git.ipfire.org Git - thirdparty/suricata-verify.git/blob

   1 pcap: ../../exception-policy-midstream-03/input.pcap
   2
   3 requires:
   4   min-version: 7
   5
   6 args:
   7 - --set stream.midstream=false
   8 - --set stream.midstream-policy=pass-flow
   9
  10 checks:
  11   - filter:
  12       count: 0
  13       match:
  14         event_type: alert
  15   - filter:
  16       count: 0
  17       match:
  18         event_type: http
  19   - filter:
  20       count: 1
  21       match:
  22         event_type: flow
  23         flow.action: pass