SigmaHQ/invalid_sigma-invalid_aggregation.yml at sigmac-usability - SigmaHQ - example

valitydev/SigmaHQ

mirror of https://github.com/valitydev/SigmaHQ.git synced 2024-11-06 09:25:17 +00:00

Thomas Patzke 65e1f8ec2b Increased test coverage

* more tests
* removed unneeded code
* increased coverage fail threshold

2017-10-23 23:30:44 +02:00

8 lines

129 B

YAML

Raw Permalink Blame History

 title: Parse error in aggregation
 logsource:
     product: linux
 detection:
     foo:
         - test
     condition: foo | foo bar