Vulnerability detector test module refactor: test_general_settings_min_full_scan_interval

[jmv74211]

It is asked to refactor the test module named test_general_settings_min_full_scan_interval.py.

It is disabled for now, as it was failing or unstable, causing false positives.

Tasks

• Make a study of the objectives of the test, and what is being tested.
• Refactor the test. Clean and modularizable code.
• Check that the test always starts from the same state and restores it completely at the end of the test (independent of the tests previously executed in that environment).
• Review test documentation, and modify if necessary.
• Proven that tests pass when they have to pass.
• Proven that tests fail when they have to fail.
• Test in 5-10 rounds of execution that the test always shows the same result.

Checks

• The code complies with the standard PEP-8 format.
• Python codebase is documented following the Google Style for Python docstrings.
• The test is processed by qa-docs tool without errors.

[roronoasins]

Test design

Name

test_general_settings_min_full_scan_interval.py

---

Objective

Check that a full scan is performed when min_full_scan_interval expires and the CVEs database is updated with new
information.

---

Test checks

• A full scan starts after the min_full_scan_interval as expected.
• The vulnerabilities are set as pending.
• Every package is set as triaged.
• The sys_osinfo rows are set as triaged.
• The inserts/updates from pending to valid are performed.
• The vulnerabilities alerts are logged correctly.
• The pending/obsolete alerts are deleted.
• The delete event is logged correctly.

---

Initial stage (setup)

• All modules except vulnerability detector must be disabled.
• Set the ossec.conf configuration.
• Insert packages and vulnerabilities in order to trigger a full scan.

---

Test phases

Enabled cases

• Restart wazuh-modulesd daemon.
• Monitor ossec.log and check the full scan log.
• Query the CVEs databases for PENDING vulnerabilities(should be all of them at this point).
• Query the CVEs databases for VALID vulnerabilities(some test cases should be VALID).
• Query the CVEs databases for OBSOLETE vulnerabilities(some test cases should be OBSOLETE)
• Monitor ossec.log and check that new vulnerabilities alerts are logged.
• Monitor ossec.log and check that removed vulnerabilities alerts are logged.

Disabled cases

• Restart wazuh-modulesd daemon
• Monitor ossec.log and check that the full scan log does not appear.

---

Final stage (teardown)

• Remove the packages and vulnerabilities used.
• Restore initial ossec.conf file.
• Clean the ossec.log file.

---

Test cases:

ossec.conf

{min_full_scan_interval : 30s}

Packages and vulnerabilities

Not determined.

As the TimeTravel will be deprecated soon, we can't have a test that spent minutes or hours for each case.

[roronoasins]

For now, there are two tiers for this test:

Tier 0

This test will check the minimal behavior and using short amounts of min_full_scan_interval

Tier 5

This test will check the same than the tier 0 but with some additions:

• Check pending vulns in vuln_cve db
• Every package is set as triaged.
• The sys_osinfo rows are set as triaged.
• Check valid changes in vuln_cve db
• Monitor new vuln alert event
• Check obsolete vuln
• Check obsolete vuln deletion
• Monitor vulns removed from vuln_cve db

Also, a method has been added to run the test by tier: If you specify a tier like --tier=0, the simple test will be executed. If you don't specify a tier, the complex test will be executed by default.