{"id":18011072,"url":"https://github.com/regit/suricata-verify-orig","last_synced_at":"2025-04-04T13:16:21.220Z","repository":{"id":141524938,"uuid":"114117963","full_name":"regit/suricata-verify-orig","owner":"regit","description":"Suricata Verification Tests - Testing Suricata Output","archived":false,"fork":false,"pushed_at":"2019-02-19T21:43:00.000Z","size":778,"stargazers_count":0,"open_issues_count":0,"forks_count":2,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-02-09T22:46:07.521Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/regit.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2017-12-13T12:27:40.000Z","updated_at":"2019-02-20T08:14:44.000Z","dependencies_parsed_at":null,"dependency_job_id":"7e46763f-e2e2-4993-8af7-3142114b15c1","html_url":"https://github.com/regit/suricata-verify-orig","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/regit%2Fsuricata-verify-orig","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/regit%2Fsuricata-verify-orig/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/regit%2Fsuricata-verify-orig/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/regit%2Fsuricata-verify-orig/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/regit","download_url":"https://codeload.github.com/regit/suricata-verify-orig/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247182422,"owners_count":20897381,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-30T02:16:22.167Z","updated_at":"2025-04-04T13:16:21.195Z","avatar_url":"https://github.com/regit.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Suricata Verification Tests\n\nThese are tests that run Suricata with a specific configuration and/or\ninputs and verify the outputs.\n\n## Running All Tests\n\nFrom your Suricata source directory run:\n\n```\n../path/to/suricata-verify/run.py\n```\n\nOr to run a single test:\n```\n../path/to/suricata-tests/run.py TEST-NAME\n```\n\n## Adding a New Test\n\n- Create a directory that is the name of the new test.\n\n- Copy a single pcap file into the test directory. It must end in\n  \".pcap\" or \".pcapng\".\n\n  This is enough for a basic test that will run Suricata over the pcap\n  testing for a successful exit code.\n\n- Optional: Create a suricata.yaml in the test directory.\n\n    Note: You may want to add something like:\n    ```\n    include: ../../etc/suricata-4.0.3.yaml\n    ```\n    to the top and then just make the necessary overrides in the tests\n    suricata.yaml.\n\n\tIf the test directory does not include a suricata.yaml, the one\n    found in your build directory will be used.\n\n- Add any rules required to ${dir}/test.rules.\n\n- Add a *test.yaml* descriptor file to add further control to your\n  tests such as restricting features required for the test, and\n  validating output.\n\n## Example test.yaml\n\n```\nrequires:\n\n  # Require a minimum version of Suricata.\n  min-version: 4.1.0\n\n  # Test is only for this version. For example, 4.0 would match any 4.0 \n  # release, but 4.0.3 would only match 4.0.3.\n  version: 4.0\n\n  # Require the presence of specific features.\n  features:\n    # Restrict the test to builds with HAVE_LUA.\n    - HAVE_LUA\n\n  # Don't require a pcap file to be present. By default a test will be skipped\n  # if there is no pcap file in the test directory. Not applicable if a\n  # command is provided.\n  pcap: false\n\n  # Run the script and only continue with the test if the script exists\n  # successfully.\n  script:\n\t- command1\n\t- command2\n\t- ...\n\nskip:\n  # Skip a test if a feature is present, with a message that is logged.\n  - feature: RUST\n    msg: eve dns v1 not supported by rust\n\n# Add additional arguments to Suricata.\nargs:\n  - --set stream.reassembly.depth=0\n\n# Override the default command. This is also an example of how it can\n# be broken up over multiple lines for readability. If providing the command\n# all arguments must be provided as part of the command.\ncommand: |\n  ${SRCDIR}/src/suricata -T -c ${TEST_DIR}/suricata.yaml -vvv \\\n      -l ${TEST_DIR}/output --set default-rule-path=\"${TEST_DIR}\"\n\n# Execute Suricata with the test parameters this many times. All checks will\n# done after each iteration.\ncount: 10\n\npre-check: |\n  # Some script to run before running checks.\n  cp eve.json eve.json.bak\n\nchecks:\n\n  # A verification filter that is run over the eve.json. Multiple\n  # filters may exist and all must pass for the test to pass.\n  - filter:\n      # The number of records this filter should match.\n\t  count: 1\n\t  \n\t  # The fields to match on.\n\t  match:\n\t    # Example match on event_type:\n\t\tevent_type: alert\n\t\t\n\t\t# Example match on array item:\n\t\talert.metadata.tag[0]: \"tag1\"\n\t\t\n\t\t# Check that a field exists:\n\t\thas-key: alert.rule\n\t\t\n\t\t# Check that a field does not exist:\n\t\tnot-has-key: flow\n```\t\t\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fregit%2Fsuricata-verify-orig","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fregit%2Fsuricata-verify-orig","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fregit%2Fsuricata-verify-orig/lists"}