mirror of
https://github.com/falcosecurity/falco.git
synced 2025-08-12 11:32:39 +00:00
Verifying rule names can have spaces.
Related to discussion on https://github.com/draios/agent/pull/160, verifying we can have rule names with spaces.
This commit is contained in:
parent
e717e3e3e0
commit
2731fd5ae1
@ -61,6 +61,13 @@ trace_files: !mux
|
|||||||
- repeated_evttypes_with_separate_in: [open]
|
- repeated_evttypes_with_separate_in: [open]
|
||||||
- repeated_evttypes_with_mix: [open]
|
- repeated_evttypes_with_mix: [open]
|
||||||
|
|
||||||
|
rule_names_with_spaces:
|
||||||
|
detect: True
|
||||||
|
detect_level: WARNING
|
||||||
|
rules_file:
|
||||||
|
- rules/rule_names_with_spaces.yaml
|
||||||
|
trace_file: trace_files/cat_write.scap
|
||||||
|
|
||||||
multiple_rules_first_empty:
|
multiple_rules_first_empty:
|
||||||
detect: True
|
detect: True
|
||||||
detect_level: WARNING
|
detect_level: WARNING
|
||||||
|
8
test/rules/rule_names_with_spaces.yaml
Normal file
8
test/rules/rule_names_with_spaces.yaml
Normal file
@ -0,0 +1,8 @@
|
|||||||
|
- macro: is_cat
|
||||||
|
condition: proc.name=cat
|
||||||
|
|
||||||
|
- rule: Open From Cat
|
||||||
|
desc: A process named cat does an open
|
||||||
|
condition: evt.type=open and is_cat
|
||||||
|
output: "An open was seen (command=%proc.cmdline)"
|
||||||
|
priority: WARNING
|
Loading…
Reference in New Issue
Block a user