Another rewrite

Author: ljstella

contentctl/actions/detection_testing/infrastructures/DetectionTestingInfrastructure.py

@@ -1062,17 +1062,18 @@ def retry_search_until_timeout(
             # Consolidate a set of the distinct observable field names
             observable_fields_set = set([o.name for o in detection.tags.observable]) # keeping this around for later
             risk_object_fields_set = set([o.name for o in detection.tags.observable if "Victim" in o.role ]) # just the "Risk Objects"
-            threat_object_fields_set = set([o.name for o in detection.tags.observable if "Attacker" in o.role]) # saving this for later
+            threat_object_fields_set = set([o.name for o in detection.tags.observable if "Attacker" in o.role]) # just the "threat objects"
 
             # Ensure the search had at least one result
             if int(job.content.get("resultCount", "0")) > 0:
                 # Initialize the test result
                 test.result = UnitTestResult()
 
                 # Initialize the collection of fields that are empty that shouldn't be
+                present_threat_objects: set[str] = set()
                 empty_fields: set[str] = set()
-                full_result_null_set: set[str] = set()
-                full_null_threat_set: set[str] = set()
+                
+                
 
                 result_count: int = 0
                 # Filter out any messages in the results
@@ -1083,9 +1084,8 @@ def retry_search_until_timeout(
                     # If not a message, it is a dict and we will process it
                     results_fields_set = set(result.keys())
                     # Guard against first events (relevant later)
-                    result_count += 1
 
-                    # Identify any observable fields that are not available in the results
+                    # Identify any risk object fields that are not available in the results
                     missing_risk_objects = risk_object_fields_set - results_fields_set
                     if len(missing_risk_objects) > 0:
                         # Report a failure in such cases
@@ -1098,25 +1098,35 @@ def retry_search_until_timeout(
                             duration=time.time() - search_start_time,
                         )
 
-                        return
+                        return                    
 
                     # If we find one or more risk object fields that contain the string "null" then they were
                     # not populated and we should throw an error.  This can happen if there is a typo
                     # on a field.  In this case, the field will appear but will not contain any values
                     current_empty_fields: set[str] = set()
-                    for field in risk_object_fields_set:
+                    
+                    for field in observable_fields_set:
                         if result.get(field, 'null') == 'null':
-                            current_empty_fields.add(field)
-                            if result_count == 1:
-                                full_result_null_set.add(field)
+                            if field in risk_object_fields_set:
+                                e = Exception(f"The risk object field {field} is missing in at least one result.")
+                                test.result.set_job_content(
+                                    job.content,
+                                    self.infrastructure,
+                                    TestResultStatus.FAIL,
+                                    exception=e,
+                                    duration=time.time() - search_start_time,
+                                )
+                                return
                             else:
-                                if field in full_result_null_set:
-                                    continue
+                                if field in threat_object_fields_set:
+                                    current_empty_fields.add(field)
                         else:
-                            if field in full_result_null_set:
-                                full_result_null_set.remove(field)
-
+                            if field in threat_object_fields_set:
+                                present_threat_objects.add(field)
+                                continue
+                                
 
+                    
                     # If everything succeeded up until now, and no empty fields are found in the
                     # current result, then the search was a success
                     if len(current_empty_fields) == 0:
@@ -1132,22 +1142,30 @@ def retry_search_until_timeout(
                         empty_fields = empty_fields.union(current_empty_fields)
 
 
+                missing_threat_objects = threat_object_fields_set - present_threat_objects
+                # Report a failure if there were empty fields in a threat object in all results
+                if len(missing_threat_objects) > 0:
+                    e = Exception(
+                        f"One or more required threat object fields {missing_threat_objects} contained 'null' values in all events. "
+                        "Is the data being parsed correctly or is there an error in the naming of a field?"
+                    )
+                    test.result.set_job_content(
+                        job.content,
+                        self.infrastructure,
+                        TestResultStatus.FAIL,
+                        exception=e,
+                        duration=time.time() - search_start_time,
+                    )
+                    return
 
-                # Report a failure if there were empty fields in some results
 
-                e = Exception(
-                    f"One or more required observable fields {empty_fields} contained 'null' values.  Is the "
-                    "data being parsed correctly or is there an error in the naming of a field?"
-                    )
                 test.result.set_job_content(
-                    job.content,
-                    self.infrastructure,
-                    TestResultStatus.ERROR,
-                    exception=e,
-                    duration=time.time() - search_start_time,
-                )
-
-                return
+                            job.content,
+                            self.infrastructure,
+                            TestResultStatus.PASS,
+                            duration=time.time() - search_start_time,
+                        )
+                return               
 
             else:
                 # Report a failure if there were no results at all