From 969708a4888410e7afb2e0b9c149c03dfcac02be Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 13 Mar 2024 11:06:02 +0100 Subject: [PATCH] tests: add detection_filter tests for by_flow and by_src --- .../detection_filter-rule-flow/test.rules | 6 ++++ .../detection_filter-rule-flow/test.yaml | 36 +++++++++++++++++++ .../detection_filter-rule-hostsrc/test.rules | 6 ++++ .../detection_filter-rule-hostsrc/test.yaml | 36 +++++++++++++++++++ 4 files changed, 84 insertions(+) create mode 100644 tests/threshold/detection_filter-rule-flow/test.rules create mode 100644 tests/threshold/detection_filter-rule-flow/test.yaml create mode 100644 tests/threshold/detection_filter-rule-hostsrc/test.rules create mode 100644 tests/threshold/detection_filter-rule-hostsrc/test.yaml diff --git a/tests/threshold/detection_filter-rule-flow/test.rules b/tests/threshold/detection_filter-rule-flow/test.rules new file mode 100644 index 000000000..2409f9cf1 --- /dev/null +++ b/tests/threshold/detection_filter-rule-flow/test.rules @@ -0,0 +1,6 @@ +alert icmp any any -> any any (itype:8; sid:1;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 1, seconds 3600; sid:2;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 2, seconds 3600; sid:3;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 4, seconds 3600; sid:4;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 7, seconds 3600; sid:5;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 8, seconds 3600; sid:6;) diff --git a/tests/threshold/detection_filter-rule-flow/test.yaml b/tests/threshold/detection_filter-rule-flow/test.yaml new file mode 100644 index 000000000..a6b4106d1 --- /dev/null +++ b/tests/threshold/detection_filter-rule-flow/test.yaml @@ -0,0 +1,36 @@ +requires: + min-version: 8 + +pcap: ../threshold-rule-flow/icmp.pcap + +checks: + - filter: + count: 8 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 7 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 6 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 4 + match: + event_type: alert + alert.signature_id: 4 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 5 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 6 diff --git a/tests/threshold/detection_filter-rule-hostsrc/test.rules b/tests/threshold/detection_filter-rule-hostsrc/test.rules new file mode 100644 index 000000000..acbe80c78 --- /dev/null +++ b/tests/threshold/detection_filter-rule-hostsrc/test.rules @@ -0,0 +1,6 @@ +alert icmp any any -> any any (itype:8; sid:1;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 1, seconds 3600; sid:2;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 2, seconds 3600; sid:3;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 4, seconds 3600; sid:4;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 7, seconds 3600; sid:5;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 8, seconds 3600; sid:6;) diff --git a/tests/threshold/detection_filter-rule-hostsrc/test.yaml b/tests/threshold/detection_filter-rule-hostsrc/test.yaml new file mode 100644 index 000000000..a6b4106d1 --- /dev/null +++ b/tests/threshold/detection_filter-rule-hostsrc/test.yaml @@ -0,0 +1,36 @@ +requires: + min-version: 8 + +pcap: ../threshold-rule-flow/icmp.pcap + +checks: + - filter: + count: 8 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 7 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 6 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 4 + match: + event_type: alert + alert.signature_id: 4 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 5 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 6 -- 2.47.2