tests: test new json format option

diff --git a/tests/datajson/datajson-09-jsonformat/hosts-nested-key.json b/tests/datajson/datajson-09-jsonformat/hosts-nested-key.json
new file mode 100644 (file)
index 0000000..df49060
--- /dev/null
+++ b/tests/datajson/datajson-09-jsonformat/hosts-nested-key.json
@@ -0,0 +1,21 @@
+{
+  "info": {
+    "threat": [
+      {
+        "context": "gold old test",
+        "year": 2005,
+        "host": {
+          "fqdn": "www.testmyids.com",
+          "domain": "testmyids.com"
+        }
+      },
+      {
+        "context": "old test",
+        "year": 2023,
+        "host": {
+          "domain": "testmyids.com"
+        }
+      }
+    ]
+  }
+}

diff --git a/tests/datajson/datajson-09-jsonformat/test.rules b/tests/datajson/datajson-09-jsonformat/test.rules
index c22e2916457518928a035d3a14f66459e197e264..4caa80a70bd96275906f4afaf6eada39a5c9e41b 100644 (file)
--- a/tests/datajson/datajson-09-jsonformat/test.rules
+++ b/tests/datajson/datajson-09-jsonformat/test.rules
@@ -2,5 +2,6 @@ alert http any any -> any any (flow:established,to_server; http.host; datajson:i
 
 alert http any any -> any any (flow:established,to_server; http.host; datajson:isset,dbadhost,type string,load hosts-direct.json,key dbad_host,json_key host; ip.src; datajson:isset,src_ip,type ip,load src.json,key src_ip,json_key ip; sid:2;)
 
-
 alert http any any -> any any (flow:established,to_server; http.host; datajson:isset,nbadhost,type string,load hosts-nested.json,key nbad_host,json_key host, array_key info.threat; ip.src; datajson:isset,src_ip,type ip,load src.json,key src_ip,json_key ip; sid:3;)
+
+alert http any any -> any any (flow:established,to_server; http.host; datajson:isset,nkbadhost,type string,load hosts-nested-key.json,key nkbad_host,json_key host.fqdn, array_key info.threat; ip.src; datajson:isset,src_ip,type ip,load src.json,key src_ip,json_key ip; sid:4;)

diff --git a/tests/datajson/datajson-09-jsonformat/test.yaml b/tests/datajson/datajson-09-jsonformat/test.yaml
index 6e95693a58accb5d975240edfb6a4ab8ec3cd409..669934fa20e25f3ceb9766d4c9e2f6589e5d49d3 100644 (file)
--- a/tests/datajson/datajson-09-jsonformat/test.yaml
+++ b/tests/datajson/datajson-09-jsonformat/test.yaml
@@ -9,7 +9,7 @@ args:
 
 checks:
   - filter:
-      count: 3
+      count: 4
       match:
         event_type: alert
   - filter:
@@ -33,3 +33,11 @@ checks:
         alert.signature_id: 3
         alert.extra.src_ip.test: success
         alert.extra.nbad_host.year: 2005
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 4
+        alert.extra.src_ip.test: success
+        alert.extra.nkbad_host.year: 2005
+        alert.extra.nkbad_host.host.domain: testmyids.com