tests: improve alert-max tests

As the tests for correct rule alerts appending and alert verdict  have
more rules, it's easier to understand the whole behavior if all the
rules present are accounted for, in the yaml checks.

Bug #8021

diff --git a/tests/alert-max/alert-max-append-higher-priority/test.yaml b/tests/alert-max/alert-max-append-higher-priority/test.yaml
index a81975ba9a9d89ee099a9397c757e828ece7976b..764b419ac709f2316dddc8939e1eae21e6bc06e2 100644 (file)
--- a/tests/alert-max/alert-max-append-higher-priority/test.yaml
+++ b/tests/alert-max/alert-max-append-higher-priority/test.yaml
@@ -58,3 +58,27 @@ checks:
     match:
       event_type: stats
       stats.detect.alert_queue_overflow: 4
+# Subtest 10
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 9
+# Subtest 11
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 10
+# Subtest 11
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 11
+# Subtest 13
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 12

diff --git a/tests/alert-max/alert-max-verdict/test.yaml b/tests/alert-max/alert-max-verdict/test.yaml
index 60abc4fa04d5013459e0e230b4081c7997c6da8a..768bbfa724e5d4665b6c7c56fa71a93822c70daa 100644 (file)
--- a/tests/alert-max/alert-max-verdict/test.yaml
+++ b/tests/alert-max/alert-max-verdict/test.yaml
@@ -30,6 +30,7 @@ checks:
     match:
       event_type: alert
       alert.signature_id: 4
+      verdict.action: alert
 # Subtest 5
 - filter:
     count: 0
@@ -42,12 +43,14 @@ checks:
     match:
       event_type: alert
       alert.signature_id: 6
+      verdict.action: alert
 # Subtest 7
 - filter:
     count: 1
     match:
       event_type: alert
       alert.signature_id: 7
+      verdict.action: alert
 # Subtest 8
 - filter:
     count: 0
@@ -60,3 +63,21 @@ checks:
     match:
       event_type: stats
       stats.detect.alert_queue_overflow: 4
+# Subtest 8
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 9
+# Subtest 8
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 11
+# Subtest 8
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 12