diff --git a/.github/workflows/build-test-release.yml b/.github/workflows/build-test-release.yml index 4edce1263..c3efdeb48 100644 --- a/.github/workflows/build-test-release.yml +++ b/.github/workflows/build-test-release.yml @@ -223,13 +223,13 @@ jobs: matrix: splunk: ${{ fromJson(needs.meta.outputs.matrix_supportedSplunk) }} cim-models: - - ref: "v1" - label: "1.x" - - ref: "v2" - label: "2.x" + - ref: "cim-5.3.3" + label: "5.x" + - ref: "cim-6.4" + label: "6.x" # Add future releases here, e.g.: - # - ref: "v3" - # label: "3.x" + # - ref: "cim-7.x" + # label: "7.x" name: "CIM models ${{ matrix.cim-models.label }} / Splunk ${{ matrix.splunk.version }}" steps: - uses: actions/checkout@v4 @@ -277,7 +277,7 @@ jobs: # runtime error rather than a wrong-field assertion. # # splunk_cim_model (real Change/Network_Traffic models) is left to - # test-splunk-matrix, which always uses the default v2 dev + # test-splunk-matrix, which always uses the default cim-6.4 dev # dependency and asserts version-specific field outcomes. poetry run pytest -v \ --splunk-version=${{ matrix.splunk.version }} \ diff --git a/docs/cim_tests.md b/docs/cim_tests.md index 9afbd8292..59ec3e490 100644 --- a/docs/cim_tests.md +++ b/docs/cim_tests.md @@ -23,7 +23,7 @@ pip install splunk-cim-models Or, during development, install the latest from the repository: ```console -pip install git+https://github.com/splunk/psa-cim-models.git@v2 +pip install git+https://github.com/splunk/psa-cim-models.git@cim-6.4 ``` The package exposes: @@ -109,11 +109,11 @@ To generate test cases only for CIM compatibility, append the following marker t **Workflow:** - - Plugin collects the list of not_allowed_in_search fields from mapped datasets and [CommonFields.json](https://github.com/splunk/psa-cim-models/blob/v2/splunk_cim_models/CommonFields.json). + - Plugin collects the list of not_allowed_in_search fields from mapped datasets and [CommonFields.json](https://github.com/splunk/psa-cim-models/blob/cim-6.4/splunk_cim_models/CommonFields.json). - Using search query the test case verifies if not_allowed_in_search fields are populated in search or not. > **_NOTE:_** - [CommonFields.json](https://github.com/splunk/psa-cim-models/blob/v2/splunk_cim_models/CommonFields.json) contains fields which are automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. + [CommonFields.json](https://github.com/splunk/psa-cim-models/blob/cim-6.4/splunk_cim_models/CommonFields.json) contains fields which are automatically provided by asset and identity correlation features of applications like Splunk Enterprise Security. **4. Testcase for all not_allowed_in_props fields** diff --git a/docs/contributing.md b/docs/contributing.md index d366f7cca..77fdc6ed9 100644 --- a/docs/contributing.md +++ b/docs/contributing.md @@ -18,7 +18,7 @@ To install currently checked out version of pytest-splunk-addon use: $ poetry install ``` -This installs `splunk-cim-models` automatically as a dev dependency (from the `v2` branch of +This installs `splunk-cim-models` automatically as a dev dependency (from the `cim-6.4` branch of [psa-cim-models](https://github.com/splunk/psa-cim-models)). In CI or when installing from PyPI, install `splunk-cim-models` separately before running CIM tests: diff --git a/docs/how_to_use.md b/docs/how_to_use.md index 058d9e80e..073ad783e 100644 --- a/docs/how_to_use.md +++ b/docs/how_to_use.md @@ -460,9 +460,9 @@ def splunk_setup(splunk): How can this be achieved : - - Make json representation of the data models, which satisfies the [DatamodelSchema](https://github.com/splunk/psa-cim-models/blob/v2/splunk_cim_models/DatamodelSchema.json) provided by the `splunk-cim-models` package. + - Make json representation of the data models, which satisfies the [DatamodelSchema](https://github.com/splunk/psa-cim-models/blob/cim-6.4/splunk_cim_models/DatamodelSchema.json) provided by the `splunk-cim-models` package. - Provide the path to the directory having all the data models by adding `--splunk_dm_path path_to_dir` to the pytest command. - - The test cases will now be generated for the data models provided to the plugin and not for the [default data models](https://github.com/splunk/psa-cim-models/tree/v2/splunk_cim_models/data_models) bundled in `splunk-cim-models`. + - The test cases will now be generated for the data models provided to the plugin and not for the [default data models](https://github.com/splunk/psa-cim-models/tree/cim-6.4/splunk_cim_models/data_models) bundled in `splunk-cim-models`. > **_NOTE:_** CIM data model definitions are provided by the [`splunk-cim-models`](https://github.com/splunk/psa-cim-models) package. Install it separately before running CIM tests: > diff --git a/poetry.lock b/poetry.lock index 72209b718..7067f7624 100644 --- a/poetry.lock +++ b/poetry.lock @@ -770,8 +770,8 @@ develop = false [package.source] type = "git" url = "https://github.com/splunk/psa-cim-models.git" -reference = "v2" -resolved_reference = "338dc37836126a1ee372a8cf160b763840f45bf1" +reference = "cim-6.4" +resolved_reference = "f547c30bcd0f04690d8a4e3e963c41e76a8d23d0" [[package]] name = "splunk-sdk" @@ -898,4 +898,4 @@ testing = ["big-O", "flake8 (<5)", "jaraco.functools", "jaraco.itertools", "more [metadata] lock-version = "2.1" python-versions = "^3.7" -content-hash = "d01333f9c5b28b76a479936fffd1f87b0223d7a33bea8c647423eaa0d36f4071" +content-hash = "8562907cb839c6d62c0d6fb7283de5682b658cf47f82e1b1dfa81c8888d725ba" diff --git a/pyproject.toml b/pyproject.toml index 729fcd5ae..24fea9fe9 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -56,7 +56,7 @@ pytest-cov = "^4" requests-mock = "^1.8.0" freezegun = "^1.5.1" pytz = "^2024.1" -splunk-cim-models = {git = "https://github.com/splunk/psa-cim-models.git", branch = "v2"} +splunk-cim-models = {git = "https://github.com/splunk/psa-cim-models.git", branch = "cim-6.4"} [tool.poetry.plugins] pytest11 = { plugin = "pytest_splunk_addon.plugin", "splunk" = "pytest_splunk_addon.splunk" } diff --git a/tests/e2e/addons/TA_cim_addon/samples/test_change.xml b/tests/e2e/addons/TA_cim_addon/samples/test_change.xml index d8a00611f..5a6f89f81 100644 --- a/tests/e2e/addons/TA_cim_addon/samples/test_change.xml +++ b/tests/e2e/addons/TA_cim_addon/samples/test_change.xml @@ -33,7 +33,10 @@ - + + image_id + result_id + @@ -66,7 +69,10 @@ - + + image_id + result_id + @@ -99,8 +105,13 @@ + dest_nt_domain + image_id result + result_id + src_nt_domain src_user + src_user_name diff --git a/tests/e2e/addons/TA_req_broken/samples/syslog.xml b/tests/e2e/addons/TA_req_broken/samples/syslog.xml index 22df6c3ec..d69308fff 100644 --- a/tests/e2e/addons/TA_req_broken/samples/syslog.xml +++ b/tests/e2e/addons/TA_req_broken/samples/syslog.xml @@ -37,6 +37,7 @@ src src_ip src_port + src_translated_ip src_zone src_interface user @@ -82,6 +83,7 @@ src src_ip src_port + src_translated_ip src_zone src_interface user diff --git a/tests/e2e/constants.py b/tests/e2e/constants.py index a07bebbc7..5f3eff38b 100644 --- a/tests/e2e/constants.py +++ b/tests/e2e/constants.py @@ -781,8 +781,6 @@ '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication* PASSED*', '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::action* PASSED*', '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::app* PASSED*', - '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::dest* PASSED*', - '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src* PASSED*', '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src_user* PASSED*', '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::user* PASSED*', '*test_splunk_app_req.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Failed_Authentication* PASSED*', @@ -865,7 +863,6 @@ '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_translated_ip* PASSED*', '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_translated_ip+src_translated_ip* PASSED*', '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_translated_port* PASSED*', - '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_zone* PASSED*', '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::icmp_code* PASSED*', '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::icmp_code+icmp_type* PASSED*', '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::icmp_type* PASSED*', @@ -882,8 +879,6 @@ '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication* PASSED*', '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::action* PASSED*', '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::app* PASSED*', - '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src* PASSED*', - '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::dest* PASSED*', '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src_user* PASSED*', '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::user* PASSED*', '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Failed_Authentication* PASSED*', @@ -921,6 +916,7 @@ Define the TA_broken add-on failed test case list. """ TA_REQ_BROKEN_FAILED = [ + '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_zone* FAILED*', '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dest_zone+src_zone* FAILED*', '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::dvc* FAILED*', '*test_splunk_app_req_broken.py::Test_App::test_cim_required_fields[eventtype="net"::All_Traffic::protocol* FAILED*', @@ -959,8 +955,8 @@ '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::object* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::object_attrs* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::object_id* PASSED*', + '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::object_path* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::result* PASSED*', - '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::src* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::status* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::user* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change"::All_Changes::vendor_product* PASSED*', @@ -976,8 +972,8 @@ '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::object_attrs* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::object_category* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::object_id* PASSED*', + '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::object_path* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::result* PASSED*', - '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::src* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::status* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::user* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_change_account"::All_Changes::vendor_product* PASSED*', @@ -992,7 +988,6 @@ '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_translated_ip* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_translated_ip+src_translated_ip* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_translated_port* PASSED*', - '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_zone* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_zone+src_zone* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::icmp_code* PASSED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::icmp_code+icmp_type* PASSED*', @@ -1030,6 +1025,7 @@ '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::action* FAILED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::app* FAILED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest* FAILED*', + '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dest_zone* FAILED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::dvc* FAILED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::src* FAILED*', '*test_splunk_cim_model.py::Test_App::test_cim_required_fields[eventtype="test_ipv6"::All_Traffic::transport* FAILED*', @@ -1308,8 +1304,6 @@ '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication* PASSED*', '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::action* PASSED*', '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::app* PASSED*', - '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::dest* PASSED*', - '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src* PASSED*', '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::src_user* PASSED*', '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Authentication::user* PASSED*', '*test_splunk_app_req_with_ep.py::Test_App::test_cim_required_fields[eventtype="test_auth"::Failed_Authentication* PASSED*',