[Feature proposal] Allow for a "should not trigger" test type
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 139
- Forks
- 52
- Avg merge
- 1h 16m
- Merged PRs (30d)
- 3
Description
Currently, the tests for a detection are tests that PASS if the log is found using the provided detection' search. This is great to test that the rule matches when it's supposed to match, but it cannot test the exclusions to a rule.
Proposal: Introduce the concept of test "types": "should trigger" and "should not trigger".
The behavior is very simple:
- For a should trigger test: If the detection' search finds a log, the test PASSES. Else it FAILS.
- For a should not trigger test: If the detection' search finds a log, the test FAILS. Else it PASSES.
I can work on this feature and contribute it to upstream. If this is not something you want, we'll keep it in our private fork.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the existing detection test implementation and the tests that currently pass when a search finds a log. Trace how test outcomes are represented, then define coverage for both “should trigger” and “should not trigger” cases. Done means both test types produce the stated pass/fail behavior, with regression tests for each.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- testing-qa
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100