Aldo Lacuku

@aldolck

Joined on Mar 28, 2022

  • Architecture Overview: The enhanced event generator will support testing Falco rules using declarative YAML files. These YAML files will contain tests for different rules, including setup and cleanup phases, and will specify the runner type for each test or block of tests. The event generator will interpret these YAML files, execute the tests in the specified environment using the corresponding runner, and provide logging and reporting functionalities. YAML Test File Structure: The YAML test file structure will include the following fields: tests: A list of tests, each containing:rule: The name of the Falco rule being tested; runner: The type of runner to be used for executing the test (e.g., HostRunner, ContainerRunner); setup: Bash script for the setup phase before running the test steps. steps: The steps needed to trigger the rule, specifying syscalls and their arguments;
     Like  Bookmark