mirror of
https://github.com/falcosecurity/falco.git
synced 2026-02-02 07:28:47 +00:00
2a4e4d555d
Test infrastructure and sample confs/rules/traces for plugins automated tests: New test cases are in falco_tests_plugins.yaml and cover: - Listing plugins and fields when plugins are loaded. - Basic cloudtrail + json plugin on a fake cloudtrail json file and a sample rule that uses both plugins. - Conflicts between source/extractor plugins - Incompatible plugin api - Wrong plugin path - Checking for warnings when reading rules with unnown sources (e.g. when plugins are not loaded) Some test-only plugins written in C are in test/plugins and built on the fly. (They aren't included in packages of course). The test framework needed some small changes to handle these tests: - Add a mode to not check detection counts at all (for --list/--list-plugins) - addl_cmdline_opts to allow specifying --list/--list-plugins - Using DOTALL when matching stderr/stdout (allows multi-line matches more easily) Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
16 lines
428 B
YAML
16 lines
428 B
YAML
stdout_output:
|
|
enabled: true
|
|
|
|
plugins:
|
|
- name: cloudtrail
|
|
library_path: BUILD_DIR/cloudtrail-plugin-prefix/src/cloudtrail-plugin/libcloudtrail.so
|
|
init_config: ""
|
|
open_params: "BUILD_DIR/test/trace_files/plugins/alice_start_instances.json"
|
|
- name: test_source
|
|
library_path: BUILD_DIR/test/plugins/libtest_source.so
|
|
init_config: ""
|
|
open_params: ""
|
|
|
|
# Optional
|
|
load_plugins: [cloudtrail, test_source]
|