Function TestRunSequenceRule

pkg/rules/engine_test.go:183–271

(t *testing.T)

}

func TestRunSequenceRule(t *testing.T) {
	log.SetLevel(log.DebugLevel)

	e := NewEngine(new(ps.SnapshotterMock), newConfig("_fixtures/sequence_rule_complex.yml"))
	compileRules(t, e)

	e1 := &event.Event{
		Seq:       1,
		Type:      event.CreateProcess,
		Timestamp: time.Now(),
		Category:  event.Process,
		Name:      "CreateProcess",
		Tid:       2484,
		PID:       2243,
		PS: &types.PS{
			Name: "firefox.exe",
			Exe:  "C:\\Program Files\\Firefox\\firefox.exe",
		},
		Params: event.Params{
			params.ProcessID:   {Name: params.ProcessID, Type: params.PID, Value: uint32(2243)},
			params.ProcessName: {Name: params.ProcessName, Type: params.UnicodeString, Value: "firefox.exe"},
		},
		Metadata: map[event.MetadataKey]any{"foo": "bar", "fooz": "barzz"},
	}

	e2 := &event.Event{
		Seq:       2,
		Type:      event.CreateFile,
		Timestamp: time.Now().Add(time.Millisecond * 250),
		Name:      "CreateFile",
		Tid:       2484,
		PID:       2243,
		Category:  event.File,
		PS: &types.PS{
			Name:    "firefox.exe",
			Exe:     "C:\\Program Files\\Mozilla Firefox\\firefox.exe",
			Cmdline: "C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -contentproc --channel=\"10464.7.539748228\\1366525930\" -childID 6 -isF",
		},
		Params: event.Params{
			params.FilePath:      {Name: params.FilePath, Type: params.UnicodeString, Value: "C:\\Temp\\dropper.exe"},
			params.FileOperation: {Name: params.FileOperation, Type: params.Enum, Value: uint32(2), Enum: fs.FileCreateDispositions},
		},
		Metadata: map[event.MetadataKey]any{"foo": "bar", "fooz": "barzz"},
	}

	e3 := &event.Event{
		Seq:       4,
		Type:      event.ConnectTCPv4,
		Timestamp: time.Now().Add(time.Second),
		Category:  event.Net,
		Name:      "Connect",
		Tid:       244,
		PID:       2243,
		PS: &types.PS{
			Name:    "firefox.exe",
			Exe:     "C:\\Program Files\\Mozilla Firefox\\firefox.exe",
			Cmdline: "C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -contentproc --channel=\"10464.7.539748228\\1366525930\" -childID 6 -isF",
		},