mentat.idea.test_sqldb module

Unit test module for testing the mentat.idea.sqldb module.

class mentat.idea.test_sqldb.TestMentatIdeaJSON(methodName='runTest')[source]

Bases: TestCase

Unit test class for testing the mentat.idea.sqldb module.

idea_raw_1 = {'Attach': [{'Handle': 'att1', 'FileName': ['killemall'], 'Type': ['Malware'], 'ContentType': 'application/octet-stream', 'Hash': ['sha1:0c4a38c3569f0cc632e74f4c'], 'Size': 46, 'Ref': ['Trojan-Spy:W32/FinSpy.A'], 'ContentEncoding': 'base64', 'Content': 'TVpqdXN0a2lkZGluZwo='}], 'Category': ['Fraud.Phishing', 'Test'], 'CeaseTime': '2012-11-03T09:55:22Z', 'Confidence': 1.0, 'ConnCount': 20, 'CreateTime': '2012-11-03T10:00:02Z', 'Description': 'Synthetic example', 'DetectTime': '2012-11-03T10:00:07Z', 'EventTime': '2012-11-03T07:36:00Z', 'Format': 'IDEA0', 'ID': '4390fc3f-c753-4a3e-bc83-1b44f24baf75', 'Node': [{'Name': 'org.example.kippo_honey', 'Realm': 'cesnet.cz', 'Type': ['Protocol', 'Honeypot'], 'SW': ['Kippo'], 'AggrWin': '00:05:00'}], 'Note': 'Synthetic example note', 'Ref': ['cve:CVE-1234-5678'], 'Source': [{'Type': ['Phishing'], 'IP4': ['192.168.0.2-192.168.0.5', '192.168.0.0/25', '192.168.1.1'], 'IP6': ['2001:db8::ff00:42:0/112', '2001:db8::ff00:42:50'], 'Hostname': ['example.com'], 'URL': ['http://example.com/cgi-bin/killemall'], 'Proto': ['tcp', 'http'], 'AttachHand': ['att1'], 'Netname': ['ripe:IANA-CBLK-RESERVED1']}], 'Target': [{'Type': ['Backscatter', 'OriginSpam'], 'Email': ['innocent@example.com'], 'IP6': ['2001:ffff::ff00:42:0/112'], 'Port': [22, 25, 443], 'Proto': ['tcp', 'http'], 'Spoofed': True}, {'Type': ['CasualIP'], 'IP4': ['10.2.2.0/24'], 'Port': [22, 25, 443], 'Proto': ['tcp', 'HTTP'], 'Anonymised': True}], 'WinEndTime': '2012-11-03T10:00:00Z', 'WinStartTime': '2012-11-03T05:00:00Z', '_Mentat': {'EventClass': 'vulnerable-config-ssdp', 'EventSeverity': 'low', 'EventTemplate': 'sserv-012', 'Impact': 'System provides SDDP service and can be misused for massive DDoS attack', 'InspectionErrors': ['Demonstration error - first', 'Demonstration error - second'], 'ResolvedAbuses': ['abuse@cesnet.cz'], 'StorageTime': '2017-04-05T10:21:39Z'}}
idea_raw_2 = {'Category': ['Fraud.Phishing', 'Test'], 'DetectTime': '2012-11-03T10:00:07Z', 'Format': 'IDEA0', 'ID': '4390fc3f-c753-4a3e-bc83-1b44f24baf76', 'Node': [{'Name': 'org.example.kippo_honey', 'Realm': 'cesnet.cz', 'Type': ['Protocol', 'Honeypot'], 'SW': ['Kippo'], 'AggrWin': '00:05:00'}, {'Name': 'org.example.kippo_honey2', 'Realm': 'cesnet.cz', 'Type': ['Protocol', 'Honeypot'], 'SW': ['Kippo'], 'AggrWin': '00:05:00'}]}
idea_raw_3 = {'Category': ['Fraud.Phishing', 'Test'], 'DetectTime': '2012-11-03T10:00:07Z', 'Format': 'IDEA0', 'ID': '4390fc3f-c753-4a3e-bc83-1b44f24baf76', 'Node': [{'Name': 'org.example.kippo_honey', 'Realm': 'cesnet.cz', 'Type': ['Protocol', 'Honeypot'], 'SW': ['Kippo'], 'AggrWin': '00:05:00'}, {'Type': ['External']}]}
idea_raw_4 = {'Category': ['Fraud.Phishing', 'Test'], 'DetectTime': '2012-11-03T10:00:07Z', 'Format': 'IDEA0', 'ID': '4390fc3f-c753-4a3e-bc83-1b44f24baf77', 'Node': [{'Realm': 'cesnet.cz', 'Type': ['Protocol', 'Honeypot'], 'SW': ['Kippo'], 'AggrWin': '00:05:00'}, {'Type': ['External']}]}
test_01_conv_internal()[source]

Perform basic parsing and conversion tests from menat.idea.internal.Idea class messages. For the purposes of comparison, the menat.idea.internal.Idea class is also tested here.

test_02_missing_node_names()[source]

Perform test of presence of node names in the event.

verbose = False