Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat(docs): explain how to use Go-FTW #74

Open
lifeforms opened this issue Oct 30, 2022 · 2 comments
Open

feat(docs): explain how to use Go-FTW #74

lifeforms opened this issue Oct 30, 2022 · 2 comments

Comments

@lifeforms
Copy link
Member

lifeforms commented Oct 30, 2022

Motivation

Currently we don’t have documented how to set up and run go-ftw for rule developers.

Proposed solution

Create a documentation page under development and explain:

  • links to installing and running docker & docker-compose
  • downloading go-ftw
  • for macOS, trusting the ftw binary one time with right click and Open
  • add template for .ftw.yaml
  • running ftw
  • running ftw on one rule only
  • running ftw on a subset (regexp)
  • remembering to docker-compose down & up after changing a rule

Btw, my .ftw.yaml (if it's not already doc'd somewhere) is:

---
logfile: 'tests/logs/modsec2-apache/error.log'
logtype:
  name: 'apache'
  timeregex:  '\[([A-Z][a-z]{2} [A-z][a-z]{2} \d{1,2} \d{1,2}\:\d{1,2}\:\d{1,2}\.\d+? \d{4})\]'
  timeformat: 'ddd MMM DD HH:mm:ss.S YYYY'

We should have Nginx/Coraza too, maybe in the future and do it in steps.

Alternatives

Explain it manually to people 30 times. 😉

Additional context

N/A

@RedXanadu
Copy link
Member

Can we replace the legacy Python ftw instructions? That will mean no duplication. (https://coreruleset.org/docs/development/testing/)

@lifeforms
Copy link
Member Author

That seems quite sensible to me!

@fzipi fzipi transferred this issue from coreruleset/coreruleset Nov 21, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants