From 9f0a82de77ed36286e7ddd228267809cea469c4b Mon Sep 17 00:00:00 2001
From: Eric Leblond <el@stamus-networks.com>
Date: Wed, 19 Oct 2022 16:07:00 +0200
Subject: [PATCH] tests: filestore alert event

---
 tests/filestore-alert-log/README.md     |  7 +++++++
 tests/filestore-alert-log/suricata.yaml | 15 +++++++++++++++
 tests/filestore-alert-log/test.rules    |  1 +
 tests/filestore-alert-log/test.yaml     | 19 +++++++++++++++++++
 4 files changed, 42 insertions(+)
 create mode 100644 tests/filestore-alert-log/README.md
 create mode 100644 tests/filestore-alert-log/suricata.yaml
 create mode 100644 tests/filestore-alert-log/test.rules
 create mode 100644 tests/filestore-alert-log/test.yaml

diff --git a/tests/filestore-alert-log/README.md b/tests/filestore-alert-log/README.md
new file mode 100644
index 000000000..7b7d4bb7f
--- /dev/null
+++ b/tests/filestore-alert-log/README.md
@@ -0,0 +1,7 @@
+# Description
+
+Test alert event with filestore
+
+# PCAP
+
+The pcap comes from test filestore-filecontainer-http
diff --git a/tests/filestore-alert-log/suricata.yaml b/tests/filestore-alert-log/suricata.yaml
new file mode 100644
index 000000000..66ab441dd
--- /dev/null
+++ b/tests/filestore-alert-log/suricata.yaml
@@ -0,0 +1,15 @@
+%YAML 1.1
+---
+
+outputs:
+  - eve-log:
+      enabled: yes
+      types:
+        - files
+        - stats
+        - alert
+  - file-store:
+      version: 2
+      enabled: yes
+      stream-depth: 0
+      write-fileinfo: true
diff --git a/tests/filestore-alert-log/test.rules b/tests/filestore-alert-log/test.rules
new file mode 100644
index 000000000..c60c01bde
--- /dev/null
+++ b/tests/filestore-alert-log/test.rules
@@ -0,0 +1 @@
+alert http any any -> any any (msg:"store png images"; filemagic:"PNG image data"; filestore; sid:13371338; rev:1;)
diff --git a/tests/filestore-alert-log/test.yaml b/tests/filestore-alert-log/test.yaml
new file mode 100644
index 000000000..16143c2a3
--- /dev/null
+++ b/tests/filestore-alert-log/test.yaml
@@ -0,0 +1,19 @@
+pcap: ../filestore-filecontainer-http/filecontainer-http.pcap
+
+requires:
+  features:
+    - MAGIC
+  files:
+    - src/output-filestore.c
+
+checks:
+
+  - shell:
+        args: test -e filestore/e0/e092858d5bd66ab33085a966ee4ac0bf0edf6eab8d8b1e66432ee600e904bb4f
+
+  - filter:
+      min-version: 7
+      count: 1
+      match:
+        event_type: alert
+        files[0].storing: true
-- 
2.47.2