Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-02 14:48:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Add subnet intel expiration to a test.

Browse source
This commit is contained in:
Seth Hall 2018-04-27 19:55:22 -04:00
parent e5e1037e91
commit c973375f1f
2 changed files with 9 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

15
testing/btest/Baseline/scripts.base.frameworks.intel.expire-item/output
View file

@ -3,15 +3,15 @@
#empty_field (empty)
#unset_field -
#path intel
#open 2017-02-09-18-29-44
#open 2018-04-27-23-53-04
#fields ts uid id.orig_h id.orig_p id.resp_h id.resp_p seen.indicator seen.indicator_type seen.where seen.node matched sources fuid file_mime_type file_desc
#types time string addr port addr port string enum enum string set[enum] set[string] string string string
1486664984.510411 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE bro Intel::ADDR source1 - - -
1486664987.510937 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE bro Intel::ADDR source1 - - -
1486664990.511265 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE bro Intel::ADDR source1,source2 - - -
1486664993.512024 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE bro Intel::ADDR source1,source2 - - -
1486664996.512265 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE bro Intel::ADDR source1,source2 - - -
#close 2017-02-09-18-30-03
1524873184.861542 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE bro Intel::ADDR source1 - - -
1524873187.913197 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE bro Intel::ADDR source1 - - -
1524873190.976201 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE bro Intel::ADDR source1,source2 - - -
1524873194.052686 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE bro Intel::ADDR source1,source2 - - -
1524873197.128942 - - - - - 1.2.3.4 Intel::ADDR SOMEWHERE bro Intel::ADDR source1,source2 - - -
#close 2018-04-27-23-53-20
-- Run 1 --
Trigger: 1.2.3.4
Seen: 1.2.3.4
@ -22,6 +22,7 @@ Seen: 1.2.3.4
-- Run 3 --
Trigger: 1.2.3.4
Seen: 1.2.3.4
Expired: 192.168.0.0/16
-- Run 4 --
Trigger: 1.2.3.4
Seen: 1.2.3.4

1
testing/btest/scripts/base/frameworks/intel/expire-item.bro
View file

@ -7,6 +7,7 @@
# @TEST-START-FILE intel.dat
#fields indicator indicator_type meta.source meta.desc meta.url
1.2.3.4 Intel::ADDR source1 this host is bad http://some-data-distributor.com/1
192.168.0.0/16 Intel::SUBNET source1 this network is bad http://some-data-distributor.com/2
# @TEST-END-FILE
@load frameworks/intel/do_expire