Testcases for all PAWS collectors

collectors/auth0/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-collector",
-  "version": "1.1.44",
+  "version": "1.1.45",
   "description": "Alert Logic AWS based Auth0 Log Collector extension",
   "repository": {},
   "private": true,

collectors/auth0/test/auth0_mock.js

@@ -70,7 +70,7 @@ const AUTH0_LOG_EVENT = {
         "log_id": "90020200113151943625000993024408641221974042823186448498",
         "_id": "90020200113151943625000993024408641221974042823186448498",
         "isMobile": false
-      };
+};
 
 const FUNCTION_ARN = 'arn:aws:lambda:us-east-1:352283894008:function:test-01-CollectLambdaFunction-2CWNLPPW5XO8';
 const FUNCTION_NAME = 'test-TestCollectLambdaFunction-1JNNKQIPOTEST';

collectors/auth0/test/auth0_test.js

@@ -154,6 +154,48 @@ describe('Unit Tests', function () {
                 done();
             });
         });
+
+        it('log format when type is null or undefined', function (done) {
+            let ctx = {
+                invokedFunctionArn: auth0Mock.FUNCTION_ARN,
+                fail: function (error) {
+                    assert.fail(error);
+                    done();
+                },
+                succeed: function () {
+                    done();
+                }
+            };
+
+            Auth0Collector.load().then(function (creds) {
+                var collector = new Auth0Collector(ctx, creds);
+                auth0Mock.AUTH0_LOG_EVENT.type = null;
+                let fmt = collector.pawsFormatLog(auth0Mock.AUTH0_LOG_EVENT);
+                assert.equal(fmt.messageTypeId, undefined);
+                done();
+            });
+        });
+
+        it('log format when date is null or undefined', function (done) {
+            let ctx = {
+                invokedFunctionArn: auth0Mock.FUNCTION_ARN,
+                fail: function (error) {
+                    assert.fail(error);
+                    done();
+                },
+                succeed: function () {
+                    done();
+                }
+            };
+
+            Auth0Collector.load().then(function (creds) {
+                var collector = new Auth0Collector(ctx, creds);
+                auth0Mock.AUTH0_LOG_EVENT.date=null;
+                let fmt = collector.pawsFormatLog(auth0Mock.AUTH0_LOG_EVENT);
+                assert.equal(fmt.messageTsUs, undefined);
+                done();
+            });
+        });
     });
 
     describe('pawsGetLogs', function () {

collectors/auth0/test/utils_test.js

@@ -39,6 +39,36 @@ describe('Unit Tests', function () {
         });
     });
 
+    describe('Get API Logs with error', function () {
+        it('Get API Logs with error', function (done) {
+            getLogsStub = sinon.stub(auth0Client, 'getLogs').callsFake(
+                function fakeFn() {
+                    return new Promise(function (resolve, reject) {
+                        return reject({ statusCode: 503,
+                               error: "Service Unavailable",
+                              message: "The API service is temporarily unavailable, please try again later"
+                     });
+                    });
+                });
+
+            const startDate = moment().subtract(5, 'minutes');    
+            let state = {
+                since: startDate.toISOString(),
+                poll_interval_sec: 1
+            };
+            let maxPagesPerInvocation = 5;
+            let accumulator = [];
+
+            utils.getAPILogs(auth0Client, state, accumulator, maxPagesPerInvocation)
+                .catch(err => {
+                    assert.equal(err.message, "The API service is temporarily unavailable, please try again later", "Error message is not correct");
+                    getLogsStub.restore();
+                    done();
+                });
+        });
+    });
+
+
     describe('Get API Logs with last log id', function () {
         it('Get API Logs  with last log id', function (done) {
             getLogsStub = sinon.stub(auth0Client, 'getLogs').callsFake(

collectors/carbonblack/package.json

@@ -1,6 +1,6 @@
 {
   "name": "carbonblack-collector",
-  "version": "1.0.40",
+  "version": "1.0.41",
   "description": "Alert Logic AWS based Carbonblack Log Collector",
   "repository": {},
   "private": true,

collectors/carbonblack/test/Carbonblack_test.js

@@ -202,6 +202,48 @@ describe('Unit Tests', function () {
                 done();
             });
         });
+        it('log format success when id is null', function (done) {
+            setAlServiceStub();
+            let ctx = {
+                invokedFunctionArn: carbonblackMock.FUNCTION_ARN,
+                fail: function (error) {
+                    assert.fail(error);
+                    done();
+                },
+                succeed: function () {
+                    done();
+                }
+            };
+
+            CarbonblackCollector.load().then(function (creds) {
+                var collector = new CarbonblackCollector(ctx, creds, 'carbonblack');
+                carbonblackMock.LOG_EVENT.eventId = null;
+                let fmt = collector.pawsFormatLog(carbonblackMock.LOG_EVENT);
+                assert.equal(fmt.messageTypeId, undefined);
+                done();
+            });
+        });
+        it('log format success when eventTime is null', function (done) {
+            setAlServiceStub();
+            let ctx = {
+                invokedFunctionArn: carbonblackMock.FUNCTION_ARN,
+                fail: function (error) {
+                    assert.fail(error);
+                    done();
+                },
+                succeed: function () {
+                    done();
+                }
+            };
+
+            CarbonblackCollector.load().then(function (creds) {
+                var collector = new CarbonblackCollector(ctx, creds, 'carbonblack');
+                carbonblackMock.LOG_EVENT.eventTime = null;
+                let fmt = collector.pawsFormatLog(carbonblackMock.LOG_EVENT);
+                assert.equal(fmt.messageTsUs, undefined);
+                done();
+            });
+        });
     });
 
     describe('NextCollectionStateWithNextPage', function () {
@@ -275,7 +317,7 @@ describe('Unit Tests', function () {
                 var collector = new CarbonblackCollector(ctx, creds, 'carbonblack');
                 const startDate = moment().subtract(3, 'days');
                 const curState = {
-                    stream: "AuditLogEvents",
+                    stream: null,
                     since: startDate.toISOString(),
                     until: startDate.add(2, 'days').toISOString(),
                     nextPage: null,

collectors/carbonblack/test/carbonblack_mock.js

@@ -19,6 +19,8 @@ process.env.paws_api_secret = "api-secret";
 process.env.collector_streams = "[\"AuditLogEvents\", \"SearchAlerts\",\"SearchAlertsCBAnalytics\", \"SearchAlertsWatchlist\"]";
 process.env.paws_collector_param_string_2 = "carbonblackOrgKey";
 process.env.paws_endpoint = "https://api-url.conferdeploy.net";
+process.env.collector_streams_null = "[\"AuditLogEventsCB\", \"SearchAlertsCB\",\"SearchAlertsCBAnalyticsCB\", \"SearchAlertsWatchlistCB\"]";
+
 
 const AIMS_TEST_CREDS = {
     access_key_id: 'test-access-key-id',
@@ -27,7 +29,7 @@ const AIMS_TEST_CREDS = {
 
 const LOG_EVENT =  {
     "requestUrl": null,
-    "eventTime": 1529332687006,
+    "eventTime": "2020-05-30T13:49:11.789012Z",
     "eventId": "37075c01730511e89504c9ba022c3fbf",
     "loginName": "[email protected]",
     "orgName": "example.org",

collectors/carbonblack/test/utils_test.js

@@ -115,5 +115,104 @@ describe('Unit Tests', function () {
         });
     });
 });
+describe('Get API Logs (GET) with Error', function () {
+    it('Get API Logs with Error (GET)', function (done) {
+        alserviceStub.get = sinon.stub(RestServiceClient.prototype, 'get').callsFake(
+            function fakeFn(path, extraOptions) {
+                return new Promise(function (resolve, reject) {
+                    return reject(new Error("Failed to fetch API logs due to an authentication issue"));
+                });
+            });
+        let maxPagesPerInvocation = 5;
+        const startDate = moment().subtract(5, 'minutes');
+        let state = {
+            stream: "AuditLogEvents",
+            since: startDate.toISOString(),
+            until: startDate.add(5, 'minutes').toISOString(),
+            poll_interval_sec: 1
+        };
+        let apiDetails = {
+            url: "url",
+            method: "GET",
+            requestBody:"",
+            typeIdPaths: [{ path: ["eventId"] }],
+            tsPaths: [{ path: ["eventTime"] }]
+        };
+        let accumulator = [];
+        const apiEndpoint = process.env.paws_endpoint;
+        const clientSecret = process.env.paws_api_secret;
+        const clientId = process.env.paws_api_client_id;
+
+        utils.getAPILogs(apiDetails, accumulator, apiEndpoint, state, clientSecret, clientId, maxPagesPerInvocation).catch(err => {
+            assert.equal(err.message, "Failed to fetch API logs due to an authentication issue", "Error message is not correct");
+            alserviceStub.get.restore();
+            done();
+        });
+    });
+});
+
+
+describe('Get API Logs (POST Request) with Error', function () {
+    it('Get API Logs with Error (POST)', function (done) {
+        alserviceStub.post = sinon.stub(RestServiceClient.prototype, 'post').callsFake(
+            function fakeFn(path, extraOptions) {
+                return new Promise(function (resolve, reject) {
+                    return reject(new Error("Failed to fetch API logs due to an authentication issue"));
+                });
+            });
+        let maxPagesPerInvocation = 5;
+        const startDate = moment().subtract(5, 'minutes');
+        let state = {
+            stream: "SearchAlerts",
+            since: startDate.toISOString(),
+            until: startDate.add(5, 'minutes').toISOString(),
+            poll_interval_sec: 1
+        };
+        let apiDetails = {
+            url: "url",
+            method: "POST",
+            requestBody:{
+                "criteria": {
+                    "create_time": {
+                        "end": state.until,
+                        "start": state.since
+                    },
+                },
+                "rows": 0,
+                "start": 0
+            },
+            typeIdPaths: [{ path: ["id"] }],
+            tsPaths: [{ path: ["last_update_time"] }]
+        };
+        let accumulator = [];
+        const apiEndpoint = process.env.paws_endpoint;
+        const clientSecret = process.env.paws_api_secret;
+        const clientId = process.env.paws_api_client_id;
 
+        utils.getAPILogs(apiDetails, accumulator, apiEndpoint, state, clientSecret, clientId, maxPagesPerInvocation).catch(err => {
+            assert.equal(err.message, "Failed to fetch API logs due to an authentication issue", "Error message is not correct");
+            alserviceStub.post.restore();
+            done();
+        });
+    });
+});
 
+describe('Get API Details when state.stream is null', function () {
+    it('Get API Details when state.stream is null', function (done) {
+        const startDate = moment().subtract(5, 'minutes');
+        const orgKey = "orgKey";
+        let apiDetails = [];
+        const apiNames = JSON.parse(process.env.collector_streams_null);
+        apiNames.map(stream => {
+            let state = {
+                stream: null,
+                since: startDate.toISOString(),
+                until: startDate.add(5, 'minutes').toISOString(),
+                poll_interval_sec: 1
+            };
+            apiDetails.push(utils.getAPIDetails(state, orgKey));
+        });
+        assert(apiDetails.length == apiNames.length, "apiDetails length is wrong");
+        done();
+    });
+});

collectors/ciscoamp/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ciscoamp-collector",
-  "version": "1.0.41",
+  "version": "1.0.42",
   "description": "Alert Logic AWS based Ciscoamp Log Collector",
   "repository": {},
   "private": true,

collectors/ciscoamp/test/ciscoamp_mock.js

@@ -31,7 +31,7 @@ const LOG_EVENT = {
     audit_log_type: 'Computer',
     audit_log_id: 'b72fd5c0-1ec8-4b7a-b5aa-a500e64635f4',
     audit_log_user: '16db5cf986eec6f44422',
-    created_at: '2020-04-20T05:30:18Z',
+    created_at: '2020-04-20T05:30:18.789012Z',
     date: "2022-09-27T04:52:54+00:00",
     old_attributes:
     {
@@ -51,6 +51,30 @@ const LOG_EVENT = {
     }
 };
 
+const LOG_EVENT_WITHOUT_DATE = {
+    event: 'create',
+    audit_log_type: 'Computer',
+    audit_log_id: 'b72fd5c0-1ec8-4b7a-b5aa-a500e64635f4',
+    audit_log_user: '16db5cf986eec6f44422',
+    created_at: '2020-04-20T05:30:18Z',
+    old_attributes:
+    {
+        name: null,
+        desc: null,
+        hostname: null,
+        group_id: null,
+        operating_system_id: null
+    },
+    new_attributes:
+    {
+        name: 'Demo_AMP_Intel',
+        desc: 'Computer populated with demo data',
+        hostname: 'Demo_AMP_Intel',
+        group_id: 609190,
+        operating_system_id: 21810
+    }
+};
+
 
 
 const FUNCTION_ARN = 'arn:aws:lambda:us-east-1:352283894008:function:test-01-CollectLambdaFunction-2CWNLPPW5XO8';
@@ -60,5 +84,6 @@ module.exports = {
     AIMS_TEST_CREDS: AIMS_TEST_CREDS,
     FUNCTION_ARN: FUNCTION_ARN,
     FUNCTION_NAME: FUNCTION_NAME,
-    LOG_EVENT: LOG_EVENT
+    LOG_EVENT: LOG_EVENT,
+    LOG_EVENT_WITHOUT_DATE: LOG_EVENT_WITHOUT_DATE
 };