From b8d33ed323f1047b9f3f1a8e3b930d2091a697e6 Mon Sep 17 00:00:00 2001 From: Victor Julien Date: Tue, 2 Sep 2025 09:51:54 +0200 Subject: [PATCH] tests: add tests for issue 5758 --- tests/bug-5758/input.pcap | Bin 0 -> 15435 bytes tests/bug-5758/test.rules | 1 + tests/bug-5758/test.yaml | 14 ++++++++++++++ 3 files changed, 15 insertions(+) create mode 100644 tests/bug-5758/input.pcap create mode 100644 tests/bug-5758/test.rules create mode 100644 tests/bug-5758/test.yaml diff --git a/tests/bug-5758/input.pcap b/tests/bug-5758/input.pcap new file mode 100644 index 0000000000000000000000000000000000000000..dd13fb6d2c0608d79cb7631ad387f7296c84506b GIT binary patch literal 15435 zc-rl|Wl&t(7xvlExVyVsaCdhP?h@Py?!nzPXo9;t1PBE80Kwgz;1U?%R_ zoT-|wIt@kj`R!+~v(~fDKD(LfuK5HC00aD=7Z||g`5n>J->lLX9>Dwj`^zEr{DbjC z5Wo+iX%3?T0w1@CP8G5X(n>Dj(EoB)4(Q$Kk`w>{3I<*W1_}k!;IhsB@^=s*5b}kE zSNbOl01yOlLqw~;a9(&Its%SaIILyQyn!5)$53{>S60~zD`iV}^@aDF#Z?9mV14GW z{=;HrJbl$=_m{4LXI{A<63CUI`Lhm?S4~1MtQSVp89aas6!3b80YJGJ&t4en7XQh> z0=X({{+IFgg@FMC0R?~nKpud=1Ex=zO7;^Css z@=n@LhR(81(oV`wm`=1#=uT8XW@jcKqca1*_Z&So00SU@hiP|#2?P_R&7 zP~cDyU?AWi5YN{J2m+u5fP(?SfIz?-04NB^vmy!r+4EpTROF8GKM+W1hIT!p<+x(# zag?HA89Ac6OeY%P6-i@l0k{C*OE}R1Wq|(=yt|#PkJd;%$Smmf{vwu)|J!6ledfSDUr10O*z@%R1z@5*!$Ck^ zWM0DkIaS7=uXShhXU)7Hb;n^tdZ|0Tk$-DO>qY7dBNPDvAn-hdz&~{-z@yZesN1d7CfBA*_yro-?8TEeT?A4O>3?k3aK?;8txfiq{jmRG&Zw-wWgW(-Rr13m)d}wZlxM{M%c`%39sw`~ z4tPDp0N_)4pI$15hTzZ2VM8L9aGrZfNjK8pm7@oINvW60Nq2fFB$SxIGAggX+8H9%=nd3=+O z&w;KY-rPjSR=Bn)Dw+JD+@0Q^UnztTn-=@_OLmTZ#ihxbbw|M3@VTK(Ip(uIGLDVa zke|zruA&-OS*QWV2^=kToZ(sT=|gV!@CCNESRJgbEYnft@g+Q(v|SW`sPWGXu4=5-REfgcA@PN6e4hYsZupA~Ik7Eq89r%smW9b5 zt!Q*lw_k8Ik(RMo(^l)R>#ZA|ex0(?iy`|CZjp znHIt@HYGPciON6n7Hvl88_)RF*Lx_n89sC=B)Puy6ASx#q7o z*x4hk!`&wyG`VT8tcM}7g(txUzdnCZPle;Il)hN*rkx4sFdXW>NFetx>`Pr1hw^4x zghXFTInul=^El~SIHGW)p0*%b)e{jX06dyL_(6ch)2T*B>y8`06>RkrhpywXM9kRy z&TFO4t6*{Ei9aJ8mZ23l3fV6*v5#%33V`UHsfa9T+^*RZOx;P|1p8qGRsJXHCObTCUz?3b-~t z<8E*}Mo;?fI=KhPeoTmaRM$gqJ`6_%h+g|q$aB2S^%(OeJDU^3Qesc8JEu2IbnEgQ zmh$NV-`0MNb7GKF*x#(m`-utD=wQSr zYQq;(Fk0hV99d5DC~RgKm__UV1ay$|9l%!Z8;XLS9TK^$MUF7@f}5lHaivG`h%WO} z7CJa+n*}SI3R_Rh>o@@`Pn7XDT@{nFH}PF&cfNfV<6t*dYoDXgNv@WHWBi^KR)dDL z@t(-EF(nnD475OMB___0U@Pd3X+y(mWFz|R^4o3muLDatSKBlXel*UKJMrpWyAcys zy>?Dkj?&m$!r!=2SHV<};E-_`&oP*fea23T-l8(3ZrNYnT$!Nc(T?=s9H}k0LUxf9 z-Kn^QDmL?5xZ7BB81YS{cc!{9&CfV_4t;MAPF&Dmq**Eh%*!zu zc;QrycZBciJI9jT4=8#PhR8U!hKk^roXR~kw~38{Vg@`;^tung+RQSaq=S zFA3{Ges~qke@ll>};rKQ7jY*_}aB^|DPWJ`PJj`|MYn7s#lMHzGXnh|I_2= zS1I|Mr&2o2Cz8~wuJXOFRT{?@c?3%AwhDETjINn)6WSCBL@VFgz~DUCb7W}Gw|$W2 z3f?~Q8)@IbPl7OJ$MwQy+#JL{m?GlF7{iZ$FfIVu-M%7#`%FCVUiugMeiSPIe$~I^LS&9Yl^ognqU~aj7=AViKjU%#=jml z&z62|O|t+_A3&gmp2+A#mdVTqtIN2!SXbX{PAp7Un*H%&(O}_3z+#S-)Nl&bNRIaH zwKZ?(8g(o;M-^mmA15|X3wF*YmvVPI1ltiJfR|%0yLlr=Xb&LO*3OkB!(9rp_pBs> zhYEJybRz{P9@C~%z4H{hcMA)S)c}B+SE{1q&SURDXKBV zI5%3u2~zva*7t3rv?IQcJs5q(uWCClb9=Ws=+8YzSgc+9Q;EqHg2KGnh;QGF6BjDp zS&=IS{^Db+C?4RSMjy3Thbg-|*C-X2kP?cVF{ZiECP+98w{Z6+cf!0zP{!IC>W*_^vb z7xyWRLL3XHdcs<6dnWJdTLJyGjkd>$ZmD|YmV!t?EOBk8H2gNH*%%CPZFng8e~OAwgB&Ywa#^Uh?z})d`E%%kn!v?npEudfhaH|TT#db z%c|+~+DxCQl=~nk0qaPuj9PJ-EsZ>CDez*c67dq%NF!X6D^>0#-Nh*csQE9{L@{j!z_cv_Rtjk0j-7qAiTq-ZxtR{>H zRl+?47m1r4&AvqDvNM<_87fsGmkb&Y?UxZ{@48$9SILib&hWln0tDytXp3A-uC z3$a&OAi&xeu=JNF-anyMm*g2PjG*@Z=%s!lI7b^;NCIYNlCF~zzs?^Ax$qGjm@$MM z{2ec0<3~fDvBVlZzi?u~<2;uEgsq!wVpW%kz|ras5R>$qv<8$ZuK2`UZb#V4MnBKu zZW<|rmXHtK$4jWoK!rL8@3fI&5^7%Q3^072hY~39s6hIevus4=!pA+Gw|=xhV(9EP zxKpjy^en{L+@uJ z&*kl=)eXfjVJ$V(q92}4N-V_BRdOc*e6krM7`E;r#5cCRlQGNTHbHN{^OMi-B$X@a zv~q$O1Z1sq2k01ts?kt6Y=JP2%G2mU(sIA0vc!;XLFT0Zc>rZ0g%Ck+#l!bVV$8qw zPTG#a^~N?)W2r`O*Axy^kL-RsF$cZ?qxgW!)(}Q4>XCg)jb9HyL^ng_QwoyP5EhC7 z-CZv(@w->>@0n>nhot=QA@cc-69jujsyXB~4JTRUv^n{%uIavVSdgS5HBp!a4%AYj znwRN@umma++OT&ZP1Bq8d%L&p?VYvtv}HpK6M*Le+IVeI+il~w$G-&uydGizkhgld zFCI^y`KQMVD*pEPMz=pbK59Tg))+}@Q!4F_!bWHAqs50-Ve;xF>}(-J>>iuKr`?*h zmiJ<+AA&c%h{i@Wj&$e@W6DgXX0d8Jj36XA=MVNP=uKQE-V`i!BFM|lju^-5ev6In zj9d+L@ArZ54Va;ncX&Hyu{94ri~c#r#jltxN?l|AUT)^0ox4lv8b=fQ3)$)~vaRs2 zcY6M^S{)$wVS9l%mg?;J2X^`yJT8VZC!q6hmnm^@I}_sx|o zelgpjA7iyGj{|7j5C_X9ps)|{X&LD-Xl1O){LeL&RgAJdg|QTe0`vT+UP4UF^w;YB z;&t_I_2LiVzG2a4-3~ z=tb8OBWwLDu2GgXQ92bRIgc79RZG5kt2T$WG1se9ft=R|I?u{>o>lGqqil!q`bC*W z{a?!5e=7s3{;#r%WyNS^dv-L$o!s!gwPGQjT?UA7JqP*k%YBDmJ95MX5W}LUX;%bs zCXa=~>2I9{1trHKkfao0-N|nrj*l1A#buH-64d1fg2)m!BT>z$RjSP1+qt^s@$z&q zo&?vb88hTnkp$y;WTbZX&Zh_SV;;hpAyeOTe*bB6kl1oepNEtnKcMGK!1oY*yButLea@@#m!$kx zNmhSJ`tnL$ix*Gsfc4-riyuXyCEgiIe8Ks2=o> z0s+z6OAenqPVI~@CU)X}EBND?W#OxWroR-(kW0AI`5}Q^%47bk0RBb6ZwB|XTXX;8 z*xY(WuZ~^)pA0OJ%g+~oGG5vTh@shAxt|E%M=NGEHxEYP-#31w86M|e(aH3h%vYLx z+E2VpJCEShRvc*G4?!{>{YVB+&X2QMklLHQTdMaN4zz|Wron$V=Fm911+(Ii{$%h_{uR9(wfz}=4YAw+raPxS_Bldb)j>OcQ9@obTDEbSzT}xbpg_MC&5lMbp!=QNJ{LMj zQVgs?9h874S7Hu!*v{m(B4CE6A;Ws(*t(i} z6wh!G^gYUc2@uIbRcd6@ZlWb=f+cm1K;i~LIFoLGvCSeNqINC}&tIB*_Z?xf)M6pR zImmRoXSB~J?*w6&XAjt9ee{o`*S zL4%z5w?xLZOWcJzT85WyxK6qoF80;?6D&>*EO1$2t^fJ9cw48oOG3;}18S4gno1 z*$&kOInVy_F1+w#hQLV@`YLMH2%%{#=b@%(^jK(YR*I0nPBA75Hou3um`WBDedvXi z`79rYIfWfm+dD7+U*tWgS8t+V-1~~vCaRI-`QdJ33h;Uc%ULQgs9Hdu`f|7D3R}Sr z4*f~KM!ahm8=wj+scnNO1>zUsW{`EsvgPU4aSw@dg_Y0F9>=zo3w1NB7aAyP`K?Ap zcxFaCDbbOLe>wC6l>`?AJ84Kt`jH1`1b7^aP4k6p>0~~yQG3WwN z{WK)|zTr^iRtk1CMZ;64C&aG7@XNrxr6&;}_0{Jy(-1t*JG>wWF?Yn{Ixwd!^{EMJ zmu1fP+5SfhH0IPLwg>*&Z0<4}%o!K~SfX1LOT-dtU|Y&sS0~WtD)V+8_F9*a+fOls z(GLsma4?e-m-5qR=Rzxi_uTN*?TGb`UTgR$yCH9!yC_an%cxc-XmkdVN)t~;KJ?sF*gcum%3tbj7Fg3G8~J-xwO__mBW))i`U%V4C-pA%GxiZj59bS zp%CT=Q7U%^rrt|ui)Iqzqg8E_9_11%L%|8dj>Gb!?zWo^~QdI^tgJ!Fk=z`5Xm?G|o-Cmjf4B4;v`a&av>=JS$iUX?OSbAW=viP7@|_H)sv-9Q3gefE`Lr36ZlU2Dd#>y8bdJUrpIf z0e>WR_$1*9dhS8vNn;*9(vBx|HtsVsxh@_KwHMtD?SWLIf6rUIjCeW<#)IyimRl(7 zG1>DrPuAF?h=JasCSWN97R zHvNn%J4|(Nky?uPSgTn1-sKVd31AimWAzqdi?DB zzAHL6^dMWQ5%ycC;8^66aMxbZd!NbC&)+8z2;qTy-yTd+-(L$P#1r~2DpnY;kw`(E ze#9VJa}fhFF%HRzrV)j~LO2px&)=goqT9~PY|xm2Yx&qqrz#VaCp8ge6t zUJ`yXsy2mU*SUM>5Jjq|c2}Z2yRx|v8bc$cf=E3Ktjh7xwK)|fkbqmw7+D}@4;wj} zXAUKES`Ea?%*`W_KxNOs6Ekkzr+huoQ>iBgjy^-GGbmOO3-+UCK@f!!hRJK0p_tS~ zsT@L9h7`s#G|B;djrc?PW&OlcO4FKglI95h^1ki^S!k|vZGcnC`*@@6g5(6h&nPg!l_(bW0CKeu z?A}nN_aHWT8^atdl_}yml4(^>0r}83boMv|Th;=B*P2dAcWPbNkv5^f{Vm=b3QJvLxNT)B|6U(3r>Xd5=h#Lh-v^k$ni>ljcroQU# zNlOIp-U=#K0TdwOn#4xwph4q0Kxh%0*V^keJw6T{MNQttp3*a@l+a7Wl!5 zk@jgqs8KAooe$UW2j(i~j2Xi=^%98$DX6{4!cT^N(QN{1!}%FzO5{eNZmlf8El#6e z;n3)Gb#p;4Tb_um+T~8@ETd(o*`K&3{Q#5SK2|)hP&8nJ+{9VgC|C)PVT)7Zya;20!;Y5w&QCL(KglUJiW{q}f+IX9ejG)<<&h~F@a;4IIq z!lmMb*S!ahZz`lohBwRsGau*ud=LQx7<6Q|UYJ;r-g4c30vGcb`>wdlB{1%=pOYb1 zW?+1F%HE((>Jp_p`t9DSUNi_6aohSIwaBVmbdDCEC{Lzw;iNXg% zTa~OkDZ(xZZOqmftzkCi4aw|}v2AHPP!%_!r{f$9{l&k= z*8~-6rbScAB-RhZ8Ww^hvS;9_GKJop%DD0QQp9pyFb!r@?usK5oL&*V)q2;C?;kpk zzc6(DpeS-(s%hRujU7OoeP{z;&goc|hmcW25;>by&5&OTzjb@4;#0#Ly$EVd$!rjl z2};dNKVLW*kE^q8dFvd46l4#@&l`xJn#gVF7I>B^TT{^eDK%H}G$`G3_6GE=n?We- zc>tF}MWr$o&dxRhdMnTNu1kMl%9gnj#|>L-NgcP8h!Mwj4(tr^R32+)zL&PUB0MA( zCt zXb5eD5^XBC-&buCXt6yW5%T$I2xh~aYAh|zD?to(=hFeVNykg8`y;j>>}@suRVMJ)8k8DJs#~(kC%`8 zeIL)E{-?+DHPm9T4WLvxOKn=;M&gG{SLXl=Is&IhduYkk5($+RG?B!W0fj!$v1C&v zAu$?uo!wsBTXt5;6C@m4)aH`=2JC2oq;FTin3}ZNNTG$U^PyXzn~pT)+x6NF z27W`8+gNWafBtm^G3mTOR(_1w?+1SF6gzE(bD~k7Mfb1THB55da!HFvRIjcH6Vn|E zT4q+e(p2veI;g8=#Tnco&M7D$3LVI_-bn3L(-B^w958PiC?&<;$WArM;>QnsP9uoRdxMFyY0n_pgp zhf&N+78Q@tqsZs`+)g-!dwt(vvnqWG1U*W*`Na zGVQz-)c&=&)uAbIFd#i z%jqQt%@CUxeGysLo6k?vI)3j{&4)A^5s^4!!q0qd=|qOqOpQ099=@<#qK7#(;Y*z7 z5#`d#*dhcGp%cxVl5%oar$sy3nHVGYH-^^S2B^_LSgAw-6Q97l`eM{Si+upvh-Ddm zASy<_V%I_ow&=ZufgAX`JXF-HV09KdSGQ)xO~ZknS}$P;1H*7+y#?wE$&o7dIRUL* z4p|F~G8o~cE-sz2r-&6*bVdc@Uf6Ca5$hL=E%KvcIXdD=s&=C6LH!VUwaE#nD5AAB z^<^r8q{$=qK72QJ*zO$aJsWtqs{&ICAG@)Jg4T7MjEGKpy&v7KR1CYME4aGVObLwz zGnzLi*2WqCB@gO{N7V2xJp^sv1f>EBAcTbOeg6c)g_gMOGE_!+WWnQ1;C&zRSqwHf zmqv#158{%eNRnEYYH8Y&djQKUwBPw&x9tpKJGyKxTs+Mf3nRT5`iht6G0R{YN?#zM zgP@K3e7FjJ1kDL<(<(#N_5pOz^X=YA4|xQ`qI$nz{T}|WXu)ptFGN(q6Xe7 z?7`!M5XtK@ibjNw=jTEjSb6)_zl==)^|{6T2!0)8thpYJ>`C93|pSU;Nq~+b<7ZIhLq)yOd4CT%7sjS;b_7eTVw@x!4 zySL&^`*I3p_d}_Q!#Ur#EHCuX;sGyqna>1V-&nnEYSn=Iy7f{VGnjc9vpZ+)e8qR{Z|lMV5^&H7lMbu*_ejw7&;!RxkzVZ*?UFJ&j9 z+E-_vQJY=C(!Roq`LrUHG1m>LBS70a+Xt%Wk;ua*PgIT}V9KA@uGm|885fn4Jc&0@ zMbS(X6?Kcm`|zHm5DFW{>jtgmLmQq`R(>K!THebKQ&xqS82S-b#;}oUl@j>Ldd4!!o&9TiD?-1^;z zk10*?a>xk3>}P`c=ZvIB2_g&FJ$+ep+&T22$oh%)OFM2ngHnCQ^m<%*V1SzJ61tASQRygf-N3I4cDj zt*YCML!vXLt4gr z)^a1`Gr26;e=LTsFw_I!$L^9{SqCyL2QXV9rJ1&MeB{ zN|+Xo8)vOTV#Y(%`~vJ07PjjsAymzLYOqof%A4rAPpk-f(g=ItvKaJ3(&y zW|9Z;u1yMkZ&oq8ZTW`~%O!Ei$2a&$R?x?vuLB+N>WwC|XFg0opl_}lb@G0sl=C-; z;o1i-ma0$?g@tH2QwbAXUKhb-r!=_N7p^%l%kXu9RY#isIul72+nLovtv{b|qu`Uk zAAk6o8w*8gi_WC<4Z=Q`_9|NwQFkF;l%+bJY>?r4MgGS$(W1(hxi}Ykj%4;SXmp$m zZXfjARZ^uOr(&!=Qc2&Xm~xTs$c-qEfulR=D5D{z8bH3(TBX9wpZ9={}qdFta8Dhh)S z45F$5)hNZqIkuFT_27`T?~jDhf#k8W6ZA&2_!Gtz*j*!}H1~zG`gEg4)%tGPF`7sz zm2l3u(#q~ljpAB*(pznHETiMF`2hc>y@lTE^y#o`)RhHX@*DXh^#~ac(Hid|GB_r% z_*2QF3d;akZGiV(wj`&Tb|_cVXbFE;nEMiI0uIdjTBbgz&2&q>nVSF9>fEw*iKuhh zMiE{+*Q>|#Y5lcPdh@!iX!hskoh#kT9*rLoD3?6Uzngb9FMBjEjEBD&x33J-|7D0M zJu?(!EB|HK{${jk|HZg_WtjXgLq6`AVI`#e2Lt{;8TYS@cmK=KoOofdqx?7H?eqC> z|6#mke0XJu{wD(q)GEO6PsYoB70x2k&`_r3$Aprf_VhCh7J1{%eMB2!U66>vFGGAa z`>U;%zqVDBKijJ2#P6k(tn6PKQuC{9dBA>ra<`;S@0QYJbVG7N8Y5EnyTFZin3YltxCStl>1R? zEJpno`=*clW@lSWUvd=aFNb*ix+k+&p7b_IC+e>I5=B0Fvz32zX9{IBO?n#LH!U^K z`9<=DX}{2wh{-C(*r<`-IiL@+7m1~1!7hj6&)}6- zP{8tR#{<|1*x2o%zFRAq!}Jo~Mu+$Bp45?R`Z3eXdcxPD-z|b_se&upd9&fQ;J@qN zj}^l5#=S)DA4Ks|ix@v*s3}xT%Cw{ON&UQza@D>#mfjOzKy$1s5(=rF|FD==i$X6U_uA z)cb}*iG0uCg-@NWRM>{On>@{$6%W;MJ~wP|X~ws%8}SDy^`l?n1rgA!%|QaUCS)Eh zl92qq=2#JoZ%Oy0IencQ{bioOJ!ejOza;bIj%RxEd1g*V z91u<-*<^TLkY>`V9d(^4XnW@zRU};(y4-d!RxK|w3V|X_$#4jsoD9zx{iT$Z0eCmNzyu_pf z1?YBKU7}gDQdGtwBF%S?km*i%#?I=i4%Te_Rk3J|M|b#Rm;J z9)ewk!mdZ;fgz*5V$_tYS>XN=ke0PvLs0r;p*GuFE$6m7#m-ad|3r&AgO#5S^JDqQ zA=1?cJNjv4Hm$>uVo3wjo`qB@CG3U$x`Cw(U$SR;%PeyYA+a}u; zi(Yw|^}^J}T|^zuNvYZRxo>tZAP?s4QYx<`^*20P!2rvSjYv@o@OvubH4-f)Q}^1s zZvyY?_^}x$h$_6y1N~^ByQUzev$fBhM+uxW3Wlfb58(j($yF#uTYgCSd*NIy86VU9 zdE}#L_`84(T!`5!AH{pf>Al~e`^HlI(l>rj|4p>2UsE=iH12d54M$=o#M%6uKEfVw z&;Y;ht|v@g4T+LshyV{EX3@EmcNDyv`H;;SXzhs}$HZdnKGIwfOxa(lz?25{Nz3qE z2Aq^H_5`eBHIZsL(R}yZBzJosz)q$gcPb{iJbKcEB#SuR;1+=6zjiC+XtTO?HxFuX zx|05LZvA)+bvvKvx5sZkw~+0B+Q_zE#p@Rap8oWBeTUymr&atvJ>DY-s?nr0z?q%~~SP0X%j`l5C(hJ2h ziH&>f9X1DvAH&WdL4$qnvN%CfIO~$lb#079>%F4a(%?Cr5f4TVVHYK<0hCa1uvz?{ z&D=h-z`6IX=Ji%rzs!2i{I3T5>$Q0r{nb2W+;I#@Um7q&*1yfu;dcXGLq+`a>l&4> zU)QMmGjax`FPxX|$guryF{kR1pxem>v$ABHjGo}2l z;k-0)8cv%KH!K6&XghiwJVzg6Tg9weXs+-^Q6xfjQ-=d3%?TRZ-2wtr;ST@bLq7NE z*W-CeS;nW=AtnDB(&P7#{d@loDf@d!RMOaATQkT!GKmf9oWX;m`8L0tUf3-hz&}F5 z1bAiZ|HY1fWg~-HQAq#EeqjV_{K?R(dJSvke}vWJC9DMh{_l|Kc^1}F`{}-d?l~Mkm4CH49)c*rU?JJ|~F9z8&BjHsC#J`N|-waKI czhVmV8dJT$Vw&*6c}Z3Lkbh&U_M+wg0;`=bIsgCw literal 0 Hc-jL100001 diff --git a/tests/bug-5758/test.rules b/tests/bug-5758/test.rules new file mode 100644 index 000000000..6e55ad63a --- /dev/null +++ b/tests/bug-5758/test.rules @@ -0,0 +1 @@ +alert tls any any -> any any (tls.sni; content:"ftp.nluug.nl"; sid:1;) diff --git a/tests/bug-5758/test.yaml b/tests/bug-5758/test.yaml new file mode 100644 index 000000000..cc7a430a5 --- /dev/null +++ b/tests/bug-5758/test.yaml @@ -0,0 +1,14 @@ +requires: + min-version: 7 + +checks: +- filter: + count: 1 + match: + event_type: tls + tls.sni: ftp.nluug.nl +- filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 -- 2.47.3