update transform test to fail on missing transform (elastic#3085)

Co-authored-by: brokensound77 <[email protected]> Co-authored-by: Jonhnathan <[email protected]> Co-authored-by: Terrance DeJesus <[email protected]>
MakoWish · Sep 21, 2023 · f6b6bee · f6b6bee
1 parent de2b97a
commit f6b6bee
Showing 1 changed file with 17 additions and 8 deletions.
diff --git a/tests/test_all_rules.py b/tests/test_all_rules.py
@@ -1177,20 +1177,29 @@ def test_plugin_placeholders_match_entries(self):
         for rule in self.production_rules.rules:
             has_transform = rule.contents.get('transform') is not None
             has_note = rule.contents.data.get('note') is not None
+            note = rule.contents.data.note
 
-            if has_transform and not has_note:
-                self.fail(f'{self.rule_str(rule)} transformed defined with no note')
-            elif not has_transform:
-                continue
+            if has_transform:
+                if not has_note:
+                    self.fail(f'{self.rule_str(rule)} transformed defined with no note')
+            else:
+                if not has_note:
+                    continue
+
+            note_template = PatchedTemplate(note)
+            identifiers = [i for i in note_template.get_identifiers() if '_' in i]
+
+            if not has_transform:
+                if identifiers:
+                    self.fail(f'{self.rule_str(rule)} note contains plugin placeholders with no transform entries')
+                else:
+                    continue
 
             transform = rule.contents.transform
             transform_counts = {plugin: len(entries) for plugin, entries in transform.to_dict().items()}
-            note = rule.contents.data.note
-            self.assertIsNotNone(note)
-            note_template = PatchedTemplate(note)
 
             note_counts = defaultdict(int)
-            for identifier in note_template.get_identifiers():
+            for identifier in identifiers:
                 # "$" is used for other things, so this verifies the pattern of a trailing "_" followed by ints
                 if '_' not in identifier:
                     continue