From 522966d11bd2fb72b2d3df3c03cc761c00cd15b3 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Fri, 1 Mar 2024 14:15:27 +0100 Subject: [PATCH 1/4] tests: add threshold by_flow test Ticket: #6822. --- tests/threshold/threshold-rule-flow/README.md | 3 +++ tests/threshold/threshold-rule-flow/icmp.pcap | Bin 0 -> 1104 bytes .../threshold/threshold-rule-flow/test.rules | 4 +++ tests/threshold/threshold-rule-flow/test.yaml | 24 ++++++++++++++++++ 4 files changed, 31 insertions(+) create mode 100644 tests/threshold/threshold-rule-flow/README.md create mode 100644 tests/threshold/threshold-rule-flow/icmp.pcap create mode 100644 tests/threshold/threshold-rule-flow/test.rules create mode 100644 tests/threshold/threshold-rule-flow/test.yaml diff --git a/tests/threshold/threshold-rule-flow/README.md b/tests/threshold/threshold-rule-flow/README.md new file mode 100644 index 000000000..3a000ae60 --- /dev/null +++ b/tests/threshold/threshold-rule-flow/README.md @@ -0,0 +1,3 @@ +PCAP +==== +PCAP from https://wiki.wireshark.org/Internet_Control_Message_Protocol diff --git a/tests/threshold/threshold-rule-flow/icmp.pcap b/tests/threshold/threshold-rule-flow/icmp.pcap new file mode 100644 index 0000000000000000000000000000000000000000..037606d1beff5b19ce4a44395a490a44e623b2f5 GIT binary patch literal 1104 zcmca|c+)~A1{MYw`2U}Qff2|t|IY4rJdT0E3&;jx2A*@mI~Oo0#oN!A$id*sz+iLC zj)9?p@zeDKD;Oeyn303QDTaxGlOZuFIVCkMJtH$KJ0~|Uzo4+FxTLhK94-tp`7zB* z7R*C(GuX8dmm}Q#pRpL^W=4>^foh3zvjx!2*W!^(#taQ-aA;gYgoY!~WG;fC0Ww)A zkya+(FF-OGGc;Tbh~7 YS&rmp%+LV385kNMH$y|iohUa00Mh7JB>(^b literal 0 HcmV?d00001 diff --git a/tests/threshold/threshold-rule-flow/test.rules b/tests/threshold/threshold-rule-flow/test.rules new file mode 100644 index 000000000..602c24969 --- /dev/null +++ b/tests/threshold/threshold-rule-flow/test.rules @@ -0,0 +1,4 @@ +alert icmp any any -> any any (itype:8; sid:1;) +alert icmp any any -> any any (itype:8; threshold:type limit, track by_flow, count 1, seconds 3600; sid:2;) +alert icmp any any -> any any (itype:8; threshold:type limit, track by_flow, count 2, seconds 3600; sid:3;) +alert icmp any any -> any any (itype:8; threshold:type both, track by_flow, count 3, seconds 3600; sid:4;) diff --git a/tests/threshold/threshold-rule-flow/test.yaml b/tests/threshold/threshold-rule-flow/test.yaml new file mode 100644 index 000000000..cfa502879 --- /dev/null +++ b/tests/threshold/threshold-rule-flow/test.yaml @@ -0,0 +1,24 @@ +requires: + min-version: 8 + +checks: + - filter: + count: 8 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 2 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 4 From ce00974515190e5e082df1bcbccdc9b210f51467 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Sat, 2 Mar 2024 08:40:42 +0100 Subject: [PATCH 2/4] tests: add global by_flow thresholding tests --- .../README.md | 5 ++++ .../input.rules | 1 + .../suricata.yaml | 15 ++++++++++ .../test.yaml | 30 +++++++++++++++++++ .../threshold.config | 1 + .../README.md | 5 ++++ .../input.rules | 1 + .../suricata.yaml | 15 ++++++++++ .../test.yaml | 19 ++++++++++++ .../threshold.config | 1 + .../README.md | 5 ++++ .../input.rules | 1 + .../suricata.yaml | 15 ++++++++++ .../test.yaml | 19 ++++++++++++ .../threshold.config | 1 + .../README.md | 5 ++++ .../input.rules | 1 + .../suricata.yaml | 15 ++++++++++ .../test.yaml | 19 ++++++++++++ .../threshold.config | 1 + 20 files changed, 175 insertions(+) create mode 100644 tests/threshold/threshold-config-rate-filter-alert-flow/README.md create mode 100644 tests/threshold/threshold-config-rate-filter-alert-flow/input.rules create mode 100644 tests/threshold/threshold-config-rate-filter-alert-flow/suricata.yaml create mode 100644 tests/threshold/threshold-config-rate-filter-alert-flow/test.yaml create mode 100644 tests/threshold/threshold-config-rate-filter-alert-flow/threshold.config create mode 100644 tests/threshold/threshold-config-threshold-both-flow/README.md create mode 100644 tests/threshold/threshold-config-threshold-both-flow/input.rules create mode 100644 tests/threshold/threshold-config-threshold-both-flow/suricata.yaml create mode 100644 tests/threshold/threshold-config-threshold-both-flow/test.yaml create mode 100644 tests/threshold/threshold-config-threshold-both-flow/threshold.config create mode 100644 tests/threshold/threshold-config-threshold-limit-flow/README.md create mode 100644 tests/threshold/threshold-config-threshold-limit-flow/input.rules create mode 100644 tests/threshold/threshold-config-threshold-limit-flow/suricata.yaml create mode 100644 tests/threshold/threshold-config-threshold-limit-flow/test.yaml create mode 100644 tests/threshold/threshold-config-threshold-limit-flow/threshold.config create mode 100644 tests/threshold/threshold-config-threshold-threshold-flow/README.md create mode 100644 tests/threshold/threshold-config-threshold-threshold-flow/input.rules create mode 100644 tests/threshold/threshold-config-threshold-threshold-flow/suricata.yaml create mode 100644 tests/threshold/threshold-config-threshold-threshold-flow/test.yaml create mode 100644 tests/threshold/threshold-config-threshold-threshold-flow/threshold.config diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/README.md b/tests/threshold/threshold-config-rate-filter-alert-flow/README.md new file mode 100644 index 000000000..ff3dec0de --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/README.md @@ -0,0 +1,5 @@ +# Threshold.config with by_flow + +This test checks threshold.config file using by_flow tracking + +The pcap file is from http-all-headers test diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/input.rules b/tests/threshold/threshold-config-rate-filter-alert-flow/input.rules new file mode 100644 index 000000000..7cb862d41 --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/input.rules @@ -0,0 +1 @@ +drop tcp any any -> any any (dsize:0; sid: 1000001;) diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/suricata.yaml b/tests/threshold/threshold-config-rate-filter-alert-flow/suricata.yaml new file mode 100644 index 000000000..ee5c3f004 --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/suricata.yaml @@ -0,0 +1,15 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - alert + - drop: + flows: all + alerts: true + - http + - anomaly diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/test.yaml b/tests/threshold/threshold-config-rate-filter-alert-flow/test.yaml new file mode 100644 index 000000000..7f23097b0 --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/test.yaml @@ -0,0 +1,30 @@ +pcap: ../../http-all-headers/input.pcap + +requires: + min-version: 8 + +args: +- --set threshold-file=${TEST_DIR}/threshold.config +- --simulate-ips + +checks: + - filter: + count: 3 + match: + event_type: alert + alert.signature_id: 1000001 + alert.action: blocked + - filter: + count: 16 + match: + event_type: alert + alert.signature_id: 1000001 + alert.action: allowed + - filter: + count: 3 + match: + event_type: drop + - filter: + count: 1 + match: + event_type: http diff --git a/tests/threshold/threshold-config-rate-filter-alert-flow/threshold.config b/tests/threshold/threshold-config-rate-filter-alert-flow/threshold.config new file mode 100644 index 000000000..ae0ebefdb --- /dev/null +++ b/tests/threshold/threshold-config-rate-filter-alert-flow/threshold.config @@ -0,0 +1 @@ +rate_filter gen_id 1, sig_id 1000001, track by_flow, count 3, seconds 60, new_action alert, timeout 1000 diff --git a/tests/threshold/threshold-config-threshold-both-flow/README.md b/tests/threshold/threshold-config-threshold-both-flow/README.md new file mode 100644 index 000000000..432a2ebb7 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/README.md @@ -0,0 +1,5 @@ +# Threshold.config with by_flow + +This test checks threshold.config file using by_flow keyword + +The pcap file is from http-all-headers test diff --git a/tests/threshold/threshold-config-threshold-both-flow/input.rules b/tests/threshold/threshold-config-threshold-both-flow/input.rules new file mode 100644 index 000000000..9ace89c29 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/input.rules @@ -0,0 +1 @@ +alert tcp any any -> any any (dsize:0; sid: 1000001;) diff --git a/tests/threshold/threshold-config-threshold-both-flow/suricata.yaml b/tests/threshold/threshold-config-threshold-both-flow/suricata.yaml new file mode 100644 index 000000000..ee5c3f004 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/suricata.yaml @@ -0,0 +1,15 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - alert + - drop: + flows: all + alerts: true + - http + - anomaly diff --git a/tests/threshold/threshold-config-threshold-both-flow/test.yaml b/tests/threshold/threshold-config-threshold-both-flow/test.yaml new file mode 100644 index 000000000..a9413effc --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/test.yaml @@ -0,0 +1,19 @@ +pcap: ../../http-all-headers/input.pcap + +requires: + min-version: 8 + +args: +- --set threshold-file=${TEST_DIR}/threshold.config +- --simulate-ips + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1000001 + - filter: + count: 1 + match: + event_type: http diff --git a/tests/threshold/threshold-config-threshold-both-flow/threshold.config b/tests/threshold/threshold-config-threshold-both-flow/threshold.config new file mode 100644 index 000000000..2c50d6479 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-both-flow/threshold.config @@ -0,0 +1 @@ +threshold gen_id 1, sig_id 1000001, type both, track by_flow, count 5, seconds 60 diff --git a/tests/threshold/threshold-config-threshold-limit-flow/README.md b/tests/threshold/threshold-config-threshold-limit-flow/README.md new file mode 100644 index 000000000..432a2ebb7 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/README.md @@ -0,0 +1,5 @@ +# Threshold.config with by_flow + +This test checks threshold.config file using by_flow keyword + +The pcap file is from http-all-headers test diff --git a/tests/threshold/threshold-config-threshold-limit-flow/input.rules b/tests/threshold/threshold-config-threshold-limit-flow/input.rules new file mode 100644 index 000000000..9ace89c29 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/input.rules @@ -0,0 +1 @@ +alert tcp any any -> any any (dsize:0; sid: 1000001;) diff --git a/tests/threshold/threshold-config-threshold-limit-flow/suricata.yaml b/tests/threshold/threshold-config-threshold-limit-flow/suricata.yaml new file mode 100644 index 000000000..ee5c3f004 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/suricata.yaml @@ -0,0 +1,15 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - alert + - drop: + flows: all + alerts: true + - http + - anomaly diff --git a/tests/threshold/threshold-config-threshold-limit-flow/test.yaml b/tests/threshold/threshold-config-threshold-limit-flow/test.yaml new file mode 100644 index 000000000..a9413effc --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/test.yaml @@ -0,0 +1,19 @@ +pcap: ../../http-all-headers/input.pcap + +requires: + min-version: 8 + +args: +- --set threshold-file=${TEST_DIR}/threshold.config +- --simulate-ips + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1000001 + - filter: + count: 1 + match: + event_type: http diff --git a/tests/threshold/threshold-config-threshold-limit-flow/threshold.config b/tests/threshold/threshold-config-threshold-limit-flow/threshold.config new file mode 100644 index 000000000..8ef60ce92 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-limit-flow/threshold.config @@ -0,0 +1 @@ +threshold gen_id 1, sig_id 1000001, type limit, track by_flow, count 1, seconds 60 diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/README.md b/tests/threshold/threshold-config-threshold-threshold-flow/README.md new file mode 100644 index 000000000..432a2ebb7 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/README.md @@ -0,0 +1,5 @@ +# Threshold.config with by_flow + +This test checks threshold.config file using by_flow keyword + +The pcap file is from http-all-headers test diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/input.rules b/tests/threshold/threshold-config-threshold-threshold-flow/input.rules new file mode 100644 index 000000000..9ace89c29 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/input.rules @@ -0,0 +1 @@ +alert tcp any any -> any any (dsize:0; sid: 1000001;) diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/suricata.yaml b/tests/threshold/threshold-config-threshold-threshold-flow/suricata.yaml new file mode 100644 index 000000000..ee5c3f004 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/suricata.yaml @@ -0,0 +1,15 @@ +%YAML 1.1 +--- + +outputs: + - eve-log: + enabled: yes + filetype: regular + filename: eve.json + types: + - alert + - drop: + flows: all + alerts: true + - http + - anomaly diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/test.yaml b/tests/threshold/threshold-config-threshold-threshold-flow/test.yaml new file mode 100644 index 000000000..4e7b4d840 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/test.yaml @@ -0,0 +1,19 @@ +pcap: ../../http-all-headers/input.pcap + +requires: + min-version: 8 + +args: +- --set threshold-file=${TEST_DIR}/threshold.config +- --simulate-ips + +checks: + - filter: + count: 3 + match: + event_type: alert + alert.signature_id: 1000001 + - filter: + count: 1 + match: + event_type: http diff --git a/tests/threshold/threshold-config-threshold-threshold-flow/threshold.config b/tests/threshold/threshold-config-threshold-threshold-flow/threshold.config new file mode 100644 index 000000000..0b08a5724 --- /dev/null +++ b/tests/threshold/threshold-config-threshold-threshold-flow/threshold.config @@ -0,0 +1 @@ +threshold gen_id 1, sig_id 1000001, type threshold, track by_flow, count 5, seconds 60 From 969708a4888410e7afb2e0b9c149c03dfcac02be Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Wed, 13 Mar 2024 11:06:02 +0100 Subject: [PATCH 3/4] tests: add detection_filter tests for by_flow and by_src --- .../detection_filter-rule-flow/test.rules | 6 ++++ .../detection_filter-rule-flow/test.yaml | 36 +++++++++++++++++++ .../detection_filter-rule-hostsrc/test.rules | 6 ++++ .../detection_filter-rule-hostsrc/test.yaml | 36 +++++++++++++++++++ 4 files changed, 84 insertions(+) create mode 100644 tests/threshold/detection_filter-rule-flow/test.rules create mode 100644 tests/threshold/detection_filter-rule-flow/test.yaml create mode 100644 tests/threshold/detection_filter-rule-hostsrc/test.rules create mode 100644 tests/threshold/detection_filter-rule-hostsrc/test.yaml diff --git a/tests/threshold/detection_filter-rule-flow/test.rules b/tests/threshold/detection_filter-rule-flow/test.rules new file mode 100644 index 000000000..2409f9cf1 --- /dev/null +++ b/tests/threshold/detection_filter-rule-flow/test.rules @@ -0,0 +1,6 @@ +alert icmp any any -> any any (itype:8; sid:1;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 1, seconds 3600; sid:2;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 2, seconds 3600; sid:3;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 4, seconds 3600; sid:4;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 7, seconds 3600; sid:5;) +alert icmp any any -> any any (itype:8; detection_filter:track by_flow, count 8, seconds 3600; sid:6;) diff --git a/tests/threshold/detection_filter-rule-flow/test.yaml b/tests/threshold/detection_filter-rule-flow/test.yaml new file mode 100644 index 000000000..a6b4106d1 --- /dev/null +++ b/tests/threshold/detection_filter-rule-flow/test.yaml @@ -0,0 +1,36 @@ +requires: + min-version: 8 + +pcap: ../threshold-rule-flow/icmp.pcap + +checks: + - filter: + count: 8 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 7 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 6 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 4 + match: + event_type: alert + alert.signature_id: 4 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 5 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 6 diff --git a/tests/threshold/detection_filter-rule-hostsrc/test.rules b/tests/threshold/detection_filter-rule-hostsrc/test.rules new file mode 100644 index 000000000..acbe80c78 --- /dev/null +++ b/tests/threshold/detection_filter-rule-hostsrc/test.rules @@ -0,0 +1,6 @@ +alert icmp any any -> any any (itype:8; sid:1;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 1, seconds 3600; sid:2;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 2, seconds 3600; sid:3;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 4, seconds 3600; sid:4;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 7, seconds 3600; sid:5;) +alert icmp any any -> any any (itype:8; detection_filter:track by_src, count 8, seconds 3600; sid:6;) diff --git a/tests/threshold/detection_filter-rule-hostsrc/test.yaml b/tests/threshold/detection_filter-rule-hostsrc/test.yaml new file mode 100644 index 000000000..a6b4106d1 --- /dev/null +++ b/tests/threshold/detection_filter-rule-hostsrc/test.yaml @@ -0,0 +1,36 @@ +requires: + min-version: 8 + +pcap: ../threshold-rule-flow/icmp.pcap + +checks: + - filter: + count: 8 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 7 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 6 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 4 + match: + event_type: alert + alert.signature_id: 4 + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 5 + - filter: + count: 0 + match: + event_type: alert + alert.signature_id: 6 From de4ab1a964a4ea5683b04dd595b9a3bca7fa28e0 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Mon, 24 Jun 2024 14:18:08 +0200 Subject: [PATCH 4/4] tests: add threshold backoff tests --- .../test.rules | 4 +++ .../test.yaml | 26 +++++++++++++++++++ .../threshold-rule-flow-backoff/test.rules | 4 +++ .../threshold-rule-flow-backoff/test.yaml | 26 +++++++++++++++++++ 4 files changed, 60 insertions(+) create mode 100644 tests/threshold/threshold-rule-flow-backoff-single-flow/test.rules create mode 100644 tests/threshold/threshold-rule-flow-backoff-single-flow/test.yaml create mode 100644 tests/threshold/threshold-rule-flow-backoff/test.rules create mode 100644 tests/threshold/threshold-rule-flow-backoff/test.yaml diff --git a/tests/threshold/threshold-rule-flow-backoff-single-flow/test.rules b/tests/threshold/threshold-rule-flow-backoff-single-flow/test.rules new file mode 100644 index 000000000..38e4ebd05 --- /dev/null +++ b/tests/threshold/threshold-rule-flow-backoff-single-flow/test.rules @@ -0,0 +1,4 @@ +alert tcp any any -> any any (dsize:>0; sid:1;) +alert tcp any any -> any any (dsize:>0; threshold:type backoff, track by_flow, count 1, multiplier 2; sid:2;) +alert tcp any any -> any any (dsize:>0; threshold:type backoff, track by_flow, count 3, multiplier 2; sid:3;) +alert tcp any any -> any any (dsize:>0; threshold:type backoff, track by_flow, count 5, multiplier 5; sid:4;) diff --git a/tests/threshold/threshold-rule-flow-backoff-single-flow/test.yaml b/tests/threshold/threshold-rule-flow-backoff-single-flow/test.yaml new file mode 100644 index 000000000..dca2674f2 --- /dev/null +++ b/tests/threshold/threshold-rule-flow-backoff-single-flow/test.yaml @@ -0,0 +1,26 @@ +requires: + min-version: 8 + +pcap: ../../filestore-filecontainer-smb/filecontainer-smb.pcap + +checks: + - filter: + count: 6676 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 13 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 12 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 5 + match: + event_type: alert + alert.signature_id: 4 diff --git a/tests/threshold/threshold-rule-flow-backoff/test.rules b/tests/threshold/threshold-rule-flow-backoff/test.rules new file mode 100644 index 000000000..16727efc1 --- /dev/null +++ b/tests/threshold/threshold-rule-flow-backoff/test.rules @@ -0,0 +1,4 @@ +alert tcp any any -> any any (dsize:>0; sid:1;) +alert tcp any any -> any any (dsize:>0; threshold:type backoff, track by_flow, count 1, multiplier 2; sid:2;) +alert tcp any any -> any any (dsize:>0; threshold:type backoff, track by_flow, count 3, multiplier 2; sid:3;) +alert tcp any any -> any any (dsize:>0; threshold:type backoff, track by_flow, count 1, multiplier 10; sid:4;) diff --git a/tests/threshold/threshold-rule-flow-backoff/test.yaml b/tests/threshold/threshold-rule-flow-backoff/test.yaml new file mode 100644 index 000000000..6a8f1c05b --- /dev/null +++ b/tests/threshold/threshold-rule-flow-backoff/test.yaml @@ -0,0 +1,26 @@ +requires: + min-version: 8 + +pcap: ../../bug-2482-01/proxyCONNECT_443.pcap + +checks: + - filter: + count: 1725 + match: + event_type: alert + alert.signature_id: 1 + - filter: + count: 707 + match: + event_type: alert + alert.signature_id: 2 + - filter: + count: 338 + match: + event_type: alert + alert.signature_id: 3 + - filter: + count: 257 + match: + event_type: alert + alert.signature_id: 4