(t *testing.T)
| 423 | } |
| 424 | |
| 425 | func TestAlertAction(t *testing.T) { |
| 426 | require.NoError(t, alertsender.LoadAll([]alertsender.Config{{Type: alertsender.Noop}})) |
| 427 | e := NewEngine(new(ps.SnapshotterMock), newConfig("_fixtures/simple_emit_alert.yml")) |
| 428 | compileRules(t, e) |
| 429 | |
| 430 | evt := &event.Event{ |
| 431 | Type: event.RecvTCPv4, |
| 432 | Name: "Recv", |
| 433 | Tid: 2484, |
| 434 | PID: 859, |
| 435 | Category: event.Net, |
| 436 | PS: &types.PS{ |
| 437 | Name: "cmd.exe", |
| 438 | }, |
| 439 | Params: event.Params{ |
| 440 | params.NetDport: {Name: params.NetDport, Type: params.Uint16, Value: uint16(443)}, |
| 441 | params.NetSport: {Name: params.NetSport, Type: params.Uint16, Value: uint16(43123)}, |
| 442 | params.NetSIP: {Name: params.NetSIP, Type: params.IPv4, Value: net.ParseIP("127.0.0.1")}, |
| 443 | params.NetDIP: {Name: params.NetDIP, Type: params.IPv4, Value: net.ParseIP("216.58.201.174")}, |
| 444 | }, |
| 445 | Metadata: make(map[event.MetadataKey]any), |
| 446 | } |
| 447 | |
| 448 | require.True(t, wrapProcessEvent(evt, e.ProcessEvent)) |
| 449 | time.Sleep(time.Millisecond * 25) |
| 450 | require.NotNil(t, emitAlert) |
| 451 | assert.Equal(t, "match https connections", emitAlert.Title) |
| 452 | assert.Equal(t, "cmd.exe process received data on port 443", emitAlert.Text) |
| 453 | assert.Equal(t, alertsender.Critical, emitAlert.Severity) |
| 454 | assert.Equal(t, []string{"tag1", "tag2"}, emitAlert.Tags) |
| 455 | emitAlert = nil |
| 456 | } |
| 457 | |
| 458 | func TestKillAction(t *testing.T) { |
| 459 | log.SetLevel(log.DebugLevel) |
nothing calls this directly
no test coverage detected