You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+10Lines changed: 10 additions & 0 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -620,6 +620,16 @@ To combine the default check on the current rule id with additional checks, the
620
620
621
621
This way, the status check will be used in addition to the default rule id check.
622
622
623
+
For writing negative tests, you can also use the `no_expect_ids` test in the same way:
624
+
625
+
```yaml
626
+
output:
627
+
log:
628
+
no_expect_ids: []
629
+
```
630
+
631
+
This way, the current rule id will be appended and the check verifies it does not show up in logs.
632
+
623
633
Exact properties, syntax, available checks and parameters are dependent on the used version of `go-ftw`. The generator will simply replace what is defined under the `output` field in the corresponding field of the generated test case.
624
634
625
635
As described for `go-ftw`, [if any of the checks fail the test will fail](https://github.com/coreruleset/go-ftw?tab=readme-ov-file#how-log-parsing-works).
0 commit comments