detect: add test for flow.rate keyword

Feature 7438
inashivb · Dec 5, 2024 · f65cee7 · f65cee7
1 parent 5fe298c
commit f65cee7
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 0 deletions.
diff --git a/tests/rules/flow_rate/test.rules b/tests/rules/flow_rate/test.rules
@@ -0,0 +1,2 @@
+alert tcp any any -> any any (msg:"Flow rate is 500 bytes per second"; flow.rate:500; sid:1;)
+pass tcp any any -> any any (msg:"Flow rate is greater than 5 mbytes per second"; flow.rate:>5mb; alert; sid:2;)
diff --git a/tests/rules/flow_rate/test.yaml b/tests/rules/flow_rate/test.yaml
@@ -0,0 +1,22 @@
+requires:
+    min-version: 8.0
+    pcap: false
+
+args:
+    - --engine-analysis
+
+checks:
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      id: 1
+      lists.packet.matches[0].name: "flow.rate"
+      lists.packet.matches[0].flow_rate.equal: 500
+- filter:
+    filename: rules.json
+    count: 1
+    match:
+      id: 2
+      lists.packet.matches[0].name: "flow.rate"
+      lists.packet.matches[0].flow_rate.gt: 5242880
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		alert tcp any any -> any any (msg:"Flow rate is 500 bytes per second"; flow.rate:500; sid:1;)
		pass tcp any any -> any any (msg:"Flow rate is greater than 5 mbytes per second"; flow.rate:>5mb; alert; sid:2;)