Change from toml to yaml

test_files/rules/test.toml

@@ -1,2 +0,0 @@
-[rule]
-severity = "high"

test_files/rules/test2.toml

@@ -1,3 +0,0 @@
-[rule]
-severity = "high"
-name = "test2"

test_files/rules/yaml/1.yml

@@ -0,0 +1,19 @@
+title: Sysmon Check command lines
+description: hogehoge
+enabled: true
+author: Yea
+logsource: 
+    product: windows
+detection:
+    selection:
+        EventLog: Sysmon
+        EventID: 1
+        CommandLine: '*'
+    condition: selection
+falsepositives:
+    - unknown
+level: medium
+output: 'CommandLine=%CommandLine%¥nParentImage=%ParentImage%'
+creation_date: 2020/11/8
+uodated_date: 2020/11/8
+