Verifying rule names can have spaces.

Related to discussion on https://github.com/draios/agent/pull/160,
verifying we can have rule names with spaces.
This commit is contained in:
Mark Stemm 2016-08-22 19:34:54 -07:00
parent e717e3e3e0
commit 2731fd5ae1
2 changed files with 15 additions and 0 deletions

View File

@ -61,6 +61,13 @@ trace_files: !mux
- repeated_evttypes_with_separate_in: [open]
- repeated_evttypes_with_mix: [open]
rule_names_with_spaces:
detect: True
detect_level: WARNING
rules_file:
- rules/rule_names_with_spaces.yaml
trace_file: trace_files/cat_write.scap
multiple_rules_first_empty:
detect: True
detect_level: WARNING

View File

@ -0,0 +1,8 @@
- macro: is_cat
condition: proc.name=cat
- rule: Open From Cat
desc: A process named cat does an open
condition: evt.type=open and is_cat
output: "An open was seen (command=%proc.cmdline)"
priority: WARNING