68 lines
2.4 KiB
Python
68 lines
2.4 KiB
Python
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""The SID registry is unique, complete, and matches the engine sources."""
|
|
import unittest
|
|
|
|
from enodia_sentinel import fim, pkgdb, posture, rootcheck, sids
|
|
from enodia_sentinel.detectors import (
|
|
credential_access,
|
|
input_snooper,
|
|
memory_obfuscation,
|
|
stealth_network,
|
|
)
|
|
from enodia_sentinel.events.rules import DEFAULT_EXEC_RULES
|
|
from enodia_sentinel.events.host_rules import DEFAULT_HOST_RULES
|
|
from enodia_sentinel.events.syscall_rules import DEFAULT_SYSCALL_RULES
|
|
|
|
|
|
class TestRegistry(unittest.TestCase):
|
|
def test_sids_are_unique(self):
|
|
nums = [s.sid for s in sids.BUILTIN_SIDS]
|
|
self.assertEqual(len(nums), len(set(nums)))
|
|
|
|
def test_count_and_helpers(self):
|
|
self.assertEqual(len(sids.BUILTIN_SIDS), 53)
|
|
self.assertEqual(
|
|
sids.all_sids(), frozenset(s.sid for s in sids.BUILTIN_SIDS)
|
|
)
|
|
self.assertEqual(
|
|
sids.engine_sids("exec_rule"),
|
|
frozenset({100001, 100002, 100003, 100004}),
|
|
)
|
|
|
|
def test_event_rule_sids_match_engines(self):
|
|
self.assertEqual(
|
|
sids.engine_sids("exec_rule"),
|
|
frozenset(r.sid for r in DEFAULT_EXEC_RULES),
|
|
)
|
|
self.assertEqual(
|
|
sids.engine_sids("syscall_rule"),
|
|
frozenset(r.sid for r in DEFAULT_SYSCALL_RULES),
|
|
)
|
|
self.assertEqual(
|
|
sids.engine_sids("host_rule"),
|
|
frozenset(r.sid for r in DEFAULT_HOST_RULES),
|
|
)
|
|
|
|
def test_registry_uses_the_source_constants(self):
|
|
by_sid = {s.sid: s for s in sids.BUILTIN_SIDS}
|
|
for const, engine in (
|
|
(fim.SID_MODIFIED, "fim"),
|
|
(pkgdb.SID_PKGDB, "pkgdb"),
|
|
(rootcheck.SID_HIDDEN_PROC, "rootcheck"),
|
|
(posture.SID_SSH_ROOT_LOGIN, "posture"),
|
|
(input_snooper.SID_INPUT_SNOOPER, "detector"),
|
|
(credential_access.SID_CREDENTIAL_ACCESS, "detector"),
|
|
(stealth_network.SID_STEALTH_NETWORK, "detector"),
|
|
(memory_obfuscation.SID_PROCESS_HIDING_LIBRARY, "detector"),
|
|
):
|
|
self.assertIn(const, by_sid)
|
|
self.assertEqual(by_sid[const].engine, engine)
|
|
|
|
def test_every_entry_has_name_and_module(self):
|
|
for entry in sids.BUILTIN_SIDS:
|
|
self.assertTrue(entry.name)
|
|
self.assertTrue(entry.module.startswith("enodia_sentinel"))
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|