diff --git a/tests/datarep-8768/datarep.rules b/tests/datarep-8768/datarep.rules new file mode 100644 index 0000000000..fd0bdd8f46 --- /dev/null +++ b/tests/datarep-8768/datarep.rules @@ -0,0 +1,2 @@ +alert dns any any -> any any (dns.query; to_md5; datarep:dns_md5, >, 200, load dns_md5.rep, type md5; sid:1;) +alert dns any any -> any any (dns.query; to_sha256; datarep:dns_sha256, >, 200, load dns_sha256.rep, type sha256; sid:2;) diff --git a/tests/datarep-8768/dns_md5.rep b/tests/datarep-8768/dns_md5.rep new file mode 100644 index 0000000000..64a94672de --- /dev/null +++ b/tests/datarep-8768/dns_md5.rep @@ -0,0 +1 @@ +5ababd603b2278,101 diff --git a/tests/datarep-8768/dns_sha256.rep b/tests/datarep-8768/dns_sha256.rep new file mode 100644 index 0000000000..64a94672de --- /dev/null +++ b/tests/datarep-8768/dns_sha256.rep @@ -0,0 +1 @@ +5ababd603b2278,101 diff --git a/tests/datarep-8768/test.yaml b/tests/datarep-8768/test.yaml new file mode 100644 index 0000000000..1b68ebc8fa --- /dev/null +++ b/tests/datarep-8768/test.yaml @@ -0,0 +1,13 @@ +requires: + min-version: 9 + +pcap: ../datarep-01/input.pcap + +args: + - -k none + +checks: + - filter: + count: 0 + match: + event_type: alert