ssh-banner-only: update test.yaml checks

Added filter for rule sid 3 which had none
Uncommented rule sid 2

diff --git a/tests/ssh-banner-only/test.rules b/tests/ssh-banner-only/test.rules
index 7638fded03d5b9e4a94436ebde0727a110c81b03..dfeade1e4b5307e6fff4f08a89328167e20b4927 100644 (file)
--- a/tests/ssh-banner-only/test.rules
+++ b/tests/ssh-banner-only/test.rules
@@ -1,4 +1,4 @@
 alert ssh any any -> any any (ssh.software; content:"OpenSSH"; sid:1;)
-# broken?
-#alert ssh any any -> any any (ssh.softwareversion:OpenSSH_7.4; sid:2;)
+# ssh.softwareversion is deprecated in favor of ssh.software this is just to check if it still works
+alert ssh any any -> any any (ssh.softwareversion:OpenSSH_7.4; sid:2;)
 alert ssh any any -> any any (ssh.proto; content:"2"; sid:3;)

diff --git a/tests/ssh-banner-only/test.yaml b/tests/ssh-banner-only/test.yaml
index 04f1a60580f0b982b5f4a23cfaef3ef271c44060..02e82d20ca7783a0376cdb118a7a8ff0b7fe27a7 100644 (file)
--- a/tests/ssh-banner-only/test.yaml
+++ b/tests/ssh-banner-only/test.yaml
@@ -19,3 +19,13 @@ checks:
       match:
         event_type: alert
         alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
+  - filter:
+      count: 2
+      match:
+        event_type: alert
+        alert.signature_id: 3