OISF · catenacyber · Aug 12, 2024
diff --git a/tests/datasets-10-unset/README.md b/tests/datasets-10-unset/README.md
@@ -0,0 +1,20 @@
+Test Description
+================
+
+This test demonstrates the unset operation for datasets.
+
+PCAP
+====
+
+Running as server `python3 -m http.server 8001`
+And as clients
+```
+curl -A "useragent1" http://127.0.0.1:8001/toto
+curl -A "useragent2" http://127.0.0.1:8001/toto
+curl -A "useragent1" http://127.0.0.1:8001/tata
+```
+
+Related tickets
+===============
+
+https://redmine.openinfosecfoundation.org/issues/7195
diff --git a/tests/datasets-10-unset/expected/after.csv b/tests/datasets-10-unset/expected/after.csv
@@ -0,0 +1 @@
+dXNlcmFnZW50Mg==
diff --git a/tests/datasets-10-unset/test.rules b/tests/datasets-10-unset/test.rules
@@ -0,0 +1,2 @@
+alert http any any -> any any (http.uri; content: "/toto"; http.user_agent; dataset:set,ua-seen,type string,save after.csv; sid:1;)
+alert http any any -> any any (http.uri; content: "/tata"; http.user_agent; dataset:unset,ua-seen,type string,save after.csv; sid:2;)
diff --git a/tests/datasets-10-unset/test.yaml b/tests/datasets-10-unset/test.yaml
@@ -0,0 +1,21 @@
+requires:
+  min-version: 7
+
+args:
+  - --data-dir=${OUTPUT_DIR} -k none --runmode single
+
+checks:
+# 2 sets and 1 unset alerts
+  - filter:
+      count: 2
+      match:
+        event_type: alert
+        alert.signature_id: 1
+  - filter:
+      count: 1
+      match:
+        event_type: alert
+        alert.signature_id: 2
+  - file-compare:
+      filename: after.csv
+      expected: expected/after.csv
diff --git a/tests/datasets-10-unset/unset.pcap b/tests/datasets-10-unset/unset.pcap