Merge 4.6.0 into 4.7.0 (#4421)

* docs(#3786): update changelog.md * feat(#3786): new event_monitors * fix(#3786): recursive_directory_creation perms * feat(#3786): new fixture * fix(#3786): configuration imports * feat(#3786): new test module * docs(#3786): update changelog.md * style(#3786): fix indentation and whitelines * style(#3786): fix indentation * feat(#3693): add cases and configuration files * feat(#3693): add test_registry_wildcards module * feat(#3693): add new callbacks and event_monitor * docs(#3693): update changelog.md * style(#3693): fix whitelines * feat(#4281): New invalid decoder test case for wazuh-logtest * fix(#4281): Fix invalid_decoder_syntax.yaml file line lengths * feat(#4325): upgrade pyyaml to 6.0.1 * feat: bump version 4.5.2 * fix(#4275): modified year field in test_update_from_year * fix(#4275): update custom feeds to NVD 2.0 structure * fix(#4275): deprecate NVD update_from_year option and related changes * fix(#4275): NVD feed must be in one line * fix(#4275): more NVD feed one line fix * style(#4275): fix quoted errors in YAML file * style(#4275): added changelog entry and fixed indexing problems * Merge 4.5.2 into 4.6.0 (#4348) * feat(#4281): New invalid decoder test case for wazuh-logtest * fix(#4281): Fix invalid_decoder_syntax.yaml file line lengths * feat(#4325): upgrade pyyaml to 6.0.1 * feat: bump version 4.5.2 * refactor(#4344): Add space to version json * feat(#4344): add Release section --------- Co-authored-by: Vikman Fernandez-Castro <vmfdez90@gmail.com> Co-authored-by: Victor M. Fernandez-Castro <victor@wazuh.com> Co-authored-by: jnasselle <jnasselle@gmail.com> Co-authored-by: Julia <juliamgnr@gmail.com> Co-authored-by: Julia Magán <80041853+juliamagan@users.noreply.github.com> Co-authored-by: David Jose Iglesias Lopez <davidj.iglesias@wazuh.com> Co-authored-by: Víctor Rebollo Pérez <victorrebollop@gmail.com> * Move 4.5.0 `CHANGELOG.md` changes to 4.6.0 (#4331) * Fix registry wildcards path (#4357) * fix(#4356): fix configuration_templates path * docs(#4356): update test wazuh_min_version * fix(#3786): imports and paths * fix: delete update_from_year for nvd * Added new test to verify every check tag in configuration * feat(#3723): Adds custom AlmaLinux OVAL feed * feat(#3723): Adds AlmaLinux to test_providers vd tests * feat(#3723): Adds AlmaLinux to test_scan_results vd tests * feat(#3723): Adds AlmaLinux to test_feeds vd tests * feat(#3723): Adds AlmaLinux to the remaining vd tests description * feat(#3723): Adds AlmaLinux init configurations * style(#3723): minor fixes * style(#3723): Formatting .yaml files according to linting test * fix: renamed syscollector wmodules prefix * fix(#4336): fix flaky test. * style(#4336): add missing line * fix(#4336): fix test logic * docs: include 4382 to changelog * fix(#4231): fix canonical tests * style(#3723): Fixing formatting for AlmaLinux .yaml config file * docs: include affected component to changelog Co-Authored-By: Juan Nicolas Asselle <jnasselle@gmail.com> * Fix FIM framework to validate path in event correctly * docs: update changelog * docs: update changelog --------- Co-authored-by: Deblintrake09 <amicalizzi2005@gmail.com> Co-authored-by: Vikman Fernandez-Castro <vmfdez90@gmail.com> Co-authored-by: Victor M. Fernandez-Castro <victor@wazuh.com> Co-authored-by: damarisg <seyladamaris@gmail.com> Co-authored-by: jnasselle <jnasselle@gmail.com> Co-authored-by: Julia <juliamgnr@gmail.com> Co-authored-by: Julia Magán <80041853+juliamagan@users.noreply.github.com> Co-authored-by: David Jose Iglesias Lopez <davidj.iglesias@wazuh.com> Co-authored-by: lsayanes <leandro.sayanes@gmail.com> Co-authored-by: Leonardo Quiceno <leonardo.quiceno@wazuh.com> Co-authored-by: Mateo Cervilla <mateo.cervilla@wazuh.com> Co-authored-by: lsayanes <leandro.sayanes@wazuh.com> Co-authored-by: Marcel Kemp <marcel.kemp@wazuh.com> Co-authored-by: Seyla Dámaris Gomez <seyla.gomez@wazuh.com> Co-authored-by: Octavio Valle <octa.tala@gmail.com> Co-authored-by: Jose Luis Carreras Marin <jose.carreras@wazuh.com> Co-authored-by: Matias Pereyra <matias.pereyra@wazuh.com> Co-authored-by: mauromalara <mmalara@outlook.es> Co-authored-by: BelenValdivia <belen.valdivia@wazuh.com> Co-authored-by: Javier Castro <javier.castro@wazuh.com>
wazuh · Aug 11, 2023 · fa2fb1b · fa2fb1b
1 parent cfd85dc
commit fa2fb1b
Show file tree

Hide file tree

Showing 90 changed files with 2,169 additions and 85,766 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -28,6 +28,7 @@ Release report: TBD
 
 ### Added
 
+- Add Windows location wildcards tests ([#4263](https://github.com/wazuh/wazuh-qa/pull/4263)) \- (Tests + Framework)
 - New 'SCA' test suite and framework. ([#3566](https://github.com/wazuh/wazuh-qa/pull/3566)) \- (Framework + Tests)
 - Add integration tests for AWS module. ([#3911](https://github.com/wazuh/wazuh-qa/pull/3911)) \- (Framework + Tests + Documentation)
 - Add tests for msu patches with no associated CVE . ([#4009](https://github.com/wazuh/wazuh-qa/pull/4009)) \- (Framework + Tests)
@@ -43,6 +44,7 @@ Release report: TBD
 
 ### Changed
 
+- Updated syscollector wmodules prefix ([#4384](https://github.com/wazuh/wazuh-qa/pull/4384)) \- (Framework)
 - Replace embedded python invocations with generic `python3`. ([#4186](https://github.com/wazuh/wazuh-qa/pull/4186)) - (Tests)
 - Fix FIM test_large_changes test suite ([#3948](https://github.com/wazuh/wazuh-qa/pull/3948)) \- (Tests)
 - Update `get_test_cases_data` function so it handles fim_mode parameter ([#4185](https://github.com/wazuh/wazuh-qa/pull/4185)) \- (Framework)
@@ -75,16 +77,31 @@ Release report: TBD
 - Fix an error in the cluster performance tests related to CSV parser ([#2999](https://github.com/wazuh/wazuh-qa/pull/2999)) \- (Framework + Tests)
 - Fix bug in the framework on migration tool ([#4027](https://github.com/wazuh/wazuh-qa/pull/4027)) \- (Framework)
 
+## [4.5.2] - TBD
+
+Wazuh commit: TBD \
+Release report: TBD
+
 ## [4.5.1] - TBD
 
 Wazuh commit: TBD \
 Release report: TBD
 
+### Added
+
+- Add an integration test to check the wazuh-analysisd's decoder parser ([#4286](https://github.com/wazuh/wazuh-qa/pull/4286)) \- (Tests)
+
 ## [4.5.0] - TBD
 
 Wazuh commit: TBD \
 Release report: TBD
 
+### Changed
+
+- Delete `update_from_year` from system and E2E tests configuration ([#4372](https://github.com/wazuh/wazuh-qa/pull/4372)) \- (Tests)
+- Upgrade PyYAML to 6.0.1. ([#4326](https://github.com/wazuh/wazuh-qa/pull/4326)) \- (Framework)
+- Change Vulnerability Detector ITs to support the development of the NVD 2.0 refactor. ([#4327](https://github.com/wazuh/wazuh-qa/pull/4327)) \- (Tests)
+
 ## [4.4.5] - 10-07-2023
 
 Wazuh commit: https://github.com/wazuh/wazuh/commit/8d17d2c9c11bc10be9a31c83bc7c17dfbac0d2a0 \

diff --git a/deps/wazuh_testing/wazuh_testing/db_interface/cve_db.py b/deps/wazuh_testing/wazuh_testing/db_interface/cve_db.py
@@ -212,7 +212,7 @@ def get_metadata_timestamp(provider_os):
     return result[0]
 
 
-def get_nvd_metadata_timestamp(year):
+def get_nvd_metadata_timestamp():
     """Get the NVD timestamp data for a specific year from nvd_metadata table.
 
     Args:
@@ -221,7 +221,7 @@ def get_nvd_metadata_timestamp(year):
     Returns:
         str: Timestamp data. (example: 2022-03-03T03:00:01-05:00)
     """
-    query_string = f"SELECT timestamp FROM nvd_metadata WHERE year={year}"
+    query_string = f"SELECT timestamp FROM nvd_metadata"
     result = get_sqlite_query_result(CVE_DB_PATH, query_string)
 
     if len(result) == 0:

diff --git a/deps/wazuh_testing/wazuh_testing/execd.py b/deps/wazuh_testing/wazuh_testing/execd.py
@@ -1,5 +1,6 @@
 import os
 import platform
+import re
 
 from wazuh_testing.tools import LOG_FILE_PATH, WAZUH_PATH
 from wazuh_testing.tools.file import truncate_file
@@ -16,14 +17,38 @@ def clean_logs():
 
 def wait_ended_message_line(line):
     """Callback function to wait for the Ended Active Response message."""
-    return True if "Ended" in line else None
+    regex = r'.*active-response\/bin\/\S+: Ended$'
+    match = re.match(regex, line)
+
+    return None if not match else line
 
 
 def wait_received_message_line(line):
     """Callback function to wait for the Received Active Response message."""
-    return True if "DEBUG: Received message: " in line else None
+    regex = r'.*wazuh-execd.+ExecdStart\(\): DEBUG: Received message: \S+'
+    match = re.match(regex, line)
+
+    return None if not match else line
 
 
 def wait_start_message_line(line):
     """Callback function to wait for the Starting Active Response message."""
-    return True if "Starting" in line else None
+    regex = r'.*active-response\/bin\/\S+: Starting$'
+    match = re.match(regex, line)
+
+    return None if not match else line
+
+
+def wait_firewall_drop_msg(line):
+    """Callback function to wait for a JSON message with the AR command.
+
+    Args:
+        line (str): String containing message.
+
+    Returns:
+        match.group(1): First capturing group which is the JSON message.
+    """
+    regex = r'.*active-response\/bin\/firewall-drop: (.+)'
+    match = re.match(regex, line)
+
+    return None if not match else match.group(1)
diff --git a/deps/wazuh_testing/wazuh_testing/mocking/__init__.py b/deps/wazuh_testing/wazuh_testing/mocking/__init__.py
@@ -132,7 +132,15 @@
                'os_uname': 'Linux |localhost|5.3.18-22-default |#1 SMP Wed Jun 3 12:16:43 UTC 2020 (720aeba)|x86_64',
                'os_arch': 'x64', 'config_sum': '', 'merged_sum': '', 'manager_host': 'localhost.localdomain',
                'node_name': 'node01', 'date_add': '1652381429', 'last_keepalive': '253402300799',
-               'sync_status': 'synced', 'connection_status': 'active'}
+               'sync_status': 'synced', 'connection_status': 'active'},
+    'AlmaLinux-8': {'hostname': 'localhost', 'architecture': 'x64', 'os_name': 'AlmaLinux', 'os_version': '8',
+                    'os_codename': '', 'os_major': '8', 'os_minor': '', 'os_patch': '', 'os_build': '',
+                    'os_platform': 'almalinux', 'sysname': 'Linux', 'release': '5.3.18-22-default',
+                    'version': 'Wazuh v4.4.0', 'os_release': '', 'checksum': '1652388661375945607',
+                    'name': 'ALMALINUX8', 'ip': '127.0.0.1', 'register_ip': 'any', 'internal_key': '',
+                    'os_arch': 'x64', 'config_sum': '', 'merged_sum': '', 'manager_host': 'localhost.localdomain',
+                    'node_name': 'node01', 'date_add': '1652381429', 'last_keepalive': '253402300799',
+                    'sync_status': 'synced', 'connection_status': 'active'}
 }
 
 

diff --git a/deps/wazuh_testing/wazuh_testing/modules/fim/classes.py b/deps/wazuh_testing/wazuh_testing/modules/fim/classes.py
@@ -9,7 +9,7 @@
 from jsonschema import validate
 from collections import Counter
 from wazuh_testing import global_parameters, logger, WAZUH_TESTING_DATA_PATH
-from wazuh_testing.modules.fim import REQUIRED_ATTRIBUTES, REQUIRED_REG_KEY_ATTRIBUTES, REQUIRED_REG_VALUE_ATTRIBUTES
+from wazuh_testing.modules.fim import REQUIRED_ATTRIBUTES, REQUIRED_REG_KEY_ATTRIBUTES, REQUIRED_REG_VALUE_ATTRIBUTES, CHECK_GROUP
 from wazuh_testing.modules.fim.event_monitor import callback_detect_event
 
 if sys.platform == 'linux2' or sys.platform == 'linux':

diff --git a/deps/wazuh_testing/wazuh_testing/modules/fim/utils.py b/deps/wazuh_testing/wazuh_testing/modules/fim/utils.py
@@ -696,8 +696,8 @@ def get_fim_mode_param(mode, key='FIM_MODE'):
         return None, None
 
 
-def regular_file_cud(folder, log_monitor, file_list=['testfile0'], min_timeout=1, options=None,
-                     triggers_event=True, encoding=None, validators_after_create=None, validators_after_update=None,
+def regular_file_cud(folder, log_monitor, file_list=['testfile0'], min_timeout=1, options=None, triggers_event=True,
+                     triggers_modified_event=True, encoding=None, validators_after_create=None, validators_after_update=None,
                      validators_after_delete=None, validators_after_cud=None, event_mode=None, escaped=False):
     """Check if creation, update and delete events are detected by syscheck.
 
@@ -746,16 +746,17 @@ def regular_file_cud(folder, log_monitor, file_list=['testfile0'], min_timeout=1
         logger.info("'added' {} detected as expected.\n".format("events" if len(file_list) > 1 else "event"))
 
     # Modify previous text files
-    for name, content in file_list.items():
-        modify_file_content(folder, name, is_binary=isinstance(content, bytes))
-
-    event_checker = EventChecker(log_monitor=log_monitor, folder=folder, file_list=file_list, options=options,
-                                 custom_validator=custom_validator, encoding=encoding,
-                                 callback=ev.callback_detect_file_modified_event)
-    event_checker.fetch_and_check('modified', min_timeout=min_timeout, triggers_event=triggers_event,
-                                  event_mode=event_mode, escaped=escaped)
-    if triggers_event:
-        logger.info("'modified' {} detected as expected.\n".format("events" if len(file_list) > 1 else "event"))
+    if triggers_modified_event:
+        for name, content in file_list.items():
+            modify_file_content(folder, name, is_binary=isinstance(content, bytes))
+
+        event_checker = EventChecker(log_monitor=log_monitor, folder=folder, file_list=file_list, options=options,
+                                     custom_validator=custom_validator, encoding=encoding,
+                                     callback=ev.callback_detect_file_modified_event)
+        event_checker.fetch_and_check('modified', min_timeout=min_timeout, triggers_event=triggers_event,
+                                      event_mode=event_mode, escaped=escaped)
+        if triggers_event:
+            logger.info("'modified' {} detected as expected.\n".format("events" if len(file_list) > 1 else "event"))
 
     # Delete previous text files
     for name in file_list:

diff --git a/deps/wazuh_testing/wazuh_testing/modules/logcollector/event_monitor.py b/deps/wazuh_testing/wazuh_testing/modules/logcollector/event_monitor.py
@@ -132,3 +132,40 @@ def check_ignore_restrict_message_not_found(message, regex, tag, prefix):
     with pytest.raises(TimeoutError):
         log_found = check_ignore_restrict_message(message=message, regex=regex, tag=tag, prefix=prefix)
     assert log_found is False, ERR_MSG_UNEXPECTED_IGNORE_EVENT
+
+
+def check_wildcard_pattern_expanded(file_path, location_regex, prefix, error_message=None, file_monitor=None,
+                                    timeout=T_10, escape=False):
+    """Create a callback to detect "New file that matches the '{file_path}' pattern: '(.*)'" line.
+    Args:
+        file_path (str): file path that is being monitored
+        location_regex (str): path configured in location tag
+        prefix (str): Daemon that generates the error log.
+        error_message (str): Error message.
+        file_monitor (FileMonitor): Log monitor.
+        timeout (int): Timeout to check the log.
+        escape (bool): Flag to escape special characters in the pattern.
+    Returns: True if the expected message has been found, False otherwise.
+    """
+    callback_msg = f".*New file that matches the '{location_regex}' pattern: '{file_path}'"
+
+    return check_logcollector_event(file_monitor=file_monitor, timeout=timeout, callback=callback_msg,
+                                    error_message=error_message, prefix=prefix, escape=escape)
+
+
+def check_win_wildcard_pattern_no_match(regex, prefix, error_message=None, file_monitor=None, timeout=T_10,
+                                        escape=False):
+    """Create a callback to detect "DEBUG: No file/folder that matches ..." line.
+    Args:
+        regex (str): regex pattern configured in location tag for monitoring
+        prefix (str): Daemon that generates the error log.
+        error_message (str): Error message.
+        file_monitor (FileMonitor): Log monitor.
+        timeout (int): Timeout to check the log.
+        escape (bool): Flag to escape special characters in the pattern.
+    Returns: True if the expected message has been found, False otherwise.
+    """
+    callback_msg = f".*expand_win32_wildcards.*DEBUG: No .* that matches {regex}"
+
+    return check_logcollector_event(file_monitor=file_monitor, timeout=timeout, callback=callback_msg,
+                                    error_message=error_message, prefix=prefix, escape=escape)
diff --git a/deps/wazuh_testing/wazuh_testing/modules/syscollector/event_monitor.py b/deps/wazuh_testing/wazuh_testing/modules/syscollector/event_monitor.py
@@ -11,7 +11,7 @@
 
 # Define the log messages prefix
 SYSCOLLECTOR_PREFIX = '.+wazuh-modulesd:syscollector.+'
-WMODULES_SYSCOLLECTOR_PREFIX = '.+wmodules_syscollector.+'
+WMODULES_SYSCOLLECTOR_PREFIX = '.+wmodules-syscollector.+'
 
 # Callback messages
 CB_MODULE_STARTING = 'DEBUG: Starting Syscollector.'

diff --git a/deps/wazuh_testing/wazuh_testing/modules/vulnerability_detector/__init__.py b/deps/wazuh_testing/wazuh_testing/modules/vulnerability_detector/__init__.py
@@ -37,6 +37,7 @@
 CUSTOM_ALAS2_JSON_FEED = 'custom_alas2_feed.json'
 CUSTOM_ALAS_2022_JSON_FEED = 'custom_alas_2022_feed.json'
 CUSTOM_SUSE_OVAL_FEED = 'custom_suse_oval_feed.xml'
+CUSTOM_ALMA_OVAL_FEED = 'custom_alsa8_oval_feed.xml'
 
 VULNERABILITY_DETECTOR_PREFIX = r'.*wazuh-modulesd:vulnerability-detector.*'
 
@@ -180,8 +181,7 @@ def feed_is_recently_updated(provider_name, provider_os, threshold_weeks):
         boolean: True if the feed is considered recently updated, False otherwise.
     """
     if provider_name == 'National Vulnerability Database':
-        current_year = datetime.now().year
-        feed_update_timestamp = cve_db.get_nvd_metadata_timestamp(year=current_year)
+        feed_update_timestamp = cve_db.get_nvd_metadata_timestamp()
     else:
         feed_update_timestamp = cve_db.get_metadata_timestamp(provider_os=provider_os)
 

diff --git a/deps/wazuh_testing/wazuh_testing/modules/vulnerability_detector/event_monitor.py b/deps/wazuh_testing/wazuh_testing/modules/vulnerability_detector/event_monitor.py
@@ -240,17 +240,6 @@ def check_obtaining_software_failure_log(agent_id='000', num_attemps=5):
                                        f"{num_attemps} attempts. Skipping agent until the next scan.")
 
 
-def check_nvd_download_log(update_year):
-    """Check that the NVD download has started.
-
-    Args:
-        update_year (int): Year specified in <update_from_year>.
-    """
-    check_vuln_detector_event(timeout=vd.T_40, callback=fr".*Downloading .*nvdcve-\d.\d-{update_year}.meta.*",
-                              error_message='NVD feed download did not started',
-                              prefix=r'.*wazuh-modulesd:download.*')
-
-
 def check_invalid_provider_update_from_year_log(provider):
     """Check that the warning message is logged correctly.
 
@@ -259,8 +248,8 @@ def check_invalid_provider_update_from_year_log(provider):
     """
     if provider == 'redhat':
         callback = "INFO: 'update_from_year' option at module 'vulnerability-detector' is deprecated"
-    elif provider == 'msu':
-        callback = "WARNING: 'update_from_year' option cannot be used for 'msu' provider."
+    elif provider == 'msu' or provider == 'nvd':
+        callback = f"WARNING: 'update_from_year' option cannot be used for '{provider}' provider."
     else:
         callback = f"WARNING: Invalid option 'update_from_year' for '{provider}' provider at 'vulnerability-detector'"
 

diff --git a/deps/wazuh_testing/wazuh_testing/tools/file.py b/deps/wazuh_testing/wazuh_testing/tools/file.py
@@ -494,10 +494,10 @@ def recursive_directory_creation(path):
     if parent != '' and not os.path.exists(parent):
         split = os.path.split(parent)
         recursive_directory_creation(split[0])
-        os.mkdir(parent)
+        os.mkdir(parent, mode=0o0777)
 
     if not os.path.exists(path):
-        os.mkdir(path)
+        os.mkdir(path, mode=0o0777)
 
 
 def move_everything_from_one_directory_to_another(source_directory, destination_directory):

diff --git a/...ulnerability_detector/test_vulnerability_detector_linux/data/playbooks/configuration.yaml b/...ulnerability_detector/test_vulnerability_detector_linux/data/playbooks/configuration.yaml
@@ -53,7 +53,6 @@
           <!-- Aggregate vulnerabilities -->
           <provider name="nvd">
           <enabled>yes</enabled>
-          <update_from_year>2021</update_from_year>
           <update_interval>1h</update_interval>
           </provider>
           </vulnerability-detector>

diff --git a/...nerability_detector/test_vulnerability_detector_windows/data/playbooks/configuration.yaml b/...nerability_detector/test_vulnerability_detector_windows/data/playbooks/configuration.yaml
@@ -66,7 +66,6 @@
           <!-- Aggregate vulnerabilities -->
           <provider name="nvd">
           <enabled>yes</enabled>
-          <update_from_year>2021</update_from_year>
           <update_interval>1h</update_interval>
           </provider>
           </vulnerability-detector>

diff --git a/tests/integration/conftest.py b/tests/integration/conftest.py
@@ -22,7 +22,8 @@
 from wazuh_testing.tools import (PREFIX, LOG_FILE_PATH, WAZUH_CONF, get_service, ALERT_FILE_PATH,
                                  WAZUH_LOCAL_INTERNAL_OPTIONS, AGENT_CONF, AGENT_INFO_SOCKET_PATH)
 from wazuh_testing.tools.configuration import get_minimal_configuration, get_wazuh_conf, write_wazuh_conf
-from wazuh_testing.tools.file import copy, recursive_directory_creation, remove_file, truncate_file, write_file
+from wazuh_testing.tools.file import (copy, recursive_directory_creation, remove_file, truncate_file, write_file,
+                                      delete_path_recursively)
 from wazuh_testing.tools.monitoring import FileMonitor, QueueMonitor, SocketController, close_sockets
 from wazuh_testing.tools.services import check_daemon_status, control_service, delete_dbs
 from wazuh_testing.tools.time import TimeMachine
@@ -1310,6 +1311,22 @@ def copy_file(source_path, destination_path):
         remove_file(file)
 
 
+@pytest.fixture()
+def create_files_in_folder(folder_path, file_list):
+    """Create a list of files, inside a given path. Deletes it at the end.
+    Args:
+        folder_path (str): folder path to create.
+        file_list (List): list of file names to create
+    """
+    recursive_directory_creation(folder_path)
+    for file in file_list:
+        write_file(os.path.join(folder_path, file))
+
+    yield
+
+    delete_path_recursively(folder_path)
+
+
 @pytest.fixture(scope='function')
 def create_file(new_file_path):
     """Create an empty file.
@@ -1328,18 +1345,18 @@ def create_file(new_file_path):
 def load_wazuh_basic_configuration():
     """Load a new basic configuration to the manager"""
     # Load ossec.conf with all disabled settings
-    minimal_configuration = get_minimal_configuration()
+    minimal_configuration = conf.get_minimal_configuration()
 
     # Make a backup from current configuration
-    backup_ossec_configuration = get_wazuh_conf()
+    backup_ossec_configuration = conf.get_wazuh_conf()
 
     # Write new configuration
-    write_wazuh_conf(minimal_configuration)
+    conf.write_wazuh_conf(minimal_configuration)
 
     yield
 
     # Restore the ossec.conf backup
-    write_wazuh_conf(backup_ossec_configuration)
+    conf.write_wazuh_conf(backup_ossec_configuration)
 
 
 @pytest.fixture(scope='function')

diff --git a/tests/integration/test_active_response/test_execd/conftest.py b/tests/integration/test_active_response/test_execd/conftest.py
@@ -2,6 +2,7 @@
 import platform
 import pytest
 
+import wazuh_testing.execd as execd
 from wazuh_testing.tools import WAZUH_PATH, get_version
 
 
@@ -41,3 +42,13 @@ def test_version():
     """Validate Wazuh version."""
     if get_version() < "v4.2.0":
         raise AssertionError("The version of the agent is < 4.2.0")
+
+
+@pytest.fixture
+def truncate_ar_log():
+    """Truncate the logs related with Active Response."""
+    execd.clean_logs()
+
+    yield
+
+    execd.clean_logs()