55 lines
2.0 KiB
Python
55 lines
2.0 KiB
Python
from pathlib import Path
|
|
|
|
ROOT = Path(__file__).resolve().parents[1]
|
|
|
|
|
|
def test_eve_profile_uses_suricata8_logger_names():
|
|
profile = (ROOT / "suricata" / "ids-output.yaml").read_text()
|
|
assert " - llmnr\n" not in profile
|
|
assert " - ftp-data\n" not in profile
|
|
assert " - ftp\n" in profile
|
|
assert " - ike\n" in profile
|
|
assert " - ike:\n extended: yes\n" not in profile
|
|
|
|
|
|
def test_ui_has_no_m_logo_or_llmnr_event_filter():
|
|
dashboard = (ROOT / "app" / "templates" / "index.html").read_text()
|
|
css = (ROOT / "app" / "static" / "css" / "app.css").read_text()
|
|
assert 'class="brand-mark"' not in dashboard
|
|
assert '>M</div>' not in dashboard
|
|
assert '<option>llmnr</option>' not in dashboard
|
|
assert '.brand-mark{' not in css
|
|
|
|
|
|
def test_forensic_pcap_is_bounded_and_alert_conditional():
|
|
profile = (ROOT / "suricata" / "ids-output.yaml").read_text()
|
|
assert "- pcap-log:" in profile
|
|
assert "conditional: alerts" in profile
|
|
assert "limit: 64" in profile
|
|
assert "max-files: 8" in profile
|
|
|
|
|
|
def test_multistage_xbits_rules_are_present():
|
|
rules = (ROOT / "suricata" / "local.rules").read_text()
|
|
assert "xbits:set,ms_ext_scanner" in rules
|
|
assert "xbits:isset,ms_ext_scanner" in rules
|
|
assert "xbits:set,ms_lateral_probe" in rules
|
|
assert "xbits:isset,ms_lateral_probe" in rules
|
|
for sid in range(1000120, 1000124):
|
|
assert f"sid:{sid};" in rules
|
|
|
|
|
|
def test_intelligence_ui_exposes_pcap_and_incident_triage():
|
|
dashboard = (ROOT / "app" / "templates" / "index.html").read_text()
|
|
js = (ROOT / "app" / "static" / "js" / "app.js").read_text()
|
|
assert 'id="pcapRows"' in dashboard
|
|
assert "/api/forensics/pcaps" in js
|
|
assert "/api/admin/ndr/incidents/status" in js
|
|
|
|
|
|
def test_cleartext_ftp_syn_rule_has_explicit_flow_direction():
|
|
rules = (ROOT / "suricata" / "local.rules").read_text()
|
|
line = next(line for line in rules.splitlines() if "sid:1000113;" in line)
|
|
assert "flow:to_server,stateless;" in line
|
|
assert "rev:2;" in line
|