The committers are authorized under a signed CLA.

• ✅ Josh Brower (2a2c1f9)

To pass the code style enforcement check, you can run clang-format -i /path/to/source_code.cpp on the files you have changed previously, and then commit/push those changes.

It looks like the newly added test case is failing on the CI because certain mock event test data ("recorded events") (JSON files, here) do not have the computername field.

It should be added as DESKTOP-4AR7BIA to match the other test files (this hostname came from Alessandro's VM).

E.g. for 1.json, adding the line:

{
    "osquery_time": "1592478128",
    "datetime": "2020-06-09T18:12:25.4809506Z",
    "source": "Application",
    "provider_name": "SecurityCenter",
    "provider_guid": "",
    "event_id": "1",
    "task_id": "0",
    "level": "4",
    "keywords": "0x80000000000000",
    "data": "{\"EventData\":\"\"}",
    "computer_name": "DESKTOP-4AR7BIA"
}

To re-run just the failing test locally:

ctest -R osquery_tables_events_tests_windowseventstests-test -C RelWithDebInfo -V

It looks like the newly added test case is failing on the CI because certain mock event test data ("recorded events") (JSON files, here) do not have the computername field.

Is this an error in the test data, or is this field sometimes missing?

It looks like the newly added test case is failing on the CI because certain mock event test data ("recorded events") (JSON files, here) do not have the computername field.

Is this an error in the test data, or is this field sometimes missing?

@alessandrogario you originally put these test files together, right? Were they manually exported from the event log selecting only certain fields?

I guess I am echoing the question @theopolis originally asked here #6280 (comment)

@alessandrogario you originally put these test files together, right? Were they manually exported from the event log selecting only certain fields?

In a separate conversation with me he said that he exported these Windows events manually from Windows Event Viewer or possibly wevtutil as XML. Then he manually edited them, removing fields to create these test files, which he then ran through osquery to create the JSON files and manually reviewed them for correctness.

Hopefully that answers the question of why this particular field is missing.

Example:

C:\Users\mmyers\Desktop>wevtutil qe /c:1 Security
<Event xmlns='http://schemas.microsoft.com/win/2004/08/events/event'><System><Provider Name='Microsoft-Windows-Security-Auditing' Guid='{54849625-5478-4994-a5ba-3e3b0328c30d}'/><EventID>4688</EventID><Version>2</Version><Level>0</Level><Task>13312</Task><Opcode>0</Opcode><Keywords>0x8020000000000000</Keywords><TimeCreated SystemTime='2020-12-17T17:20:40.9473540Z'/><EventRecordID>1</EventRecordID><Correlation/><Execution ProcessID='4' ThreadID='32'/><Channel>Security</Channel><Computer>DESKTOP-FR7THQP</Computer><Security/></System><EventData><Data Name='SubjectUserSid'>S-1-5-18</Data><Data Name='SubjectUserName'>-</Data><Data Name='SubjectDomainName'>-</Data><Data Name='SubjectLogonId'>0x3e7</Data><Data Name='NewProcessId'>0x64</Data><Data Name='NewProcessName'>Registry</Data><Data Name='TokenElevationType'>%%1936</Data><Data Name='ProcessId'>0x4</Data><Data Name='CommandLine'></Data><Data Name='TargetUserSid'>S-1-0-0</Data><Data Name='TargetUserName'>-</Data><Data Name='TargetDomainName'>-</Data><Data Name='TargetLogonId'>0x0</Data><Data Name='ParentProcessName'></Data><Data Name='MandatoryLabel'>S-1-16-16384</Data></EventData></Event>

You can see that the events normally include <Computer>DESKTOP-FR7THQP</Computer>

Should I manually add that field to the test files?

Should I manually add that field to the test files?

Yea, that's all that is needed. I manually confirmed that with a couple of them. It will unfortunately be a little tedious to update them all manually, but you can edit each XML file with an xmlstarlet one-liner like this:

cd ./osquery/tables/events/tests/windows/data/windows_events
xmlstarlet edit -L --subnode "/Event/System" -t elem -n "Computer" -v "DESKTOP-4AR7BIA" ./input/Application/1.xml

and then each JSON file with jq like this:

jq '. += {"computer_name": "DESKTOP-4AR7BIA"}' ./output/Application/1.json

Except jq can't edit the file in-place so you have to append that with, like, > JSON.tmp && mv JSON.tmp ./output/Application/1.json

not a problem, will get it done and submitted. Thanks for the guidance!

Looks like that JSON parsing test is having a problem still

https://github.com/osquery/osquery/pull/6952/checks?check_run_id=1989915214#step:17:2239

Did too much get appended to this one? osquery/tables/events/tests/windows/data/windows_events/output/Application/1.json

My mistake, I pushed to the wrong branch. Still cleaning up the test files.

Local tests are now passing. I had to edit a few of the source test files as they had different hostnames - normalized them all to DESKTOP-4AR7BIA

For those who may need to bulk edit these test source files in the future (Will need to tweak for your use case):

(Thanks to @mike-myers-tob for getting me started on figuring this out)

XML: xmlstarlet edit -L --subnode "/Event/System" -t elem -n "Computer" -v "DESKTOP-4AR7BIA" ./input/*/*.xml

JSON: for f in output/*/*.json; do jq '. += {"computer_name": "DESKTOP-4AR7BIA"}' ${f} | sponge ${f}; done;