requires:
  min-version: 8

pcap: input.pcap

args:
  - --simulate-ips

checks:
# - filter:
#     count: 0
#     match:
#       event_type: alert
# - filter:
#     count: 0
#     match:
#       event_type: alert
#       alert.signature_id: 1
- filter:
    count: 1
    match:
      event_type: drop
- filter:
    match:
      count: 1
      event_type: stats
      stats.ips.accepted: 3
      stats.ips.blocked: 7
