fixing IT failures

Signed-off-by: Dennis Toepker <[email protected]>
opensearch-project · Oct 30, 2024 · b839147 · b839147
1 parent ccfca01
commit b839147
Show file tree

Hide file tree

Showing 2 changed files with 20 additions and 19 deletions.
diff --git a/src/main/resources/OSMapping/waf_logtype.json b/src/main/resources/OSMapping/waf_logtype.json
@@ -55,12 +55,12 @@
       "ocsf": "unmapped.timestamp"
     },
     {
-      "raw_field":"httpRequest.headers[].value",
+      "raw_field":"httpRequest.headers.value",
       "ecs":"waf.request.headers.value",
       "ocsf": "http_request.http_headers[].value"
     },
     {
-      "raw_field":"httpRequest.headers[].name",
+      "raw_field":"httpRequest.headers.name",
       "ecs":"waf.request.headers.name",
       "ocsf": "http_request.http_headers[].name"
     }

diff --git a/src/test/java/org/opensearch/securityanalytics/resthandler/OCSFDetectorRestApiIT.java b/src/test/java/org/opensearch/securityanalytics/resthandler/OCSFDetectorRestApiIT.java
@@ -430,13 +430,14 @@ public void testOCSFCloudtrailGetMappingsViewApi() throws IOException {
         Map<String, Object> respMap = responseAsMap(response);
         // Verify alias mappings
         Map<String, Object> props = (Map<String, Object>) respMap.get("properties");
-        Assert.assertEquals(18, props.size());
+        Assert.assertEquals(17, props.size());
         // Verify unmapped index fields
         List<String> unmappedIndexFields = (List<String>) respMap.get("unmapped_index_fields");
-        assertEquals(20, unmappedIndexFields.size());
+        assertEquals(21, unmappedIndexFields.size());
         // Verify unmapped field aliases
         List<String> unmappedFieldAliases = (List<String>) respMap.get("unmapped_field_aliases");
-        assertEquals(24, unmappedFieldAliases.size());
+        assertEquals(25, unmappedFieldAliases.size());
+        throw new IllegalArgumentException("respMap: " + respMap);
     }
 
     @SuppressWarnings("unchecked")
@@ -452,13 +453,13 @@ public void testOCSFCloudtrailGetMappingsViewApiWithCustomRule() throws IOExcept
         Map<String, Object> respMap = responseAsMap(response);
         // Verify alias mappings
         Map<String, Object> props = (Map<String, Object>) respMap.get("properties");
-        Assert.assertEquals(18, props.size());
+        Assert.assertEquals(17, props.size());
         // Verify unmapped index fields
         List<String> unmappedIndexFields = (List<String>) respMap.get("unmapped_index_fields");
-        assertEquals(20, unmappedIndexFields.size());
+        assertEquals(21, unmappedIndexFields.size());
         // Verify unmapped field aliases
         List<String> unmappedFieldAliases = (List<String>) respMap.get("unmapped_field_aliases");
-        assertEquals(24, unmappedFieldAliases.size());
+        assertEquals(25, unmappedFieldAliases.size());
 
         // create a cloudtrail rule with a raw field
         String rule = randomRuleWithRawField();
@@ -472,13 +473,13 @@ public void testOCSFCloudtrailGetMappingsViewApiWithCustomRule() throws IOExcept
         Map<String, Object> respMap2 = responseAsMap(response2);
         // Verify alias mappings
         Map<String, Object> props2 = (Map<String, Object>) respMap2.get("properties");
-        Assert.assertEquals(18, props2.size());
+        Assert.assertEquals(17, props2.size());
         // Verify unmapped index fields
         List<String> unmappedIndexFields2 = (List<String>) respMap2.get("unmapped_index_fields");
-        assertEquals(20, unmappedIndexFields2.size());
+        assertEquals(21, unmappedIndexFields2.size());
         // Verify unmapped field aliases
         List<String> unmappedFieldAliases2 = (List<String>) respMap2.get("unmapped_field_aliases");
-        assertEquals(24, unmappedFieldAliases2.size());
+        assertEquals(25, unmappedFieldAliases2.size());
         // Verify that first response and second response are the same after rule was indexed
         assertEquals(props, props2);
         assertEquals(unmappedIndexFields, unmappedIndexFields2);
@@ -498,13 +499,13 @@ public void testOCSFVpcflowGetMappingsViewApi() throws IOException {
         Map<String, Object> respMap = responseAsMap(response);
         // Verify alias mappings
         Map<String, Object> props = (Map<String, Object>) respMap.get("properties");
-        Assert.assertEquals(20, props.size());
+        Assert.assertEquals(21, props.size());
         // Verify unmapped index fields
         List<String> unmappedIndexFields = (List<String>) respMap.get("unmapped_index_fields");
-        assertEquals(26, unmappedIndexFields.size());
+        assertEquals(25, unmappedIndexFields.size());
         // Verify unmapped field aliases
         List<String> unmappedFieldAliases = (List<String>) respMap.get("unmapped_field_aliases");
-        assertEquals(5, unmappedFieldAliases.size());
+        assertEquals(4, unmappedFieldAliases.size());
     }
 
     @SuppressWarnings("unchecked")
@@ -520,13 +521,13 @@ public void testOCSFRoute53GetMappingsViewApi() throws IOException {
         Map<String, Object> respMap = responseAsMap(response);
         // Verify alias mappings
         Map<String, Object> props = (Map<String, Object>) respMap.get("properties");
-        Assert.assertEquals(11, props.size());
+        Assert.assertEquals(12, props.size());
         // Verify unmapped index fields
         List<String> unmappedIndexFields = (List<String>) respMap.get("unmapped_index_fields");
-        assertEquals(28, unmappedIndexFields.size());
+        assertEquals(27, unmappedIndexFields.size());
         // Verify unmapped field aliases
         List<String> unmappedFieldAliases = (List<String>) respMap.get("unmapped_field_aliases");
-        assertEquals(11, unmappedFieldAliases.size());
+        assertEquals(12, unmappedFieldAliases.size());
     }
 
     @SuppressWarnings("unchecked")
@@ -586,10 +587,10 @@ public void testRawRoute53GetMappingsViewApi() throws IOException {
         Map<String, Object> respMap = responseAsMap(response);
         // Verify alias mappings
         Map<String, Object> props = (Map<String, Object>) respMap.get("properties");
-        Assert.assertEquals(14, props.size());
+        Assert.assertEquals(16, props.size());
         // Verify unmapped index fields
         List<String> unmappedIndexFields = (List<String>) respMap.get("unmapped_index_fields");
-        assertEquals(6, unmappedIndexFields.size());
+        assertEquals(4, unmappedIndexFields.size());
         // Verify unmapped field aliases
         List<String> unmappedFieldAliases = (List<String>) respMap.get("unmapped_field_aliases");
         assertEquals(8, unmappedFieldAliases.size());