mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
added test preview bare firehose
This commit is contained in:
@@ -2,6 +2,11 @@
|
||||
import sys
|
||||
import pytest
|
||||
import argparse
|
||||
# import logging
|
||||
# import os
|
||||
#
|
||||
# logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO"))
|
||||
# LOGGER = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def main(args):
|
||||
|
||||
@@ -17,5 +17,4 @@
|
||||
| eval start_time = timestamp,
|
||||
end_time = timestamp,
|
||||
entities = mvappend(dest_device_id, dest_user_id),
|
||||
body = "TBD"
|
||||
| into write_null();
|
||||
body = "TBD";
|
||||
|
||||
@@ -0,0 +1 @@
|
||||
| from splunk_firehose();
|
||||
@@ -16,7 +16,7 @@ from modules.utils import request_headers
|
||||
|
||||
DSP_URL = f"https://api.playground.scp.splunk.com/research2/"
|
||||
STREAMS_ENDPOINT = f"{DSP_URL}streams/v3beta1/"
|
||||
SEARCH_EDNPOINT = f"{DSP_URL}search/v2beta1/"
|
||||
SEARCH_ENDPOINT = f"{DSP_URL}search/v2beta1/"
|
||||
|
||||
# Streaming Pipelines REST endpoints
|
||||
CONNECTIONS_ENDPOINT = f"{STREAMS_ENDPOINT}connections"
|
||||
@@ -27,7 +27,7 @@ PIPELINES_REGISTRY_ENDPOINT = f"{PIPELINES_ENDPOINT}/registry"
|
||||
PREVIEW_SESSION_ENDPOINT = f"{STREAMS_ENDPOINT}preview-session"
|
||||
PREVIEW_DATA_ENDPOINT = f"{STREAMS_ENDPOINT}preview-data"
|
||||
INGEST_ENDPOINT = f"{DSP_URL}ingest/v1beta2/events"
|
||||
SUBMIT_SEARCH_ENDPOINT = f"{SEARCH_EDNPOINT}jobs"
|
||||
SUBMIT_SEARCH_ENDPOINT = f"{SEARCH_ENDPOINT}jobs"
|
||||
|
||||
# Logger
|
||||
logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO"))
|
||||
|
||||
@@ -12,17 +12,7 @@ from modules.utils import read_spl, read_data
|
||||
logging.basicConfig(level=os.environ.get("LOGLEVEL", "INFO"))
|
||||
LOGGER = logging.getLogger(__name__)
|
||||
|
||||
|
||||
def test_ssa_detection_in_dsp_with_preview_session(token):
|
||||
assert (token is not None), "scloud token is missing"
|
||||
header_token = f"Bearer {token}"
|
||||
|
||||
spl = read_spl('test2.spl')
|
||||
|
||||
# pipeline_id = create_pipeline_from_spl(header_token, spl)
|
||||
# assert pipeline_id is not None
|
||||
# print(pipeline_id)
|
||||
|
||||
def ssa_detection_in_dsp_with_preview_session(header_token, spl):
|
||||
preview_id = get_preview_id_from_spl(header_token, spl)
|
||||
assert preview_id is not None
|
||||
|
||||
@@ -33,6 +23,22 @@ def test_ssa_detection_in_dsp_with_preview_session(token):
|
||||
assert response_body.get("currentNumberOfRecords") > 0, "Missing records in preview session."
|
||||
|
||||
|
||||
def test_ssa_detection_test2(token):
|
||||
assert (token is not None), "scloud token is missing"
|
||||
header_token = f"Bearer {token}"
|
||||
|
||||
spl = read_spl('test2.spl')
|
||||
|
||||
ssa_detection_in_dsp_with_preview_session(header_token, spl)
|
||||
|
||||
def test_ssa_detection_test3(token):
|
||||
assert (token is not None), "scloud token is missing"
|
||||
header_token = f"Bearer {token}"
|
||||
|
||||
spl = read_spl('test3.spl')
|
||||
|
||||
ssa_detection_in_dsp_with_preview_session(header_token, spl)
|
||||
|
||||
def test_ssa_detection_end_to_end(token):
|
||||
assert (token is not None), "scloud token is missing"
|
||||
token_formatted = f"Bearer {token}"
|
||||
|
||||
Reference in New Issue
Block a user