luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add typed host event egress rule

Browse source
This commit is contained in:
Luna 2026-07-09 06:04:30 -07:00
parent 0b010df514
commit 3b037646d2
15 changed files with 360 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

14
tests/test_rule_compat.py
View file

@ -71,9 +71,21 @@ class TestRuleEventCompatibility(unittest.TestCase):
}
self.assertIn(100061, self._sids(event))
def test_host_event_accepts_tcp_connect_shape(self):
event = {
"event": "tcp_connect",
"pid": "4242",
"ppid": "1",
"uid": "1000",
"comm": "python3",
"remote_ip": "8.8.8.8",
"remote_port": "4444",
}
self.assertIn(100067, self._sids(event))
def test_unknown_event_shape_still_errors(self):
with self.assertRaisesRegex(
ValueError, "event JSON must be an exec or syscall event"
ValueError, "event JSON must be an exec, syscall, or host event"
):
ruleops.test_event(self.cfg, {"pid": 4242})