testutil

Documentation

Index

• func CheckLogParser(t *testing.T, p parsers.Interface, input string, expect ...string)
• func CheckPantherMultiline(t *testing.T, logs string, parser parsers.LogParser, ...)
• func CheckPantherParser(t *testing.T, log string, parser parsers.LogParser, expect *parsers.PantherLog, ...)
• func CheckParserResults(t *testing.T, want string, actual *pantherlog.Result, ...)
• func CheckParserSamplesJSONL(t *testing.T, filename string, parser parsers.LogParser)
• func CheckRegisteredParser(t *testing.T, logType, input string, expect ...string)
• func EqualPantherLog(t *testing.T, expectedEvent *parsers.PantherLog, events []*parsers.PantherLog, ...)
• func EqualTimestamp(t *testing.T, expect, actual time.Time, msgAndArgs ...interface{})
• func MustReadFileJSONLines(filename string) (lines []string)
• func MustReadFileString(filename string) string
• func NewRawMessage(jsonString string) *jsoniter.RawMessage
• func UnmarshalResultJSON(data []byte, r *pantherlog.Result, indicators pantherlog.FieldSet) error
• type MockParser
  • func AlwaysFailParser(err error) *MockParser
  • func (p *MockParser) ParseLog(log string) ([]*parsers.Result, error)
  • func (p *MockParser) RequireLessOrEqualNumberOfCalls(t *testing.T, method string, number int)
• type ParserConfig
  • func (args ParserConfig) Parser() *MockParser

Functions

func CheckLogParser

func CheckLogParser(t *testing.T, p parsers.Interface, input string, expect ...string)

CheckLogParser checks a log type parser

func CheckPantherMultiline

func CheckPantherMultiline(t *testing.T, logs string, parser parsers.LogParser, expect ...*parsers.PantherLog)

func CheckPantherParser

func CheckPantherParser(t *testing.T, log string, parser parsers.LogParser, expect *parsers.PantherLog, expectMore ...*parsers.PantherLog)

func CheckParserResults

func CheckParserResults(t *testing.T, want string, actual *pantherlog.Result, indicators ...pantherlog.FieldID)

Checks that `actual` is a parser result matching `expect` If expect.RowID is empty it checks if actual has non-empty RowID If expect.EventTime is zero it checks if actual.EventTime equals actual.ParseTime If expect.ParseTime is zero it checks if actual.ParseTime is non-zero Otherwise equality is checked strictly

func CheckParserSamplesJSONL

func CheckParserSamplesJSONL(t *testing.T, filename string, parser parsers.LogParser)

func CheckRegisteredParser

func CheckRegisteredParser(t *testing.T, logType, input string, expect ...string)

CheckRegisteredParser checks a registered log type parser

func EqualPantherLog

func EqualPantherLog(t *testing.T, expectedEvent *parsers.PantherLog, events []*parsers.PantherLog, parseErr error)

For new parser tests use `CheckPantherParser` instead Used by log parsers to validate records

func EqualTimestamp

func EqualTimestamp(t *testing.T, expect, actual time.Time, msgAndArgs ...interface{})

func MustReadFileJSONLines

func MustReadFileJSONLines(filename string) (lines []string)

func MustReadFileString

func MustReadFileString(filename string) string

func NewRawMessage

func NewRawMessage(jsonString string) *jsoniter.RawMessage

func UnmarshalResultJSON

func UnmarshalResultJSON(data []byte, r *pantherlog.Result, indicators pantherlog.FieldSet) error

UnmarshalResultJSON unmarshals a result from JSON The parsing is inefficient. It's purpose is to be used in tests to verify output results.

Types

type MockParser

type MockParser struct {
	mock.Mock
}

func AlwaysFailParser

func AlwaysFailParser(err error) *MockParser

func (*MockParser) ParseLog

func (p *MockParser) ParseLog(log string) ([]*parsers.Result, error)

func (*MockParser) RequireLessOrEqualNumberOfCalls

func (p *MockParser) RequireLessOrEqualNumberOfCalls(t *testing.T, method string, number int)

type ParserConfig

type ParserConfig map[string]interface{}

func (ParserConfig) Parser

func (args ParserConfig) Parser() *MockParser