Skip to content

Commit f060958

Browse files
Copilotthomaspatzke
andcommitted
Add test for missing percentile validation in value_percentile correlation
Co-authored-by: thomaspatzke <1845601+thomaspatzke@users.noreply.github.com>
1 parent cc93347 commit f060958

1 file changed

Lines changed: 35 additions & 0 deletions

File tree

tests/test_conversion_correlations.py

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -707,3 +707,38 @@ def test_value_median_correlation_single_rule_with_grouping(
707707
| aggregate window=5min median(ResponseTime) as value_median by Endpoint
708708
| where value_median >= 1000"""
709709
]
710+
711+
712+
def test_value_percentile_correlation_missing_percentile(test_backend):
713+
"""Test that missing percentile attribute raises SigmaConversionError for value_percentile correlation"""
714+
correlation_rule = SigmaCollection.from_yaml(
715+
"""
716+
title: Network traffic event
717+
name: network_traffic
718+
status: test
719+
logsource:
720+
product: network
721+
detection:
722+
selection:
723+
EventType: network_traffic
724+
condition: selection
725+
---
726+
title: High percentile latency without percentile
727+
status: test
728+
correlation:
729+
type: value_percentile
730+
rules:
731+
- network_traffic
732+
group-by:
733+
- SourceIP
734+
timespan: 15m
735+
condition:
736+
gte: 500
737+
field: Latency
738+
"""
739+
)
740+
with pytest.raises(
741+
SigmaConversionError,
742+
match="Percentile must be specified in condition for value_percentile correlation type"
743+
):
744+
test_backend.convert(correlation_rule)

0 commit comments

Comments
 (0)