synapse 2.155.0__py311-none-any.whl → 2.156.0__py311-none-any.whl

synapse/models/infotech.py

@@ -408,6 +408,10 @@ class ItModule(s_module.CoreModule):
                     'doc': 'A Mitre ATT&CK Software ID.',
                     'ex': 'S0154',
                 }),
+                ('it:mitre:attack:campaign', ('str', {'regex': r'^C[0-9]{4}$'}), {
+                    'doc': 'A Mitre ATT&CK Campaign ID.',
+                    'ex': 'C0028',
+                }),
                 ('it:mitre:attack:flow', ('guid', {}), {
                     'doc': 'A Mitre ATT&CK Flow diagram.',
                 }),
@@ -490,7 +494,8 @@ class ItModule(s_module.CoreModule):
                 ('it:adid', ('str', {'lower': True, 'strip': True}), {
                     'doc': 'An advertising identification string.'}),
 
-                ('it:os:windows:sid', ('str', {'regex': r'^S-1-[0-59]-\d{2}-\d{8,10}-\d{8,10}-\d{8,10}-[1-9]\d{3}$'}), {
+                # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/c92a27b1-c772-4fa7-a432-15df5f1b66a1
+                ('it:os:windows:sid', ('str', {'regex': r'^S-1-(?:\d{1,10}|0x[0-9a-fA-F]{12})(?:-(?:\d+|0x[0-9a-fA-F]{2,}))*$'}), {
                     'doc': 'A Microsoft Windows Security Identifier.',
                     'ex': 'S-1-5-21-1220945662-1202665555-839525555-5555',
                 }),
@@ -1255,6 +1260,50 @@ class ItModule(s_module.CoreModule):
                         'doc': 'An array of ATT&CK technique IDs addressed by the mitigation.',
                     }),
                 )),
+                ('it:mitre:attack:campaign', {}, (
+                    ('name', ('ou:campname', {}), {
+                        'doc': 'The primary name for the ATT&CK campaign.',
+                    }),
+                    ('names', ('array', {'type': 'ou:campname', 'uniq': True, 'sorted': True}), {
+                        'doc': 'An array of alternate names for the ATT&CK campaign.',
+                    }),
+                    ('desc', ('str', {'strip': True}), {
+                        'doc': 'A description of the ATT&CK campaign.',
+                        'disp': {'hint': 'text'},
+                    }),
+                    ('url', ('inet:url', {}), {
+                        'doc': 'The URL that documents the ATT&CK campaign.',
+                    }),
+                    ('groups', ('array', {'type': 'it:mitre:attack:group',
+                                             'uniq': True, 'sorted': True, 'split': ','}), {
+                        'doc': 'An array of ATT&CK group IDs attributed to the campaign.',
+                    }),
+                    ('software', ('array', {'type': 'it:mitre:attack:software',
+                                             'uniq': True, 'sorted': True, 'split': ','}), {
+                        'doc': 'An array of ATT&CK software IDs used in the campaign.',
+                    }),
+                    ('techniques', ('array', {'type': 'it:mitre:attack:technique',
+                                             'uniq': True, 'sorted': True, 'split': ','}), {
+                        'doc': 'An array of ATT&CK technique IDs used in the campaign.',
+                    }),
+                    ('matrices', ('array', {'type': 'it:mitre:attack:matrix',
+                                            'uniq': True, 'sorted': True, 'split': ','}), {
+                        'doc': 'The ATT&CK matrices which define the campaign.',
+                    }),
+                    ('references', ('array', {'type': 'inet:url', 'uniq': True}), {
+                        'doc': 'An array of URLs that document the ATT&CK campaign.',
+                    }),
+                    ('period', ('ival', {}), {
+                        'doc': 'The time interval when the campaign was active.'}),
+                    ('created', ('time', {}), {
+                        'doc': 'The time that the campaign was created by Mitre.'}),
+                    ('updated', ('time', {}), {
+                        'doc': 'The time that the campaign was last updated by Mitre.'}),
+                    ('tag', ('syn:tag', {}), {
+                        'doc': 'The synapse tag used to annotate nodes included in this ATT&CK campaign.',
+                        'ex': 'cno.mitre.c0028',
+                    }),
+                )),
                 ('it:mitre:attack:flow', {}, (
                     ('name', ('str', {}), {
                         'doc': 'The name of the attack-flow diagram.'}),
@@ -1789,6 +1838,12 @@ class ItModule(s_module.CoreModule):
                     ('target:url', ('inet:url', {}), {
                         'doc': 'The URL that was scanned to produce the result.'}),
 
+                    ('target:ipv4', ('inet:ipv4', {}), {
+                        'doc': 'The IPv4 address that was scanned to produce the result.'}),
+
+                    ('target:ipv6', ('inet:ipv6', {}), {
+                        'doc': 'The IPv6 address that was scanned to produce the result.'}),
+
                     ('multi:scan', ('it:av:scan:result', {}), {
                         'doc': 'Set if this result was part of running multiple scanners.'}),
 

synapse/models/orgs.py

@@ -503,6 +503,9 @@ class OuModule(s_module.CoreModule):
 
                     ('tag', ('syn:tag', {}), {
                         'doc': 'The tag used to annotate nodes that are associated with the campaign.'}),
+
+                    ('mitre:attack:campaign', ('it:mitre:attack:campaign', {}), {
+                        'doc': 'A mapping to a Mitre ATT&CK campaign if applicable.'}),
                 )),
                 ('ou:conflict', {}, (
                     ('name', ('str', {'onespace': True}), {

synapse/models/risk.py

@@ -115,6 +115,8 @@ class RiskModule(s_module.CoreModule):
                 ('risk:extortion:type:taxonomy', ('taxonomy', {}), {
                     'interfaces': ('taxonomy',),
                     'doc': 'A taxonomy of extortion event types.'}),
+                ('risk:technique:masquerade', ('guid', {}), {
+                    'doc': 'Represents the assessment that a node is designed to resemble another in order to mislead.'}),
             ),
             'edges': (
                 # some explicit examples...
@@ -337,6 +339,9 @@ class RiskModule(s_module.CoreModule):
                     ('timeline:exploited', ('time', {"ismin": True}), {
                         'doc': 'The earliest known time when the vulnerability was exploited in the wild.'}),
 
+                    ('id', ('str', {'strip': True}), {
+                        'doc': 'An identifier for the vulnerability.'}),
+
                     ('cve', ('it:sec:cve', {}), {
                         'doc': 'The CVE ID of the vulnerability.'}),
 
@@ -942,6 +947,16 @@ class RiskModule(s_module.CoreModule):
                         'doc': 'The currency in which payment was demanded.'}),
 
                 )),
+                ('risk:technique:masquerade', {}, (
+                    ('node', ('ndef', {}), {
+                        'doc': 'The node masquerading as another.'}),
+                    ('period', ('ival', {}), {
+                        'doc': 'The time period when the masquerading was active.'}),
+                    ('target', ('ndef', {}), {
+                        'doc': 'The being masqueraded as.'}),
+                    ('technique', ('ou:technique', {}), {
+                        'doc': 'The specific technique which describes the type of masquerading.'}),
+                )),
             ),
         }
         name = 'risk'

synapse/models/syn.py

@@ -127,9 +127,6 @@ class SynModule(s_module.CoreModule):
                 ('syn:cmd', ('str', {'strip': True}), {
                     'doc': 'A Synapse storm command.'
                 }),
-                ('syn:splice', ('guid', {'strip': True}), {
-                    'doc': 'A splice from a layer.'
-                }),
                 ('syn:nodedata', ('comp', {'fields': (('key', 'str'), ('form', 'syn:form'))}), {
                     'doc': 'A nodedata key and the form it may be present on.',
                 }),
@@ -282,40 +279,5 @@ class SynModule(s_module.CoreModule):
                     ('nodedata', ('array', {'type': 'syn:nodedata'}), {
                         'doc': 'The list of nodedata that may be added by the command.', 'uniq': True, 'sorted': True, 'ro': True}),
                 )),
-                ('syn:splice', {'runt': True}, (
-                    ('type', ('str', {'strip': True}), {
-                        'doc': 'Type of splice.', 'ro': True
-                    }),
-                    ('iden', ('str', {}), {
-                        'doc': 'The iden of the node involved in the splice.', 'ro': True,
-                    }),
-                    ('form', ('syn:form', {'strip': True}), {
-                        'doc': 'The form involved in the splice.', 'ro': True
-                    }),
-                    ('prop', ('syn:prop', {'strip': True}), {
-                        'doc': 'Property modified in the splice.', 'ro': True
-                    }),
-                    ('tag', ('syn:tag', {'strip': True}), {
-                        'doc': 'Tag modified in the splice.', 'ro': True
-                    }),
-                    ('valu', ('data', {}), {
-                        'doc': 'The value being set in the splice.', 'ro': True
-                    }),
-                    ('oldv', ('data', {}), {
-                        'doc': 'The value before the splice.', 'ro': True
-                    }),
-                    ('user', ('guid', {}), {
-                        'doc': 'The user who caused the splice.', 'ro': True,
-                    }),
-                    ('prov', ('guid', {}), {
-                        'doc': 'The provenance stack of the splice.', 'ro': True,
-                    }),
-                    ('time', ('time', {}), {
-                        'doc': 'The time the splice occurred.', 'ro': True,
-                    }),
-                    ('splice', ('data', {}), {
-                        'doc': 'The splice.', 'ro': True
-                    }),
-                )),
             ),
         }),)

synapse/tests/test_cmds_cortex.py

@@ -245,7 +245,7 @@ class CmdCoreTest(s_t_utils.SynTest):
                 cmdr = await s_cmdr.getItemCmdr(core, outp=outp)
                 await cmdr.runCmdLine('log --on --format jsonl')
                 fp = cmdr.locs.get('log:fp')
-                await cmdr.runCmdLine('storm --editformat splices [test:str=hi :tick=2018 +#haha.hehe]')
+                await cmdr.runCmdLine('storm [test:str=hi :tick=2018 +#haha.hehe]')
 
                 await cmdr.runCmdLine('storm --editformat nodeedits [test:str=hi2 :tick=2018 +#haha.hehe]')
                 await cmdr.runCmdLine('storm [test:comp=(42, bar)]')

synapse/tests/test_cortex.py

@@ -937,14 +937,6 @@ class CortexTest(s_t_utils.SynTest):
                 return($list.size())
             '''))
 
-            # check that edge node edits dont bork up legacy splice generation
-            nodeedits = [(ipv4.buid, 'inet:ipv4', (
-                (s_layer.EDIT_EDGE_ADD, (), ()),
-                (s_layer.EDIT_EDGE_DEL, (), ()),
-            ))]
-
-            self.eq((), await alist(core.view.layers[0].makeSplices(0, nodeedits, {})))
-
             # Run multiple nodes through edge creation/deletion ( test coverage for perm caching )
             await core.nodes('inet:ipv4 [ <(test)+ { meta:source:name=test }]')
             self.len(2, await core.nodes('meta:source:name=test -(test)> *'))
@@ -1799,45 +1791,41 @@ class CortexTest(s_t_utils.SynTest):
 
             async with self.getTestCore(dirn=dirn) as core:
 
-                async with core.getLocalProxy() as prox:
-
-                    await prox.setStormCmd(cdef0)
+                await core.setStormCmd(cdef0)
 
-                    nodes = await core.nodes('[ inet:asn=10 ] | testcmd0 zoinks')
-                    self.true(nodes[0].tags.get('zoinks'))
+                nodes = await core.nodes('[ inet:asn=10 ] | testcmd0 zoinks')
+                self.true(nodes[0].tags.get('zoinks'))
 
-                    nodes = await core.nodes('[ inet:asn=11 ] | testcmd0 zoinks --domore')
+                nodes = await core.nodes('[ inet:asn=11 ] | testcmd0 zoinks --domore')
 
-                    self.true(nodes[0].tags.get('haha'))
-                    self.true(nodes[0].tags.get('zoinks'))
+                self.true(nodes[0].tags.get('haha'))
+                self.true(nodes[0].tags.get('zoinks'))
 
-                    # test that cmdopts/cmdconf/locals dont leak
-                    with self.raises(s_exc.NoSuchVar):
-                        q = '[ inet:asn=11 ] | testcmd0 zoinks --domore | if ($cmdopts) {[ +#hascmdopts ]}'
-                        nodes = await core.nodes(q)
+                # test that cmdopts/cmdconf/locals dont leak
+                with self.raises(s_exc.NoSuchVar):
+                    q = '[ inet:asn=11 ] | testcmd0 zoinks --domore | if ($cmdopts) {[ +#hascmdopts ]}'
+                    nodes = await core.nodes(q)
 
-                    with self.raises(s_exc.NoSuchVar):
-                        q = '[ inet:asn=11 ] | testcmd0 zoinks --domore | if ($cmdconf) {[ +#hascmdconf ]}'
-                        nodes = await core.nodes(q)
+                with self.raises(s_exc.NoSuchVar):
+                    q = '[ inet:asn=11 ] | testcmd0 zoinks --domore | if ($cmdconf) {[ +#hascmdconf ]}'
+                    nodes = await core.nodes(q)
 
-                    with self.raises(s_exc.NoSuchVar):
-                        q = '[ inet:asn=11 ] | testcmd0 zoinks --domore | if ($foo) {[ +#hasfoo ]}'
-                        nodes = await core.nodes(q)
+                with self.raises(s_exc.NoSuchVar):
+                    q = '[ inet:asn=11 ] | testcmd0 zoinks --domore | if ($foo) {[ +#hasfoo ]}'
+                    nodes = await core.nodes(q)
 
             # make sure it's still loaded...
             async with self.getTestCore(dirn=dirn) as core:
 
-                async with core.getLocalProxy() as prox:
-
-                    await core.nodes('[ inet:asn=30 ] | testcmd0 zoinks')
+                await core.nodes('[ inet:asn=30 ] | testcmd0 zoinks')
 
-                    await prox.delStormCmd('testcmd0')
+                await core.delStormCmd('testcmd0')
 
-                    with self.raises(s_exc.NoSuchCmd):
-                        await prox.delStormCmd('newpcmd')
+                with self.raises(s_exc.NoSuchCmd):
+                    await core.delStormCmd('newpcmd')
 
-                    with self.raises(s_exc.NoSuchName):
-                        await core.nodes('[ inet:asn=31 ] | testcmd0 zoinks')
+                with self.raises(s_exc.NoSuchName):
+                    await core.nodes('[ inet:asn=31 ] | testcmd0 zoinks')
 
     async def test_base_types2(self):
 
@@ -3130,6 +3118,7 @@ class CortexBasicTest(s_t_utils.SynTest):
             self.eq(corever, s_version.version)
             self.eq(corever, cellver)
 
+            # NOTE: addNode / addNodes are deprecated in 3.0.0
             nodes = ((('inet:user', 'visi'), {}),)
 
             nodes = await alist(proxy.addNodes(nodes))
@@ -3137,24 +3126,6 @@ class CortexBasicTest(s_t_utils.SynTest):
 
             node = await proxy.addNode('test:str', 'foo')
 
-            pack = await proxy.addNodeTag(node[1].get('iden'), '#foo.bar')
-            self.eq(pack[1]['tags'].get('foo.bar'), (None, None))
-
-            pack = await proxy.setNodeProp(node[1].get('iden'), 'tick', '2015')
-            self.eq(pack[1]['props'].get('tick'), 1420070400000)
-
-            self.eq(1, await proxy.count('test:str#foo.bar'))
-            self.eq(1, await proxy.count('test:str:tick=2015'))
-
-            pack = await proxy.delNodeProp(node[1].get('iden'), 'tick')
-            self.none(pack[1]['props'].get('tick'))
-
-            iden = s_common.ehex(s_common.buid('newp'))
-            await self.asyncraises(s_exc.NoSuchIden, proxy.delNodeProp(iden, 'tick'))
-
-            await proxy.delNodeTag(node[1].get('iden'), '#foo.bar')
-            self.eq(0, await proxy.count('test:str#foo.bar'))
-
             opts = {'ndefs': [('inet:user', 'visi')]}
 
             msgs = await proxy.storm('', opts=opts).list()
@@ -3174,9 +3145,7 @@ class CortexBasicTest(s_t_utils.SynTest):
             ret = await proxy.getFeedFuncs()
             resp = {rec.get('name'): rec for rec in ret}
             self.isin('com.test.record', resp)
-            self.isin('syn.splice', resp)
             self.isin('syn.nodes', resp)
-            self.isin('syn.nodeedits', resp)
             rec = resp.get('syn.nodes')
             self.eq(rec.get('name'), 'syn.nodes')
             self.eq(rec.get('desc'), 'Add nodes to the Cortex via the packed node format.')
@@ -4452,46 +4421,6 @@ class CortexBasicTest(s_t_utils.SynTest):
 
             self.len(0, await core.nodes('test:cycle0=foo | delnode --force', opts=opts))
 
-    async def test_cortex_cell_splices(self):
-
-        async with self.getTestCore() as core:
-
-            async with core.getLocalProxy() as prox:
-                # TestModule creates one node and 3 splices
-                await self.agenlen(3, prox.splices((0, 0, 0), 1000))
-
-                await alist(prox.eval('[ test:str=foo ]'))
-
-                splicelist = await alist(prox.splices((0, 0, 0), 1000))
-                splicecount = len(splicelist)
-                self.ge(splicecount, 3)
-
-                # should get the same splices in reverse order
-                splicelist.reverse()
-                self.eq(await alist(prox.splicesBack(splicelist[0][0], 1000)), splicelist)
-                self.eq(await alist(prox.splicesBack(splicelist[0][0], 3)), splicelist[:3])
-
-                self.eq(await alist(prox.spliceHistory()), [s[1] for s in splicelist])
-
-                visi = await prox.addUser('visi')
-                await prox.setUserPasswd(visi['iden'], 'secret')
-
-                await prox.addUserRule(visi['iden'], (True, ('node', 'add')))
-                await prox.addUserRule(visi['iden'], (True, ('prop', 'set')))
-
-                async with core.getLocalProxy(user='visi') as asvisi:
-
-                    # normal user can't user splicesBack
-                    await self.agenraises(s_exc.AuthDeny, asvisi.splicesBack((1000, 0, 0), 1000))
-
-                    # make sure a normal user only gets their own splices
-                    await alist(asvisi.eval('[ test:str=bar ]'))
-                    await self.agenlen(2, asvisi.spliceHistory())
-
-                    # should get all splices now as an admin
-                    await prox.setUserAdmin(visi['iden'], True)
-                    await self.agenlen(splicecount + 2, asvisi.spliceHistory())
-
     async def test_node_repr(self):
 
         async with self.getTestCore() as core:
@@ -4590,12 +4519,13 @@ class CortexBasicTest(s_t_utils.SynTest):
             self.len(2, await core.nodes('test:str'))
 
             layr = core.getLayer()
-            await self.agenlen(0, layr.splices())
-            await self.agenlen(0, layr.splicesBack())
-            await self.agenlen(0, layr.syncNodeEdits(0))
-            self.eq(0, await layr.getEditIndx())
+            await self.agenlen(0, layr.syncNodeEdits(0, wait=False))
+            await self.agenlen(0, layr.syncNodeEdits2(0, wait=False))
+            # We can still generate synthetic edits though
+            ndedits = await alist(layr.iterLayerNodeEdits())
+            self.gt(len(ndedits), 0)
 
-            self.nn(await core.stat())
+            self.eq(0, await layr.getEditIndx())
 
     async def test_cortex_layer_settings(self):
         '''
@@ -4789,181 +4719,6 @@ class CortexBasicTest(s_t_utils.SynTest):
                 q = '[test:deprform=dform :deprprop=(1, 2)]'
                 await core1.nodes(q, opts={'view': view2_iden})
 
-    async def test_feed_syn_splice(self):
-
-        async with self.getTestCoreAndProxy() as (core, prox):
-
-            mesg = ('node:add', {'ndef': ('test:str', 'foo')})
-            await core.addFeedData('syn.splice', [mesg])
-
-            async with await core.snap() as snap:
-                node = await snap.getNodeByNdef(('test:str', 'foo'))
-                self.nn(node)
-
-            # test coreapi addFeedData
-            mesg = ('node:add', {'ndef': ('test:str', 'foobar')})
-            await prox.addFeedData('syn.splice', [mesg])
-
-            async with await core.snap() as snap:
-                node = await snap.getNodeByNdef(('test:str', 'foobar'))
-                self.nn(node)
-
-            mesg = ('prop:set', {'ndef': ('test:str', 'foo'), 'prop': 'tick', 'valu': 200})
-            await core.addFeedData('syn.splice', [mesg])
-
-            async with await core.snap() as snap:
-                node = await snap.getNodeByNdef(('test:str', 'foo'))
-                self.eq(200, node.get('tick'))
-
-            mesg = ('prop:del', {'ndef': ('test:str', 'foo'), 'prop': 'tick'})
-            await core.addFeedData('syn.splice', [mesg])
-
-            async with await core.snap() as snap:
-                node = await snap.getNodeByNdef(('test:str', 'foo'))
-                self.none(node.get('tick'))
-
-            mesg = ('tag:add', {'ndef': ('test:str', 'foo'), 'tag': 'bar', 'valu': (200, 300)})
-            await core.addFeedData('syn.splice', [mesg])
-
-            async with await core.snap() as snap:
-                node = await snap.getNodeByNdef(('test:str', 'foo'))
-                self.eq((200, 300), node.getTag('bar'))
-
-            mesg = ('tag:del', {'ndef': ('test:str', 'foo'), 'tag': 'bar'})
-            await core.addFeedData('syn.splice', [mesg])
-
-            async with await core.snap() as snap:
-                node = await snap.getNodeByNdef(('test:str', 'foo'))
-                self.none(node.getTag('bar'))
-
-            await core.addTagProp('score', ('int', {}), {})
-            splice = ('tag:prop:set', {'ndef': ('test:str', 'foo'), 'tag': 'lol', 'prop': 'score', 'valu': 100,
-                                       'curv': None})
-            await core.addFeedData('syn.splice', [splice])
-
-            self.len(1, await core.nodes('#lol:score=100'))
-
-            splice = ('tag:prop:del', {'ndef': ('test:str', 'foo'), 'tag': 'lol', 'prop': 'score', 'valu': 100})
-            await core.addFeedData('syn.splice', [splice])
-
-            self.len(0, await core.nodes('#lol:score=100'))
-
-            mesg = ('node:del', {'ndef': ('test:str', 'foo')})
-            await core.addFeedData('syn.splice', [mesg])
-
-            async with await core.snap() as snap:
-                node = await snap.getNodeByNdef(('test:str', 'foo'))
-                self.none(node)
-
-            # test feeding to a different view
-            vdef2 = await core.view.fork()
-            view2_iden = vdef2.get('iden')
-            view2 = core.getView(view2_iden)
-
-            mesg = ('node:add', {'ndef': ('test:str', 'bar')})
-            await core.addFeedData('syn.splice', [mesg], viewiden=view2_iden)
-
-            async with await core.snap(view=view2) as snap:
-                node = await snap.getNodeByNdef(('test:str', 'bar'))
-                self.nn(node)
-
-            async with await core.snap() as snap:
-                node = await snap.getNodeByNdef(('test:str', 'bar'))
-                self.none(node)
-
-            # test coreapi addFeedData to a different view
-            mesg = ('node:add', {'ndef': ('test:str', 'baz')})
-            await prox.addFeedData('syn.splice', [mesg], viewiden=view2_iden)
-
-            async with await core.snap(view=view2) as snap:
-                node = await snap.getNodeByNdef(('test:str', 'baz'))
-                self.nn(node)
-
-            async with await core.snap() as snap:
-                node = await snap.getNodeByNdef(('test:str', 'baz'))
-                self.none(node)
-
-            # sad paths
-            await self.asyncraises(s_exc.NoSuchView, core.addFeedData('syn.splice', [mesg], viewiden='badiden'))
-            await self.asyncraises(s_exc.NoSuchView, prox.addFeedData('syn.splice', [mesg], viewiden='badiden'))
-
-    async def test_feed_syn_nodeedits(self):
-
-        async with self.getTestCoreAndProxy() as (core0, prox0):
-
-            nodelist0 = []
-            nodelist0.extend(await core0.nodes('[ test:str=foo ]'))
-            nodelist0.extend(await core0.nodes('[ inet:ipv4=1.2.3.4 .seen=(2012,2014) +#foo.bar=(2012, 2014) ]'))
-            nodelist0.extend(await core0.nodes('[ test:int=42 ]'))
-            await core0.nodes('test:int=42 | delnode')
-
-            with self.raises(s_exc.NoSuchLayer):
-                async for _, nodeedits in prox0.syncLayerNodeEdits(0, layriden='asdf', wait=False):
-                    pass
-
-            with self.raises(s_exc.NoSuchLayer):
-                async for _, nodeedits in core0.syncLayerNodeEdits('asdf', 0, wait=False):
-                    pass
-
-            editlist = []
-            async for _, nodeedits in prox0.syncLayerNodeEdits(0, wait=False):
-                editlist.append(nodeedits)
-
-            deledit = editlist.pop(len(editlist) - 1)
-
-            async with self.getTestCoreAndProxy() as (core1, prox1):
-
-                await prox1.addFeedData('syn.nodeedits', editlist)
-
-                nodelist1 = []
-                nodelist1.extend(await core1.nodes('test:str'))
-                nodelist1.extend(await core1.nodes('inet:ipv4'))
-                nodelist1.extend(await core1.nodes('test:int'))
-
-                nodelist0 = [node.pack() for node in nodelist0]
-                nodelist1 = [node.pack() for node in nodelist1]
-                self.eq(nodelist0, nodelist1)
-
-                await core1.nodes('trigger.add node:del --form test:int --query {[test:int=7]}')
-
-                self.len(1, await core1.nodes('test:int=42'))
-
-                await prox1.addFeedData('syn.nodeedits', [deledit])
-
-                self.len(0, await core1.nodes('test:int=42'))
-                self.len(1, await core1.nodes('test:int=7'))
-
-                # Try a nodeedits we might get from cmdr
-                cmdrnodeedits = s_common.jsonsafe_nodeedits(editlist[1])
-                await core0.nodes('test:str=foo | delnode')
-
-                await prox1.addFeedData('syn.nodeedits', [cmdrnodeedits])
-                self.len(1, await core1.nodes('test:str'))
-
-    async def test_stat(self):
-
-        async with self.getTestCoreAndProxy() as (realcore, core):
-            coreiden = realcore.iden
-            ostat = await core.stat()
-            self.eq(ostat.get('iden'), coreiden)
-            self.isin('layer', ostat)
-            self.len(1, await realcore.nodes('[test:str=123 :tick=2018]'))
-            nstat = await core.stat()
-
-            counts = nstat.get('formcounts')
-            self.eq(counts.get('test:str'), 1)
-
-    async def test_stat_lock(self):
-        self.thisHostMust(hasmemlocking=True)
-        conf = {'layers:lockmemory': True}
-        async with self.getTestCoreAndProxy(conf=conf) as (realcore, core):
-            slab = realcore.view.layers[0].layrslab
-            self.true(await asyncio.wait_for(slab.lockdoneevent.wait(), 8))
-
-            nstat = await core.stat()
-            layr = nstat.get('layer')
-            self.gt(layr.get('lock_goal'), 0)
-
     async def test_storm_sub_query(self):
 
         async with self.getTestCore() as core:
@@ -5124,6 +4879,9 @@ class CortexBasicTest(s_t_utils.SynTest):
             self.nn(node.getTag('known'))
             self.none(node.getTag('unknown'))
 
+            q = '$valu={[test:str=foo]} switch $valu { foo: {test:str=foo return($node.value()) } }'
+            self.eq('foo', await core.callStorm(q))
+
     async def test_storm_tagvar(self):
 
         async with self.getTestCore() as core:
@@ -6663,35 +6421,6 @@ class CortexBasicTest(s_t_utils.SynTest):
             self.eq(view, core.getView(core.iden))
             self.none(core.getView('xxx'))
 
-    async def test_cortex_cronjob_perms(self):
-        async with self.getTestCore() as realcore:
-            async with realcore.getLocalProxy() as core:
-                fred = await core.addUser('fred')
-                await core.setUserPasswd(fred['iden'], 'secret')
-                cdef = {'storm': '[test:str=foo]', 'reqs': {'dayofmonth': 1},
-                        'incunit': None, 'incvals': None}
-                adef = await core.addCronJob(cdef)
-                iden = adef.get('iden')
-
-            async with realcore.getLocalProxy(user='fred') as core:
-                # Rando user can't make cron jobs
-                cdef = {'storm': '[test:int=1]', 'reqs': {'month': 1},
-                        'incunit': None, 'incvals': None}
-                await self.asyncraises(s_exc.AuthDeny, core.addCronJob(cdef))
-
-                # Rando user can't mod cron jobs
-                await self.asyncraises(s_exc.AuthDeny, core.updateCronJob(iden, '[test:str=bar]'))
-
-                # Rando user doesn't see any cron jobs
-                self.len(0, await core.listCronJobs())
-
-                # Rando user can't delete cron jobs
-                await self.asyncraises(s_exc.AuthDeny, core.delCronJob(iden))
-
-                # Rando user can't enable/disable cron jobs
-                await self.asyncraises(s_exc.AuthDeny, core.enableCronJob(iden))
-                await self.asyncraises(s_exc.AuthDeny, core.disableCronJob(iden))
-
     async def test_cortex_cron_deluser(self):
 
         async with self.getTestCore() as core:
@@ -6767,39 +6496,6 @@ class CortexBasicTest(s_t_utils.SynTest):
                 await self.asyncraises(s_exc.AuthDeny, prox.enableMigrationMode())
                 await self.asyncraises(s_exc.AuthDeny, prox.disableMigrationMode())
 
-    async def test_cortex_watch(self):
-
-        async with self.getTestCore() as core:
-
-            async with core.getLocalProxy() as prox:
-
-                async def nodes():
-                    await asyncio.sleep(0.1)    # due to telepath proxy causing task switch
-                    await core.nodes('[ test:int=10 +#foo.bar +#baz.faz ]')
-                    await core.nodes('test:int=10 [ -#foo.bar -#baz.faz ]')
-
-                task = core.schedCoro(nodes())
-
-                data = []
-                async for mesg in prox.watch({'tags': ['foo.bar', 'baz.*']}):
-                    data.append(mesg)
-                    if len(data) == 4:
-                        break
-
-                await asyncio.wait_for(task, timeout=1)
-
-                self.eq(data[0][0], 'tag:add')
-                self.eq(data[0][1]['tag'], 'foo.bar')
-
-                self.eq(data[1][0], 'tag:add')
-                self.eq(data[1][1]['tag'], 'baz.faz')
-
-                self.eq(data[2][0], 'tag:del')
-                self.eq(data[2][1]['tag'], 'foo.bar')
-
-                self.eq(data[3][0], 'tag:del')
-                self.eq(data[3][1]['tag'], 'baz.faz')
-
     async def test_cortex_behold(self):
         async with self.getTestCore() as core:
             async with core.getLocalProxy() as prox: