From eb357ad913341f47c233c7018331d58e8e478603 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sun, 17 Jan 2021 20:12:36 +0100 Subject: [PATCH] tests: update krb test to do detection --- tests/krb5-request-frag-log/suricata.yaml | 1 + tests/krb5-request-frag-log/test.rules | 2 ++ tests/krb5-request-frag-log/test.yaml | 12 +++++++++++- 3 files changed, 14 insertions(+), 1 deletion(-) create mode 100644 tests/krb5-request-frag-log/test.rules diff --git a/tests/krb5-request-frag-log/suricata.yaml b/tests/krb5-request-frag-log/suricata.yaml index 955cf95e2..2cfa66955 100644 --- a/tests/krb5-request-frag-log/suricata.yaml +++ b/tests/krb5-request-frag-log/suricata.yaml @@ -6,3 +6,4 @@ outputs: enabled: true types: - krb5 + - alert diff --git a/tests/krb5-request-frag-log/test.rules b/tests/krb5-request-frag-log/test.rules new file mode 100644 index 000000000..d3809b059 --- /dev/null +++ b/tests/krb5-request-frag-log/test.rules @@ -0,0 +1,2 @@ +alert krb5 any any -> any any (krb5.sname; content:"test"; sid:1;) +alert krb5 any any -> any any (krb5.cname; content:"user01"; sid:2;) diff --git a/tests/krb5-request-frag-log/test.yaml b/tests/krb5-request-frag-log/test.yaml index 900f14d46..c14054c65 100644 --- a/tests/krb5-request-frag-log/test.yaml +++ b/tests/krb5-request-frag-log/test.yaml @@ -8,8 +8,18 @@ requires: args: - --set pcap-file.checksum-checks=no -checks: +checks: + - filter: + count: 2 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 2 + match: + event_type: alert + alert.signature_id: 2 - filter: comment: authentication service (AS) response count: 1 -- 2.47.2