Function TestEventSourceEnableFlagsDynamically

internal/etw/source_test.go:151–229

(t *testing.T)

}

func TestEventSourceEnableFlagsDynamically(t *testing.T) {
	psnap := new(ps.SnapshotterMock)
	psnap.On("Write", mock.Anything).Return(nil)
	psnap.On("AddThread", mock.Anything).Return(nil)
	psnap.On("AddModule", mock.Anything).Return(nil)
	psnap.On("AddMmap", mock.Anything).Return(nil)
	psnap.On("RemoveMmap", mock.Anything, mock.Anything).Return(nil)
	psnap.On("RemoveThread", mock.Anything, mock.Anything).Return(nil)
	psnap.On("RemoveModule", mock.Anything, mock.Anything).Return(nil)
	psnap.On("FindModule", mock.Anything).Return(false, nil)
	psnap.On("FindAndPut", mock.Anything).Return(&pstypes.PS{})
	psnap.On("Find", mock.Anything).Return(true, &pstypes.PS{})
	psnap.On("Remove", mock.Anything).Return(nil)

	hsnap := new(handle.SnapshotterMock)
	hsnap.On("FindByObject", mock.Anything).Return(htypes.Handle{}, false)
	hsnap.On("FindHandles", mock.Anything).Return([]htypes.Handle{}, nil)

	r := &config.RulesCompileResult{
		HasProcEvents:     true,
		HasModuleEvents:   true,
		HasRegistryEvents: true,
		HasNetworkEvents:  true,
		HasFileEvents:     true,
		HasThreadEvents:   false,
		HasVAMapEvents:    true,
		HasAuditAPIEvents: true,
		UsedEvents: []event.Type{
			event.CreateProcess,
			event.LoadModule,
			event.RegCreateKey,
			event.RegSetValue,
			event.CreateFile,
			event.RenameFile,
			event.MapViewFile,
			event.OpenProcess,
			event.ConnectTCPv4,
		},
	}
	cfg := &config.Config{
		EventSource: config.EventSourceConfig{
			EnableThreadEvents:   true,
			EnableRegistryEvents: true,
			EnableModuleEvents:   true,
			EnableFileIOEvents:   true,
			EnableAuditAPIEvents: true,
		},
		Filters: &config.Filters{},
	}

	cfg.EventSource.Init()
	evs := NewEventSource(psnap, hsnap, cfg, r)
	require.NoError(t, evs.Open(cfg))
	defer evs.Close()

	require.Len(t, evs.(*EventSource).traces, 2)

	flags := evs.(*EventSource).traces[1].enableFlagsDynamically(cfg.EventSource)