File tree Expand file tree Collapse file tree 6 files changed +36
-2
lines changed Expand file tree Collapse file tree 6 files changed +36
-2
lines changed Original file line number Diff line number Diff line change
1
+ Similar to ` ../requires-ok ` but does include one rule that will fail
2
+ to load. This is to test that a bad rule after "skipped" rule fails
3
+ out and is not recorded as skipped.
File renamed without changes.
Original file line number Diff line number Diff line change
1
+ requires :
2
+ min-version : 7.0.3
3
+
4
+ pcap : ../eve-metadata/testmyids.pcap
5
+
6
+ args :
7
+ - -v
8
+
9
+ # As we have a bad rule, expect exit-code 1.
10
+ exit-code : 1
11
+
12
+ # No checks, as no stats are written on exit code 0.
File renamed without changes.
Original file line number Diff line number Diff line change
1
+ # Rule for Suricata >= 7 and < 8.
2
+ alert http any any -> any any (msg:"TEST Suricata >= 7 and < 8"; content:"uid=0"; requires: version >= 7 < 8; sid:7; rev:1;)
3
+
4
+ # Rule for Suricata >= 7.0.3 but less than 8... Or >= 8.0.1
5
+ alert http any any -> any any (content:"uid=0"; requires: version >= 7.0.3 < 8 | >= 8.0.1; sid:9; rev:1;)
6
+
7
+ # Rule for Suricata >= 8.
8
+ alert http any any -> any any (msg:"TEST Suricata >= 8"; content:"uid=0"; requires: version >= 8.0.0; sid:8; rev:1;)
9
+
10
+ # These rules have something invalid about them, but do follow the general rule
11
+ # structure, so should be eliminated by the requires statement.
12
+ alert vxlan any any -> any any (requires: version >= 10; sid:1;)
13
+ alert udp any any -> any any (vxlan_vni:10; requires: version >= 10; sid:2;)
14
+ alert http any any => any any (requires: version >= 10; sid:3;)
15
+ alert tcp any any -> any any (frame:smtp.not_supported; requires: version >= 10; sid:4;)
Original file line number Diff line number Diff line change @@ -50,12 +50,16 @@ checks:
50
50
count : 1
51
51
match :
52
52
event_type : stats
53
- stats.detect.engines[0].rules_skipped : 6
53
+ stats.detect.engines[0].rules_skipped : 5
54
+ stats.detect.engines[0].rules_loaded : 2
55
+ stats.detect.engines[0].rules_failed : 0
54
56
55
57
- filter :
56
58
requires :
57
59
min-version : 8
58
60
count : 1
59
61
match :
60
62
event_type : stats
61
- stats.detect.engines[0].rules_skipped : 7
63
+ stats.detect.engines[0].rules_skipped : 6
64
+ stats.detect.engines[0].rules_loaded : 1
65
+ stats.detect.engines[0].rules_failed : 0
You can’t perform that action at this time.
0 commit comments