diff --git a/bbot/core/event/base.py b/bbot/core/event/base.py index 61004143f..d5a9552e2 100644 --- a/bbot/core/event/base.py +++ b/bbot/core/event/base.py @@ -1719,7 +1719,7 @@ def event_from_json(j, siem_friendly=False): event._parent_id = parent_id parent_uuid = j.get("parent_uuid", None) if parent_uuid is not None: - event._parent_uuid = parent_uuid + event._parent_uuid = uuid.UUID(parent_uuid) return event except KeyError as e: raise ValidationError(f"Event missing required field: {e}") diff --git a/bbot/test/bbot_fixtures.py b/bbot/test/bbot_fixtures.py index abad144d1..181b2473f 100644 --- a/bbot/test/bbot_fixtures.py +++ b/bbot/test/bbot_fixtures.py @@ -217,9 +217,9 @@ class bbot_events: return bbot_events -@pytest.fixture(scope="session", autouse=True) -def install_all_python_deps(): - deps_pip = set() - for module in DEFAULT_PRESET.module_loader.preloaded().values(): - deps_pip.update(set(module.get("deps", {}).get("pip", []))) - subprocess.run([sys.executable, "-m", "pip", "install"] + list(deps_pip)) +# @pytest.fixture(scope="session", autouse=True) +# def install_all_python_deps(): +# deps_pip = set() +# for module in DEFAULT_PRESET.module_loader.preloaded().values(): +# deps_pip.update(set(module.get("deps", {}).get("pip", []))) +# subprocess.run([sys.executable, "-m", "pip", "install"] + list(deps_pip)) diff --git a/bbot/test/test_step_1/test_events.py b/bbot/test/test_step_1/test_events.py index d9cfc2e98..cf5aebb42 100644 --- a/bbot/test/test_step_1/test_events.py +++ b/bbot/test/test_step_1/test_events.py @@ -471,6 +471,7 @@ async def test_events(events, helpers): assert str(reconstituted_event.uuid) == json_event["uuid"] assert str(reconstituted_event.parent_uuid) == json_event["parent_uuid"] assert reconstituted_event.uuid == db_event.uuid + assert reconstituted_event.parent_uuid == scan.root_event.uuid assert reconstituted_event.scope_distance == 1 assert reconstituted_event.timestamp.isoformat() == timestamp assert reconstituted_event.data == "evilcorp.com:80" diff --git a/bbot/test/test_step_2/module_tests/test_module_json.py b/bbot/test/test_step_2/module_tests/test_module_json.py index 7d9e052e7..ad3417539 100644 --- a/bbot/test/test_step_2/module_tests/test_module_json.py +++ b/bbot/test/test_step_2/module_tests/test_module_json.py @@ -9,6 +9,9 @@ def check(self, module_test, events): dns_data = "blacklanternsecurity.com" context_data = f"Scan {module_test.scan.name} seeded with DNS_NAME: blacklanternsecurity.com" + scan_event = [e for e in events if e.type == "SCAN"][0] + dns_event = [e for e in events if e.type == "DNS_NAME"][0] + # json events txt_file = module_test.scan.home / "output.json" lines = list(module_test.scan.helpers.read_file(txt_file)) @@ -22,24 +25,34 @@ def check(self, module_test, events): dns_json = dns_json[0] assert scan_json["data"]["name"] == module_test.scan.name assert scan_json["data"]["id"] == module_test.scan.id + assert scan_json["id"] == module_test.scan.id + assert scan_json["uuid"] == str(module_test.scan.root_event.uuid) + assert scan_json["parent_uuid"] == str(module_test.scan.root_event.uuid) assert scan_json["data"]["target"]["seeds"] == ["blacklanternsecurity.com"] assert scan_json["data"]["target"]["whitelist"] == ["blacklanternsecurity.com"] assert dns_json["data"] == dns_data + assert dns_json["id"] == str(dns_event.id) + assert dns_json["uuid"] == str(dns_event.uuid) + assert dns_json["parent_uuid"] == str(module_test.scan.root_event.uuid) assert dns_json["discovery_context"] == context_data assert dns_json["discovery_path"] == [context_data] - assert dns_json["parent_chain"] == ["DNS_NAME:1e57014aa7b0715bca68e4f597204fc4e1e851fc"] + assert dns_json["parent_chain"] == [dns_json["uuid"]] # event objects reconstructed from json scan_reconstructed = event_from_json(scan_json) dns_reconstructed = event_from_json(dns_json) assert scan_reconstructed.data["name"] == module_test.scan.name assert scan_reconstructed.data["id"] == module_test.scan.id + assert scan_reconstructed.uuid == scan_event.uuid + assert scan_reconstructed.parent_uuid == scan_event.uuid assert scan_reconstructed.data["target"]["seeds"] == ["blacklanternsecurity.com"] assert scan_reconstructed.data["target"]["whitelist"] == ["blacklanternsecurity.com"] assert dns_reconstructed.data == dns_data + assert dns_reconstructed.uuid == dns_event.uuid + assert dns_reconstructed.parent_uuid == module_test.scan.root_event.uuid assert dns_reconstructed.discovery_context == context_data assert dns_reconstructed.discovery_path == [context_data] - assert dns_reconstructed.parent_chain == ["DNS_NAME:1e57014aa7b0715bca68e4f597204fc4e1e851fc"] + assert dns_reconstructed.parent_chain == [dns_json["uuid"]] class TestJSONSIEMFriendly(ModuleTestBase):