mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-21 19:44:57 +00:00
2a4e4d555d
Test infrastructure and sample confs/rules/traces for plugins automated tests: New test cases are in falco_tests_plugins.yaml and cover: - Listing plugins and fields when plugins are loaded. - Basic cloudtrail + json plugin on a fake cloudtrail json file and a sample rule that uses both plugins. - Conflicts between source/extractor plugins - Incompatible plugin api - Wrong plugin path - Checking for warnings when reading rules with unnown sources (e.g. when plugins are not loaded) Some test-only plugins written in C are in test/plugins and built on the fly. (They aren't included in packages of course). The test framework needed some small changes to handle these tests: - Add a mode to not check detection counts at all (for --list/--list-plugins) - addl_cmdline_opts to allow specifying --list/--list-plugins - Using DOTALL when matching stderr/stdout (allows multi-line matches more easily) Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
32 lines
829 B
JSON
32 lines
829 B
JSON
{"Records": [{
|
|
"eventVersion": "1.0",
|
|
"userIdentity": {
|
|
"type": "IAMUser",
|
|
"principalId": "EX_PRINCIPAL_ID",
|
|
"arn": "arn:aws:iam::123456789012:user/Alice",
|
|
"accessKeyId": "EXAMPLE_KEY_ID",
|
|
"accountId": "123456789012",
|
|
"userName": "Alice"
|
|
},
|
|
"eventTime": "2014-03-06T21:22:54Z",
|
|
"eventSource": "ec2.amazonaws.com",
|
|
"eventType": "AwsApiCall",
|
|
"eventName": "StartInstances",
|
|
"awsRegion": "us-east-2",
|
|
"sourceIPAddress": "205.251.233.176",
|
|
"userAgent": "ec2-api-tools 1.6.12.2",
|
|
"requestParameters": {"instancesSet": {"items": [{"instanceId": "i-ebeaf9e2"}]}},
|
|
"responseElements": {"instancesSet": {"items": [{
|
|
"instanceId": "i-ebeaf9e2",
|
|
"currentState": {
|
|
"code": 0,
|
|
"name": "pending"
|
|
},
|
|
"previousState": {
|
|
"code": 80,
|
|
"name": "stopped"
|
|
}
|
|
}]}}
|
|
}]}
|
|
|