Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add unit testing for compiled rules that check functionality and performance #5

Open
michaelhidalgo opened this issue May 8, 2019 · 1 comment

Comments

@michaelhidalgo
Copy link

Hey @qjerome as per my article it would be good to add unittests with mocks of the sysmon events that allow us to not only test that rules matches but also that are performant.

@qjerome
Copy link
Collaborator

qjerome commented May 9, 2019

Yes, I could write unit tests (I will think about how to do it easily) for any rule developed in order to test that rules match, however I don't think performance should be assessed through unit testing.
IMHO a realistic performance test should be ran on a running system with real events generated. If you measure performance through unit tests, you will have a performance test in the worst case scenario because only matching events will be tested (a matching event takes more time to process than a non-matching one). If you want to measure the maximum throughput of events that Gene (and WHIDS by extension) can process, you can use the -progress command line switch in gene command line. According to my tests, for a bunch of 100 rules ran on 60000 events collected on a running machine, the engine is able to process around 7000 events per second when ran on a single job (-job switch). This way we can assess the maximum throughput the tool can handle in a realistic scenario.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants