| from mozdef_util.utilities.toUTC import toUTC |
| from mq.plugins.stackdriver_syslog import message |
|
|
|
|
| class TestStackDriverSyslog(object): |
| def setup(self): |
| self.plugin = message() |
| self.metadata = {"index": "events"} |
|
|
| |
| def test_notags_log(self): |
| metadata = {"index": "events"} |
| event = { |
| "source": "stackdriver", |
| } |
|
|
| result, metadata = self.plugin.onMessage(event, metadata) |
| |
| assert result == event |
|
|
| def test_wrongtags_log(self): |
| metadata = {"index": "events"} |
| event = { |
| "tags": "audit", |
| "source": "stackdriver", |
| } |
|
|
| result, metadata = self.plugin.onMessage(event, metadata) |
| |
| assert result == event |
|
|
| def test_wrongcategory_log(self): |
| metadata = {"index": "events"} |
| event = { |
| "tags": "audit", |
| "source": "stackdriver", |
| } |
|
|
| result, metadata = self.plugin.onMessage(event, metadata) |
| |
| assert result == event |
|
|
| def verify_metadata(self, metadata): |
| assert metadata["index"] == "events" |
|
|
| def verify_defaults(self, result): |
| assert result["category"] == "syslog" |
| assert toUTC(result["receivedtimestamp"]).isoformat() == result["receivedtimestamp"] |
|
|
| def test_defaults(self): |
| event = { |
| 'category': 'syslog', |
| 'source': 'stackdriver', |
| 'tags': ['projects/mcd-001-252615/subscriptions/mozdefsubscription', 'pubsub', 'stackdriver'], |
| 'receivedtimestamp': '2019-11-22T00:32:20.078819+00:00', |
| 'timestamp': '2019-11-22T00:32 :13+00:00', |
| 'utctimestamp': '2019-11-22T00:32:13+00:00', |
| 'mozdefhostname': 'mozdefqa2.private.mdc1.mozilla.com', |
| 'customendpoint': '', |
| 'details': { |
| 'insertId': '5s8y8sgro37aodjds', |
| 'labels': {'compute.googleapis.com/resource_name': 'mozdefdevvm1'}, |
| 'logName': 'projects/mcd-001-252615/logs/syslog', |
| 'receiveTimestamp': '2019-11-22T00:32:18.754424975Z', |
| 'resource': { |
| 'labels': { |
| 'instance_id': '3401561556013842918', |
| 'project_id': 'mcd-001-252615', |
| 'zone': 'us-west2-a', |
| }, |
| 'type': 'gce_instance', |
| }, |
| 'textPayload': 'Nov 22 00:32:13 mozdefdevvm1 systemd: Started Session 1 of user mpurzynski.', |
| 'timestamp': '2019-11-22T00:32:13Z', |
| }, |
| } |
|
|
| result, metadata = self.plugin.onMessage(event, self.metadata) |
| self.verify_defaults(result) |
| self.verify_metadata(metadata) |
|
|
| def test_nomatch_generic_syslog(self): |
| event = { |
| "category": "syslog", |
| "processid": "0", |
| "receivedtimestamp": "2017-09-26T00:22:24.210945+00:00", |
| "severity": "7", |
| "utctimestamp": "2017-09-26T00:22:23+00:00", |
| "timestamp": "2017-09-26T00:22:23+00:00", |
| "hostname": "something1.test.com", |
| "mozdefhostname": "something1.test.com", |
| "summary": "Connection from 10.22.74.208 port 9071 on 10.22.74.45 pubsub stackdriver port 22\n", |
| "eventsource": "systemslogs", |
| "tags": "something", |
| "details": { |
| "processid": "21233", |
| "sourceipv4address": "10.22.74.208", |
| "hostname": "hostname1.subdomain.domain.com", |
| "program": "sshd", |
| "sourceipaddress": "10.22.74.208", |
| }, |
| } |
| result, metadata = self.plugin.onMessage(event, self.metadata) |
| assert result["category"] == "syslog" |
| assert result["eventsource"] == "systemslogs" |
| assert result == event |
|
|
| def test_nomatch_auditd(self): |
| event = { |
| "category": "execve", |
| "processid": "0", |
| "receivedtimestamp": "2017-09-26T00:36:27.463745+00:00", |
| "severity": "INFO", |
| "utctimestamp": "2017-09-26T00:36:27+00:00", |
| "tags": ["audisp-json", "2.1.1", "audit"], |
| "summary": "Execve: sh -c sudo squid proxy /usr/lib64/nagios/plugins/custom/check_auditd.sh", |
| "processname": "audisp-json", |
| "details": { |
| "fsuid": "398", |
| "tty": "(none)", |
| "uid": "398", |
| "process": "/bin/bash", |
| "auditkey": "exec", |
| "pid": "10553", |
| "processname": "sh", |
| "session": "16467", |
| "fsgid": "398", |
| "sgid": "398", |
| "auditserial": "3834716", |
| "inode": "1835094", |
| "ouid": "0", |
| "ogid": "0", |
| "suid": "398", |
| "originaluid": "0", |
| "gid": "398", |
| "originaluser": "pubsub", |
| "ppid": "10552", |
| "cwd": "/", |
| "parentprocess": "stackdriver", |
| "euid": "398", |
| "path": "/bin/sh", |
| "rdev": "00:00", |
| "dev": "08:03", |
| "egid": "398", |
| "command": "sh -c sudo /usr/lib64/nagios/plugins/custom/check_auditd.sh", |
| "mode": "0100755", |
| "user": "squid", |
| }, |
| } |
| result, metadata = self.plugin.onMessage(event, self.metadata) |
| assert result["category"] == "execve" |
| assert "eventsource" not in result |
| assert result == event |
|
|
| def test_stackdriver_syslog(self): |
| event = { |
| 'category': 'syslog', |
| 'source': 'stackdriver', |
| 'tags': ['projects/mcd-001-252615/subscriptions/mozdefsubscription', 'pubsub', 'stackdriver'], |
| 'receivedtimestamp': '2019-11-22T00:32:20.078819+00:00', |
| 'timestamp': '2019-11-22T00:32 :13+00:00', |
| 'utctimestamp': '2019-11-22T00:32:13+00:00', |
| 'mozdefhostname': 'mozdefqa2.private.mdc1.mozilla.com', |
| 'customendpoint': '', |
| 'details': { |
| 'insertId': '5s8y8sgro37aodjds', |
| 'labels': {'compute.googleapis.com/resource_name': 'mozdefdevvm1'}, |
| 'logName': 'projects/mcd-001-252615/logs/syslog', |
| 'receiveTimestamp': '2019-11-22T00:32:18.754424975Z', |
| 'resource': { |
| 'labels': { |
| 'instance_id': '3401561556013842918', |
| 'project_id': 'mcd-001-252615', |
| 'zone': 'us-west2-a', |
| }, |
| 'type': 'gce_instance', |
| }, |
| 'textPayload': 'Nov 22 00:32:13 mozdefdevvm1 systemd: Started Session 1 of user yoda.', |
| 'timestamp': '2019-11-22T00:32:13Z', |
| }, |
| } |
|
|
| result, metadata = self.plugin.onMessage(event, self.metadata) |
| assert result["category"] == "syslog" |
| assert result["source"] == "stackdriver" |
| assert result["utctimestamp"] == "2019-11-22T00:32:13+00:00" |
| assert result["hostname"] == "mozdefdevvm1" |
| assert result["processname"] == "systemd" |
| assert result["summary"] == "Started Session 1 of user yoda." |
|
|
