(t *testing.T)
| 80 | } |
| 81 | |
| 82 | func TestSeqFilterCompile(t *testing.T) { |
| 83 | f := New(`sequence |
| 84 | |evt.name = 'CreateProcess'| by ps.exe |
| 85 | |evt.name = 'CreateFile' and file.operation = 'create'| by file.name |
| 86 | `, cfg) |
| 87 | require.NoError(t, f.Compile()) |
| 88 | require.NotNil(t, f.GetSequence()) |
| 89 | assert.Len(t, f.GetSequence().Expressions, 2) |
| 90 | assert.NotNil(t, f.GetSequence().Expressions[0].By) |
| 91 | assert.True(t, len(f.GetStringFields()) > 0) |
| 92 | } |
| 93 | |
| 94 | func TestSeqFilterInvalidBoundRefs(t *testing.T) { |
| 95 | f := New(`sequence |
nothing calls this directly
no test coverage detected