git.ipfire.org Git - thirdparty/suricata-verify.git/blob

   1 pcap: ../../exception-policy-midstream-03/input.pcap
   2
   3 requires:
   4   min-version: 7
   5
   6 args:
   7 - --set stream.midstream=false
   8 - --set stream.midstream-policy=drop-flow
   9
  10 checks:
  11   - filter:
  12       count: 0
  13       match:
  14         event_type: alert
  15   - filter:
  16       count: 0
  17       match:
  18         event_type: http
  19   - filter:
  20       count: 1
  21       match:
  22         event_type: drop
  23         drop.reason: stream midstream
  24   - filter:
  25       count: 1
  26       match:
  27         event_type: flow
  28         flow.action: drop