github/falco
1
0
Fork 0
mirror of https://github.com/falcosecurity/falco.git synced 2025-09-13 05:22:34 +00:00
Code Issues Projects Releases Wiki Activity

new(test): regression test for FAL-01-003

Browse Source 
Signed-off-by: Leonardo Di Donato <leodidonato@gmail.com>
This commit is contained in:
Leonardo Di Donato
2021-04-19 12:47:39 +00:00
committed by poiana
parent d3c22d3d0c
commit 6e94c37399
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
test/falco_k8s_audit_tests.yaml
View File

@@ -623,3 +623,12 @@ trace_files: !mux
detect_counts: detect_counts:
- K8s Secret Deleted: 1 - K8s Secret Deleted: 1
trace_file: trace_files/k8s_audit/delete_secret.json trace_file: trace_files/k8s_audit/delete_secret.json
fal_01_003:
detect: False
detect_level: INFO
rules_file:
- ../rules/falco_rules.yaml
- ../rules/k8s_audit_rules.yaml
trace_file: trace_files/k8s_audit/fal_01_003.json
stderr_contains: 'Could not read k8s audit event line #1, "{"kind": 0}": Data not recognized as a k8s audit event, stopping'