fix(fim/ebpf): propagate process fields changes to integration tests

elastic · Apr 3, 2024 · eae0bda · eae0bda
1 parent 745187f
commit eae0bda
Showing 1 changed file with 6 additions and 6 deletions.
diff --git a/auditbeat/tests/system/test_file_integrity.py b/auditbeat/tests/system/test_file_integrity.py
@@ -107,12 +107,12 @@ def wait_startup(self, backend, dir):
     def _assert_process_data(self, event, backend):
         if backend != "ebpf":
             return
-        assert event["file.process.entity_id"] != ""
-        assert event["file.process.executable"] == "pytest"
-        assert event["file.process.pid"] == os.getpid()
-        assert int(event["file.process.user.id"]) == os.geteuid()
-        assert event["file.process.user.name"] == pwd.getpwuid(os.geteuid()).pw_name
-        assert int(event["file.process.group.id"]) == os.getegid()
+        assert event["process.entity_id"] != ""
+        assert event["process.executable"] == "pytest"
+        assert event["process.pid"] == os.getpid()
+        assert int(event["process.user.id"]) == os.geteuid()
+        assert event["process.user.name"] == pwd.getpwuid(os.geteuid()).pw_name
+        assert int(event["process.group.id"]) == os.getegid()
 
     def _test_non_recursive(self, backend):
         """