tcell_agent 0.2.29 → 0.4.0

data/spec/lib/tcell_agent/policies/command_injection_policy_spec.rb

@@ -0,0 +1,736 @@
+require 'spec_helper'
+
+module TCellAgent
+  module Policies
+
+    describe CommandInjectionPolicy do
+      describe "#from_json" do
+        context "with a nil policy" do
+          it "should return nil" do
+            expect(CommandInjectionPolicy.from_json(nil)).to be_nil
+          end
+        end
+
+        context "with an empty policy" do
+          it "should raise a policy missing error" do
+            expect {
+              CommandInjectionPolicy.from_json({})
+            }.to raise_error(RuntimeError)
+          end
+        end
+
+        context "with an empty version" do
+          it "should have empty version" do
+            cmdi = CommandInjectionPolicy.from_json({ "policy_id" => "policy_id" })
+            expect(cmdi.policy_id).to eq("policy_id")
+            expect(cmdi.version).to be_nil
+            expect(cmdi.enabled).to eq(false)
+            expect(cmdi.overall_action).to be_nil
+            expect(cmdi.compound_statement_rule).to be_nil
+            expect(cmdi.command_rules).to eq({})
+            expect(cmdi.collect_full_commandline).to eq(false)
+          end
+        end
+
+        context "with no data" do
+          it "should have disabled ip blocking" do
+            cmdi = CommandInjectionPolicy.from_json({
+              "policy_id" => "policy_id",
+              "version" => 1
+            })
+            expect(cmdi.policy_id).to eq("policy_id")
+            expect(cmdi.version).to eq(1)
+            expect(cmdi.enabled).to eq(false)
+            expect(cmdi.overall_action).to be_nil
+            expect(cmdi.compound_statement_rule).to be_nil
+            expect(cmdi.command_rules).to eq({})
+            expect(cmdi.collect_full_commandline).to eq(false)
+          end
+        end
+
+        context "with empty data" do
+          it "should have default values" do
+            cmdi = CommandInjectionPolicy.from_json({
+              "policy_id" => "policy_id",
+              "version" => 1,
+              "data" => {}
+            })
+            expect(cmdi.policy_id).to eq("policy_id")
+            expect(cmdi.version).to eq(1)
+            expect(cmdi.enabled).to eq(false)
+            expect(cmdi.overall_action).to be_nil
+            expect(cmdi.compound_statement_rule).to be_nil
+            expect(cmdi.command_rules).to eq({})
+            expect(cmdi.collect_full_commandline).to eq(false)
+          end
+        end
+
+        context "with empty command rules" do
+          it "should have default values" do
+            cmdi = CommandInjectionPolicy.from_json({
+              "policy_id" => "policy_id",
+              "version" => 1,
+              "data" => {
+                "command_rules" => []
+              }
+            })
+            expect(cmdi.policy_id).to eq("policy_id")
+            expect(cmdi.version).to eq(1)
+            expect(cmdi.enabled).to eq(false)
+            expect(cmdi.overall_action).to be_nil
+            expect(cmdi.compound_statement_rule).to be_nil
+            expect(cmdi.command_rules).to eq({})
+            expect(cmdi.collect_full_commandline).to eq(false)
+          end
+        end
+
+        context "with empty compount statement rules" do
+          it "should have default values" do
+            cmdi = CommandInjectionPolicy.from_json({
+              "policy_id" => "policy_id",
+              "version" => 1,
+              "data" => {
+                "compound_statement_rules" => []
+              }
+            })
+            expect(cmdi.policy_id).to eq("policy_id")
+            expect(cmdi.version).to eq(1)
+            expect(cmdi.enabled).to eq(false)
+            expect(cmdi.overall_action).to be_nil
+            expect(cmdi.compound_statement_rule).to be_nil
+            expect(cmdi.command_rules).to eq({})
+            expect(cmdi.collect_full_commandline).to eq(false)
+          end
+        end
+
+        context "with populated command rules" do
+          it "should have default values" do
+            cmdi = CommandInjectionPolicy.from_json({
+              "policy_id" => "policy_id",
+              "version" => 1,
+              "data" => {
+                "command_rules" => [
+                  {"rule_id" => "1", "action" => "block"},
+                  {"rule_id" => "2", "command" => "nc", "action" => "ignore"}
+                ]
+              }
+            })
+
+            expect(cmdi.policy_id).to eq("policy_id")
+            expect(cmdi.version).to eq(1)
+            expect(cmdi.enabled).to eq(true)
+            expect(cmdi.overall_action).to_not be_nil
+            expect(cmdi.overall_action.rule_id).to eq("1")
+            expect(cmdi.overall_action.action).to eq(CommandRule::BLOCK)
+            expect(cmdi.overall_action.command).to be_nil
+            expect(cmdi.command_rules.size).to eq(1)
+            expect(cmdi.command_rules["nc"]).to_not be_nil
+            expect(cmdi.command_rules["nc"].rule_id).to eq("2")
+            expect(cmdi.command_rules["nc"].action).to eq(CommandRule::IGNORE)
+            expect(cmdi.command_rules["nc"].command).to eq("nc")
+            expect(cmdi.compound_statement_rule).to be_nil
+            expect(cmdi.collect_full_commandline).to eq(false)
+          end
+        end
+
+        context "with populated compound statement rules" do
+          it "should have default values" do
+            cmdi = CommandInjectionPolicy.from_json({
+              "policy_id" => "policy_id",
+              "version" => 1,
+              "data" => {
+                "compound_statement_rules" => [
+                  {"rule_id" => "3", "action" => "block"}
+                ]
+              }
+            })
+
+            expect(cmdi.policy_id).to eq("policy_id")
+            expect(cmdi.version).to eq(1)
+            expect(cmdi.enabled).to eq(true)
+            expect(cmdi.overall_action).to be_nil
+            expect(cmdi.command_rules).to eq({})
+            expect(cmdi.compound_statement_rule).to_not be_nil
+            expect(cmdi.compound_statement_rule.rule_id).to eq("3")
+            expect(cmdi.compound_statement_rule.action).to eq(CommandRule::BLOCK)
+            expect(cmdi.compound_statement_rule.command).to be_nil
+            expect(cmdi.collect_full_commandline).to eq(false)
+          end
+        end
+
+        context "with populated collect_full_commandline" do
+          context "as nil" do
+            it "should have collect_full_commandline disabled" do
+              cmdi = CommandInjectionPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "collect_full_commandline" => nil,
+                  "compound_statement_rules" => [
+                    {"rule_id" => "3", "action" => "block"}
+                  ]
+                }
+              })
+
+              expect(cmdi.policy_id).to eq("policy_id")
+              expect(cmdi.version).to eq(1)
+              expect(cmdi.enabled).to eq(true)
+              expect(cmdi.overall_action).to be_nil
+              expect(cmdi.command_rules).to eq({})
+              expect(cmdi.compound_statement_rule).to_not be_nil
+              expect(cmdi.compound_statement_rule.rule_id).to eq("3")
+              expect(cmdi.compound_statement_rule.action).to eq(CommandRule::BLOCK)
+              expect(cmdi.compound_statement_rule.command).to be_nil
+              expect(cmdi.collect_full_commandline).to eq(false)
+            end
+          end
+
+          context "as false" do
+            it "should have collect_full_commandline disabled" do
+              cmdi = CommandInjectionPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "collect_full_commandline" => false,
+                  "compound_statement_rules" => [
+                    {"rule_id" => "3", "action" => "block"}
+                  ]
+                }
+              })
+
+              expect(cmdi.policy_id).to eq("policy_id")
+              expect(cmdi.version).to eq(1)
+              expect(cmdi.enabled).to eq(true)
+              expect(cmdi.overall_action).to be_nil
+              expect(cmdi.command_rules).to eq({})
+              expect(cmdi.compound_statement_rule).to_not be_nil
+              expect(cmdi.compound_statement_rule.rule_id).to eq("3")
+              expect(cmdi.compound_statement_rule.action).to eq(CommandRule::BLOCK)
+              expect(cmdi.compound_statement_rule.command).to be_nil
+              expect(cmdi.collect_full_commandline).to eq(false)
+            end
+          end
+
+          context "as true" do
+            it "should have collect_full_commandline enabled" do
+              cmdi = CommandInjectionPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "collect_full_commandline" => true,
+                  "compound_statement_rules" => [
+                    {"rule_id" => "3", "action" => "block"}
+                  ]
+                }
+              })
+
+              expect(cmdi.policy_id).to eq("policy_id")
+              expect(cmdi.version).to eq(1)
+              expect(cmdi.enabled).to eq(true)
+              expect(cmdi.overall_action).to be_nil
+              expect(cmdi.command_rules).to eq({})
+              expect(cmdi.compound_statement_rule).to_not be_nil
+              expect(cmdi.compound_statement_rule.rule_id).to eq("3")
+              expect(cmdi.compound_statement_rule.action).to eq(CommandRule::BLOCK)
+              expect(cmdi.compound_statement_rule.command).to be_nil
+              expect(cmdi.collect_full_commandline).to eq(true)
+            end
+          end
+        end
+
+      end
+
+      describe "#block?" do
+        context "with command rules" do
+          context "that are blank" do
+            it "should not block" do
+              cmdi = CommandInjectionPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "collect_full_commandline" => true,
+                  "command_rules" => []
+                }
+              })
+
+              expect(TCellAgent).to_not receive(:send_event)
+
+              expect(
+                cmdi.block?("cat /etc/passwd | grep root", nil)
+              ).to eq(false)
+            end
+          end
+
+          context "that ignore all" do
+            it "should not block" do
+              cmdi = CommandInjectionPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "collect_full_commandline" => true,
+                  "command_rules" => [{"rule_id" => "1", "action" => "ignore"}]
+                }
+              })
+
+              expect(TCellAgent).to_not receive(:send_event)
+
+              expect(
+                cmdi.block?("cat /etc/passwd | grep root", nil)
+              ).to eq(false)
+            end
+
+            context "and ignore cat" do
+              it "should not send an event" do
+                cmdi = CommandInjectionPolicy.from_json({
+                  "policy_id" => "policy_id",
+                  "version" => 1,
+                  "data" => {
+                    "collect_full_commandline" => true,
+                    "command_rules" => [
+                      {"rule_id" => "1", "action" => "ignore"},
+                      {"rule_id" => "2", "action" => "ignore", "command" => "cat"}
+                    ]
+                  }
+                })
+
+                expect(TCellAgent).to_not receive(:send_event)
+
+                expect(
+                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                ).to eq(false)
+              end
+            end
+
+            context "and report cat" do
+              it "should send an event" do
+                cmdi = CommandInjectionPolicy.from_json({
+                  "policy_id" => "policy_id",
+                  "version" => 1,
+                  "data" => {
+                    "collect_full_commandline" => true,
+                    "command_rules" => [
+                      {"rule_id" => "1", "action" => "ignore"},
+                      {"rule_id" => "2", "action" => "report", "command" => "cat"}
+                    ]
+                  }
+                })
+
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "cmdi",
+                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
+                  "blocked" => false,
+                  "matches" => [{"rule_id" => "2", "command" => "cat"}],
+                  "full_commandline" => "cat /etc/passwd | grep root"
+                })
+
+                expect(
+                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                ).to eq(false)
+              end
+            end
+
+            context "and block cat" do
+              it "should send an event and block" do
+                cmdi = CommandInjectionPolicy.from_json({
+                  "policy_id" => "policy_id",
+                  "version" => 1,
+                  "data" => {
+                    "collect_full_commandline" => true,
+                    "command_rules" => [
+                      {"rule_id" => "1", "action" => "ignore"},
+                      {"rule_id" => "2", "action" => "block", "command" => "cat"}
+                    ]
+                  }
+                })
+
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "cmdi",
+                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
+                  "blocked" => true,
+                  "matches" => [{"rule_id" => "2", "command" => "cat"}],
+                  "full_commandline"=>"cat /etc/passwd | grep root"
+                })
+
+                expect(
+                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                ).to eq(true)
+              end
+            end
+          end
+
+          context "that report all" do
+            it "should send an event" do
+              cmdi = CommandInjectionPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "command_rules" => [{"rule_id" => "1", "action" => "report"}]
+                }
+              })
+
+              expect(TCellAgent).to receive(:send_event).with({
+                "event_type" => "cmdi",
+                "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
+                "blocked" => false,
+                "matches" => [{"rule_id" => "1", "command" => "cat"}, {"rule_id" => "1", "command" => "grep"}]
+              })
+
+              expect(
+                cmdi.block?("cat /etc/passwd | grep root", nil)
+              ).to eq(false)
+            end
+
+            context "and ignore cat" do
+              it "should send an event for grep not cat" do
+                cmdi = CommandInjectionPolicy.from_json({
+                  "policy_id" => "policy_id",
+                  "version" => 1,
+                  "data" => {
+                    "command_rules" => [
+                      {"rule_id" => "1", "action" => "report"},
+                      {"rule_id" => "2", "action" => "ignore", "command" => "cat"}
+                    ]
+                  }
+                })
+
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "cmdi",
+                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
+                  "blocked" => false,
+                  "matches" => [{"rule_id" => "1", "command" => "grep"}]
+                })
+
+                expect(
+                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                ).to eq(false)
+              end
+            end
+
+            context "and report cat" do
+              it "should send an event for grep and cat" do
+                cmdi = CommandInjectionPolicy.from_json({
+                  "policy_id" => "policy_id",
+                  "version" => 1,
+                  "data" => {
+                    "command_rules" => [
+                      {"rule_id" => "1", "action" => "report"},
+                      {"rule_id" => "2", "action" => "report", "command" => "cat"}
+                    ]
+                  }
+                })
+
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "cmdi",
+                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
+                  "blocked" => false,
+                  "matches" => [{"rule_id" => "2", "command" => "cat"}, {"rule_id" => "1", "command" => "grep"}]
+                })
+
+                expect(
+                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                ).to eq(false)
+              end
+            end
+
+            context "and block cat" do
+              it "should send an event for grep and cat and block" do
+                cmdi = CommandInjectionPolicy.from_json({
+                  "policy_id" => "policy_id",
+                  "version" => 1,
+                  "data" => {
+                    "command_rules" => [
+                      {"rule_id" => "1", "action" => "report"},
+                      {"rule_id" => "2", "action" => "block", "command" => "cat"}
+                    ]
+                  }
+                })
+
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "cmdi",
+                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
+                  "blocked" => true,
+                  "matches" => [{"rule_id" => "2", "command" => "cat"}, {"rule_id" => "1", "command" => "grep"}]
+                })
+
+                expect(
+                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                ).to eq(true)
+              end
+            end
+          end
+
+          context "that block all" do
+            it "should send an event and block" do
+              cmdi = CommandInjectionPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "command_rules" => [{"rule_id" => "1", "action" => "block"}]
+                }
+              })
+
+              expect(TCellAgent).to receive(:send_event).with({
+                "event_type" => "cmdi",
+                "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
+                "blocked" => true,
+                "matches" => [{"rule_id" => "1", "command" => "cat"}, {"rule_id" => "1", "command" => "grep"}]
+              })
+
+              expect(
+                cmdi.block?("cat /etc/passwd | grep root", nil)
+              ).to eq(true)
+            end
+
+            context "and ignore cat" do
+              it "should send an event for grep not cat and block" do
+                cmdi = CommandInjectionPolicy.from_json({
+                  "policy_id" => "policy_id",
+                  "version" => 1,
+                  "data" => {
+                    "command_rules" => [
+                      {"rule_id" => "1", "action" => "block"},
+                      {"rule_id" => "2", "action" => "ignore", "command" => "cat"}
+                    ]
+                  }
+                })
+
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "cmdi",
+                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
+                  "blocked" => true,
+                  "matches" => [{"rule_id" => "1", "command" => "grep"}]
+                })
+
+                expect(
+                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                ).to eq(true)
+              end
+            end
+
+            context "and report cat" do
+              it "should send an event for grep and cat and block" do
+                cmdi = CommandInjectionPolicy.from_json({
+                  "policy_id" => "policy_id",
+                  "version" => 1,
+                  "data" => {
+                    "command_rules" => [
+                      {"rule_id" => "1", "action" => "block"},
+                      {"rule_id" => "2", "action" => "report", "command" => "cat"}
+                    ]
+                  }
+                })
+
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "cmdi",
+                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
+                  "blocked" => true,
+                  "matches" => [{"rule_id" => "2", "command" => "cat"}, {"rule_id" => "1", "command" => "grep"}]
+                })
+
+                expect(
+                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                ).to eq(true)
+              end
+            end
+
+            context "and block cat" do
+              it "should send an event for grep and cat and block" do
+                cmdi = CommandInjectionPolicy.from_json({
+                  "policy_id" => "policy_id",
+                  "version" => 1,
+                  "data" => {
+                    "command_rules" => [
+                      {"rule_id" => "1", "action" => "block"},
+                      {"rule_id" => "2", "action" => "block", "command" => "cat"}
+                    ]
+                  }
+                })
+
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "cmdi",
+                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
+                  "blocked" => true,
+                  "matches" => [{"rule_id" => "2", "command" => "cat"}, {"rule_id" => "1", "command" => "grep"}]
+                })
+
+                expect(
+                  cmdi.block?("cat /etc/passwd | grep root", nil)
+                ).to eq(true)
+              end
+            end
+          end
+        end
+
+        context "with compound statement rules" do
+          before(:each) do
+            @tcell_context = TCellAgent::Instrumentation::TCellData.new
+            @tcell_context.request_method = "GET"
+            @tcell_context.ip_address = "1.1.1.1"
+            @tcell_context.route_id = "12345"
+            @tcell_context.hmac_session_id = "sldfjk2343"
+            @tcell_context.user_id = "user_id"
+          end
+
+          context "set to ignore" do
+            before(:each) do
+              @cmdi = CommandInjectionPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "compound_statement_rules" => [
+                    {"rule_id" => "1", "action" => "ignore"}
+                  ]
+                }
+              })
+            end
+
+            context "one parsed command" do
+              it "should not send events or block" do
+                expect(TCellAgent).to_not receive(:send_event)
+
+                expect(
+                  @cmdi.block?("cat /etc/passwd", @tcell_context)
+                ).to eq(false)
+              end
+            end
+
+            context "two parsed commands" do
+              it "should not send events or block" do
+                expect(TCellAgent).to_not receive(:send_event)
+
+                expect(
+                  @cmdi.block?("cat /etc/passwd | grep root", @tcell_context)
+                ).to eq(false)
+              end
+            end
+          end
+
+          context "set to report" do
+            before(:each) do
+              @cmdi = CommandInjectionPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "compound_statement_rules" => [
+                    {"rule_id" => "1", "action" => "report"}
+                  ]
+                }
+              })
+            end
+
+            context "one parsed command" do
+              it "should not send events or block" do
+                expect(TCellAgent).to_not receive(:send_event)
+
+                expect(
+                  @cmdi.block?("cat /etc/passwd", @tcell_context)
+                ).to eq(false)
+              end
+            end
+
+            context "two parsed commands" do
+              it "should send an event but not block" do
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "cmdi",
+                  "commands" => [
+                    {"command" => "cat", "arg_count" => 1},
+                    {"command" => "grep", "arg_count" => 1}
+                  ],
+                  "blocked" => false,
+                  "matches" => [{"rule_id" => "1"}],
+                  "method" => "GET",
+                  "remote_address" => "1.1.1.1",
+                  "route_id" => "12345",
+                  "session_id" => "sldfjk2343",
+                  "user_id" => "user_id"
+                })
+
+                expect(
+                  @cmdi.block?("cat /etc/passwd | grep root", @tcell_context)
+                ).to eq(false)
+              end
+            end
+          end
+
+          context "set to block" do
+            before(:each) do
+              @cmdi = CommandInjectionPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "compound_statement_rules" => [
+                    {"rule_id" => "1", "action" => "block"}
+                  ]
+                }
+              })
+            end
+
+            context "one parsed command" do
+              it "should not send events or block" do
+                expect(TCellAgent).to_not receive(:send_event)
+
+                expect(
+                  @cmdi.block?("cat /etc/passwd", @tcell_context)
+                ).to eq(false)
+              end
+            end
+
+            context "two parsed commands" do
+              it "should send an event and block" do
+                expect(TCellAgent).to receive(:send_event).with({
+                  "event_type" => "cmdi",
+                  "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
+                  "blocked" => true,
+                  "matches" => [{"rule_id" => "1"}],
+                  "method" => "GET",
+                  "remote_address" => "1.1.1.1",
+                  "route_id" => "12345",
+                  "session_id" => "sldfjk2343",
+                  "user_id" => "user_id"
+                })
+
+                expect(
+                  @cmdi.block?("cat /etc/passwd | grep root", @tcell_context)
+                ).to eq(true)
+              end
+            end
+          end
+
+          context "that conflict" do
+            it "only take the first one and ignore the rest" do
+              ## multiple compound statements present only first one is taken
+              cmdi = CommandInjectionPolicy.from_json({
+                "policy_id" => "policy_id",
+                "version" => 1,
+                "data" => {
+                  "compound_statement_rules" => [
+                    {"rule_id" => "1", "action" => "block"},
+                    {"rule_id" => "2", "action" => "ignore"}
+                  ]
+                }
+              })
+
+              expect(TCellAgent).to receive(:send_event).with({
+                "event_type" => "cmdi",
+                "commands" => [{"command" => "cat", "arg_count" => 1}, {"command" => "grep", "arg_count" => 1}],
+                "blocked" => true,
+                "matches" => [{"rule_id" => "1"}],
+                "method" => "GET",
+                "remote_address" => "1.1.1.1",
+                "route_id" => "12345",
+                "session_id" => "sldfjk2343",
+                "user_id" => "user_id"
+              })
+
+              expect(
+                cmdi.block?("cat /etc/passwd | grep root", @tcell_context)
+              ).to eq(true)
+            end
+
+          end
+        end
+      end
+
+    end
+  end
+end