name: Detect Kerberoasting - SSA Unit test
tests:
  - name: Detect kerberoasting
    file: endpoint/ssa___detect_kerberoasting.yml 
    pass_condition: '@count_gt(0)'
    description: Test detection of kerberoasting
    attack_data:
      - file_name: T1558.003.json
        data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1558.003/T1558.003.json

