feat: add cloudwatch and inspector discard regex tests and cases

wazuh · Jul 17, 2023 · 57edfab · 57edfab
1 parent dea763a
commit 57edfab
Show file tree

Hide file tree

Showing 7 changed files with 485 additions and 14 deletions.
diff --git a/...ation_template/discard_regex_test_module/configuration_cloudwatch_discard_regex_json.yaml b/...ation_template/discard_regex_test_module/configuration_cloudwatch_discard_regex_json.yaml
@@ -0,0 +1,23 @@
+- sections:
+    - section: wodle
+      attributes:
+        - name: aws-s3
+      elements:
+        - disabled:
+            value: 'no'
+        - service:
+            attributes:
+              - type: SERVICE_TYPE
+            elements:
+              - aws_profile:
+                  value: qa
+              - aws_log_groups:
+                  value: LOG_GROUP_NAME
+              - only_logs_after:
+                  value: ONLY_LOGS_AFTER
+              - regions:
+                  value: REGIONS
+              - discard_regex:
+                  attributes:
+                    - field: DISCARD_FIELD
+                  value: DISCARD_REGEX
diff --git a/...emplate/discard_regex_test_module/configuration_cloudwatch_discard_regex_simple_text.yaml b/...emplate/discard_regex_test_module/configuration_cloudwatch_discard_regex_simple_text.yaml
@@ -0,0 +1,21 @@
+- sections:
+    - section: wodle
+      attributes:
+        - name: aws-s3
+      elements:
+        - disabled:
+            value: 'no'
+        - service:
+            attributes:
+              - type: SERVICE_TYPE
+            elements:
+              - aws_profile:
+                  value: qa
+              - aws_log_groups:
+                  value: LOG_GROUP_NAME
+              - only_logs_after:
+                  value: ONLY_LOGS_AFTER
+              - regions:
+                  value: REGIONS
+              - discard_regex:
+                  value: DISCARD_REGEX
diff --git a/...nfiguration_template/discard_regex_test_module/configuration_inspector_discard_regex.yaml b/...nfiguration_template/discard_regex_test_module/configuration_inspector_discard_regex.yaml
@@ -0,0 +1,21 @@
+- sections:
+    - section: wodle
+      attributes:
+        - name: aws-s3
+      elements:
+        - disabled:
+            value: 'no'
+        - service:
+            attributes:
+              - type: SERVICE_TYPE
+            elements:
+              - aws_profile:
+                  value: qa
+              - only_logs_after:
+                  value: ONLY_LOGS_AFTER
+              - regions:
+                  value: REGIONS
+              - discard_regex:
+                  attributes:
+                    - field: DISCARD_FIELD
+                  value: DISCARD_REGEX
diff --git a/...st_aws/data/test_cases/discard_regex_test_module/cases_cloudwatch_discard_regex_json.yaml b/...st_aws/data/test_cases/discard_regex_test_module/cases_cloudwatch_discard_regex_json.yaml
@@ -0,0 +1,17 @@
+- name: cloudwatch_discard_regex_json
+  description: CloudWatch discard regex configuration for JSON logs
+  configuration_parameters:
+    SERVICE_TYPE: cloudwatchlogs
+    LOG_GROUP_NAME: wazuh-cloudwatchlogs-integration-tests
+    REGIONS: us-east-1
+    DISCARD_FIELD: networkInterfaces.networkInterfaceId
+    DISCARD_REGEX: .*eni-networkInterfaceId*
+    ONLY_LOGS_AFTER: 2023-JUL-03
+  metadata:
+    service_type: cloudwatchlogs
+    log_group_name: wazuh-cloudwatchlogs-integration-tests
+    only_logs_after: 2023-JUL-03
+    discard_field: networkInterfaces.networkInterfaceId
+    discard_regex: .*eni-networkInterfaceId.*
+    regions: us-east-1
+    found_logs: 1
diff --git a/...data/test_cases/discard_regex_test_module/cases_cloudwatch_discard_regex_simple_text.yaml b/...data/test_cases/discard_regex_test_module/cases_cloudwatch_discard_regex_simple_text.yaml
@@ -0,0 +1,15 @@
+- name: cloudwatch_discard_regex_simple_text
+  description: CloudWatch discard regex configuration for simple text logs
+  configuration_parameters:
+    SERVICE_TYPE: cloudwatchlogs
+    LOG_GROUP_NAME: wazuh-cloudwatchlogs-integration-tests
+    REGIONS: us-east-1
+    DISCARD_REGEX: .*Test.*
+    ONLY_LOGS_AFTER: 2023-JAN-12
+  metadata:
+    service_type: cloudwatchlogs
+    log_group_name: wazuh-cloudwatchlogs-integration-tests
+    only_logs_after: 2023-JAN-12
+    discard_regex: .*Test.*
+    regions: us-east-1
+    found_logs: 3
diff --git a/...ion/test_aws/data/test_cases/discard_regex_test_module/cases_inspector_discard_regex.yaml b/...ion/test_aws/data/test_cases/discard_regex_test_module/cases_inspector_discard_regex.yaml
@@ -0,0 +1,15 @@
+- name: inspector_discard_regex
+  description: Inspector discard regex configurations
+  configuration_parameters:
+    SERVICE_TYPE: inspector
+    REGIONS: us-east-1
+    DISCARD_FIELD: assetAttributes.tags.value
+    DISCARD_REGEX: .*inspector-integration-test.*
+    ONLY_LOGS_AFTER: 2023-JAN-12
+  metadata:
+    service_type: inspector
+    only_logs_after: 2023-JAN-12
+    discard_field: assetAttributes.tags.value
+    discard_regex: .*inspector-integration-test.*
+    regions: us-east-1
+    found_logs: 4