      859,
			Category: event.Net,
			PS: &types.PS{
				Name: "cmd.exe",
			},
			Params: event.Params{
				params.NetDport: {Name: params.NetDport, Type: params.Uint16, Value: uint16(443)},
				params.NetSport: {Name: params.NetSport, Type: params.Uint16, Value: uint16(43123)},
				params.NetSIP:   {Name: params.NetSIP, Type: params.IPv4, Value: net.ParseIP("127.0.0.1")},
				params.NetDIP:   {Name: params.NetDIP, Type: params.IPv4, Value: net.ParseIP("216.58.201.174")},
			},
			Metadata: make(map[event.MetadataKey]any),
		},
		{
			Type:     event.CreateProcess,
			Name:     "CreateProcess",
			Category: event.Process,
			Tid:      2484,
			PID:      859,
			PS: &types.PS{
				Name: "powershell.exe",
			},
			Params: event.Params{
				params.ProcessID:       {Name: params.ProcessID, Type: params.PID, Value: 2323},
				params.ProcessParentID: {Name: params.ProcessParentID, Type: params.PID, Value: uint32(8390)},
				params.ProcessName:     {Name: params.ProcessName, Type: params.UnicodeString, Value: "spotify.exe"},
				params.Cmdline:         {Name: params.Cmdline, Type: params.UnicodeString, Value: `C:\Users\admin\AppData\Roaming\Spotify\Spotify.exe --type=crashpad-handler /prefetch:7 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--metrics-dir=C:\Users\admin\AppData\Local\Spotify\User Data" --url=https://crashdump.spotify.com:443/ --annotation=platform=win32 --annotation=product=spotify --annotation=version=1.1.4.197 --initial-client-data=0x5a4,0x5a0,0x5a8,0x59c,0x5ac,0x6edcbf60,0x6edcbf70,0x6edcbf7c`},
				params.Exe:             {Name: params.Exe, Type: params.UnicodeString, Value: `C:\Users\admin\AppData\Roaming\Spotify\Spotify.exe`},
				params.UserSID:         {Name: params.UserSID, Type: params.UnicodeString, Value: `admin\SYSTEM`},
			},
			Metadata: make(map[event.MetadataKey]any),
		},
		{
			Type:     event.CreateHandle,
			Name:     "CreateHandle",
			Category: event.Handle,
			Tid:      2484,
			PID:      859,
			PS: &types.PS{
				Name: "powershell.exe",
			},
			Params: event.Params{
				params.ProcessID: {Name: params.ProcessID, Type: params.PID, Value: 2323},
			},