diff --git a/tests/detect-to_lowercase-01/input.rules b/tests/detect-to_lowercase-01/input.rules new file mode 100644 index 000000000..9c5ef937d --- /dev/null +++ b/tests/detect-to_lowercase-01/input.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"lower-case 1"; flow:established; file_data; to_lowercase; content:"at patpoopy, we have"; sid:1;) diff --git a/tests/detect-to_lowercase-01/test.yaml b/tests/detect-to_lowercase-01/test.yaml new file mode 100644 index 000000000..fbaae82f0 --- /dev/null +++ b/tests/detect-to_lowercase-01/test.yaml @@ -0,0 +1,14 @@ +pcap: ../bug-3616-ips/input.pcap + +requires: + min-version: 7.0.3 + pcap: false + +exit-code: 0 + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1 diff --git a/tests/detect-to_uppercase-01/input.rules b/tests/detect-to_uppercase-01/input.rules new file mode 100644 index 000000000..3b0900aff --- /dev/null +++ b/tests/detect-to_uppercase-01/input.rules @@ -0,0 +1 @@ +alert http any any -> any any (msg:"lower-case 1"; flow:established; file_data; to_uppercase; content:"AT PATPOOPY, WE HAVE"; sid:1;) diff --git a/tests/detect-to_uppercase-01/test.yaml b/tests/detect-to_uppercase-01/test.yaml new file mode 100644 index 000000000..fbaae82f0 --- /dev/null +++ b/tests/detect-to_uppercase-01/test.yaml @@ -0,0 +1,14 @@ +pcap: ../bug-3616-ips/input.pcap + +requires: + min-version: 7.0.3 + pcap: false + +exit-code: 0 + +checks: + - filter: + count: 1 + match: + event_type: alert + alert.signature_id: 1