feat: add cloudwatch and inspector discard regex tests and cases

wazuh · Jul 17, 2023 · 57edfab · 57edfab
1 parent dea763a
commit 57edfab
Show file tree

Hide file tree

Showing 7 changed files with 485 additions and 14 deletions.
diff --git a/...ation_template/discard_regex_test_module/configuration_cloudwatch_discard_regex_json.yaml b/...ation_template/discard_regex_test_module/configuration_cloudwatch_discard_regex_json.yaml
@@ -0,0 +1,23 @@
+- sections:
+ - section: wodle
+ attributes:
+ - name: aws-s3
+ elements:
+ - disabled:
+ value: 'no'
+ - service:
+ attributes:
+ - type: SERVICE_TYPE
+ elements:
+ - aws_profile:
+ value: qa
+ - aws_log_groups:
+ value: LOG_GROUP_NAME
+ - only_logs_after:
+ value: ONLY_LOGS_AFTER
+ - regions:
+ value: REGIONS
+ - discard_regex:
+ attributes:
+ - field: DISCARD_FIELD
+ value: DISCARD_REGEX
diff --git a/...emplate/discard_regex_test_module/configuration_cloudwatch_discard_regex_simple_text.yaml b/...emplate/discard_regex_test_module/configuration_cloudwatch_discard_regex_simple_text.yaml
@@ -0,0 +1,21 @@
+- sections:
+ - section: wodle
+ attributes:
+ - name: aws-s3
+ elements:
+ - disabled:
+ value: 'no'
+ - service:
+ attributes:
+ - type: SERVICE_TYPE
+ elements:
+ - aws_profile:
+ value: qa
+ - aws_log_groups:
+ value: LOG_GROUP_NAME
+ - only_logs_after:
+ value: ONLY_LOGS_AFTER
+ - regions:
+ value: REGIONS
+ - discard_regex:
+ value: DISCARD_REGEX
diff --git a/...nfiguration_template/discard_regex_test_module/configuration_inspector_discard_regex.yaml b/...nfiguration_template/discard_regex_test_module/configuration_inspector_discard_regex.yaml
@@ -0,0 +1,21 @@
+- sections:
+ - section: wodle
+ attributes:
+ - name: aws-s3
+ elements:
+ - disabled:
+ value: 'no'
+ - service:
+ attributes:
+ - type: SERVICE_TYPE
+ elements:
+ - aws_profile:
+ value: qa
+ - only_logs_after:
+ value: ONLY_LOGS_AFTER
+ - regions:
+ value: REGIONS
+ - discard_regex:
+ attributes:
+ - field: DISCARD_FIELD
+ value: DISCARD_REGEX
diff --git a/...st_aws/data/test_cases/discard_regex_test_module/cases_cloudwatch_discard_regex_json.yaml b/...st_aws/data/test_cases/discard_regex_test_module/cases_cloudwatch_discard_regex_json.yaml
@@ -0,0 +1,17 @@
+- name: cloudwatch_discard_regex_json
+ description: CloudWatch discard regex configuration for JSON logs
+ configuration_parameters:
+ SERVICE_TYPE: cloudwatchlogs
+ LOG_GROUP_NAME: wazuh-cloudwatchlogs-integration-tests
+ REGIONS: us-east-1
+ DISCARD_FIELD: networkInterfaces.networkInterfaceId
+ DISCARD_REGEX: .*eni-networkInterfaceId*
+ ONLY_LOGS_AFTER: 2023-JUL-03
+ metadata:
+ service_type: cloudwatchlogs
+ log_group_name: wazuh-cloudwatchlogs-integration-tests
+ only_logs_after: 2023-JUL-03
+ discard_field: networkInterfaces.networkInterfaceId
+ discard_regex: .*eni-networkInterfaceId.*
+ regions: us-east-1
+ found_logs: 1
diff --git a/...data/test_cases/discard_regex_test_module/cases_cloudwatch_discard_regex_simple_text.yaml b/...data/test_cases/discard_regex_test_module/cases_cloudwatch_discard_regex_simple_text.yaml
@@ -0,0 +1,15 @@
+- name: cloudwatch_discard_regex_simple_text
+ description: CloudWatch discard regex configuration for simple text logs
+ configuration_parameters:
+ SERVICE_TYPE: cloudwatchlogs
+ LOG_GROUP_NAME: wazuh-cloudwatchlogs-integration-tests
+ REGIONS: us-east-1
+ DISCARD_REGEX: .*Test.*
+ ONLY_LOGS_AFTER: 2023-JAN-12
+ metadata:
+ service_type: cloudwatchlogs
+ log_group_name: wazuh-cloudwatchlogs-integration-tests
+ only_logs_after: 2023-JAN-12
+ discard_regex: .*Test.*
+ regions: us-east-1
+ found_logs: 3
diff --git a/...ion/test_aws/data/test_cases/discard_regex_test_module/cases_inspector_discard_regex.yaml b/...ion/test_aws/data/test_cases/discard_regex_test_module/cases_inspector_discard_regex.yaml
@@ -0,0 +1,15 @@
+- name: inspector_discard_regex
+ description: Inspector discard regex configurations
+ configuration_parameters:
+ SERVICE_TYPE: inspector
+ REGIONS: us-east-1
+ DISCARD_FIELD: assetAttributes.tags.value
+ DISCARD_REGEX: .*inspector-integration-test.*
+ ONLY_LOGS_AFTER: 2023-JAN-12
+ metadata:
+ service_type: inspector
+ only_logs_after: 2023-JAN-12
+ discard_field: assetAttributes.tags.value
+ discard_regex: .*inspector-integration-test.*
+ regions: us-east-1
+ found_logs: 4