45 lines
1.4 KiB
Go
45 lines
1.4 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package detectors
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/config"
|
|
"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
|
|
)
|
|
|
|
func TestFirstSeenAlertsNewDestinationAndListener(t *testing.T) {
|
|
pid := 42
|
|
cfg := config.Default()
|
|
alerts := FirstSeen(model.State{
|
|
FirstSeenInitialized: true,
|
|
FirstSeenPublicDestinations: map[string][]string{"bash": {"1.1.1.1:443"}},
|
|
FirstSeenListenerPorts: map[string][]string{"nc": {"22"}},
|
|
Sockets: []model.Socket{
|
|
{State: "ESTAB", Peer: "8.8.8.8:4443", Comm: "bash", PID: &pid},
|
|
{State: "LISTEN", Local: "0.0.0.0:31337", Comm: "nc", PID: &pid, Kind: "tcp"},
|
|
},
|
|
}, cfg)
|
|
if len(alerts) != 2 || alerts[0].SID != 100074 || alerts[1].SID != 100075 {
|
|
t.Fatalf("got %#v", alerts)
|
|
}
|
|
}
|
|
|
|
func TestFirstSeenUninitializedIsSilent(t *testing.T) {
|
|
cfg := config.Default()
|
|
state := model.State{
|
|
FirstSeenPublicDestinations: map[string][]string{},
|
|
FirstSeenListenerPorts: map[string][]string{},
|
|
Sockets: []model.Socket{
|
|
{State: "ESTAB", Peer: "8.8.8.8:443", Comm: "bash"},
|
|
{State: "ESTAB", Peer: "8.8.8.8:443", Comm: "bash"},
|
|
},
|
|
}
|
|
if alerts := FirstSeen(state, cfg); len(alerts) != 0 {
|
|
t.Fatalf("got %#v", alerts)
|
|
}
|
|
if got := state.FirstSeenPublicDestinations["bash"]; len(got) != 1 || got[0] != "8.8.8.8:443" {
|
|
t.Fatalf("silent learning did not update state once: %#v", got)
|
|
}
|
|
}
|