splunk / splunk/contentctl

[Feature proposal] Allow for a "should not trigger" test type

Open
#326 3 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
139
Forks
52
Avg merge
1h 16m
Merged PRs (30d)
3

Description

Currently, the tests for a detection are tests that PASS if the log is found using the provided detection' search. This is great to test that the rule matches when it's supposed to match, but it cannot test the exclusions to a rule.

Proposal: Introduce the concept of test "types": "should trigger" and "should not trigger".

The behavior is very simple:

  • For a should trigger test: If the detection' search finds a log, the test PASSES. Else it FAILS.
  • For a should not trigger test: If the detection' search finds a log, the test FAILS. Else it PASSES.

I can work on this feature and contribute it to upstream. If this is not something you want, we'll keep it in our private fork.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by locating the existing detection test implementation and the tests that currently pass when a search finds a log. Trace how test outcomes are represented, then define coverage for both “should trigger” and “should not trigger” cases. Done means both test types produce the stated pass/fail behavior, with regression tests for each.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
testing-qa
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.