diff --git a/.github/workflows/build-test-release.yml b/.github/workflows/build-test-release.yml
index 4edce1263..c3efdeb48 100644
--- a/.github/workflows/build-test-release.yml
+++ b/.github/workflows/build-test-release.yml
@@ -223,13 +223,13 @@ jobs:
matrix:
splunk: ${{ fromJson(needs.meta.outputs.matrix_supportedSplunk) }}
cim-models:
- - ref: "v1"
- label: "1.x"
- - ref: "v2"
- label: "2.x"
+ - ref: "cim-5.3.3"
+ label: "5.x"
+ - ref: "cim-6.4"
+ label: "6.x"
# Add future releases here, e.g.:
- # - ref: "v3"
- # label: "3.x"
+ # - ref: "cim-7.x"
+ # label: "7.x"
name: "CIM models ${{ matrix.cim-models.label }} / Splunk ${{ matrix.splunk.version }}"
steps:
- uses: actions/checkout@v4
@@ -277,7 +277,7 @@ jobs:
# runtime error rather than a wrong-field assertion.
#
# splunk_cim_model (real Change/Network_Traffic models) is left to
- # test-splunk-matrix, which always uses the default v2 dev
+ # test-splunk-matrix, which always uses the default cim-6.4 dev
# dependency and asserts version-specific field outcomes.
poetry run pytest -v \
--splunk-version=${{ matrix.splunk.version }} \
diff --git a/docs/cim_tests.md b/docs/cim_tests.md
index 9afbd8292..59ec3e490 100644
--- a/docs/cim_tests.md
+++ b/docs/cim_tests.md
@@ -23,7 +23,7 @@ pip install splunk-cim-models
Or, during development, install the latest from the repository:
```console
-pip install git+https://github.com/splunk/psa-cim-models.git@v2
+pip install git+https://github.com/splunk/psa-cim-models.git@cim-6.4
```
The package exposes:
@@ -109,11 +109,11 @@ To generate test cases only for CIM compatibility, append the following marker t
**Workflow:**
- - Plugin collects the list of not_allowed_in_search fields from mapped datasets and [CommonFields.json](https://github.com/splunk/psa-cim-models/blob/v2/splunk_cim_models/CommonFields.json).
+ - Plugin collects the list of not_allowed_in_search fields from mapped datasets and [CommonFields.json](https://github.com/splunk/psa-cim-models/blob/cim-6.4/splunk_cim_models/CommonFields.json).
- Using search query the test case verifies if not_allowed_in_search fields are populated in search or not.
> **_NOTE:_**
- [CommonFields.json](https://github.com/splunk/psa-cim-models/blob/v2/splunk_cim_models/CommonFields.json) contains fields which are automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security.
+ [CommonFields.json](https://github.com/splunk/psa-cim-models/blob/cim-6.4/splunk_cim_models/CommonFields.json) contains fields which are automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security.
**4. Testcase for all not_allowed_in_props fields**
diff --git a/docs/contributing.md b/docs/contributing.md
index d366f7cca..77fdc6ed9 100644
--- a/docs/contributing.md
+++ b/docs/contributing.md
@@ -18,7 +18,7 @@ To install currently checked out version of pytest-splunk-addon use:
$ poetry install
```
-This installs `splunk-cim-models` automatically as a dev dependency (from the `v2` branch of
+This installs `splunk-cim-models` automatically as a dev dependency (from the `cim-6.4` branch of
[psa-cim-models](https://github.com/splunk/psa-cim-models)). In CI or when installing from
PyPI, install `splunk-cim-models` separately before running CIM tests:
diff --git a/docs/how_to_use.md b/docs/how_to_use.md
index 058d9e80e..073ad783e 100644
--- a/docs/how_to_use.md
+++ b/docs/how_to_use.md
@@ -460,9 +460,9 @@ def splunk_setup(splunk):
How can this be achieved :
- - Make json representation of the data models, which satisfies the [DatamodelSchema](https://github.com/splunk/psa-cim-models/blob/v2/splunk_cim_models/DatamodelSchema.json) provided by the `splunk-cim-models` package.
+ - Make json representation of the data models, which satisfies the [DatamodelSchema](https://github.com/splunk/psa-cim-models/blob/cim-6.4/splunk_cim_models/DatamodelSchema.json) provided by the `splunk-cim-models` package.
- Provide the path to the directory having all the data models by adding `--splunk_dm_path path_to_dir` to the pytest command.
- - The test cases will now be generated for the data models provided to the plugin and not for the [default data models](https://github.com/splunk/psa-cim-models/tree/v2/splunk_cim_models/data_models) bundled in `splunk-cim-models`.
+ - The test cases will now be generated for the data models provided to the plugin and not for the [default data models](https://github.com/splunk/psa-cim-models/tree/cim-6.4/splunk_cim_models/data_models) bundled in `splunk-cim-models`.
> **_NOTE:_** CIM data model definitions are provided by the [`splunk-cim-models`](https://github.com/splunk/psa-cim-models) package. Install it separately before running CIM tests:
>
diff --git a/poetry.lock b/poetry.lock
index 72209b718..7067f7624 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -770,8 +770,8 @@ develop = false
[package.source]
type = "git"
url = "https://github.com/splunk/psa-cim-models.git"
-reference = "v2"
-resolved_reference = "338dc37836126a1ee372a8cf160b763840f45bf1"
+reference = "cim-6.4"
+resolved_reference = "f547c30bcd0f04690d8a4e3e963c41e76a8d23d0"
[[package]]
name = "splunk-sdk"
@@ -898,4 +898,4 @@ testing = ["big-O", "flake8 (<5)", "jaraco.functools", "jaraco.itertools", "more
[metadata]
lock-version = "2.1"
python-versions = "^3.7"
-content-hash = "d01333f9c5b28b76a479936fffd1f87b0223d7a33bea8c647423eaa0d36f4071"
+content-hash = "8562907cb839c6d62c0d6fb7283de5682b658cf47f82e1b1dfa81c8888d725ba"
diff --git a/pyproject.toml b/pyproject.toml
index 729fcd5ae..24fea9fe9 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -56,7 +56,7 @@ pytest-cov = "^4"
requests-mock = "^1.8.0"
freezegun = "^1.5.1"
pytz = "^2024.1"
-splunk-cim-models = {git = "https://github.com/splunk/psa-cim-models.git", branch = "v2"}
+splunk-cim-models = {git = "https://github.com/splunk/psa-cim-models.git", branch = "cim-6.4"}
[tool.poetry.plugins]
pytest11 = { plugin = "pytest_splunk_addon.plugin", "splunk" = "pytest_splunk_addon.splunk" }
diff --git a/tests/e2e/addons/TA_cim_addon/samples/test_change.xml b/tests/e2e/addons/TA_cim_addon/samples/test_change.xml
index d8a00611f..5a6f89f81 100644
--- a/tests/e2e/addons/TA_cim_addon/samples/test_change.xml
+++ b/tests/e2e/addons/TA_cim_addon/samples/test_change.xml
@@ -33,7 +33,10 @@
-
+
+ image_id
+ result_id
+
@@ -66,7 +69,10 @@
-
+
+ image_id
+ result_id
+
@@ -99,8 +105,13 @@
+ dest_nt_domain
+ image_id
result
+ result_id
+ src_nt_domain
src_user
+ src_user_name
diff --git a/tests/e2e/addons/TA_req_broken/samples/syslog.xml b/tests/e2e/addons/TA_req_broken/samples/syslog.xml
index 22df6c3ec..d69308fff 100644
--- a/tests/e2e/addons/TA_req_broken/samples/syslog.xml
+++ b/tests/e2e/addons/TA_req_broken/samples/syslog.xml
@@ -37,6 +37,7 @@
src
src_ip
src_port
+ src_translated_ip
src_zone
src_interface
user
@@ -82,6 +83,7 @@
src
src_ip
src_port
+ src_translated_ip
src_zone
src_interface
user
diff --git a/tests/e2e/constants.py b/tests/e2e/constants.py
index a07bebbc7..5f3eff38b 100644
--- a/tests/e2e/constants.py
+++ b/tests/e2e/constants.py
@@ -781,8 +781,6 @@
'*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication* PASSED*',
'*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::action* PASSED*',
'*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::app* PASSED*',
- '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::dest* PASSED*',
- '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src* PASSED*',
'*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src_user* PASSED*',
'*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::user* PASSED*',
'*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Failed_Authentication* PASSED*',
@@ -865,7 +863,6 @@
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_translated_ip* PASSED*',
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_translated_ip+src_translated_ip* PASSED*',
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_translated_port* PASSED*',
- '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_zone* PASSED*',
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::icmp_code* PASSED*',
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::icmp_code+icmp_type* PASSED*',
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::icmp_type* PASSED*',
@@ -882,8 +879,6 @@
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication* PASSED*',
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::action* PASSED*',
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::app* PASSED*',
- '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src* PASSED*',
- '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::dest* PASSED*',
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src_user* PASSED*',
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::user* PASSED*',
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Failed_Authentication* PASSED*',
@@ -921,6 +916,7 @@
Define the TA_broken add-on failed test case list.
"""
TA_REQ_BROKEN_FAILED = [
+ '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_zone* FAILED*',
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_zone+src_zone* FAILED*',
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dvc* FAILED*',
'*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::protocol* FAILED*',
@@ -959,8 +955,8 @@
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::object* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::object_attrs* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::object_id* PASSED*',
+ '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::object_path* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::result* PASSED*',
- '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::src* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::status* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::user* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::vendor_product* PASSED*',
@@ -976,8 +972,8 @@
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::object_attrs* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::object_category* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::object_id* PASSED*',
+ '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::object_path* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::result* PASSED*',
- '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::src* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::status* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::user* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::vendor_product* PASSED*',
@@ -992,7 +988,6 @@
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_translated_ip* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_translated_ip+src_translated_ip* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_translated_port* PASSED*',
- '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_zone* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_zone+src_zone* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::icmp_code* PASSED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::icmp_code+icmp_type* PASSED*',
@@ -1030,6 +1025,7 @@
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::action* FAILED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::app* FAILED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest* FAILED*',
+ '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_zone* FAILED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dvc* FAILED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::src* FAILED*',
'*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::transport* FAILED*',
@@ -1308,8 +1304,6 @@
'*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication* PASSED*',
'*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::action* PASSED*',
'*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::app* PASSED*',
- '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::dest* PASSED*',
- '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src* PASSED*',
'*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src_user* PASSED*',
'*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::user* PASSED*',
'*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Failed_Authentication* PASSED*',