tests: add global by_flow thresholding tests

diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/README.md b/tests/threshold/threshold-config-rate-filter-alert-flow/README.md
new file mode 100644 (file)
index 0000000..ff3dec0
--- /dev/null
+++ b/tests/threshold/threshold-config-rate-filter-alert-flow/README.md
@@ -0,0 +1,5 @@
+# Threshold.config with by_flow
+
+This test checks threshold.config file using by_flow tracking
+
+The pcap file is from http-all-headers test

diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/input.rules b/tests/threshold/threshold-config-rate-filter-alert-flow/input.rules
new file mode 100644 (file)
index 0000000..7cb862d
--- /dev/null
+++ b/tests/threshold/threshold-config-rate-filter-alert-flow/input.rules
@@ -0,0 +1 @@
+drop tcp any any -> any any (dsize:0; sid: 1000001;)

diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/suricata.yaml b/tests/threshold/threshold-config-rate-filter-alert-flow/suricata.yaml
new file mode 100644 (file)
index 0000000..ee5c3f0
--- /dev/null
+++ b/tests/threshold/threshold-config-rate-filter-alert-flow/suricata.yaml
@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - alert
+        - drop:
+            flows: all
+            alerts: true
+        - http
+        - anomaly

diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/test.yaml b/tests/threshold/threshold-config-rate-filter-alert-flow/test.yaml
new file mode 100644 (file)
index 0000000..7f23097
--- /dev/null
+++ b/tests/threshold/threshold-config-rate-filter-alert-flow/test.yaml
@@ -0,0 +1,30 @@
+pcap: ../../http-all-headers/input.pcap
+
+requires:
+  min-version: 8
+
+args:
+- --set threshold-file=${TEST_DIR}/threshold.config
+- --simulate-ips
+
+checks:
+  - filter:
+      count: 3
+      match:
+        event_type: alert
+        alert.signature_id: 1000001
+        alert.action: blocked
+  - filter:
+      count: 16
+      match:
+        event_type: alert
+        alert.signature_id: 1000001
+        alert.action: allowed
+  - filter:
+      count: 3
+      match:
+        event_type: drop
+  - filter:
+      count: 1
+      match:
+        event_type: http

diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/threshold.config b/tests/threshold/threshold-config-rate-filter-alert-flow/threshold.config
new file mode 100644 (file)
index 0000000..ae0ebef
--- /dev/null
+++ b/tests/threshold/threshold-config-rate-filter-alert-flow/threshold.config
@@ -0,0 +1 @@
+rate_filter gen_id 1, sig_id 1000001, track by_flow, count 3, seconds 60, new_action alert, timeout 1000

diff --git a/tests/threshold/threshold-config-threshold-both-flow/README.md b/tests/threshold/threshold-config-threshold-both-flow/README.md
new file mode 100644 (file)
index 0000000..432a2eb
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-both-flow/README.md
@@ -0,0 +1,5 @@
+# Threshold.config with by_flow
+
+This test checks threshold.config file using by_flow keyword
+
+The pcap file is from http-all-headers test

diff --git a/tests/threshold/threshold-config-threshold-both-flow/input.rules b/tests/threshold/threshold-config-threshold-both-flow/input.rules
new file mode 100644 (file)
index 0000000..9ace89c
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-both-flow/input.rules
@@ -0,0 +1 @@
+alert tcp any any -> any any (dsize:0; sid: 1000001;)

diff --git a/tests/threshold/threshold-config-threshold-both-flow/suricata.yaml b/tests/threshold/threshold-config-threshold-both-flow/suricata.yaml
new file mode 100644 (file)
index 0000000..ee5c3f0
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-both-flow/suricata.yaml
@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - alert
+        - drop:
+            flows: all
+            alerts: true
+        - http
+        - anomaly

diff --git a/tests/threshold/threshold-config-threshold-both-flow/test.yaml b/tests/threshold/threshold-config-threshold-both-flow/test.yaml
new file mode 100644 (file)
index 0000000..a9413ef
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-both-flow/test.yaml
@@ -0,0 +1,19 @@
+pcap: ../../http-all-headers/input.pcap
+
+requires:
+  min-version: 8
+
+args:
+- --set threshold-file=${TEST_DIR}/threshold.config
+- --simulate-ips
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1000001
+  - filter:
+      count: 1
+      match:
+        event_type: http

diff --git a/tests/threshold/threshold-config-threshold-both-flow/threshold.config b/tests/threshold/threshold-config-threshold-both-flow/threshold.config
new file mode 100644 (file)
index 0000000..2c50d64
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-both-flow/threshold.config
@@ -0,0 +1 @@
+threshold gen_id 1, sig_id 1000001, type both, track by_flow, count 5, seconds 60

diff --git a/tests/threshold/threshold-config-threshold-limit-flow/README.md b/tests/threshold/threshold-config-threshold-limit-flow/README.md
new file mode 100644 (file)
index 0000000..432a2eb
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-limit-flow/README.md
@@ -0,0 +1,5 @@
+# Threshold.config with by_flow
+
+This test checks threshold.config file using by_flow keyword
+
+The pcap file is from http-all-headers test

diff --git a/tests/threshold/threshold-config-threshold-limit-flow/input.rules b/tests/threshold/threshold-config-threshold-limit-flow/input.rules
new file mode 100644 (file)
index 0000000..9ace89c
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-limit-flow/input.rules
@@ -0,0 +1 @@
+alert tcp any any -> any any (dsize:0; sid: 1000001;)

diff --git a/tests/threshold/threshold-config-threshold-limit-flow/suricata.yaml b/tests/threshold/threshold-config-threshold-limit-flow/suricata.yaml
new file mode 100644 (file)
index 0000000..ee5c3f0
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-limit-flow/suricata.yaml
@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - alert
+        - drop:
+            flows: all
+            alerts: true
+        - http
+        - anomaly

diff --git a/tests/threshold/threshold-config-threshold-limit-flow/test.yaml b/tests/threshold/threshold-config-threshold-limit-flow/test.yaml
new file mode 100644 (file)
index 0000000..a9413ef
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-limit-flow/test.yaml
@@ -0,0 +1,19 @@
+pcap: ../../http-all-headers/input.pcap
+
+requires:
+  min-version: 8
+
+args:
+- --set threshold-file=${TEST_DIR}/threshold.config
+- --simulate-ips
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1000001
+  - filter:
+      count: 1
+      match:
+        event_type: http

diff --git a/tests/threshold/threshold-config-threshold-limit-flow/threshold.config b/tests/threshold/threshold-config-threshold-limit-flow/threshold.config
new file mode 100644 (file)
index 0000000..8ef60ce
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-limit-flow/threshold.config
@@ -0,0 +1 @@
+threshold gen_id 1, sig_id 1000001, type limit, track by_flow, count 1, seconds 60

diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/README.md b/tests/threshold/threshold-config-threshold-threshold-flow/README.md
new file mode 100644 (file)
index 0000000..432a2eb
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-threshold-flow/README.md
@@ -0,0 +1,5 @@
+# Threshold.config with by_flow
+
+This test checks threshold.config file using by_flow keyword
+
+The pcap file is from http-all-headers test

diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/input.rules b/tests/threshold/threshold-config-threshold-threshold-flow/input.rules
new file mode 100644 (file)
index 0000000..9ace89c
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-threshold-flow/input.rules
@@ -0,0 +1 @@
+alert tcp any any -> any any (dsize:0; sid: 1000001;)

diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/suricata.yaml b/tests/threshold/threshold-config-threshold-threshold-flow/suricata.yaml
new file mode 100644 (file)
index 0000000..ee5c3f0
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-threshold-flow/suricata.yaml
@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular
+      filename: eve.json
+      types:
+        - alert
+        - drop:
+            flows: all
+            alerts: true
+        - http
+        - anomaly

diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/test.yaml b/tests/threshold/threshold-config-threshold-threshold-flow/test.yaml
new file mode 100644 (file)
index 0000000..4e7b4d8
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-threshold-flow/test.yaml
@@ -0,0 +1,19 @@
+pcap: ../../http-all-headers/input.pcap
+
+requires:
+  min-version: 8
+
+args:
+- --set threshold-file=${TEST_DIR}/threshold.config
+- --simulate-ips
+
+checks:
+  - filter:
+      count: 3
+      match:
+        event_type: alert
+        alert.signature_id: 1000001
+  - filter:
+      count: 1
+      match:
+        event_type: http

diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/threshold.config b/tests/threshold/threshold-config-threshold-threshold-flow/threshold.config
new file mode 100644 (file)
index 0000000..0b08a57
--- /dev/null
+++ b/tests/threshold/threshold-config-threshold-threshold-flow/threshold.config
@@ -0,0 +1 @@
+threshold gen_id 1, sig_id 1000001, type threshold, track by_flow, count 5, seconds 60