Function TestIsSequenceUnordered

pkg/filter/ql/parser_test.go:417–488

(t *testing.T)

}

func TestIsSequenceUnordered(t *testing.T) {
	var tests = []struct {
		expr        string
		isUnordered bool
	}{
		{
			`|evt.name = 'CreateProcess'| by ps.uuid
			 |evt.name = 'OpenProcess'| by ps.uuid
			`,
			true,
		},
		{
			`|evt.name = 'CreateProcess'|
			 |evt.name = 'CreateFile'|
			`,
			false,
		},
		{
			`|evt.name = 'CreateProcess'|
			 |evt.name = 'UnmapViewFile'|
 			 |evt.name = 'LoadModule'|
			`,
			false,
		},
		{
			`|evt.name = 'CreateProcess'|
			 |evt.name = 'SetThreadContext'|
			`,
			true,
		},
		{
			`|evt.name = 'OpenThread'| by ps.uuid
			 |evt.name = 'OpenProcess'| by ps.uuid
			`,
			false,
		},
		{
			`|evt.name = 'OpenThread' or evt.name = 'OpenProcess'| by ps.uuid
			 |evt.name = 'SetThreadContext'| by ps.uuid
			`,
			false,
		},
		{
			`|evt.name = 'RegSetValue'| by ps.uuid
			 |evt.name = 'SetThreadContext'| by ps.uuid
			`,
			true,
		},
		{
			`|evt.name = 'RegSetValue'| by ps.uuid
			 |evt.name = 'RegDeleteValue'| by ps.uuid
			`,
			false,
		},
		{
			`|evt.name = 'OpenProcess'| by ps.uuid
			 |evt.name = 'QueryDns'| by ps.uuid
			`,