cisagov / cisagov/ACID

include test PCAPs and baseline logs

Open
#2 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Zeek
Stars
78
Forks
4
PR merge metrics
No merged PRs in 30d

Description

Best practice for creating Zeek packages is to include a [tests](https://github.com/zeek/package-template/tree/master/tests) directory with PCAPs included (usually in a "Traces" sub-directory) and then a Baseline directory with logs generated by your plugin. At installation zkg runs the tests against the test PCAPs and makes sure the baseline tests match those which are generated. This helps for regression testing as well as helping users of the plugin make sure it's being installed and loaded correctly.

I'd suggest including at least one test PCAP each for BACnet, ENIP/CIP, and S7comm.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.