CalvinBackup/mvt
1
0
Fork 0
mirror of https://github.com/mvt-project/mvt.git synced 2026-08-29 14:10:44 +02:00
Code Issues Packages Projects Releases Wiki Activity

Rework old detections tracking into stuctured alert levels

Browse Source
This commit is contained in:
Donncha Ó Cearbhaill
2025-02-19 23:46:03 +01:00
parent ca0bc46f11
commit 2d547662f8
126 changed files with 1132 additions and 761 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/android_androidqf/test_getprop.py
+4 -4
View File
@@ -26,7 +26,7 @@ class TestAndroidqfGetpropAnalysis:
assert m.results[0]["name"] == "dalvik.vm.appimageformat"
assert m.results[0]["value"] == "lz4"
assert len(m.timeline) == 0
assert len(m.detected) == 0
assert len(m.alertstore.alerts) == 0
def test_getprop_parsing_zip(self):
fpath = get_artifact("androidqf.zip")
@@ -38,7 +38,7 @@ class TestAndroidqfGetpropAnalysis:
assert m.results[0]["name"] == "dalvik.vm.appimageformat"
assert m.results[0]["value"] == "lz4"
assert len(m.timeline) == 0
assert len(m.detected) == 0
assert len(m.alertstore.alerts) == 0
def test_androidqf_getprop_detection(self, indicator_file):
data_path = get_android_androidqf()
@@ -52,5 +52,5 @@ class TestAndroidqfGetpropAnalysis:
m.indicators = ind
run_module(m)
assert len(m.results) == 10
assert len(m.detected) == 1
assert m.detected[0]["name"] == "dalvik.vm.heapmaxfree"
assert len(m.alertstore.alerts) == 1
assert m.alertstore.alerts[0].event["name"] == "dalvik.vm.heapmaxfree"