diff --git a/test/confs/file_stdout.yaml b/test/confs/file_stdout.yaml new file mode 100644 index 00000000..f111c90c --- /dev/null +++ b/test/confs/file_stdout.yaml @@ -0,0 +1,42 @@ +# +# Copyright (C) 2019 The Falco Authors. +# +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +# File containing Falco rules, loaded at startup. +rules_file: /etc/falco_rules.yaml + +# Whether to output events in json or text +json_output: false + +# Send information logs to stderr and/or syslog Note these are *not* security +# notification logs! These are just Falco lifecycle (and possibly error) logs. +log_stderr: false +log_syslog: false + +# Where security notifications should go. +# Multiple outputs can be enabled. + +syslog_output: + enabled: false + +file_output: + enabled: false + +stdout_output: + enabled: true + +program_output: + enabled: false diff --git a/test/falco_tests.yaml b/test/falco_tests.yaml index 1c678530..5743fe20 100644 --- a/test/falco_tests.yaml +++ b/test/falco_tests.yaml @@ -688,6 +688,16 @@ trace_files: !mux results: - "Warning An open was seen" + stdout_output_strict: + detect: True + detect_level: WARNING + rules_file: + - rules/single_rule.yaml + conf_file: confs/file_stdout.yaml + trace_file: trace_files/cat_write.scap + output_strictly_contains: + - stdout: output_files/single_rule_with_cat_write.txt + detect_counts: detect: True detect_level: WARNING diff --git a/test/output_files/single_rule_with_cat_write.txt b/test/output_files/single_rule_with_cat_write.txt new file mode 100644 index 00000000..40b8d7b7 --- /dev/null +++ b/test/output_files/single_rule_with_cat_write.txt @@ -0,0 +1,8 @@ +18:17:57.881781397: Warning An open was seen (command=cat /dev/null) +18:17:57.881785348: Warning An open was seen (command=cat /dev/null) +18:17:57.881796705: Warning An open was seen (command=cat /dev/null) +18:17:57.881799840: Warning An open was seen (command=cat /dev/null) +18:17:57.882003104: Warning An open was seen (command=cat /dev/null) +18:17:57.882008208: Warning An open was seen (command=cat /dev/null) +18:17:57.882045694: Warning An open was seen (command=cat /dev/null) +18:17:57.882054739: Warning An open was seen (command=cat /dev/null) \ No newline at end of file