davidjiglesias
commented
2 weeks ago To be done as part of 5.0 when time comes.
Closed juliamagan closed 2 weeks ago
davidjiglesias
commented
2 weeks ago To be done as part of 5.0 when time comes.
Overview
This issue is dedicated to the comprehensive end-to-end functionality system testing of the FIM feature. The aim is to ensure the correct operation of all interconnected components and processes involved in the FIM feature, with a focus on its alerting and state management capabilities. The test coverage spans across multiple operating systems, simulating real-world use and ensuring the robustness of the system across various scenarios.
Feature Architecture and Components
The Wazuh FIM module monitors files and directories and triggers an alert when a user or process creates, modifies, and deletes monitored files. It runs a baseline scan, storing the cryptographic checksum and other attributes of the monitored files. When a user or process changes a file, the module compares its checksum and attributes to the baseline. It triggers an alert if it finds a mismatch. The FIM module performs real-time and scheduled scans depending on the FIM configuration for agents and manager.
The architecture includes:
Test Design
The test design ensures that all components work as intended in an integrated, real-world context. We aim to ensure that the FIM feature behaves reliably, issuing appropriate alerts and maintaining accurate state information across various scenarios.
Chosen Families
Initial Coverage OS
This list will be updated accordingly following the new compatibility matrix and tiers system.
Test Cases
Test Execution
Security Implications:
Performance Expectations:
Edge Cases/Exception Cases:
Regression Scenarios:
Tasks