From: Eric Leblond Date: Fri, 20 Dec 2024 21:50:41 +0000 (+0100) Subject: tests: add json datajson X-Git-Tag: suricata-7.0.11~23 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=14745f168a11213dde5e599aed3e24e6acced223;p=thirdparty%2Fsuricata-verify.git tests: add json datajson --- diff --git a/tests/datajson/datajson-09-jsonformat/hosts-direct.json b/tests/datajson/datajson-09-jsonformat/hosts-direct.json new file mode 100644 index 000000000..c3ef34c9d --- /dev/null +++ b/tests/datajson/datajson-09-jsonformat/hosts-direct.json @@ -0,0 +1 @@ +[ {"context":"gold old test", "year": 2005, "host": "www.testmyids.com"} ] diff --git a/tests/datajson/datajson-09-jsonformat/hosts-nested.json b/tests/datajson/datajson-09-jsonformat/hosts-nested.json new file mode 100644 index 000000000..7106dcab0 --- /dev/null +++ b/tests/datajson/datajson-09-jsonformat/hosts-nested.json @@ -0,0 +1 @@ +{ "info": {"threat": [ {"context":"gold old test", "year": 2005, "host": "www.testmyids.com"} ] } } diff --git a/tests/datajson/datajson-09-jsonformat/hosts.json b/tests/datajson/datajson-09-jsonformat/hosts.json new file mode 100644 index 000000000..c7761c184 --- /dev/null +++ b/tests/datajson/datajson-09-jsonformat/hosts.json @@ -0,0 +1 @@ +{"threat": [ {"context":"gold old test", "year": 2005, "host": "www.testmyids.com"} ] } diff --git a/tests/datajson/datajson-09-jsonformat/input.pcap b/tests/datajson/datajson-09-jsonformat/input.pcap new file mode 100644 index 000000000..8fb6832de Binary files /dev/null and b/tests/datajson/datajson-09-jsonformat/input.pcap differ diff --git a/tests/datajson/datajson-09-jsonformat/src.json b/tests/datajson/datajson-09-jsonformat/src.json new file mode 100644 index 000000000..21b598ed3 --- /dev/null +++ b/tests/datajson/datajson-09-jsonformat/src.json @@ -0,0 +1,3 @@ +[ + {"ip": "10.16.1.11", "test": "success","context":3} +] diff --git a/tests/datajson/datajson-09-jsonformat/test.rules b/tests/datajson/datajson-09-jsonformat/test.rules new file mode 100644 index 000000000..c22e29164 --- /dev/null +++ b/tests/datajson/datajson-09-jsonformat/test.rules @@ -0,0 +1,6 @@ +alert http any any -> any any (flow:established,to_server; http.host; datajson:isset,badhost,type string,load hosts.json,key bad_host,json_key host, array_key threat; ip.src; datajson:isset,src_ip,type ip,load src.json,key src_ip,json_key ip; sid:1;) + +alert http any any -> any any (flow:established,to_server; http.host; datajson:isset,dbadhost,type string,load hosts-direct.json,key dbad_host,json_key host; ip.src; datajson:isset,src_ip,type ip,load src.json,key src_ip,json_key ip; sid:2;) + + +alert http any any -> any any (flow:established,to_server; http.host; datajson:isset,nbadhost,type string,load hosts-nested.json,key nbad_host,json_key host, array_key info.threat; ip.src; datajson:isset,src_ip,type ip,load src.json,key src_ip,json_key ip; sid:3;) diff --git a/tests/datajson/datajson-09-jsonformat/test.yaml b/tests/datajson/datajson-09-jsonformat/test.yaml new file mode 100644 index 000000000..6e95693a5 --- /dev/null +++ b/tests/datajson/datajson-09-jsonformat/test.yaml @@ -0,0 +1,35 @@ +requires: + features: + - HAVE_LIBJANSSON + files: + - src/datasets.c + +args: + - -k none --set datasets.enabled=yes + +checks: + - filter: + count: 3 + match: + event_type: alert + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + alert.extra.src_ip.test: success + alert.extra.bad_host.year: 2005 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2 + alert.extra.src_ip.test: success + alert.extra.dbad_host.year: 2005 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 3 + alert.extra.src_ip.test: success + alert.extra.nbad_host.year: 2005