tests: add tests for fw hook lt mode

diff --git a/tests/firewall/ruletype-firewall-89-lt-sni/firewall.rules b/tests/firewall/ruletype-firewall-89-lt-sni/firewall.rules
new file mode 100644 (file)
index 0000000..40908c4
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-89-lt-sni/firewall.rules
@@ -0,0 +1,9 @@
+# accept outgoing ping and the returning pongs
+accept:flow icmp:flow_start $HOME_NET any -> $HOME_NET any (itype:8; msg:"Ping!"; alert; sid:101;)
+
+# allow session setup
+accept:hook tcp:all $HOME_NET any <> $EXTERNAL_NET any (flow:not_established; sid:1021;)
+accept:hook tcp:all $HOME_NET any <> $EXTERNAL_NET any (flow:established; sid:1022;)
+
+accept:flow tls:<client_hello_done $HOME_NET any -> $EXTERNAL_NET any (tls.sni; content:"www.google.com"; sid:9999; alert;)
+

diff --git a/tests/firewall/ruletype-firewall-89-lt-sni/suricata.yaml b/tests/firewall/ruletype-firewall-89-lt-sni/suricata.yaml
new file mode 100644 (file)
index 0000000..2af3243
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-89-lt-sni/suricata.yaml
@@ -0,0 +1,69 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+engine-analysis:
+  # enables printing reports for fast-pattern for every rule.
+  rules-fast-pattern: yes
+  # enables printing reports for each rule
+  rules: yes

diff --git a/tests/firewall/ruletype-firewall-89-lt-sni/test.yaml b/tests/firewall/ruletype-firewall-89-lt-sni/test.yaml
new file mode 100644 (file)
index 0000000..440a0e4
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-89-lt-sni/test.yaml
@@ -0,0 +1,45 @@
+pcap: ../../tls/tls-client-hello-frag-01/dump_mtu300.pcap
+
+requires:
+  min-version: 9
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 9999
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      pcap_cnt: 6
+      alert.signature_id: 9999
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 101
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 32
+      flow.pkts_toclient: 30
+      flow.state: "closed"
+      flow.alerted: true
+      flow.action: "accept"
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 62
+      stats.ips.blocked: 0

diff --git a/tests/firewall/ruletype-firewall-90-lt-sni-mix/firewall.rules b/tests/firewall/ruletype-firewall-90-lt-sni-mix/firewall.rules
new file mode 100644 (file)
index 0000000..af0bddc
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-90-lt-sni-mix/firewall.rules
@@ -0,0 +1,10 @@
+# accept outgoing ping and the returning pongs
+accept:flow icmp:flow_start $HOME_NET any -> $HOME_NET any (itype:8; msg:"Ping!"; alert; sid:101;)
+
+# allow session setup
+accept:hook tcp:all $HOME_NET any <> $EXTERNAL_NET any (flow:not_established; sid:1021;)
+accept:hook tcp:all $HOME_NET any <> $EXTERNAL_NET any (flow:established; sid:1022;)
+
+accept:hook tls:client_in_progress $HOME_NET any -> $EXTERNAL_NET any (sid:9998; alert;)
+accept:flow tls:<client_hello_done $HOME_NET any -> $EXTERNAL_NET any (tls.sni; content:"www.google.com"; sid:9999; alert;)
+

diff --git a/tests/firewall/ruletype-firewall-90-lt-sni-mix/suricata.yaml b/tests/firewall/ruletype-firewall-90-lt-sni-mix/suricata.yaml
new file mode 100644 (file)
index 0000000..2af3243
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-90-lt-sni-mix/suricata.yaml
@@ -0,0 +1,69 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+engine-analysis:
+  # enables printing reports for fast-pattern for every rule.
+  rules-fast-pattern: yes
+  # enables printing reports for each rule
+  rules: yes

diff --git a/tests/firewall/ruletype-firewall-90-lt-sni-mix/test.yaml b/tests/firewall/ruletype-firewall-90-lt-sni-mix/test.yaml
new file mode 100644 (file)
index 0000000..bbbd664
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-90-lt-sni-mix/test.yaml
@@ -0,0 +1,62 @@
+pcap: ../../tls/tls-client-hello-frag-01/dump_mtu300.pcap
+
+requires:
+  min-version: 9
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 2
+    match:
+      event_type: alert
+      alert.signature_id: 9998
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      pcap_cnt: 4
+      alert.signature_id: 9998
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      pcap_cnt: 6
+      alert.signature_id: 9998
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 9999
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      pcap_cnt: 6
+      alert.signature_id: 9999
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 101
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 32
+      flow.pkts_toclient: 30
+      flow.state: "closed"
+      flow.alerted: true
+      flow.action: "accept"
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 62
+      stats.ips.blocked: 0

diff --git a/tests/firewall/ruletype-firewall-91-lt-ua/firewall.rules b/tests/firewall/ruletype-firewall-91-lt-ua/firewall.rules
new file mode 100644 (file)
index 0000000..9ea1059
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-91-lt-ua/firewall.rules
@@ -0,0 +1,6 @@
+# Packet rules
+
+accept:hook tcp:all any any -> any any (sid:100;)
+# default drop
+
+accept:tx http1:<request_headers any any -> any any (http.user_agent; content:"curl"; alert; sid:9999;)

diff --git a/tests/firewall/ruletype-firewall-91-lt-ua/suricata.yaml b/tests/firewall/ruletype-firewall-91-lt-ua/suricata.yaml
new file mode 100644 (file)
index 0000000..24e38b5
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-91-lt-ua/suricata.yaml
@@ -0,0 +1,63 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop

diff --git a/tests/firewall/ruletype-firewall-91-lt-ua/test.yaml b/tests/firewall/ruletype-firewall-91-lt-ua/test.yaml
new file mode 100644 (file)
index 0000000..cfb1be8
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-91-lt-ua/test.yaml
@@ -0,0 +1,39 @@
+requires:
+  min-version: 9
+
+pcap: ../../flowbit-oring/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 100
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 9999
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 6
+      flow.pkts_toclient: 4
+      flow.state: "closed"
+      flow.alerted: true
+      not-has-key: flow.action
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 10
+      stats.ips.blocked: 0

diff --git a/tests/firewall/ruletype-firewall-92-lt-ua-mix/firewall.rules b/tests/firewall/ruletype-firewall-92-lt-ua-mix/firewall.rules
new file mode 100644 (file)
index 0000000..9903622
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-92-lt-ua-mix/firewall.rules
@@ -0,0 +1,7 @@
+# Packet rules
+
+accept:hook tcp:all any any -> any any (sid:100;)
+# default drop
+
+accept:hook http1:request_line any any -> any any (http.method; content:"GET"; alert; sid:9998;)
+accept:tx http1:<request_headers any any -> any any (http.user_agent; content:"curl"; alert; sid:9999;)

diff --git a/tests/firewall/ruletype-firewall-92-lt-ua-mix/suricata.yaml b/tests/firewall/ruletype-firewall-92-lt-ua-mix/suricata.yaml
new file mode 100644 (file)
index 0000000..3c4c18b
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-92-lt-ua-mix/suricata.yaml
@@ -0,0 +1,69 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+
+firewall:
+  policies:
+    http:
+      request-started: [ "accept:hook" ]

diff --git a/tests/firewall/ruletype-firewall-92-lt-ua-mix/test.yaml b/tests/firewall/ruletype-firewall-92-lt-ua-mix/test.yaml
new file mode 100644 (file)
index 0000000..6200464
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-92-lt-ua-mix/test.yaml
@@ -0,0 +1,44 @@
+requires:
+  min-version: 9
+
+pcap: ../../flowbit-oring/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 100
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 9998
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 9999
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 6
+      flow.pkts_toclient: 4
+      flow.state: "closed"
+      flow.alerted: true
+      not-has-key: flow.action
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 10
+      stats.ips.blocked: 0

diff --git a/tests/firewall/ruletype-firewall-93-lt-ua-mix-accept-hook/firewall.rules b/tests/firewall/ruletype-firewall-93-lt-ua-mix-accept-hook/firewall.rules
new file mode 100644 (file)
index 0000000..e6ceccc
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-93-lt-ua-mix-accept-hook/firewall.rules
@@ -0,0 +1,7 @@
+# Packet rules
+
+accept:hook tcp:all any any -> any any (sid:100;)
+# default drop
+
+accept:hook http1:request_line any any -> any any (http.method; content:"GET"; alert; sid:9998;)
+accept:hook http1:<request_headers any any -> any any (http.user_agent; content:"curl"; alert; sid:9999;)

diff --git a/tests/firewall/ruletype-firewall-93-lt-ua-mix-accept-hook/suricata.yaml b/tests/firewall/ruletype-firewall-93-lt-ua-mix-accept-hook/suricata.yaml
new file mode 100644 (file)
index 0000000..e4daaff
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-93-lt-ua-mix-accept-hook/suricata.yaml
@@ -0,0 +1,73 @@
+%YAML 1.1
+---
+
+vars:
+  # more specific is better for alert accuracy and performance
+  address-groups:
+    HOME_NET: "[192.168.0.0/16,10.0.0.0/8,172.16.0.0/12]"
+    #HOME_NET: "[192.168.0.0/16]"
+    #HOME_NET: "[10.0.0.0/8]"
+    #HOME_NET: "[172.16.0.0/12]"
+    #HOME_NET: "any"
+
+    EXTERNAL_NET: "!$HOME_NET"
+    #EXTERNAL_NET: "any"
+
+    HTTP_SERVERS: "$HOME_NET"
+    SMTP_SERVERS: "$HOME_NET"
+    SQL_SERVERS: "$HOME_NET"
+    DNS_SERVERS: "$HOME_NET"
+    TELNET_SERVERS: "$HOME_NET"
+    AIM_SERVERS: "$EXTERNAL_NET"
+    DC_SERVERS: "$HOME_NET"
+    DNP3_SERVER: "$HOME_NET"
+    DNP3_CLIENT: "$HOME_NET"
+    MODBUS_CLIENT: "$HOME_NET"
+    MODBUS_SERVER: "$HOME_NET"
+    ENIP_CLIENT: "$HOME_NET"
+    ENIP_SERVER: "$HOME_NET"
+
+  port-groups:
+    HTTP_PORTS: "80"
+    SHELLCODE_PORTS: "!80"
+    ORACLE_PORTS: 1521
+    SSH_PORTS: 22
+    DNP3_PORTS: 20000
+    MODBUS_PORTS: 502
+    FILE_DATA_PORTS: "[$HTTP_PORTS,110,143]"
+    FTP_PORTS: 21
+    GENEVE_PORTS: 6081
+    VXLAN_PORTS: 4789
+    TEREDO_PORTS: 3544
+    SIP_PORTS: "[5060, 5061]"
+
+# Global stats configuration
+stats:
+  enabled: yes
+  interval: 8
+
+# Configure the type of alert (and other) logging you would like.
+outputs:
+  - eve-log:
+      enabled: yes
+      filetype: regular #regular|syslog|unix_dgram|unix_stream|redis
+      filename: eve.json
+      types:
+        - stats
+        - flow
+        - alert
+        - tls:
+            extended: yes     # enable this for extended logging information
+        - drop:
+            alerts: yes      # log alerts that caused drops
+            flows: all       # start or all: 'start' logs only a single drop
+
+
+firewall:
+  policies:
+    http:
+      request-started: [ "accept:hook" ]
+
+      request-body: [ "accept:hook" ]
+      request-trailer: [ "accept:hook" ]
+      request-complete: [ "accept:tx" ]

diff --git a/tests/firewall/ruletype-firewall-93-lt-ua-mix-accept-hook/test.yaml b/tests/firewall/ruletype-firewall-93-lt-ua-mix-accept-hook/test.yaml
new file mode 100644 (file)
index 0000000..6200464
--- /dev/null
+++ b/tests/firewall/ruletype-firewall-93-lt-ua-mix-accept-hook/test.yaml
@@ -0,0 +1,44 @@
+requires:
+  min-version: 9
+
+pcap: ../../flowbit-oring/input.pcap
+
+args:
+  - --simulate-ips
+  - -k none
+
+checks:
+- filter:
+    count: 0
+    match:
+      event_type: alert
+      alert.signature_id: 100
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 9998
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 9999
+- filter:
+    count: 0
+    match:
+      event_type: drop
+- filter:
+    count: 1
+    match:
+      event_type: flow
+      flow.pkts_toserver: 6
+      flow.pkts_toclient: 4
+      flow.state: "closed"
+      flow.alerted: true
+      not-has-key: flow.action
+- filter:
+    count: 1
+    match:
+      event_type: stats
+      stats.ips.accepted: 10
+      stats.ips.blocked: 0