Skip to content

Commit

Permalink
Update ruleset test template
Browse files Browse the repository at this point in the history
  • Loading branch information
chemamartinez committed Nov 27, 2018
1 parent db9c85d commit e141a00
Showing 1 changed file with 21 additions and 8 deletions.
29 changes: 21 additions & 8 deletions .github/ISSUE_TEMPLATE/test--ruleset.md
Expand Up @@ -10,7 +10,27 @@ about: Test suite for the ruleset.
| --- | --- | --- |
| x.y.z | rev | branch |

## Unit tests
## Analysisd performance

- [ ] Change the number of threads used by analysisd in the internal options. Check the performance at `var/run/ossec-analysisd.state` depending on the threads.
- [ ] Change the value of the queues size of analysisd. Check its behavior when flooded.
- [ ] Check the refresh interval of `ossec-analysisd.state` matches with the defined `analysisd.state_interval` at internal options.
- [ ] Check every file is written correctly when enabling/disabling `alerts_log`, `jsonout_output`, `logall` and `logall_json` options.

## Ruleset

- [ ] Trigger alerts which depend on `frequency`, `timeframe`, `ignore`.
- [ ] Trigger alerts which depend on `if_matched_sid`, `if_matched_group`, `same_source_ip`, etc.
- [ ] Trigger a custom decoder and rule set at `etc/decoders`/`etc/rules`.
- [ ] Overwrite a rule.
- [ ] Make the manager fails when starting by setting a duplicated rule ID, as well as other invalid fields.
- [ ] Decode static and dynamic fields and use them into a rule.
- [ ] Trigger a rule depending on a CDB list.
- [ ] Trigger an alert by using `ossec-logtest`.

https://documentation.wazuh.com/current/user-manual/ruleset/ruleset-xml-syntax/rules.html

## Ruleset unit tests

- [ ] Run unit tests.

Expand All @@ -19,10 +39,3 @@ about: Test suite for the ruleset.
- [ ] Check *major.minor.x*.
- [ ] From specific branch.
- [ ] Every argument.

## JSON plugin decoder

- [ ] Add a static field to the rule description. (https://github.com/wazuh/wazuh/pull/397)
- [ ] Check the offset option to the plugin decoders. (https://github.com/wazuh/wazuh/pull/512)
- [ ] Check the treatment of null fields from events with the option `json_null_field`. (https://github.com/wazuh/wazuh/pull/677)
- [ ] Mix two decoders trying to extend a regex extracting a specific field. (https://github.com/wazuh/wazuh/pull/602)

0 comments on commit e141a00

Please sign in to comment.