Skip to content

Commit 168b915

Browse files
kkedziak-splunkkkedziak-splunk
authored
feat: schema changes for LR notes (#862)
1 parent 6acef89 commit 168b915

File tree

5 files changed

+162
-0
lines changed

5 files changed

+162
-0
lines changed

‎pytest_splunk_addon/sample_generation/schema.xsd‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -83,6 +83,7 @@
8383
</xs:sequence>
8484
</xs:complexType>
8585
</xs:element>
86+
<xs:element type="xs:string" name="note" minOccurs="0" />
8687
<xs:element type="xs:string" name="raw"/>
8788
<xs:element name="cim">
8889
<xs:complexType>
@@ -103,6 +104,7 @@
103104
<xs:extension base="xs:string">
104105
<xs:attribute type="xs:string" name="name" use="optional"/>
105106
<xs:attribute type="xs:string" name="value" use="optional"/>
107+
<xs:attribute type="xs:string" name="note" use="optional"/>
106108
</xs:extension>
107109
</xs:simpleContent>
108110
</xs:complexType>

‎tests/unit/tests_standard_lib/tests_sample_generation/test_data/xmls/lr_incorrect.xml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<device>
3+
<vendor>Microsoft</vendor>
4+
<product>Sysmon</product>
5+
<version id="15.0" />
6+
<event code="19" name="EventID_19_WmiEvent_(WmiEventFilter_activity_detected)" format="">
7+
<transport type="windows_input" sourcetype="xmlwineventlog" source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" host="SERVER1" />
8+
<NONEXISTING>HELLO</NONEXISTING>
9+
<source>
10+
<jira id="" />
11+
<comment>lab, index = * EventCode=19</comment>
12+
</source>
13+
<note>Some event level note!!!</note>
14+
<raw><![CDATA[<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>19</EventID><Version>3</Version><Level>4</Level><Task>19</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-08-24T08:52:46.446846100Z'/><EventRecordID>114712</EventRecordID><Correlation/><Execution ProcessID='1336' ThreadID='2120'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>server1</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='EventType'>WmiFilterEvent</Data><Data Name='UtcTime'>2023-08-24 08:52:46.443</Data><Data Name='Operation'>Created</Data><Data Name='User'>SERVER1\Administrator</Data><Data Name='EventNamespace'> "root\\cimv2"</Data><Data Name='Name'> "ServiceFilter_creation_for_EventID19"</Data><Data Name='Query'> "select Look_ME_UP_eventID19 from __instanceModificationEvent within 5 where targetInstance isa 'non_existent'"</Data></EventData></Event>]]></raw>
15+
<cim>
16+
<models>
17+
<model>Change:Endpoint_Changes</model>
18+
</models>
19+
<cim_fields>
20+
<field name="action" value="created" note="some field level note!!!" />
21+
<field name="change_type" value="filesystem" />
22+
<field name="dest" value="server1" />
23+
<field name="dvc" value="server1" />
24+
<field name="object_category" value="wmi" />
25+
<field name="result" value="created" />
26+
<field name="src" value="server1" />
27+
<field name="status" value="success" />
28+
<field name="user" value="Administrator" />
29+
<field name="user_name" value="Administrator" />
30+
<field name="vendor_product" value="Microsoft Sysmon" />
31+
<field name="signature" value="WmiEvent (WmiEventFilter activity detected)" />
32+
<field name="signature_id" value="19" />
33+
</cim_fields>
34+
<missing_recommended_fields>
35+
<field>command</field>
36+
<field>object</field>
37+
<field>object_attrs</field>
38+
<field>object_id</field>
39+
<field>object_path</field>
40+
<field>result_id</field>
41+
</missing_recommended_fields>
42+
</cim>
43+
</event>
44+
</device>

‎tests/unit/tests_standard_lib/tests_sample_generation/test_data/xmls/lr_notes.xml‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<device>
3+
<vendor>Microsoft</vendor>
4+
<product>Sysmon</product>
5+
<version id="15.0" />
6+
<event code="19" name="EventID_19_WmiEvent_(WmiEventFilter_activity_detected)" format="">
7+
<transport type="windows_input" sourcetype="xmlwineventlog" source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" host="SERVER1" />
8+
<source>
9+
<jira id="" />
10+
<comment>lab, index = * EventCode=19</comment>
11+
</source>
12+
<note>Some event level note!!!</note>
13+
<raw><![CDATA[<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>19</EventID><Version>3</Version><Level>4</Level><Task>19</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-08-24T08:52:46.446846100Z'/><EventRecordID>114712</EventRecordID><Correlation/><Execution ProcessID='1336' ThreadID='2120'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>server1</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='EventType'>WmiFilterEvent</Data><Data Name='UtcTime'>2023-08-24 08:52:46.443</Data><Data Name='Operation'>Created</Data><Data Name='User'>SERVER1\Administrator</Data><Data Name='EventNamespace'> "root\\cimv2"</Data><Data Name='Name'> "ServiceFilter_creation_for_EventID19"</Data><Data Name='Query'> "select Look_ME_UP_eventID19 from __instanceModificationEvent within 5 where targetInstance isa 'non_existent'"</Data></EventData></Event>]]></raw>
14+
<cim>
15+
<models>
16+
<model>Change:Endpoint_Changes</model>
17+
</models>
18+
<cim_fields>
19+
<field name="action" value="created" note="some field level note!!!" />
20+
<field name="change_type" value="filesystem" />
21+
<field name="dest" value="server1" />
22+
<field name="dvc" value="server1" />
23+
<field name="object_category" value="wmi" />
24+
<field name="result" value="created" />
25+
<field name="src" value="server1" />
26+
<field name="status" value="success" />
27+
<field name="user" value="Administrator" />
28+
<field name="user_name" value="Administrator" />
29+
<field name="vendor_product" value="Microsoft Sysmon" />
30+
<field name="signature" value="WmiEvent (WmiEventFilter activity detected)" />
31+
<field name="signature_id" value="19" />
32+
</cim_fields>
33+
<missing_recommended_fields>
34+
<field>command</field>
35+
<field>object</field>
36+
<field>object_attrs</field>
37+
<field>object_id</field>
38+
<field>object_path</field>
39+
<field>result_id</field>
40+
</missing_recommended_fields>
41+
</cim>
42+
</event>
43+
</device>

‎tests/unit/tests_standard_lib/tests_sample_generation/test_data/xmls/lr_without_notes.xml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<device>
3+
<vendor>Microsoft</vendor>
4+
<product>Sysmon</product>
5+
<version id="15.0" />
6+
<event code="19" name="EventID_19_WmiEvent_(WmiEventFilter_activity_detected)" format="">
7+
<transport type="windows_input" sourcetype="xmlwineventlog" source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" host="SERVER1" />
8+
<source>
9+
<jira id="" />
10+
<comment>lab, index = * EventCode=19</comment>
11+
</source>
12+
<raw><![CDATA[<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Sysmon' Guid='{5770385F-C22A-43E0-BF4C-06F5698FFBD9}'/><EventID>19</EventID><Version>3</Version><Level>4</Level><Task>19</Task><Opcode>0</Opcode><Keywords>0x8000000000000000</Keywords><TimeCreated SystemTime='2023-08-24T08:52:46.446846100Z'/><EventRecordID>114712</EventRecordID><Correlation/><Execution ProcessID='1336' ThreadID='2120'/><Channel>Microsoft-Windows-Sysmon/Operational</Channel><Computer>server1</Computer><Security UserID='S-1-5-18'/></System><EventData><Data Name='RuleName'>-</Data><Data Name='EventType'>WmiFilterEvent</Data><Data Name='UtcTime'>2023-08-24 08:52:46.443</Data><Data Name='Operation'>Created</Data><Data Name='User'>SERVER1\Administrator</Data><Data Name='EventNamespace'> "root\\cimv2"</Data><Data Name='Name'> "ServiceFilter_creation_for_EventID19"</Data><Data Name='Query'> "select Look_ME_UP_eventID19 from __instanceModificationEvent within 5 where targetInstance isa 'non_existent'"</Data></EventData></Event>]]></raw>
13+
<cim>
14+
<models>
15+
<model>Change:Endpoint_Changes</model>
16+
</models>
17+
<cim_fields>
18+
<field name="action" value="created" />
19+
<field name="change_type" value="filesystem" />
20+
<field name="dest" value="server1" />
21+
<field name="dvc" value="server1" />
22+
<field name="object_category" value="wmi" />
23+
<field name="result" value="created" />
24+
<field name="src" value="server1" />
25+
<field name="status" value="success" />
26+
<field name="user" value="Administrator" />
27+
<field name="user_name" value="Administrator" />
28+
<field name="vendor_product" value="Microsoft Sysmon" />
29+
<field name="signature" value="WmiEvent (WmiEventFilter activity detected)" />
30+
<field name="signature_id" value="19" />
31+
</cim_fields>
32+
<missing_recommended_fields>
33+
<field>command</field>
34+
<field>object</field>
35+
<field>object_attrs</field>
36+
<field>object_id</field>
37+
<field>object_path</field>
38+
<field>result_id</field>
39+
</missing_recommended_fields>
40+
</cim>
41+
</event>
42+
</device>

‎tests/unit/tests_standard_lib/tests_sample_generation/test_schema.py‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
import os.path
2+
3+
import pytest
4+
from xmlschema import XMLSchema, XMLSchemaChildrenValidationError
5+
6+
from pytest_splunk_addon.sample_generation.pytest_splunk_addon_data_parser import (
7+
SCHEMA_PATH,
8+
)
9+
10+
11+
@pytest.fixture
12+
def validator() -> XMLSchema:
13+
return XMLSchema(SCHEMA_PATH)
14+
15+
16+
def get_xml(name: str) -> str:
17+
with open(os.path.join(os.path.dirname(__file__), "test_data", "xmls", name)) as fp:
18+
return fp.read()
19+
20+
21+
def test_validate_schema(validator):
22+
validator.validate(get_xml("lr_without_notes.xml"))
23+
24+
25+
def test_validate_schema_incorrect_event_element(validator):
26+
with pytest.raises(XMLSchemaChildrenValidationError):
27+
validator.validate(get_xml("lr_incorrect.xml"))
28+
29+
30+
def test_validate_schema_notes(validator):
31+
validator.validate(get_xml("lr_notes.xml"))

0 commit comments

Comments
 (0)