test.yaml

requires:
  features:
    - HAVE_LIBJANSSON

pcap: ../filemagic-flowbits/pdf-dl.pcap

args:
  - -k none

checks:
  - filter:
      count: 1
      match:
        alert.signature_id: 1
  - filter:
      count: 1
      match:
        alert.signature_id: 2
  - filter:
      count: 1
      match:
        alert.signature_id: 3
  - filter:
      count: 1
      match:
        alert.signature_id: 4
  - filter:
      count: 1
      match:
        alert.signature_id: 5
  - filter:
      count: 1
      match:
        alert.signature_id: 6
  - filter:
      count: 0
      match:
        alert.signature_id: 7
  - filter:
      count: 0
      match:
        alert.signature_id: 8
  - filter:
      count: 0
      match:
        alert.signature_id: 9