20 lines
761 B
Python
20 lines
761 B
Python
import os
|
|
from pathlib import Path
|
|
|
|
import pytest
|
|
|
|
from app.parser import parse_evtx_bytes
|
|
|
|
FIXTURE = os.environ.get("EVENTLENS_EVTX_FIXTURE")
|
|
|
|
|
|
@pytest.mark.skipif(not FIXTURE, reason="EVENTLENS_EVTX_FIXTURE is only supplied by CI/release qualification")
|
|
def test_pinned_real_evtx_fixture_end_to_end():
|
|
data = Path(FIXTURE).read_bytes()
|
|
assert data.startswith(b"ElfFile\x00")
|
|
result = parse_evtx_bytes(data, max_events=100, max_seconds=10.0)
|
|
assert len(result.events) == 7
|
|
assert [event.event_id for event in result.events] == [5152, 4611, 4776, 4625, 5152, 5157, 4673]
|
|
assert all(event.provider == "Microsoft-Windows-Security-Auditing" for event in result.events)
|
|
assert all(event.channel == "Security" for event in result.events)
|