diff --git a/testing/btest/policy/frameworks/intel/insert-and-matcher.bro b/testing/btest/policy/frameworks/intel/insert-and-matcher.bro index 57be363499..bf8cd10e75 100644 --- a/testing/btest/policy/frameworks/intel/insert-and-matcher.bro +++ b/testing/btest/policy/frameworks/intel/insert-and-matcher.bro @@ -6,20 +6,20 @@ event bro_init() { - event Intel::insert([$ip=1.2.3.4, $tags=set("zeustracker.abuse.ch", "malicious")]); - event Intel::insert([$str="http://www.google.com/", $subtype="url", $tags=set("infrastructure", "google")]); - event Intel::insert([$str="Ab439G32F...", $subtype="x509_cert", $tags=set("bad")]); - event Intel::insert([$str="Ab439G32F...", $tags=set("bad")]); + Intel::insert([$ip=1.2.3.4, $tags=set("zeustracker.abuse.ch", "malicious")]); + Intel::insert([$str="http://www.google.com/", $subtype="url", $tags=set("infrastructure", "google")]); + Intel::insert([$str="Ab439G32F...", $subtype="x509_cert", $tags=set("bad")]); + Intel::insert([$str="Ab439G32F...", $tags=set("bad")]); } event bro_done() { local orig_h = 1.2.3.4; - if ( Intel::matcher([$ip=orig_h, $tags=set("malicious")]) ) + if ( Intel::matcher([$ip=orig_h, $and_tags=set("malicious")]) ) print "VALID"; - if ( Intel::matcher([$ip=orig_h, $tags=set("don't match")]) ) + if ( Intel::matcher([$ip=orig_h, $and_tags=set("don't match")]) ) print "INVALID"; if ( Intel::matcher([$ip=orig_h, $pred=function(meta: Intel::MetaData): bool { return T; } ]) )