def _get_formatter(output_format):
if output_format == FileEventsOutputFormat.JSON:
return FileEventDictToJSONFormatter()
elif output_format == FileEventsOutputFormat.CEF:
return FileEventDictToCEFFormatter()
else:
return FileEventDictToRawJSONFormatter()
def test_format_is_okay_with_null_values(self, mock_file_event_log_record):
json_out = FileEventDictToRawJSONFormatter().format(
mock_file_event_log_record)
file_event_dict = json.loads(json_out)
assert (file_event_dict["actor"] is None
) # actor happens to be null in this case.
def test_format_returns_expected_number_of_fields(
self, mock_file_event_log_record):
json_out = FileEventDictToRawJSONFormatter().format(
mock_file_event_log_record)
file_event_dict = json.loads(json_out)
assert len(file_event_dict) == 40