Skip to content

Commit

Permalink
doc: Add test_benchmark and test_checks of test_fim/test_files docume…
Browse files Browse the repository at this point in the history
…ntation in QA Docs style

The following tests have been documentated:
  * test_hard_link.py
Enhancements in the documentation of the remaining tests.
The current scheme of the issue #1694 has been used.
PEP-8 fixes.

Closes: #1936
  • Loading branch information
mdengra committed Sep 29, 2021
1 parent f7f57ef commit 7a35303
Show file tree
Hide file tree
Showing 7 changed files with 284 additions and 185 deletions.
2 changes: 2 additions & 0 deletions docs/DocGenerator/config.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,8 @@ Ignore paths:
- "../../tests/integration/test_fim/test_files/test_ambiguous_confs/data"
- "../../tests/integration/test_fim/test_files/test_audit/data"
- "../../tests/integration/test_fim/test_files/test_basic_usage/data"
- "../../tests/integration/test_fim/test_files/test_benchmark/data"
- "../../tests/integration/test_fim/test_files/test_checks/data"

Output fields:
Module:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,10 @@
type: integration
brief: These tests will check if the File Integrity Monitoring (`FIM`) system watches selected
files and triggering alerts when these files are modified. Specifically, they will check
if `FIM` CUD events are generated for each modified file before the specified time expires.
The `FIM` capability is managed by the `wazuh-syscheckd` daemon, which checks configured files
for changes to the checksums, permissions, and ownership.
brief: File Integrity Monitoring (FIM) system watches selected files and triggering alerts when these files
are modified. Specifically, these tests will check if FIM CUD events are generated for each modified file
before the specified time expires. The FIM capability is managed by the 'wazuh-syscheckd' daemon,
which checks configured files for changes to the checksums, permissions, and ownership.
tier: 0
Expand All @@ -23,7 +22,6 @@
- manager
daemons:
- wazuh-agentd
- wazuh-syscheckd
os_platform:
Expand Down Expand Up @@ -54,22 +52,23 @@
- Windows Server 2016
- Windows server 2012
- Windows server 2003
- Windows XP
references:
- https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/index.html
- https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/syscheck.html
pytest_args:
- fim_mode:
realtime: Enable real-time monitoring on Linux (using the `inotify` system calls) and Windows systems.
whodata: Implies real-time monitoring but adding the `who-data` information.
realtime: Enable real-time monitoring on Linux (using the 'inotify' system calls) and Windows systems.
whodata: Implies real-time monitoring but adding the 'who-data' information.
- tier:
0: Only level 0 tests are performed, they check basic functionalities and are quick to perform.
1: Only level 1 tests are performed, they check functionalities of medium complexity.
2: Only level 2 tests are performed, they check advanced functionalities and are slow to perform.
tags:
- fim
- fim_benchmark
'''
import os

Expand Down Expand Up @@ -130,13 +129,13 @@ def test_benchmark_regular_files(files, folder, tags_to_apply, get_configuration
configure_environment, restart_syscheckd,
wait_for_fim_start):
'''
description: Check if the `wazuh-syscheckd` daemon detects CUD events (`added`, `modified`, and `deleted`)
description: Check if the 'wazuh-syscheckd' daemon detects CUD events ('added', 'modified', and 'deleted')
in a certain volume of file changes. For this purpose, the test will monitor a folder with
multiple testing files and perform modifications on them (add, modify and delete). Finally,
the test will verify that all FIM events have been generated for each change made
to each file before the set timeout expires.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- files:
Expand All @@ -156,20 +155,20 @@ def test_benchmark_regular_files(files, folder, tags_to_apply, get_configuration
brief: Configure a custom environment for testing.
- restart_syscheckd:
type: fixture
brief: Clear the `ossec.log` file and start a new monitor.
brief: Clear the 'ossec.log' file and start a new monitor.
- wait_for_fim_start:
type: fixture
brief: Wait for realtime start, whodata start, or end of initial FIM scan.
assertions:
- Verify that `FIM` CUD events are generated for each modified file before the specified time expires.
- Verify that FIM CUD events are generated for each modified file before the specified time expires.
input_description: A test case (ossec_conf) is contained in external `YAML` file (wazuh_conf.yaml)
which includes configuration settings for the `wazuh-syscheckd` daemon and, it
input_description: A test case (ossec_conf) is contained in external YAML file (wazuh_conf.yaml)
which includes configuration settings for the wazuh-syscheckd daemon and, it
is combined with the testing files to be monitored defined in this module.
expected_output:
- r'.*Sending FIM event: (.+)$' (`added`, `modified`, and `deleted` events)
- r'.*Sending FIM event: (.+)$' ('added', 'modified', and 'deleted' events)
tags:
- realtime
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -7,11 +7,10 @@
type: integration
brief: These tests will check if the File Integrity Monitoring (`FIM`) system watches selected
files and triggering alerts when these files are modified. Specifically, they will check
if the `wazuh-syscheckd` daemon generates the `diff` files on large amounts of files and
files with a large size using the `report_changes` feature.
The `FIM` capability is managed by the `wazuh-syscheckd` daemon, which checks configured files
brief: File Integrity Monitoring (FIM) system watches selected files and triggering alerts when these files
are modified. Specifically, these tests will check if the 'wazuh-syscheckd' daemon generates the 'diff'
files on large amounts of files and files with a large size using the 'report_changes' feature.
The FIM capability is managed by the 'wazuh-syscheckd' daemon, which checks configured files
for changes to the checksums, permissions, and ownership.
tier: 0
Expand All @@ -24,7 +23,6 @@
- manager
daemons:
- wazuh-agentd
- wazuh-syscheckd
os_platform:
Expand Down Expand Up @@ -55,22 +53,23 @@
- Windows Server 2016
- Windows server 2012
- Windows server 2003
- Windows XP
references:
- https://documentation.wazuh.com/current/user-manual/capabilities/file-integrity/index.html
- https://documentation.wazuh.com/current/user-manual/reference/ossec-conf/syscheck.html
pytest_args:
- fim_mode:
realtime: Enable real-time monitoring on Linux (using the `inotify` system calls) and Windows systems.
whodata: Implies real-time monitoring but adding the `who-data` information.
realtime: Enable real-time monitoring on Linux (using the 'inotify' system calls) and Windows systems.
whodata: Implies real-time monitoring but adding the 'who-data' information.
- tier:
0: Only level 0 tests are performed, they check basic functionalities and are quick to perform.
1: Only level 1 tests are performed, they check functionalities of medium complexity.
2: Only level 2 tests are performed, they check advanced functionalities and are slow to perform.
tags:
- fim
- fim_benchmark
'''
import os
import sys
Expand Down Expand Up @@ -264,15 +263,15 @@ def write_csv(data):
def test_report_changes_big(file_size, n_files, tags_to_apply, get_configuration, configure_environment,
restart_syscheckd, wait_for_fim_start):
'''
description: Check if the `wazuh-syscheckd` daemon generates the `diff` files on large amounts of files and
files with a large size using the `report_changes` feature. For this purpose, the test creates
in a monitored directory (with the `report_changes` attribute) large amounts of files and files
with large size. Then it checks if the expected number of `FIM` events is obtained, if they are
description: Check if the 'wazuh-syscheckd' daemon generates the 'diff' files on large amounts of files and
files with a large size using the 'report_changes' feature. For this purpose, the test creates
in a monitored directory (with the 'report_changes' attribute) large amounts of files and files
with large size. Then it checks if the expected number of FIM events is obtained, if they are
of the correct type and if a copy of each file has been created in the corresponding directory.
In addition, the test generates a `CSV` file with metrics about the time used to create
In addition, the test generates a CSV file with metrics about the time used to create
the files, generate the logs, and the size of the directory.
wazuh_min_version: 4.2
wazuh_min_version: 4.2.0
parameters:
- file_size:
Expand All @@ -292,23 +291,23 @@ def test_report_changes_big(file_size, n_files, tags_to_apply, get_configuration
brief: Configure a custom environment for testing.
- restart_syscheckd:
type: fixture
brief: Clear the `ossec.log` file and start a new monitor.
brief: Clear the 'ossec.log' file and start a new monitor.
- wait_for_fim_start:
type: fixture
brief: Wait for realtime start, whodata start, or end of initial FIM scan.
assertions:
- Verify that `FIM` events are generated for each modified file.
- Verify that for each modified file a `diff` file is generated.
- Verify that `diff` files are updated when files are modified.
- Verify that FIM events are generated for each modified file.
- Verify that for each modified file a 'diff' file is generated.
- Verify that 'diff' files are updated when files are modified.
input_description: A test case (ossec_conf) is contained in external `YAML` file (wazuh_conf.yaml)
which includes configuration settings for the `wazuh-syscheckd` daemon and, it
input_description: A test case (ossec_conf) is contained in external YAML file (wazuh_conf.yaml)
which includes configuration settings for the 'wazuh-syscheckd' daemon and, it
is combined with the testing files to be monitored defined in this module.
expected_output:
- r'.*Sending FIM event: (.+)$' (`added`, `modified`, and `deleted` events)
- A `CSV` file with the metrics collected.
- r'.*Sending FIM event: (.+)$' ('added', 'modified', and 'deleted' events)
- A CSV file with the metrics collected.
tags:
- scheduled
Expand Down
Loading

0 comments on commit 7a35303

Please sign in to comment.