luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): enrich snapshots asynchronously

Browse source
This commit is contained in:
Luna 2026-07-22 03:10:26 -07:00
parent 1ab4add205
commit eff31b3a82
No known key found for this signature in database
7 changed files with 270 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

47
go-agent/internal/snapshot/store_test.go
View file

@ -130,6 +130,53 @@ func TestCaptureEventLinksMergedSnapshotToOneIncident(t *testing.T) {
}
}
func TestSlowEnrichmentAddsBoundedHashAndFileMetadata(t *testing.T) {
store, err := New(t.TempDir(), "/unused", 10, 30)
if err != nil {
t.Fatal(err)
}
store.EnableSlowEnrichment()
defer store.Close()
exe := filepath.Join(store.Dir, "payload")
watch := filepath.Join(store.Dir, "persistence.service")
if err := os.WriteFile(exe, []byte("stage-one"), 0o700); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(watch, []byte("[Service]"), 0o600); err != nil {
t.Fatal(err)
}
store.Collect = func(pid int) ProcessDetail {
return ProcessDetail{PID: pid, Comm: "payload", Exe: exe, FDs: map[string]string{}}
}
event := alertEvent("2026-07-22T10:11:12Z", model.Alert{SID: 1, Severity: "HIGH", Signature: "test", Classtype: "test", Key: "file", Detail: "modified " + watch, PIDs: []int{42}})
if _, err := store.CaptureEvent(event); err != nil {
t.Fatal(err)
}
store.FlushSlow()
raw, err := os.ReadFile(filepath.Join(store.Dir, "alert-20260722-101112.json"))
if err != nil {
t.Fatal(err)
}
var report Report
if err := json.Unmarshal(raw, &report); err != nil {
t.Fatal(err)
}
processes := report.Enrichment["processes"].([]any)
process := processes[0].(map[string]any)
if digest, ok := process["exe_sha256"].(string); !ok || len(digest) != 64 {
t.Fatalf("process enrichment=%#v", process)
}
files := report.Enrichment["files"].([]any)
file := files[0].(map[string]any)
if file["exists"] != true || file["mode"] != float64(0o600) {
t.Fatalf("file enrichment=%#v", file)
}
logRaw, err := os.ReadFile(filepath.Join(store.Dir, "alert-20260722-101112.log"))
if err != nil || !strings.Contains(string(logRaw), "ENODIA SENTINEL ALERT") {
t.Fatalf("slow log err=%v text=%q", err, logRaw)
}
}
func TestRetentionPrunesCountAndAgeAsPairs(t *testing.T) {
store, err := New(t.TempDir(), "/unused", 2, 1)
if err != nil {