Project

General

Profile

Actions

Feature #5262

open

run.py: should tell which fields are mismatching

Added by Shivani Bhardwaj almost 2 years ago. Updated 2 months ago.

Status:
Assigned
Priority:
Normal
Target version:
Effort:
Difficulty:
Label:
Python

Description

Something like

Sub task 1
----------
        email.to[0]: <recipient@example.com>
        event_type: smtp
        pcap_cnt: 89                                 <---- Mismatch
        proto: TCP 
        smtp.helo: client-1016363.example.int
        tx_id: 0

would be nice since it'll help us see which fields exactly to look at unless the entire event is missing.

Idea proposed by: Victor Julien

Actions #1

Updated by Shivani Bhardwaj almost 2 years ago

  • Description updated (diff)
Actions #2

Updated by Victor Julien over 1 year ago

  • Assignee changed from Community Ticket to Shivani Bhardwaj
Actions #3

Updated by Shivani Bhardwaj 2 months ago

This turned out harder than expected bc the match object does not carry the context.
The way we go about it is:
1. Go over each event and try to match against a filter, return immediately in case of a mismatch.
2. If there was a match, increment the match count.
3. Check if the match count is the expected count in the test.

Actions

Also available in: Atom PDF