diff --git a/testing/btest/Baseline/scripts.base.frameworks.intel.expire-item/output b/testing/btest/Baseline/scripts.base.frameworks.intel.expire-item/output index c30d03b9d9..8f75b7e9d1 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.intel.expire-item/output +++ b/testing/btest/Baseline/scripts.base.frameworks.intel.expire-item/output @@ -3,15 +3,18 @@ #empty_field (empty) #unset_field - #path intel -#open 2020-07-06-18-47-48 +#open 2020-07-06-20-13-06 #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where seen.node matched sources fuid file_mime_type file_desc #types time string addr port addr port string enum enum string set[enum] set[string] string string string -1594061268.125378 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1 - - - -1594061271.127050 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2,source1 - - - -1594061274.130721 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2,source1 - - - -#close 2020-07-06-18-48-00 +1594066386.095894 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1 - - - +1594066389.097925 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1 - - - +1594066392.099402 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2,source1 - - - +1594066395.103419 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2,source1 - - - +1594066398.103542 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2,source1 - - - +#close 2020-07-06-20-13-21 -- Run 1 -- Trigger: 1.2.3.4 +Seen: 1.2.3.4 -- Run 2 -- Trigger: 1.2.3.4 Reinsert: 1.2.3.4 @@ -23,8 +26,9 @@ Expired: 192.168.0.0/16 -- Run 4 -- Trigger: 1.2.3.4 Seen: 1.2.3.4 -Expired: 1.2.3.4 -- Run 5 -- Trigger: 1.2.3.4 +Seen: 1.2.3.4 +Expired: 1.2.3.4 -- Run 6 -- Trigger: 1.2.3.4 diff --git a/testing/btest/Baseline/scripts.base.frameworks.intel.match-subnet/output b/testing/btest/Baseline/scripts.base.frameworks.intel.match-subnet/output index b1a1dec235..bab329b20d 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.intel.match-subnet/output +++ b/testing/btest/Baseline/scripts.base.frameworks.intel.match-subnet/output @@ -3,13 +3,13 @@ #empty_field (empty) #unset_field - #path intel -#open 2020-04-23-23-52-54 +#open 2020-07-06-20-13-29 #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where seen.node matched sources fuid file_mime_type file_desc #types time string addr port addr port string enum enum string set[enum] set[string] string string string -1587685974.717161 - - - - - 192.168.1.1 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1 - - - -1587685974.717161 - - - - - 192.168.2.1 Intel::ADDR SOMEWHERE zeek Intel::SUBNET source1 - - - -1587685974.717161 - - - - - 192.168.142.1 Intel::ADDR SOMEWHERE zeek Intel::SUBNET,Intel::ADDR source1 - - - -#close 2020-04-23-23-52-54 +1594066409.698463 - - - - - 192.168.1.1 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1 - - - +1594066409.698463 - - - - - 192.168.2.1 Intel::ADDR SOMEWHERE zeek Intel::SUBNET source1 - - - +1594066409.698463 - - - - - 192.168.142.1 Intel::ADDR SOMEWHERE zeek Intel::ADDR,Intel::SUBNET source1 - - - +#close 2020-07-06-20-13-29 Seen: [indicator=192.168.1.1, indicator_type=Intel::ADDR, host=192.168.1.1, where=SOMEWHERE, node=zeek, conn=, uid=, f=, fuid=] Item: [indicator=192.168.1.1, indicator_type=Intel::ADDR, meta=[source=source1, desc=this host is just plain baaad, url=http://some-data-distributor.com/1]] @@ -18,7 +18,7 @@ Seen: [indicator=192.168.2.1, indicator_type=Intel::ADDR, host=192.168.2.1, wher Item: [indicator=192.168.2.0/24, indicator_type=Intel::SUBNET, meta=[source=source1, desc=this subnetwork is just plain baaad, url=http://some-data-distributor.com/2]] Seen: [indicator=192.168.142.1, indicator_type=Intel::ADDR, host=192.168.142.1, where=SOMEWHERE, node=zeek, conn=, uid=, f=, fuid=] -Item: [indicator=192.168.142.0/26, indicator_type=Intel::SUBNET, meta=[source=source1, desc=this subnetwork is inside, url=http://some-data-distributor.com/4]] -Item: [indicator=192.168.142.0/24, indicator_type=Intel::SUBNET, meta=[source=source1, desc=this subnetwork is baaad, url=http://some-data-distributor.com/4]] Item: [indicator=192.168.128.0/18, indicator_type=Intel::SUBNET, meta=[source=source1, desc=this subnetwork might be baaad, url=http://some-data-distributor.com/5]] +Item: [indicator=192.168.142.0/24, indicator_type=Intel::SUBNET, meta=[source=source1, desc=this subnetwork is baaad, url=http://some-data-distributor.com/4]] +Item: [indicator=192.168.142.0/26, indicator_type=Intel::SUBNET, meta=[source=source1, desc=this subnetwork is inside, url=http://some-data-distributor.com/4]] Item: [indicator=192.168.142.1, indicator_type=Intel::ADDR, meta=[source=source1, desc=this host is just plain baaad, url=http://some-data-distributor.com/3]] diff --git a/testing/btest/Baseline/scripts.base.frameworks.intel.updated-match/output b/testing/btest/Baseline/scripts.base.frameworks.intel.updated-match/output index 1e065f2673..3bffc48d87 100644 --- a/testing/btest/Baseline/scripts.base.frameworks.intel.updated-match/output +++ b/testing/btest/Baseline/scripts.base.frameworks.intel.updated-match/output @@ -3,23 +3,23 @@ #empty_field (empty) #unset_field - #path intel -#open 2019-06-07-02-20-04 +#open 2020-03-02-21-27-11 #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where seen.node matched sources fuid file_mime_type file_desc #types time string addr port addr port string enum enum string set[enum] set[string] string string string -1559874004.005095 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1 - - - -1559874005.130958 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1,source2 - - - -1559874005.130958 - - - - - 4.3.2.1 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2 - - - -1559874006.142023 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1,source2 - - - -1559874006.142023 - - - - - 4.3.2.1 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2 - - - -#close 2019-06-07-02-20-06 +1583184431.704132 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1 - - - +1583184432.708990 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2,source1 - - - +1583184432.708990 - - - - - 4.3.2.1 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2 - - - +1583184433.709197 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2,source1 - - - +1583184433.709197 - - - - - 4.3.2.1 Intel::ADDR SOMEWHERE zeek Intel::ADDR source2 - - - +#close 2020-03-02-21-27-13 #separator \x09 #set_separator , #empty_field (empty) #unset_field - #path notice -#open 2019-06-07-02-20-06 +#open 2020-03-02-21-27-13 #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p fuid file_mime_type file_desc proto note msg sub src dst p n peer_descr actions suppress_for remote_location.country_code remote_location.region remote_location.city remote_location.latitude remote_location.longitude #types time string addr port addr port string string string enum enum string string addr addr port count string set[enum] interval string string string double double -1559874006.142023 - - - - - - - - - Intel::Notice Intel hit on 1.2.3.4 at SOMEWHERE 1.2.3.4 - - - - - Notice::ACTION_LOG 3600.000000 - - - - - -1559874006.142023 - - - - - - - - - Intel::Notice Intel hit on 4.3.2.1 at SOMEWHERE 4.3.2.1 - - - - - Notice::ACTION_LOG 3600.000000 - - - - - -#close 2019-06-07-02-20-06 +1583184433.709197 - - - - - - - - - Intel::Notice Intel hit on 1.2.3.4 at SOMEWHERE 1.2.3.4 - - - - - Notice::ACTION_LOG 3600.000000 - - - - - +1583184433.709197 - - - - - - - - - Intel::Notice Intel hit on 4.3.2.1 at SOMEWHERE 4.3.2.1 - - - - - Notice::ACTION_LOG 3600.000000 - - - - - +#close 2020-03-02-21-27-13 diff --git a/testing/btest/Baseline/scripts.policy.frameworks.intel.removal/zeekproc.intel.log b/testing/btest/Baseline/scripts.policy.frameworks.intel.removal/zeekproc.intel.log index 22c67e953a..ac508f5694 100644 --- a/testing/btest/Baseline/scripts.policy.frameworks.intel.removal/zeekproc.intel.log +++ b/testing/btest/Baseline/scripts.policy.frameworks.intel.removal/zeekproc.intel.log @@ -3,8 +3,9 @@ #empty_field (empty) #unset_field - #path intel -#open 2019-06-07-02-29-36 +#open 2020-03-02-19-33-21 #fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where seen.node matched sources fuid file_mime_type file_desc #types time string addr port addr port string enum enum string set[enum] set[string] string string string -1559874575.982006 - - - - - 10.0.0.2 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1 - - - -#close 2019-06-07-02-29-36 +1583177601.918405 - - - - - 10.0.0.1 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1 - - - +1583177601.918405 - - - - - 10.0.0.2 Intel::ADDR SOMEWHERE zeek Intel::ADDR source1 - - - +#close 2020-03-02-19-33-22 diff --git a/testing/btest/scripts/base/frameworks/intel/expire-item.zeek b/testing/btest/scripts/base/frameworks/intel/expire-item.zeek index 631d9bbc50..2b35bb0de5 100644 --- a/testing/btest/scripts/base/frameworks/intel/expire-item.zeek +++ b/testing/btest/scripts/base/frameworks/intel/expire-item.zeek @@ -63,5 +63,5 @@ hook Intel::item_expired(indicator: string, indicator_type: Intel::Type, event zeek_init() &priority=-10 { - schedule 1.5sec { do_it() }; + schedule 4sec { do_it() }; } diff --git a/testing/btest/scripts/base/frameworks/intel/filter-item.zeek b/testing/btest/scripts/base/frameworks/intel/filter-item.zeek index ea97b74350..ffb99fe96c 100644 --- a/testing/btest/scripts/base/frameworks/intel/filter-item.zeek +++ b/testing/btest/scripts/base/frameworks/intel/filter-item.zeek @@ -39,5 +39,5 @@ event Intel::log_intel(rec: Intel::Info) event zeek_init() &priority=-10 { - schedule 1sec { do_it() }; + schedule 4sec { do_it() }; } diff --git a/testing/btest/scripts/base/frameworks/intel/input-and-match.zeek b/testing/btest/scripts/base/frameworks/intel/input-and-match.zeek index f4408e689f..da43b808fc 100644 --- a/testing/btest/scripts/base/frameworks/intel/input-and-match.zeek +++ b/testing/btest/scripts/base/frameworks/intel/input-and-match.zeek @@ -34,5 +34,5 @@ event Intel::log_intel(rec: Intel::Info) event zeek_init() &priority=-10 { - schedule 1sec { do_it() }; + schedule 4sec { do_it() }; } diff --git a/testing/btest/scripts/base/frameworks/intel/match-subnet.zeek b/testing/btest/scripts/base/frameworks/intel/match-subnet.zeek index 116d4f7fc7..49aabff694 100644 --- a/testing/btest/scripts/base/frameworks/intel/match-subnet.zeek +++ b/testing/btest/scripts/base/frameworks/intel/match-subnet.zeek @@ -31,7 +31,7 @@ event do_it() event zeek_init() &priority=-10 { - schedule 1sec { do_it() }; + schedule 4sec { do_it() }; } global log_lines = 0; diff --git a/testing/btest/scripts/base/frameworks/intel/read-file-dist-cluster.zeek b/testing/btest/scripts/base/frameworks/intel/read-file-dist-cluster.zeek index 18d4dd6515..4f25151f20 100644 --- a/testing/btest/scripts/base/frameworks/intel/read-file-dist-cluster.zeek +++ b/testing/btest/scripts/base/frameworks/intel/read-file-dist-cluster.zeek @@ -50,7 +50,7 @@ event zeek_init() # Delay the workers searching for hits briefly to allow for the data distribution # mechanism to distribute the data to the workers. if ( Cluster::local_node_type() == Cluster::WORKER ) - schedule 2sec { do_it() }; + schedule 4sec { do_it() }; } event do_terminate() diff --git a/testing/btest/scripts/base/frameworks/intel/remove-non-existing.zeek b/testing/btest/scripts/base/frameworks/intel/remove-non-existing.zeek index ceb216f021..45cb607e0a 100644 --- a/testing/btest/scripts/base/frameworks/intel/remove-non-existing.zeek +++ b/testing/btest/scripts/base/frameworks/intel/remove-non-existing.zeek @@ -27,5 +27,5 @@ event do_it() event zeek_init() &priority=-10 { - schedule 1sec { do_it() }; + schedule 3sec { do_it() }; }