diff --git a/test/falco_tests.yaml.in b/test/falco_tests.yaml.in index 793446c6..69447004 100644 --- a/test/falco_tests.yaml.in +++ b/test/falco_tests.yaml.in @@ -113,6 +113,12 @@ trace_files: !mux - "open.*" trace_file: trace_files/cat_write.scap + disabled_rules_using_enabled_flag: + detect: False + rules_file: + - rules/single_rule_enabled_flag.yaml + trace_file: trace_files/cat_write.scap + file_output: detect: True detect_level: WARNING diff --git a/test/rules/single_rule_enabled_flag.yaml b/test/rules/single_rule_enabled_flag.yaml new file mode 100644 index 00000000..dd5c204b --- /dev/null +++ b/test/rules/single_rule_enabled_flag.yaml @@ -0,0 +1,9 @@ +- macro: is_cat + condition: proc.name=cat + +- rule: open_from_cat + desc: A process named cat does an open + condition: evt.type=open and is_cat + output: "An open was seen (command=%proc.cmdline)" + priority: WARNING + enabled: false