| 92 | } |
| 93 | |
| 94 | func TestSeqFilterInvalidBoundRefs(t *testing.T) { |
| 95 | f := New(`sequence |
| 96 | |evt.name = 'CreateProcess'| as e1 |
| 97 | |evt.name = 'CreateFile' and file.name = $e.ps.exe | |
| 98 | `, cfg) |
| 99 | require.Error(t, f.Compile()) |
| 100 | f1 := New(`sequence |
| 101 | |evt.name = 'CreateProcess'| as e1 |
| 102 | |evt.name = 'CreateFile' and file.name = $e1.ps.exe | |
| 103 | `, cfg) |
| 104 | require.NoError(t, f1.Compile()) |
| 105 | } |
| 106 | |
| 107 | func TestStringFields(t *testing.T) { |
| 108 | f := New(`ps.name = 'cmd.exe' and evt.name = 'CreateProcess' or evt.name in ('TerminateProcess', 'CreateFile')`, cfg) |