switched back to test file format

bin/contentctl_project/contentctl_core/domain/entities/unit_test.py

@@ -3,15 +3,9 @@
 from pydantic import BaseModel, validator, ValidationError
 
 from contentctl_core.domain.entities.security_content_object import SecurityContentObject
-from contentctl_core.domain.entities.unit_test_attack_data import UnitTestAttackData
-from contentctl_core.domain.entities.unit_test_baseline import UnitTestBaseline
+from contentctl_core.domain.entities.unit_test_test import UnitTestTest
 
 class UnitTest(BaseModel, SecurityContentObject):
     name: str
-    file: str
-    pass_condition: str
-    earliest_time: str = None
-    latest_time: str = None
-    baselines: list[UnitTestBaseline] = None
-    attack_data: list[UnitTestAttackData]
+    tests: list[UnitTestTest]
     

bin/contentctl_project/contentctl_core/domain/entities/unit_test_test.py

@@ -0,0 +1,15 @@
+
+
+from pydantic import BaseModel
+
+from contentctl_core.domain.entities.unit_test_attack_data import UnitTestAttackData
+from contentctl_core.domain.entities.unit_test_baseline import UnitTestBaseline
+
+class UnitTestTest(BaseModel):
+    name: str
+    file: str
+    pass_condition: str
+    earliest_time: str = None
+    latest_time: str = None
+    baselines: list[UnitTestBaseline] = None
+    attack_data: list[UnitTestAttackData]

bin/contentctl_project/contentctl_infrastructure/builder/security_content_detection_builder.py

@@ -154,7 +154,7 @@ class SecurityContentDetectionBuilder(DetectionBuilder):
 
     def addUnitTest(self, tests: list) -> None:
         for test in tests:
-            if test.name == self.security_content_obj.name:
+            if test.tests[0].name == self.security_content_obj.name:
                 self.security_content_obj.test = test
                 return
 

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/test/attempted_credential_dump_from_registry_via_reg_exe.test.yml

@@ -1,10 +1,12 @@
-name: Attempted Credential Dump From Registry via Reg exe
-file: endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
-pass_condition: '| stats count | where count > 0'
-earliest_time: -24h
-latest_time: now
-attack_data:
-- file_name: windows-sysmon.log
-  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
-  source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
-  sourcetype: xmlwineventlog
+name: Attempted Credential Dump From Registry via Reg exe Unit Test
+tests:
+- name: Attempted Credential Dump From Registry via Reg exe
+  file: endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_data/test/example.test.yml

@@ -1,22 +1,24 @@
-name: Cloud Compute Instance Created By Previously Unseen User
-file: cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
-pass_condition: '| stats count | where count > 0'
-earliest_time: -24h
-latest_time: now
-baselines:
-- name: Previously Seen Cloud Compute Creations By User - Initial
-  file: detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: -30d
-  latest_time: -1d
-- name: Previously Seen Cloud Compute Creations By User - Update
-  file: detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml
-  pass_condition: '| stats count | where count > 0'
-  earliest_time: -30d
-  latest_time: -1d
-attack_data:
-- file_name: cloudtrail_behavioural_detections.json
-  data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
-  sourcetype: aws:cloudtrail
-  source: aws_cloudtrail
-  update_timestamp: true
+name: Cloud Compute Instance Created By Previously Unseen User Unit Test
+tests:
+  - name: Cloud Compute Instance Created By Previously Unseen User
+    file: cloud/cloud_compute_instance_created_by_previously_unseen_user.yml
+    pass_condition: '| stats count | where count > 0'
+    earliest_time: -24h
+    latest_time: now
+    baselines:
+    - name: Previously Seen Cloud Compute Creations By User - Initial
+      file: detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml
+      pass_condition: '| stats count | where count > 0'
+      earliest_time: -30d
+      latest_time: -1d
+    - name: Previously Seen Cloud Compute Creations By User - Update
+      file: detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml
+      pass_condition: '| stats count | where count > 0'
+      earliest_time: -30d
+      latest_time: -1d
+    attack_data:
+    - file_name: cloudtrail_behavioural_detections.json
+      data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/abnormally_high_cloud_instances_launched/cloudtrail_behavioural_detections.json
+      sourcetype: aws:cloudtrail
+      source: aws_cloudtrail
+      update_timestamp: true

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_basic_builder.py

@@ -54,6 +54,6 @@ def test_read_test():
         'test_data/test/example.test.yml'), SecurityContentType.unit_tests)
     test = security_content_builder.getObject()
 
-    assert test.name == "Cloud Compute Instance Created By Previously Unseen User"
-    assert test.baselines[0].name == "Previously Seen Cloud Compute Creations By User - Initial"
-    assert test.attack_data[0].source == "aws_cloudtrail"
+    assert test.name == "Cloud Compute Instance Created By Previously Unseen User Unit Test"
+    assert test.tests[0].baselines[0].name == "Previously Seen Cloud Compute Creations By User - Initial"
+    assert test.tests[0].attack_data[0].source == "aws_cloudtrail"

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_detection_builder.py

@@ -152,4 +152,4 @@ def test_detection_enrich_unit_test():
     security_content_builder.addUnitTest([test])
     detection = security_content_builder.getObject()
 
-    assert detection.test.file == "endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml"
+    assert detection.test.tests[0].file == "endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml"

bin/contentctl_project/contentctl_infrastructure/tests/builder/test_security_content_director.py

@@ -62,9 +62,9 @@ def test_construct_unit_tests():
         'test_data/test/example.test.yml'))
     test = unit_test_builder.getObject()
 
-    assert test.name == "Cloud Compute Instance Created By Previously Unseen User"
-    assert test.baselines[0].name == "Previously Seen Cloud Compute Creations By User - Initial"
-    assert test.attack_data[0].source == "aws_cloudtrail"
+    assert test.name == "Cloud Compute Instance Created By Previously Unseen User Unit Test"
+    assert test.tests[0].baselines[0].name == "Previously Seen Cloud Compute Creations By User - Initial"
+    assert test.tests[0].attack_data[0].source == "aws_cloudtrail"
 
 
 def test_construct_baselines():
@@ -156,7 +156,7 @@ def test_construct_detections():
     assert detection.risk == valid_risk
     assert detection.playbooks[0].name == "Ransomware Investigate and Contain"
     assert detection.baselines[0].name == "Previously Seen Users In CloudTrail - Update"
-    assert detection.test.name == "Attempted Credential Dump From Registry via Reg exe"
+    assert detection.test.name == "Attempted Credential Dump From Registry via Reg exe Unit Test"
 
 
 def test_construct_stories():