testing

• testing gulp
  • prerequisites
  • running the test suite
  • running single tests manually
  • ingestion tool
  • query external tool

testing gulp

prerequisites

install gulp api client sdk if you haven't already (i.e. you're not in the dev environment)

pip3 install https://github.com/mentat-is/gulp-sdk-python

start gulp first

# run gulp on localhost:8080
# setting GULP_INTEGRATION_TEST is mandatory when running tests (disables debug features if forgotten activated)
# we also ensure to start in the most clean way (recreate collab db, create test operation, delete all existing data)
GULP_INTEGRATION_TEST=1 gulp --reset-collab --create test_operation

running the test suite

TODO: some tests are currently broken!

the test suite tests all the gulp rest API and plugins, including ingestion and query (checking the results too)

# run test suite (covers the whole API, including ingestion and query)
cd tests
./test_suite.sh

# also test paid plugins
PATH_PAID_PLUGINS=/home/valerino/repos/gulp-paid-plugins ./test_suite.sh

use test_lite.sh to skip most of the ingestion tests (but still tests collab objects, queries, etc...)

running single tests manually

single tests in the test suite may also be run manually

# run single test manually, i.e. run test_queries function inside test_query_api.py
python3 -m pytest -v -s ./tests/query/test_query_api.py::test_queries

ingestion tool

to quickly test ingestion with a particular plugin manually i.e. during plugin dev, you may use ingest.py:

ingest_py script will spawn CURL processes, and exits once it detects the ingestion is done on the websocket.

# win_evtx
# 98633 records, 1 record failed, 1 skipped, 98632 ingested
./test_scripts/ingest.py --path ./samples/win_evtx

# csv without mapping
# 10 records, 10 ingested
./test_scripts/ingest.py --path ./samples/mftecmd/sample_record.csv --plugin csv --plugin_params '{"mappings": {
      "test_mapping": {
        "fields": {
          "Created0x10": {
            "ecs": "@timestamp",
            "is_timestamp": "chrome"
          }
        }
      }
    }
  }'

query external tool

a similar tool is available to manually test external queries: query_external.py:

# example for the splunk paid plugin, 56590 hits
./test_scripts/query_external.py \
    --q 'sourcetype="WinEventLog:Security" Nome_applicazione="\\\\device\\\\harddiskvolume2\\\\program files\\\\intergraph smart licensing\\\\client\\\\islclient.exe"' \
    --plugin splunk --operation_id test_operation --reset \
    --plugin_params '{
        "custom_parameters":  {
            "uri": "http://localhost:8089",
            "username": "admin",
            "password": "Valerino74!",
            "index": "incidente_183651"
        },
        "override_chunk_size": 200,
        "additional_mapping_files": [[ "windows.json", "windows" ]]
    }'