File size: 4,219 Bytes
7c89ed7 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 | # This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at https://mozilla.org/MPL/2.0/.
# Copyright (c) 2017 Mozilla Corporation
import copy
from mq.plugins.parse_su import message
session_su = {}
session_su['utctimestamp'] = '2017-08-24T22:49:42+00:00'
session_su['timestamp'] = '2017-08-24T22:49:42+00:00'
session_su['receivedtimestamp'] = '2017-08-24T22:49:42+00:00'
session_su['category'] = 'syslog'
session_su['processid'] = '0'
session_su['severity'] = '7'
session_su['eventsource'] = 'systemlogs'
session_su['hostname'] = 'syslog1.private.scl3.mozilla.com'
session_su['mozdefhostname'] = 'mozdef4.private.scl3.mozilla.com'
session_su['details'] = {}
session_su['details']['program'] = 'su'
session_su['details']['hostname'] = 'irc1.dmz.scl3.mozilla.com'
class TestSuSessionOpenedMessageV1():
def setup(self):
self.msgobj = message()
self.msg = copy.deepcopy(session_su)
self.msg['summary'] = 'pam_unix(su:session): session opened for user user1 by (uid=0)'
def test_onMessage(self):
metadata = {}
(retmessage, retmeta) = self.msgobj.onMessage(self.msg, metadata)
assert retmessage is not None
assert retmeta is not None
assert retmessage['details']['originuser'] is None
assert retmessage['details']['status'] == 'opened'
assert retmessage['details']['uid'] == '0'
assert retmessage['details']['username'] == 'user1'
#
class TestSuSessionOpenedMessageV2():
def setup(self):
self.msgobj = message()
self.msg = copy.deepcopy(session_su)
self.msg['summary'] = 'pam_unix(su:session): session opened for user user2 by user3(uid=0)'
def test_onMessage(self):
metadata = {}
(retmessage, retmeta) = self.msgobj.onMessage(self.msg, metadata)
assert retmessage is not None
assert retmeta is not None
assert retmessage['details']['originuser'] == 'user3'
assert retmessage['details']['status'] == 'opened'
assert retmessage['details']['uid'] == '0'
assert retmessage['details']['username'] == 'user2'
#
class TestSuSessionOpenedMessageV3():
def setup(self):
self.msgobj = message()
self.msg = copy.deepcopy(session_su)
self.msg['summary'] = 'pam_unix(su-l:session): session opened for user user4 by (uid=0)'
def test_onMessage(self):
metadata = {}
(retmessage, retmeta) = self.msgobj.onMessage(self.msg, metadata)
assert retmessage is not None
assert retmeta is not None
assert retmessage['details']['originuser'] is None
assert retmessage['details']['status'] == 'opened'
assert retmessage['details']['uid'] == '0'
assert retmessage['details']['username'] == 'user4'
#
class TestSuSessionOpenedMessageV4():
def setup(self):
self.msgobj = message()
self.msg = copy.deepcopy(session_su)
self.msg['summary'] = 'pam_unix(su-l:session): session opened for user user5 by user6(uid=0)'
def test_onMessage(self):
metadata = {}
(retmessage, retmeta) = self.msgobj.onMessage(self.msg, metadata)
assert retmessage is not None
assert retmeta is not None
assert retmessage['details']['originuser'] == 'user6'
assert retmessage['details']['status'] == 'opened'
assert retmessage['details']['uid'] == '0'
assert retmessage['details']['username'] == 'user5'
#
class TestSuSessionClosedMessageV1():
def setup(self):
self.msgobj = message()
self.msg = copy.deepcopy(session_su)
self.msg['summary'] = 'pam_unix(su:session): session closed for user user7'
def test_onMessage(self):
metadata = {}
(retmessage, retmeta) = self.msgobj.onMessage(self.msg, metadata)
assert retmessage is not None
assert retmeta is not None
assert retmessage['details']['originuser'] is None
assert retmessage['details']['status'] == 'closed'
assert retmessage['details']['uid'] is None
assert retmessage['details']['username'] == 'user7'
|