clear

src/yaml.rs

@@ -264,7 +264,7 @@ mod tests {
     #[test]
     fn test_exclude_rules_file() {
         let mut yaml = yaml::ParseYaml::new();
-        let path = Path::new("test_files/rules/exclude_rules");
+        let path = Path::new("test_files/rules/yaml");
         yaml.read_dir(path.to_path_buf(), &"", &fillter::exclude_ids())
             .unwrap();
         assert_eq!(yaml.ignorerule_count, 1);

test_files/rules/exclude_rules/1.yml

@@ -1,19 +0,0 @@
-title: Sysmon Check command lines
-id : 4fe151c2-ecf9-4fae-95ae-b88ec9c2fca6
-description: hogehoge
-enabled: true
-author: Yea
-logsource: 
-    product: windows
-detection:
-    selection:
-        EventLog: Sysmon
-        EventID: 1
-        CommandLine: '*'
-    condition: selection
-falsepositives:
-    - unknown
-level: medium
-output: 'CommandLine=%CommandLine%¥nParentImage=%ParentImage%'
-creation_date: 2020/11/8
-updated_date: 2020/11/8

test_files/rules/yaml/1.yml

@@ -1,4 +1,5 @@
 title: Sysmon Check command lines
+id : 4fe151c2-ecf9-4fae-95ae-b88ec9c2fca6
 description: hogehoge
 enabled: true
 author: Yea