Skip to content

Commit

Permalink
Handled the case when jobTrigger is not present
Browse files Browse the repository at this point in the history
  • Loading branch information
@c8y3
c8y3 committed Jan 10, 2024
1 parent c096981 commit c32656f
Show file tree
Hide file tree
Showing 2 changed files with 43 additions and 15 deletions.
9 changes: 6 additions & 3 deletions ...java/com/airbus_cyber_security/graylog/events/notifications/types/MessagesURLBuilder.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -78,10 +78,13 @@ private String buildSplitFieldsSearchQuery(Iterable<String> splitFields, Message
}

private DateTime evaluateEndTime(EventNotificationContext context, DateTime beginTime) {
// TODO currently we use event.eventTimestamp() for beginTime and this complex code for endTime
// why don't we just simply use event.timerangeStart() and event.timerangeEnd() ?
if (context.jobTrigger().isEmpty()) {
EventDto event = context.event();
return event.eventTimestamp().plusMinutes(1);
}
DateTime endTime;
// TODO should handle the case where the jobTrigger is not present
// this can happen in the notification edition page when testing the notification
// in this case, maybe use event.eventTimestamp().plusMinutes(1) as endTime (as was done before)
JobTriggerDto jobTrigger = context.jobTrigger().get();
if (jobTrigger.endTime().isPresent()) {
endTime = jobTrigger.endTime().get().plusMinutes(1);
Expand Down
49 changes: 37 additions & 12 deletions .../com/airbus_cyber_security/graylog/events/notifications/types/MessagesURLBuilderTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,6 @@

import java.util.*;

import org.graylog.events.contentpack.entities.EventProcessorConfigEntity;
import org.graylog.events.event.EventDto;
import org.graylog.events.notifications.EventNotificationConfig;
import org.graylog.events.notifications.EventNotificationContext;
Expand All @@ -33,10 +32,8 @@
import org.graylog.events.processor.EventProcessorConfig;
import org.graylog.scheduler.JobSchedule;
import org.graylog.scheduler.JobTriggerDto;
import org.graylog2.contentpacks.EntityDescriptorIds;
import org.graylog2.plugin.Message;
import org.graylog2.plugin.MessageSummary;
import org.graylog2.plugin.rest.ValidationResult;
import org.joda.time.DateTime;
import org.junit.Assert;
import org.junit.Before;
Expand All @@ -59,9 +56,8 @@ public void setup() {
this.dummyTime = DateTime.parse("2023-06-21T14:43:25Z");
}

private EventNotificationContext buildContext(DateTime jobTriggerTime) {
EventNotificationConfig notificationConfig = new EventNotificationConfig.FallbackNotificationConfig();
EventDto event = EventDto.builder()
private EventDto buildDummyEvent() {
return EventDto.builder()
.alert(true)
.eventDefinitionId("EventDefinitionTestId")
.eventDefinitionType("notification-test-v1")
Expand All @@ -77,7 +73,10 @@ private EventNotificationContext buildContext(DateTime jobTriggerTime) {
.priority(2)
.fields(ImmutableMap.of("field1", "value1", "field2", "value2"))
.build();
EventDefinitionDto eventDefinitionDto = EventDefinitionDto.builder()
}

EventDefinitionDto buildDummyEventDefinition() {
return EventDefinitionDto.builder()
.alert(true)
.id(TEST_NOTIFICATION_ID)
.title("Event Definition Test Title")
Expand All @@ -103,6 +102,24 @@ public Builder toBuilder() {
}

).build();
}

private EventNotificationContext buildDummyContext() {
EventNotificationConfig notificationConfig = new EventNotificationConfig.FallbackNotificationConfig();
EventDto event = buildDummyEvent();
EventDefinitionDto eventDefinitionDto = buildDummyEventDefinition();
return EventNotificationContext.builder()
.notificationId(TEST_NOTIFICATION_ID)
.notificationConfig(notificationConfig)
.event(event)
.eventDefinition(eventDefinitionDto)
.build();
}

private EventNotificationContext buildDummyContext(DateTime jobTriggerTime) {
EventNotificationConfig notificationConfig = new EventNotificationConfig.FallbackNotificationConfig();
EventDto event = buildDummyEvent();
EventDefinitionDto eventDefinitionDto = buildDummyEventDefinition();
JobTriggerDto jobTrigger = JobTriggerDto.builder()
.jobDefinitionId("jobDefinitionId")
.jobDefinitionType("jobDefinitionType")
Expand All @@ -126,7 +143,7 @@ public void buildMessagesUrlShouldEscapeBackslash() {
fields.put("filename", "C:\\File.exe");
Message message = new Message(fields);
MessageSummary messageSummary = new MessageSummary("index", message);
EventNotificationContext context = this.buildContext(this.dummyTime);
EventNotificationContext context = this.buildDummyContext(this.dummyTime);
String query = this.subject.buildMessagesUrl(context, splitFields, messageSummary, this.dummyTime);
Assert.assertEquals("/search?rangetype=absolute&from=2023-06-21T14%3A43%3A25.000Z&to=2023-06-21T14%3A44%3A25.000Z&q=filename%3A\"C:\\\\File.exe\"", query);
}
Expand All @@ -139,7 +156,7 @@ public void buildMessagesUrlShouldEscapeDoubleQuotes() {
fields.put("key", "\"");
Message message = new Message(fields);
MessageSummary messageSummary = new MessageSummary("index", message);
EventNotificationContext context = this.buildContext(this.dummyTime);
EventNotificationContext context = this.buildDummyContext(this.dummyTime);
String query = this.subject.buildMessagesUrl(context, splitFields, messageSummary, this.dummyTime);
Assert.assertEquals("/search?rangetype=absolute&from=2023-06-21T14%3A43%3A25.000Z&to=2023-06-21T14%3A44%3A25.000Z&q=key%3A\"\\\"\"", query);
}
Expand All @@ -152,7 +169,7 @@ public void buildMessagesUrlShouldNotFailWhenSplitFieldIsInteger() {
fields.put("key", 48);
Message message = new Message(fields);
MessageSummary messageSummary = new MessageSummary("index", message);
EventNotificationContext context = this.buildContext(this.dummyTime);
EventNotificationContext context = this.buildDummyContext(this.dummyTime);
this.subject.buildMessagesUrl(context, splitFields, messageSummary, this.dummyTime);
}

Expand All @@ -163,7 +180,7 @@ public void buildMessagesUrlShouldNotFailWhenSplitFieldIsNotPresent() {
fields.put("_id", "identifier");
Message message = new Message(fields);
MessageSummary messageSummary = new MessageSummary("index", message);
EventNotificationContext context = this.buildContext(this.dummyTime);
EventNotificationContext context = this.buildDummyContext(this.dummyTime);
this.subject.buildMessagesUrl(context, splitFields, messageSummary, this.dummyTime);
}

Expand All @@ -175,9 +192,17 @@ public void getStreamSearchUrlShouldComputeTheSameTimeRangeAsbuildMessagesUrlIss
Message message = new Message(fields);
MessageSummary messageSummary = new MessageSummary("index", message);
DateTime jobTrigger = this.dummyTime.plusMinutes(5);
EventNotificationContext context = this.buildContext(jobTrigger);
EventNotificationContext context = this.buildDummyContext(jobTrigger);
String query = this.subject.getStreamSearchUrl(context, this.dummyTime);
String expectedQuery = this.subject.buildMessagesUrl(context, splitFields, messageSummary, this.dummyTime);
Assert.assertEquals(expectedQuery, query);
}

@Test
public void getStreamSearchUrlShouldNotFailWhenThereIsNoJobTrigger() {
Map<String, Object> fields = new HashMap<String, Object>();
fields.put("_id", "identifier");
EventNotificationContext context = this.buildDummyContext();
this.subject.getStreamSearchUrl(context, this.dummyTime);
}
}

0 comments on commit c32656f

Please sign in to comment.