From: Alice Akaki <akakialice@gmail.com>
Date: Thu, 6 Feb 2025 01:54:44 +0000 (-0400)
Subject: detect: add test for ldap.responses.dn keyword
X-Git-Tag: suricata-7.0.9~33
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=26b0017ddc9480bd5aa98a720333e70f1914cddc;p=thirdparty%2Fsuricata-verify.git

detect: add test for ldap.responses.dn keyword

Ticket: #7471
---

diff --git a/tests/detect-ldap-dn/README.md b/tests/detect-ldap-dn/README.md
index 127a77ed6..a9e176324 100644
--- a/tests/detect-ldap-dn/README.md
+++ b/tests/detect-ldap-dn/README.md
@@ -1,4 +1,5 @@
-Test ldap.request.dn keyword.
+Test ldap.request.dn and
+ldap.responses.dn keywords.
 
 PCAP from ../ldap-search/ldap.pcap
 
diff --git a/tests/detect-ldap-dn/test.rules b/tests/detect-ldap-dn/test.rules
index 5554354fd..056c5b58a 100644
--- a/tests/detect-ldap-dn/test.rules
+++ b/tests/detect-ldap-dn/test.rules
@@ -1 +1,2 @@
 alert ldap any any -> any any (msg:"Test ldap request dn"; ldap.request.dn; content:"dc=example,dc=com"; startswith; endswith; sid:1;)
+alert ldap any any -> any any (msg:"Test ldap responses dn"; ldap.responses.dn; content:"dc=example,dc=com"; startswith; endswith; sid:2;)
\ No newline at end of file
diff --git a/tests/detect-ldap-dn/test.yaml b/tests/detect-ldap-dn/test.yaml
index c649f474b..8bddd264a 100644
--- a/tests/detect-ldap-dn/test.yaml
+++ b/tests/detect-ldap-dn/test.yaml
@@ -15,3 +15,11 @@ checks:
         ldap.request.operation: search_request
         ldap.request.search_request.base_object: dc=example,dc=com
         alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        pcap_cnt: 6
+        ldap.responses[0].operation: search_result_entry
+        ldap.responses[0].search_result_entry.base_object: dc=example,dc=com
+        alert.signature_id: 2