VDT_R3.html

configuration = {'metadata': {'description': 'Amazon Linux provider', 'download_timeout': 120, 'name': 'ALAS', 'provider_name': 'Amazo...led': {'value': 'yes'}}], 'section': 'wodle'}, {'elements': [{'disabled': {'value': 'yes'}}], 'section': 'auth'}, ...]}
metadata = {'description': 'Amazon Linux provider', 'download_timeout': 120, 'name': 'ALAS', 'provider_name': 'Amazon Linux 1', ...}, set_wazuh_configuration_vdt = None, truncate_monitored_files = None
clean_cve_tables_func = None, restart_modulesd_function = None

@pytest.mark.tier(level=2)
@pytest.mark.parametrize('configuration, metadata', zip(configurations, configuration_metadata), ids=case_ids)
def test_download_feeds(configuration, metadata, set_wazuh_configuration_vdt, truncate_monitored_files,
clean_cve_tables_func, restart_modulesd_function):
'''
description: Check if modulesd downloads successfully the feeds from different providers and os, and check that
the feed update date does not exceed a set limit.

test_phases:
- Set a custom Wazuh configuration.
- Restart wazuh-modulesd.
- Check in log that the database provider has been updated successfully.
- Check that the timestamp of the feed metadata does not exceed the established threshold limit.

wazuh_min_version: 4.4.0

tier: 2

parameters:
- configuration:
type: dict
brief: Wazuh configuration data. Needed for set_wazuh_configuration fixture.
- metadata:
type: dict
brief: Wazuh configuration metadata
- set_wazuh_configuration_vdt:
type: fixture
brief: Set the wazuh configuration according to the configuration data.
- truncate_monitored_files:
type: fixture
brief: Truncate all the log files and json alerts files before and after the test execution.
- clean_cve_tables_func:
type: fixture
brief: Clean all the CVE tables before and after running the test.
- restart_modulesd_function:
type: fixture
brief: Restart the wazuh-modulesd daemon.

assertions:
- Check that it starts the feed download.
- Check that the feed is downloaded successfully.
- Check that the feed update date does not exceed a set limit.

input_description:
- The `configuration_download_feeds.yaml` file provides the module configuration for this test.
- The `cases_download_feeds` file provides the test cases.

expected_output:
- r'Starting .* database update'
- r'The update of the .* feed finished successfully'
'''
if metadata['provider_os'] == 'BIONIC':
pytest.xfail(reason='Ubuntu Bionic feed parsing error - Wazuh/Wazuh Issue #13556')

# Check that the feed update has started
evm.check_provider_database_update_start_log(metadata['provider_name'])
# Check that the feed has been updated successfully
evm.check_provider_database_update_finish_log(provider_name=metadata['provider_name'],
timeout=metadata['download_timeout'])

if 'provider_json_name' in metadata:
evm.check_provider_database_update_start_log(metadata['provider_json_name'])
evm.check_provider_database_update_finish_log(provider_name=metadata['provider_json_name'],
timeout=metadata['download_timeout'])

if metadata['update_treshold_weeks'] != 'None':
> assert vd.feed_is_recently_updated(provider_name=metadata['provider_name'],
provider_os=metadata['provider_os'],
threshold_weeks=metadata['update_treshold_weeks']), '' \
f"The {metadata['provider_os']} feed has not been recently updated"
E AssertionError: The Amazon-Linux feed has not been recently updated
E assert False
E + where False = <function feed_is_recently_updated at 0x7fbcd4dec2f0>(provider_name='Amazon Linux 1', provider_os='Amazon-Linux', threshold_weeks=3)
E + where <function feed_is_recently_updated at 0x7fbcd4dec2f0> = vd.feed_is_recently_updated

test_vulnerability_detector/test_feeds/test_download_feeds.py:149: AssertionError
-----------------------------Captured stderr setup------------------------------
2023/03/09 14:41:33 wazuh-modulesd[37221] debug_op.c:70 at _log(): DEBUG: Logging module auto-initialized 2023/03/09 14:41:33 wazuh-modulesd[37221] main.c:77 at main(): DEBUG: Wazuh home directory: /var/ossec 2023/03/09 14:41:33 wazuh-modulesd[37221] wmodules-osquery-monitor.c:78 at wm_osquery_monitor_read(): DEBUG: Logpath read: /var/log/osquery/osqueryd.results.log 2023/03/09 14:41:33 wazuh-modulesd[37221] wmodules-osquery-monitor.c:84 at wm_osquery_monitor_read(): DEBUG: configPath read: /etc/osquery/osquery.conf 2023/03/09 14:41:33 wazuh-modulesd[37221] wmodules-vuln-detector.c:668 at wm_vuldet_read_provider(): DEBUG: Added alas (amazon-linux) feed. Interval: 3600s | Path: 'none' | Url: 'none' | Timeout: 300s

configuration = {'metadata': {'description': 'Amazon Linux provider', 'download_timeout': 120, 'name': 'ALAS-2', 'provider_name': 'Ama...led': {'value': 'yes'}}], 'section': 'wodle'}, {'elements': [{'disabled': {'value': 'yes'}}], 'section': 'auth'}, ...]}
metadata = {'description': 'Amazon Linux provider', 'download_timeout': 120, 'name': 'ALAS-2', 'provider_name': 'Amazon Linux 2', ...}, set_wazuh_configuration_vdt = None, truncate_monitored_files = None
clean_cve_tables_func = None, restart_modulesd_function = None

@pytest.mark.tier(level=2)
@pytest.mark.parametrize('configuration, metadata', zip(configurations, configuration_metadata), ids=case_ids)
def test_download_feeds(configuration, metadata, set_wazuh_configuration_vdt, truncate_monitored_files,
clean_cve_tables_func, restart_modulesd_function):
'''
description: Check if modulesd downloads successfully the feeds from different providers and os, and check that
the feed update date does not exceed a set limit.

test_phases:
- Set a custom Wazuh configuration.
- Restart wazuh-modulesd.
- Check in log that the database provider has been updated successfully.
- Check that the timestamp of the feed metadata does not exceed the established threshold limit.

wazuh_min_version: 4.4.0

tier: 2

parameters:
- configuration:
type: dict
brief: Wazuh configuration data. Needed for set_wazuh_configuration fixture.
- metadata:
type: dict
brief: Wazuh configuration metadata
- set_wazuh_configuration_vdt:
type: fixture
brief: Set the wazuh configuration according to the configuration data.
- truncate_monitored_files:
type: fixture
brief: Truncate all the log files and json alerts files before and after the test execution.
- clean_cve_tables_func:
type: fixture
brief: Clean all the CVE tables before and after running the test.
- restart_modulesd_function:
type: fixture
brief: Restart the wazuh-modulesd daemon.

assertions:
- Check that it starts the feed download.
- Check that the feed is downloaded successfully.
- Check that the feed update date does not exceed a set limit.

input_description:
- The `configuration_download_feeds.yaml` file provides the module configuration for this test.
- The `cases_download_feeds` file provides the test cases.

expected_output:
- r'Starting .* database update'
- r'The update of the .* feed finished successfully'
'''
if metadata['provider_os'] == 'BIONIC':
pytest.xfail(reason='Ubuntu Bionic feed parsing error - Wazuh/Wazuh Issue #13556')

# Check that the feed update has started
evm.check_provider_database_update_start_log(metadata['provider_name'])
# Check that the feed has been updated successfully
evm.check_provider_database_update_finish_log(provider_name=metadata['provider_name'],
timeout=metadata['download_timeout'])

if 'provider_json_name' in metadata:
evm.check_provider_database_update_start_log(metadata['provider_json_name'])
evm.check_provider_database_update_finish_log(provider_name=metadata['provider_json_name'],
timeout=metadata['download_timeout'])

if metadata['update_treshold_weeks'] != 'None':
> assert vd.feed_is_recently_updated(provider_name=metadata['provider_name'],
provider_os=metadata['provider_os'],
threshold_weeks=metadata['update_treshold_weeks']), '' \
f"The {metadata['provider_os']} feed has not been recently updated"
E AssertionError: The Amazon-Linux-2 feed has not been recently updated
E assert False
E + where False = <function feed_is_recently_updated at 0x7fbcd4dec2f0>(provider_name='Amazon Linux 2', provider_os='Amazon-Linux-2', threshold_weeks=3)
E + where <function feed_is_recently_updated at 0x7fbcd4dec2f0> = vd.feed_is_recently_updated

test_vulnerability_detector/test_feeds/test_download_feeds.py:149: AssertionError
-----------------------------Captured stderr setup------------------------------
2023/03/09 14:41:41 wazuh-modulesd[37314] debug_op.c:70 at _log(): DEBUG: Logging module auto-initialized 2023/03/09 14:41:41 wazuh-modulesd[37314] main.c:77 at main(): DEBUG: Wazuh home directory: /var/ossec 2023/03/09 14:41:41 wazuh-modulesd[37314] wmodules-osquery-monitor.c:78 at wm_osquery_monitor_read(): DEBUG: Logpath read: /var/log/osquery/osqueryd.results.log 2023/03/09 14:41:41 wazuh-modulesd[37314] wmodules-osquery-monitor.c:84 at wm_osquery_monitor_read(): DEBUG: configPath read: /etc/osquery/osquery.conf 2023/03/09 14:41:41 wazuh-modulesd[37314] wmodules-vuln-detector.c:668 at wm_vuldet_read_provider(): DEBUG: Added alas (amazon-linux-2) feed. Interval: 3600s | Path: 'none' | Url: 'none' | Timeout: 300s

configuration = {'metadata': {'description': 'Amazon Linux provider', 'download_timeout': 120, 'name': 'ALAS-2022', 'provider_name': '...led': {'value': 'yes'}}], 'section': 'wodle'}, {'elements': [{'disabled': {'value': 'yes'}}], 'section': 'auth'}, ...]}
metadata = {'description': 'Amazon Linux provider', 'download_timeout': 120, 'name': 'ALAS-2022', 'provider_name': 'Amazon Linux 2022', ...}, set_wazuh_configuration_vdt = None
truncate_monitored_files = None, clean_cve_tables_func = None, restart_modulesd_function = None

@pytest.mark.tier(level=2)
@pytest.mark.parametrize('configuration, metadata', zip(configurations, configuration_metadata), ids=case_ids)
def test_download_feeds(configuration, metadata, set_wazuh_configuration_vdt, truncate_monitored_files,
clean_cve_tables_func, restart_modulesd_function):
'''
description: Check if modulesd downloads successfully the feeds from different providers and os, and check that
the feed update date does not exceed a set limit.

test_phases:
- Set a custom Wazuh configuration.
- Restart wazuh-modulesd.
- Check in log that the database provider has been updated successfully.
- Check that the timestamp of the feed metadata does not exceed the established threshold limit.

wazuh_min_version: 4.4.0

tier: 2

parameters:
- configuration:
type: dict
brief: Wazuh configuration data. Needed for set_wazuh_configuration fixture.
- metadata:
type: dict
brief: Wazuh configuration metadata
- set_wazuh_configuration_vdt:
type: fixture
brief: Set the wazuh configuration according to the configuration data.
- truncate_monitored_files:
type: fixture
brief: Truncate all the log files and json alerts files before and after the test execution.
- clean_cve_tables_func:
type: fixture
brief: Clean all the CVE tables before and after running the test.
- restart_modulesd_function:
type: fixture
brief: Restart the wazuh-modulesd daemon.

assertions:
- Check that it starts the feed download.
- Check that the feed is downloaded successfully.
- Check that the feed update date does not exceed a set limit.

input_description:
- The `configuration_download_feeds.yaml` file provides the module configuration for this test.
- The `cases_download_feeds` file provides the test cases.

expected_output:
- r'Starting .* database update'
- r'The update of the .* feed finished successfully'
'''
if metadata['provider_os'] == 'BIONIC':
pytest.xfail(reason='Ubuntu Bionic feed parsing error - Wazuh/Wazuh Issue #13556')

# Check that the feed update has started
evm.check_provider_database_update_start_log(metadata['provider_name'])
# Check that the feed has been updated successfully
evm.check_provider_database_update_finish_log(provider_name=metadata['provider_name'],
timeout=metadata['download_timeout'])

if 'provider_json_name' in metadata:
evm.check_provider_database_update_start_log(metadata['provider_json_name'])
evm.check_provider_database_update_finish_log(provider_name=metadata['provider_json_name'],
timeout=metadata['download_timeout'])

if metadata['update_treshold_weeks'] != 'None':
> assert vd.feed_is_recently_updated(provider_name=metadata['provider_name'],
provider_os=metadata['provider_os'],
threshold_weeks=metadata['update_treshold_weeks']), '' \
f"The {metadata['provider_os']} feed has not been recently updated"
E AssertionError: The Amazon-Linux-2022 feed has not been recently updated
E assert False
E + where False = <function feed_is_recently_updated at 0x7fbcd4dec2f0>(provider_name='Amazon Linux 2022', provider_os='Amazon-Linux-2022', threshold_weeks=3)
E + where <function feed_is_recently_updated at 0x7fbcd4dec2f0> = vd.feed_is_recently_updated

test_vulnerability_detector/test_feeds/test_download_feeds.py:149: AssertionError
-----------------------------Captured stderr setup------------------------------
2023/03/09 14:41:47 wazuh-modulesd[37420] debug_op.c:70 at _log(): DEBUG: Logging module auto-initialized 2023/03/09 14:41:47 wazuh-modulesd[37420] main.c:77 at main(): DEBUG: Wazuh home directory: /var/ossec 2023/03/09 14:41:47 wazuh-modulesd[37420] wmodules-osquery-monitor.c:78 at wm_osquery_monitor_read(): DEBUG: Logpath read: /var/log/osquery/osqueryd.results.log 2023/03/09 14:41:47 wazuh-modulesd[37420] wmodules-osquery-monitor.c:84 at wm_osquery_monitor_read(): DEBUG: configPath read: /etc/osquery/osquery.conf 2023/03/09 14:41:47 wazuh-modulesd[37420] wmodules-vuln-detector.c:668 at wm_vuldet_read_provider(): DEBUG: Added alas (amazon-linux-2022) feed. Interval: 3600s | Path: 'none' | Url: 'none' | Timeout: 300s

configuration = {'metadata': {'description': 'Microsoft Security Update provider', 'download_timeout': 120, 'name': 'MSU', 'provider_n...led': {'value': 'yes'}}], 'section': 'wodle'}, {'elements': [{'disabled': {'value': 'yes'}}], 'section': 'auth'}, ...]}
metadata = {'description': 'Microsoft Security Update provider', 'download_timeout': 120, 'name': 'MSU', 'provider_name': 'Microsoft Security Update', ...}, set_wazuh_configuration_vdt = None
truncate_monitored_files = None, clean_cve_tables_func = None, restart_modulesd_function = None

@pytest.mark.tier(level=2)
@pytest.mark.parametrize('configuration, metadata', zip(configurations, configuration_metadata), ids=case_ids)
def test_download_feeds(configuration, metadata, set_wazuh_configuration_vdt, truncate_monitored_files,
clean_cve_tables_func, restart_modulesd_function):
'''
description: Check if modulesd downloads successfully the feeds from different providers and os, and check that
the feed update date does not exceed a set limit.

test_phases:
- Set a custom Wazuh configuration.
- Restart wazuh-modulesd.
- Check in log that the database provider has been updated successfully.
- Check that the timestamp of the feed metadata does not exceed the established threshold limit.

wazuh_min_version: 4.4.0

tier: 2

parameters:
- configuration:
type: dict
brief: Wazuh configuration data. Needed for set_wazuh_configuration fixture.
- metadata:
type: dict
brief: Wazuh configuration metadata
- set_wazuh_configuration_vdt:
type: fixture
brief: Set the wazuh configuration according to the configuration data.
- truncate_monitored_files:
type: fixture
brief: Truncate all the log files and json alerts files before and after the test execution.
- clean_cve_tables_func:
type: fixture
brief: Clean all the CVE tables before and after running the test.
- restart_modulesd_function:
type: fixture
brief: Restart the wazuh-modulesd daemon.

assertions:
- Check that it starts the feed download.
- Check that the feed is downloaded successfully.
- Check that the feed update date does not exceed a set limit.

input_description:
- The `configuration_download_feeds.yaml` file provides the module configuration for this test.
- The `cases_download_feeds` file provides the test cases.

expected_output:
- r'Starting .* database update'
- r'The update of the .* feed finished successfully'
'''
if metadata['provider_os'] == 'BIONIC':
pytest.xfail(reason='Ubuntu Bionic feed parsing error - Wazuh/Wazuh Issue #13556')

# Check that the feed update has started
evm.check_provider_database_update_start_log(metadata['provider_name'])
# Check that the feed has been updated successfully
evm.check_provider_database_update_finish_log(provider_name=metadata['provider_name'],
timeout=metadata['download_timeout'])

if 'provider_json_name' in metadata:
evm.check_provider_database_update_start_log(metadata['provider_json_name'])
evm.check_provider_database_update_finish_log(provider_name=metadata['provider_json_name'],
timeout=metadata['download_timeout'])

if metadata['update_treshold_weeks'] != 'None':
> assert vd.feed_is_recently_updated(provider_name=metadata['provider_name'],
provider_os=metadata['provider_os'],
threshold_weeks=metadata['update_treshold_weeks']), '' \
f"The {metadata['provider_os']} feed has not been recently updated"
E AssertionError: The MSU feed has not been recently updated
E assert False
E + where False = <function feed_is_recently_updated at 0x7fbcd4dec2f0>(provider_name='Microsoft Security Update', provider_os='MSU', threshold_weeks=3)
E + where <function feed_is_recently_updated at 0x7fbcd4dec2f0> = vd.feed_is_recently_updated

test_vulnerability_detector/test_feeds/test_download_feeds.py:149: AssertionError
-----------------------------Captured stderr setup------------------------------
2023/03/09 14:51:46 wazuh-modulesd[37653] debug_op.c:70 at _log(): DEBUG: Logging module auto-initialized 2023/03/09 14:51:46 wazuh-modulesd[37653] main.c:77 at main(): DEBUG: Wazuh home directory: /var/ossec 2023/03/09 14:51:46 wazuh-modulesd[37653] wmodules-osquery-monitor.c:78 at wm_osquery_monitor_read(): DEBUG: Logpath read: /var/log/osquery/osqueryd.results.log 2023/03/09 14:51:46 wazuh-modulesd[37653] wmodules-osquery-monitor.c:84 at wm_osquery_monitor_read(): DEBUG: configPath read: /etc/osquery/osquery.conf 2023/03/09 14:51:46 wazuh-modulesd[37653] wmodules-vuln-detector.c:1054 at wm_vuldet_read_provider_content(): WARNING: Invalid option 'os' for 'msu' provider at 'vulnerability-detector' 2023/03/09 14:51:46 wazuh-modulesd[37653] wmodules-vuln-detector.c:726 at wm_vuldet_read_provider(): DEBUG: Added msu feed. Interval: 3600s | Multi path: 'none' | Multi url: 'none' | Update since: 0 | Timeout: 300s