| 135 | } |
| 136 | |
| 137 | func TestCompileIndexableFilters(t *testing.T) { |
| 138 | e := NewEngine(new(ps.SnapshotterMock), newConfig( |
| 139 | "_fixtures/merged_filters/filter*.yml", |
| 140 | "_fixtures/default/microsoft_edge.yml", |
| 141 | "_fixtures/default/windows_error_*.yml")) |
| 142 | |
| 143 | compileRules(t, e) |
| 144 | |
| 145 | assert.Len(t, e.filters.types, 5) |
| 146 | assert.Len(t, e.filters.categories, 1) |
| 147 | |
| 148 | var tests = []struct { |
| 149 | evt *event.Event |
| 150 | wants int |
| 151 | }{ |
| 152 | {&event.Event{Type: event.CreateProcess}, 2}, |
| 153 | {&event.Event{Type: event.RecvUDPv6}, 3}, |
| 154 | {&event.Event{Type: event.RecvTCPv4}, 3}, |
| 155 | {&event.Event{Type: event.RecvTCPv4, Category: event.Net}, 4}, |
| 156 | {&event.Event{Category: event.Net}, 1}, |
| 157 | } |
| 158 | |
| 159 | for _, tt := range tests { |
| 160 | t.Run(tt.evt.Type.String(), func(t *testing.T) { |
| 161 | assert.Len(t, e.filters.collect(tt.evt), tt.wants) |
| 162 | }) |
| 163 | } |
| 164 | } |
| 165 | |
| 166 | func TestRunSimpleRules(t *testing.T) { |
| 167 | var tests = []struct { |