Skip to content

Commit

Permalink
fix indentation
Browse files Browse the repository at this point in the history
  • Loading branch information
mmguero committed Dec 19, 2024
1 parent 6595910 commit ebeaf51
Show file tree
Hide file tree
Showing 12 changed files with 307 additions and 307 deletions.
2 changes: 1 addition & 1 deletion pyproject.toml
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ build-backend = "hatchling.build"

[project]
name = "malcolm-test"
version = "0.9.1"
version = "0.9.2"
authors = [
{ name="Seth Grover", email="[email protected]" },
]
Expand Down
144 changes: 72 additions & 72 deletions src/maltest/tests/test_arkime_api.py
Original file line number Diff line number Diff line change
Expand Up @@ -30,14 +30,14 @@ def test_arkime_views(
malcolm_url,
malcolm_http_auth,
):
"""test_arkime_views
"""test_arkime_views
Test the Arkime views API
Test the Arkime views API
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
"""
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
"""
response = requests.get(
f"{malcolm_url}/arkime/api/views",
headers={"Content-Type": "application/json"},
Expand All @@ -58,15 +58,15 @@ def test_arkime_sessions(
malcolm_http_auth,
artifact_hash_map,
):
"""test_arkime_sessions
"""test_arkime_sessions
Test the Arkime sessions API
Test the Arkime sessions API
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
for viewName in EXPECTED_VIEWS:
response = requests.post(
f"{malcolm_url}/arkime/api/sessions",
Expand Down Expand Up @@ -94,15 +94,15 @@ def test_arkime_connections(
malcolm_http_auth,
artifact_hash_map,
):
"""test_arkime_connections
"""test_arkime_connections
Test the Arkime connections API
Test the Arkime connections API
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
response = requests.post(
f"{malcolm_url}/arkime/api/connections",
headers={"Content-Type": "application/json"},
Expand All @@ -128,15 +128,15 @@ def test_arkime_pcap_payload(
malcolm_http_auth,
artifact_hash_map,
):
"""test_arkime_pcap_payload
"""test_arkime_pcap_payload
Test the Arkime sessions/pcap API (download a PCAP payload)
Test the Arkime sessions/pcap API (download a PCAP payload)
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
response = requests.post(
f"{malcolm_url}/arkime/api/sessions",
headers={"Content-Type": "application/json"},
Expand Down Expand Up @@ -175,15 +175,15 @@ def test_arkime_spiview(
malcolm_http_auth,
artifact_hash_map,
):
"""test_arkime_spiview
"""test_arkime_spiview
Test the Arkime SPIview API
Test the Arkime SPIview API
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
response = requests.post(
f"{malcolm_url}/arkime/api/spiview",
headers={"Content-Type": "application/json"},
Expand Down Expand Up @@ -211,15 +211,15 @@ def test_arkime_spigraph(
malcolm_http_auth,
artifact_hash_map,
):
"""test_arkime_spigraph
"""test_arkime_spigraph
Test the Arkime SPIgraph API
Test the Arkime SPIgraph API
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
response = requests.post(
f"{malcolm_url}/arkime/api/spigraph",
headers={"Content-Type": "application/json"},
Expand All @@ -246,14 +246,14 @@ def test_arkime_files(
malcolm_url,
malcolm_http_auth,
):
"""test_arkime_files
"""test_arkime_files
Test the Arkime files API
Test the Arkime files API
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
"""
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
"""
response = requests.get(
f"{malcolm_url}/arkime/api/files",
headers={"Content-Type": "application/json"},
Expand All @@ -272,14 +272,14 @@ def test_arkime_fields(
malcolm_url,
malcolm_http_auth,
):
"""test_arkime_fields
"""test_arkime_fields
Test the Arkime fields API
Test the Arkime fields API
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
"""
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
"""
response = requests.get(
f"{malcolm_url}/arkime/api/fields",
headers={"Content-Type": "application/json"},
Expand All @@ -298,14 +298,14 @@ def test_arkime_valueactions(
malcolm_url,
malcolm_http_auth,
):
"""test_arkime_valueactions
"""test_arkime_valueactions
Test the Arkime valueactions API
Test the Arkime valueactions API
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
"""
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
"""
response = requests.get(
f"{malcolm_url}/arkime/api/valueactions",
headers={"Content-Type": "application/json"},
Expand All @@ -324,14 +324,14 @@ def test_arkime_fieldactions(
malcolm_url,
malcolm_http_auth,
):
"""test_arkime_fieldactions
"""test_arkime_fieldactions
Test the Arkime fieldactions API
Test the Arkime fieldactions API
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
"""
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
"""
response = requests.get(
f"{malcolm_url}/arkime/api/fieldactions",
headers={"Content-Type": "application/json"},
Expand All @@ -352,15 +352,15 @@ def test_arkime_unique(
malcolm_http_auth,
artifact_hash_map,
):
"""test_arkime_unique
"""test_arkime_unique
Test the Arkime unique API
Test the Arkime unique API
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
response = requests.post(
f"{malcolm_url}/arkime/api/unique",
headers={"Content-Type": "application/json"},
Expand Down
92 changes: 46 additions & 46 deletions src/maltest/tests/test_common_protocols.py
Original file line number Diff line number Diff line change
Expand Up @@ -101,15 +101,15 @@ def test_common_protocols_zeek(
malcolm_url,
artifact_hash_map,
):
"""test_common_protocols_zeek
"""test_common_protocols_zeek
Checks for the existence of various Zeek logs (event.dataset)
Checks for the existence of various Zeek logs (event.dataset)
Args:
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
malcolm_url (str): URL for connecting to the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
Args:
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
malcolm_url (str): URL for connecting to the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
assert all([artifact_hash_map.get(x, None) for x in mmguero.GetIterable(UPLOAD_ARTIFACTS)])

response = requests.post(
Expand Down Expand Up @@ -142,15 +142,15 @@ def test_mapi_document_lookup(
malcolm_http_auth,
artifact_hash_map,
):
"""test_mapi_document_lookup
"""test_mapi_document_lookup
Test the /mapi/document API by looking up the JSON document for a zeek log
Test the /mapi/document API by looking up the JSON document for a zeek log
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
response = requests.post(
f"{malcolm_url}/mapi/document",
headers={"Content-Type": "application/json"},
Expand Down Expand Up @@ -184,17 +184,17 @@ def test_extracted_files_download(
malcolm_url,
malcolm_http_auth,
):
"""test_extracted_files_download
"""test_extracted_files_download
List the quarantined .exe files from the /extracted-files/quarantine page, then download one of them.
With the assumption that the downloaded .exe file is zipped (the test suite's default) and
encrypted with a password of "infected" (the test suite's default), it attempts to decrypt
and unzip the file.
List the quarantined .exe files from the /extracted-files/quarantine page, then download one of them.
With the assumption that the downloaded .exe file is zipped (the test suite's default) and
encrypted with a password of "infected" (the test suite's default), it attempts to decrypt
and unzip the file.
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
"""
Args:
malcolm_url (str): URL for connecting to the Malcolm instance
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
"""
response = requests.get(
f"{malcolm_url}/extracted-files/quarantine",
allow_redirects=True,
Expand Down Expand Up @@ -242,16 +242,16 @@ def test_freq(
malcolm_url,
artifact_hash_map,
):
"""test_freq
"""test_freq
Test that the event.freq_score_v1 and event.freq_score_v2 fields were calculated. These fields
represent the entropy of dns.host values.
Test that the event.freq_score_v1 and event.freq_score_v2 fields were calculated. These fields
represent the entropy of dns.host values.
Args:
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
malcolm_url (str): URL for connecting to the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
Args:
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
malcolm_url (str): URL for connecting to the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
response = requests.post(
f"{malcolm_url}/mapi/agg/dns.host,event.freq_score_v1,event.freq_score_v2",
headers={"Content-Type": "application/json"},
Expand Down Expand Up @@ -289,15 +289,15 @@ def test_geo_asn(
malcolm_url,
artifact_hash_map,
):
"""test_geo_asn
"""test_geo_asn
Test that GeoIP and ASN lookups were performed for Zeek and Suricata logs
Test that GeoIP and ASN lookups were performed for Zeek and Suricata logs
Args:
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
malcolm_url (str): URL for connecting to the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
Args:
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
malcolm_url (str): URL for connecting to the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
for provider in ('zeek', 'suricata'):
for field in ('destination.geo.city_name', 'source.geo.city_name', 'destination.as.full', 'source.as.full'):
response = requests.post(
Expand Down Expand Up @@ -328,16 +328,16 @@ def test_conn_info(
malcolm_url,
artifact_hash_map,
):
"""test_conn_info
"""test_conn_info
Check that connection-related enrichment information (source and destination OUIs, direction, transport,
user agent, etc.) are calculated.
Check that connection-related enrichment information (source and destination OUIs, direction, transport,
user agent, etc.) are calculated.
Args:
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
malcolm_url (str): URL for connecting to the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
Args:
malcolm_http_auth (HTTPBasicAuth): username and password for the Malcolm instance
malcolm_url (str): URL for connecting to the Malcolm instance
artifact_hash_map (defaultdict(lambda: None)): a map of artifact files' full path to their file hash
"""
for provider in ['zeek']:
for field in (
'source.oui',
Expand Down
Loading

0 comments on commit ebeaf51

Please sign in to comment.