From: Eric Leblond Date: Wed, 2 Oct 2024 19:54:47 +0000 (+0200) Subject: tests: add initial datajson test X-Git-Tag: suricata-7.0.11~33 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=29d3e5abd746e2000d7bf35780b7dc95ed96b3b1;p=thirdparty%2Fsuricata-verify.git tests: add initial datajson test --- diff --git a/tests/datajson/datajson-01-ip/input.pcap b/tests/datajson/datajson-01-ip/input.pcap new file mode 100644 index 000000000..8fb6832de Binary files /dev/null and b/tests/datajson/datajson-01-ip/input.pcap differ diff --git a/tests/datajson/datajson-01-ip/src.lst b/tests/datajson/datajson-01-ip/src.lst new file mode 100644 index 000000000..f44ad188c --- /dev/null +++ b/tests/datajson/datajson-01-ip/src.lst @@ -0,0 +1 @@ +10.16.1.11,{"test": "success","context":3} diff --git a/tests/datajson/datajson-01-ip/test.rules b/tests/datajson/datajson-01-ip/test.rules new file mode 100644 index 000000000..6a94208f4 --- /dev/null +++ b/tests/datajson/datajson-01-ip/test.rules @@ -0,0 +1 @@ +alert http any any -> any any (flow:established,to_server; http.host; content:"testmyids.com"; ip.src; datajson:isset,src_ip,type ip,load src.lst,key src_ip; sid:1;) diff --git a/tests/datajson/datajson-01-ip/test.yaml b/tests/datajson/datajson-01-ip/test.yaml new file mode 100644 index 000000000..6dc740286 --- /dev/null +++ b/tests/datajson/datajson-01-ip/test.yaml @@ -0,0 +1,20 @@ +requires: + features: + - HAVE_LIBJANSSON + files: + - src/datasets.c + +args: + - -k none --set datasets.enabled=yes + +checks: + - filter: + count: 1 + match: + event_type: alert + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + alert.extra.src_ip.test: success