new filter checks: has-key not has-key

Match on the event having or not having a key.

diff --git a/README.md b/README.md
index 5a0a89dda705f1d449a9df1e9644e294eea15318..9fb17bc839178b6c2a6901a3eb04e0138dc84a72 100644 (file)
--- a/README.md
+++ b/README.md
@@ -76,3 +76,26 @@ command: |
 # Execute Suricata with the test parameters this many times. All checks will
 # done after each iteration.
 count: 10
+
+checks:
+
+  # A verification filter that is run over the eve.json. Multiple
+  # filters may exist and all must pass for the test to pass.
+  - filter:
+      # The number of records this filter should match.
+         count: 1
+         
+         # The fields to match on.
+         match:
+           # Example match on event_type:
+               event_type: alert
+               
+               # Example match on array item:
+               alert.metadata.tag[0]: "tag1"
+               
+               # Check that a field exists:
+               has-key: alert.rule
+               
+               # Check that a field does not exist:
+               not-has-key: flow
+```            

diff --git a/run.py b/run.py
index 018c464b762970269cbe6b004a66e8f894385c57..3a23b90f54cad2dc83bc06440cf1c27c47d6d97b 100755 (executable)
--- a/run.py
+++ b/run.py
@@ -201,12 +201,19 @@ class FilterCheck:
             self.config["count"], count, str(self.config)))
 
     def match(self, event):
-        for field in self.config["match"]:
-            val = find_value(field, event)
-            if val is None:
-                return False
-            if val != self.config["match"][field]:
-                return False
+        for key, expected in self.config["match"].items():
+            if key == "has-key":
+                val = find_value(expected, event)
+                if val is None:
+                    return False
+            elif key == "not-has-key":
+                val = find_value(expected, event)
+                if val is not None:
+                    return False
+            else:
+                val = find_value(key, event)
+                if val != expected:
+                    return False
         return True
 
 class TestRunner: