Mirror/zeek
1
0
Fork 0
mirror of https://github.com/zeek/zeek.git synced 2025-10-06 16:48:19 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

Intel framework test passes now.

Browse source
This commit is contained in:
Seth Hall 2011-06-24 16:10:13 -04:00
parent 0b918eb140
commit cb3d312d5a
1 changed files with 6 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
testing/btest/policy/frameworks/intel/insert-and-matcher.bro
View file

@ -6,20 +6,20 @@
event bro_init() event bro_init()
{ {
event Intel::insert([$ip=1.2.3.4, $tags=set("zeustracker.abuse.ch", "malicious")]); Intel::insert([$ip=1.2.3.4, $tags=set("zeustracker.abuse.ch", "malicious")]);
event Intel::insert([$str="http://www.google.com/", $subtype="url", $tags=set("infrastructure", "google")]); Intel::insert([$str="http://www.google.com/", $subtype="url", $tags=set("infrastructure", "google")]);
event Intel::insert([$str="Ab439G32F...", $subtype="x509_cert", $tags=set("bad")]); Intel::insert([$str="Ab439G32F...", $subtype="x509_cert", $tags=set("bad")]);
event Intel::insert([$str="Ab439G32F...", $tags=set("bad")]); Intel::insert([$str="Ab439G32F...", $tags=set("bad")]);
} }
event bro_done() event bro_done()
{ {
local orig_h = 1.2.3.4; local orig_h = 1.2.3.4;
if ( Intel::matcher([$ip=orig_h, $tags=set("malicious")]) ) if ( Intel::matcher([$ip=orig_h, $and_tags=set("malicious")]) )
print "VALID"; print "VALID";
if ( Intel::matcher([$ip=orig_h, $tags=set("don't match")]) ) if ( Intel::matcher([$ip=orig_h, $and_tags=set("don't match")]) )
print "INVALID"; print "INVALID";
if ( Intel::matcher([$ip=orig_h, $pred=function(meta: Intel::MetaData): bool { return T; } ]) ) if ( Intel::matcher([$ip=orig_h, $pred=function(meta: Intel::MetaData): bool { return T; } ]) )