Søren Eggert Lundsteen Olsen
66129d99fc
SQLI-SVC-001 (High) reports a service set to start automatically that is not running (SQL Server Agent, Full-text launcher, Launchpad …), from the sys.dm_server_services data the configuration collector already reads (2008 R2 SP1+; not relevant before). The service account is sensitive. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
33 lines
1.5 KiB
C#
33 lines
1.5 KiB
C#
using SQLInsight.Core.Data;
|
|
using SQLInsight.Core.Findings;
|
|
using SQLInsight.Rules.Engine;
|
|
using SQLInsight.Rules.Instance;
|
|
using static SQLInsight.Rules.Tests.TestInstances;
|
|
|
|
namespace SQLInsight.Rules.Tests;
|
|
|
|
public class ServiceRuleTests
|
|
{
|
|
private static RuleResult Run(IRule rule, RuleContext context) => Assert.Single(new RuleEngine([rule]).Evaluate(context));
|
|
|
|
private static InstanceConfigurationSnapshot Setup(params ServiceInfo[] services) =>
|
|
new() { CapturedAt = Now, ServicesAvailable = true, Services = services };
|
|
|
|
[Fact]
|
|
public void A_stopped_automatic_service_is_high_and_manual_ones_are_ignored()
|
|
{
|
|
var result = Run(new StoppedServiceRule(), With(Setup(
|
|
new ServiceInfo("SQL Server (MSSQLSERVER)", @"NT Service\MSSQLSERVER", "Automatic", "Running", true),
|
|
new ServiceInfo("SQL Server Agent (MSSQLSERVER)", @"KUNDE\svc-agent", "Automatic", "Stopped", null),
|
|
new ServiceInfo("SQL Server Launchpad (MSSQLSERVER)", null, "Manual", "Stopped", null))));
|
|
|
|
var finding = Assert.Single(result.Findings);
|
|
Assert.Equal(Severity.High, finding.Severity);
|
|
Assert.Contains("backup", finding.Explanation, StringComparison.Ordinal);
|
|
Assert.True(finding.Evidence.Single(e => e.Name == "Konto").Sensitive);
|
|
}
|
|
|
|
[Fact]
|
|
public void Before_2008_r2_sp1_it_is_not_relevant() =>
|
|
Assert.Equal(RuleOutcome.NotApplicable, Run(new StoppedServiceRule(), WithVersion("10.50.1600.1", Setup())).Outcome);
|
|
}
|