<commit_before>#!/usr/bin/env python
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
# Copyright (c) 2017 Mozilla Corporation

from positive_alert_test_case import PositiveAlertTestCase
from negative_alert_test_case import NegativeAlertTestCase
from alert_test_suite import AlertTestSuite


class TestSessionOpenedUser(AlertTestSuite):
    alert_filename = "session_opened_sensitive_user"

    # This event is the default positive event that will cause the
    # alert to trigger
    default_event = {
        "_type": "event",
        "_source": {
            "category": "syslog",
            "summary": 'pam_unix(sshd:session): session opened for user user1 by (uid=0)',
            "details": {
                "program": "sshd",
                "hostname": "exhostname",
            }
        }
    }

    # This alert is the expected result from running this task
    default_alert = {
        "category": "session",
        "severity": "WARNING",
        "tags": ['pam', 'syslog'],
        "summary": "Session opened by a sensitive user outside of the expected window - sample hosts: exhostname [total 10 hosts]"
    }

    test_cases = []

    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test with default event and default alert expected",
            events=AlertTestSuite.create_events(default_event, 10),
            expected_alert=default_alert
        )
    )

    events = AlertTestSuite.create_events(default_event, 10)
    for event in events:
        event['_source']['utctimestamp'] = AlertTestSuite.subtract_from_timestamp_lambda(date_timedelta={'minutes': 1})
        event['_source']['receivedtimestamp'] = AlertTestSuite.subtract_from_timestamp_lambda(date_timedelta={'minutes': 1})
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test with events a minute earlier",
            events=events,
            expected_alert=default_alert
        )
    )

    events = AlertTestSuite.create_events(default_event, 10)
    for event in events:
        event['_source']['summary'] = 'pam_unix(sshd:session): session opened for user user2 by (uid=0)'
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test with events with a user 'user2'",
            events=events,
            expected_alert=default_alert
        )
    )

    events = AlertTestSuite.create_events(default_event, 10)
    for event in events:
        event['_source']['summary'] = 'pam_unix(sshd:session): session opened for user user1 by (uid=0)'
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test with events with a user 'user1'",
            events=events,
            expected_alert=default_alert
        )
    )

    events = AlertTestSuite.create_events(default_event, 10)
    randomhostsalert = AlertTestSuite.copy(default_alert)
    randomhostsalert['summary'] = "Session opened by a sensitive user outside of the expected window - sample hosts:"
    for event in events:
        randomhostname = 'host' + str(events.index(event))
        event['_source']['details']['hostname'] = randomhostname
        randomhostsalert['summary'] += ' {0}'.format(randomhostname)
    randomhostsalert['summary'] += " [total 10 hosts]"
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test with events with a user 'user1'",
            events=events,
            expected_alert=randomhostsalert
        )
    )
<commit_msg>Adding modified unit test<commit_after>#!/usr/bin/env python
#
# This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
# Copyright (c) 2017 Mozilla Corporation

from positive_alert_test_case import PositiveAlertTestCase
from negative_alert_test_case import NegativeAlertTestCase
from alert_test_suite import AlertTestSuite


class TestSessionOpenedUser(AlertTestSuite):
    alert_filename = "session_opened_sensitive_user"

    # This event is the default positive event that will cause the
    # alert to trigger
    default_event = {
        "_type": "event",
        "_source": {
            "category": "syslog",
            "hostname": "exhostname",
            "summary": 'pam_unix(sshd:session): session opened for user user1 by (uid=0)',
            "details": {
                "program": "sshd",
            }
        }
    }

    # This alert is the expected result from running this task
    default_alert = {
        "category": "session",
        "severity": "WARNING",
        "tags": ['pam', 'syslog'],
        "summary": "Session opened by a sensitive user outside of the expected window - sample hosts: exhostname [total 10 hosts]"
    }

    test_cases = []

    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test with default event and default alert expected",
            events=AlertTestSuite.create_events(default_event, 10),
            expected_alert=default_alert
        )
    )

    events = AlertTestSuite.create_events(default_event, 10)
    for event in events:
        event['_source']['utctimestamp'] = AlertTestSuite.subtract_from_timestamp_lambda(date_timedelta={'minutes': 1})
        event['_source']['receivedtimestamp'] = AlertTestSuite.subtract_from_timestamp_lambda(date_timedelta={'minutes': 1})
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test with events a minute earlier",
            events=events,
            expected_alert=default_alert
        )
    )

    events = AlertTestSuite.create_events(default_event, 10)
    for event in events:
        event['_source']['summary'] = 'pam_unix(sshd:session): session opened for user user2 by (uid=0)'
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test with events with a user 'user2'",
            events=events,
            expected_alert=default_alert
        )
    )

    events = AlertTestSuite.create_events(default_event, 10)
    for event in events:
        event['_source']['summary'] = 'pam_unix(sshd:session): session opened for user user1 by (uid=0)'
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test with events with a user 'user1'",
            events=events,
            expected_alert=default_alert
        )
    )

    events = AlertTestSuite.create_events(default_event, 10)
    randomhostsalert = AlertTestSuite.copy(default_alert)
    randomhostsalert['summary'] = "Session opened by a sensitive user outside of the expected window - sample hosts:"
    for event in events:
        randomhostname = 'host' + str(events.index(event))
        event['_source']['hostname'] = randomhostname
        randomhostsalert['summary'] += ' {0}'.format(randomhostname)
    randomhostsalert['summary'] += " [total 10 hosts]"
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test with events with a user 'user1'",
            events=events,
            expected_alert=randomhostsalert
        )
    )

{'fraction_non_alphanumeric': 0.0953816636974099, 'fraction_numerical': 0.00931889817733315, 'mean_word_length': 2.915236051502146, 'pattern_counts': {'":': 22, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '524187', 'n_tokens_mistral': 2058, 'n_tokens_neox': 1943, 'n_words': 539}