Merge pull request #226 from wazuh/merge-4.9.0-into-4.9.1

Merge 4.9.0 into 4.9.1

Author: fdalmaup

Diff for: CHANGELOG.md

@@ -23,6 +23,8 @@ All notable changes to this project will be documented in this file.
 - Fixed bug in the RemotedSimulator udp connections mocker. ([#86](https://github.com/wazuh/qa-integration-framework/pull/86))
 - Fixed agent_simulator response for active-response configuration commands. ([#139](https://github.com/wazuh/qa-integration-framework/pull/139))
 
+## [4.8.2]
+
 ## [4.8.1]
 
 ## [4.8.0]

Diff for: src/wazuh_testing/modules/fim/configuration.py

@@ -6,6 +6,7 @@
 SYSCHECK_DEBUG = 'syscheck.debug'
 SYMLINK_SCAN_INTERVAL = 'syscheck.symlink_scan_interval'
 FILE_MAX_SIZE = 'syscheck.file_max_size'
+RT_DELAY = 'syscheck.rt_delay'
 
 # File names
 LAST_ENTRY_FILE = 'last-entry.gz'

Diff for: src/wazuh_testing/modules/fim/patterns.py

@@ -20,6 +20,8 @@
 SENDING_FIM_EVENT = r'.*Sending FIM event: .*"type":"event".*'
 EVENT_TYPE_ADDED = r'.*Sending FIM event: .*"type":"added".*'
 EVENT_TYPE_MODIFIED = r'.*Sending FIM event: .*"type":"modified".*'
+EVENT_TYPE_REPORT_CHANGES = r".*Sending FIM event: .*\"content_changes\":\"([^\"]*)\".*"
+EVENT_UNABLE_DIFF = r".*Sending FIM event: .*\"content_changes\":\"(Unable to calculate diff due to [^\"]* limit has been reached.)\".*"
 EVENT_TYPE_DELETED = r'.*Sending FIM event: .*"type":"deleted".*'
 FIM_EVENT_JSON = r'.*Sending FIM event: (.+)$'
 FIM_EVENT_RESTRICT = r".*Ignoring entry '(.*?)' due to restriction '.*?'"
@@ -40,8 +42,8 @@
 WIN_CONVERT_FOLDER = r".*fim_adjust_path.*Convert '(.*) to '(.*)' to process the FIM events."
 
 DIFF_MAXIMUM_FILE_SIZE = r".*Maximum file size limit to generate diff information configured to \'(\d+) KB\'.*"
-DISK_QUOTA_LIMIT_CONFIGURED_VALUE = r'.*Maximum disk quota size limit configured to \'(\d+) KB\'.*'
-FILE_EXCEEDS_DISK_QUOTA = r'.*The (.*) of the file size \'(.*)\' exceeds the disk_quota.*'
+DIFF_DISK_QUOTA_LIMIT = r'.*Maximum disk quota size limit configured to \'(\d+) KB\'.*'
+DISK_QUOTA_LIMIT_REACHED = r'.*The (.*) of the file size \'(.*)\' exceeds the disk_quota.*'
 FILE_SIZE_LIMIT_REACHED = r'.*File \'(.*)\' is too big for configured maximum size to perform diff operation\.'
 DIFF_FOLDER_DELETED = r'.*Folder \'(.*)\' has been deleted.*'
 
@@ -50,4 +52,5 @@
 ERROR_MSG_DISK_QUOTA_LIMIT = 'Did not receive "Maximum disk quota size limit configured to \'... KB\'." event'
 ERROR_MSG_FIM_EVENT_NOT_DETECTED = 'Did not receive expected "Sending FIM event: ..." event.'
 ERROR_MSG_FILE_LIMIT_REACHED = 'Did not receive "File ... is too big ... to perform diff operation" event.'
+ERROR_MSG_REPORT_CHANGES_EVENT_NOT_DETECTED = 'Did not receive event with \'content_changes\' field.'
 ERROR_MSG_FOLDER_DELETED = 'Did not receive expected "Folder ... has been deleted." event.'