27 lines
976 B
Go
27 lines
976 B
Go
package rules
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestCompileThreshold(t *testing.T) {
|
|
r := Rule{ID: "failed", Title: "Failed", Severity: "high", Kind: "threshold", Enabled: true, EventCodes: []uint32{4625}, GroupBy: []string{"host", "user", "source_ip"}, Threshold: 20, WindowSeconds: 300, Summary: "{count} failures for {user}"}
|
|
q, _, err := Compile(r, "siem", "default", time.Date(2026, 7, 23, 12, 0, 0, 0, time.UTC))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
for _, want := range []string{"event_code IN (4625)", "GROUP BY host_name", "HAVING cnt >= 20"} {
|
|
if !strings.Contains(q, want) {
|
|
t.Fatalf("query missing %q: %s", want, q)
|
|
}
|
|
}
|
|
}
|
|
func TestRejectUnknownField(t *testing.T) {
|
|
r := Rule{ID: "bad", Title: "Bad", Severity: "high", Kind: "event", EventCodes: []uint32{1}, Conditions: []Condition{{Field: "DROP TABLE", Operator: "equals", Value: "x"}}, WindowSeconds: 300}
|
|
if err := Validate(r); err == nil {
|
|
t.Fatal("expected validation error")
|
|
}
|
|
}
|