mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-09 12:57:13 +00:00
marc
d6d0faf218
End-to-end regression test for the SDL Stormshield parser: - test.py single upload + 150s polling verifier - send_burst.py 4 varied events (different users, IPs, actions) with current timestamps - verify_query.py query last 15 min of stormshield events - run_and_verify.sh burst + 40s wait + verify - config.example.json template (config.json is gitignored) - README.md setup, run, behaviour-quirks docs Use against a real SDL tenant after deploying parsers/stormshield. Confirms parser='stormshield', dataSource.name='Stormshield', and the 5 OCSF rewrites (src_endpoint.ip/port, dst_endpoint.ip/port, actor.user.name).
14 lines
228 B
Plaintext
14 lines
228 B
Plaintext
.env
|
|
mcp_config.txt
|
|
__pycache__/
|
|
*.pyc
|
|
node_modules/
|
|
.next/
|
|
frontend/out/
|
|
pgdata/
|
|
data/
|
|
|
|
# Parsers ARE committed in this fork (snapshot of the demo tenant).
|
|
# .env still excluded for safety.
|
|
tools/stormshield-verify/config.json
|