Skip to content

Commit 38b8aaf

Browse files
harshilgajera-crestharshilgajera-crest
authored
chore(release): making a new release (#882)
Contains PRs: - #840 - #846 - #883 - #881
2 parents 753adb5 + dfde610 commit 38b8aaf

File tree

15 files changed

+414
-36
lines changed

15 files changed

+414
-36
lines changed

‎.github/workflows/build-test-release.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,7 @@ jobs:
129129
path: |
130130
test-results-${{ matrix.splunk.version }}
131131
132+
132133
test-splunk-matrix:
133134
needs:
134135
- meta
@@ -149,7 +150,6 @@ jobs:
149150
"splunk_app_cim_broken",
150151
"splunk_fiction_indextime",
151152
"splunk_fiction_indextime_broken",
152-
"splunk_fiction_indextime_wrong_hec_token",
153153
"splunk_setup_fixture",
154154
"splunk_app_req",
155155
"splunk_app_req_broken",

‎pytest_splunk_addon/data_models/Intrusion_Detection.json

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,6 @@
2323
"name": "dest",
2424
"type": "conditional",
2525
"condition": "ids_type=\"network\"",
26-
"validity": "case(in(upper(transport), \"HOPOPT\", \"ICMP\", \"IGMP\", \"GGP\", \"IP-IN-IP\", \"ST\", \"TCP\", \"CBT\", \"EGP\", \"IGP\", \"BBN-RCC-MON\", \"NVP-II\", \"PUP\", \"ARGUS\", \"EMCON\", \"XNET\", \"CHAOS\", \"UDP\", \"MUX\", \"DCN-MEAS\", \"HMP\", \"PRM\", \"XNS-ID\", \"TRUNK-1\", \"TRUNK-2\", \"LEAF-1\", \"LEAF-2\", \"RDP\", \"IRTP\", \"ISO-TP4\", \"NETBLT\", \"MFE-NSP\", \"MERIT-INP\", \"DCCP\", \"3CP\", \"IDPR\", \"XTP\", \"DDP\", \"IDPR-CMTP\", \"TP++\", \"IL\", \"IPV6\", \"SDRP\", \"IPV6-ROUTE\", \"IPV6-FRAG\", \"IDRP\", \"RSVP\", \"GRES\", \"DSR\", \"BNA\", \"ESP\", \"AH\", \"I-NLSP\", \"SWIPE\", \"NARP\", \"MOBILE\", \"TLSP\", \"SKIP\", \"IPV6-ICMP\", \"IPC6-NONXT\", \"IPV6-OPTS\", \"CFTP\", \"SAT-EXPAK\", \"KRYPTOLAN\", \"RVD\", \"IPPC\", \"SAT-MON\", \"VISA\", \"IPCU\", \"CPNX\", \"CPHB\", \"WSN\", \"PVP\", \"BR-SAT-MON\", \"SUN-ND\", \"WB-MON\", \"WB-EXPAK\", \"ISO-IP\", \"VMTP\", \"SECURE-VMTP\", \"VINES\", \"TTP\", \"IPTM\", \"NSFNET-IGP\", \"DGP\", \"TCF\", \"EIGRP\", \"OSPF\", \"SPRITE-RPC\", \"LARP\", \"MTP\", \"AX.25\", \"OS\", \"MICP\", \"SCC-SP\", \"ETHERIP\", \"ENCAP\", \"GMTP\", \"IFMP\", \"PNNI\", \"PIM\", \"ARIS\", \"SCPS\", \"QNX\", \"A/N\", \"IPCOMP\", \"SNP\", \"COMPAQ-PEER\", \"IPX-IN-IP\", \"VRRP\", \"PGM\", \"L2TP\", \"DDX\", \"IATP\", \"STP\", \"SRP\", \"UTI\", \"SMP\", \"SM\", \"PTP\", \"IS-IS OVER IPV4\", \"FIRE\", \"CRTP\", \"CRUDP\", \"SSCOPMCE\", \"IPLT\", \"SPS\", \"PIPE\", \"SCTP\", \"FC\", \"RSVP-E2E-IGNORE\", \"MOBILITY HEADER\", \"UDPLITE\", \"MPLS-IN-IP\", \"MANET\", \"HIP\", \"SHIM6\", \"WESP\", \"ROHC\", \"ETHERNET\"), if(match(dest,\"(?:(?:::ffff:)|(?:[0-9a-fA-F]{1,4}:){6}ffff:)\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|(?>([a-f0-9]{1,4})(?>:(?1)){7}|(?!(?:.[a-f0-9](?>:|$)){8,})^((?1)(?>:(?1)){0,6})?::(?2)?(?!(?:.*[a-f0-9](?>:|$))))|(?>(?>(?1)(?>:(?1)){5}:|(?!(?:.*[a-f0-9]:){6,})(?3)?::(?>((?1)(?>:(?1)){0,4}):)?)?(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?>\\.(?4)){3})\"), dest, null()), match(dest,\"^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$\"), dest, true(), null())",
2726
"comment": "The destination of the attack detected by the intrusion detection system (IDS). You can alias this from more specific fields not included in this data model, such as dest_host, dest_ip, or dest_name."
2827
},
2928
{
@@ -76,7 +75,6 @@
7675
"name": "src",
7776
"type": "conditional",
7877
"condition": "ids_type=\"network\"",
79-
"validity": "case(in(upper(transport), \"HOPOPT\", \"ICMP\", \"IGMP\", \"GGP\", \"IP-IN-IP\", \"ST\", \"TCP\", \"CBT\", \"EGP\", \"IGP\", \"BBN-RCC-MON\", \"NVP-II\", \"PUP\", \"ARGUS\", \"EMCON\", \"XNET\", \"CHAOS\", \"UDP\", \"MUX\", \"DCN-MEAS\", \"HMP\", \"PRM\", \"XNS-ID\", \"TRUNK-1\", \"TRUNK-2\", \"LEAF-1\", \"LEAF-2\", \"RDP\", \"IRTP\", \"ISO-TP4\", \"NETBLT\", \"MFE-NSP\", \"MERIT-INP\", \"DCCP\", \"3CP\", \"IDPR\", \"XTP\", \"DDP\", \"IDPR-CMTP\", \"TP++\", \"IL\", \"IPV6\", \"SDRP\", \"IPV6-ROUTE\", \"IPV6-FRAG\", \"IDRP\", \"RSVP\", \"GRES\", \"DSR\", \"BNA\", \"ESP\", \"AH\", \"I-NLSP\", \"SWIPE\", \"NARP\", \"MOBILE\", \"TLSP\", \"SKIP\", \"IPV6-ICMP\", \"IPC6-NONXT\", \"IPV6-OPTS\", \"CFTP\", \"SAT-EXPAK\", \"KRYPTOLAN\", \"RVD\", \"IPPC\", \"SAT-MON\", \"VISA\", \"IPCU\", \"CPNX\", \"CPHB\", \"WSN\", \"PVP\", \"BR-SAT-MON\", \"SUN-ND\", \"WB-MON\", \"WB-EXPAK\", \"ISO-IP\", \"VMTP\", \"SECURE-VMTP\", \"VINES\", \"TTP\", \"IPTM\", \"NSFNET-IGP\", \"DGP\", \"TCF\", \"EIGRP\", \"OSPF\", \"SPRITE-RPC\", \"LARP\", \"MTP\", \"AX.25\", \"OS\", \"MICP\", \"SCC-SP\", \"ETHERIP\", \"ENCAP\", \"GMTP\", \"IFMP\", \"PNNI\", \"PIM\", \"ARIS\", \"SCPS\", \"QNX\", \"A/N\", \"IPCOMP\", \"SNP\", \"COMPAQ-PEER\", \"IPX-IN-IP\", \"VRRP\", \"PGM\", \"L2TP\", \"DDX\", \"IATP\", \"STP\", \"SRP\", \"UTI\", \"SMP\", \"SM\", \"PTP\", \"IS-IS OVER IPV4\", \"FIRE\", \"CRTP\", \"CRUDP\", \"SSCOPMCE\", \"IPLT\", \"SPS\", \"PIPE\", \"SCTP\", \"FC\", \"RSVP-E2E-IGNORE\", \"MOBILITY HEADER\", \"UDPLITE\", \"MPLS-IN-IP\", \"MANET\", \"HIP\", \"SHIM6\", \"WESP\", \"ROHC\", \"ETHERNET\"), if(match(src,\"(?:(?:::ffff:)|(?:[0-9a-fA-F]{1,4}:){6}ffff:)\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|(?>([a-f0-9]{1,4})(?>:(?1)){7}|(?!(?:.[a-f0-9](?>:|$)){8,})^((?1)(?>:(?1)){0,6})?::(?2)?(?!(?:.*[a-f0-9](?>:|$))))|(?>(?>(?1)(?>:(?1)){5}:|(?!(?:.*[a-f0-9]:){6,})(?3)?::(?>((?1)(?>:(?1)){0,4}):)?)?(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?>\\.(?4)){3})\"), src, null()), match(src,\"^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$\"), src, true(), null())",
8078
"comment": "The source involved in the attack detected by the IDS. You can alias this from more specific fields not included in this data model, such as src_host, src_ip, or src_name."
8179
},
8280
{

‎pytest_splunk_addon/data_models/Network_Resolution.json

Lines changed: 92 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,6 @@
3838
{
3939
"name": "dest",
4040
"type": "required",
41-
"validity": "case(in(upper(transport), \"TCP\", \"UDP\"), if(match(dest,\"(?:(?:::ffff:)|(?:[0-9a-fA-F]{1,4}:){6}ffff:)\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|(?>([a-f0-9]{1,4})(?>:(?1)){7}|(?!(?:.[a-f0-9](?>:|$)){8,})^((?1)(?>:(?1)){0,6})?::(?2)?(?!(?:.*[a-f0-9](?>:|$))))|(?>(?>(?1)(?>:(?1)){5}:|(?!(?:.*[a-f0-9]:){6,})(?3)?::(?>((?1)(?>:(?1)){0,4}):)?)?(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?>\\.(?4)){3})\"), dest, null()), match(dest,\"^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$\"), dest, true(), null())",
4241
"comment": "The destination of the network resolution event. You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name."
4342
},
4443
{
@@ -83,12 +82,100 @@
8382
"type": "required",
8483
"expected_values": [
8584
"A",
86-
"DNAME",
87-
"MX",
8885
"NS",
89-
"PTR"
86+
"MD",
87+
"MF",
88+
"CNAME",
89+
"SOA",
90+
"MB",
91+
"MG",
92+
"MR",
93+
"NULL",
94+
"WKS",
95+
"PTR",
96+
"HINFO",
97+
"MINFO",
98+
"MX",
99+
"TXT",
100+
"RP",
101+
"AFSDB",
102+
"X25",
103+
"ISDN",
104+
"RT",
105+
"NSAP",
106+
"NSAP-PTR",
107+
"SIG",
108+
"KEY",
109+
"PX",
110+
"GPOS",
111+
"AAAA",
112+
"LOC",
113+
"NXT",
114+
"EID",
115+
"NIMLOC",
116+
"SRV",
117+
"ATMA",
118+
"NAPTR",
119+
"KX",
120+
"CERT",
121+
"A6",
122+
"DNAME",
123+
"SINK",
124+
"OPT",
125+
"APL",
126+
"DS",
127+
"SSHFP",
128+
"IPSECKEY",
129+
"RRSIG",
130+
"NSEC",
131+
"DNSKEY",
132+
"DHCID",
133+
"NSEC3",
134+
"NSEC3PARAM",
135+
"TLSA",
136+
"SMIMEA",
137+
"Unassigned",
138+
"HIP",
139+
"NINFO",
140+
"RKEY",
141+
"TALINK",
142+
"CDS",
143+
"CDNSKEY",
144+
"OPENPGPKEY",
145+
"CSYNC",
146+
"ZONEMD",
147+
"SVCB",
148+
"HTTPS",
149+
"SPF",
150+
"UINFO",
151+
"UID",
152+
"GID",
153+
"UNSPEC",
154+
"NID",
155+
"L32",
156+
"L64",
157+
"LP",
158+
"EUI48",
159+
"EUI64",
160+
"TKEY",
161+
"TSIG",
162+
"IXFR",
163+
"AXFR",
164+
"MAILB",
165+
"MAILA",
166+
"*",
167+
"URI",
168+
"CAA",
169+
"AVC",
170+
"DOA",
171+
"AMTRELAY",
172+
"RESINFO",
173+
"TA",
174+
"DLV",
175+
"Private use",
176+
"Reserved"
90177
],
91-
"comment": "The DNS resource record type. For details, see the List of DNS record types on Wikipedia."
178+
"comment": "The DNS resource record type. For details, see the List of DNS record types on Internet Assigned Numbers Authority (IANA) web site."
92179
},
93180
{
94181
"name": "reply_code",
@@ -151,7 +238,6 @@
151238
{
152239
"name": "src",
153240
"type": "required",
154-
"validity": "case(in(upper(transport), \"TCP\", \"UDP\"), if(match(src,\"(?:(?:::ffff:)|(?:[0-9a-fA-F]{1,4}:){6}ffff:)\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|(?>([a-f0-9]{1,4})(?>:(?1)){7}|(?!(?:.[a-f0-9](?>:|$)){8,})^((?1)(?>:(?1)){0,6})?::(?2)?(?!(?:.*[a-f0-9](?>:|$))))|(?>(?>(?1)(?>:(?1)){5}:|(?!(?:.*[a-f0-9]:){6,})(?3)?::(?>((?1)(?>:(?1)){0,4}):)?)?(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?>\\.(?4)){3})\"), src, null()), match(src,\"^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$\"), src, true(), null())",
155241
"comment": "The source of the network resolution event. You can alias this from more specific fields, such as src_host, src_ip, or src_name."
156242
},
157243
{

‎pytest_splunk_addon/data_models/Network_Traffic.json

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,6 @@
5353
{
5454
"name": "dest",
5555
"type": "required",
56-
"validity": "case(in(upper(transport), \"HOPOPT\", \"ICMP\", \"IGMP\", \"GGP\", \"IP-IN-IP\", \"ST\", \"TCP\", \"CBT\", \"EGP\", \"IGP\", \"BBN-RCC-MON\", \"NVP-II\", \"PUP\", \"ARGUS\", \"EMCON\", \"XNET\", \"CHAOS\", \"UDP\", \"MUX\", \"DCN-MEAS\", \"HMP\", \"PRM\", \"XNS-ID\", \"TRUNK-1\", \"TRUNK-2\", \"LEAF-1\", \"LEAF-2\", \"RDP\", \"IRTP\", \"ISO-TP4\", \"NETBLT\", \"MFE-NSP\", \"MERIT-INP\", \"DCCP\", \"3CP\", \"IDPR\", \"XTP\", \"DDP\", \"IDPR-CMTP\", \"TP++\", \"IL\", \"IPV6\", \"SDRP\", \"IPV6-ROUTE\", \"IPV6-FRAG\", \"IDRP\", \"RSVP\", \"GRES\", \"DSR\", \"BNA\", \"ESP\", \"AH\", \"I-NLSP\", \"SWIPE\", \"NARP\", \"MOBILE\", \"TLSP\", \"SKIP\", \"IPV6-ICMP\", \"IPC6-NONXT\", \"IPV6-OPTS\", \"CFTP\", \"SAT-EXPAK\", \"KRYPTOLAN\", \"RVD\", \"IPPC\", \"SAT-MON\", \"VISA\", \"IPCU\", \"CPNX\", \"CPHB\", \"WSN\", \"PVP\", \"BR-SAT-MON\", \"SUN-ND\", \"WB-MON\", \"WB-EXPAK\", \"ISO-IP\", \"VMTP\", \"SECURE-VMTP\", \"VINES\", \"TTP\", \"IPTM\", \"NSFNET-IGP\", \"DGP\", \"TCF\", \"EIGRP\", \"OSPF\", \"SPRITE-RPC\", \"LARP\", \"MTP\", \"AX.25\", \"OS\", \"MICP\", \"SCC-SP\", \"ETHERIP\", \"ENCAP\", \"GMTP\", \"IFMP\", \"PNNI\", \"PIM\", \"ARIS\", \"SCPS\", \"QNX\", \"A/N\", \"IPCOMP\", \"SNP\", \"COMPAQ-PEER\", \"IPX-IN-IP\", \"VRRP\", \"PGM\", \"L2TP\", \"DDX\", \"IATP\", \"STP\", \"SRP\", \"UTI\", \"SMP\", \"SM\", \"PTP\", \"IS-IS OVER IPV4\", \"FIRE\", \"CRTP\", \"CRUDP\", \"SSCOPMCE\", \"IPLT\", \"SPS\", \"PIPE\", \"SCTP\", \"FC\", \"RSVP-E2E-IGNORE\", \"MOBILITY HEADER\", \"UDPLITE\", \"MPLS-IN-IP\", \"MANET\", \"HIP\", \"SHIM6\", \"WESP\", \"ROHC\", \"ETHERNET\"), if(match(dest,\"(?:(?:::ffff:)|(?:[0-9a-fA-F]{1,4}:){6}ffff:)\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|(?>([a-f0-9]{1,4})(?>:(?1)){7}|(?!(?:.[a-f0-9](?>:|$)){8,})^((?1)(?>:(?1)){0,6})?::(?2)?(?!(?:.*[a-f0-9](?>:|$))))|(?>(?>(?1)(?>:(?1)){5}:|(?!(?:.*[a-f0-9]:){6,})(?3)?::(?>((?1)(?>:(?1)){0,4}):)?)?(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?>\\.(?4)){3})\"), dest, null()), match(dest,\"^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$\"), dest, true(), null())",
5756
"comment": "The destination of the network traffic (the remote host). You can alias this from more specific fields, such as dest_host, dest_ip, or dest_name."
5857
},
5958
{
@@ -198,7 +197,6 @@
198197
{
199198
"name": "src",
200199
"type": "required",
201-
"validity": "case(in(upper(transport), \"HOPOPT\", \"ICMP\", \"IGMP\", \"GGP\", \"IP-IN-IP\", \"ST\", \"TCP\", \"CBT\", \"EGP\", \"IGP\", \"BBN-RCC-MON\", \"NVP-II\", \"PUP\", \"ARGUS\", \"EMCON\", \"XNET\", \"CHAOS\", \"UDP\", \"MUX\", \"DCN-MEAS\", \"HMP\", \"PRM\", \"XNS-ID\", \"TRUNK-1\", \"TRUNK-2\", \"LEAF-1\", \"LEAF-2\", \"RDP\", \"IRTP\", \"ISO-TP4\", \"NETBLT\", \"MFE-NSP\", \"MERIT-INP\", \"DCCP\", \"3CP\", \"IDPR\", \"XTP\", \"DDP\", \"IDPR-CMTP\", \"TP++\", \"IL\", \"IPV6\", \"SDRP\", \"IPV6-ROUTE\", \"IPV6-FRAG\", \"IDRP\", \"RSVP\", \"GRES\", \"DSR\", \"BNA\", \"ESP\", \"AH\", \"I-NLSP\", \"SWIPE\", \"NARP\", \"MOBILE\", \"TLSP\", \"SKIP\", \"IPV6-ICMP\", \"IPC6-NONXT\", \"IPV6-OPTS\", \"CFTP\", \"SAT-EXPAK\", \"KRYPTOLAN\", \"RVD\", \"IPPC\", \"SAT-MON\", \"VISA\", \"IPCU\", \"CPNX\", \"CPHB\", \"WSN\", \"PVP\", \"BR-SAT-MON\", \"SUN-ND\", \"WB-MON\", \"WB-EXPAK\", \"ISO-IP\", \"VMTP\", \"SECURE-VMTP\", \"VINES\", \"TTP\", \"IPTM\", \"NSFNET-IGP\", \"DGP\", \"TCF\", \"EIGRP\", \"OSPF\", \"SPRITE-RPC\", \"LARP\", \"MTP\", \"AX.25\", \"OS\", \"MICP\", \"SCC-SP\", \"ETHERIP\", \"ENCAP\", \"GMTP\", \"IFMP\", \"PNNI\", \"PIM\", \"ARIS\", \"SCPS\", \"QNX\", \"A/N\", \"IPCOMP\", \"SNP\", \"COMPAQ-PEER\", \"IPX-IN-IP\", \"VRRP\", \"PGM\", \"L2TP\", \"DDX\", \"IATP\", \"STP\", \"SRP\", \"UTI\", \"SMP\", \"SM\", \"PTP\", \"IS-IS OVER IPV4\", \"FIRE\", \"CRTP\", \"CRUDP\", \"SSCOPMCE\", \"IPLT\", \"SPS\", \"PIPE\", \"SCTP\", \"FC\", \"RSVP-E2E-IGNORE\", \"MOBILITY HEADER\", \"UDPLITE\", \"MPLS-IN-IP\", \"MANET\", \"HIP\", \"SHIM6\", \"WESP\", \"ROHC\", \"ETHERNET\"), if(match(src,\"(?:(?:::ffff:)|(?:[0-9a-fA-F]{1,4}:){6}ffff:)\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}|(?>([a-f0-9]{1,4})(?>:(?1)){7}|(?!(?:.[a-f0-9](?>:|$)){8,})^((?1)(?>:(?1)){0,6})?::(?2)?(?!(?:.*[a-f0-9](?>:|$))))|(?>(?>(?1)(?>:(?1)){5}:|(?!(?:.*[a-f0-9]:){6,})(?3)?::(?>((?1)(?>:(?1)){0,4}):)?)?(25[0-5]|2[0-4][0-9]|1[0-9]{2}|[1-9]?[0-9])(?>\\.(?4)){3})\"), src, null()), match(src,\"^([0-9A-Fa-f]{2}[:-]){5}([0-9A-Fa-f]{2})$\"), src, true(), null())",
202200
"comment": "The source of the network traffic (the client requesting the connection). You can alias this from more specific fields, such as src_host, src_ip, or src_name.'"
203201
},
204202
{

‎pytest_splunk_addon/fields_tests/test_generator.py

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -250,17 +250,19 @@ def generate_requirements_tests(self):
250250
}
251251

252252
cim_fields = event.requirement_test_data.get("cim_fields", {})
253+
other_fields = event.requirement_test_data.get("other_fields", {})
254+
requirement_fields = {**cim_fields, **other_fields}
253255

254-
if cim_fields:
255-
cim_fields = {
256+
if requirement_fields:
257+
requirement_fields = {
256258
field: value
257-
for field, value in cim_fields.items()
259+
for field, value in requirement_fields.items()
258260
if field not in exceptions
259261
}
260262
yield pytest.param(
261263
{
262264
"escaped_event": escaped_event,
263-
"fields": cim_fields,
265+
"fields": requirement_fields,
264266
"modinput_params": modinput_params,
265267
},
266268
id=f"sample_name::{event.sample_name}::host::{event.metadata.get('host')}",

‎pytest_splunk_addon/plugin.py

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -26,8 +26,6 @@
2626

2727
test_generator = None
2828

29-
EXC_MAP = [Exception]
30-
3129

3230
def pytest_configure(config):
3331
"""
@@ -122,7 +120,6 @@ def pytest_sessionstart(session):
122120
SampleXdistGenerator.tokenized_event_source = session.config.getoption(
123121
"tokenized_event_source"
124122
).lower()
125-
session.__exc_limits = EXC_MAP
126123
if (
127124
SampleXdistGenerator.tokenized_event_source == "store_new"
128125
and session.config.getoption("ingest_events").lower()
@@ -212,14 +209,3 @@ def init_pytest_splunk_addon_logger():
212209

213210
init_pytest_splunk_addon_logger()
214211
LOGGER = logging.getLogger("pytest-splunk-addon")
215-
216-
217-
def pytest_exception_interact(node, call, report):
218-
"""
219-
Hook called when an exception is raised during a test.
220-
If the number of occurrences for a specific exception exceeds the limit in session.__exc_limits, pytest exits
221-
https://docs.pytest.org/en/stable/reference/reference.html#pytest.hookspec.pytest_exception_interact
222-
"""
223-
if call.excinfo.type in node.session.__exc_limits:
224-
# pytest exits only for exceptions defined in EXC_MAP
225-
pytest.exit(f"Exiting pytest due to: {call.excinfo.type}")

‎pytest_splunk_addon/sample_generation/sample_stanza.py

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -398,6 +398,16 @@ def populate_requirement_test_data(event):
398398
"""
399399
requirement_test_data = {}
400400
cim = event.get("cim")
401+
other_mappings = event.get("other_mappings")
402+
if other_mappings:
403+
other_fields = {}
404+
fields = other_mappings["field"]
405+
if type(fields) == list:
406+
for field in fields:
407+
other_fields[field["@name"]] = field["@value"]
408+
elif type(fields) == dict:
409+
other_fields[fields["@name"]] = fields["@value"]
410+
requirement_test_data["other_fields"] = other_fields
401411
if cim:
402412
requirement_test_data["cim_version"] = cim.get("@version", "latest")
403413
requirement_test_data["datamodels"] = cim.get("models") or {}

‎pytest_splunk_addon/splunk.py

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -979,7 +979,7 @@ def is_responsive_hec(request, splunk):
979979
f'{request.config.getoption("splunk_hec_scheme")}://{splunk["forwarder_host"]}:{splunk["port_hec"]}/services/collector/health/1.0',
980980
verify=False,
981981
)
982-
LOGGER.debug("Status code: {}".format(response.status_code))
982+
LOGGER.debug("Status code: %d", response.status_code)
983983
if response.status_code in (200, 201):
984984
LOGGER.info("Splunk HEC is responsive.")
985985
return True
@@ -1040,7 +1040,8 @@ def is_valid_hec(request, splunk):
10401040
data={"event": "test_hec", "sourcetype": "hec_token_test"},
10411041
verify=False,
10421042
)
1043-
LOGGER.debug("Status code: {}".format(response.status_code))
1043+
LOGGER.debug("Status code: %d", response.status_code)
1044+
10441045
if response.status_code == 200:
10451046
LOGGER.info("Splunk HEC is valid.")
10461047
else:

‎tests/e2e/addons/TA_req_broken/samples/sample_modinput.xml

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -102,4 +102,32 @@
102102
</missing_recommended_fields>
103103
</cim>
104104
</event>
105+
<event code="" name="WrongFieldValueOtherMappings" format="">
106+
<transport type="modinput" sourcetype="test:data:1" source="test_data.1" host="so1"/>
107+
<source>
108+
<jira id=""/>
109+
<comment>lab</comment>
110+
</source>
111+
<raw>
112+
<![CDATA[2021-12-31 15:15:30,340+0000 action=success app=psa user=admin status=success dest=10.0.0.1 src=10.0.0.2]]></raw>
113+
<cim>
114+
<models>
115+
<model>Authentication</model>
116+
</models>
117+
<cim_fields>
118+
<field name="action" value="success"/>
119+
<field name="status" value="success"/>
120+
<field name="app" value="psa"/>
121+
<field name="src" value="10.0.0.2"/>
122+
<field name="user" value="admin"/>
123+
<field name="dest" value="10.0.0.1"/>
124+
</cim_fields>
125+
<missing_recommended_fields>
126+
<field>src_user</field>
127+
</missing_recommended_fields>
128+
</cim>
129+
<other_mappings>
130+
<field name="vendor_product" value="PSA"/>
131+
</other_mappings>
132+
</event>
105133
</device>

‎tests/e2e/addons/TA_transition_from_req/default/props.conf

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,5 @@ FIELDALIAS-action = result AS action
1010
EVAL-app = "psa"
1111
FIELDALIAS-user = tester AS user
1212
FIELDALIAS-src = ip AS src
13-
EVAL-status = case(action=="success", "PASS", action=="failure", "FAIL", 0==0, "OTHER")
13+
EVAL-status = case(action=="success", "PASS", action=="failure", "FAIL", 0==0, "OTHER")
14+
EVAL-vendor_product = "Pytest Splunk Addon"

‎tests/e2e/addons/TA_transition_from_req/samples/sample_modinput.xml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,5 +26,8 @@
2626
<field>src_user</field>
2727
</missing_recommended_fields>
2828
</cim>
29+
<other_mappings>
30+
<field name="vendor_product" value="Pytest Splunk Addon"/>
31+
</other_mappings>
2932
</event>
3033
</device>

0 commit comments

Comments
 (0)