Function TestParseSequence

pkg/filter/ql/parser_test.go:229–415

(t *testing.T)

}

func TestParseSequence(t *testing.T) {
	var tests = []struct {
		expr          string
		err           error
		maxSpan       time.Duration
		isConstrained bool
	}{
		{
			`evt.name = 'CreateProcess'|
			 |evt.name = 'CreateFile'|
			`,
			errors.New("expected |"),
			time.Duration(0),
			false,
		},
		{
			`|evt.name = 'CreateProcess'
			 evt.name = 'CreateFile'|
			`,
			errors.New("expected operator, ')', ',', '|'"),
			time.Duration(0),
			false,
		},
		{
			`|evt.name = 'CreateProcess'|
			 |evt.name = 'CreateFile'
			`,
			errors.New("expected |"),
			time.Duration(0),
			false,
		},
		{
			`|evt.name = 'CreateProcess'|
			 |evt.name = 'CreateFile'|
			`,
			nil,
			time.Duration(0),
			false,
		},
		{
			`|evt.name = 'CreateProcess'| by ps.exe
			 |evt.name = 'CreateFile'| by file.name
			`,
			nil,
			time.Duration(0),
			true,
		},
		{
			`|evt.name = 'CreateProcess'| by ps.exe, ps.uuid
			 |evt.name = 'CreateFile'| by file.name, ps.uuid
			`,
			nil,
			time.Duration(0),
			true,
		},
		{
			`by ps.exe, ps.uuid
			 |evt.name = 'CreateProcess'|