@@ -66,11 +66,9 @@ public void testParse() throws IOException, URISyntaxException {
6666 }
6767 }
6868
69- public void testExecute () {
69+ public void testExecute () throws IOException , URISyntaxException {
7070 Map <String , Object > source = new HashMap <>();
71- String message = "CEF:0|Elastic|Vaporware|1.0.0-alpha|18|Web request|low|eventId=3457 requestMethod=POST "
72- + "slat=38.915 slong=-77.511 proto=TCP sourceServiceName=httpd requestContext=https://www.google.com "
73- + "src=89.160.20.156 spt=33876 dst=192.168.10.1 dpt=443 request=https://www.example.com/cart" ;
71+ String message = readCefMessageFile ("message_execute.cef.txt" );
7472 source .put ("message" , message );
7573 document = new IngestDocument ("index" , "id" , 1L , null , null , source );
7674 CefProcessor processor = new CefProcessor ("tag" , "description" , "message" , "cef" , false , true , null );
@@ -118,9 +116,8 @@ public void testInvalidCefFormat() {
118116 expectThrows (IllegalArgumentException .class , () -> processor .execute (invalidIngestDocument ));
119117 }
120118
121- public void testStandardMessage () {
122- String message = "CEF:26|security|threatmanager|1.0|100|trojan successfully stopped|10|"
123- + "src=10.0.0.192 dst=12.121.122.82 spt=1232 eventId=1 in=4294 out=4294" ;
119+ public void testStandardMessage () throws IOException , URISyntaxException {
120+ String message = readCefMessageFile ("standard_message.cef.txt" );
124121 Map <String , Object > source = new HashMap <>();
125122 source .put ("message" , message );
126123 document = new IngestDocument ("index" , "id" , 1L , null , null , source );
@@ -150,8 +147,8 @@ public void testStandardMessage() {
150147 );
151148 }
152149
153- public void testHeaderOnly () {
154- String message = "CEF:26|security|threatmanager|1.0|100|trojan successfully stopped|10|" ;
150+ public void testHeaderOnly () throws IOException , URISyntaxException {
151+ String message = readCefMessageFile ( "header_only.cef.txt" ) ;
155152 Map <String , Object > source = new HashMap <>();
156153 source .put ("message" , message );
157154 document = new IngestDocument ("index" , "id" , 1L , null , null , source );
@@ -179,8 +176,8 @@ public void testHeaderOnly() {
179176 );
180177 }
181178
182- public void testEmptyDeviceFields () {
183- String message = "CEF:0|||1.0|100|trojan successfully stopped|10|src=10.0.0.192 dst=12.121.122.82 spt=1232" ;
179+ public void testEmptyDeviceFields () throws IOException , URISyntaxException {
180+ String message = readCefMessageFile ( "empty_device_fields.cef.txt" ) ;
184181 Map <String , Object > source = new HashMap <>();
185182 source .put ("message" , message );
186183 document = new IngestDocument ("index" , "id" , 1L , null , null , source );
@@ -207,9 +204,8 @@ public void testEmptyDeviceFields() {
207204 );
208205 }
209206
210- public void testEscapedPipeInHeader () {
211- String message = "CEF:26|security|threat\\ |->manager|1.0|100|"
212- + "trojan successfully stopped|10|src=10.0.0.192 dst=12.121.122.82 spt=1232" ;
207+ public void testEscapedPipeInHeader () throws IOException , URISyntaxException {
208+ String message = readCefMessageFile ("escaped_pipe_in_header.cef.txt" );
213209 Map <String , Object > source = new HashMap <>();
214210 source .put ("message" , message );
215211 document = new IngestDocument ("index" , "id" , 1L , null , null , source );
0 commit comments