Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

tests: add test for alert-then-pass issue 5466 #1579

Closed
wants to merge 1 commit into from
Closed

tests: add test for alert-then-pass issue 5466 #1579

wants to merge 1 commit into from

Conversation

victorjulien
Copy link
Member

@victorjulien victorjulien mentioned this pull request Jan 12, 2024
Closed
jufajardini
jufajardini reviewed Jan 12, 2024
View reviewed changes
tests/issue-5466-alert-then-pass-01/test.rules
Comment on lines +1 to +2
pass tcp any any -> any 22 (alert; sid:2; gid:10000003; msg:"PASS SSH";)
drop tcp any any -> any any (noalert; sid:1; rev:1; msg:"DROP all TCP";)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The sid vs signature order here is sneaky xD

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hehe yeah, just copied and updated the 4663-03 test, so came from there :)

@catenacyber catenacyber added the requires suricata pr Depends on a PR in Suricata label Jan 18, 2024
@victorjulien victorjulien mentioned this pull request Jun 6, 2024
Closed
@victorjulien
Copy link
Member Author

replaced by #1893

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jufajardini jufajardini jufajardini left review comments

Assignees
No one assigned
Labels
requires suricata pr Depends on a PR in Suricata
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@victorjulien @jufajardini @catenacyber