зеркало из https://github.com/mozilla/MozDef.git
Standardize some proxy drop summary verbiage
This commit is contained in:
Родитель
341a6f7a9c
Коммит
0d9e63895d
|
@ -53,7 +53,7 @@ class AlertProxyDropNonStandardPort(AlertTask):
|
|||
for event in aggreg['allevents']:
|
||||
destinations.add(event['_source']['details']['destination'])
|
||||
|
||||
summary = 'Suspicious Proxy DROP events detected from {0} to the following non-std port(s): {1}'.format(
|
||||
summary = 'Suspicious Proxy DROP events detected from {0} to the following non-std port desintation(s): {1}'.format(
|
||||
aggreg['value'],
|
||||
",".join(sorted(destinations))
|
||||
)
|
||||
|
|
|
@ -52,12 +52,12 @@ class TestAlertProxyDropNonStandardPort(AlertTestSuite):
|
|||
"category": "squid",
|
||||
"tags": ['squid', 'proxy'],
|
||||
"severity": "WARNING",
|
||||
"summary": 'Suspicious Proxy DROP events detected from 1.2.3.4 to the following non-std port(s): evil.com:6667'
|
||||
"summary": 'Suspicious Proxy DROP events detected from 1.2.3.4 to the following non-std port destination(s): evil.com:6667'
|
||||
}
|
||||
|
||||
default_alert_aggregated = AlertTestSuite.copy(default_alert)
|
||||
default_alert_aggregated[
|
||||
"summary"] = 'Suspicious Proxy DROP events detected from 1.2.3.4 to the following non-std port(s): evil.com:1337,evil.com:6667'
|
||||
"summary"] = 'Suspicious Proxy DROP events detected from 1.2.3.4 to the following non-std port destination(s): evil.com:1337,evil.com:6667'
|
||||
|
||||
test_cases = []
|
||||
|
||||
|
|
Загрузка…
Ссылка в новой задаче