git.ipfire.org Git - thirdparty/suricata-verify.git/blob

   1 pcap: ../../exception-policy-midstream-03/input.pcap
   2
   3 requires:
   4   min-version: 7
   5
   6 args:
   7 - --simulate-ips
   8 - --set stream.midstream=false
   9 - --set stream.midstream-policy=pass-flow
  10
  11 checks:
  12   - filter:
  13       count: 0
  14       match:
  15         event_type: alert
  16   - filter:
  17       count: 0
  18       match:
  19         event_type: http
  20   - filter:
  21       count: 1
  22       match:
  23         event_type: flow
  24         flow.action: pass