How can I write multiple pantherlog tests for a schema?

QUESTION

When I write a test file to use with pantherlog, I can only specify one input log and one expected result. How can I write multiple tests for the same schema?

ANSWER

We support multiple tests by utilizing multiple YAML documents in the same file. Consider this example:

name: Custom Log Test 1
logType: Custom.MyLog
input: |
  {
    <your log input here>
  }
result: |
  {
    <parsed log here>
  }

---
name: Custom Log Test 2
logType: Custom.MyLog
input: |
  {
    <second log input>
  }
result: |
  {
    <second parsed result>
  }

 We can denote separate tests by adding a single line with three dashes: ---