flow/pkts: add rules w new syntax

inashivb · Dec 3, 2024 · a1e0152 · a1e0152
1 parent 5fe298c
commit a1e0152
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 2 deletions.
diff --git a/tests/detect-flow-pkts/README.md b/tests/detect-flow-pkts/README.md
@@ -1,7 +1,7 @@
 Test
 ====
 
-Test `flow.pkts_toclient` and alike (bytes, server) keywords
+Test `flow.pkts:toclient`.. and alike (bytes, server) keywords
 
 PCAP
 ====

diff --git a/tests/detect-flow-pkts/test.rules b/tests/detect-flow-pkts/test.rules
@@ -1 +1,2 @@
-alert ip any any -> any any (msg:"Flow has 10 packets"; flow.pkts_toclient:10; flow.pkts_toserver:10; flow.bytes_toserver:<3000; flow.bytes_toclient:>8000; sid:1;)
+alert ip any any -> any any (msg:"Flow has 10 packets"; flow.pkts:toclient,=10; flow.pkts:toserver,=10; flow.bytes:toserver,<3000; flow.bytes:toclient,>8000; sid:1;)
+alert ip any any -> any any (msg:"Flow has 10 packets (old syntax)"; flow.pkts_toclient:10; flow.pkts_toserver:10; flow.bytes_toserver:<3000; flow.bytes_toclient:>8000; sid:2;)
diff --git a/tests/detect-flow-pkts/test.yaml b/tests/detect-flow-pkts/test.yaml
@@ -12,3 +12,8 @@ checks:
     match:
       event_type: alert
       alert.signature_id: 1
+- filter:
+    count: 1
+    match:
+      event_type: alert
+      alert.signature_id: 2