diff --git a/tests/rules/flowbits/test.rules b/tests/rules/flowbits/test.rules new file mode 100644 index 000000000..ae1b7966b --- /dev/null +++ b/tests/rules/flowbits/test.rules @@ -0,0 +1,8 @@ +alert ip any any -> any any (msg:"Flowbit noalert"; flowbits:noalert,fb1; sid:1;) +alert ip any any -> any any (msg:"Flowbit isset"; flowbits:isset,fb1; sid:2;) +alert ip any any -> any any (msg:"Flowbit isnotset"; flowbits:isnotset,fb1; sid:3;) +alert ip any any -> any any (msg:"Flowbit set"; flowbits:set,fb1; sid:4;) +alert ip any any -> any any (msg:"Flowbit unset"; flowbits:unset,fb1; sid:5;) +alert ip any any -> any any (msg:"Flowbit toggle"; flowbits:toggle,fb1; sid:6;) +alert ip any any -> any any (msg:"Flowbit isset ored flowbits"; flowbits:isset,fb1|fb2; sid:7;) +alert ip any any -> any any (msg:"Flowbit isnotset ored flowbits"; flowbits:isnotset, fb1|fb2 ; sid:8;) diff --git a/tests/rules/flowbits/test.yaml b/tests/rules/flowbits/test.yaml new file mode 100644 index 000000000..2b65d0b86 --- /dev/null +++ b/tests/rules/flowbits/test.yaml @@ -0,0 +1,64 @@ +requires: + min-version: 7.0.0 + pcap: false + +args: + - --engine-analysis + +checks: +- filter: + filename: rules.json + count: 1 + match: + id: 1 + lists.packet.matches[0].name: "flowbits" + lists.packet.matches[0].flowbits.cmd: "toggle" +- filter: + filename: rules.json + count: 1 + match: + id: 2 + lists.packet.matches[0].name: "flowbits" + lists.packet.matches[0].flowbits.cmd: "isset" +- filter: + filename: rules.json + count: 1 + match: + id: 3 + lists.packet.matches[0].name: "flowbits" + lists.packet.matches[0].flowbits.cmd: "isnotset" +- filter: + filename: rules.json + count: 1 + match: + id: 4 + lists.packet.matches[0].name: "flowbits" + lists.packet.matches[0].flowbits.cmd: "set" +- filter: + filename: rules.json + count: 1 + match: + id: 5 + lists.packet.matches[0].name: "flowbits" + lists.packet.matches[0].flowbits.cmd: "unset" +- filter: + filename: rules.json + count: 1 + match: + id: 6 + lists.packet.matches[0].name: "flowbits" + lists.packet.matches[0].flowbits.cmd: "toggle" +- filter: + filename: rules.json + count: 1 + match: + id: 7 + lists.packet.matches[0].name: "flowbits" + lists.packet.matches[0].flowbits.cmd: "isset" +- filter: + filename: rules.json + count: 1 + match: + id: 8 + lists.packet.matches[0].name: "flowbits" + lists.packet.matches[0].flowbits.cmd: "isnotset"