E2E design and implementation: Yara

[juliamagan]

Description

The test research was accomplished in this issue. So, in this issue, we will design and develop the E2E test to cover those use cases.

Tasks

• Design the test
• Implement the test locally
• Refactor the test for it to work in the test environment

Conclusion

WIP.

[juliamagan]

On Hold because of Release Candidate Manual Testing.

[mauromalara]

Task 1: Design the test 🟢

The added module tests the integration with Yara. The only precondition to run is to create an inventory as follows:

all:
  hosts:
    wazuh-manager:
      ansible_connection: ssh
      ansible_user: <VM USER>
      ansible_ssh_private_key_file: <PRIVATE KEY PATH>
      ansible_python_interpreter: <PYTHON INTERPRETER PATH>
      dashboard_user: <USER>
      dashboard_password: <PASS>

The test structure is the following:

tests/end_to_end/test_yara_integration/
├── data
│   ├── configuration
│   │   ├── malware_downloader.sh
│   │   └── yara.sh
│   ├── playbooks
│   │   ├── configuration.yaml
│   │   ├── generate_events.yaml
│   │   └── teardown.yaml
│   └── test_cases
│       └── cases_yara_integration.yaml
└── test_yara_integration.py

• configuration: this folder contains all necessary scripts to generate the events that must trigger alerts in the manager.
• playbooks: this folder contains all necessary Ansible playbooks to (1) prepare the environment, (2) generate the events and get alerts, and (3) clean the environment.
• test_cases: this folder contains a YAML file with the test cases that will be executed in this test (in this stage we will only create 1 test case).
• test_yara_integration.py: this is the module that test the integration.

[mauromalara]

Task 2: Implement the test locally 🟢

Development branch	Pull Request
3085-test-yara-integration	#3115

How to execute the test:

python -m pytest tests/end_to_end/TEST-PATH --inventory_path PATH-TO-INVENTORY

Executions

Tester	Test path	Jenkins	Local	OS	Commit	Notes
@mauromalara (Developer)	end_to_end/test_yara_integration	n/a	🟢 🟢 🟢	CentOS	3619a69	Nothing to highlight

[mauromalara]

Update 26/07/2022

The requested changes were applied. The status of the issue is set to "Pending Review"