Windows 4659 events tests #648

Molter73 · 2020-04-07T10:43:37Z

Related issue
#642

Description

The added tests verify that Windows events with ID 4659 generate deleted events correctly.

In order to test this condition, the tests create a number of files and later deletes them by using the Windows del command interactively.

Results

tests/integration/test_fim/test_basic_usage/test_basic_usage_deferred_delete_folder.py

Fix some styling problems on test_basic_usage_deferred_delete_folder.py to comply with the stablished guidelines.

…d-delete

jesusjimsa

LGTM!

juliamagan

GJ, but some changes are required

juliamagan · 2021-09-06T11:41:24Z

tests/integration/test_fim/test_basic_usage/test_basic_usage_deferred_delete_folder.py

+# configurations
+
+conf_params = {'TEST_DIRECTORIES': directory_str, 'MODULE_NAME': __name__}
+p, m = generate_params(extra_params=conf_params, modes=['whodata'])


Variables with a single letter are not allowed, they should have descriptive names as parameters and metadata

juliamagan · 2021-09-06T11:44:34Z

tests/integration/test_fim/test_basic_usage/test_basic_usage_deferred_delete_folder.py

+# callback
+def callback_detect_delete_event(line):
+    msg = r'.*Sending FIM event: (.+)$'
+    match = re.match(msg, line)
+
+    try:
+        event = json.loads(match.group(1))
+        if (event['type'] == 'event' and
+                event['data']['type'] == 'deleted' and
+                'process_name' not in event['data']['audit']):
+            return event
+    except (AttributeError, JSONDecodeError, KeyError):
+        pass
+
+    return None


A callback is a generic function, it should be placed in a common library as fim.py

juliamagan · 2021-09-07T08:16:07Z

tests/integration/test_fim/test_basic_usage/test_basic_usage_deferred_delete_folder.py

+    confirmation = re.search(r'\((\w)\/\w\)\?', stdout[0])
+    assert confirmation
+
+    # Run the command again and this time delete the files


Instead of this time delete the files, we could comment confirm deletion of files

…eferred-delete

Fix some styling problems on test_basic_usage_deferred_delete_folder.py to comply with the stablished guidelines.

CamiRomero · 2021-11-25T15:14:14Z

This PR is outdated, we work with this in a temporal branch tmp-642-windows-deferred-delete, where we update the test implemented here and applied a rebase of the stable tests from 2040-4.3-full-green branch.

I attached some details about the package used and executions.

Package Details

Version	Path
4.3.0	https://packages-dev.wazuh.com/staging/windows/wazuh-agent-4.3.0-0.40302.20211112.msi

The test execution results are:

Windows	Jenkins	Notes
R1	🔴

…. Some style changes

jotacarma90 · 2021-11-26T10:34:36Z

After analyzing the problem, I have found that it is no longer necessary to check in this test that the process_name field does not appear, since the fix that has been given to this bug has finally been different from what was thought at first.
I have modified the callback that detects the deletion event so that it simply looks for a normal deletion.
PR ready for review!

CamiRomero · 2021-11-26T17:38:44Z

Jenkins branch	QA branch
4.3	642-windows-deferred-delete

Packages details

Type	Format	Architecture	Version	File name
Agent	Windows	x86_64	4.3.0	wazuh-agent-4.3.0-0.40302.20211112.msi

local_internal_options.conf

Agent

syscheck.debug=2
agent.debug=2
monitord.rotate_log=0
windows.debug=2

Windows Agent	Type	Status
Test Execution 1	Jenkins	🟢

CamiRomero · 2021-11-30T12:53:45Z

Jenkins branch	QA branch
4.3	642-windows-deferred-delete

Packages details

Type	Format	Version	File name
Agent	Windows	4.3.0	wazuh-agent-4.3.0-0.2204.msi
Agent	Solaris	4.3.0	wazuh-agent_v4.3.0-0.2204-sol11-i386.p5p
Agent	Macos	4.3.0	wazuh-agent-4.3.0-0.2204.pkg
Agent	Centos	4.3.0	wazuh-agent-4.3.0-0.2204.x86_64.rpm
Manager	Centos	4.3.0	wazuh-manager-4.3.0-0.2204.x86_64.rpm

local_internal_options.conf

Agent Windows

syscheck.debug=2
agent.debug=2
monitord.rotate_log=0
windows.debug=2

Agent Centos, macos, solaris

syscheck.debug=2
agent.debug=2
monitord.rotate_log=0

Manager

syscheck.debug=2
analysisd.debug=2
monitord.rotate_log=0

Test Results

OS	Type	Status	Notes
Centos Manager	Jenkins	🟢
Centos Manager	Jenkins	🟢
Centos Manager	Jenkins	🟢
Windows Agent	Jenkins	🟢
Windows Agent	Jenkins	🟢
Windows Agent	Jenkins	🟢
Windows Agent	Jenkins	🔴	test windows-deferred has passed but there are flaky tests according to the issue #1836
Windows Agent	Jenkins	🔴	test windows-deferred has passed but there are flaky tests according to the issue #1836
Centos Agent	Jenkins	🟢
Centos Agent	Jenkins	🟢
Centos Agent	Jenkins	🟢
Macos Agent	Jenkins	🟢
Macos Agent	Jenkins	🟢
Macos Agent	Jenkins	🟢
Solaris Agent	Jenkins	🟢
Solaris Agent	Jenkins	🟢
Solaris Agent	Jenkins	🟢

snaow · 2021-11-30T22:40:51Z

Try not to use hardcoded Popen and command execution within the test, better to create a framework function.

Add integration test for windows 4659 events

267d484

Molter73 requested a review from bah07 April 7, 2020 10:43

Molter73 linked an issue Apr 7, 2020 that may be closed by this pull request

FIM System Tests: Windows EventID 4659 #642

Closed

bah07 added the FIM label Apr 15, 2020

bah07 modified the milestone: Sprint 110 - Core Apr 15, 2020

jotacarma90 added core/fim and removed FIM labels Apr 20, 2020

jesusjimsa self-requested a review April 29, 2020 11:27

jesusjimsa suggested changes Apr 29, 2020

View reviewed changes

Molter73 requested a review from jesusjimsa April 29, 2020 13:33

jesusjimsa suggested changes Apr 29, 2020

View reviewed changes

tests/integration/test_fim/test_basic_usage/test_basic_usage_deferred_delete_folder.py Outdated Show resolved Hide resolved

tests/integration/test_fim/test_basic_usage/test_basic_usage_deferred_delete_folder.py Outdated Show resolved Hide resolved

Fix styling problems

08e2c49

Fix some styling problems on test_basic_usage_deferred_delete_folder.py to comply with the stablished guidelines.

Molter73 force-pushed the 642-windows-deferred-delete branch from a353fbd to 08e2c49 Compare April 29, 2020 15:03

Merge remote-tracking branch 'origin/master' into 642-windows-deferre…

a2cc1f7

…d-delete

Molter73 requested a review from jesusjimsa April 29, 2020 15:08

jesusjimsa previously approved these changes Apr 30, 2020

View reviewed changes

BraulioV force-pushed the master branch from c83b574 to eef3b5b Compare April 8, 2021 08:00

juliamagan requested review from juliamagan and removed request for bah07 September 6, 2021 11:32

juliamagan requested changes Sep 7, 2021

View reviewed changes

Rebits requested a review from fedepacher October 15, 2021 14:02

Rebits assigned fedepacher Oct 15, 2021

Merge branch 'master' of github.com:wazuh/wazuh-qa into 642-windows-d…

dba293e

…eferred-delete

damarisg mentioned this pull request Nov 15, 2021

FIM Review: Windows 4659 events tests #2219

Closed

4 tasks

Molter73 and others added 4 commits November 24, 2021 08:39

Add integration test for windows 4659 events

e469a6c

Fix styling problems

99a272d

Fix some styling problems on test_basic_usage_deferred_delete_folder.py to comply with the stablished guidelines.

move test basic usage deferred delete folder to basic usage folder

112d6df

Changed fixture

c23f7e6

Moved callback to fim.py and modify it to detect normal deleted event…

61fd31d

…. Some style changes

jotacarma90 dismissed jesusjimsa’s stale review via 61fd31d November 26, 2021 10:31

jotacarma90 force-pushed the 642-windows-deferred-delete branch from dba293e to 61fd31d Compare November 26, 2021 10:31

jotacarma90 requested a review from juliamagan November 26, 2021 10:34

jotacarma90 changed the base branch from master to 2040-4.3-full-green November 26, 2021 10:50

damarisg assigned jotacarma90 and unassigned fedepacher Nov 26, 2021

damarisg requested review from CamiRomero and removed request for fedepacher November 26, 2021 11:22

CamiRomero added 2 commits November 29, 2021 00:09

deleted comment

28515b2

Deleted old path

f000301

damarisg approved these changes Nov 30, 2021

View reviewed changes

Base automatically changed from 2040-4.3-full-green to master November 30, 2021 22:34

snaow merged commit 9f8a14c into master Nov 30, 2021

snaow deleted the 642-windows-deferred-delete branch November 30, 2021 22:40

snaow mentioned this pull request Jan 27, 2022

QA Release - Rev 430031 #2500

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Windows 4659 events tests #648

Windows 4659 events tests #648

Molter73 commented Apr 7, 2020

jesusjimsa left a comment

juliamagan left a comment

juliamagan Sep 6, 2021

jotacarma90 Nov 26, 2021

juliamagan Sep 6, 2021

jotacarma90 Nov 26, 2021

juliamagan Sep 7, 2021

jotacarma90 Nov 26, 2021

CamiRomero commented Nov 25, 2021 •

edited

Loading

jotacarma90 commented Nov 26, 2021

CamiRomero commented Nov 26, 2021

CamiRomero commented Nov 30, 2021 •

edited by damarisg

Loading

snaow commented Nov 30, 2021

Windows 4659 events tests #648

Windows 4659 events tests #648

Conversation

Molter73 commented Apr 7, 2020

Description

Results

jesusjimsa left a comment

Choose a reason for hiding this comment

juliamagan left a comment

Choose a reason for hiding this comment

juliamagan Sep 6, 2021

Choose a reason for hiding this comment

jotacarma90 Nov 26, 2021

Choose a reason for hiding this comment

juliamagan Sep 6, 2021

Choose a reason for hiding this comment

jotacarma90 Nov 26, 2021

Choose a reason for hiding this comment

juliamagan Sep 7, 2021

Choose a reason for hiding this comment

jotacarma90 Nov 26, 2021

Choose a reason for hiding this comment

CamiRomero commented Nov 25, 2021 • edited Loading

Package Details

jotacarma90 commented Nov 26, 2021

CamiRomero commented Nov 26, 2021

Packages details

local_internal_options.conf

Agent

CamiRomero commented Nov 30, 2021 • edited by damarisg Loading

Packages details

local_internal_options.conf

Agent Windows

Agent Centos, macos, solaris

Manager

Test Results

snaow commented Nov 30, 2021

CamiRomero commented Nov 25, 2021 •

edited

Loading

CamiRomero commented Nov 30, 2021 •

edited by damarisg

Loading