From 35d0f0603fd6b4c57026fd44eac559ef727a998e Mon Sep 17 00:00:00 2001 From: Josh Soref Date: Thu, 24 Feb 2022 01:48:07 -0500 Subject: [PATCH] spelling: multitrailing Signed-off-by: Josh Soref --- test/falco_tests.yaml | 4 ++-- test/rules/falco_rules_warnings.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/test/falco_tests.yaml b/test/falco_tests.yaml index cad3029b..c8536624 100644 --- a/test/falco_tests.yaml +++ b/test/falco_tests.yaml @@ -44,8 +44,8 @@ trace_files: !mux - not_equals_after_evttype: [execve] - not_after_evttype: [execve] - leading_trailing_evttypes: [execve,open] - - leading_multtrailing_evttypes: [connect,execve,open] - - leading_multtrailing_evttypes_using_in: [connect,execve,open] + - leading_multitrailing_evttypes: [connect,execve,open] + - leading_multitrailing_evttypes_using_in: [connect,execve,open] - not_equals_at_end: [all] - not_at_end: [all] - not_before_trailing_evttype: [all] diff --git a/test/rules/falco_rules_warnings.yaml b/test/rules/falco_rules_warnings.yaml index ba44d971..38d390d6 100644 --- a/test/rules/falco_rules_warnings.yaml +++ b/test/rules/falco_rules_warnings.yaml @@ -56,13 +56,13 @@ output: "None" priority: WARNING -- rule: leading_multtrailing_evttypes +- rule: leading_multitrailing_evttypes desc: one evttype at beginning, multiple at end condition: evt.type=execve and proc.name=foo or evt.type=open or evt.type=connect output: "None" priority: WARNING -- rule: leading_multtrailing_evttypes_using_in +- rule: leading_multitrailing_evttypes_using_in desc: one evttype at beginning, multiple at end, using in condition: evt.type=execve and proc.name=foo or evt.type in (open, connect) output: "None"