42 lines
1.5 KiB
Python
42 lines
1.5 KiB
Python
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
|
|
from enodia_sentinel.config import Config
|
|
from enodia_sentinel.detectors import first_seen
|
|
from enodia_sentinel.system import Socket, SystemState
|
|
|
|
|
|
class TestFirstSeen(unittest.TestCase):
|
|
def setUp(self):
|
|
self.dir = tempfile.TemporaryDirectory()
|
|
self.cfg = Config()
|
|
self.cfg.log_dir = Path(self.dir.name)
|
|
|
|
def tearDown(self):
|
|
self.dir.cleanup()
|
|
|
|
def test_first_pass_baselines_without_alerting_then_new_dest_alerts(self):
|
|
first = SystemState(sockets=[
|
|
Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:443", 1, "curl", 400, "tcp"),
|
|
])
|
|
self.assertEqual(list(first_seen.detect(first, self.cfg)), [])
|
|
second = SystemState(sockets=[
|
|
Socket("ESTAB", "10.0.0.2:5001", "1.1.1.1:8443", 2, "curl", 400, "tcp"),
|
|
])
|
|
alerts = list(first_seen.detect(second, self.cfg))
|
|
self.assertEqual(alerts[0].sid, first_seen.SID_FIRST_PUBLIC_DESTINATION)
|
|
|
|
def test_new_listener_port_alerts_after_baseline(self):
|
|
list(first_seen.detect(SystemState(sockets=[
|
|
Socket("LISTEN", "0.0.0.0:8000", "*:*", 1, "python3", 401, "tcp"),
|
|
]), self.cfg))
|
|
alerts = list(first_seen.detect(SystemState(sockets=[
|
|
Socket("LISTEN", "0.0.0.0:9000", "*:*", 2, "python3", 401, "tcp"),
|
|
]), self.cfg))
|
|
self.assertEqual(alerts[0].sid, first_seen.SID_FIRST_LISTENER_PORT)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|