schema.yaml

output_fields:
  module:
    mandatory:
      - copyright
      - type
      - brief
      - components
      - targets
      - daemons
      - os_platform
      - os_version
    optional:
      - suite
      - references
      - pytest_args
      - tags
    auto:
      - path
  test:
    mandatory:
      - description
      - wazuh_min_version
      - tier
      - parameters
      - assertions
      - input_description
    optional:
      - test_phases
      - expected_output
      - inputs
      - tags

test_cases_field: test_cases

predefined_values:
  module_fields:
    - type
    - components
    - targets
    - daemons
    - os_platform
    - os_version
    - tags
  test_fields:
    - wazuh_min_version
    - tags
  type:
    - integration
    - performance
    - system
    - unit
    - end_to_end
  components:
    - active_response
    - agentd
    - analysisd
    - api
    - authd
    - aws_s3
    - cluster
    - docker_listener
    - fim
    - gcloud
    - github
    - integration
    - logcollector
    - logtest
    - modulesd
    - office365
    - osquery
    - remoted
    - rids
    - rootcheck
    - syscheck
    - vulnerability_detector
    - wazuh_db
    - wpk
  os_platform:
    - aix
    - linux
    - hp-ux
    - macos
    - solaris
    - windows
  os_version:
    - Amazon Linux 1
    - Amazon Linux 2
    - Arch Linux
    - Debian Buster
    - Debian Stretch
    - Debian Jessie
    - Debian Wheezy
    - CentOS 6
    - CentOS 7
    - CentOS 8
    - Fedora 31
    - Fedora 32
    - Fedora 33
    - Fedora 34
    - openSUSE 42
    - Oracle 6
    - Oracle 7
    - Oracle 8
    - Red Hat 6
    - Red Hat 7
    - Red Hat 8
    - Solaris 10
    - Solaris 11
    - SUSE 12
    - SUSE 13
    - SUSE 14
    - SUSE 15
    - Ubuntu Bionic
    - Ubuntu Trusty
    - Ubuntu Xenial
    - Ubuntu Focal
    - macOS Server
    - macOS Sierra
    - macOS Catalina
    - Windows XP
    - Windows 7
    - Windows 8
    - Windows 10
    - Windows Server 2003
    - Windows Server 2012
    - Windows Server 2016
    - Windows Server 2019
  targets:
    - agent
    - manager
  daemons:
    - ossec-agentd
    - ossec-agentlessd
    - ossec-analysisd
    - ossec-authd
    - ossec-csyslogd
    - ossec-dbd
    - ossec-execd
    - ossec-integratord
    - ossec-logcollector
    - ossec-maild
    - ossec-monitord
    - ossec-remoted
    - ossec-reportd
    - ossec-syscheckd
    - wazuh-agentd
    - wazuh-agentlessd
    - wazuh-analysisd
    - wazuh-authd
    - wazuh-csyslogd
    - wazuh-apid
    - wazuh-clusterd
    - wazuh-db
    - wazuh-dbd
    - wazuh-execd
    - wazuh-integratord
    - wazuh-logcollector
    - wazuh-maild
    - wazuh-monitord
    - wazuh-modulesd
    - wazuh-remoted
    - wazuh-reportd
    - wazuh-syscheckd
  wazuh_min_version:
    - 2.1.0
    - 3.0.0
    - 3.1.0
    - 3.2.0
    - 3.3.0
    - 3.4.0
    - 3.5.0
    - 3.6.0
    - 3.7.0
    - 3.8.0
    - 3.9.0
    - 3.10.0
    - 3.11.0
    - 3.12.0
    - 3.13.0
    - 4.0.0
    - 4.1.0
    - 4.1.3
    - 4.2.0
    - 4.3.0
    - 4.4.0
    - 4.4.1
    - 4.4.2
    - 4.4.3
    - 4.4.4
    - 4.4.5
    - 4.5.0
    - 4.5.1
    - 4.5.2
    - 4.6.0
  tags:
    - active_response
    - agentd
    - alas_feeds
    - alerts
    - analysisd
    - api
    - ar_analysisd
    - ar_execd
    - archlinux
    - archlinux_feeds
    - auditd
    - audit_keys
    - audit_rules
    - authd
    - aws
    - basic_configuration
    - brute_force_attack
    - cache
    - canonical
    - canonical_feeds
    - cdb
    - cluster
    - config
    - config
    - cors
    - cpe
    - cpe_helper
    - debian
    - debian_feeds
    - decoder
    - demo
    - diff
    - disk_quota
    - docker
    - dos_attack
    - download
    - emotet
    - enrollment
    - errors
    - events
    - experimental
    - feeds
    - fernet
    - fim
    - fim_ambiguous_confs
    - fim_audit
    - fim_basic_usage
    - fim_benchmark
    - fim_checks
    - fim_env_variables
    - fim_file_limit
    - fim_follow_symbolic_link
    - fim_ignore
    - fim_inotify
    - fim_invalid
    - fim_max_eps
    - fim_max_eps_sync
    - fim_max_files_per_second
    - fim_moving_files
    - fim_multiple_dirs
    - fim_nodiff
    - fim_prefilter_cmd
    - fim_report_changes
    - fim_process_priority
    - fim_recursion_level
    - fim_restrict
    - fim_scan
    - fim_skip
    - fim_stats_integrity_sync
    - fim_tags
    - fim_timezone_changes
    - fim_wildcards_complex
    - fim_windows_audit_interval
    - fim_registry_ambiguous_confs
    - fim_registry_basic_usage
    - fim_registry_checks
    - fim_registry_ignore
    - fim_registry_nodiff
    - fim_registry_file_limit
    - fim_registry_ignore
    - fim_registry_multiple_registries
    - fim_registry_nodiff
    - fim_registry_recursion_level
    - fim_registry_report_changes
    - fim_registry_restrict
    - fim_report_changes
    - fim_restrict
    - fim_scan
    - fim_skip
    - fim_stats_integrity_sync
    - fim_synchronization
    - fim_tags
    - fim_timezone_changes
    - fim_wildcards_complex
    - fim_windows_audit_interval
    - gcloud
    - general_settings
    - github
    - github_configuration
    - inactivity
    - integration
    - integrity
    - interval
    - invalid
    - invalid_settings
    - ip_reputation
    - keys
    - key_polling
    - limits
    - lists
    - logcollector
    - logcollector_location
    - logcollector_log_format
    - logcollector_only_future_events
    - logcollector_options
    - logcollector_reconnect_time
    - logcollector_statistics
    - logcollector_macos
    - logcollector_age
    - logcollector_cmd_exec
    - logcollector_configuration
    - logcollector_keep_running
    - logging
    - logs
    - logs
    - logtest
    - logtest_configuration
    - logtest_invalid_rule_decoder_syntax
    - logtest_invalid_socket_input
    - logtest_invalid_token
    - logtest_log_process_options
    - logtest_remove_old_sessions
    - logtest_remove_session
    - logtest_rules_decoders_load
    - logtest_ruleset_refresh
    - man_in_the_middle
    - master
    - maximum
    - mitre
    - msu
    - msu_feeds
    - nids
    - nvd
    - office365
    - on_start
    - osquery
    - oval
    - prelink
    - providers
    - pull
    - rbac
    - rdp
    - realtime
    - redhat
    - redhat_feeds
    - remote
    - remoted
    - rids
    - rootcheck
    - rules
    - scan
    - scan_results
    - scan_types
    - schedule
    - scheduled
    - session_error
    - session_limit
    - settings
    - shellshock
    - simulator
    - syscollector
    - slack
    - sql_injection
    - ssh
    - ssl
    - stats_file
    - suricata
    - sysmon
    - system_inventory
    - time_travel
    - token
    - virustotal
    - vulnerability
    - vulnerability_detector
    - wazuh_db
    - wdb_socket
    - week_day
    - who_data
    - windows
    - windows_defender
    - worker
    - wpk
    - yara