tests/mq/plugins/test_stackdriver_gceactivity.py

from mozdef_util.utilities.toUTC import toUTC
from mq.plugins.stackdriver_gceactivity import message


class TestStackDriverGCEActivity(object):
    def setup(self):
        self.plugin = message()
        self.metadata = {"index": "events"}

    def test_notags_log(self):
        metadata = {"index": "events"}
        event = {"category": "gceactivity"}

        result, metadata = self.plugin.onMessage(event, metadata)
        # in = out - plugin didn't touch it
        assert result == event

    def test_nocategory_log(self):
        metadata = {"index": "events"}
        event = {"tags": "audit"}

        result, metadata = self.plugin.onMessage(event, metadata)
        # in = out - plugin didn't touch it
        assert result == event

    # Should never match and be modified by the plugin
    def test_wrongtags_log(self):
        metadata = {"index": "events"}
        event = {"tags": "audit", "category": "gceactivity"}

        result, metadata = self.plugin.onMessage(event, metadata)
        # in = out - plugin didn't touch it
        assert result == event

    def verify_metadata(self, metadata):
        assert metadata["index"] == "events"

    def verify_defaults(self, result):
        assert result["category"] == "gceactivity"
        assert toUTC(result["receivedtimestamp"]).isoformat() == result["receivedtimestamp"]

    def test_defaults(self):
        event = {
            'category': 'gceactivity',
            'source': 'stackdriver',
            'tags': ['projects/mcd-001-252615/subscriptions/mozdefsubscription', 'pubsub', 'stackdriver'],
            'receivedtimestamp': '2019-11-22T01:23:49.238723+00:00',
            'timestamp': '2019-11-22T01:23:47.936931+00:00',
            'utctimestamp': '2019-11-22T01:23:47.936931+00:00',
            'mozdefhostname': 'mozdefqa2.private.mdc1.mozilla.com',
            'customendpoint': '',
            'details': {
                'insertId': '1y7iw8ag15tmjpz',
                'jsonPayload': {
                    'actor': {'user': 'luke@or.not'},
                    'event_subtype': 'compute.instances.reset',
                    'event_timestamp_us': '1574385827936931',
                    'event_type': 'GCE_API_CALL',
                    'ip_address': '',
                    'operation': {
                        'id': '2169930274576172620',
                        'name': 'operation-1574385827284-597e543f984be-d1640557-51c07a30',
                        'type': 'operation',
                        'zone': 'us-west2-a',
                    },
                    'request': {
                        'body': 'null',
                        'url': 'https://compute.googleapis.com/compute/v1/projects/mcd-001-252615/zones/us-west2-a/instances/mozdefdevvm1/reset?key=AIzaSyDWUi9T78xEO-m10evQANR7TMSiB_bjyNc',
                    },
                    'resource': {
                        'id': '3401561556013842918',
                        'name': 'mozdefdevvm1',
                        'type': 'instance',
                        'zone': 'us-west2-a',
                    },
                    'trace_id': 'operation-1574385827284-597e543f984be-d1640557-51c07a30',
                    'user_agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0,gzip(gfe),gzip(gfe)',
                    'version': '1.2',
                },
                'labels': {
                    'compute.googleapis.com/resource_id': '3401561556013842918',
                    'compute.googleapis.com/resource_name': 'mozdefdevvm1',
                    'compute.googleapis.com/resource_type': 'instance',
                    'compute.googleapis.com/resource_zone': 'us-west2-a',
                },
                'logName': 'projects/mcd-001-252615/logs/compute.googleapis.com%2Factivity_log',
                'receiveTimestamp': '2019-11-22T01:23:47.988998161Z',
                'resource': {
                    'labels': {
                        'instance_id': '3401561556013842918',
                        'project_id': 'mcd-001-252615',
                        'zone': 'us-west2-a',
                    },
                    'type': 'gce_instance',
                },
                'severity': 'INFO',
                'timestamp': '2019-11-22T01:23:47.936931Z',
            },
        }

        result, metadata = self.plugin.onMessage(event, self.metadata)
        self.verify_defaults(result)
        self.verify_metadata(metadata)

    def test_nomatch_syslog(self):
        event = {
            "category": "syslog",
            "processid": "0",
            "receivedtimestamp": "2017-09-26T00:22:24.210945+00:00",
            "severity": "7",
            "utctimestamp": "2017-09-26T00:22:23+00:00",
            "timestamp": "2017-09-26T00:22:23+00:00",
            "hostname": "something1.test.com",
            "mozdefhostname": "something1.test.com",
            "summary": "Connection from 10.22.74.208 port 9071 on 10.22.74.45 pubsub stackdriver port 22\n",
            "eventsource": "systemslogs",
            "tags": "something",
            "details": {
                "processid": "21233",
                "sourceipv4address": "10.22.74.208",
                "hostname": "hostname1.subdomain.domain.com",
                "program": "sshd",
                "sourceipaddress": "10.22.74.208",
            },
        }
        result, metadata = self.plugin.onMessage(event, self.metadata)
        assert result["category"] == "syslog"
        assert result["eventsource"] == "systemslogs"
        assert result == event

    def test_nomatch_auditd(self):
        event = {
            "category": "execve",
            "processid": "0",
            "receivedtimestamp": "2017-09-26T00:36:27.463745+00:00",
            "severity": "INFO",
            "utctimestamp": "2017-09-26T00:36:27+00:00",
            "tags": ["audisp-json", "2.1.1", "audit"],
            "summary": "Execve: sh -c sudo squid proxy /usr/lib64/nagios/plugins/custom/check_auditd.sh",
            "processname": "audisp-json",
            "details": {
                "fsuid": "398",
                "tty": "(none)",
                "uid": "398",
                "process": "/bin/bash",
                "auditkey": "exec",
                "pid": "10553",
                "processname": "sh",
                "session": "16467",
                "fsgid": "398",
                "sgid": "398",
                "auditserial": "3834716",
                "inode": "1835094",
                "ouid": "0",
                "ogid": "0",
                "suid": "398",
                "originaluid": "0",
                "gid": "398",
                "originaluser": "pubsub",
                "ppid": "10552",
                "cwd": "/",
                "parentprocess": "stackdriver",
                "euid": "398",
                "path": "/bin/sh",
                "rdev": "00:00",
                "dev": "08:03",
                "egid": "398",
                "command": "sh -c sudo /usr/lib64/nagios/plugins/custom/check_auditd.sh",
                "mode": "0100755",
                "user": "squid",
            },
        }
        result, metadata = self.plugin.onMessage(event, self.metadata)
        assert result["category"] == "execve"
        assert "eventsource" not in result
        assert result == event

    def test_stackdriver(self):
        event = {
            'category': 'gceactivity',
            'source': 'stackdriver',
            'tags': ['projects/mcd-001-252615/subscriptions/mozdefsubscription', 'pubsub', 'stackdriver'],
            'receivedtimestamp': '2019-11-22T01:23:49.238723+00:00',
            'timestamp': '2019-11-22T01:23:47.936931+00:00',
            'utctimestamp': '2019-11-22T01:23:47.936931+00:00',
            'mozdefhostname': 'mozdefqa2.private.mdc1.mozilla.com',
            'customendpoint': '',
            'details': {
                'insertId': '1y7iw8ag15tmjpz',
                'jsonPayload': {
                    'actor': {'user': 'luke@or.not'},
                    'event_subtype': 'compute.instances.reset',
                    'event_timestamp_us': '1574385827936931',
                    'event_type': 'GCE_API_CALL',
                    'ip_address': '',
                    'operation': {
                        'id': '2169930274576172620',
                        'name': 'operation-1574385827284-597e543f984be-d1640557-51c07a30',
                        'type': 'operation',
                        'zone': 'us-west2-a',
                    },
                    'request': {
                        'body': 'null',
                        'url': 'https://compute.googleapis.com/compute/v1/projects/mcd-001-252615/zones/us-west2-a/instances/mozdefdevvm1/reset?key=AIzaSyDWUi9T78xEO-m10evQANR7TMSiB_bjyNc',
                    },
                    'resource': {
                        'id': '3401561556013842918',
                        'name': 'mozdefdevvm1',
                        'type': 'instance',
                        'zone': 'us-west2-a',
                    },
                    'trace_id': 'operation-1574385827284-597e543f984be-d1640557-51c07a30',
                    'user_agent': 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:72.0) Gecko/20100101 Firefox/72.0,gzip(gfe),gzip(gfe)',
                    'version': '1.2',
                },
                'labels': {
                    'compute.googleapis.com/resource_id': '3401561556013842918',
                    'compute.googleapis.com/resource_name': 'mozdefdevvm1',
                    'compute.googleapis.com/resource_type': 'instance',
                    'compute.googleapis.com/resource_zone': 'us-west2-a',
                },
                'logName': 'projects/mcd-001-252615/logs/compute.googleapis.com%2Factivity_log',
                'receiveTimestamp': '2019-11-22T01:23:47.988998161Z',
                'resource': {
                    'labels': {
                        'instance_id': '3401561556013842918',
                        'project_id': 'mcd-001-252615',
                        'zone': 'us-west2-a',
                    },
                    'type': 'gce_instance',
                },
                'severity': 'INFO',
                'timestamp': '2019-11-22T01:23:47.936931Z',
            },
        }

        result, metadata = self.plugin.onMessage(event, self.metadata)

        assert result["details"]["action"] == "compute.instances.reset"
        assert result["details"]["gceactivity"]["resource"]["id"] == "3401561556013842918"
        assert result["utctimestamp"] == "2019-11-22T01:23:47.936931+00:00"
        assert result["details"]["username"] == "luke@or.not"
        assert result["details"]["service"] == "compute.googleapis.com"
        assert result["summary"] == "luke@or.not executed compute.instances.reset on mozdefdevvm1"
        assert "jsonPayload" not in result["details"]