-
Notifications
You must be signed in to change notification settings - Fork 4.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
{,x-pack/}winlogbeat: resurrect tests for event processing (#31464)
This is a moderately involved change. The process is described in the steps below, but the reader should refer to the commits in the PR to see exactly what was done and when. * port forward semi-processed events for tests This brings partially processed event data from a modified version of the testing code at 8896fd3 (the commit immediately prior to the removal of the javascript processing pipeline in #29435: commit at 2f3b0c5cbe9cfdd10e11fd52e2a259e564001100). The evtx.golden.json files were generated by removing the js processing call at https://github.com/elastic/beats/blob/8896fd319a257f3e0783119a7dd8d0978ef62197/x-pack/winlogbeat/module/testing_windows.go#L132-L135 to match the code in that file as it appears here and then run go test -update in x-pack/winlogbeat/module/{powershell,security,sysmon}/test on a windows 2019 host. The test package for each of the modules is also resurrected with modifications reflecting the loss of the javascript processor. Tests in x-pack/winlogbeat/module/{security,sysmon}/test fail in this commit. * make sure metadata is available for enrichment of raw values This fixes failing tests in x-pack/winlogbeat/module/security/test, but tests in sysmon continue to fail because sysmon-11-filedeletedetected.evtx was added in 33acb3c (2022-01-25) after the origin of the forward port origin (2021-12-02). * update golden file for sysmon-11-filedeletedetected.evtx * ignore opcode field on Windows 2022 Also prohibit generating golden files for PowerShell on Windows 2022 to prevent unnecessary work in discovering that this will fail on other versions. * defer event field filtering until value comparison This will result in additional diff noise if golden values are generated on multiple versions of windows so it may be worth keeping the version used reasonably constant. The version used here was 2019. (cherry picked from commit f22abe3) # Conflicts: # x-pack/winlogbeat/module/security/test/testdata/security-windows2019_4688_Process_Created.evtx.golden.json # x-pack/winlogbeat/module/testing_windows.go
- Loading branch information
1 parent
bdd9e87
commit 4096abb
Showing
110 changed files
with
4,292 additions
and
16,901 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
44 changes: 44 additions & 0 deletions
44
x-pack/winlogbeat/module/powershell/test/powershell_windows_test.go
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| // Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one | ||
| // or more contributor license agreements. Licensed under the Elastic License; | ||
| // you may not use this file except in compliance with the Elastic License. | ||
|
|
||
| package test | ||
|
|
||
| import ( | ||
| "strings" | ||
| "testing" | ||
|
|
||
| "github.com/elastic/beats/v7/x-pack/winlogbeat/module" | ||
| "github.com/elastic/go-sysinfo/providers/windows" | ||
|
|
||
| // Register required processors. | ||
| _ "github.com/elastic/beats/v7/libbeat/cmd/instance" | ||
| _ "github.com/elastic/beats/v7/libbeat/processors/timestamp" | ||
| ) | ||
|
|
||
| // Ignore these fields because they can be different on different versions | ||
| // of windows. | ||
| var ignoreFields = []string{ | ||
| "message", | ||
| } | ||
|
|
||
| func TestPowerShell(t *testing.T) { | ||
| // FIXME: We do not get opcode strings in the XML on Windows 2022, so ignore that | ||
| // field there. Only apply this to that platform to avoid regressions elsewhere. | ||
| // This means that golden values should be generated on a non-2022 version of | ||
| // Windows to ensure that this field is properly rendered. This is checked in | ||
| // the module.TestPipeline function. | ||
| // | ||
| // See https://github.com/elastic/beats/issues/31490 for tracking issue. | ||
| os, err := windows.OperatingSystem() | ||
| if err != nil { | ||
| t.Fatalf("failed to get operating system info: %v", err) | ||
| } | ||
| t.Logf("running tests on %s", os.Name) | ||
| if strings.Contains(os.Name, "2022") { | ||
| ignoreFields = append(ignoreFields, "winlog.opcode") | ||
| t.Log("ignoring winlog.opcode") | ||
| } | ||
|
|
||
| module.TestPipeline(t, "testdata/*.evtx", module.WithFieldFilter(ignoreFields)) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.