38 lines
1.6 KiB
Go
38 lines
1.6 KiB
Go
package normalize
|
|
|
|
import (
|
|
"testing"
|
|
"time"
|
|
|
|
"example.com/siem-greenfield/internal/contracts"
|
|
)
|
|
|
|
func TestEvent4740ExtractsCallerComputer(t *testing.T) {
|
|
xml := `<Event><System><Provider Name="Microsoft-Windows-Security-Auditing"/><Computer>DC01.example.local</Computer></System><EventData><Data Name="TargetUserName">alice</Data><Data Name="CallerComputerName">CLIENT-42</Data></EventData></Event>`
|
|
env := contracts.IngestEnvelope{TenantID: "default", AgentID: "agent-1", BatchUID: "batch-abc", ReceivedAt: time.Date(2026, 7, 23, 12, 0, 1, 0, time.UTC)}
|
|
p := contracts.LogPayload{Hostname: "DC01", Channel: "Security", EventID: 4740, Source: "windows-agent", Time: time.Date(2026, 7, 23, 12, 0, 0, 0, time.UTC), Message: xml}
|
|
e := Event(env, p, "2026/07/raw.json.gz", 3, 99, 4)
|
|
if e.EventUID != "batch-abc:4" {
|
|
t.Fatalf("event uid = %q", e.EventUID)
|
|
}
|
|
if e.TargetUser != "alice" || e.Workstation != "CLIENT-42" {
|
|
t.Fatalf("unexpected normalized event: %#v", e)
|
|
}
|
|
if e.Action != "account_locked" || e.Severity != 4 {
|
|
t.Fatalf("unexpected classification: action=%s severity=%d", e.Action, e.Severity)
|
|
}
|
|
if e.Message != "" {
|
|
t.Fatalf("raw XML must not be stored as message")
|
|
}
|
|
if len(e.Attributes) != 0 {
|
|
t.Fatalf("promoted fields must not be duplicated in attributes: %#v", e.Attributes)
|
|
}
|
|
}
|
|
|
|
func TestWMI5857IsGenericNotDetectionClass(t *testing.T) {
|
|
cat, action, _, sev := classify("Microsoft-Windows-WMI-Activity/Operational", 5857)
|
|
if cat != "event" || action != "observed" || sev != 1 {
|
|
t.Fatalf("unexpected WMI classification: %s %s %d", cat, action, sev)
|
|
}
|
|
}
|