diff --git a/src/yaml.rs b/src/yaml.rs index a06aac28..e724fb6c 100644 --- a/src/yaml.rs +++ b/src/yaml.rs @@ -264,7 +264,7 @@ mod tests { #[test] fn test_exclude_rules_file() { let mut yaml = yaml::ParseYaml::new(); - let path = Path::new("test_files/rules/exclude_rules"); + let path = Path::new("test_files/rules/yaml"); yaml.read_dir(path.to_path_buf(), &"", &fillter::exclude_ids()) .unwrap(); assert_eq!(yaml.ignorerule_count, 1); diff --git a/test_files/rules/exclude_rules/1.yml b/test_files/rules/exclude_rules/1.yml deleted file mode 100644 index 76e3e73d..00000000 --- a/test_files/rules/exclude_rules/1.yml +++ /dev/null @@ -1,19 +0,0 @@ -title: Sysmon Check command lines -id : 4fe151c2-ecf9-4fae-95ae-b88ec9c2fca6 -description: hogehoge -enabled: true -author: Yea -logsource: - product: windows -detection: - selection: - EventLog: Sysmon - EventID: 1 - CommandLine: '*' - condition: selection -falsepositives: - - unknown -level: medium -output: 'CommandLine=%CommandLine%¥nParentImage=%ParentImage%' -creation_date: 2020/11/8 -updated_date: 2020/11/8 \ No newline at end of file diff --git a/test_files/rules/yaml/1.yml b/test_files/rules/yaml/1.yml index 5f844d26..c34d0bc2 100644 --- a/test_files/rules/yaml/1.yml +++ b/test_files/rules/yaml/1.yml @@ -1,4 +1,5 @@ title: Sysmon Check command lines +id : 4fe151c2-ecf9-4fae-95ae-b88ec9c2fca6 description: hogehoge enabled: true author: Yea