test: dataset state isnotset test

The idea with this test is to alert on the first time something
is seen in a state type dataset.

diff --git a/tests/datasets-state-isnotset/README.md b/tests/datasets-state-isnotset/README.md
new file mode 100644 (file)
index 0000000..4a9c616
--- /dev/null
+++ b/tests/datasets-state-isnotset/README.md
@@ -0,0 +1,3 @@
+Test dataset isnotseen for state. The idea is to check the first occurrence of
+something happening. Then once recorded in the state, isnotset should not
+match.

diff --git a/tests/datasets-state-isnotset/test.rules b/tests/datasets-state-isnotset/test.rules
new file mode 100644 (file)
index 0000000..95f94a4
--- /dev/null
+++ b/tests/datasets-state-isnotset/test.rules
@@ -0,0 +1,4 @@
+alert dns any any -> any any (dns.query; to_md5; \
+       dataset:isnotset, dns-seen.md5, type md5, state dns-seen.md5; \
+       dataset:set, dns-seen.md5; \
+       sid:1; rev:1;)

diff --git a/tests/datasets-state-isnotset/test.yaml b/tests/datasets-state-isnotset/test.yaml
new file mode 100644 (file)
index 0000000..ea1bf19
--- /dev/null
+++ b/tests/datasets-state-isnotset/test.yaml
@@ -0,0 +1,13 @@
+requires:
+  min-version: 5.0.0
+
+pcap: ../datasets-05-state/input.pcap
+
+args:
+  - --data-dir ./output
+
+checks:
+  - filter:
+      count: 1
+      match:
+        alert.signature_id: 1