Standardize some proxy drop summary verbiage

This commit is contained in:
Jonathan Claudius 2018-10-11 15:32:22 -04:00
Родитель 341a6f7a9c
Коммит 0d9e63895d
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: 4BCDD990313DFA87
2 изменённых файлов: 3 добавлений и 3 удалений

Просмотреть файл

@ -53,7 +53,7 @@ class AlertProxyDropNonStandardPort(AlertTask):
for event in aggreg['allevents']:
destinations.add(event['_source']['details']['destination'])
summary = 'Suspicious Proxy DROP events detected from {0} to the following non-std port(s): {1}'.format(
summary = 'Suspicious Proxy DROP events detected from {0} to the following non-std port desintation(s): {1}'.format(
aggreg['value'],
",".join(sorted(destinations))
)

Просмотреть файл

@ -52,12 +52,12 @@ class TestAlertProxyDropNonStandardPort(AlertTestSuite):
"category": "squid",
"tags": ['squid', 'proxy'],
"severity": "WARNING",
"summary": 'Suspicious Proxy DROP events detected from 1.2.3.4 to the following non-std port(s): evil.com:6667'
"summary": 'Suspicious Proxy DROP events detected from 1.2.3.4 to the following non-std port destination(s): evil.com:6667'
}
default_alert_aggregated = AlertTestSuite.copy(default_alert)
default_alert_aggregated[
"summary"] = 'Suspicious Proxy DROP events detected from 1.2.3.4 to the following non-std port(s): evil.com:1337,evil.com:6667'
"summary"] = 'Suspicious Proxy DROP events detected from 1.2.3.4 to the following non-std port destination(s): evil.com:1337,evil.com:6667'
test_cases = []