mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-21 19:44:57 +00:00
Verifying rule names can have spaces.
Related to discussion on https://github.com/draios/agent/pull/160, verifying we can have rule names with spaces.
This commit is contained in:
8
test/rules/rule_names_with_spaces.yaml
Normal file
8
test/rules/rule_names_with_spaces.yaml
Normal file
@@ -0,0 +1,8 @@
|
||||
- macro: is_cat
|
||||
condition: proc.name=cat
|
||||
|
||||
- rule: Open From Cat
|
||||
desc: A process named cat does an open
|
||||
condition: evt.type=open and is_cat
|
||||
output: "An open was seen (command=%proc.cmdline)"
|
||||
priority: WARNING
|
Reference in New Issue
Block a user