def test_create_provider(self): """Test method.""" qry_prov = QueryProvider("LocalData") qry_prov.connect() self.assertTrue(qry_prov.connected) queries = qry_prov.list_queries() self.assertGreaterEqual(len(queries), 8) self.assertIn("SecurityAlert.list_alerts", queries) self.assertIn("WindowsSecurity.list_host_events", queries) self.assertIn("Network.list_azure_network_flows_by_ip", queries)
def test_additional_queries(self): """Test method.""" data_path = get_test_data_path() query_path = str(Path(get_test_data_path()) / "localdata") qry_prov = QueryProvider("LocalData", data_paths=[data_path], query_paths=[query_path]) queries = qry_prov.list_queries() self.assertGreaterEqual(len(queries), 11) for query in queries: qry_func = getattr(qry_prov, query) d_frame = qry_func() self.assertIsInstance(d_frame, pd.DataFrame) self.assertGreaterEqual(len(d_frame), 1)
def test_load_yaml_def(self): la_provider = QueryProvider( data_environment="LogAnalytics", driver=self.provider ) with self.assertRaises((ImportError, ValueError)) as cm: file_path = Path(_TEST_DATA, "data_q_meta_fail.yaml") la_provider.import_query_file(query_file=file_path) self.assertIn("no data families defined", str(cm.exception)) with self.assertRaises((ImportError, ValueError)) as cm: file_path = Path(_TEST_DATA, "data_q_source_fail_param.yaml") la_provider.import_query_file(query_file=file_path) self.assertIn("Missing parameters are", str(cm.exception)) with self.assertRaises((ImportError, ValueError)) as cm: file_path = Path(_TEST_DATA, "data_q_source_fail_type.yaml") la_provider.import_query_file(query_file=file_path) self.assertIn("Parameters with missing types", str(cm.exception)) before_queries = len(list(la_provider.list_queries())) file_path = Path(_TEST_DATA, "data_q_success.yaml") la_provider.import_query_file(query_file=file_path) self.assertEqual(before_queries + 3, len(list(la_provider.list_queries())))
def test_queries(self): """Test method.""" data_path = Path(get_test_data_path()) / "localdata" qry_prov = QueryProvider("LocalData", data_paths=[str(data_path)]) queries = qry_prov.list_queries() for query in queries: qry_func = getattr(qry_prov, query) d_frame = qry_func() self.assertIsInstance(d_frame, pd.DataFrame) self.assertGreater(len(d_frame), 1) schema = qry_prov.schema for cols in schema.values(): self.assertIsInstance(cols, dict) self.assertGreater(len(cols), 10)
def test_additional_queries(self): """Test method.""" data_path = get_test_data_path() query_path = str(Path(get_test_data_path()) / "localdata") qry_prov = QueryProvider("LocalData", data_paths=[data_path], query_paths=[query_path]) queries = qry_prov.list_queries() self.assertGreaterEqual(len(queries), 11) qry_params = { "start": -1, "end": 0, "ip_address_list": ["test"], "host_name": "test", "account_name": "test", } for query in queries: qry_func = getattr(qry_prov, query) d_frame = qry_func(**qry_params) self.assertIsInstance(d_frame, pd.DataFrame) self.assertGreaterEqual(len(d_frame), 1)