admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed output of files names when running

Browse Source 
a mock.  Handle errors when processing
a detection test generates an error.
This commit is contained in:
pyth0n1c
2022-09-20 07:46:15 -07:00
parent 091f35ee4a
commit 99b8b2f4eb
2 changed files with 13 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/docker_detection_tester/detection_testing_execution.py
+6 -5
View File
@@ -255,11 +255,12 @@ def finish_mock(settings: dict, detections: list[Detection], output_file_templat
for d in detection_tests:
filename = os.path.basename(d)
filename = filename.replace(".test.yml", ".yml")
leading = os.path.split(d)[0]
leading = leading.replace("tests/", "detections/")
new_name = os.path.join(
"security_content", leading, filename)
normalized_detection_names.append(new_name)
#leading = os.path.split(d)[0]
#leading = leading.replace()
#new_name = os.path.join(
# "security_content", leading, filename)
#normalized_detection_names.append(new_name)
normalized_detection_names.append(d.replace(".test.yml", ".yml").replace("tests/", "detections/"))
# Generate an appropriate config file for this test
mock_settings = copy.deepcopy(settings)
bin/docker_detection_tester/modules/splunk_container.py
+7 -3
View File
@@ -485,14 +485,18 @@ class SplunkContainer:
"Warning - uncaught error in detection test for [%s] - this should not happen: [%s]"
% (detection_to_test.testFile.path, str(e))
)
self.synchronization_object.addResult(detection_to_test)
try:
self.synchronization_object.addResult(detection_to_test)
except Exception as e:
print(f"Adding a failed result to the queue failed with error: {str(e)}")
###begin testing block
self.num_tests_completed += 1
# Try to get something from the queue
detection_to_test = self.synchronization_object.getTest()
#detection_to_test = self.synchronization_object.getTest()
continue
###end testing block