(t *testing.T)
| 33 | ) |
| 34 | |
| 35 | func TestEventSourceConfig(t *testing.T) { |
| 36 | c := NewWithOpts(WithRun()) |
| 37 | |
| 38 | err := c.flags.Parse([]string{ |
| 39 | "--eventsource.enable-thread=false", |
| 40 | "--eventsource.enable-registry=false", |
| 41 | "--eventsource.enable-fileio=false", |
| 42 | "--eventsource.enable-net=false", |
| 43 | "--eventsource.enable-module=false", |
| 44 | "--eventsource.blacklist.events=CloseFile,CloseHandle", |
| 45 | "--eventsource.blacklist.images=System,svchost.exe", |
| 46 | }) |
| 47 | require.NoError(t, err) |
| 48 | require.NoError(t, c.viper.BindPFlags(c.flags)) |
| 49 | require.NoError(t, err) |
| 50 | |
| 51 | require.NoError(t, c.Init()) |
| 52 | |
| 53 | assert.False(t, c.EventSource.EnableThreadEvents) |
| 54 | assert.False(t, c.EventSource.EnableNetEvents) |
| 55 | assert.False(t, c.EventSource.EnableRegistryEvents) |
| 56 | assert.False(t, c.EventSource.EnableModuleEvents) |
| 57 | assert.False(t, c.EventSource.EnableFileIOEvents) |
| 58 | |
| 59 | assert.True(t, c.EventSource.ExcludeEvent(event.CloseHandle.ID())) |
| 60 | assert.False(t, c.EventSource.ExcludeEvent(event.CreateProcess.ID())) |
| 61 | |
| 62 | assert.True(t, c.EventSource.ExcludeImage(&pstypes.PS{Name: "svchost.exe"})) |
| 63 | assert.False(t, c.EventSource.ExcludeImage(&pstypes.PS{Name: "explorer.exe"})) |
| 64 | } |
nothing calls this directly
no test coverage detected