(t *testing.T)
| 105 | } |
| 106 | |
| 107 | func TestStringFields(t *testing.T) { |
| 108 | f := New(`ps.name = 'cmd.exe' and evt.name = 'CreateProcess' or evt.name in ('TerminateProcess', 'CreateFile')`, cfg) |
| 109 | require.NoError(t, f.Compile()) |
| 110 | assert.Len(t, f.GetStringFields(), 2) |
| 111 | assert.Len(t, f.GetStringFields()[fields.EvtName], 3) |
| 112 | assert.Len(t, f.GetStringFields()[fields.PsName], 1) |
| 113 | } |
| 114 | |
| 115 | func TestMakeSequenceLinkID(t *testing.T) { |
| 116 | var tests = []struct { |
nothing calls this directly
no test coverage detected