mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-22 03:49:36 +00:00
Unit test for fd.net + in operator fixes (#343)
Tests fix for https://github.com/draios/falco/issues/339. Depends on https://github.com/draios/sysdig/pull/1091.
This commit is contained in:
@@ -664,3 +664,10 @@ trace_files: !mux
|
|||||||
- rules/rule_append.yaml
|
- rules/rule_append.yaml
|
||||||
trace_file: trace_files/cat_write.scap
|
trace_file: trace_files/cat_write.scap
|
||||||
stdout_contains: "^(?!.*Warning An open of /dev/null was seen.*)"
|
stdout_contains: "^(?!.*Warning An open of /dev/null was seen.*)"
|
||||||
|
|
||||||
|
in_operator_netmasks:
|
||||||
|
detect: True
|
||||||
|
detect_level: INFO
|
||||||
|
rules_file:
|
||||||
|
- rules/detect_connect_using_in.yaml
|
||||||
|
trace_file: trace_files/connect_localhost.scap
|
6
test/rules/detect_connect_using_in.yaml
Normal file
6
test/rules/detect_connect_using_in.yaml
Normal file
@@ -0,0 +1,6 @@
|
|||||||
|
- rule: Localhost connect
|
||||||
|
desc: Detect any connect to the localhost network, using fd.net and the in operator
|
||||||
|
condition: evt.type=connect and fd.net in ("127.0.0.1/24")
|
||||||
|
output: Program connected to localhost network
|
||||||
|
(user=%user.name command=%proc.cmdline connection=%fd.name)
|
||||||
|
priority: INFO
|
BIN
test/trace_files/connect_localhost.scap
Normal file
BIN
test/trace_files/connect_localhost.scap
Normal file
Binary file not shown.
Reference in New Issue
Block a user