luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add typed host event egress rule

Browse source
This commit is contained in:
Luna 2026-07-09 06:04:30 -07:00
parent 0b010df514
commit 3b037646d2
15 changed files with 360 additions and 31 deletions
Download patch file Download diff file Expand all files Collapse all files

32
tests/test_ruleops.py
View file

@ -18,9 +18,13 @@ class TestRuleOps(unittest.TestCase):
sids = {r["sid"] for r in rules}
self.assertIn(100001, sids)
self.assertIn(100060, sids)
self.assertIn(100067, sids)
exec_rule = next(r for r in rules if r["sid"] == 100002)
self.assertEqual(exec_rule["event"], "exec")
self.assertIn("argv_regex", exec_rule["conditions"])
host_rule = next(r for r in rules if r["sid"] == 100067)
self.assertEqual(host_rule["event"], "tcp_connect")
self.assertIn("peer_port_exclude", host_rule["conditions"])
def test_configured_exec_rule_is_listed(self):
with tempfile.TemporaryDirectory() as d:
@ -66,6 +70,33 @@ exec_comm = ["id"]
alerts = ruleops.test_event(cfg, event)
self.assertIn(100060, {a.sid for a in alerts})
def test_matches_host_event_json(self):
cfg = Config()
event = {
"event": "tcp_connect",
"pid": 42,
"ppid": 1,
"uid": 1000,
"comm": "python3",
"peer_ip": "8.8.8.8",
"peer_port": 4444,
}
alerts = ruleops.test_event(cfg, event)
self.assertIn(100067, {a.sid for a in alerts})
def test_host_event_common_public_port_no_match(self):
cfg = Config()
event = {
"event": "tcp_connect",
"pid": 42,
"ppid": 1,
"uid": 1000,
"comm": "python3",
"peer_ip": "8.8.8.8",
"peer_port": 443,
}
self.assertEqual(ruleops.test_event(cfg, event), [])
def test_render_markdown_documents_rules(self):
text = ruleops.render_markdown(Config())
self.assertIn("# Enodia Sentinel Event Rule Reference", text)
@ -136,6 +167,7 @@ class TestRulesCli(unittest.TestCase):
self.assertEqual(code, 0)
self.assertIn("Enodia Sentinel Event Rule Reference", out)
self.assertIn("SID 100060", out)
self.assertIn("SID 100067", out)
self.assertIn("Expected false positives", out)