Skip to content

Commit

Permalink
doc: Add test_fim documentation in QA Docs style
Browse files Browse the repository at this point in the history
Update documentation with the last changes.
PEP-8 fixes.

Closes: #1810
  • Loading branch information
mdengra committed Oct 25, 2021
1 parent fdd778b commit 2f8caa8
Show file tree
Hide file tree
Showing 33 changed files with 203 additions and 203 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -279,7 +279,7 @@ def test_ambiguous_complex(tags_to_apply,
FIM settings for each subdirectory and finally verifies that
these have been applied correctly.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- tags_to_apply:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -204,7 +204,7 @@ def test_ambiguous_restrict(folders, tags_to_apply, get_configuration, configure
For this purpose, the two previous paths are monitored, and modifications are made to the files
to check if alerts are generated when required.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- folders:
Expand Down Expand Up @@ -269,7 +269,7 @@ def test_ambiguous_report(folders, tags_to_apply, get_configuration, configure_e
and modifications are made to the files to check if the 'content_changes' field
is generated in the events when required.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- folders:
Expand Down Expand Up @@ -361,7 +361,7 @@ def test_ambiguous_tags(folders, tags_to_apply, get_configuration, configure_env
and modifications are made to the files to check if the 'tags' field is generated
in the events when required.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- folders:
Expand Down Expand Up @@ -429,7 +429,7 @@ def test_ambiguous_recursion(dirname, recursion_level, tags_to_apply, get_config
For this purpose, a testing folder with several levels of subdirectories is monitored,
and modifications are made in each level to see if events are generated when required.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- dirname:
Expand Down Expand Up @@ -504,7 +504,7 @@ def test_ambiguous_recursion_tag(dirnames, recursion_level, triggers_event, tags
Once the events have been generated, they are checked to see whether or not they
should include the 'tag' field.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- dirnames:
Expand Down Expand Up @@ -580,7 +580,7 @@ def test_ambiguous_check(dirname, checkers, tags_to_apply, get_configuration, co
to generate events. Finally, verification is performed to ensure that the events contain only
the fields of the 'checks' specified for the monitored folder.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- dirname:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -127,7 +127,7 @@ def test_ambiguous_whodata_thread(whodata_enabled, tags_to_apply, get_configurat
values ('yes' and 'no'). For this purpose, the configuration is applied and it checks
that the last value detected for 'whodata' in the 'ossec.conf' file is the one used.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- whodata_enabled:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -180,7 +180,7 @@ def test_duplicate_entries(get_configuration, configure_environment, restart_sys
For this purpose, it applies the test case configuration, adds a test file in the directory,
and finally checks that only one FIM event has been generated.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- get_configuration:
Expand Down Expand Up @@ -247,7 +247,7 @@ def test_duplicate_entries_sregex(get_configuration, configure_environment,
the directory, checks that only one FIM event has been generated for each operation, and finally
verifies that only one FIM event has been generated for each operation.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- get_configuration:
Expand Down Expand Up @@ -318,7 +318,7 @@ def test_duplicate_entries_report(get_configuration, configure_environment, rest
in the directory, checks that FIM event has been generated for each operation,
and finally verifies that a 'diff' file has not been created.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- get_configuration:
Expand Down Expand Up @@ -391,7 +391,7 @@ def test_duplicate_entries_complex(get_configuration, configure_environment, res
modifying the size or permissions of the test file, and finally verify that
the 'size' and 'permissions' fields have been generated in that event.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- get_configuration:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -132,7 +132,7 @@ def test_ignore_works_over_restrict(folder, filename, triggers_event, tags_to_ap
For this purpose, the test case configuration is applied, and it is checked if FIM events
are generated when required.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- folder:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@ def test_whodata_prevails_over_realtime(directory, get_configuration, put_env_va
'who-data' is set to 'yes', the 'realtime' value is not taken into account,
enabling in this case the real-time file monitoring.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- directory:
Expand Down
14 changes: 7 additions & 7 deletions tests/integration/test_fim/test_files/test_audit/test_audit.py
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@ def test_audit_health_check(tags_to_apply, get_configuration,
'who-data' and it will check that the health check passed
verifying that the proper FIM event is generated.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- tags_to_apply:
Expand Down Expand Up @@ -165,7 +165,7 @@ def test_added_rules(tags_to_apply, get_configuration,
Once FIM starts, the test will check if the a rule for every monitored
directory is added verifying that the proper FIM event is generated.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- tags_to_apply:
Expand Down Expand Up @@ -223,7 +223,7 @@ def test_readded_rules(tags_to_apply, get_configuration,
will check that the 'audit' rule is added again verifying that
the proper FIM event is generated.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- tags_to_apply:
Expand Down Expand Up @@ -287,7 +287,7 @@ def test_readded_rules_on_restart(tags_to_apply, get_configuration,
After 'auditd' is running, the test will wait for the FIM 'connect' and
'load rule' events to be generated.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- tags_to_apply:
Expand Down Expand Up @@ -356,7 +356,7 @@ def test_move_rules_realtime(tags_to_apply, get_configuration,
Then it will wait until the monitored directories using 'whodata' are monitored with
'realtime', verifying that the proper FIM events are generated.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- tags_to_apply:
Expand Down Expand Up @@ -421,7 +421,7 @@ def test_audit_key(audit_key, path, get_configuration, configure_environment, re
will manually add a rule for a monitored path using a custom 'audit' key. After FIM starts,
the test will check that the events that are generated with the custom key are processed.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- audit_key:
Expand Down Expand Up @@ -492,7 +492,7 @@ def test_restart_audit(tags_to_apply, should_restart, get_configuration, configu
by the 'auditd' daemon and monitoring the 'auditd' process to see if it restart and
and finally, it checks if the deleted plugin is created again.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- tags_to_apply:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@ def test_remove_and_read_folder(tags_to_apply, folder, get_configuration,
the folder and checks if the 'audit' rule associated to that folder has been removed.
Finally, it creates again the same folder and checks that the 'audit' rule is added.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- tags_to_apply:
Expand Down Expand Up @@ -183,7 +183,7 @@ def test_reconnect_to_audit(tags_to_apply, get_configuration, configure_environm
after restarting. For this purpose, restart the 'auditd' daemon and check that
the connection closing and opening events are generated.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- tags_to_apply:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -136,7 +136,7 @@ def test_audit_no_dir(tags_to_apply, get_configuration, configure_environment, r
thread is up, the audit rules are reloaded every 30 seconds (not configurable),
so when the directory is created, it starts to be monitored.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- tags_to_apply:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -147,7 +147,7 @@ def test_move_folders_to_realtime(tags_to_apply, get_configuration, uninstall_in
are monitored with 'realtime' verifying that the proper FIM events are generated.
Finally, the test will install the 'auditd' package again.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- tags_to_apply:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@ def test_remove_rule_five_times(tags_to_apply, folder, audit_key,
directory using 'whodata' is monitored with 'realtime' verifying that
the proper FIM events are generated.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- tags_to_apply:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -133,13 +133,13 @@ def extra_configuration_before_yield():

def test_wait_until_baseline(get_configuration, configure_environment, restart_syscheckd):
'''
description: Check if `FIM` events are appearing after the `baseline`. The log message
`File integrity monitoring scan ended` informs about the end of the first scan,
which generates the `baseline`. For this purpose, the test creates a test file
description: Check if FIM events are appearing after the 'baseline'. The log message
'File integrity monitoring scan ended' informs about the end of the first scan,
which generates the 'baseline'. For this purpose, the test creates a test file
while the initial scan is being performed. When the baseline has been generated
it checks if the `FIM` addition event has been triggered.
it checks if the FIM addition event has been triggered.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- get_configuration:
Expand All @@ -150,13 +150,13 @@ def test_wait_until_baseline(get_configuration, configure_environment, restart_s
brief: Configure a custom environment for testing.
- restart_syscheckd:
type: fixture
brief: Clear the `ossec.log` file and start a new monitor.
brief: Clear the 'ossec.log' file and start a new monitor.
assertions:
- Verify that a `FIM` addition event was generated during the initial scan.
- Verify that a FIM addition event was generated during the initial scan.
input_description: A test case (ossec_conf) is contained in external `YAML` file (wazuh_conf.yaml)
which includes configuration settings for the `wazuh-syscheckd` daemon and, it
input_description: A test case (ossec_conf) is contained in external YAML file (wazuh_conf.yaml)
which includes configuration settings for the 'wazuh-syscheckd' daemon and, it
is combined with the testing directories to be monitored defined in this module.
expected_output:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -144,12 +144,12 @@ def test_regular_file_changes(folder, name, encoding, checkers, tags_to_apply,
get_configuration, configure_environment,
restart_syscheckd, wait_for_fim_start):
'''
description: Check if the `wazuh-syscheckd` daemon detects regular file changes (add, modify, delete).
description: Check if the 'wazuh-syscheckd' daemon detects regular file changes (add, modify, delete).
For this purpose, the test uses different character encodings in the names of the testing
directories and files and performs operations on them. Finally, it verifies that
the `FIM` events have been generated properly.
the FIM events have been generated properly.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- folder:
Expand All @@ -175,22 +175,22 @@ def test_regular_file_changes(folder, name, encoding, checkers, tags_to_apply,
brief: Configure a custom environment for testing.
- restart_syscheckd:
type: fixture
brief: Clear the `ossec.log` file and start a new monitor.
brief: Clear the 'ossec.log' file and start a new monitor.
- wait_for_fim_start:
type: fixture
brief: Wait for realtime start, whodata start, or end of initial FIM scan.
assertions:
- Verify that all `FIM` events are generated for the operations performed,
and these contain all `check_` fields specified in the configuration.
- Verify that all FIM events are generated for the operations performed,
and these contain all 'check_' fields specified in the configuration.
input_description: A test case (ossec_conf) is contained in external `YAML` file (wazuh_conf.yaml)
which includes configuration settings for the `wazuh-syscheckd` daemon and, it
input_description: A test case (ossec_conf) is contained in external YAML file (wazuh_conf.yaml)
which includes configuration settings for the 'wazuh-syscheckd' daemon and, it
is combined with the testing directories to be monitored defined in this module.
expected_output:
- r'.*Sending FIM event: (.+)$' (Initial scan when restarting Wazuh)
- Multiple `FIM` events logs of the monitored directories.
- Multiple FIM events logs of the monitored directories.
tags:
- scheduled
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -121,13 +121,13 @@ def get_configuration(request):
def test_create_after_delete(tags_to_apply, get_configuration, configure_environment, restart_syscheckd,
wait_for_fim_start):
'''
description: Check if a monitored directory keeps reporting `FIM` events after deleting and creating it again.
description: Check if a monitored directory keeps reporting FIM events after deleting and creating it again.
Under Windows systems, it verifies that the directory watcher is refreshed (checks the SACLs)
after directory re-creation one second after. For this purpose, the test creates the testing
directory to be monitored, checks that `FIM` events are generated, and then deletes it.
directory to be monitored, checks that FIM events are generated, and then deletes it.
Finally, it creates the directory again and verifies that the events are still generated correctly.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- tags_to_apply:
Expand All @@ -141,22 +141,22 @@ def test_create_after_delete(tags_to_apply, get_configuration, configure_environ
brief: Configure a custom environment for testing.
- restart_syscheckd:
type: fixture
brief: Clear the `ossec.log` file and start a new monitor.
brief: Clear the 'ossec.log' file and start a new monitor.
- wait_for_fim_start:
type: fixture
brief: Wait for realtime start, whodata start, or end of initial FIM scan.
assertions:
- Verify that `FIM` events are still generated when a monitored directory is deleted and created again.
- Verify that FIM events are still generated when a monitored directory is deleted and created again.
input_description: A test case (ossec_conf) is contained in external `YAML` file
input_description: A test case (ossec_conf) is contained in external YAML file
(wazuh_conf.yaml or wazuh_conf_win32.yaml) which includes configuration
settings for the `wazuh-syscheckd` daemon and, it is combined with
settings for the 'wazuh-syscheckd' daemon and, it is combined with
the testing directories to be monitored defined in this module.
expected_output:
- r'.*Sending FIM event: (.+)$' (Initial scan when restarting Wazuh)
- Multiple `FIM` events logs of the monitored directories.
- Multiple FIM events logs of the monitored directories.
tags:
- realtime
Expand Down
Loading

0 comments on commit 2f8caa8

Please sign in to comment.