Skip to content

Conversation

@brokensound77
Copy link
Contributor

@brokensound77 brokensound77 commented Mar 7, 2023

Issues

resolves #1869
resolves #2623

Summary

This PR caches the rule loader default rules for unit tests. It also skips rule based-test when the rule loader fails.

Details

To test, change any rule author to authorz and run unit tests

Duration before:

passing: make test  165.21s user 11.06s system 96% cpu 3:03.31 total
failing: make test  478.26s user 14.04s system 97% cpu 8:23.70 total
# these are local; GH test took up to ~16+m

Duration after:

passing: make test  96.66s user 6.64s system 96% cpu 1:47.22 total
failing: make test  49.61s user 5.81s system 93% cpu 59.209 total

Speeding up passing

Each unittest class in test_all_rules loads the BaseRuleTest.setUp method when setting up unit tests. This meant that the rule loader was run multiple times. It now caches that load to limit it to a single load.

Speeding up failures

Now, if the loader fails, it will skip all rule based test dependent on the leader

tests/test_all_rules.py::TestValidRules::test_all_rule_queries_optimized FAILED                                                                                                                    [  0%]
tests/test_all_rules.py::TestValidRules::test_duplicate_file_names SKIPPED (Rule loader failure)                                                                                                   [  1%]
tests/test_all_rules.py::TestValidRules::test_file_names SKIPPED (Rule loader failure)                                                                                                             [  2%]
tests/test_all_rules.py::TestValidRules::test_production_rules_have_rta SKIPPED (Rule loader failure)                                                                                              [  3%]
tests/test_all_rules.py::TestValidRules::test_rule_type_changes SKIPPED (Rule loader failure)                                                                                                      [  4%]
tests/test_all_rules.py::TestValidRules::test_schema_and_dupes SKIPPED (Rule loader failure)                                                                                                       [  5%]
tests/test_all_rules.py::TestThreatMappings::test_duplicated_tactics SKIPPED (Rule loader failure)                                                                                                 [  5%]
tests/test_all_rules.py::TestThreatMappings::test_tactic_to_technique_correlations SKIPPED (Rule loader failure)                                                                                   [  6%]
tests/test_all_rules.py::TestThreatMappings::test_technique_deprecations SKIPPED (Rule loader failure)                                                                                             [  7%]
tests/test_all_rules.py::TestRuleTags::test_casing_and_spacing SKIPPED (Rule loader failure)                                                                                                       [  8%]
tests/test_all_rules.py::TestRuleTags::test_primary_tactic_as_tag SKIPPED (Rule loader failure)                                                                                                    [  9%]
tests/test_all_rules.py::TestRuleTags::test_required_tags SKIPPED (Rule loader failure)                                                                                                            [ 10%]
tests/test_all_rules.py::TestRuleTimelines::test_timeline_has_title SKIPPED (Rule loader failure)                                                                                                  [ 11%]
tests/test_all_rules.py::TestRuleFiles::test_rule_file_name_tactic SKIPPED (Rule loader failure)                                                                                                   [ 11%]
tests/test_all_rules.py::TestRuleMetadata::test_deprecated_rules SKIPPED (Rule loader failure)                                                                                                     [ 12%]
tests/test_all_rules.py::TestRuleMetadata::test_integration_tag SKIPPED (Rule loader failure)                                                                                                      [ 13%]
tests/test_all_rules.py::TestRuleMetadata::test_updated_date_newer_than_creation SKIPPED (Rule loader failure)                                                                                     [ 14%]
tests/test_all_rules.py::TestIntegrationRules::test_all_min_stack_rules_have_comment SKIPPED (Rule loader failure)                                                                                 [ 15%]
tests/test_all_rules.py::TestIntegrationRules::test_integration_guide SKIPPED (8.3+ Stacks Have Related Integrations Feature)                                                                      [ 16%]
tests/test_all_rules.py::TestIntegrationRules::test_rule_demotions SKIPPED (Rule loader failure)                                                                                                   [ 16%]
tests/test_all_rules.py::TestRuleTiming::test_eql_interval_to_maxspan SKIPPED (Rule loader failure)                                                                                                [ 17%]
tests/test_all_rules.py::TestRuleTiming::test_eql_lookback SKIPPED (Rule loader failure)                                                                                                           [ 18%]
tests/test_all_rules.py::TestRuleTiming::test_event_override SKIPPED (Rule loader failure)                                                                                                         [ 19%]
tests/test_all_rules.py::TestRuleTiming::test_required_lookback SKIPPED (Rule loader failure)                                                                                                      [ 20%]
tests/test_all_rules.py::TestLicense::test_elastic_license_only_v2 SKIPPED (Rule loader failure)                                                                                                   [ 21%]
tests/test_all_rules.py::TestIncompatibleFields::test_rule_backports_for_restricted_fields SKIPPED (Rule loader failure)                                                                           [ 22%]
tests/test_all_rules.py::TestBuildTimeFields::test_build_fields_min_stack SKIPPED (Rule loader failure)                                                                                            [ 22%]
tests/test_all_rules.py::TestRiskScoreMismatch::test_rule_risk_score_severity_mismatch SKIPPED (Rule loader failure)                                                                               [ 23%]
tests/test_all_rules.py::TestOsqueryPluginNote::test_note_guide SKIPPED (Rule loader failure)                                                                                                      [ 24%]
tests/test_all_rules.py::TestEndpointQuery::test_os_and_platform_in_query SKIPPED (Rule loader failure)                                                                                            [ 25%]
tests/test_gh_workflows.py::TestWorkflows::test_matrix_to_lock_version_defaults PASSED                                                                                                             [ 26%]
tests/test_mappings.py::TestMappings::test_false_positives SKIPPED (Rule loader failure)                                                                                                           [ 27%]
tests/test_mappings.py::TestMappings::test_true_positives SKIPPED (Rule loader failure)                                                                                                            [ 27%]
tests/test_mappings.py::TestRTAs::test_rtas_with_triggered_rules_have_uuid PASSED                                                                                                                  [ 28%]
tests/test_packages.py::TestPackages::test_package_loader_default_configs SKIPPED (Rule loader failure)                                                                                            [ 29%]
tests/test_packages.py::TestPackages::test_package_loader_production_config SKIPPED (Rule loader failure)                                                                                          [ 30%]
tests/test_packages.py::TestPackages::test_package_summary SKIPPED (Rule loader failure)                                                                                                           [ 31%]
tests/test_packages.py::TestPackages::test_rule_versioning SKIPPED (Rule loader failure)                                                                                                           [ 32%]
tests/test_packages.py::TestRegistryPackage::test_registry_package_config PASSED                                                                                                                   [ 33%]
tests/test_schemas.py::TestSchemas::test_eql_validation PASSED                                                                                                                                     [ 33%]
tests/test_schemas.py::TestSchemas::test_query_downgrade_7_x PASSED                                                                                                                                [ 34%]
tests/test_schemas.py::TestSchemas::test_query_downgrade_8_x PASSED                                                                                                                                [ 35%]
tests/test_schemas.py::TestSchemas::test_threshold_downgrade_7_x PASSED                                                                                                                            [ 36%]
tests/test_schemas.py::TestSchemas::test_threshold_downgrade_8_x PASSED                                                                                                                            [ 37%]
tests/test_schemas.py::TestSchemas::test_versioned_downgrade_7_x PASSED                                                                                                                            [ 38%]
tests/test_schemas.py::TestSchemas::test_versioned_downgrade_8_x PASSED                                                                                                                            [ 38%]
tests/test_schemas.py::TestVersionLockSchema::test_version_lock_has_nested_previous PASSED                                                                                                         [ 39%]
tests/test_schemas.py::TestVersionLockSchema::test_version_lock_no_previous PASSED                                                                                                                 [ 40%]
tests/test_schemas.py::TestVersions::test_stack_schema_map PASSED                                                                                                                                  [ 41%]
tests/test_toml_formatter.py::TestRuleTomlFormatter::test_formatter_deep PASSED                                                                                                                    [ 42%]
tests/test_toml_formatter.py::TestRuleTomlFormatter::test_formatter_rule PASSED                                                                                                                    [ 43%]
tests/test_toml_formatter.py::TestRuleTomlFormatter::test_normalization PASSED                                                                                                                     [ 44%]
tests/test_utils.py::TestTimeUtils::test_caching PASSED                                                                                                                                            [ 44%]
tests/test_utils.py::TestTimeUtils::test_event_class_normalization PASSED                                                                                                                          [ 45%]
tests/test_utils.py::TestTimeUtils::test_schema_multifields PASSED                                                                                                                                 [ 46%]
tests/test_utils.py::TestTimeUtils::test_time_normalize PASSED                                                                                                                                     [ 47%]
tests/test_version_locking.py::TestVersionLock::test_previous_entries_gte_current_min_stack PASSED                                                                                                 [ 48%]
tests/kuery/test_dsl.py::TestKQLtoDSL::test_and_query PASSED                                                                                                                                       [ 49%]
tests/kuery/test_dsl.py::TestKQLtoDSL::test_field_exists PASSED                                                                                                                                    [ 50%]
tests/kuery/test_dsl.py::TestKQLtoDSL::test_field_inequality PASSED                                                                                                                                [ 50%]
tests/kuery/test_dsl.py::TestKQLtoDSL::test_field_match PASSED                                                                                                                                     [ 51%]
tests/kuery/test_dsl.py::TestKQLtoDSL::test_not_query PASSED                                                                                                                                       [ 52%]
tests/kuery/test_dsl.py::TestKQLtoDSL::test_optimizations PASSED                                                                                                                                   [ 53%]
tests/kuery/test_dsl.py::TestKQLtoDSL::test_or_query PASSED                                                                                                                                        [ 54%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_and_query PASSED                                                                                                                                    [ 55%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_boolean_precedence PASSED                                                                                                                           [ 55%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_field_equals PASSED                                                                                                                                 [ 56%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_field_inequality PASSED                                                                                                                             [ 57%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_ip_checks PASSED                                                                                                                                    [ 58%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_list_of_values PASSED                                                                                                                               [ 59%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_not_query PASSED                                                                                                                                    [ 60%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_or_query PASSED                                                                                                                                     [ 61%]
tests/kuery/test_eql2kql.py::TestEql2Kql::test_wildcard_field PASSED                                                                                                                               [ 61%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_and_expr PASSED                                                                                                                                [ 62%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_and_values PASSED                                                                                                                              [ 63%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_cidr_match PASSED                                                                                                                              [ 64%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_field_exists PASSED                                                                                                                            [ 65%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_flattening PASSED                                                                                                                              [ 66%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_list_value PASSED                                                                                                                              [ 66%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_not_value PASSED                                                                                                                               [ 67%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_or_expr PASSED                                                                                                                                 [ 68%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_or_values PASSED                                                                                                                               [ 69%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_quoted_wildcard PASSED                                                                                                                         [ 70%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_range PASSED                                                                                                                                   [ 71%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_single_value PASSED                                                                                                                            [ 72%]
tests/kuery/test_evaluator.py::EvaluatorTests::test_wildcard PASSED                                                                                                                                [ 72%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_and_query PASSED                                                                                                                                    [ 73%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_boolean_precedence PASSED                                                                                                                           [ 74%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_field_equals PASSED                                                                                                                                 [ 75%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_field_inequality PASSED                                                                                                                             [ 76%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_list_of_values PASSED                                                                                                                               [ 77%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_lone_value PASSED                                                                                                                                   [ 77%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_nested_query PASSED                                                                                                                                 [ 78%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_not_query PASSED                                                                                                                                    [ 79%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_or_query PASSED                                                                                                                                     [ 80%]
tests/kuery/test_kql2eql.py::TestKql2Eql::test_schema PASSED                                                                                                                                       [ 81%]
tests/kuery/test_lint.py::LintTests::test_and_not PASSED                                                                                                                                           [ 82%]
tests/kuery/test_lint.py::LintTests::test_compound PASSED                                                                                                                                          [ 83%]
tests/kuery/test_lint.py::LintTests::test_double_negate PASSED                                                                                                                                     [ 83%]
tests/kuery/test_lint.py::LintTests::test_extract_not PASSED                                                                                                                                       [ 84%]
tests/kuery/test_lint.py::LintTests::test_ip PASSED                                                                                                                                                [ 85%]
tests/kuery/test_lint.py::LintTests::test_lint_field PASSED                                                                                                                                        [ 86%]
tests/kuery/test_lint.py::LintTests::test_lint_precedence PASSED                                                                                                                                   [ 87%]
tests/kuery/test_lint.py::LintTests::test_merge_fields PASSED                                                                                                                                      [ 88%]
tests/kuery/test_lint.py::LintTests::test_mixed_demorgans PASSED                                                                                                                                   [ 88%]
tests/kuery/test_lint.py::LintTests::test_not_demorgans PASSED                                                                                                                                     [ 89%]
tests/kuery/test_lint.py::LintTests::test_not_or PASSED                                                                                                                                            [ 90%]
tests/kuery/test_lint.py::LintTests::test_upper_tokens PASSED                                                                                                                                      [ 91%]
tests/kuery/test_parser.py::ParserTests::test_conversion PASSED                                                                                                                                    [ 92%]
tests/kuery/test_parser.py::ParserTests::test_date PASSED                                                                                                                                          [ 93%]
tests/kuery/test_parser.py::ParserTests::test_keyword PASSED                                                                                                                                       [ 94%]
tests/kuery/test_parser.py::ParserTests::test_list_equals PASSED                                                                                                                                   [ 94%]
tests/kuery/test_parser.py::ParserTests::test_multiple_types_fail PASSED                                                                                                                           [ 95%]
tests/kuery/test_parser.py::ParserTests::test_multiple_types_success PASSED                                                                                                                        [ 96%]
tests/kuery/test_parser.py::ParserTests::test_number_exists PASSED                                                                                                                                 [ 97%]
tests/kuery/test_parser.py::ParserTests::test_number_wildcard_fail PASSED                                                                                                                          [ 98%]
tests/kuery/test_parser.py::ParserTests::test_type_family_fail PASSED                                                                                                                              [ 99%]
tests/kuery/test_parser.py::ParserTests::test_type_family_success PASSED                                                                                                                           [100%]

================================================================================================ FAILURES ================================================================================================
_____________________________________________________________________________ TestValidRules.test_all_rule_queries_optimized _____________________________________________________________________________
tests/base.py:60: in setUp
    self.fail(f'Rule loader failure: \n{RULE_LOADER_FAIL_MSG}')
E   AssertionError: Rule loader failure: 
E   {'rule': [ValidationError({'author': ['Missing data for required field.'], 'authorz': ['Unknown field.']}), ValidationError({'type': ['Must be equal to threshold.'], 'language': ['Must be one of: kuery, lucene.'], 'threshold': ['Missing data for required field.'], 'author': ['Missing data for required field.'], 'authorz': ['Unknown field.']}), ValidationError({'type': ['Must be equal to threat_match.'], 'threat_mapping': ['Missing data for required field.'], 'threat_index': ['Missing data for required field.'], 'language': ['Must be one of: kuery, lucene.'], 'author': ['Missing data for required field.'], 'authorz': ['Unknown field.']}), ValidationError({'type': ['Must be equal to machine_learning.'], 'anomaly_threshold': ['Missing data for required field.'], 'machine_learning_job_id': ['Missing data for required field.'], 'author': ['Missing data for required field.'], 'authorz': ['Unknown field.'], 'index': ['Unknown field.'], 'query': ['Unknown field.'], 'language': ['Unknown field.']}), ValidationError({'type': ['Must be equal to query.'], 'language': ['Must be one of: kuery, lucene.'], 'author': ['Missing data for required field.'], 'authorz': ['Unknown field.']}), ValidationError({'type': ['Must be equal to new_terms.'], 'language': ['Must be one of: kuery, lucene.'], 'author': ['Missing data for required field.'], 'new_terms': ['Missing data for required field.'], 'authorz': ['Unknown field.']})]}
----------------------------------------------------------------------------------------- Captured stdout setup ------------------------------------------------------------------------------------------
Error loading rule in /Users/jibarra/PycharmProjects/detection-rules-fork/rules/windows/credential_access_lsass_memdump_handle_access.toml
============================================================================================ warnings summary ============================================================================================
env/detection-rules-build/lib/python3.8/site-packages/_pytest/config/__init__.py:1129
  /Users/jibarra/PycharmProjects/detection-rules-fork/env/detection-rules-build/lib/python3.8/site-packages/_pytest/config/__init__.py:1129: PytestAssertRewriteWarning: Module already imported so cannot be rewritten: typeguard
    self._mark_plugins_for_rewrite(hook)

-- Docs: https://docs.pytest.org/en/stable/how-to/capture-warnings.html
======================================================================================== short test summary info =========================================================================================
FAILED tests/test_all_rules.py::TestValidRules::test_all_rule_queries_optimized - AssertionError: Rule loader failure: 
========================================================================== 1 failed, 82 passed, 35 skipped, 1 warning in 42.77s ==========================================================================
make: *** [pytest] Error 1
make test  53.98s user 6.36s system 93% cpu 1:04.40 total

Copy link
Contributor

@terrancedejesus terrancedejesus left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM. From my understanding, there is two enhancements here. The first, we use the @lru_cache decorator for the rule loader, which loads all rules. This way all rules are not loaded multiple times as it is already cached. Second, the setUp method takes the value of RULE_LOADER_FAIL which is set by setUpClass and if True stops the rule loader from doing additional runs.

@brokensound77 please correct my understanding if it is incorrect.

@brokensound77
Copy link
Contributor Author

LGTM. From my understanding, there is two enhancements here. The first, we use the @lru_cache decorator for the rule loader, which loads all rules. This way all rules are not loaded multiple times as it is already cached. Second, the setUp method takes the value of RULE_LOADER_FAIL which is set by setUpClass and if True stops the rule loader from doing additional runs.

@brokensound77 please correct my understanding if it is incorrect.

yep, exactly. Any class that inherits the BaseRuleTest, which is all of the rule test cases, will be auto skipped on failure, since there are no rules to test. Before, it would try to reload the rules every time

Copy link
Contributor

@Mikaayenson Mikaayenson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1.✔️ Ran the unit test a couple ways to verify timing with pytest

(detection_dev) ➜  detection-rules git:(main) ✗ time pytest         
============================================================================================================================================================================================================================= test session starts ==============================================================================================================================================================================================================================
platform darwin -- Python 3.10.9, pytest-7.1.2, pluggy-1.0.0
rootdir: /Users/stryker/workspace/Elastic/detection-rules, configfile: pyproject.toml
plugins: typeguard-2.13.3, profiling-1.7.0
collected 118 items                                                                                                                                                                                                                                                                                                                                                                                                                                                            

tests/test_all_rules.py ..................s...........                                                                                                                                                                                                                                                                                                                                                                                                                   [ 25%]
tests/test_gh_workflows.py .                                                                                                                                                                                                                                                                                                                                                                                                                                             [ 26%]
tests/test_mappings.py ...                                                                                                                                                                                                                                                                                                                                                                                                                                               [ 28%]
tests/test_packages.py .....                                                                                                                                                                                                                                                                                                                                                                                                                                             [ 33%]
tests/test_schemas.py ..........                                                                                                                                                                                                                                                                                                                                                                                                                                         [ 41%]
tests/test_toml_formatter.py ...                                                                                                                                                                                                                                                                                                                                                                                                                                         [ 44%]
tests/test_utils.py ....                                                                                                                                                                                                                                                                                                                                                                                                                                                 [ 47%]
tests/test_version_locking.py .                                                                                                                                                                                                                                                                                                                                                                                                                                          [ 48%]
tests/kuery/test_dsl.py .......                                                                                                                                                                                                                                                                                                                                                                                                                                          [ 54%]
tests/kuery/test_eql2kql.py .........                                                                                                                                                                                                                                                                                                                                                                                                                                    [ 61%]
tests/kuery/test_evaluator.py .............                                                                                                                                                                                                                                                                                                                                                                                                                              [ 72%]
tests/kuery/test_kql2eql.py ..........                                                                                                                                                                                                                                                                                                                                                                                                                                   [ 81%]
tests/kuery/test_lint.py ............                                                                                                                                                                                                                                                                                                                                                                                                                                    [ 91%]
tests/kuery/test_parser.py ..........                                                                                                                                                                                                                                                                                                                                                                                                                                    [100%]

======================================================================================================================================================================================================================= 117 passed, 1 skipped in 55.38s ========================================================================================================================================================================================================================
pytest  42.96s user 3.50s system 81% cpu 56.673 total
(detection_dev) ➜  detection-rules git:(main) ✗ time pytest
============================================================================================================================================================================================================================= test session starts ==============================================================================================================================================================================================================================
platform darwin -- Python 3.10.9, pytest-7.1.2, pluggy-1.0.0
rootdir: /Users/stryker/workspace/Elastic/detection-rules, configfile: pyproject.toml
plugins: typeguard-2.13.3, profiling-1.7.0
collected 118 items                                                                                                                                                                                                                                                                                                                                                                                                                                                            

tests/test_all_rules.py Fsssssssssssssssssssssssssssss                                                                                                                                                                                                                                                                                                                                                                                                                   [ 25%]
tests/test_gh_workflows.py .                                                                                                                                                                                                                                                                                                                                                                                                                                             [ 26%]
tests/test_mappings.py ss.                                                                                                                                                                                                                                                                                                                                                                                                                                               [ 28%]
tests/test_packages.py ssss.                                                                                                                                                                                                                                                                                                                                                                                                                                             [ 33%]
tests/test_schemas.py ..........                                                                                                                                                                                                                                                                                                                                                                                                                                         [ 41%]
tests/test_toml_formatter.py ...                                                                                                                                                                                                                                                                                                                                                                                                                                         [ 44%]
tests/test_utils.py ....                                                                                                                                                                                                                                                                                                                                                                                                                                                 [ 47%]
tests/test_version_locking.py .                                                                                                                                                                                                                                                                                                                                                                                                                                          [ 48%]
tests/kuery/test_dsl.py .......                                                                                                                                                                                                                                                                                                                                                                                                                                          [ 54%]
tests/kuery/test_eql2kql.py .........                                                                                                                                                                                                                                                                                                                                                                                                                                    [ 61%]
tests/kuery/test_evaluator.py .............                                                                                                                                                                                                                                                                                                                                                                                                                              [ 72%]
tests/kuery/test_kql2eql.py ..........                                                                                                                                                                                                                                                                                                                                                                                                                                   [ 81%]
tests/kuery/test_lint.py ............                                                                                                                                                                                                                                                                                                                                                                                                                                    [ 91%]
tests/kuery/test_parser.py ..........                                                                                                                                                                                                                                                                                                                                                                                                                                    [100%]

=================================================================================================================================================================================================================================== FAILURES ===================================================================================================================================================================================================================================
________________________________________________________________________________________________________________________________________________________________________________________________________________ TestValidRules.test_all_rule_queries_optimized ________________________________________________________________________________________________________________________________________________________________________________________________________________
tests/base.py:60: in setUp
    self.fail(f'Rule loader failure: \n{RULE_LOADER_FAIL_MSG}')
E   AssertionError: Rule loader failure: 
E   Error at line:6,column:10
E   Invalid syntax
E     [network where host.os.type == "windows" and process.name : "MSBuild.exe" and and
E        not (destination.ip == "127.0.0.1" and source.ip == "127.0.0.1")]
E            ^
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Captured stdout setup -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Error loading rule in /Users/stryker/workspace/Elastic/detection-rules/rules/windows/defense_evasion_msbuild_beacon_sequence.toml
=========================================================================================================================================================================================================================== short test summary info ============================================================================================================================================================================================================================
FAILED tests/test_all_rules.py::TestValidRules::test_all_rule_queries_optimized - AssertionError: Rule loader failure: 
================================================================================================================================================================================================================== 1 failed, 82 passed, 35 skipped in 29.28s ===================================================================================================================================================================================================================
pytest  22.43s user 1.94s system 80% cpu 30.400 total
(detection_dev) ➜  detection-rules git:(main) ✗ time pytest
============================================================================================================================================================================================================================= test session starts ==============================================================================================================================================================================================================================
platform darwin -- Python 3.10.9, pytest-7.1.2, pluggy-1.0.0
rootdir: /Users/stryker/workspace/Elastic/detection-rules, configfile: pyproject.toml
plugins: typeguard-2.13.3, profiling-1.7.0
collected 118 items                                                                                                                                                                                                                                                                                                                                                                                                                                                            

tests/test_all_rules.py Fsssssssssssssssssssssssssssss                                                                                                                                                                                                                                                                                                                                                                                                                   [ 25%]
tests/test_gh_workflows.py .                                                                                                                                                                                                                                                                                                                                                                                                                                             [ 26%]
tests/test_mappings.py ss.                                                                                                                                                                                                                                                                                                                                                                                                                                               [ 28%]
tests/test_packages.py ssss.                                                                                                                                                                                                                                                                                                                                                                                                                                             [ 33%]
tests/test_schemas.py ..........                                                                                                                                                                                                                                                                                                                                                                                                                                         [ 41%]
tests/test_toml_formatter.py ...                                                                                                                                                                                                                                                                                                                                                                                                                                         [ 44%]
tests/test_utils.py ....                                                                                                                                                                                                                                                                                                                                                                                                                                                 [ 47%]
tests/test_version_locking.py .                                                                                                                                                                                                                                                                                                                                                                                                                                          [ 48%]
tests/kuery/test_dsl.py .......                                                                                                                                                                                                                                                                                                                                                                                                                                          [ 54%]
tests/kuery/test_eql2kql.py .........                                                                                                                                                                                                                                                                                                                                                                                                                                    [ 61%]
tests/kuery/test_evaluator.py .............                                                                                                                                                                                                                                                                                                                                                                                                                              [ 72%]
tests/kuery/test_kql2eql.py ..........                                                                                                                                                                                                                                                                                                                                                                                                                                   [ 81%]
tests/kuery/test_lint.py ............                                                                                                                                                                                                                                                                                                                                                                                                                                    [ 91%]
tests/kuery/test_parser.py ..........                                                                                                                                                                                                                                                                                                                                                                                                                                    [100%]

=================================================================================================================================================================================================================================== FAILURES ===================================================================================================================================================================================================================================
________________________________________________________________________________________________________________________________________________________________________________________________________________ TestValidRules.test_all_rule_queries_optimized ________________________________________________________________________________________________________________________________________________________________________________________________________________
tests/base.py:60: in setUp
    self.fail(f'Rule loader failure: \n{RULE_LOADER_FAIL_MSG}')
E   AssertionError: Rule loader failure: 
E   {'rule': [ValidationError({'rule_id': ['Missing data for required field.']}), ValidationError({'threshold': ['Missing data for required field.'], 'language': ['Must be one of: kuery, lucene.'], 'type': ['Must be equal to threshold.'], 'rule_id': ['Missing data for required field.']}), ValidationError({'threat_index': ['Missing data for required field.'], 'language': ['Must be one of: kuery, lucene.'], 'type': ['Must be equal to threat_match.'], 'rule_id': ['Missing data for required field.'], 'threat_mapping': ['Missing data for required field.']}), ValidationError({'type': ['Must be equal to machine_learning.'], 'rule_id': ['Missing data for required field.'], 'anomaly_threshold': ['Missing data for required field.'], 'machine_learning_job_id': ['Missing data for required field.'], 'index': ['Unknown field.'], 'query': ['Unknown field.'], 'language': ['Unknown field.']}), ValidationError({'language': ['Must be one of: kuery, lucene.'], 'type': ['Must be equal to query.'], 'rule_id': ['Missing data for required field.']}), ValidationError({'language': ['Must be one of: kuery, lucene.'], 'type': ['Must be equal to new_terms.'], 'rule_id': ['Missing data for required field.'], 'new_terms': ['Missing data for required field.']})]}
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- Captured stdout setup -----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Error loading rule in /Users/stryker/workspace/Elastic/detection-rules/rules/windows/defense_evasion_msbuild_beacon_sequence.toml
=========================================================================================================================================================================================================================== short test summary info ============================================================================================================================================================================================================================
FAILED tests/test_all_rules.py::TestValidRules::test_all_rule_queries_optimized - AssertionError: Rule loader failure: 
================================================================================================================================================================================================================== 1 failed, 82 passed, 35 skipped in 28.81s ===================================================================================================================================================================================================================
pytest  22.57s user 2.15s system 82% cpu 29.846 total
(detection_dev) ➜  detection-rules git:(main) ✗ time pytest
============================================================================================================================================================================================================================= test session starts ==============================================================================================================================================================================================================================
platform darwin -- Python 3.10.9, pytest-7.1.2, pluggy-1.0.0
rootdir: /Users/stryker/workspace/Elastic/detection-rules, configfile: pyproject.toml
plugins: typeguard-2.13.3, profiling-1.7.0
collected 118 items                                                                                                                                                                                                                                                                                                                                                                                                                                                            

tests/test_all_rules.py ..................s...........                                                                                                                                                                                                                                                                                                                                                                                                                   [ 25%]
tests/test_gh_workflows.py .                                                                                                                                                                                                                                                                                                                                                                                                                                             [ 26%]
tests/test_mappings.py ...                                                                                                                                                                                                                                                                                                                                                                                                                                               [ 28%]
tests/test_packages.py .....                                                                                                                                                                                                                                                                                                                                                                                                                                             [ 33%]
tests/test_schemas.py ..........                                                                                                                                                                                                                                                                                                                                                                                                                                         [ 41%]
tests/test_toml_formatter.py ...                                                                                                                                                                                                                                                                                                                                                                                                                                         [ 44%]
tests/test_utils.py ....                                                                                                                                                                                                                                                                                                                                                                                                                                                 [ 47%]
tests/test_version_locking.py .                                                                                                                                                                                                                                                                                                                                                                                                                                          [ 48%]
tests/kuery/test_dsl.py .......                                                                                                                                                                                                                                                                                                                                                                                                                                          [ 54%]
tests/kuery/test_eql2kql.py .........                                                                                                                                                                                                                                                                                                                                                                                                                                    [ 61%]
tests/kuery/test_evaluator.py .............                                                                                                                                                                                                                                                                                                                                                                                                                              [ 72%]
tests/kuery/test_kql2eql.py ..........                                                                                                                                                                                                                                                                                                                                                                                                                                   [ 81%]
tests/kuery/test_lint.py ............                                                                                                                                                                                                                                                                                                                                                                                                                                    [ 91%]
tests/kuery/test_parser.py ..........                                                                                                                                                                                                                                                                                                                                                                                                                                    [100%]

======================================================================================================================================================================================================================= 117 passed, 1 skipped in 53.34s ========================================================================================================================================================================================================================
pytest  42.79s user 3.55s system 84% cpu 54.672 total
(detection_dev) ➜  detection-rules git:(main) ✗ 
  1. I left some cleanup suggestions.

@brokensound77 brokensound77 merged commit cd6a598 into elastic:main Mar 7, 2023
@brokensound77 brokensound77 deleted the 2623-speed-up-unittests branch March 7, 2023 23:40
protectionsmachine pushed a commit that referenced this pull request Mar 7, 2023
* cache rule loader; skip rule tests on RL failure

-------
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>

(cherry picked from commit cd6a598)
protectionsmachine pushed a commit that referenced this pull request Mar 7, 2023
* cache rule loader; skip rule tests on RL failure

-------
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>

(cherry picked from commit cd6a598)
protectionsmachine pushed a commit that referenced this pull request Mar 7, 2023
* cache rule loader; skip rule tests on RL failure

-------
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>

(cherry picked from commit cd6a598)
protectionsmachine pushed a commit that referenced this pull request Mar 7, 2023
* cache rule loader; skip rule tests on RL failure

-------
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>

(cherry picked from commit cd6a598)
protectionsmachine pushed a commit that referenced this pull request Mar 7, 2023
* cache rule loader; skip rule tests on RL failure

-------
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>

(cherry picked from commit cd6a598)
protectionsmachine pushed a commit that referenced this pull request Mar 7, 2023
* cache rule loader; skip rule tests on RL failure

-------
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>

(cherry picked from commit cd6a598)
protectionsmachine pushed a commit that referenced this pull request Mar 7, 2023
* cache rule loader; skip rule tests on RL failure

-------
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>

(cherry picked from commit cd6a598)
protectionsmachine pushed a commit that referenced this pull request Mar 7, 2023
* cache rule loader; skip rule tests on RL failure

-------
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>

(cherry picked from commit cd6a598)
protectionsmachine pushed a commit that referenced this pull request Mar 7, 2023
* cache rule loader; skip rule tests on RL failure

-------
Co-authored-by: brokensound77 <brokensound77@users.noreply.github.com>

(cherry picked from commit cd6a598)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug] Reduce Time Taken for Unit Tests to Complete on Failure [Bug] Unit tests seem to have gotten slow

3 participants