test/test_alerts.rb in trisulrp-1.2.7 vs test/test_alerts.rb in trisulrp-1.2.8
- old
+ new
@@ -3,46 +3,29 @@
# Testing change
require 'rubygems'
require './helper'
include TrisulRP::Protocol
-require guidmap
+include TrisulRP::Keys
+
class TestTrisulrp < Test::Unit::TestCase
def test_query_alerts
- target_ip = "0A.02.C7.EB" # 10.2.199.235"
+ target_ip = "10.1.10.10" # 10.2.199.235"
+
TrisulRP::Protocol.connect("127.0.0.1",12001,"Demo_Client.crt","Demo_Client.key") do |conn|
+
tm_arr = TrisulRP::Protocol.get_available_time(conn)
- req =TrisulRP::Protocol.mk_request(:context => 0,:alert_group =>TrisulRP::Guids::AG_IDS, :source_ip => target_ip,
- :maxitems => 1000,
- :time_interval => TRPLib.mk_time_interval(tm_arr))
- TrisulRP::Protocol.get_response(conn,req) do |resp|
- follow_up = TrisulRP::Protocol.mk_request(:alert_group => TrisulRP::Guids::AG_IDS)
- resp.alert_group_response.alerts.each do |al|
- follow_up.alert_item_request.alert_ids << TRP::AlertID.new(:slice_id => al.slice_id, :alert_id => al.alert_id)
- end
+ req =TrisulRP::Protocol.mk_request(TRP::Message::Command::ALERT_GROUP_REQUEST,
+ :alert_group =>TrisulRP::Guids::AG_IDS,
+ :source_ip => TrisulRP::Keys.make_key(target_ip),
+ :maxitems => 1000,
+ :time_interval => mk_time_interval(tm_arr))
- TrisulRP::Protocol.getresponse(conn,follow_up) do | resp2 |
- resp=resp2.alert_item_response
- resolv_candidates = resp.items.collect { |item| [item.source_ip, item.source_port, item.destination_ip, item.destination_port,item.sigid] }
- resolv_arr = resolv_candidates.transpose
- sip_names = TrisulRP::Protocol.get_labels_for_keys(conn,TrisulRP::Guids::CG_HOSTS, resolv_arr[0])
- sport_names = TrisulRP::Protocol.get_labels_for_keys(conn,TrisulRP::Guids::CG_APPS, resolv_arr[1])
- dip_names = TrisulRP::Protocol.get_labels_for_keys(conn,TrisulRP::Guids::CG_HOSTS, resolv_arr[2])
- dport_names = TrisulRP::Protocol.get_labels_for_keys(conn,TrisulRP::Guids::CG_APPS, resolv_arr[3])
- sigid_names = TrisulRP::Protocol.get_labels_for_keys(conn,TrisulRP::Guids::CG_SIGDS, resolv_arr[4])
- resp.items.each do |item|
- print "#{Time.at(item.time.tv_sec)} "
- print "#{sip_names[item.source_ip]}".ljust(28)
- print "#{sport_names[item.source_port]}".ljust(11)
- print "#{dip_names[item.destination_ip]}".ljust(28)
- print "#{dport_names[item.destination_port]}".ljust(11)
- print "#{sigid_names[item.sigid]}".rjust(10)
- print "\n"
- end
- end
+ TrisulRP::Protocol.get_response(conn,req) do |resp|
+ print_alert_details(conn,resp.alert_group_response.alerts)
end
end
end
end