-
Notifications
You must be signed in to change notification settings - Fork 113
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Added additional cypress tests for Security Analytics Dashboards plug…
…in. (#486) * Added additional cypress tests for the security analytics plugin. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed imports and added test fixtures. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Refactored test to use Date instead of moment. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed eslint errors. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed eslint errors. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Added additional cypress tests for the security analytics plugin. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed cy.createIndex call. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed import. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed eslint errors. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed import. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed call to Cypress.env(). Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed eslint errors. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed call to Cypress.env(). Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed eslint errors. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed call to Cypress.env(). Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed eslint errors. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed call to Cypress.env(). Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed call to Cypress.env(). Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed expected URL. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed waitForPageLoad helper method. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Replaced call to realPress. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed failing tests. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Replaced existing test file. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed es lint errors. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Adjusted security-analytics-release-e2e-workflow to run cypress tests for PRs to all branches. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Refactored security analytics cypress tests to no longer use the custom waitForPageLoad command. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Removed unused import. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Refactored failing tests. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Refactored failing tests. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Refactored failing tests. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed failing ISM cypress test. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed failing ISM cypress test. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed failing ISM cypress test. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed failing ISM cypress test. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Fixed failing ISM cypress test. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> * Removed dev code. Signed-off-by: AWSHurneyt <hurneyt@amazon.com> --------- Signed-off-by: AWSHurneyt <hurneyt@amazon.com>
- Loading branch information
1 parent
8eaa533
commit 46e1937
Showing
30 changed files
with
2,102 additions
and
229 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
57 changes: 57 additions & 0 deletions
57
...rity-analytics-dashboards-plugin/integration_tests/detector/create_dns_detector_data.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| { | ||
| "type": "detector", | ||
| "detector_type": "dns", | ||
| "name": "Cypress DNS Detector", | ||
| "enabled": true, | ||
| "createdBy": "", | ||
| "schedule": { | ||
| "period": { | ||
| "interval": 1, | ||
| "unit": "MINUTES" | ||
| } | ||
| }, | ||
| "inputs": [ | ||
| { | ||
| "detector_input": { | ||
| "description": "Detects DNS names.", | ||
| "indices": ["cypress-index-dns"], | ||
| "pre_packaged_rules": [], | ||
| "custom_rules": [ | ||
| { | ||
| "id": "25b9c01c-350d-4b95-bed1-836d04a4f325" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ], | ||
| "triggers": [ | ||
| { | ||
| "name": "DNS name alert", | ||
| "sev_levels": ["low"], | ||
| "tags": ["dns.low"], | ||
| "actions": [ | ||
| { | ||
| "id": "", | ||
| "name": "Triggered alert condition: - Severity: 1 (Highest) - Threat detector: Cypress DNS Detector", | ||
| "destination_id": "", | ||
| "subject_template": { | ||
| "source": "Triggered alert condition: - Severity: 1 (Highest) - Threat detector: Cypress DNS Detector", | ||
| "lang": "mustache" | ||
| }, | ||
| "message_template": { | ||
| "source": "Triggered alert condition: \nSeverity: 1 (Highest)\nThreat detector: Cypress DNS Detector\nDescription: Detects DNS names.\nDetector data sources:\n\tdns", | ||
| "lang": "mustache" | ||
| }, | ||
| "throttle_enabled": false, | ||
| "throttle": { | ||
| "value": 10, | ||
| "unit": "MINUTES" | ||
| } | ||
| } | ||
| ], | ||
| "types": ["dns"], | ||
| "severity": "1", | ||
| "ids": ["R1ng94QBbw8UQ2Cvqe6h"] | ||
| } | ||
| ] | ||
| } |
16 changes: 16 additions & 0 deletions
16
...ytics-dashboards-plugin/integration_tests/detector/create_dns_detector_mappings_data.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| { | ||
| "properties": { | ||
| "dns-answers-type": { | ||
| "type": "alias", | ||
| "path": "DnsAnswerType" | ||
| }, | ||
| "dns-question-name": { | ||
| "type": "alias", | ||
| "path": "DnsQuestionName" | ||
| }, | ||
| "dns-question-registered_domain": { | ||
| "type": "alias", | ||
| "path": "DnsQuestionRegisteredDomain" | ||
| } | ||
| } | ||
| } |
57 changes: 57 additions & 0 deletions
57
...rity-analytics-dashboards-plugin/integration_tests/detector/create_usb_detector_data.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,57 @@ | ||
| { | ||
| "type": "detector", | ||
| "detector_type": "windows", | ||
| "name": "Cypress USB Detector", | ||
| "enabled": true, | ||
| "createdBy": "", | ||
| "schedule": { | ||
| "period": { | ||
| "interval": 1, | ||
| "unit": "MINUTES" | ||
| } | ||
| }, | ||
| "inputs": [ | ||
| { | ||
| "detector_input": { | ||
| "description": "Detect USB plugged in.", | ||
| "indices": ["cypress-index-windows"], | ||
| "pre_packaged_rules": [], | ||
| "custom_rules": [ | ||
| { | ||
| "id": "25b9c01c-350d-4b95-bed1-836d04a4f324" | ||
| } | ||
| ] | ||
| } | ||
| } | ||
| ], | ||
| "triggers": [ | ||
| { | ||
| "name": "USB plugged in alert", | ||
| "sev_levels": ["low"], | ||
| "tags": ["windows.usb"], | ||
| "actions": [ | ||
| { | ||
| "id": "", | ||
| "name": "Triggered alert condition: - Severity: 1 (Highest) - Threat detector: USB Detector", | ||
| "destination_id": "", | ||
| "subject_template": { | ||
| "source": "Triggered alert condition: - Severity: 1 (Highest) - Threat detector: USB Detector", | ||
| "lang": "mustache" | ||
| }, | ||
| "message_template": { | ||
| "source": "Triggered alert condition: \nSeverity: 1 (Highest)\nThreat detector: USB Detector\nDescription: Detect USB plugged in.\nDetector data sources:\n\twindows", | ||
| "lang": "mustache" | ||
| }, | ||
| "throttle_enabled": false, | ||
| "throttle": { | ||
| "value": 10, | ||
| "unit": "MINUTES" | ||
| } | ||
| } | ||
| ], | ||
| "types": ["windows"], | ||
| "severity": "1", | ||
| "ids": ["25b9c01c-350d-4b95-bed1-836d04a4f123"] | ||
| } | ||
| ] | ||
| } |
28 changes: 28 additions & 0 deletions
28
...ytics-dashboards-plugin/integration_tests/detector/create_usb_detector_mappings_data.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,28 @@ | ||
| { | ||
| "properties": { | ||
| "event_uid": { | ||
| "type": "alias", | ||
| "path": "EventID" | ||
| }, | ||
| "windows-event_data-CommandLine": { | ||
| "type": "alias", | ||
| "path": "CommandLine" | ||
| }, | ||
| "windows-hostname": { | ||
| "type": "alias", | ||
| "path": "HostName" | ||
| }, | ||
| "windows-message": { | ||
| "type": "alias", | ||
| "path": "Message" | ||
| }, | ||
| "windows-provider-name": { | ||
| "type": "alias", | ||
| "path": "Provider_Name" | ||
| }, | ||
| "windows-servicename": { | ||
| "type": "alias", | ||
| "path": "ServiceName" | ||
| } | ||
| } | ||
| } |
5 changes: 5 additions & 0 deletions
5
...gins/security-analytics-dashboards-plugin/integration_tests/index/add_dns_index_data.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| { | ||
| "DnsAnswerType": "QWE", | ||
| "DnsQuestionRegisteredDomain": "EC2AMAZ-EPWO7HKA", | ||
| "DnsQuestionName": "QWE" | ||
| } |
39 changes: 39 additions & 0 deletions
39
.../security-analytics-dashboards-plugin/integration_tests/index/add_windows_index_data.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| { | ||
| "EventTime": "2020-02-04T14:59:39.343541+00:00", | ||
| "HostName": "EC2AMAZ-EPO7HKA", | ||
| "Keywords": "9223372036854775808", | ||
| "SeverityValue": 2, | ||
| "Severity": "ERROR", | ||
| "EventID": 2003, | ||
| "SourceName": "Microsoft-Windows-Sysmon", | ||
| "ProviderGuid": "{5770385F-C22A-43E0-BF4C-06F5698FFBD9}", | ||
| "Version": 5, | ||
| "TaskValue": 22, | ||
| "OpcodeValue": 0, | ||
| "RecordNumber": 9532, | ||
| "ExecutionProcessID": 1996, | ||
| "ExecutionThreadID": 2616, | ||
| "Channel": "Microsoft-Windows-Sysmon/Operational", | ||
| "Domain": "NT AUTHORITY", | ||
| "AccountName": "SYSTEM", | ||
| "UserID": "S-1-5-18", | ||
| "AccountType": "User", | ||
| "Message": "Dns query:\r\nRuleName: \r\nUtcTime: 2020-02-04 14:59:38.349\r\nProcessGuid: {b3c285a4-3cda-5dc0-0000-001077270b00}\r\nProcessId: 1904\r\nQueryName: EC2AMAZ-EPO7HKA\r\nQueryStatus: 0\r\nQueryResults: 172.31.46.38;\r\nImage: C:\\Program Files\\nxlog\\nxlog.exe", | ||
| "Category": "Dns query (rule: DnsQuery)", | ||
| "Opcode": "Info", | ||
| "UtcTime": "2020-02-04 14:59:38.349", | ||
| "ProcessGuid": "{b3c285a4-3cda-5dc0-0000-001077270b00}", | ||
| "ProcessId": "1904", | ||
| "QueryName": "EC2AMAZ-EPO7HKA", | ||
| "QueryStatus": "0", | ||
| "QueryResults": "172.31.46.38;", | ||
| "Image": "C:\\Program Files\\nxlog\\regsvr32.exe", | ||
| "EventReceivedTime": "2020-02-04T14:59:40.780905+00:00", | ||
| "SourceModuleName": "in", | ||
| "SourceModuleType": "im_msvistalog", | ||
| "CommandLine": "eachtest", | ||
| "Initiated": "true", | ||
| "Provider_Name": "Service_ws_Control_ws_Manager", | ||
| "TargetObject": "\\SOFTWARE\\Microsoft\\Office\\Outlook\\Security", | ||
| "EventType": "SetValue" | ||
| } |
21 changes: 21 additions & 0 deletions
21
...ins/security-analytics-dashboards-plugin/integration_tests/index/create_dns_settings.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,21 @@ | ||
| { | ||
| "mappings": { | ||
| "properties": { | ||
| "DnsAnswerType": { | ||
| "type": "text" | ||
| }, | ||
| "DnsQuestionRegisteredDomain": { | ||
| "type": "text" | ||
| }, | ||
| "DnsQuestionName": { | ||
| "type": "text" | ||
| } | ||
| } | ||
| }, | ||
| "settings": { | ||
| "index": { | ||
| "number_of_shards": "1", | ||
| "number_of_replicas": "1" | ||
| } | ||
| } | ||
| } |
30 changes: 30 additions & 0 deletions
30
...security-analytics-dashboards-plugin/integration_tests/index/create_windows_settings.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| { | ||
| "mappings": { | ||
| "properties": { | ||
| "CommandLine": { | ||
| "type": "text" | ||
| }, | ||
| "EventID": { | ||
| "type": "integer" | ||
| }, | ||
| "HostName": { | ||
| "type": "text" | ||
| }, | ||
| "Message": { | ||
| "type": "text" | ||
| }, | ||
| "Provider_Name": { | ||
| "type": "text" | ||
| }, | ||
| "ServiceName": { | ||
| "type": "text" | ||
| } | ||
| } | ||
| }, | ||
| "settings": { | ||
| "index": { | ||
| "number_of_shards": "1", | ||
| "number_of_replicas": "1" | ||
| } | ||
| } | ||
| } |
26 changes: 26 additions & 0 deletions
26
.../plugins/security-analytics-dashboards-plugin/integration_tests/rule/create_dns_rule.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| { | ||
| "id": "25b9c01c-350d-4b95-bed1-836d04a4f325", | ||
| "category": "dns", | ||
| "title": "Cypress DNS Rule", | ||
| "description": "Detects DNS name as QWE", | ||
| "status": "experimental", | ||
| "author": "Cypress Tests", | ||
| "references": [ | ||
| { | ||
| "value": "" | ||
| } | ||
| ], | ||
| "tags": [ | ||
| { | ||
| "value": "dns.low" | ||
| } | ||
| ], | ||
| "log_source": "", | ||
| "detection": "selection:\n DnsQuestionName:\n - QWE\n - ASD\n - YXC\ncondition: selection", | ||
| "level": "low", | ||
| "false_positives": [ | ||
| { | ||
| "value": "" | ||
| } | ||
| ] | ||
| } |
26 changes: 26 additions & 0 deletions
26
.../security-analytics-dashboards-plugin/integration_tests/rule/create_windows_usb_rule.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| { | ||
| "id": "25b9c01c-350d-4b95-bed1-836d04a4f123", | ||
| "category": "windows", | ||
| "title": "Cypress USB Rule", | ||
| "description": "USB plugged-in rule", | ||
| "status": "experimental", | ||
| "author": "Cypress Tests", | ||
| "references": [ | ||
| { | ||
| "value": "" | ||
| } | ||
| ], | ||
| "tags": [ | ||
| { | ||
| "value": "windows.usb" | ||
| } | ||
| ], | ||
| "log_source": "", | ||
| "detection": "selection:\n EventID:\n - 2003\n - 2100\n - 2102\ncondition: selection", | ||
| "level": "low", | ||
| "false_positives": [ | ||
| { | ||
| "value": "" | ||
| } | ||
| ] | ||
| } |
16 changes: 16 additions & 0 deletions
16
cypress/fixtures/plugins/security-analytics-dashboards-plugin/sample_alias_mappings.json
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| { | ||
| "properties": { | ||
| "source_ip": { | ||
| "type": "alias", | ||
| "path": "src_ip" | ||
| }, | ||
| "windows-event_data-CommandLine": { | ||
| "path": "CommandLine", | ||
| "type": "alias" | ||
| }, | ||
| "event_uid": { | ||
| "path": "EventID", | ||
| "type": "alias" | ||
| } | ||
| } | ||
| } |
Oops, something went wrong.