From 99122bf242922d454edbcc1e35298c5545be3609 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Fri, 5 May 2023 15:12:16 -0600 Subject: [PATCH] alert-testmyids: add target to rule Choose a simple test to add the target keyword to as no other tests do this. This will excercise the "source" and "target" fields in the JSON schema. --- tests/alert-testmyids/test.rules | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/alert-testmyids/test.rules b/tests/alert-testmyids/test.rules index 9f1307bdb..8eb5f0267 100644 --- a/tests/alert-testmyids/test.rules +++ b/tests/alert-testmyids/test.rules @@ -1 +1 @@ -alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; classtype:bad-unknown; sid:2100498; rev:7;) +alert ip any any -> any any (msg:"GPL ATTACK_RESPONSE id check returned root"; content:"uid=0|28|root|29|"; target:dest_ip; classtype:bad-unknown; sid:2100498; rev:7;) -- 2.47.2