Files
splunk-security_content/tests/endpoint/unusually_long_command_line___ssa.test.yml
Ignacio Bermudez Corrales 4833e86ac1 updated pass conditions in tests
2020-12-03 11:37:00 -08:00

11 lines
391 B
YAML

name: Unusually Long Command Line - SSA Unit Test
tests:
- name: Unusually Long Command Line
file: endpoint/unusually_long_command_line___ssa.yml
pass_condition: '@count_gt(0)'
description: Test unusually long command lines
attack_data:
- file_name: unusual_commandline.json
data: https://ssa-test-dataset.s3-us-west-2.amazonaws.com/unusual_commandline.json