Onboarding MDE for Linux to LISA

lisa/tools/__init__.py

@@ -65,6 +65,7 @@
 from .lsvmbus import Lsvmbus
 from .make import Make
 from .mdadm import Mdadm
+from .mde import MDE
 from .mkdir import Mkdir
 from .mkfs import FileSystem, Mkfs, Mkfsext, Mkfsxfs
 from .modinfo import Modinfo

lisa/tools/mde.py

@@ -0,0 +1,99 @@
+# Copyright (c) Microsoft Corporation.
+# Licensed under the MIT license.
+
+import os
+import sys
+import json
+import requests
+from pathlib import Path, PurePath
+from typing import Any
+
+from lisa.executable import Tool
+from lisa.executable import CustomScriptBuilder, CustomScript
+#from . import RemoteCopy, Whoami, Curl
+from .remote_copy import RemoteCopy
+from .whoami import Whoami
+
+class MDE(Tool):
+    @property
+    def command(self) -> str:
+        return "mdatp"
+
+    @property
+    def can_install(self) -> bool:
+        return True
+
+    def get_mde_installer(self) -> bool:
+        if not hasattr(self, '_mde_installer'):
+            response = requests.get("https://raw.githubusercontent.com/microsoft/mdatp-xplat/master/linux/installation/mde_installer.sh")
+            if response.ok:
+                script = response.text
+                import tempfile
+                _, self.mde_installer_script = tempfile.mkstemp(prefix='mde_installer', suffix='.sh')
+                with open(self.mde_installer_script, 'w') as writer:
+                    writer.write(script)
+                self._mde_installer = CustomScriptBuilder(Path(os.path.dirname(self.mde_installer_script)),
+                                                [os.path.basename(self.mde_installer_script)])
+                return True
+            return False
+        return True
+
+    def _install(self) -> bool:
+        if not self.get_mde_installer():
+           self._log.error("Unable to download mde_installer.sh script. MDE can't be installed")
+
+        mde_installer: CustomScript = self.node.tools[self._mde_installer]
+        self._log.info('Installing MDE')
+        result1 = mde_installer.run(parameters="--install", sudo=True)
+        self._log.info(result1)
+
+        return self._check_exists()
+
+
+    def onboard(self, onboarding_script: PurePath) -> bool:
+        if not self._check_exists():
+            self._log.error("MDE is not installed, onboarding not possible")
+            return False
+
+        username = self.node.tools[Whoami].get_username()
+
+        remote_copy = self.node.tools[RemoteCopy]
+        remote_copy.copy_to_remote(onboarding_script, PurePath(f"/home/{username}/MicrosoftDefenderATPOnboardingLinuxServer.py"))
+
+        if not self.get_mde_installer():
+           self._log.error("Unable to download mde_installer.sh script. MDE can't be onboarded")
+
+        script: CustomScript = self.node.tools[self._mde_installer]
+
+        self._log.info('Onboarding MDE')
+        result1 = script.run(parameters=f"--onboard /home/{username}/MicrosoftDefenderATPOnboardingLinuxServer.py/MicrosoftDefenderATPOnboardingLinuxServer.py", sudo=True)
+        self._log.info(result1)
+
+        output = self.get_result('health --field licensed')
+
+        self._log.info(output)
+
+        return bool(output == ['true'])
+
+
+    def get_result(
+        self,
+        arg: str,
+        json_out: bool = False,
+        sudo: bool = False,
+    ) -> Any:
+        if json_out:
+            arg += ' --output json'
+        result = self.run(
+            arg,
+            sudo=sudo,
+            shell=True,
+            force_run=True,
+        )
+
+        result.assert_exit_code(include_output=True)
+        if json_out:
+            return json.loads(result.stdout)
+        return result.stdout.split()
+
+

microsoft/runbook/my.yml

@@ -0,0 +1,62 @@
+name: azure default
+include:
+  - path: ./debug.yml
+variable:
+  - name: origin
+    value: tiers/tier.yml
+  - name: case
+    value: verify_cpu_count
+  - name: onboarding_script
+    is_secret: true
+    is_case_visible: True
+    value: ""
+  - name: location
+    value: "westus3"
+  - name: keep_environment
+    value: "no"
+  - name: resource_group_name
+    value: ""
+  - name: marketplace_image
+    value: ""
+  - name: vhd
+    value: ""
+  - name: vm_size
+    value: ""
+  - name: deploy
+    value: true
+  - name: wait_delete
+    value: false
+  - name: concurrency
+    value: 5
+  - name: admin_private_key_file
+    value: ""
+    is_secret: true
+  - name: admin_password
+    value: ""
+    is_secret: true
+  - name: case
+    value: verify_cpu_count
+concurrency: $(concurrency)
+notifier:
+  - type: html
+  - type: env_stats
+platform:
+  - type: azure
+    admin_private_key_file: $(admin_private_key_file)
+    admin_password: $(admin_password)
+    keep_environment: $(keep_environment)
+    azure:
+      resource_group_name: "lisa-test-zakhter"
+      deploy: $(deploy)
+      subscription_id: $(subscription_id)
+      wait_delete: $(wait_delete)
+    requirement:
+      core_count:
+        min: 2
+      azure:
+        #marketplace: "Debian:debian-10-daily:10-gen2:0.20231218.1599" #$(marketplace_image)
+        marketplace: $(marketplace_image)
+        vhd: $(vhd)
+        location: $(location)
+        vm_size: $(vm_size)
+

microsoft/testsuites/vm_extensions/mde.py

@@ -0,0 +1,104 @@
+import time
+
+from typing import Any
+from pathlib import PurePath
+
+from assertpy import assert_that
+
+from lisa import (
+    Logger,
+    Node,
+    TestCaseMetadata,
+    TestSuite,
+    TestSuiteMetadata,
+    simple_requirement,
+)
+from lisa.operating_system import BSD
+from lisa.testsuite import TestResult
+from lisa.tools import Curl, MDE as mdatp
+from lisa.util import LisaException, SkippedException
+
+@TestSuiteMetadata(
+    area="vm_extension",
+    category="functional",
+    description="""
+    MDE Test Suite
+    """,
+)
+class MDE(TestSuite):
+
+    def before_case(self, log: Logger, **kwargs: Any) -> None:
+        variables = kwargs["variables"]
+        self.onboarding_script = variables.get("onboarding_script", "")
+        if not self.onboarding_script:
+            raise SkippedException("Onboarding script is not provided.")
+
+    @TestCaseMetadata(
+        description="""
+            Verify MDE installation
+        """,
+        priority=1,
+        requirement=simple_requirement(min_core_count=2,
+                                       min_memory_mb=1024,
+                                       unsupported_os=[BSD])
+    )
+    def verify_mde(self, node: Node, log: Logger, result: TestResult) -> None:
+
+        #Invoking tools first time, intalls the tool.
+        try:
+            output = node.tools[mdatp]._check_exists()
+        except LisaException as e:
+            log.error(e)
+            output = False
+
+        assert_that(output).described_as('Unable to install MDE').is_equal_to(True)
+
+        self.verify_onboard(node, log, result)
+
+        self.verify_health(node, log, result)
+
+        self.verify_eicar_detection(node, log, result)
+
+    def verify_onboard(self, node: Node, log: Logger, result: TestResult) -> None:
+
+        onboarding_result = node.tools[mdatp].onboard(PurePath(self.onboarding_script))
+
+        assert_that(onboarding_result).is_equal_to(True)
+
+        output = node.tools[mdatp].get_result('health --field licensed')
+
+        assert_that(output).is_equal_to(['true'])
+
+    def verify_health(self, node: Node, log: Logger, result: TestResult) -> None:
+        output = node.tools[mdatp].get_result('health', json_out=True)
+
+        log.info(output)
+
+        assert_that(output['healthy']).is_equal_to(True)
+
+    def verify_eicar_detection(self, node: Node, log: Logger, result: TestResult) -> None:
+        log.info('Running EICAR test')
+
+        output = node.tools[mdatp].get_result('health --field real_time_protection_enabled')
+        if output == ['false']:
+            output = node.tools[mdatp].get_result('config real-time-protection --value enabled', sudo=True)
+            assert_that(' '.join(output)).is_equal_to('Configuration property updated.')
+
+        current_threat_list= node.tools[mdatp].get_result('threat list')
+        log.info(current_threat_list)
+
+        node.tools[Curl].fetch(arg="-o /tmp/eicar.com.txt",
+                               execute_arg="",
+                               url="https://secure.eicar.org/eicar.com.txt")
+
+        time.sleep(5) #Wait for remediation
+
+        new_threat_list = node.tools[mdatp].get_result('threat list')
+        log.info(new_threat_list)
+
+        eicar_detect = ' '.join(new_threat_list).replace(' '.join(current_threat_list), '')
+
+        log.info(eicar_detect)
+        assert_that('Name: Virus:DOS/EICAR_Test_File' in eicar_detect).is_equal_to(True)
+
+