tests: add threshold by_flow test

Ticket: #6822.

diff --git a/tests/threshold/threshold-rule-flow/README.md b/tests/threshold/threshold-rule-flow/README.md
new file mode 100644 (file)
index 0000000..3a000ae
--- /dev/null
+++ b/tests/threshold/threshold-rule-flow/README.md
@@ -0,0 +1,3 @@
+PCAP
+====
+PCAP from https://wiki.wireshark.org/Internet_Control_Message_Protocol

diff --git a/tests/threshold/threshold-rule-flow/icmp.pcap b/tests/threshold/threshold-rule-flow/icmp.pcap
new file mode 100644 (file)
index 0000000..037606d
Binary files /dev/null and b/tests/threshold/threshold-rule-flow/icmp.pcap differ

diff --git a/tests/threshold/threshold-rule-flow/test.rules b/tests/threshold/threshold-rule-flow/test.rules
new file mode 100644 (file)
index 0000000..602c249
--- /dev/null
+++ b/tests/threshold/threshold-rule-flow/test.rules
@@ -0,0 +1,4 @@
+alert icmp any any -> any any (itype:8; sid:1;)
+alert icmp any any -> any any (itype:8; threshold:type limit, track by_flow, count 1, seconds 3600; sid:2;)
+alert icmp any any -> any any (itype:8; threshold:type limit, track by_flow, count 2, seconds 3600; sid:3;)
+alert icmp any any -> any any (itype:8; threshold:type both, track by_flow, count 3, seconds 3600; sid:4;)

diff --git a/tests/threshold/threshold-rule-flow/test.yaml b/tests/threshold/threshold-rule-flow/test.yaml
new file mode 100644 (file)
index 0000000..cfa5028
--- /dev/null
+++ b/tests/threshold/threshold-rule-flow/test.yaml
@@ -0,0 +1,24 @@
+requires:
+  min-version: 8
+
+checks:
+  - filter:
+      count: 8
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
+  - filter:
+      count: 2
+      match:
+        event_type: alert
+        alert.signature_id: 3
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 4