git.ipfire.org Git - thirdparty/suricata-verify.git/blob

   1 pcap: ../../exception-policy-midstream-03/input.pcap
   2
   3 args:
   4 - --simulate-ips
   5 - --set stream.midstream=true
   6 - --set stream.midstream-policy=pass-flow
   7
   8 checks:
   9   - filter:
  10       count: 0
  11       match:
  12         event_type: alert
  13   - filter:
  14       count: 1
  15       match:
  16         event_type: http
  17   - filter:
  18       count: 1
  19       match:
  20         event_type: flow
  21         flow.action: pass