tests: iprep isset/isnotset test

jufajardini · Jun 15, 2024 · c7c5a87 · c7c5a87
1 parent cec348e
commit c7c5a87
Show file tree

Hide file tree

Showing 6 changed files with 27,607 additions and 0 deletions.
diff --git a/tests/iprep-11-isset/README.md b/tests/iprep-11-isset/README.md
@@ -0,0 +1,9 @@
+# Test Description
+
+Test iprep isset and isnotset options.
+
+4.4.4.4 and 8.8.8.8 are in the list, so isset should match twice.
+
+192.168.0.13 is not in the list, so should match once.
+
+Rules are evaluated as ip-only.
diff --git a/tests/iprep-11-isset/iprep.rules b/tests/iprep-11-isset/iprep.rules
@@ -0,0 +1,2 @@
+alert ip any any -> any any (sid:1; iprep:dst,2402000,isset;)
+alert ip any any -> any any (sid:2; iprep:dst,2402000,isnotset;)
diff --git a/tests/iprep-11-isset/scirius-categories.txt b/tests/iprep-11-isset/scirius-categories.txt
@@ -0,0 +1,10 @@
+1,2520000,ET TOR Known Tor Exit Node Traffic
+2,2522000,ET TOR Known Tor Relay/Router (Not Exit) Node Traffic
+3,2403300,ET CINS Active Threat Intelligence Poor Reputation IP
+4,2525000,ET 3CORESec Poor Reputation IP
+5,2400000,ET DROP Spamhaus DROP Listed Traffic Inbound
+6,2500000,ET COMPROMISED Known Compromised or Hostile Host Traffic
+7,2404033,ET CNC Shadowserver Reported CnC Server
+8,2404000,ET CNC Shadowserver Reported CnC Server IP
+9,2404300,ET CNC Feodo Tracker Reported CnC Server
+10,2402000,ET DROP Dshield Block Listed Source