shadowbq-threatinator 0.5.0

data/spec/feeds/infiltrated-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/infiltrated-ip_reputation.feed', :feed do
+  let(:provider) { 'infiltrated' }
+  let(:name) { 'ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.infiltrated.net/blacklisted'
+
+  describe_parsing_the_file feed_data('infiltrated_iplist.txt') do
+    it "should have parsed 14 records" do
+      expect(num_records_parsed).to eq(14)
+    end
+    it "should have filtered 2 records" do
+      expect(num_records_filtered).to eq(2)
+    end
+  end
+
+  describe_parsing_a_record '95.221.71.219' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['95.221.71.219'])) }
+    end
+  end
+
+  describe_parsing_a_record '94.41.71.52' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['94.41.71.52'])) }
+    end
+  end
+end

data/spec/feeds/infiltrated_vabl-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/infiltrated_vabl-ip_reputation.feed', :feed do
+  let(:provider) { 'infiltrated' }
+  let(:name) { 'vabl_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.infiltrated.net/vabl.txt'
+
+  describe_parsing_the_file feed_data('infiltrated_vabl_iplist.txt') do
+    it "should have parsed 21 records" do
+      expect(num_records_parsed).to eq(21)
+    end
+    it "should have filtered 12 records" do
+      expect(num_records_filtered).to eq(12)
+    end
+  end
+
+  describe_parsing_a_record '108.59.1.205 | BRU | VABL | 20110609 | e22b6e201b3533a0dd1ac8bb47426169 | 30633 | 108.59.0.0/20 | LEASEWEB-US | US | - | LEASEWEB USA INC' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['108.59.1.205'])) }
+    end
+  end
+
+  describe_parsing_a_record '109.169.60.121 | BRU | VABL | 20110621 | 8850509672ee7d983d9a511e31b13a9a | 29761 | 109.169.60.0/23 | OC3-NETWORKS-AS-NUMB | US | BMTRADAGROUP.COM | RAPIDSWITCH LTD' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['109.169.60.121'])) }
+    end
+  end
+end

data/spec/feeds/isc_suspicious_high-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/isc_suspicious_high-domain_reputation.feed', :feed do
+  let(:provider) { 'isc' }
+  let(:name) { 'suspicious_high_domain_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'https://isc.sans.edu/feeds/suspiciousdomains_High.txt'
+
+  describe_parsing_the_file feed_data('isc_suspicious_high_domainlist.txt') do
+    it "should have parsed 9 records" do
+      expect(num_records_parsed).to eq(9)
+    end
+    it "should have filtered 17 records" do
+      expect(num_records_filtered).to eq(17)
+    end
+  end
+
+  describe_parsing_a_record '1-verygoods.ru' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['1-verygoods.ru']) }
+    end
+  end
+
+  describe_parsing_a_record '123kochi.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['123kochi.com']) }
+    end
+  end
+end

data/spec/feeds/isc_suspicious_low-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/isc_suspicious_low-domain_reputation.feed', :feed do
+  let(:provider) { 'isc' }
+  let(:name) { 'suspicious_low_domain_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'https://isc.sans.edu/feeds/suspiciousdomains_Low.txt'
+
+  describe_parsing_the_file feed_data('isc_suspicious_low_domainlist.txt') do
+    it "should have parsed 17 records" do
+      expect(num_records_parsed).to eq(17)
+    end
+    it "should have filtered 17 records" do
+      expect(num_records_filtered).to eq(17)
+    end
+  end
+
+  describe_parsing_a_record '10kpictures.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['10kpictures.com']) }
+    end
+  end
+
+  describe_parsing_a_record '1492tapasbar.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['1492tapasbar.com']) }
+    end
+  end
+end

data/spec/feeds/isc_suspicious_medium-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/isc_suspicious_medium-domain_reputation.feed', :feed do
+  let(:provider) { 'isc' }
+  let(:name) { 'suspicious_medium_domain_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'https://isc.sans.edu/feeds/suspiciousdomains_Medium.txt'
+
+  describe_parsing_the_file feed_data('isc_suspicious_medium_domainlist.txt') do
+    it "should have parsed 15 records" do
+      expect(num_records_parsed).to eq(15)
+    end
+    it "should have filtered 17 records" do
+      expect(num_records_filtered).to eq(17)
+    end
+  end
+
+  describe_parsing_a_record '114oldest.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['114oldest.com']) }
+    end
+  end
+
+  describe_parsing_a_record '168asia.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['168asia.com']) }
+    end
+  end
+end

data/spec/feeds/malc0de-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/malc0de-domain_reputation.feed', :feed do
+  let(:provider) { 'malc0de' }
+  let(:name) { 'domain_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://malc0de.com/bl/BOOT'
+
+  describe_parsing_the_file feed_data('malc0de_domainlist.txt') do
+    it "should have parsed 12 records" do
+      expect(num_records_parsed).to eq(12)
+    end
+    it "should have filtered 6 records" do
+      expect(num_records_filtered).to eq(6)
+    end
+  end
+
+  describe_parsing_a_record 'PRIMARY opencandy.com blockeddomain.hosts' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['opencandy.com']) }
+    end
+  end
+
+  describe_parsing_a_record 'PRIMARY cachelocal.org blockeddomain.hosts' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['cachelocal.org']) }
+    end
+  end
+end

data/spec/feeds/malc0de-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/malc0de-ip_reputation.feed', :feed do
+  let(:provider) { 'malc0de' }
+  let(:name) { 'ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://malc0de.com/bl/IP_Blacklist.txt'
+
+  describe_parsing_the_file feed_data('malc0de_iplist.txt') do
+    it "should have parsed 10 records" do
+      expect(num_records_parsed).to eq(10)
+    end
+    it "should have filtered 4 records" do
+      expect(num_records_filtered).to eq(4)
+    end
+  end
+
+  describe_parsing_a_record '216.151.164.53' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['216.151.164.53'])) }
+    end
+  end
+
+  describe_parsing_a_record '176.32.99.47' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['176.32.99.47'])) }
+    end
+  end
+end

data/spec/feeds/malwaredomainlist_url_reputation_spec.rb

@@ -0,0 +1,50 @@
+require 'spec_helper'
+
+describe 'feeds/malwaredomainlist-url_reputation.feed', :feed do
+  let(:provider) { 'malwaredomainlist' }
+  let(:name) { 'url_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.malwaredomainlist.com/updatescsv.php'
+
+  describe_parsing_the_file feed_data('malwaredomainlist-url-reputation.txt') do
+    it "should have parsed 8 records" do
+      expect(num_records_parsed).to eq(8)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+    it "should have missed 0 records" do
+      expect(num_records_missed).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '"2014/09/17_10:11","qwe.affairedhonneur.us/depqfie59y","192.99.197.131","-","exploit kit","Ben Bazar / benbazar2011y@mail.com","16276"' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+	  its(:urls) { is_expected.to eq(build(:urls, values: ['http://qwe.affairedhonneur.us/depqfie59y'])) }
+    end
+  end
+
+  describe_parsing_a_record '"2014/10/01_09:30","aveconomic.trailswest.org:15106/haddan_files/stories.php","87.118.127.230","ns2.km33436-26.keymachine.de.","exploit kit","T Fankhauser / artstaff@stjoearts.org","31103"' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+	  its(:urls) { is_expected.to eq(build(:urls, values: ['http://aveconomic.trailswest.org:15106/haddan_files/stories.php'])) }
+    end
+  end
+end

data/spec/feeds/malwaredomains-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/malwaredomains-domain_reputation.feed', :feed do
+  let(:provider) { 'malwaredomains' }
+  let(:name) { 'domain_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://mirror1.malwaredomains.com/files/domains.txt'
+
+  describe_parsing_the_file feed_data('malwaredomains_domainlist.txt') do
+    it "should have parsed 20 records" do
+      expect(num_records_parsed).to eq(20)
+    end
+    it "should have filtered 4 records" do
+      expect(num_records_filtered).to eq(4)
+    end
+  end
+
+  describe_parsing_a_record '	20151231	qyrzfhilst.ru	attackpage	safebrowsing.google.com	20131227	20120308	20110512' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['qyrzfhilst.ru']) }
+    end
+  end
+
+  describe_parsing_a_record '	20151231	xc6.in	iframe	blog.unmaskparasites.com/2009/06/25/hidden-cn-iframes-are-still-prevalent	20131228	20110311	20090830' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(['xc6.in']) }
+    end
+  end
+end

data/spec/feeds/malwaredomains_dyndns-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/malwaredomains_dyndns-domain_reputation.feed', :feed do
+  let(:provider) { 'malwaredomains' }
+  let(:name) { 'dyndns_domain_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://mirror2.malwaredomains.com/files/dynamic_dns.txt'
+
+  describe_parsing_the_file feed_data('malwaredomains_dyndns_domainlist.txt') do
+    it "should have parsed 19 records" do
+      expect(num_records_parsed).to eq(19)
+    end
+    it "should have filtered 15 records" do
+      expect(num_records_filtered).to eq(15)
+    end
+  end
+
+  describe_parsing_a_record '1040ezdotcom.com	malicious	siteinspector.comodo.com/' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:fqdns) { is_expected.to match_array(['1040ezdotcom.com']) }
+    end
+  end
+
+  describe_parsing_a_record '1stresponderservices.com	malicious	siteinspector.comodo.com/' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:fqdns) { is_expected.to match_array(['1stresponderservices.com']) }
+    end
+  end
+end

data/spec/feeds/malwaredomains_justdomains-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/malwaredomains_justdomains-domain_reputation.feed', :feed do
+  let(:provider) { 'malwaredomains' }
+  let(:name) { 'justdomains_domain_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://mirror3.malwaredomains.com/files/justdomains'
+
+  describe_parsing_the_file feed_data('malwaredomains_justdomains_domainlist.txt') do
+    it "should have parsed 18 records" do
+      expect(num_records_parsed).to eq(18)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record 'cg79wo20kl92doowfn01oqpo9mdieowv5tyj.com' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(["cg79wo20kl92doowfn01oqpo9mdieowv5tyj.com"]) }
+    end
+  end
+
+  describe_parsing_a_record 'x6p.in' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:malware_host) }
+      its(:fqdns) { is_expected.to match_array(["x6p.in"]) }
+    end
+  end
+end

data/spec/feeds/mirc-domain_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/mirc-domain_reputation.feed', :feed do
+  let(:provider) { 'mirc' }
+  let(:name) { 'domain_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.mirc.com/servers.ini'
+
+  describe_parsing_the_file feed_data('mirc_domainlist.txt') do
+    it "should have parsed 13 records" do
+      expect(num_records_parsed).to eq(13)
+    end
+    it "should have filtered 18 records" do
+      expect(num_records_filtered).to eq(18)
+    end
+  end
+
+  describe_parsing_a_record 'n3=Random US serverSERVER:irc.us.dal.net:6665-6668,7000GROUP:DALnet' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:fqdns) { is_expected.to match_array(['irc.us.dal.net']) }
+    end
+  end
+
+  describe_parsing_a_record 'n7=US, WA, SeattleSERVER:serverbuffet.wa.us.dal.net:6665-6668,7000GROUP:DALnet' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:fqdns) { is_expected.to match_array(['serverbuffet.wa.us.dal.net']) }
+    end
+  end
+end

data/spec/feeds/multiproxy-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/multiproxy-ip_reputation.feed', :feed do
+  let(:provider) { 'multiproxy' }
+  let(:name) { 'ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://multiproxy.org/txt_all/proxy.txt'
+
+  describe_parsing_the_file feed_data('multiproxy_iplist.txt') do
+    it "should have parsed 15 records" do
+      expect(num_records_parsed).to eq(15)
+    end
+    it "should have filtered 0 records" do
+      expect(num_records_filtered).to eq(0)
+    end
+  end
+
+  describe_parsing_a_record '190.53.89.103:6588' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['190.53.89.103'])) }
+    end
+  end
+
+  describe_parsing_a_record '211.140.151.214:8080' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:scanning) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['211.140.151.214'])) }
+    end
+  end
+end

data/spec/feeds/nothink_irc-ip_reputation_spec.rb

@@ -0,0 +1,47 @@
+require 'spec_helper'
+
+describe 'feeds/nothink_irc-ip_reputation.feed', :feed do
+  let(:provider) { 'nothink' }
+  let(:name) { 'irc_ip_reputation' }
+  let(:event_types) { [:scanning]}
+
+
+  it_fetches_url 'http://www.nothink.org/blacklist/blacklist_malware_irc.txt'
+
+  describe_parsing_the_file feed_data('nothink_irc_iplist.txt') do
+    it "should have parsed 11 records" do
+      expect(num_records_parsed).to eq(11)
+    end
+    it "should have filtered 3 records" do
+      expect(num_records_filtered).to eq(3)
+    end
+  end
+
+  describe_parsing_a_record '189.107.132.113' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['189.107.132.113'])) }
+    end
+  end
+
+  describe_parsing_a_record '201.48.61.38' do
+    it "should have parsed" do
+      expect(status).to eq(:parsed)
+    end
+    it "should have parsed 1 event" do
+      expect(events.count).to eq(1)
+    end
+	describe 'event 0' do
+      subject { events[0] }
+      its(:type) { is_expected.to be(:c2) }
+      its(:ipv4s) { is_expected.to  eq(build(:ipv4s, values: ['201.48.61.38'])) }
+    end
+  end
+end