From 974b5d6b00920f560285b59227797724f247baa9 Mon Sep 17 00:00:00 2001
From: Eric Leblond <el@stamus-networks.com>
Date: Sun, 22 Dec 2024 10:34:21 +0100
Subject: [PATCH] tests: test new json format option

---
 .../hosts-nested-key.json                     | 21 +++++++++++++++++++
 .../datajson-09-jsonformat/test.rules         |  3 ++-
 .../datajson/datajson-09-jsonformat/test.yaml | 10 ++++++++-
 3 files changed, 32 insertions(+), 2 deletions(-)
 create mode 100644 tests/datajson/datajson-09-jsonformat/hosts-nested-key.json

diff --git a/tests/datajson/datajson-09-jsonformat/hosts-nested-key.json b/tests/datajson/datajson-09-jsonformat/hosts-nested-key.json
new file mode 100644
index 000000000..df490606c
--- /dev/null
+++ b/tests/datajson/datajson-09-jsonformat/hosts-nested-key.json
@@ -0,0 +1,21 @@
+{
+  "info": {
+    "threat": [
+      {
+        "context": "gold old test",
+        "year": 2005,
+        "host": {
+          "fqdn": "www.testmyids.com",
+          "domain": "testmyids.com"
+        }
+      },
+      {
+        "context": "old test",
+        "year": 2023,
+        "host": {
+          "domain": "testmyids.com"
+        }
+      }
+    ]
+  }
+}
diff --git a/tests/datajson/datajson-09-jsonformat/test.rules b/tests/datajson/datajson-09-jsonformat/test.rules
index c22e29164..4caa80a70 100644
--- a/tests/datajson/datajson-09-jsonformat/test.rules
+++ b/tests/datajson/datajson-09-jsonformat/test.rules
@@ -2,5 +2,6 @@ alert http any any -> any any (flow:established,to_server; http.host; datajson:i
 
 alert http any any -> any any (flow:established,to_server; http.host; datajson:isset,dbadhost,type string,load hosts-direct.json,key dbad_host,json_key host; ip.src; datajson:isset,src_ip,type ip,load src.json,key src_ip,json_key ip; sid:2;)
 
-
 alert http any any -> any any (flow:established,to_server; http.host; datajson:isset,nbadhost,type string,load hosts-nested.json,key nbad_host,json_key host, array_key info.threat; ip.src; datajson:isset,src_ip,type ip,load src.json,key src_ip,json_key ip; sid:3;)
+
+alert http any any -> any any (flow:established,to_server; http.host; datajson:isset,nkbadhost,type string,load hosts-nested-key.json,key nkbad_host,json_key host.fqdn, array_key info.threat; ip.src; datajson:isset,src_ip,type ip,load src.json,key src_ip,json_key ip; sid:4;)
diff --git a/tests/datajson/datajson-09-jsonformat/test.yaml b/tests/datajson/datajson-09-jsonformat/test.yaml
index 6e95693a5..669934fa2 100644
--- a/tests/datajson/datajson-09-jsonformat/test.yaml
+++ b/tests/datajson/datajson-09-jsonformat/test.yaml
@@ -9,7 +9,7 @@ args:
 
 checks:
   - filter:
-      count: 3
+      count: 4
       match:
         event_type: alert
   - filter:
@@ -33,3 +33,11 @@ checks:
         alert.signature_id: 3
         alert.extra.src_ip.test: success
         alert.extra.nbad_host.year: 2005
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 4
+        alert.extra.src_ip.test: success
+        alert.extra.nkbad_host.year: 2005
+        alert.extra.nkbad_host.host.domain: testmyids.com
-- 
2.47.3