diff --git a/tests/entropy/entropy-01/test.yaml b/tests/entropy/entropy-01/test.yaml index 507b0f409..2adfecf46 100644 --- a/tests/entropy/entropy-01/test.yaml +++ b/tests/entropy/entropy-01/test.yaml @@ -1,5 +1,5 @@ requires: - min-version: 8 + version: 8.0.0 checks: - filter: diff --git a/tests/entropy/entropy-02/README.md b/tests/entropy/entropy-02/README.md new file mode 100644 index 000000000..ed494f535 --- /dev/null +++ b/tests/entropy/entropy-02/README.md @@ -0,0 +1,2 @@ +This test checks the entropy keyword with a comparison against HTTP file data and ensures +that the logging name is composed of the sticky buffer and sid. diff --git a/tests/entropy/entropy-02/test.rules b/tests/entropy/entropy-02/test.rules new file mode 100644 index 000000000..d4c927d56 --- /dev/null +++ b/tests/entropy/entropy-02/test.rules @@ -0,0 +1,14 @@ +# The entropy value is 4.137370175000773 +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value > 4; sid:1;) +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value >= 4; sid:2;) +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value >= 5; sid:3;) +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value 4-5; sid:4;) +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value !4-5; sid:5;) +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value < 4; sid:6;) +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value != 4; sid:7;) +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: value = 4; sid:8;) +# The entropy value is 4.150007324019584 +alert http any any -> any any (msg:"entropy simple test"; file.data; entropy: offset 10, value > 4.14; sid:10;) + +# Multiple entropy usages +alert http any any -> any any (msg:"entropy simple test"; http.response_body;entropy: value < 5; file.data; entropy: offset 10, value > 4.14; sid:11;) diff --git a/tests/entropy/entropy-02/test.yaml b/tests/entropy/entropy-02/test.yaml new file mode 100644 index 000000000..ba2f73822 --- /dev/null +++ b/tests/entropy/entropy-02/test.yaml @@ -0,0 +1,89 @@ +requires: + min-version: 8.0.1 + +pcap: ../entropy-01/input.pcap + +args: + - --set logging.entropy.make-unique=on + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 + metadata.entropy.sid:1;buffer:file_data;instance:1: 4.137370175000773 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2 + metadata.entropy.sid:2;buffer:file_data;instance:1: 4.137370175000773 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 4 + metadata.entropy.sid:4;buffer:file_data;instance:1: 4.137370175000773 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 5 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 6 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 7 + metadata.entropy.sid:7;buffer:file_data;instance:1: 4.137370175000773 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 8 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 10 + metadata.entropy.sid:10;buffer:file_data;instance:1: 4.150007324019584 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 10 + metadata.entropy.sid:10;buffer:file_data;instance:1: 4.150007324019584 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 11 + metadata.entropy.sid:11;buffer:file_data;instance:1: 4.137370175000773 + metadata.entropy.sid:11;buffer:file_data;instance:2: 4.150007324019584 + - filter: + count: 1 + match: + event_type: flow + src_ip: 10.92.95.2 + dest_ip: 10.92.67.138 + flow.pkts_toserver: 5 + flow.pkts_toclient: 5 + metadata.entropy.sid:1;buffer:file_data;instance:1: 4.137370175000773 + metadata.entropy.sid:2;buffer:file_data;instance:1: 4.137370175000773 + metadata.entropy.sid:3;buffer:file_data;instance:1: 4.137370175000773 + metadata.entropy.sid:4;buffer:file_data;instance:1: 4.137370175000773 + metadata.entropy.sid:5;buffer:file_data;instance:1: 4.137370175000773 + metadata.entropy.sid:6;buffer:file_data;instance:1: 4.137370175000773 + metadata.entropy.sid:7;buffer:file_data;instance:1: 4.137370175000773 + metadata.entropy.sid:8;buffer:file_data;instance:1: 4.137370175000773 + metadata.entropy.sid:10;buffer:file_data;instance:1: 4.150007324019584