From b07975ca4b2b7b07e3fe7dc55c330256c4a7fc27 Mon Sep 17 00:00:00 2001 From: Jason Ish Date: Tue, 19 Dec 2023 12:10:50 -0600 Subject: [PATCH] requires: check stat; unknown requires keyword --- tests/requires/test.rules | 2 ++ tests/requires/test.yaml | 6 ++++++ 2 files changed, 8 insertions(+) diff --git a/tests/requires/test.rules b/tests/requires/test.rules index eaa41a412..2d24c964f 100644 --- a/tests/requires/test.rules +++ b/tests/requires/test.rules @@ -13,3 +13,5 @@ alert vxlan any any -> any any (requires: version >= 10; sid:1;) alert udp any any -> any any (vxlan_vni:10; requires: version >= 10; sid:2;) alert http any any => any any (requires: version >= 10; sid:3;) alert tcp any any -> any any (frame:smtp.not_supported; requires: version >= 10; sid:4;) + +alert asdf any any -> any any (requires: version >= 6, foo bar; sid:102; rev:1;) diff --git a/tests/requires/test.yaml b/tests/requires/test.yaml index 63ac64c08..72f7e67b6 100644 --- a/tests/requires/test.yaml +++ b/tests/requires/test.yaml @@ -42,3 +42,9 @@ checks: count: 0 match: alert.signature_id: 9 + + - filter: + count: 1 + match: + event_type: stats + stats.detect.engines[0].rules_skipped: 7 -- 2.47.2