-
Notifications
You must be signed in to change notification settings - Fork 182
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Test decoders before matching rules #3446
Test decoders before matching rules #3446
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
You accidentally branched from e4399fe and so the changes on the feature/3391_office365_module_navigation
branch are included in this PR.
You should probably rebase it.
issue: There are changes related to the Office 365 module. We should remove these changes to the PR. nitpick: Add the change to the changelog |
* refactor(error-orchestrator): Changed all context value of all try-catch implementations * docs(error-orchestrator): Updated changelog.
* Implement try catch groups * Add test * test(groups): Added simple snapshot test. * Add changelog * Change context * Change title Co-authored-by: gabiwassan <gabriel.wassan@wazuh.com>
* refactor(error-orchestrator): Changed all context value of all try-catch implementations * docs(error-orchestrator): Updated changelog.
* Implement try catch groups * Add test * test(groups): Added simple snapshot test. * Add changelog * Change context * Change title Co-authored-by: gabiwassan <gabriel.wassan@wazuh.com>
* refactor(error-orchestrator): Changed all context value of all try-catch implementations * docs(error-orchestrator): Updated changelog.
* Implement try catch groups * Add test * test(groups): Added simple snapshot test. * Add changelog * Change context * Change title Co-authored-by: gabiwassan <gabriel.wassan@wazuh.com>
* refactor(error-orchestrator): Changed all context value of all try-catch implementations * docs(error-orchestrator): Updated changelog.
40eca7d
to
3db17b0
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
CR: LGTM: ✔️
Changes
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
review:
Code Review ✅
|
Hi team!
This PR adds a feature to check decoders and rulesets using logtest.
To test it:
Management/Decoders
Prerequisite 1: command:
Apr 28 13:43:51 localhost local_decoder_example: test
custom decoder
->Add new decoder file
->Decoder test
Tests:
The cases in focus are:
All of the above cases should produce the same output in the web interface as they currently output when wazuh-logtest is run from the command line.
Here is an example of the second item. It only matches top level parent rule 5700 which is level 0.
As to the first item in my list, I am assuming this is already present in local_decoder.xml
And here an example of a non-rule-matching sample that matches a decoder
Lastly an example of a level 2 rule that would normally not be logged:
Here that one goes:
Related issue: #3348