You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
fix: remove unnecessary backtick escaping in markdown
- Fix inline code backticks that were over-escaped
- Keep proper escaping only for backticks inside code blocks
- Improve markdown readability and rendering
Edit the generated configuration file (\`.tests/<test-name>/config.yaml\`):
85
+
Edit the generated configuration file (`.tests/<test-name>/config.yaml`):
86
86
87
87
```yaml
88
88
parsers:
@@ -98,11 +98,11 @@ ignore_parsers: false
98
98
99
99
#### 3. Add test data and assertions
100
100
101
-
- **Log file**: Add sample logs to \`.tests/<test-name>/<test-name>.log\`
102
-
- **Parser assertions**: Define expected parsed fields in \`parser.assert\`
103
-
- **Scenario assertions**: Define expected alerts in \`scenario.assert\`
101
+
- **Log file**: Add sample logs to `.tests/<test-name>/<test-name>.log`
102
+
- **Parser assertions**: Define expected parsed fields in `parser.assert`
103
+
- **Scenario assertions**: Define expected alerts in `scenario.assert`
104
104
105
-
**Note**: When you first run \`cscli hubtest run\`, it will output the generated assertions that you need to fill out in \`parser.assert\` or \`scenario.assert\` files. You can find examples of assertion files in the hub repository at \`.tests/<existing-test>/parser.assert\` and \`.tests/<existing-test>/scenario.assert\`.
105
+
**Note**: When you first run `cscli hubtest run`, it will output the generated assertions that you need to fill out in `parser.assert` or `scenario.assert` files. You can find examples of assertion files in the hub repository at `.tests/<existing-test>/parser.assert` and `.tests/<existing-test>/scenario.assert`.
106
106
107
107
#### 4. Run your test
108
108
@@ -148,7 +148,7 @@ cscli hubtest coverage
148
148
149
149
## Git Workflow / Branch Management
150
150
151
-
We receive contributions on the \`master\` branch. To contribute:
151
+
We receive contributions on the `master` branch. To contribute:
152
152
153
153
1. **Fork the repository** on GitHub
154
154
2. **Clone your fork** locally:
@@ -165,14 +165,14 @@ We receive contributions on the \`master\` branch. To contribute:
165
165
```bash
166
166
git push origin feature/your-feature-name
167
167
```
168
-
6.**Open a Pull Request** targeting the \`master\` branch
168
+
6. **Open a Pull Request** targeting the `master` branch
169
169
170
170
### Branch Naming Convention
171
171
172
172
Use descriptive branch names that indicate the type of contribution:
173
-
-\`feature/parser-nginx-access-logs\`
174
-
-\`fix/scenario-ssh-bruteforce-labels\`
175
-
-\`docs/collection-apache-examples\`
173
+
- `feature/parser-nginx-access-logs`
174
+
- `fix/scenario-ssh-bruteforce-labels`
175
+
- `docs/collection-apache-examples`
176
176
177
177
### Commit Messages
178
178
@@ -245,7 +245,7 @@ Yes, we understand that using YAML anchors makes the YAML DRY but it can introdu
245
245
- **Automatic key handling**: If a static returns empty data, the key will not be set (as you mentioned)
246
246
- **Cleaner structure**: Avoids YAML complexity and improves readability
247
247
- **Consistent patterns**: Follows established CrowdSec conventions
248
-
- **Proper targeting**: Statics can target \`meta\`, \`parsed\`, or \`enriched\` fields directly
248
+
- **Proper targeting**: Statics can target `meta`, `parsed`, or `enriched` fields directly
249
249
- **Expression support**: Can use expressions to derive values dynamically
250
250
251
251
### AI-Assisted Generation
@@ -265,7 +265,7 @@ We do allow AI-assisted generation of parsers, scenarios, and collections, but w
265
265
266
266
#### What We Expect
267
267
268
-
- Test coverage using \`cscli hubtest\`
268
+
- Test coverage using `cscli hubtest`
269
269
- Proper error handling and edge cases
270
270
- Clear documentation and examples
271
271
- Adherence to CrowdSec patterns and conventions
@@ -292,7 +292,7 @@ Collections group related parsers, scenarios, and postoverflows together. It oft
292
292
293
293
#### When to add to existing collections:
294
294
295
-
- Adding a parser for \`SpecificWebServer\` access logs that would benefit from [all the default http related scenarios](https://hub.crowdsec.net/author/crowdsecurity/collections/base-http-scenarios)
295
+
- Adding a parser for `SpecificWebServer` access logs that would benefit from [all the default http related scenarios](https://hub.crowdsec.net/author/crowdsecurity/collections/base-http-scenarios)
296
296
- Your contribution enhances an existing service's detection capabilities
297
297
- Your scenario complements existing parsers in a collection
298
298
@@ -308,19 +308,19 @@ Each collection should include:
308
308
309
309
### Scenarios
310
310
311
-
Scenarios define the logic for detecting attacks and suspicious behavior. When you create a scenario, you must fill some fields in the [\`labels\`](/log_processor/scenarios/format.md#labels), else the CI won't accept the contribution.
311
+
Scenarios define the logic for detecting attacks and suspicious behavior. When you create a scenario, you must fill some fields in the [`labels`](/log_processor/scenarios/format.md#labels), else the CI won't accept the contribution.
312
312
313
313
#### Required Labels
314
314
315
-
Those \`labels\` are:
316
-
- \`classification\`: this array contains the CVE ID and the [Mitre Techniques](https://attack.mitre.org/techniques/enterprise/) related to the scenario (when applicable)
317
-
- \`spoofable\`: between 0 and 3, is the chance that the attacker behind the attack can spoof its origin
318
-
- \`confidence\`: between 0 and 3, is the confidence that the scenario will not trigger false positive
319
-
- \`behaviors\`: an existing behavior in [this file](https://github.com/crowdsecurity/hub/blob/scenario_taxonomy/taxonomy/behaviors.json)
320
-
- \`label\` : a human readable name for the scenario
321
-
- \`cti\` : (optional) true or false, used to specify that a scenario is mainly used for audit rather than detecting a threat
315
+
Those `labels` are:
316
+
- `classification`: this array contains the CVE ID and the [Mitre Techniques](https://attack.mitre.org/techniques/enterprise/) related to the scenario (when applicable)
317
+
- `spoofable`: between 0 and 3, is the chance that the attacker behind the attack can spoof its origin
318
+
- `confidence`: between 0 and 3, is the confidence that the scenario will not trigger false positive
319
+
- `behaviors`: an existing behavior in [this file](https://github.com/crowdsecurity/hub/blob/scenario_taxonomy/taxonomy/behaviors.json)
320
+
- `label` : a human readable name for the scenario
321
+
- `cti` : (optional) true or false, used to specify that a scenario is mainly used for audit rather than detecting a threat
322
322
323
-
[Here](/log_processor/scenarios/format.md#labels) is the \`labels\` documentation for more information.
323
+
[Here](/log_processor/scenarios/format.md#labels) is the `labels` documentation for more information.
324
324
325
325
#### Example Scenario Labels
326
326
@@ -435,9 +435,9 @@ Before opening your PR, ensure you can check all items in the [PR template](http
435
435
#### Testing Issues
436
436
437
437
- **Hubtest creation fails**: Ensure you're in the hub repository root directory
438
-
- **Test configuration errors**: Check YAML syntax in \`.tests/<test-name>/config.yaml\`
439
-
- **Parser assertions failing**: Use \`cscli hubtest explain <test-name>\` to debug parser output
440
-
- **Scenario assertions failing**: Verify scenario logic and thresholds with \`cscli hubtest explain <test-name>\`
438
+
- **Test configuration errors**: Check YAML syntax in `.tests/<test-name>/config.yaml`
439
+
- **Parser assertions failing**: Use `cscli hubtest explain <test-name>` to debug parser output
440
+
- **Scenario assertions failing**: Verify scenario logic and thresholds with `cscli hubtest explain <test-name>`
441
441
- **Missing test data**: Provide comprehensive log samples and assertion files
442
442
- **CI tests failing**: Review the GitHub Actions logs for specific errors
0 commit comments