With the Pull Request wazuh/wazuh#4940, real-time is replaced by realtime in syscheck alerts, therefore, the schema that checks that the mode in the alerts is correct for the integration tests needs to be modified. This change must be performed in these files:
|
"enum": ["real-time", "whodata", "scheduled"], |
|
"enum": ["real-time", "whodata", "scheduled"], |
|
"File '/testdir0/example' modified\nMode: real-time\nChanged attributes: size,permission,uid,user_name,gid,group_name,mtime,inode,md5,sha1,sha256\nSize changed from '0' to '8'\nPermissions changed from 'rw-r--r--' to 'rw-rw-rw-'\nOwnership was '0', now it is '1'\nUser name was 'root', now it is 'bin'\nGroup ownership was '0', now it is '1'\nGroup name was 'root', now it is 'bin'\nOld modification time was: '1581438201', now it is '1581439247'\nOld inode was: '1185139', now it is '1184275'\nOld md5sum was: 'd41d8cd98f00b204e9800998ecf8427e'\nNew md5sum is : '35e0c8c0b180c95d4e122e55ed62cc64'\nOld sha1sum was: 'da39a3ee5e6b4b0d3255bfef95601890afd80709'\nNew sha1sum is : '19a532c8bc61c311f583455c80ffe37067bbc9bb'\nOld sha256sum was: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'\nNew sha256sum is : 'e8ce5dcaf408935ff76747226d2e8bee4319a2f593c1d7a838115e56183d1f37'\n" |
|
"File 'c:\\testdir0\\example' modified\nMode: real-time\nChanged attributes: size,permission,attributes,uid,user_name,mtime,md5,sha1,sha256\nSize changed from '0' to '8'\nPermissions changed.\nOwnership was 'S-1-5-32-544', now it is 'S-1-5-21-3527455827-79240758-596275861-1001'\nUser name was 'Administradores', now it is 'jmv74211'\nOld modification time was: '1581675567', now it is '1581676663'\nOld md5sum was: 'd41d8cd98f00b204e9800998ecf8427e'\nNew md5sum is : '35e0c8c0b180c95d4e122e55ed62cc64'\nOld sha1sum was: 'da39a3ee5e6b4b0d3255bfef95601890afd80709'\nNew sha1sum is : '19a532c8bc61c311f583455c80ffe37067bbc9bb'\nOld sha256sum was: 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'\nNew sha256sum is : 'e8ce5dcaf408935ff76747226d2e8bee4319a2f593c1d7a838115e56183d1f37'\nOld attributes were: 'ARCHIVE'\nNow they are 'HIDDEN'\n" |
With the Pull Request wazuh/wazuh#4940,
real-timeis replaced byrealtimein syscheck alerts, therefore, the schema that checks that the mode in the alerts is correct for the integration tests needs to be modified. This change must be performed in these files:wazuh-qa/deps/wazuh_testing/wazuh_testing/data/syscheck_event.json
Line 53 in 786cb6c
wazuh-qa/deps/wazuh_testing/wazuh_testing/data/syscheck_event_windows.json
Line 54 in 786cb6c
wazuh-qa/deps/wazuh_testing/wazuh_testing/data/analysis_alert.json
Line 288 in 786cb6c
wazuh-qa/deps/wazuh_testing/wazuh_testing/data/analysis_alert_windows.json
Line 298 in 786cb6c