def test_two_step_finding_from_reference_time_with_duration(mocker):
step_query = make_query(
"two step query for findings with category ADDED on buckets within "
"a week from reference time")
step_query['joins'] = [
make_join('ASSET', 1, 'SINGLE',
'securityCenterProperties.resourceName'),
make_join('FINDING', 2, 'SINGLE', 'resourceName')
]
step_query['steps'] = [(make_step(
'ASSET', 1,
'securityCenterProperties.resourceType = "google.cloud.storage.Bucket"',
'timestamp', '2018-4-25T18:00:00-0800', '1w')),
(make_step('FINDING', 2, 'category="ADDED"'))]
step_query['threshold'] = make_threshold('gt', 10000000)
with mocker.mock_module.patch(
target='tests.query_executor_test.process_query',
return_value=mock_two_step_asset_from_reference_time_with_duration()) \
as mock:
# when
response = process_query(step_query)
# then
assert mock.called
assert len(response) is not 0
for finding in response:
assert finding.state != 'UNUSED'
def test_two_steps_asset_mark_query(mocker):
#given
two_step_query = make_query("two step query for project join with marks")
two_step_query['joins'] = [
(make_join(
'ASSET', 1, 'SINGLE',
'securityMarks.marks.scc_query_6f04f632-3276-4ff3-b32a-92f794fb0f2f'
)),
(make_join(
'ASSET', 2, 'SINGLE',
'securityMarks.marks.scc_query_6f04f632-3276-4ff3-b32a-92f794fb0f2f'
))
]
two_step_query['steps'] = [
(make_step(
'ASSET', 1,
'securityCenterProperties.resourceType = "google.cloud.resourcemanager.Project" AND '
'securityCenterProperties.resourceOwners : "dandrade"')),
(make_step('ASSET', 2,
'resourceProperties.projectId = "asset-dev-project"'))
]
two_step_query['threshold'] = make_threshold('gt', 1000000)
with mocker.mock_module.patch(
target='tests.query_executor_test.process_query',
return_value=mock_two_steps_asset_mark_query()) as mock:
# when
response = process_query(two_step_query)
# then
assert mock.called
assert len(response) is not 0
def test_one_step_asset_from_reference_time_timestamp(mocker):
step_query = make_query(
"one step query for networks created before reference time")
step_query['joins'] = [
make_join('ASSET', 1, 'SINGLE',
'securityCenterProperties.resourceType')
]
step_query['steps'] = [(make_step(
'ASSET', 1,
'securityCenterProperties.resourceType = "google.compute.Network"',
'timestamp', '2018-04-25T18:00:00+0400'))]
step_query['threshold'] = make_threshold('gt', 10000000)
with mocker.mock_module.patch(
target='tests.query_executor_test.process_query',
return_value=mock_one_step_asset_from_reference_time_timestamp()) \
as mock:
# when
response = process_query(step_query)
# then
assert mock.called
assert len(response) is not 0
for asset in response:
assert asset.state == 'UNUSED'
def test_two_steps_asset_attribute_mult_query(mocker):
two_step_query = make_query(
"two step query for project join with attributes of type Mult")
two_step_query['joins'] = [
(make_join('ASSET', 1, 'MULT',
'securityCenterProperties.resourceOwners')),
(make_join('ASSET', 2, 'MULT',
'securityCenterProperties.resourceOwners'))
]
two_step_query['steps'] = [
(make_step(
'ASSET', 1,
'securityCenterProperties.resourceType = "google.cloud.resourcemanager.Project" AND '
'securityCenterProperties.resourceOwners : "dandrade"')),
(make_step(
'ASSET', 2,
'securityCenterProperties.resourceType = "google.cloud.resourcemanager.Project" '
))
]
two_step_query['threshold'] = make_threshold('gt', 10000000)
with mocker.mock_module.patch(
target='tests.query_executor_test.process_query',
return_value=mock_two_steps_asset_attribute_mult_query()) as mock:
# when
response = process_query(two_step_query)
# then
assert mock.called
assert len(response) is not 0
def test_two_steps_asset_finding(mocker):
#given
two_step_query = make_query("two step query with assets and findings")
two_step_query['joins'] = [
(make_join('ASSET', 1, 'SINGLE',
'securityCenterProperties.resourceName')),
(make_join('FINDING', 2, 'SINGLE', 'resourceName'))
]
two_step_query['steps'] = [
(make_step(
'ASSET', 1,
'securityCenterProperties.resourceType = "google.compute.Firewall"'
)),
(make_step('FINDING', 2,
'securityMarks.marks.test-mark = "test-mark-value-sz"'))
]
two_step_query['threshold'] = make_threshold('gt', 1000000)
with mocker.mock_module.patch(
target='tests.query_executor_test.process_query',
return_value=mock_two_steps_asset_finding()) as mock:
# when
response = process_query(two_step_query)
# then
assert mock.called
assert len(response) is not 0
def test_finding_with_form_last_executiuon():
pytest.skip("skip integration tests")
query = make_query("query findings")
query['joins'] = [(make_join('FINDING', 1, 'SINGLE', 'resourceName'))]
query['steps'] = [
(make_step('FINDING',
1,
'category = "resource_involved_in_coin_mining"',
fromLastExecution='true'))
]
query['threshold'] = make_threshold('gt', 1000000)
#set_query_last_execution(query,1550589452000)
response = process_query(query)
def test_one_step_finding_from_reference_time_fromnow(mocker):
step_query = make_query("one step query for findings on category")
step_query['joins'] = [make_join('FINDING', 1, 'SINGLE', '')]
step_query['steps'] = [
(make_step('FINDING', 1, 'category : "CONTAINER_RUNTIME_ANOMALY"',
'from_now', '2d+7h+20m'))
]
step_query['threshold'] = make_threshold('gt', 10000000)
with mocker.mock_module.patch(
target='tests.query_executor_test.process_query',
return_value=mock_one_step_finding_from_reference_time_fromnow()) \
as mock:
# when
response = process_query(step_query)
# then
assert mock.called
assert len(response) is not 0