ftp: improves check for alert app-layer data

diff --git a/tests/ftp/ftp-too-long-command/test.yaml b/tests/ftp/ftp-too-long-command/test.yaml
index 3336d888345fe5145342a0b1d42da32c45177bda..4ce3111b018cc17072ded31b3132463d0306ee22 100644 (file)
--- a/tests/ftp/ftp-too-long-command/test.yaml
+++ b/tests/ftp/ftp-too-long-command/test.yaml
@@ -34,3 +34,11 @@ checks:
       match:
         event_type: alert
         alert.signature_id: 2232000
+  # Alert has app-layer details.
+  - filter:
+      min-version: 8
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2232000
+        ftp.command: "RETR"