diff --git a/tests/entropy/entropy-01/README.md b/tests/entropy/entropy-01/README.md new file mode 100644 index 000000000..c1924f917 --- /dev/null +++ b/tests/entropy/entropy-01/README.md @@ -0,0 +1 @@ +This test checks the entropy keyword with a comparison against HTTP file data. diff --git a/tests/entropy/entropy-01/input.pcap b/tests/entropy/entropy-01/input.pcap new file mode 100644 index 000000000..c84b2df70 Binary files /dev/null and b/tests/entropy/entropy-01/input.pcap differ diff --git a/tests/entropy/entropy-01/test.rules b/tests/entropy/entropy-01/test.rules new file mode 100644 index 000000000..700c010cf --- /dev/null +++ b/tests/entropy/entropy-01/test.rules @@ -0,0 +1,4 @@ +alert http any any -> any any (msg:"entropy simple test"; \ + file.data; \ + entropy: value 4, oper >=; \ + sid:1;) diff --git a/tests/entropy/entropy-01/test.yaml b/tests/entropy/entropy-01/test.yaml new file mode 100644 index 000000000..f97be7b6b --- /dev/null +++ b/tests/entropy/entropy-01/test.yaml @@ -0,0 +1,9 @@ +requires: + min-version: 8 + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1