@@ -0,0 +1,2683 @@
+from positive_alert_test_case import PositiveAlertTestCase%0Afrom negative_alert_test_case import NegativeAlertTestCase%0A%0Afrom alert_test_suite import AlertTestSuite%0A%0A%0Aclass TestAlertOpenPortViolation(AlertTestSuite):%0A    alert_filename = %22open_port_violation%22%0A%0A    # This event is the default positive event that will cause the%0A    # alert to trigger%0A    default_event = %7B%0A        %22_type%22: %22event%22,%0A        %22_source%22: %7B%0A            %22tags%22: %5B%22open_port_policy_violation%22%5D,%0A            %22details%22: %7B%0A                %22destinationipaddress%22: %22220.231.44.213%22,%0A                %22destinationport%22: 25,%0A            %7D%0A        %7D%0A    %7D%0A%0A    # This alert is the expected result from running this task%0A    default_alert = %7B%0A        %22category%22: %22open_port_policy_violation%22,%0A        %22tags%22: %5B'open_port_policy_violation'%5D,%0A        %22severity%22: %22CRITICAL%22,%0A        %22summary%22: '10 unauthorized open port(s) on 220.231.44.213 (25 25 25 25 25 )',%0A    %7D%0A%0A    test_cases = %5B%5D%0A%0A    default_events = list()%0A    for num in xrange(10):%0A        default_events.append(AlertTestSuite.copy(default_event))%0A%0A    test_cases.append(%0A        PositiveAlertTestCase(%0A            description=%22Positive test with default events and default alert expected%22,%0A            events=default_events,%0A            expected_alert=default_alert%0A        )%0A    )%0A%0A    custom_events = default_events%0A    for temp_event in custom_events:%0A        temp_event%5B'_source'%5D%5B'utctimestamp'%5D = AlertTestSuite.subtract_from_timestamp_lambda(date_timedelta=%7B'minutes': 239%7D)%0A    test_cases.append(%0A        PositiveAlertTestCase(%0A            description=%22Positive test with events a minute earlier%22,%0A            events=custom_events,%0A            expected_alert=default_alert%0A        )%0A    )%0A%0A    custom_events = default_events%0A    for temp_event in custom_events:%0A        temp_event%5B'_type'%5D = 'bad'%0A    test_cases.append(%0A        NegativeAlertTestCase(%0A            description=%22Negative test case with events with incorrect _type%22,%0A            events=custom_events,%0A        )%0A    )%0A%0A    custom_events = default_events%0A    for temp_event in custom_events:%0A        temp_event%5B'_source'%5D%5B'tags'%5D = 'bad tag example'%0A    test_cases.append(%0A        NegativeAlertTestCase(%0A            description=%22Negative test case with events with incorrect tags%22,%0A            events=custom_events,%0A        )%0A    )%0A%0A    custom_events = default_events%0A    for temp_event in custom_events:%0A        temp_event%5B'_source'%5D%5B'utctimestamp'%5D = AlertTestSuite.subtract_from_timestamp_lambda(%7B'minutes': 241%7D)%0A    test_cases.append(%0A        NegativeAlertTestCase(%0A            description=%22Negative test case with old timestamp%22,%0A            events=custom_events,%0A        )%0A    )%0A

Add unit-tests for open port violation alert