diff --git a/testing/btest/Traces/smtp-multi-addr.pcap b/testing/btest/Traces/smtp-multi-addr.pcap new file mode 100644 index 0000000000..5651d045a9 Binary files /dev/null and b/testing/btest/Traces/smtp-multi-addr.pcap differ diff --git a/testing/btest/scripts/policy/frameworks/intel/seen/smtp.bro b/testing/btest/scripts/policy/frameworks/intel/seen/smtp.bro new file mode 100644 index 0000000000..fd21e0f73a --- /dev/null +++ b/testing/btest/scripts/policy/frameworks/intel/seen/smtp.bro @@ -0,0 +1,35 @@ +# @TEST-EXEC: bro -r $TRACES/smtp-multi-addr.pcap %INPUT +# @TEST-EXEC: btest-diff intel.log + +@TEST-START-FILE intel.dat +#fields indicator indicator_type meta.source meta.desc meta.url +jan.grashoefer@gmail.com Intel::EMAIL source1 test entry http://some-data-distributor.com/100000 +jan.grashoefer@cern.ch Intel::EMAIL source1 test entry http://some-data-distributor.com/100000 +jan.grashofer@cern.ch Intel::EMAIL source1 test entry http://some-data-distributor.com/100000 +addr-spec@example.com Intel::EMAIL source1 test entry http://some-data-distributor.com/100000 +angle-addr@example.com Intel::EMAIL source1 test entry http://some-data-distributor.com/100000 +name-addr@example.com Intel::EMAIL source1 test entry http://some-data-distributor.com/100000 +@TEST-END-FILE + +@load base/frameworks/intel +@load frameworks/intel/seen + +redef Intel::read_files += { "intel.dat" }; + +event bro_init() + { + suspend_processing(); + } + +event Input::end_of_data(name: string, source: string) + { + continue_processing(); + } + +event SMTP::log_smtp(rec: SMTP::Info) + { + for ( adr in rec$to ) + { + print fmt("Addr: '%s'", adr); + } + }