diff --git a/tests/threshold/detection_filter-rule-flow/test.rules b/tests/threshold/detection_filter-rule-flow/test.rules new file mode 100644 index 000000000..2409f9cf1 --- /dev/null +++ b/tests/threshold/detection_filter-rule-flow/test.rules @@ -0,0 +1,6 @@ +alert icmp any any -> any any (itype:8; sid:1;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 1, seconds 3600; sid:2;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 2, seconds 3600; sid:3;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 4, seconds 3600; sid:4;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 7, seconds 3600; sid:5;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 8, seconds 3600; sid:6;) diff --git a/tests/threshold/detection_filter-rule-flow/test.yaml b/tests/threshold/detection_filter-rule-flow/test.yaml new file mode 100644 index 000000000..a6b4106d1 --- /dev/null +++ b/tests/threshold/detection_filter-rule-flow/test.yaml @@ -0,0 +1,36 @@ +requires: + min-version: 8 + +pcap: ../threshold-rule-flow/icmp.pcap + +checks: + - filter: + count: 8 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 7 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 6 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 4 + match: + event_type: alert + alert.signature_id: 4 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 5 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 6 diff --git a/tests/threshold/detection_filter-rule-hostsrc/test.rules b/tests/threshold/detection_filter-rule-hostsrc/test.rules new file mode 100644 index 000000000..acbe80c78 --- /dev/null +++ b/tests/threshold/detection_filter-rule-hostsrc/test.rules @@ -0,0 +1,6 @@ +alert icmp any any -> any any (itype:8; sid:1;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 1, seconds 3600; sid:2;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 2, seconds 3600; sid:3;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 4, seconds 3600; sid:4;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 7, seconds 3600; sid:5;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 8, seconds 3600; sid:6;) diff --git a/tests/threshold/detection_filter-rule-hostsrc/test.yaml b/tests/threshold/detection_filter-rule-hostsrc/test.yaml new file mode 100644 index 000000000..a6b4106d1 --- /dev/null +++ b/tests/threshold/detection_filter-rule-hostsrc/test.yaml @@ -0,0 +1,36 @@ +requires: + min-version: 8 + +pcap: ../threshold-rule-flow/icmp.pcap + +checks: + - filter: + count: 8 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 7 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 6 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 4 + match: + event_type: alert + alert.signature_id: 4 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 5 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 6 diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/README.md b/tests/threshold/threshold-config-rate-filter-alert-flow/README.md new file mode 100644 index 000000000..ff3dec0de --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/README.md @@ -0,0 +1,5 @@ +# Threshold.config with by_flow + +This test checks threshold.config file using by_flow tracking + +The pcap file is from http-all-headers test diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/input.rules b/tests/threshold/threshold-config-rate-filter-alert-flow/input.rules new file mode 100644 index 000000000..7cb862d41 --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/input.rules @@ -0,0 +1 @@ +drop tcp any any -> any any (dsize:0; sid: 1000001;) diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/suricata.yaml b/tests/threshold/threshold-config-rate-filter-alert-flow/suricata.yaml new file mode 100644 index 000000000..ee5c3f004 --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/suricata.yaml @@ -0,0 +1,15 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - alert + - drop: + flows: all + alerts: true + - http + - anomaly diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/test.yaml b/tests/threshold/threshold-config-rate-filter-alert-flow/test.yaml new file mode 100644 index 000000000..7f23097b0 --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/test.yaml @@ -0,0 +1,30 @@ +pcap: ../../http-all-headers/input.pcap + +requires: + min-version: 8 + +args: +- --set threshold-file=${TEST_DIR}/threshold.config +- --simulate-ips + +checks: + - filter: + count: 3 + match: + event_type: alert + alert.signature_id: 1000001 + alert.action: blocked + - filter: + count: 16 + match: + event_type: alert + alert.signature_id: 1000001 + alert.action: allowed + - filter: + count: 3 + match: + event_type: drop + - filter: + count: 1 + match: + event_type: http diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/threshold.config b/tests/threshold/threshold-config-rate-filter-alert-flow/threshold.config new file mode 100644 index 000000000..ae0ebefdb --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/threshold.config @@ -0,0 +1 @@ +rate_filter gen_id 1, sig_id 1000001, track by_flow, count 3, seconds 60, new_action alert, timeout 1000 diff --git a/tests/threshold/threshold-config-threshold-both-flow/README.md b/tests/threshold/threshold-config-threshold-both-flow/README.md new file mode 100644 index 000000000..432a2ebb7 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/README.md @@ -0,0 +1,5 @@ +# Threshold.config with by_flow + +This test checks threshold.config file using by_flow keyword + +The pcap file is from http-all-headers test diff --git a/tests/threshold/threshold-config-threshold-both-flow/input.rules b/tests/threshold/threshold-config-threshold-both-flow/input.rules new file mode 100644 index 000000000..9ace89c29 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/input.rules @@ -0,0 +1 @@ +alert tcp any any -> any any (dsize:0; sid: 1000001;) diff --git a/tests/threshold/threshold-config-threshold-both-flow/suricata.yaml b/tests/threshold/threshold-config-threshold-both-flow/suricata.yaml new file mode 100644 index 000000000..ee5c3f004 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/suricata.yaml @@ -0,0 +1,15 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - alert + - drop: + flows: all + alerts: true + - http + - anomaly diff --git a/tests/threshold/threshold-config-threshold-both-flow/test.yaml b/tests/threshold/threshold-config-threshold-both-flow/test.yaml new file mode 100644 index 000000000..a9413effc --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/test.yaml @@ -0,0 +1,19 @@ +pcap: ../../http-all-headers/input.pcap + +requires: + min-version: 8 + +args: +- --set threshold-file=${TEST_DIR}/threshold.config +- --simulate-ips + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1000001 + - filter: + count: 1 + match: + event_type: http diff --git a/tests/threshold/threshold-config-threshold-both-flow/threshold.config b/tests/threshold/threshold-config-threshold-both-flow/threshold.config new file mode 100644 index 000000000..2c50d6479 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/threshold.config @@ -0,0 +1 @@ +threshold gen_id 1, sig_id 1000001, type both, track by_flow, count 5, seconds 60 diff --git a/tests/threshold/threshold-config-threshold-limit-flow/README.md b/tests/threshold/threshold-config-threshold-limit-flow/README.md new file mode 100644 index 000000000..432a2ebb7 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/README.md @@ -0,0 +1,5 @@ +# Threshold.config with by_flow + +This test checks threshold.config file using by_flow keyword + +The pcap file is from http-all-headers test diff --git a/tests/threshold/threshold-config-threshold-limit-flow/input.rules b/tests/threshold/threshold-config-threshold-limit-flow/input.rules new file mode 100644 index 000000000..9ace89c29 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/input.rules @@ -0,0 +1 @@ +alert tcp any any -> any any (dsize:0; sid: 1000001;) diff --git a/tests/threshold/threshold-config-threshold-limit-flow/suricata.yaml b/tests/threshold/threshold-config-threshold-limit-flow/suricata.yaml new file mode 100644 index 000000000..ee5c3f004 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/suricata.yaml @@ -0,0 +1,15 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - alert + - drop: + flows: all + alerts: true + - http + - anomaly diff --git a/tests/threshold/threshold-config-threshold-limit-flow/test.yaml b/tests/threshold/threshold-config-threshold-limit-flow/test.yaml new file mode 100644 index 000000000..a9413effc --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/test.yaml @@ -0,0 +1,19 @@ +pcap: ../../http-all-headers/input.pcap + +requires: + min-version: 8 + +args: +- --set threshold-file=${TEST_DIR}/threshold.config +- --simulate-ips + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1000001 + - filter: + count: 1 + match: + event_type: http diff --git a/tests/threshold/threshold-config-threshold-limit-flow/threshold.config b/tests/threshold/threshold-config-threshold-limit-flow/threshold.config new file mode 100644 index 000000000..8ef60ce92 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/threshold.config @@ -0,0 +1 @@ +threshold gen_id 1, sig_id 1000001, type limit, track by_flow, count 1, seconds 60 diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/README.md b/tests/threshold/threshold-config-threshold-threshold-flow/README.md new file mode 100644 index 000000000..432a2ebb7 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/README.md @@ -0,0 +1,5 @@ +# Threshold.config with by_flow + +This test checks threshold.config file using by_flow keyword + +The pcap file is from http-all-headers test diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/input.rules b/tests/threshold/threshold-config-threshold-threshold-flow/input.rules new file mode 100644 index 000000000..9ace89c29 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/input.rules @@ -0,0 +1 @@ +alert tcp any any -> any any (dsize:0; sid: 1000001;) diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/suricata.yaml b/tests/threshold/threshold-config-threshold-threshold-flow/suricata.yaml new file mode 100644 index 000000000..ee5c3f004 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/suricata.yaml @@ -0,0 +1,15 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - alert + - drop: + flows: all + alerts: true + - http + - anomaly diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/test.yaml b/tests/threshold/threshold-config-threshold-threshold-flow/test.yaml new file mode 100644 index 000000000..4e7b4d840 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/test.yaml @@ -0,0 +1,19 @@ +pcap: ../../http-all-headers/input.pcap + +requires: + min-version: 8 + +args: +- --set threshold-file=${TEST_DIR}/threshold.config +- --simulate-ips + +checks: + - filter: + count: 3 + match: + event_type: alert + alert.signature_id: 1000001 + - filter: + count: 1 + match: + event_type: http diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/threshold.config b/tests/threshold/threshold-config-threshold-threshold-flow/threshold.config new file mode 100644 index 000000000..0b08a5724 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/threshold.config @@ -0,0 +1 @@ +threshold gen_id 1, sig_id 1000001, type threshold, track by_flow, count 5, seconds 60 diff --git a/tests/threshold/threshold-rule-flow-backoff-single-flow/test.rules b/tests/threshold/threshold-rule-flow-backoff-single-flow/test.rules new file mode 100644 index 000000000..38e4ebd05 --- /dev/null +++ b/tests/threshold/threshold-rule-flow-backoff-single-flow/test.rules @@ -0,0 +1,4 @@ +alert tcp any any -> any any (dsize:>0; sid:1;) +alert tcp any any -> any any (dsize:>0; threshold:type backoff, track by_flow, count 1, multiplier 2; sid:2;) +alert tcp any any -> any any (dsize:>0; threshold:type backoff, track by_flow, count 3, multiplier 2; sid:3;) +alert tcp any any -> any any (dsize:>0; threshold:type backoff, track by_flow, count 5, multiplier 5; sid:4;) diff --git a/tests/threshold/threshold-rule-flow-backoff-single-flow/test.yaml b/tests/threshold/threshold-rule-flow-backoff-single-flow/test.yaml new file mode 100644 index 000000000..dca2674f2 --- /dev/null +++ b/tests/threshold/threshold-rule-flow-backoff-single-flow/test.yaml @@ -0,0 +1,26 @@ +requires: + min-version: 8 + +pcap: ../../filestore-filecontainer-smb/filecontainer-smb.pcap + +checks: + - filter: + count: 6676 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 13 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 12 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 5 + match: + event_type: alert + alert.signature_id: 4 diff --git a/tests/threshold/threshold-rule-flow-backoff/test.rules b/tests/threshold/threshold-rule-flow-backoff/test.rules new file mode 100644 index 000000000..16727efc1 --- /dev/null +++ b/tests/threshold/threshold-rule-flow-backoff/test.rules @@ -0,0 +1,4 @@ +alert tcp any any -> any any (dsize:>0; sid:1;) +alert tcp any any -> any any (dsize:>0; threshold:type backoff, track by_flow, count 1, multiplier 2; sid:2;) +alert tcp any any -> any any (dsize:>0; threshold:type backoff, track by_flow, count 3, multiplier 2; sid:3;) +alert tcp any any -> any any (dsize:>0; threshold:type backoff, track by_flow, count 1, multiplier 10; sid:4;) diff --git a/tests/threshold/threshold-rule-flow-backoff/test.yaml b/tests/threshold/threshold-rule-flow-backoff/test.yaml new file mode 100644 index 000000000..6a8f1c05b --- /dev/null +++ b/tests/threshold/threshold-rule-flow-backoff/test.yaml @@ -0,0 +1,26 @@ +requires: + min-version: 8 + +pcap: ../../bug-2482-01/proxyCONNECT_443.pcap + +checks: + - filter: + count: 1725 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 707 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 338 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 257 + match: + event_type: alert + alert.signature_id: 4 diff --git a/tests/threshold/threshold-rule-flow/README.md b/tests/threshold/threshold-rule-flow/README.md new file mode 100644 index 000000000..3a000ae60 --- /dev/null +++ b/tests/threshold/threshold-rule-flow/README.md @@ -0,0 +1,3 @@ +PCAP +==== +PCAP from https://wiki.wireshark.org/Internet_Control_Message_Protocol diff --git a/tests/threshold/threshold-rule-flow/icmp.pcap b/tests/threshold/threshold-rule-flow/icmp.pcap new file mode 100644 index 000000000..037606d1b Binary files /dev/null and b/tests/threshold/threshold-rule-flow/icmp.pcap differ diff --git a/tests/threshold/threshold-rule-flow/test.rules b/tests/threshold/threshold-rule-flow/test.rules new file mode 100644 index 000000000..602c24969 --- /dev/null +++ b/tests/threshold/threshold-rule-flow/test.rules @@ -0,0 +1,4 @@ +alert icmp any any -> any any (itype:8; sid:1;) +alert icmp any any -> any any (itype:8; threshold:type limit, track by_flow, count 1, seconds 3600; sid:2;) +alert icmp any any -> any any (itype:8; threshold:type limit, track by_flow, count 2, seconds 3600; sid:3;) +alert icmp any any -> any any (itype:8; threshold:type both, track by_flow, count 3, seconds 3600; sid:4;) diff --git a/tests/threshold/threshold-rule-flow/test.yaml b/tests/threshold/threshold-rule-flow/test.yaml new file mode 100644 index 000000000..cfa502879 --- /dev/null +++ b/tests/threshold/threshold-rule-flow/test.yaml @@ -0,0 +1,24 @@ +requires: + min-version: 8 + +checks: + - filter: + count: 8 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 2 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 4