Skip to content

Replay --validate fails #57

@acook-recon

Description

@acook-recon

Expected Behavior

The command limacharlie replay --validate --rule-content T1196.rule should work correctly, as documented: https://doc.limacharlie.io/docs/documentation/ZG9jOjE5MzEwOTc-writing-and-testing-rules

Actual Behavior

Returns: limacharlie.utils.LcApiException: Api failure (400): {'error': 'no event_source specified'}

Running replay by removing --validate and adding a test rule works correctly, e.g. limacharlie replay --rule-content ~/test.yml --events ~/target_event.json

Steps to Reproduce the Problem

  1. Follow the docs to create a test rule
  2. limacharlie replay --validate --rule-content T1196.rule

Specifications

  • Version: 4.1.0

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions