From c827ac3b502530b2f14866e918910ccb96c254b9 Mon Sep 17 00:00:00 2001 From: Philippe Antoine Date: Thu, 3 Apr 2025 15:33:57 +0200 Subject: [PATCH] output: add test for suricata version in eve Ticket: 4853 --- tests/eve-suricata-version/README.md | 11 ++++ tests/eve-suricata-version/suricata.yaml | 15 ++++++ tests/eve-suricata-version/test.yaml | 67 ++++++++++++++++++++++++ 3 files changed, 93 insertions(+) create mode 100644 tests/eve-suricata-version/README.md create mode 100644 tests/eve-suricata-version/suricata.yaml create mode 100644 tests/eve-suricata-version/test.yaml diff --git a/tests/eve-suricata-version/README.md b/tests/eve-suricata-version/README.md new file mode 100644 index 000000000..78c913a9a --- /dev/null +++ b/tests/eve-suricata-version/README.md @@ -0,0 +1,11 @@ +# Test Description + +Test eve output with suricata version + +## PCAP + +Reused from ethernet-eve test + +## Redmine Ticket + +https://redmine.openinfosecfoundation.org/issues/4853 diff --git a/tests/eve-suricata-version/suricata.yaml b/tests/eve-suricata-version/suricata.yaml new file mode 100644 index 000000000..53e52d7dc --- /dev/null +++ b/tests/eve-suricata-version/suricata.yaml @@ -0,0 +1,15 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + suricata-version: yes + types: + - alert + - dns + - flow + - netflow + - tls + - http + - files diff --git a/tests/eve-suricata-version/test.yaml b/tests/eve-suricata-version/test.yaml new file mode 100644 index 000000000..8a782d303 --- /dev/null +++ b/tests/eve-suricata-version/test.yaml @@ -0,0 +1,67 @@ +requires: + min-version: 8 + +pcap: ../ethernet-eve/test.pcap + +args: + - -k none + +checks: + - filter: + count: 5 + match: + event_type: dns + src_ip: 10.16.1.11 + has-key: suricata_version + dns.type: request + - filter: + count: 5 + match: + event_type: dns + src_ip: 10.16.1.11 + has-key: suricata_version + dns.type: response + - filter: + count: 5 + match: + event_type: flow + src_ip: 10.16.1.11 + has-key: suricata_version + - filter: + count: 5 + match: + event_type: netflow + src_ip: 10.16.1.11 + has-key: suricata_version + - filter: + count: 5 + match: + event_type: netflow + dest_ip: 10.16.1.11 + has-key: suricata_version + - filter: + count: 4 + match: + event_type: tls + src_ip: 192.168.56.1 + has-key: suricata_version + - filter: + count: 5 + match: + event_type: flow + app_proto: tls + src_ip: 192.168.56.1 + has-key: suricata_version + - filter: + count: 1 + match: + event_type: http + src_ip: 192.168.118.10 + has-key: suricata_version + - filter: + count: 1 + match: + event_type: fileinfo + dest_ip: 192.168.118.10 + has-key: suricata_version + -- 2.47.2