SigmaHQ/tests/invalid_sigma-invalid_aggregation.yml

mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-08 18:23:52 +00:00
title: Parse error in aggregation
logsource:
    product: linux
detection:
    foo: 
        - test
    condition: foo | foo bar
Increased test coverage * more tests * removed unneeded code * increased coverage fail threshold 2017-10-23 21:30:44 +00:00			`title: Parse error in aggregation`
			`logsource:`
			`product: linux`
			`detection:`
			`foo:`
			`- test`
			`condition: foo \| foo bar`