poc2_worked

tests/test_suricata8_profile.py

@@ -0,0 +1,54 @@
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+def test_eve_profile_uses_suricata8_logger_names():
+    profile = (ROOT / "suricata" / "ids-output.yaml").read_text()
+    assert "        - llmnr\n" not in profile
+    assert "        - ftp-data\n" not in profile
+    assert "        - ftp\n" in profile
+    assert "        - ike\n" in profile
+    assert "        - ike:\n            extended: yes\n" not in profile
+
+
+def test_ui_has_no_m_logo_or_llmnr_event_filter():
+    dashboard = (ROOT / "app" / "templates" / "index.html").read_text()
+    css = (ROOT / "app" / "static" / "css" / "app.css").read_text()
+    assert 'class="brand-mark"' not in dashboard
+    assert '>M</div>' not in dashboard
+    assert '<option>llmnr</option>' not in dashboard
+    assert '.brand-mark{' not in css
+
+
+def test_forensic_pcap_is_bounded_and_alert_conditional():
+    profile = (ROOT / "suricata" / "ids-output.yaml").read_text()
+    assert "- pcap-log:" in profile
+    assert "conditional: alerts" in profile
+    assert "limit: 64" in profile
+    assert "max-files: 8" in profile
+
+
+def test_multistage_xbits_rules_are_present():
+    rules = (ROOT / "suricata" / "local.rules").read_text()
+    assert "xbits:set,ms_ext_scanner" in rules
+    assert "xbits:isset,ms_ext_scanner" in rules
+    assert "xbits:set,ms_lateral_probe" in rules
+    assert "xbits:isset,ms_lateral_probe" in rules
+    for sid in range(1000120, 1000124):
+        assert f"sid:{sid};" in rules
+
+
+def test_intelligence_ui_exposes_pcap_and_incident_triage():
+    dashboard = (ROOT / "app" / "templates" / "index.html").read_text()
+    js = (ROOT / "app" / "static" / "js" / "app.js").read_text()
+    assert 'id="pcapRows"' in dashboard
+    assert "/api/forensics/pcaps" in js
+    assert "/api/admin/ndr/incidents/status" in js
+
+
+def test_cleartext_ftp_syn_rule_has_explicit_flow_direction():
+    rules = (ROOT / "suricata" / "local.rules").read_text()
+    line = next(line for line in rules.splitlines() if "sid:1000113;" in line)
+    assert "flow:to_server,stateless;" in line
+    assert "rev:2;" in line