Added extra correct decoder information

Dockerfile.live

@@ -0,0 +1,31 @@
+FROM wazuh/wazuh-manager:4.8.0
+
+#=========================================#
+#=== CHANGE THIS TO YOUR PIPELINE REPO ===#
+#=========================================#
+ENV PIPELINE_REPO=https://github.com/alexchristy/wazuh-pipeline.git
+#=========================================#
+
+ENV WAZUH_TEST_REPO=https://github.com/alexchristy/WazuhTest.git
+
+WORKDIR /root
+
+# Clone repos
+RUN yum install git iproute golang -y 
+RUN git clone $PIPELINE_REPO wazuh_pipeline
+RUN git clone $WAZUH_TEST_REPO wazuh_test
+
+# Install WazuhTest framework
+WORKDIR /root/wazuh_test
+RUN go build .
+RUN chmod 751 WazuhTest
+RUN cp ./WazuhTest /usr/bin
+
+WORKDIR /root/wazuh_pipeline
+
+RUN chmod +x ./*.sh
+
+# Expose necessary ports
+EXPOSE 1514/tcp 1515/tcp 1516/tcp 514/udp 55000/tcp
+
+ENTRYPOINT ["/bin/sh", "/root/wazuh_pipeline/main.sh", "-i"]

main.sh

@@ -1,5 +1,27 @@
 #!/bin/sh
 
+# ====( FUNCTIONS )==== #
+usage() {
+    echo "Usage: $0 [-i]"
+    echo "  -i    Run the container in interactive mode."
+    exit 1
+}
+
+parse_args() {
+    INTERACTIVE_MODE=false
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            -i)
+                INTERACTIVE_MODE=true
+                shift
+                ;;
+            *)
+                usage
+                ;;
+        esac
+    done
+}
+
 # ====( CONSTANTS )==== #
 PIPELINE_REPO_PATH="/root/wazuh_pipeline"
 
@@ -11,6 +33,9 @@ PIPELINE_REPO_PATH="/root/wazuh_pipeline"
 # =====( MAIN )===== #
 setup_logging
 
+# Parse arguments
+parse_args "$@"
+
 log_message "$INFO_LVL" "Starting wazuh manager..."
 /init &
 
@@ -40,8 +65,15 @@ fi
 
 # Run tests
 log_message "$INFO_LVL" "Running tests..."
-if ! sh ./run_tests.sh; then
-    exit "$EXIT_ERR"
+passed=$(sh ./run_tests.sh)
+
+if [ "$INTERACTIVE_MODE" = true ]; then
+    log_message "$INFO_LVL" "Running in interactive mode"
+    /bin/sh
+else
+    if ! $passed; then
+        exit "$EXIT_ERR"
+    fi
 fi
 
 exit "$EXIT_SUCCESS"

tests/ubuntu/test_ssh.json

@@ -18,7 +18,11 @@
             "RuleDescription": "sshd: Attempt to login using a non-existent user",
             "LogFilePath": "5710-local-net.txt",
             "Predecoder": {},
-            "Decoder": {}
+            "Decoder": {
+                "srcip": "10.0.0.4",
+                "srcport": "59528",
+                "srcuser": "non-existent"
+            }
         }
     ]
-}
+}