From: Jason Ish Date: Thu, 3 Oct 2019 22:34:16 +0000 (-0600) Subject: test: dataset state isnotset test X-Git-Tag: suricata-6.0.4~381 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F135%2Fhead;p=thirdparty%2Fsuricata-verify.git test: dataset state isnotset test The idea with this test is to alert on the first time something is seen in a state type dataset. --- diff --git a/tests/datasets-state-isnotset/README.md b/tests/datasets-state-isnotset/README.md new file mode 100644 index 000000000..4a9c61625 --- /dev/null +++ b/tests/datasets-state-isnotset/README.md @@ -0,0 +1,3 @@ +Test dataset isnotseen for state. The idea is to check the first occurrence of +something happening. Then once recorded in the state, isnotset should not +match. diff --git a/tests/datasets-state-isnotset/test.rules b/tests/datasets-state-isnotset/test.rules new file mode 100644 index 000000000..95f94a4cb --- /dev/null +++ b/tests/datasets-state-isnotset/test.rules @@ -0,0 +1,4 @@ +alert dns any any -> any any (dns.query; to_md5; \ + dataset:isnotset, dns-seen.md5, type md5, state dns-seen.md5; \ + dataset:set, dns-seen.md5; \ + sid:1; rev:1;) diff --git a/tests/datasets-state-isnotset/test.yaml b/tests/datasets-state-isnotset/test.yaml new file mode 100644 index 000000000..ea1bf192a --- /dev/null +++ b/tests/datasets-state-isnotset/test.yaml @@ -0,0 +1,13 @@ +requires: + min-version: 5.0.0 + +pcap: ../datasets-05-state/input.pcap + +args: + - --data-dir ./output + +checks: + - filter: + count: 1 + match: + alert.signature_id: 1