test/entropy: Basic entropy keyword test

This commit adds a basic test of the entropy keyword.
OISF · Jan 13, 2025 · 546fd6f · 546fd6f
1 parent db5e548
commit 546fd6f
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 0 deletions.
diff --git a/tests/entropy/entropy-01/README.md b/tests/entropy/entropy-01/README.md
@@ -0,0 +1 @@
+This test checks the entropy keyword with a comparison against HTTP file data.
diff --git a/tests/entropy/entropy-01/input.pcap b/tests/entropy/entropy-01/input.pcap
diff --git a/tests/entropy/entropy-01/test.rules b/tests/entropy/entropy-01/test.rules
@@ -0,0 +1,4 @@
+alert http any any -> any any (msg:"entropy simple test"; \
+    file.data; \
+    entropy: value 4, oper >=; \
+    sid:1;)
diff --git a/tests/entropy/entropy-01/test.yaml b/tests/entropy/entropy-01/test.yaml
@@ -0,0 +1,9 @@
+requires:
+  min-version: 8
+
+checks:
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 1
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1 @@
		This test checks the entropy keyword with a comparison against HTTP file data.