extensions/windows-event-log/tests/MetadataWalkerTests.cpp - nifi-minifi-cpp - Git at Google

 /**
  *
  * Licensed to the Apache Software Foundation (ASF) under one or more
  * contributor license agreements.  See the NOTICE file distributed with
  * this work for additional information regarding copyright ownership.
  * The ASF licenses this file to You under the Apache License, Version 2.0
  * (the "License"); you may not use this file except in compliance with
  * the License.  You may obtain a copy of the License at
  *
  *     http://www.apache.org/licenses/LICENSE-2.0
  *
  * Unless required by applicable law or agreed to in writing, software
  * distributed under the License is distributed on an "AS IS" BASIS,
  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  * See the License for the specific language governing permissions and
  * limitations under the License.
  */

 #include <map>
 #include <string>

 #include "ConsumeWindowsEventLog.h"
 #include "unit/TestBase.h"
 #include "unit/Catch.h"
 #include "core/Core.h"
 #include "utils/OsUtils.h"
 #include "wel/MetadataWalker.h"
 #include "wel/XMLString.h"
 #include "pugixml.hpp"

 using Metadata = org::apache::nifi::minifi::wel::Metadata;
 using MetadataWalker = org::apache::nifi::minifi::wel::MetadataWalker;
 using WindowsEventLogProvider = org::apache::nifi::minifi::wel::WindowsEventLogProvider;
 using WindowsEventLogMetadata = org::apache::nifi::minifi::wel::WindowsEventLogMetadata;
 using WindowsEventLogMetadataImpl = org::apache::nifi::minifi::wel::WindowsEventLogMetadataImpl;
 using XmlString = org::apache::nifi::minifi::wel::XmlString;

 namespace {

 auto none_matcher = minifi::wel::parseSidMatcher(std::nullopt);

 std::string updateXmlMetadata(const std::string &xml, EVT_HANDLE provider_handle, EVT_HANDLE event_handle, bool update_xml, bool resolve,
     const std::function<bool(std::string_view)>& sid_matcher = none_matcher) {
   WindowsEventLogProvider event_log_provider{provider_handle};
   WindowsEventLogMetadataImpl metadata{event_log_provider, event_handle};
   MetadataWalker walker(metadata, "", update_xml, resolve, sid_matcher, &utils::OsUtils::userIdToUsername);

   pugi::xml_document doc;
   pugi::xml_parse_result result = doc.load_string(xml.c_str());

   if (result) {
     doc.traverse(walker);
     XmlString writer;
     doc.print(writer, "", pugi::format_raw);  // no indentation or formatting
     return writer.xml_;
   } else {
     throw std::runtime_error("Could not parse XML document");
   }
 }

 std::string formatXml(const std::string &xml) {
   pugi::xml_document doc;
   pugi::xml_parse_result result = doc.load_string(xml.c_str());

   if (result) {
     XmlString writer;
     doc.print(writer, "", pugi::format_raw);  // no indentation or formatting
     return writer.xml_;
   }
   return xml;
 }

 std::string readFile(const std::string &file_name) {
   std::ifstream file{file_name};
   return std::string{std::istreambuf_iterator<char>(file), std::istreambuf_iterator<char>()};
 }

 const std::string METADATA_WALKER_TESTS_LOG_NAME = "MetadataWalkerTests";
 const short event_type_index = 178;  // NOLINT short comes from WINDOWS API

 class FakeWindowsEventLogMetadata : public WindowsEventLogMetadata {
  public:
   [[nodiscard]] std::string getEventData(EVT_FORMAT_MESSAGE_FLAGS field, const std::string&) const override {
     return "event_data_for_field_" + std::to_string(field);
   }
   [[nodiscard]] std::string getEventTimestamp() const override { return "event_timestamp"; }
   short getEventTypeIndex() const override { return event_type_index; }  // NOLINT short comes from WINDOWS API
 };

 }  // namespace

 TEST_CASE("MetadataWalker updates the Sid in the XML if both update_xml and resolve are true", "[updateXmlMetadata]") {
   std::string xml = readFile("resources/nobodysid.xml");

   SECTION("No resolution") {
     REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, false, true) == formatXml(xml));
   }

   SECTION("Resolve nobody") {
     std::string nobody = readFile("resources/withsids.xml");
     const auto sid_matcher = minifi::wel::parseSidMatcher(".*Sid");
     REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, true, true, sid_matcher) == formatXml(nobody));
   }
 }


 TEST_CASE("MetadataWalker updates the Security/UserId attribute", "[updateXmlMetadata][userid]") {
   std::string xml = readFile("resources/userid.xml");

   SECTION("No resolution") {
     REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, false, true) == formatXml(xml));
   }

   SECTION("Resolve nobody") {
     std::string nobody = readFile("resources/resolveduserid.xml");
     const auto sid_matcher = minifi::wel::parseSidMatcher("(.*Sid)|UserID");
     REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, true, true, sid_matcher) == formatXml(nobody));
   }
 }

 TEST_CASE("MetadataWalker works even when there is no Data block", "[updateXmlMetadata]") {
   std::string xml = readFile("resources/nodata.xml");

   REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, false, true) == formatXml(xml));
 }

 TEST_CASE("MetadataWalker throws if the input XML is invalid", "[updateXmlMetadata]") {
   std::string xml = readFile("resources/invalidxml.xml");

   REQUIRE_THROWS(updateXmlMetadata(xml, nullptr, nullptr, false, true) == formatXml(xml));
 }

 TEST_CASE("MetadataWalker will leave a Sid unchanged if it doesn't correspond to a user", "[updateXmlMetadata]") {
   std::string xml = readFile("resources/unknownsid.xml");

   REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, false, true) == formatXml(xml));
   REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, true, true) == formatXml(xml));
   const auto sid_matcher = minifi::wel::parseSidMatcher(".*Sid");
   REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, true, true, sid_matcher) == formatXml(xml));
 }

 TEST_CASE("MetadataWalker can replace multiple Sids", "[updateXmlMetadata]") {
   std::string xml = readFile("resources/multiplesids.xml");

   pugi::xml_document doc;
   xml = updateXmlMetadata(xml, nullptr, nullptr, false, true);
   pugi::xml_parse_result result = doc.load_string(xml.c_str());
   REQUIRE(result);

   // we are only testing multiple sid resolutions, not the resolution of other items.
   CHECK(std::string_view("Nobody Everyone Null Authority") == doc.select_node("Event/EventData/Data[@Name='GroupMembership']").node().text().get());
 }

 namespace {

 void extractMappingsTestHelper(const std::string &file_name,
                                bool update_xml,
                                bool resolve,
                                const std::map<std::string, std::string>& expected_identifiers,
                                const std::map<Metadata, std::string>& expected_metadata,
                                const std::map<std::string, std::string>& expected_field_values) {
   std::string input_xml = readFile(file_name);
   REQUIRE(!input_xml.empty());
   pugi::xml_document doc;
   pugi::xml_parse_result result = doc.load_string(input_xml.c_str());
   REQUIRE(result);

   const auto sid_matcher = minifi::wel::parseSidMatcher(".*Sid");
   MetadataWalker walker(FakeWindowsEventLogMetadata{}, METADATA_WALKER_TESTS_LOG_NAME, update_xml, resolve, sid_matcher, &utils::OsUtils::userIdToUsername);
   doc.traverse(walker);

   CHECK(walker.getIdentifiers() == expected_identifiers);
   CHECK(walker.getFieldValues() == expected_field_values);
   for (const auto &key_value_pair : expected_metadata) {
     CHECK(walker.getMetadata(key_value_pair.first) == key_value_pair.second);
   }
 }

 }  // namespace

 TEST_CASE("MetadataWalker extracts mappings correctly when there is a single Sid and resolve=false", "[for_each]") {
   const std::string file_name = "resources/nobodysid.xml";

   const std::map<std::string, std::string> expected_identifiers{{"S-1-0-0", "S-1-0-0"}};

   using org::apache::nifi::minifi::wel::Metadata;
   const std::map<Metadata, std::string> expected_metadata{
       {Metadata::SOURCE, "Microsoft-Windows-Security-Auditing"},
       {Metadata::TIME_CREATED, "event_timestamp"},
       {Metadata::EVENTID, "4672"},
       {Metadata::EVENT_RECORDID, "2575952"}};

   const std::map<std::string, std::string> expected_field_values{};

   SECTION("update_xml is false") {
     extractMappingsTestHelper(file_name, false, false, expected_identifiers, expected_metadata, expected_field_values);
   }

   SECTION("update_xml is true") {
     extractMappingsTestHelper(file_name, true, false, expected_identifiers, expected_metadata, expected_field_values);
   }
 }

 TEST_CASE("MetadataWalker extracts mappings correctly when there is a single Sid and resolve=true", "[for_each]") {
   const std::string file_name = "resources/nobodysid.xml";

   const std::map<std::string, std::string> expected_identifiers{{"S-1-0-0", "Nobody"}};

   using org::apache::nifi::minifi::wel::Metadata;
   const std::map<Metadata, std::string> expected_metadata{
       {Metadata::LOG_NAME, "MetadataWalkerTests"},
       {Metadata::SOURCE, "Microsoft-Windows-Security-Auditing"},
       {Metadata::TIME_CREATED, "event_timestamp"},
       {Metadata::EVENTID, "4672"},
       {Metadata::OPCODE, "event_data_for_field_4"},
       {Metadata::EVENT_RECORDID, "2575952"},
       {Metadata::EVENT_TYPE, "178"},
       {Metadata::TASK_CATEGORY, "event_data_for_field_3"},
       {Metadata::LEVEL, "event_data_for_field_2"},
       {Metadata::KEYWORDS, "event_data_for_field_5"}};

   SECTION("update_xml is false => fields are collected into walker.getFieldValues()") {
     const std::map<std::string, std::string> expected_field_values{
         {"Channel", "event_data_for_field_6"},
         {"Keywords", "event_data_for_field_5"},
         {"Level", "event_data_for_field_2"},
         {"Opcode", "event_data_for_field_4"},
         {"SubjectUserSid", "Nobody"},
         {"Task", "event_data_for_field_3"}};

     extractMappingsTestHelper(file_name, false, true, expected_identifiers, expected_metadata, expected_field_values);
   }

   SECTION("update_xml is true => fields are updated in-place in the XML, and walker.getFieldValues() is empty") {
     const std::map<std::string, std::string> expected_field_values{};

     extractMappingsTestHelper(file_name, true, true, expected_identifiers, expected_metadata, expected_field_values);
   }
 }

 TEST_CASE("MetadataWalker extracts mappings correctly when there are multiple Sids and resolve=false", "[for_each]") {
   const std::string file_name = "resources/multiplesids.xml";

   const std::map<std::string, std::string> expected_identifiers{{"S-1-0-0", "S-1-0-0"}};

   using org::apache::nifi::minifi::wel::Metadata;
   const std::map<Metadata, std::string> expected_metadata{
       {Metadata::SOURCE, "Microsoft-Windows-Security-Auditing"},
       {Metadata::TIME_CREATED, "event_timestamp"},
       {Metadata::EVENTID, "4672"},
       {Metadata::EVENT_RECORDID, "2575952"}};

   const std::map<std::string, std::string> expected_field_values{};

   SECTION("update_xml is false") {
     extractMappingsTestHelper(file_name, false, false, expected_identifiers, expected_metadata, expected_field_values);
   }

   SECTION("update_xml is true") {
     extractMappingsTestHelper(file_name, true, false, expected_identifiers, expected_metadata, expected_field_values);
   }
 }

 TEST_CASE("MetadataWalker extracts mappings correctly when there are multiple Sids and resolve=true", "[for_each]") {
   const std::string file_name = "resources/multiplesids.xml";

   const std::map<std::string, std::string> expected_identifiers{
       {"%{S-1-0}", "Null Authority"},
       {"%{S-1-0-0}", "Nobody"},
       {"%{S-1-1-0}", "Everyone"},
       {"S-1-0", "Null Authority"},
       {"S-1-0-0", "Nobody"},
       {"S-1-1-0", "Everyone"}};

   using org::apache::nifi::minifi::wel::Metadata;
   const std::map<Metadata, std::string> expected_metadata{
       {Metadata::LOG_NAME, "MetadataWalkerTests"},
       {Metadata::SOURCE, "Microsoft-Windows-Security-Auditing"},
       {Metadata::TIME_CREATED, "event_timestamp"},
       {Metadata::EVENTID, "4672"},
       {Metadata::OPCODE, "event_data_for_field_4"},
       {Metadata::EVENT_RECORDID, "2575952"},
       {Metadata::EVENT_TYPE, "178"},
       {Metadata::TASK_CATEGORY, "event_data_for_field_3"},
       {Metadata::LEVEL, "event_data_for_field_2"},
       {Metadata::KEYWORDS, "event_data_for_field_5"}};

   SECTION("update_xml is false => fields are collected into walker.getFieldValues()") {
     const std::map<std::string, std::string> expected_field_values{
         {"Channel", "event_data_for_field_6"},
         {"Keywords", "event_data_for_field_5"},
         {"Level", "event_data_for_field_2"},
         {"Opcode", "event_data_for_field_4"},
         {"SubjectUserSid", "Nobody"},
         {"Task", "event_data_for_field_3"}};

     extractMappingsTestHelper(file_name, false, true, expected_identifiers, expected_metadata, expected_field_values);
   }

   SECTION("update_xml is true => fields are updated in-place in the XML, and walker.getFieldValues() is empty") {
     const std::map<std::string, std::string> expected_field_values{};

     extractMappingsTestHelper(file_name, true, true, expected_identifiers, expected_metadata, expected_field_values);
   }
 }

 TEST_CASE("MetadataWalker extracts mappings correctly when the Sid is unknown and resolve=false", "[for_each]") {
   const std::string file_name = "resources/unknownsid.xml";

   const std::map<std::string, std::string> expected_identifiers{{"S-1-8-6-5-3-0-9", "S-1-8-6-5-3-0-9"}};

   using org::apache::nifi::minifi::wel::Metadata;
   const std::map<Metadata, std::string> expected_metadata{
       {Metadata::SOURCE, "Microsoft-Windows-Security-Auditing"},
       {Metadata::TIME_CREATED, "event_timestamp"},
       {Metadata::EVENTID, "4672"},
       {Metadata::EVENT_RECORDID, "2575952"}};

   const std::map<std::string, std::string> expected_field_values{};

   SECTION("update_xml is false") {
     extractMappingsTestHelper(file_name, false, false, expected_identifiers, expected_metadata, expected_field_values);
   }

   SECTION("update_xml is true") {
     extractMappingsTestHelper(file_name, true, false, expected_identifiers, expected_metadata, expected_field_values);
   }
 }

 TEST_CASE("MetadataWalker extracts mappings correctly when the Sid is unknown and resolve=true", "[for_each]") {
   const std::string file_name = "resources/unknownsid.xml";

   const std::map<std::string, std::string> expected_identifiers{{"S-1-8-6-5-3-0-9", "S-1-8-6-5-3-0-9"}};

   using org::apache::nifi::minifi::wel::Metadata;
   const std::map<Metadata, std::string> expected_metadata{
       {Metadata::LOG_NAME, "MetadataWalkerTests"},
       {Metadata::SOURCE, "Microsoft-Windows-Security-Auditing"},
       {Metadata::TIME_CREATED, "event_timestamp"},
       {Metadata::EVENTID, "4672"},
       {Metadata::OPCODE, "event_data_for_field_4"},
       {Metadata::EVENT_RECORDID, "2575952"},
       {Metadata::EVENT_TYPE, "178"},
       {Metadata::TASK_CATEGORY, "event_data_for_field_3"},
       {Metadata::LEVEL, "event_data_for_field_2"},
       {Metadata::KEYWORDS, "event_data_for_field_5"}};

   SECTION("update_xml is false => fields are collected into walker.getFieldValues()") {
     const std::map<std::string, std::string> expected_field_values{
         {"Channel", "event_data_for_field_6"},
         {"Keywords", "event_data_for_field_5"},
         {"Level", "event_data_for_field_2"},
         {"Opcode", "event_data_for_field_4"},
         {"Task", "event_data_for_field_3"}};

     extractMappingsTestHelper(file_name, false, true, expected_identifiers, expected_metadata, expected_field_values);
   }

   SECTION("update_xml is true => fields are updated in-place in the XML, and walker.getFieldValues() is empty") {
     const std::map<std::string, std::string> expected_field_values{};

     extractMappingsTestHelper(file_name, true, true, expected_identifiers, expected_metadata, expected_field_values);
   }
 }
	/**
	*
	* Licensed to the Apache Software Foundation (ASF) under one or more
	* contributor license agreements. See the NOTICE file distributed with
	* this work for additional information regarding copyright ownership.
	* The ASF licenses this file to You under the Apache License, Version 2.0
	* (the "License"); you may not use this file except in compliance with
	* the License. You may obtain a copy of the License at
	*
	* http://www.apache.org/licenses/LICENSE-2.0
	*
	* Unless required by applicable law or agreed to in writing, software
	* distributed under the License is distributed on an "AS IS" BASIS,
	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	* See the License for the specific language governing permissions and
	* limitations under the License.
	*/

	#include <map>
	#include <string>

	#include "ConsumeWindowsEventLog.h"
	#include "unit/TestBase.h"
	#include "unit/Catch.h"
	#include "core/Core.h"
	#include "utils/OsUtils.h"
	#include "wel/MetadataWalker.h"
	#include "wel/XMLString.h"
	#include "pugixml.hpp"

	using Metadata = org::apache::nifi::minifi::wel::Metadata;
	using MetadataWalker = org::apache::nifi::minifi::wel::MetadataWalker;
	using WindowsEventLogProvider = org::apache::nifi::minifi::wel::WindowsEventLogProvider;
	using WindowsEventLogMetadata = org::apache::nifi::minifi::wel::WindowsEventLogMetadata;
	using WindowsEventLogMetadataImpl = org::apache::nifi::minifi::wel::WindowsEventLogMetadataImpl;
	using XmlString = org::apache::nifi::minifi::wel::XmlString;

	namespace {

	auto none_matcher = minifi::wel::parseSidMatcher(std::nullopt);

	std::string updateXmlMetadata(const std::string &xml, EVT_HANDLE provider_handle, EVT_HANDLE event_handle, bool update_xml, bool resolve,
	const std::function<bool(std::string_view)>& sid_matcher = none_matcher) {
	WindowsEventLogProvider event_log_provider{provider_handle};
	WindowsEventLogMetadataImpl metadata{event_log_provider, event_handle};
	MetadataWalker walker(metadata, "", update_xml, resolve, sid_matcher, &utils::OsUtils::userIdToUsername);

	pugi::xml_document doc;
	pugi::xml_parse_result result = doc.load_string(xml.c_str());

	if (result) {
	doc.traverse(walker);
	XmlString writer;
	doc.print(writer, "", pugi::format_raw); // no indentation or formatting
	return writer.xml_;
	} else {
	throw std::runtime_error("Could not parse XML document");
	}
	}

	std::string formatXml(const std::string &xml) {
	pugi::xml_document doc;
	pugi::xml_parse_result result = doc.load_string(xml.c_str());

	if (result) {
	XmlString writer;
	doc.print(writer, "", pugi::format_raw); // no indentation or formatting
	return writer.xml_;
	}
	return xml;
	}

	std::string readFile(const std::string &file_name) {
	std::ifstream file{file_name};
	return std::string{std::istreambuf_iterator<char>(file), std::istreambuf_iterator<char>()};
	}

	const std::string METADATA_WALKER_TESTS_LOG_NAME = "MetadataWalkerTests";
	const short event_type_index = 178; // NOLINT short comes from WINDOWS API

	class FakeWindowsEventLogMetadata : public WindowsEventLogMetadata {
	public:
	[[nodiscard]] std::string getEventData(EVT_FORMAT_MESSAGE_FLAGS field, const std::string&) const override {
	return "event_data_for_field_" + std::to_string(field);
	}
	[[nodiscard]] std::string getEventTimestamp() const override { return "event_timestamp"; }
	short getEventTypeIndex() const override { return event_type_index; } // NOLINT short comes from WINDOWS API
	};

	} // namespace

	TEST_CASE("MetadataWalker updates the Sid in the XML if both update_xml and resolve are true", "[updateXmlMetadata]") {
	std::string xml = readFile("resources/nobodysid.xml");

	SECTION("No resolution") {
	REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, false, true) == formatXml(xml));
	}

	SECTION("Resolve nobody") {
	std::string nobody = readFile("resources/withsids.xml");
	const auto sid_matcher = minifi::wel::parseSidMatcher(".*Sid");
	REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, true, true, sid_matcher) == formatXml(nobody));
	}
	}


	TEST_CASE("MetadataWalker updates the Security/UserId attribute", "[updateXmlMetadata][userid]") {
	std::string xml = readFile("resources/userid.xml");

	SECTION("No resolution") {
	REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, false, true) == formatXml(xml));
	}

	SECTION("Resolve nobody") {
	std::string nobody = readFile("resources/resolveduserid.xml");
	const auto sid_matcher = minifi::wel::parseSidMatcher("(.*Sid)\|UserID");
	REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, true, true, sid_matcher) == formatXml(nobody));
	}
	}

	TEST_CASE("MetadataWalker works even when there is no Data block", "[updateXmlMetadata]") {
	std::string xml = readFile("resources/nodata.xml");

	REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, false, true) == formatXml(xml));
	}

	TEST_CASE("MetadataWalker throws if the input XML is invalid", "[updateXmlMetadata]") {
	std::string xml = readFile("resources/invalidxml.xml");

	REQUIRE_THROWS(updateXmlMetadata(xml, nullptr, nullptr, false, true) == formatXml(xml));
	}

	TEST_CASE("MetadataWalker will leave a Sid unchanged if it doesn't correspond to a user", "[updateXmlMetadata]") {
	std::string xml = readFile("resources/unknownsid.xml");

	REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, false, true) == formatXml(xml));
	REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, true, true) == formatXml(xml));
	const auto sid_matcher = minifi::wel::parseSidMatcher(".*Sid");
	REQUIRE(updateXmlMetadata(xml, nullptr, nullptr, true, true, sid_matcher) == formatXml(xml));
	}

	TEST_CASE("MetadataWalker can replace multiple Sids", "[updateXmlMetadata]") {
	std::string xml = readFile("resources/multiplesids.xml");

	pugi::xml_document doc;
	xml = updateXmlMetadata(xml, nullptr, nullptr, false, true);
	pugi::xml_parse_result result = doc.load_string(xml.c_str());
	REQUIRE(result);

	// we are only testing multiple sid resolutions, not the resolution of other items.
	CHECK(std::string_view("Nobody Everyone Null Authority") == doc.select_node("Event/EventData/Data[@Name='GroupMembership']").node().text().get());
	}

	namespace {

	void extractMappingsTestHelper(const std::string &file_name,
	bool update_xml,
	bool resolve,
	const std::map<std::string, std::string>& expected_identifiers,
	const std::map<Metadata, std::string>& expected_metadata,
	const std::map<std::string, std::string>& expected_field_values) {
	std::string input_xml = readFile(file_name);
	REQUIRE(!input_xml.empty());
	pugi::xml_document doc;
	pugi::xml_parse_result result = doc.load_string(input_xml.c_str());
	REQUIRE(result);

	const auto sid_matcher = minifi::wel::parseSidMatcher(".*Sid");
	MetadataWalker walker(FakeWindowsEventLogMetadata{}, METADATA_WALKER_TESTS_LOG_NAME, update_xml, resolve, sid_matcher, &utils::OsUtils::userIdToUsername);
	doc.traverse(walker);

	CHECK(walker.getIdentifiers() == expected_identifiers);
	CHECK(walker.getFieldValues() == expected_field_values);
	for (const auto &key_value_pair : expected_metadata) {
	CHECK(walker.getMetadata(key_value_pair.first) == key_value_pair.second);
	}
	}

	} // namespace

	TEST_CASE("MetadataWalker extracts mappings correctly when there is a single Sid and resolve=false", "[for_each]") {
	const std::string file_name = "resources/nobodysid.xml";

	const std::map<std::string, std::string> expected_identifiers{{"S-1-0-0", "S-1-0-0"}};

	using org::apache::nifi::minifi::wel::Metadata;
	const std::map<Metadata, std::string> expected_metadata{
	{Metadata::SOURCE, "Microsoft-Windows-Security-Auditing"},
	{Metadata::TIME_CREATED, "event_timestamp"},
	{Metadata::EVENTID, "4672"},
	{Metadata::EVENT_RECORDID, "2575952"}};

	const std::map<std::string, std::string> expected_field_values{};

	SECTION("update_xml is false") {
	extractMappingsTestHelper(file_name, false, false, expected_identifiers, expected_metadata, expected_field_values);
	}

	SECTION("update_xml is true") {
	extractMappingsTestHelper(file_name, true, false, expected_identifiers, expected_metadata, expected_field_values);
	}
	}

	TEST_CASE("MetadataWalker extracts mappings correctly when there is a single Sid and resolve=true", "[for_each]") {
	const std::string file_name = "resources/nobodysid.xml";

	const std::map<std::string, std::string> expected_identifiers{{"S-1-0-0", "Nobody"}};

	using org::apache::nifi::minifi::wel::Metadata;
	const std::map<Metadata, std::string> expected_metadata{
	{Metadata::LOG_NAME, "MetadataWalkerTests"},
	{Metadata::SOURCE, "Microsoft-Windows-Security-Auditing"},
	{Metadata::TIME_CREATED, "event_timestamp"},
	{Metadata::EVENTID, "4672"},
	{Metadata::OPCODE, "event_data_for_field_4"},
	{Metadata::EVENT_RECORDID, "2575952"},
	{Metadata::EVENT_TYPE, "178"},
	{Metadata::TASK_CATEGORY, "event_data_for_field_3"},
	{Metadata::LEVEL, "event_data_for_field_2"},
	{Metadata::KEYWORDS, "event_data_for_field_5"}};

	SECTION("update_xml is false => fields are collected into walker.getFieldValues()") {
	const std::map<std::string, std::string> expected_field_values{
	{"Channel", "event_data_for_field_6"},
	{"Keywords", "event_data_for_field_5"},
	{"Level", "event_data_for_field_2"},
	{"Opcode", "event_data_for_field_4"},
	{"SubjectUserSid", "Nobody"},
	{"Task", "event_data_for_field_3"}};

	extractMappingsTestHelper(file_name, false, true, expected_identifiers, expected_metadata, expected_field_values);
	}

	SECTION("update_xml is true => fields are updated in-place in the XML, and walker.getFieldValues() is empty") {
	const std::map<std::string, std::string> expected_field_values{};

	extractMappingsTestHelper(file_name, true, true, expected_identifiers, expected_metadata, expected_field_values);
	}
	}

	TEST_CASE("MetadataWalker extracts mappings correctly when there are multiple Sids and resolve=false", "[for_each]") {
	const std::string file_name = "resources/multiplesids.xml";

	const std::map<std::string, std::string> expected_identifiers{{"S-1-0-0", "S-1-0-0"}};

	using org::apache::nifi::minifi::wel::Metadata;
	const std::map<Metadata, std::string> expected_metadata{
	{Metadata::SOURCE, "Microsoft-Windows-Security-Auditing"},
	{Metadata::TIME_CREATED, "event_timestamp"},
	{Metadata::EVENTID, "4672"},
	{Metadata::EVENT_RECORDID, "2575952"}};

	const std::map<std::string, std::string> expected_field_values{};

	SECTION("update_xml is false") {
	extractMappingsTestHelper(file_name, false, false, expected_identifiers, expected_metadata, expected_field_values);
	}

	SECTION("update_xml is true") {
	extractMappingsTestHelper(file_name, true, false, expected_identifiers, expected_metadata, expected_field_values);
	}
	}

	TEST_CASE("MetadataWalker extracts mappings correctly when there are multiple Sids and resolve=true", "[for_each]") {
	const std::string file_name = "resources/multiplesids.xml";

	const std::map<std::string, std::string> expected_identifiers{
	{"%{S-1-0}", "Null Authority"},
	{"%{S-1-0-0}", "Nobody"},
	{"%{S-1-1-0}", "Everyone"},
	{"S-1-0", "Null Authority"},
	{"S-1-0-0", "Nobody"},
	{"S-1-1-0", "Everyone"}};

	using org::apache::nifi::minifi::wel::Metadata;
	const std::map<Metadata, std::string> expected_metadata{
	{Metadata::LOG_NAME, "MetadataWalkerTests"},
	{Metadata::SOURCE, "Microsoft-Windows-Security-Auditing"},
	{Metadata::TIME_CREATED, "event_timestamp"},
	{Metadata::EVENTID, "4672"},
	{Metadata::OPCODE, "event_data_for_field_4"},
	{Metadata::EVENT_RECORDID, "2575952"},
	{Metadata::EVENT_TYPE, "178"},
	{Metadata::TASK_CATEGORY, "event_data_for_field_3"},
	{Metadata::LEVEL, "event_data_for_field_2"},
	{Metadata::KEYWORDS, "event_data_for_field_5"}};

	SECTION("update_xml is false => fields are collected into walker.getFieldValues()") {
	const std::map<std::string, std::string> expected_field_values{
	{"Channel", "event_data_for_field_6"},
	{"Keywords", "event_data_for_field_5"},
	{"Level", "event_data_for_field_2"},
	{"Opcode", "event_data_for_field_4"},
	{"SubjectUserSid", "Nobody"},
	{"Task", "event_data_for_field_3"}};

	extractMappingsTestHelper(file_name, false, true, expected_identifiers, expected_metadata, expected_field_values);
	}

	SECTION("update_xml is true => fields are updated in-place in the XML, and walker.getFieldValues() is empty") {
	const std::map<std::string, std::string> expected_field_values{};

	extractMappingsTestHelper(file_name, true, true, expected_identifiers, expected_metadata, expected_field_values);
	}
	}

	TEST_CASE("MetadataWalker extracts mappings correctly when the Sid is unknown and resolve=false", "[for_each]") {
	const std::string file_name = "resources/unknownsid.xml";

	const std::map<std::string, std::string> expected_identifiers{{"S-1-8-6-5-3-0-9", "S-1-8-6-5-3-0-9"}};

	using org::apache::nifi::minifi::wel::Metadata;
	const std::map<Metadata, std::string> expected_metadata{
	{Metadata::SOURCE, "Microsoft-Windows-Security-Auditing"},
	{Metadata::TIME_CREATED, "event_timestamp"},
	{Metadata::EVENTID, "4672"},
	{Metadata::EVENT_RECORDID, "2575952"}};

	const std::map<std::string, std::string> expected_field_values{};

	SECTION("update_xml is false") {
	extractMappingsTestHelper(file_name, false, false, expected_identifiers, expected_metadata, expected_field_values);
	}

	SECTION("update_xml is true") {
	extractMappingsTestHelper(file_name, true, false, expected_identifiers, expected_metadata, expected_field_values);
	}
	}

	TEST_CASE("MetadataWalker extracts mappings correctly when the Sid is unknown and resolve=true", "[for_each]") {
	const std::string file_name = "resources/unknownsid.xml";

	const std::map<std::string, std::string> expected_identifiers{{"S-1-8-6-5-3-0-9", "S-1-8-6-5-3-0-9"}};

	using org::apache::nifi::minifi::wel::Metadata;
	const std::map<Metadata, std::string> expected_metadata{
	{Metadata::LOG_NAME, "MetadataWalkerTests"},
	{Metadata::SOURCE, "Microsoft-Windows-Security-Auditing"},
	{Metadata::TIME_CREATED, "event_timestamp"},
	{Metadata::EVENTID, "4672"},
	{Metadata::OPCODE, "event_data_for_field_4"},
	{Metadata::EVENT_RECORDID, "2575952"},
	{Metadata::EVENT_TYPE, "178"},
	{Metadata::TASK_CATEGORY, "event_data_for_field_3"},
	{Metadata::LEVEL, "event_data_for_field_2"},
	{Metadata::KEYWORDS, "event_data_for_field_5"}};

	SECTION("update_xml is false => fields are collected into walker.getFieldValues()") {
	const std::map<std::string, std::string> expected_field_values{
	{"Channel", "event_data_for_field_6"},
	{"Keywords", "event_data_for_field_5"},
	{"Level", "event_data_for_field_2"},
	{"Opcode", "event_data_for_field_4"},
	{"Task", "event_data_for_field_3"}};

	extractMappingsTestHelper(file_name, false, true, expected_identifiers, expected_metadata, expected_field_values);
	}

	SECTION("update_xml is true => fields are updated in-place in the XML, and walker.getFieldValues() is empty") {
	const std::map<std::string, std::string> expected_field_values{};

	extractMappingsTestHelper(file_name, true, true, expected_identifiers, expected_metadata, expected_field_values);
	}
	}