#!/bin/sh
# Check that the rules and mappings shipped in /usr/share/chainsaw load
# and can be used to hunt through an event log.
set -eu

datadir=/usr/share/chainsaw

chainsaw --no-banner hunt tests/evtx/security_sample.evtx \
    -r "$datadir/rules/" \
    -s "$datadir/rules/" \
    --mapping "$datadir/mappings/sigma-event-logs-all.yml" \
    --json -q > "$AUTOPKGTEST_TMP/out.json"

grep -q '^\[' "$AUTOPKGTEST_TMP/out.json"
