Addl test for validation across files

Add new tests that ensure that validation across files and involving
multiple macro/rule objects display the right context. When appending,
both objects are displayed. When overwriting, the overwritten object is
displayed.

Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
This commit is contained in:
Mark Stemm
2019-07-30 21:24:55 -07:00
committed by Leo Di Donato
parent 1f0065e4b1
commit 9b7c7ff5e4
7 changed files with 100 additions and 0 deletions

View File

@@ -0,0 +1,3 @@
- macro: some macro
condition: foo
append: true

View File

@@ -0,0 +1,6 @@
- rule: some rule
desc: some desc
condition: bar
output: some output
priority: INFO
append: true

View File

@@ -0,0 +1,2 @@
- macro: some macro
condition: evt.type=execve

View File

@@ -0,0 +1,5 @@
- rule: some rule
desc: some desc
condition: evt.type=open
output: some output
priority: INFO

View File

@@ -0,0 +1,3 @@
- macro: some macro
condition: foo
append: false

View File

@@ -0,0 +1,6 @@
- rule: some rule
desc: some desc
condition: bar
output: some output
priority: INFO
append: false