2020-05-27 15:04:54 +00:00
|
|
|
type: trigger
|
|
|
|
|
debug: true
|
|
|
|
|
name: test/simple-trigger
|
|
|
|
|
data:
|
|
|
|
|
- source_url: https://invalid.com/test.list
|
2020-11-30 09:37:17 +00:00
|
|
|
dest_file: simple-trigger-external-data/simple_patterns.txt
|
2020-08-23 21:42:24 +00:00
|
|
|
type: string
|
2020-05-27 15:04:54 +00:00
|
|
|
description: "Simple trigger with external data"
|
2020-11-30 09:37:17 +00:00
|
|
|
filter: "evt.Line.Labels.type =='testlog' && evt.Parsed.tainted_data in File('simple-trigger-external-data/simple_patterns.txt')"
|
2020-05-27 15:04:54 +00:00
|
|
|
groupby: evt.Meta.source_ip
|
|
|
|
|
labels:
|
|
|
|
|
type: overflow_1
|
|
|
|
|
|
