<NME> test_deadman_generic.py
<BEF> ADDFILE
<MSG> Add basic generic deadman PoC

<DFF> @@ -0,0 +1,73 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+# Copyright (c) 2017 Mozilla Corporation
+from positive_alert_test_case import PositiveAlertTestCase
+from negative_alert_test_case import NegativeAlertTestCase
+from alert_test_suite import AlertTestSuite
+
+
+class TestDeadman_Generic(AlertTestSuite):
+    alert_filename = "deadman_generic"
+    alert_classname = "AlertDeadman_Generic"
+    deadman = True
+
+    # This event is the default positive event that will cause the
+    # alert to trigger
+    default_event = {
+        "_type": "event",
+        "_source": {
+            "category": "helloworld",
+            "details": {
+                "sourceipaddress": "1.2.3.4",
+            }
+        }
+    }
+
+    # This alert is the expected result from running this task
+    default_alert = {
+        "category": "deadman",
+        "tags": ['deadman'],
+        "severity": "ERROR",
+        "summary": 'Deadman check failed for \'Basic deadman\'',
+    }
+
+    test_cases = []
+
+    test_cases.append(
+        PositiveAlertTestCase(
+            description="Positive test with default events and default alert expected",
+            events=AlertTestSuite.create_events(default_event, 1),
+            expected_alert=default_alert
+        )
+    )
+
+    # events = AlertTestSuite.create_events(default_event, 10)
+    # for event in events:
+    #     event['_source']['category'] = 'bad'
+    # test_cases.append(
+    #     NegativeAlertTestCase(
+    #         description="Negative test case with events with incorrect category",
+    #         events=events,
+    #     )
+    # )
+
+    # events = AlertTestSuite.create_events(default_event, 10)
+    # for event in events:
+    #     event['_source']['details']['sourceipaddress'] = None
+    # test_cases.append(
+    #     NegativeAlertTestCase(
+    #         description="Negative test case with events with non-existent sourceipaddress",
+    #         events=events,
+    #     )
+    # )
+
+    # for event in events:
+    #     event['_source']['utctimestamp'] = AlertTestSuite.subtract_from_timestamp_lambda(date_timedelta={'minutes': 21})
+    #     event['_source']['receivedtimestamp'] = AlertTestSuite.subtract_from_timestamp_lambda(date_timedelta={'minutes': 21})
+    # test_cases.append(
+    #     NegativeAlertTestCase(
+    #         description="Negative test case with old timestamp",
+    #         events=events,
+    #     )
+    # )

{'commit': 'diff --git a/alerts/deadman_generic.json b/alerts/deadman_generic.json\nnew file mode 100644\nindex 00000000..4c60fc69\n--- /dev/null\n+++ b/alerts/deadman_generic.json\n@@ -0,0 +1,14 @@\n+{\n+    "alerts": [\n+        {\n+            "search_query": "ABC12345436",\n+            "time_window": "1",\n+            "description": "Basic deadman"\n+        },\n+        {\n+            "search_query": "anotherterm",\n+            "time_window": "20",\n+            "description": "Another deadman"\n+        }\n+    ]\n+}\n\\ No newline at end of file\ndiff --git a/alerts/deadman_generic.py b/alerts/deadman_generic.py\nnew file mode 100644\nindex 00000000..b836001a\n--- /dev/null\n+++ b/alerts/deadman_generic.py\n@@ -0,0 +1,40 @@\n+#!/usr/bin/env python\n+\n+# This Source Code Form is subject to the terms of the Mozilla Public\n+# License, v. 2.0. If a copy of the MPL was not distributed with this\n+# file, You can obtain one at http://mozilla.org/MPL/2.0/.\n+# Copyright (c) 2014 Mozilla Corporation\n+\n+\n+from lib.alerttask import AlertTask\n+from mozdef_util.query_models import SearchQuery, QueryStringMatch\n+from mozdef_util.utilities.logger import logger\n+\n+\n+class AlertDeadman_Generic(AlertTask):\n+\n+    def main(self):\n+        self._config = self.parse_json_alert_config(\'deadman_generic.json\')\n+\n+        for alert_cfg in self._config[\'alerts\']:\n+            try:\n+                self.process_alert(alert_cfg)\n+            except Exception:\n+                logger.error("Processing rule file {} failed".format(alert_cfg.__str__()))\n+\n+    def process_alert(self, alert_config):\n+        search_query = SearchQuery(minutes=int(alert_config[\'time_window\']))\n+        search_query.add_must(QueryStringMatch(str(alert_config[\'search_query\'])))\n+        self.filtersManual(search_query)\n+        self.searchEventsSimple()\n+        self.walkEvents(description=alert_config[\'description\'])\n+\n+    # Set alert properties\n+    # if no events found\n+    def onNoEvent(self, description):\n+        category = \'deadman\'\n+        tags = [\'deadman\']\n+        severity = \'ERROR\'\n+\n+        summary = "Deadman check failed for \'{0}\'".format(description)\n+        return self.createAlertDict(summary, category, tags, [], severity=severity)\ndiff --git a/tests/alerts/test_deadman_generic.py b/tests/alerts/test_deadman_generic.py\nnew file mode 100644\nindex 00000000..29894930\n--- /dev/null\n+++ b/tests/alerts/test_deadman_generic.py\n@@ -0,0 +1,73 @@\n+# This Source Code Form is subject to the terms of the Mozilla Public\n+# License, v. 2.0. If a copy of the MPL was not distributed with this\n+# file, You can obtain one at http://mozilla.org/MPL/2.0/.\n+# Copyright (c) 2017 Mozilla Corporation\n+from positive_alert_test_case import PositiveAlertTestCase\n+from negative_alert_test_case import NegativeAlertTestCase\n+from alert_test_suite import AlertTestSuite\n+\n+\n+class TestDeadman_Generic(AlertTestSuite):\n+    alert_filename = "deadman_generic"\n+    alert_classname = "AlertDeadman_Generic"\n+    deadman = True\n+\n+    # This event is the default positive event that will cause the\n+    # alert to trigger\n+    default_event = {\n+        "_type": "event",\n+        "_source": {\n+            "category": "helloworld",\n+            "details": {\n+                "sourceipaddress": "1.2.3.4",\n+            }\n+        }\n+    }\n+\n+    # This alert is the expected result from running this task\n+    default_alert = {\n+        "category": "deadman",\n+        "tags": [\'deadman\'],\n+        "severity": "ERROR",\n+        "summary": \'Deadman check failed for \\\'Basic deadman\\\'\',\n+    }\n+\n+    test_cases = []\n+\n+    test_cases.append(\n+        PositiveAlertTestCase(\n+            description="Positive test with default events and default alert expected",\n+            events=AlertTestSuite.create_events(default_event, 1),\n+            expected_alert=default_alert\n+        )\n+    )\n+\n+    # events = AlertTestSuite.create_events(default_event, 10)\n+    # for event in events:\n+    #     event[\'_source\'][\'category\'] = \'bad\'\n+    # test_cases.append(\n+    #     NegativeAlertTestCase(\n+    #         description="Negative test case with events with incorrect category",\n+    #         events=events,\n+    #     )\n+    # )\n+\n+    # events = AlertTestSuite.create_events(default_event, 10)\n+    # for event in events:\n+    #     event[\'_source\'][\'details\'][\'sourceipaddress\'] = None\n+    # test_cases.append(\n+    #     NegativeAlertTestCase(\n+    #         description="Negative test case with events with non-existent sourceipaddress",\n+    #         events=events,\n+    #     )\n+    # )\n+\n+    # for event in events:\n+    #     event[\'_source\'][\'utctimestamp\'] = AlertTestSuite.subtract_from_timestamp_lambda(date_timedelta={\'minutes\': 21})\n+    #     event[\'_source\'][\'receivedtimestamp\'] = AlertTestSuite.subtract_from_timestamp_lambda(date_timedelta={\'minutes\': 21})\n+    # test_cases.append(\n+    #     NegativeAlertTestCase(\n+    #         description="Negative test case with old timestamp",\n+    #         events=events,\n+    #     )\n+    # )\n', 'commit_subject': 'Add basic generic deadman PoC', 'repo_name': 'mozilla/MozDef', 'committer': {'name': 'Brandon Myers', 'email': '9cda508be11a1ae7ceef912b85c196946f0ec5f3@mozilla.com', 'time_sec': '1548358188', 'tz_offset': '-360', 'date': {'seconds': '1548358188'}}, 'commit_tree': '73650682f0ac88d5a65534adfeba9d0223ec1327', 'commit_message': 'Add basic generic deadman PoC\n', 'language_name': 'Python', 'license': 'mpl-2.0', 'hunks': '@@ -0,0 +1,73 @@\n+# This Source Code Form is subject to the terms of the Mozilla Public\n+# License, v. 2.0. If a copy of the MPL was not distributed with this\n+# file, You can obtain one at http://mozilla.org/MPL/2.0/.\n+# Copyright (c) 2017 Mozilla Corporation\n+from positive_alert_test_case import PositiveAlertTestCase\n+from negative_alert_test_case import NegativeAlertTestCase\n+from alert_test_suite import AlertTestSuite\n+\n+\n+class TestDeadman_Generic(AlertTestSuite):\n+    alert_filename = "deadman_generic"\n+    alert_classname = "AlertDeadman_Generic"\n+    deadman = True\n+\n+    # This event is the default positive event that will cause the\n+    # alert to trigger\n+    default_event = {\n+        "_type": "event",\n+        "_source": {\n+            "category": "helloworld",\n+            "details": {\n+                "sourceipaddress": "1.2.3.4",\n+            }\n+        }\n+    }\n+\n+    # This alert is the expected result from running this task\n+    default_alert = {\n+        "category": "deadman",\n+        "tags": [\'deadman\'],\n+        "severity": "ERROR",\n+        "summary": \'Deadman check failed for \\\'Basic deadman\\\'\',\n+    }\n+\n+    test_cases = []\n+\n+    test_cases.append(\n+        PositiveAlertTestCase(\n+            description="Positive test with default events and default alert expected",\n+            events=AlertTestSuite.create_events(default_event, 1),\n+            expected_alert=default_alert\n+        )\n+    )\n+\n+    # events = AlertTestSuite.create_events(default_event, 10)\n+    # for event in events:\n+    #     event[\'_source\'][\'category\'] = \'bad\'\n+    # test_cases.append(\n+    #     NegativeAlertTestCase(\n+    #         description="Negative test case with events with incorrect category",\n+    #         events=events,\n+    #     )\n+    # )\n+\n+    # events = AlertTestSuite.create_events(default_event, 10)\n+    # for event in events:\n+    #     event[\'_source\'][\'details\'][\'sourceipaddress\'] = None\n+    # test_cases.append(\n+    #     NegativeAlertTestCase(\n+    #         description="Negative test case with events with non-existent sourceipaddress",\n+    #         events=events,\n+    #     )\n+    # )\n+\n+    # for event in events:\n+    #     event[\'_source\'][\'utctimestamp\'] = AlertTestSuite.subtract_from_timestamp_lambda(date_timedelta={\'minutes\': 21})\n+    #     event[\'_source\'][\'receivedtimestamp\'] = AlertTestSuite.subtract_from_timestamp_lambda(date_timedelta={\'minutes\': 21})\n+    # test_cases.append(\n+    #     NegativeAlertTestCase(\n+    #         description="Negative test case with old timestamp",\n+    #         events=events,\n+    #     )\n+    # )\n', 'addition_count': 73, 'deletion_count': 0, 'src_file': '/dev/null', 'tgt_file': 'b/tests/alerts/test_deadman_generic.py', 'file_extension': '.py', 'before_file': 'ADDFILE', 'message': 'Add basic generic deadman PoC\n', 'author_name': 'Brandon Myers', 'lang': 'py'}