from atena.simulation.actions import (
    GroupAction,
    Column,
    AggregationFunction,
    BackAction,
    FilterAction,
    FilterOperator,
)

reference1 = [
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_dst'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('highest_layer'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('tcp_dstport'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    BackAction(),
    BackAction(),
    BackAction(),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS, filter_term='SYN, ACK'),
    BackAction(),
    FilterAction(filtered_column=Column('highest_layer'), filter_operator=FilterOperator.EQUAL, filter_term='DATA'),
    BackAction(),
]

reference2 = [
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_dst'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('highest_layer'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('highest_layer'), filter_operator=FilterOperator.EQUAL, filter_term='TCP'),
    GroupAction(grouped_column=Column('tcp_srcport'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS, filter_term='SYN, ACK'),
    GroupAction(grouped_column=Column('tcp_stream'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('length'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    BackAction(),
    BackAction(),
    BackAction(),
]

reference3 = [
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_dst'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('highest_layer'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    GroupAction(grouped_column=Column('tcp_dstport'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    GroupAction(grouped_column=Column('tcp_srcport'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS, filter_term='SYN, ACK'),
    BackAction(),
    BackAction(),
    BackAction(),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS,
                 filter_term='[FIN, PSH, URG]'),
]

reference4 = [
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_dst'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('highest_layer'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    BackAction(),
    BackAction(),
    FilterAction(filtered_column=Column('highest_layer'), filter_operator=FilterOperator.NOTEQUAL, filter_term='TCP'),
    BackAction(),
    FilterAction(filtered_column=Column('ip_dst'), filter_operator=FilterOperator.NOTEQUAL, filter_term='10.42.42.253'),
    FilterAction(filtered_column=Column('ip_src'), filter_operator=FilterOperator.NOTEQUAL, filter_term='10.42.42.253'),
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('tcp_stream'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
]

reference5 = [
    GroupAction(grouped_column=Column('eth_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_dst'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    BackAction(),
    BackAction(),
    GroupAction(grouped_column=Column('highest_layer'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('tcp_srcport'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS,
                 filter_term='[SYN, ACK]'),
    GroupAction(grouped_column=Column('tcp_stream'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    BackAction(),
]

reference6 = [
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_dst'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('highest_layer'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    GroupAction(grouped_column=Column('tcp_srcport'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS,
                 filter_term='[SYN, ACK]'),
    BackAction(),
    BackAction(),
    FilterAction(filtered_column=Column('ip_src'), filter_operator=FilterOperator.EQUAL, filter_term='10.42.42.253'),
    GroupAction(grouped_column=Column('length'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS,
                 filter_term='[FIN, PSH, URG]'),
    BackAction(),
]

reference7 = [
    GroupAction(grouped_column=Column('ip_dst'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('tcp_srcport'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS,
                 filter_term='[SYN, ACK]'),
    BackAction(),
    BackAction(),
    BackAction(),
    BackAction(),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS, filter_term='FIN'),
    BackAction(),
    FilterAction(filtered_column=Column('highest_layer'), filter_operator=FilterOperator.EQUAL, filter_term='ICMP'),
    BackAction(),
]


cyber4_references = [reference1, reference2, reference3, reference4, reference5, reference6, reference7]

assert all([len(reference) == 12 for reference in cyber4_references])

cd312f0b3ff127d340f67669b545a27bf2fe1835
<mask token>

<mask token>
assert all([(len(reference) == 12) for reference in cyber4_references])

<mask token>
reference1 = [GroupAction(grouped_column=Column('ip_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_dst'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column(
    'highest_layer'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), GroupAction(
    grouped_column=Column('tcp_dstport'), aggregated_column=Column(
    'packet_number'), aggregation_function=AggregationFunction.COUNT),
    BackAction(), BackAction(), BackAction(), BackAction(), FilterAction(
    filtered_column=Column('info_line'), filter_operator=FilterOperator.
    CONTAINS, filter_term='SYN, ACK'), BackAction(), FilterAction(
    filtered_column=Column('highest_layer'), filter_operator=FilterOperator
    .EQUAL, filter_term='DATA'), BackAction()]
reference2 = [GroupAction(grouped_column=Column('ip_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_dst'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column(
    'highest_layer'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), FilterAction(
    filtered_column=Column('highest_layer'), filter_operator=FilterOperator
    .EQUAL, filter_term='TCP'), GroupAction(grouped_column=Column(
    'tcp_srcport'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), FilterAction(
    filtered_column=Column('info_line'), filter_operator=FilterOperator.
    CONTAINS, filter_term='SYN, ACK'), GroupAction(grouped_column=Column(
    'tcp_stream'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), GroupAction(
    grouped_column=Column('length'), aggregated_column=Column(
    'packet_number'), aggregation_function=AggregationFunction.COUNT),
    BackAction(), BackAction(), BackAction(), BackAction()]
reference3 = [GroupAction(grouped_column=Column('ip_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_dst'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column(
    'highest_layer'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), BackAction(),
    GroupAction(grouped_column=Column('tcp_dstport'), aggregated_column=
    Column('packet_number'), aggregation_function=AggregationFunction.COUNT
    ), BackAction(), GroupAction(grouped_column=Column('tcp_srcport'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), FilterAction(filtered_column=Column(
    'info_line'), filter_operator=FilterOperator.CONTAINS, filter_term=
    'SYN, ACK'), BackAction(), BackAction(), BackAction(), FilterAction(
    filtered_column=Column('info_line'), filter_operator=FilterOperator.
    CONTAINS, filter_term='[FIN, PSH, URG]')]
reference4 = [GroupAction(grouped_column=Column('ip_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_dst'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column(
    'highest_layer'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), BackAction(),
    BackAction(), BackAction(), FilterAction(filtered_column=Column(
    'highest_layer'), filter_operator=FilterOperator.NOTEQUAL, filter_term=
    'TCP'), BackAction(), FilterAction(filtered_column=Column('ip_dst'),
    filter_operator=FilterOperator.NOTEQUAL, filter_term='10.42.42.253'),
    FilterAction(filtered_column=Column('ip_src'), filter_operator=
    FilterOperator.NOTEQUAL, filter_term='10.42.42.253'), GroupAction(
    grouped_column=Column('ip_src'), aggregated_column=Column(
    'packet_number'), aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('tcp_stream'), aggregated_column=
    Column('packet_number'), aggregation_function=AggregationFunction.COUNT)]
reference5 = [GroupAction(grouped_column=Column('eth_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_dst'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), BackAction(), BackAction(), BackAction(),
    GroupAction(grouped_column=Column('highest_layer'), aggregated_column=
    Column('packet_number'), aggregation_function=AggregationFunction.COUNT
    ), GroupAction(grouped_column=Column('tcp_srcport'), aggregated_column=
    Column('packet_number'), aggregation_function=AggregationFunction.COUNT
    ), FilterAction(filtered_column=Column('info_line'), filter_operator=
    FilterOperator.CONTAINS, filter_term='[SYN, ACK]'), GroupAction(
    grouped_column=Column('tcp_stream'), aggregated_column=Column(
    'packet_number'), aggregation_function=AggregationFunction.COUNT),
    BackAction(), BackAction()]
reference6 = [GroupAction(grouped_column=Column('ip_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_dst'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column(
    'highest_layer'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), BackAction(),
    GroupAction(grouped_column=Column('tcp_srcport'), aggregated_column=
    Column('packet_number'), aggregation_function=AggregationFunction.COUNT
    ), FilterAction(filtered_column=Column('info_line'), filter_operator=
    FilterOperator.CONTAINS, filter_term='[SYN, ACK]'), BackAction(),
    BackAction(), FilterAction(filtered_column=Column('ip_src'),
    filter_operator=FilterOperator.EQUAL, filter_term='10.42.42.253'),
    GroupAction(grouped_column=Column('length'), aggregated_column=Column(
    'packet_number'), aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('info_line'), filter_operator=
    FilterOperator.CONTAINS, filter_term='[FIN, PSH, URG]'), BackAction()]
reference7 = [GroupAction(grouped_column=Column('ip_dst'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column(
    'tcp_srcport'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), FilterAction(
    filtered_column=Column('info_line'), filter_operator=FilterOperator.
    CONTAINS, filter_term='[SYN, ACK]'), BackAction(), BackAction(),
    BackAction(), BackAction(), FilterAction(filtered_column=Column(
    'info_line'), filter_operator=FilterOperator.CONTAINS, filter_term=
    'FIN'), BackAction(), FilterAction(filtered_column=Column(
    'highest_layer'), filter_operator=FilterOperator.EQUAL, filter_term=
    'ICMP'), BackAction()]
cyber4_references = [reference1, reference2, reference3, reference4,
    reference5, reference6, reference7]
assert all([(len(reference) == 12) for reference in cyber4_references])

from atena.simulation.actions import GroupAction, Column, AggregationFunction, BackAction, FilterAction, FilterOperator
reference1 = [GroupAction(grouped_column=Column('ip_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_dst'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column(
    'highest_layer'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), GroupAction(
    grouped_column=Column('tcp_dstport'), aggregated_column=Column(
    'packet_number'), aggregation_function=AggregationFunction.COUNT),
    BackAction(), BackAction(), BackAction(), BackAction(), FilterAction(
    filtered_column=Column('info_line'), filter_operator=FilterOperator.
    CONTAINS, filter_term='SYN, ACK'), BackAction(), FilterAction(
    filtered_column=Column('highest_layer'), filter_operator=FilterOperator
    .EQUAL, filter_term='DATA'), BackAction()]
reference2 = [GroupAction(grouped_column=Column('ip_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_dst'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column(
    'highest_layer'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), FilterAction(
    filtered_column=Column('highest_layer'), filter_operator=FilterOperator
    .EQUAL, filter_term='TCP'), GroupAction(grouped_column=Column(
    'tcp_srcport'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), FilterAction(
    filtered_column=Column('info_line'), filter_operator=FilterOperator.
    CONTAINS, filter_term='SYN, ACK'), GroupAction(grouped_column=Column(
    'tcp_stream'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), GroupAction(
    grouped_column=Column('length'), aggregated_column=Column(
    'packet_number'), aggregation_function=AggregationFunction.COUNT),
    BackAction(), BackAction(), BackAction(), BackAction()]
reference3 = [GroupAction(grouped_column=Column('ip_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_dst'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column(
    'highest_layer'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), BackAction(),
    GroupAction(grouped_column=Column('tcp_dstport'), aggregated_column=
    Column('packet_number'), aggregation_function=AggregationFunction.COUNT
    ), BackAction(), GroupAction(grouped_column=Column('tcp_srcport'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), FilterAction(filtered_column=Column(
    'info_line'), filter_operator=FilterOperator.CONTAINS, filter_term=
    'SYN, ACK'), BackAction(), BackAction(), BackAction(), FilterAction(
    filtered_column=Column('info_line'), filter_operator=FilterOperator.
    CONTAINS, filter_term='[FIN, PSH, URG]')]
reference4 = [GroupAction(grouped_column=Column('ip_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_dst'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column(
    'highest_layer'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), BackAction(),
    BackAction(), BackAction(), FilterAction(filtered_column=Column(
    'highest_layer'), filter_operator=FilterOperator.NOTEQUAL, filter_term=
    'TCP'), BackAction(), FilterAction(filtered_column=Column('ip_dst'),
    filter_operator=FilterOperator.NOTEQUAL, filter_term='10.42.42.253'),
    FilterAction(filtered_column=Column('ip_src'), filter_operator=
    FilterOperator.NOTEQUAL, filter_term='10.42.42.253'), GroupAction(
    grouped_column=Column('ip_src'), aggregated_column=Column(
    'packet_number'), aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('tcp_stream'), aggregated_column=
    Column('packet_number'), aggregation_function=AggregationFunction.COUNT)]
reference5 = [GroupAction(grouped_column=Column('eth_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_dst'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), BackAction(), BackAction(), BackAction(),
    GroupAction(grouped_column=Column('highest_layer'), aggregated_column=
    Column('packet_number'), aggregation_function=AggregationFunction.COUNT
    ), GroupAction(grouped_column=Column('tcp_srcport'), aggregated_column=
    Column('packet_number'), aggregation_function=AggregationFunction.COUNT
    ), FilterAction(filtered_column=Column('info_line'), filter_operator=
    FilterOperator.CONTAINS, filter_term='[SYN, ACK]'), GroupAction(
    grouped_column=Column('tcp_stream'), aggregated_column=Column(
    'packet_number'), aggregation_function=AggregationFunction.COUNT),
    BackAction(), BackAction()]
reference6 = [GroupAction(grouped_column=Column('ip_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_dst'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column(
    'highest_layer'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), BackAction(),
    GroupAction(grouped_column=Column('tcp_srcport'), aggregated_column=
    Column('packet_number'), aggregation_function=AggregationFunction.COUNT
    ), FilterAction(filtered_column=Column('info_line'), filter_operator=
    FilterOperator.CONTAINS, filter_term='[SYN, ACK]'), BackAction(),
    BackAction(), FilterAction(filtered_column=Column('ip_src'),
    filter_operator=FilterOperator.EQUAL, filter_term='10.42.42.253'),
    GroupAction(grouped_column=Column('length'), aggregated_column=Column(
    'packet_number'), aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('info_line'), filter_operator=
    FilterOperator.CONTAINS, filter_term='[FIN, PSH, URG]'), BackAction()]
reference7 = [GroupAction(grouped_column=Column('ip_dst'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column('ip_src'),
    aggregated_column=Column('packet_number'), aggregation_function=
    AggregationFunction.COUNT), GroupAction(grouped_column=Column(
    'tcp_srcport'), aggregated_column=Column('packet_number'),
    aggregation_function=AggregationFunction.COUNT), FilterAction(
    filtered_column=Column('info_line'), filter_operator=FilterOperator.
    CONTAINS, filter_term='[SYN, ACK]'), BackAction(), BackAction(),
    BackAction(), BackAction(), FilterAction(filtered_column=Column(
    'info_line'), filter_operator=FilterOperator.CONTAINS, filter_term=
    'FIN'), BackAction(), FilterAction(filtered_column=Column(
    'highest_layer'), filter_operator=FilterOperator.EQUAL, filter_term=
    'ICMP'), BackAction()]
cyber4_references = [reference1, reference2, reference3, reference4,
    reference5, reference6, reference7]
assert all([(len(reference) == 12) for reference in cyber4_references])

from atena.simulation.actions import (
    GroupAction,
    Column,
    AggregationFunction,
    BackAction,
    FilterAction,
    FilterOperator,
)

reference1 = [
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_dst'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('highest_layer'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('tcp_dstport'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    BackAction(),
    BackAction(),
    BackAction(),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS, filter_term='SYN, ACK'),
    BackAction(),
    FilterAction(filtered_column=Column('highest_layer'), filter_operator=FilterOperator.EQUAL, filter_term='DATA'),
    BackAction(),
]

reference2 = [
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_dst'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('highest_layer'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('highest_layer'), filter_operator=FilterOperator.EQUAL, filter_term='TCP'),
    GroupAction(grouped_column=Column('tcp_srcport'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS, filter_term='SYN, ACK'),
    GroupAction(grouped_column=Column('tcp_stream'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('length'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    BackAction(),
    BackAction(),
    BackAction(),
]

reference3 = [
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_dst'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('highest_layer'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    GroupAction(grouped_column=Column('tcp_dstport'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    GroupAction(grouped_column=Column('tcp_srcport'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS, filter_term='SYN, ACK'),
    BackAction(),
    BackAction(),
    BackAction(),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS,
                 filter_term='[FIN, PSH, URG]'),
]

reference4 = [
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_dst'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('highest_layer'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    BackAction(),
    BackAction(),
    FilterAction(filtered_column=Column('highest_layer'), filter_operator=FilterOperator.NOTEQUAL, filter_term='TCP'),
    BackAction(),
    FilterAction(filtered_column=Column('ip_dst'), filter_operator=FilterOperator.NOTEQUAL, filter_term='10.42.42.253'),
    FilterAction(filtered_column=Column('ip_src'), filter_operator=FilterOperator.NOTEQUAL, filter_term='10.42.42.253'),
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('tcp_stream'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
]

reference5 = [
    GroupAction(grouped_column=Column('eth_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_dst'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    BackAction(),
    BackAction(),
    GroupAction(grouped_column=Column('highest_layer'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('tcp_srcport'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS,
                 filter_term='[SYN, ACK]'),
    GroupAction(grouped_column=Column('tcp_stream'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    BackAction(),
]

reference6 = [
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_dst'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('highest_layer'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    BackAction(),
    GroupAction(grouped_column=Column('tcp_srcport'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS,
                 filter_term='[SYN, ACK]'),
    BackAction(),
    BackAction(),
    FilterAction(filtered_column=Column('ip_src'), filter_operator=FilterOperator.EQUAL, filter_term='10.42.42.253'),
    GroupAction(grouped_column=Column('length'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS,
                 filter_term='[FIN, PSH, URG]'),
    BackAction(),
]

reference7 = [
    GroupAction(grouped_column=Column('ip_dst'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('ip_src'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    GroupAction(grouped_column=Column('tcp_srcport'), aggregated_column=Column('packet_number'),
                aggregation_function=AggregationFunction.COUNT),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS,
                 filter_term='[SYN, ACK]'),
    BackAction(),
    BackAction(),
    BackAction(),
    BackAction(),
    FilterAction(filtered_column=Column('info_line'), filter_operator=FilterOperator.CONTAINS, filter_term='FIN'),
    BackAction(),
    FilterAction(filtered_column=Column('highest_layer'), filter_operator=FilterOperator.EQUAL, filter_term='ICMP'),
    BackAction(),
]


cyber4_references = [reference1, reference2, reference3, reference4, reference5, reference6, reference7]

assert all([len(reference) == 12 for reference in cyber4_references])
