first add

tests/test_logs.py

@@ -0,0 +1,23 @@
+import unittest
+
+from fgai.logs import event_score, is_utm_event, parse_log_line, summarize_events
+
+
+class LogTests(unittest.TestCase):
+    def test_parse_key_value_log_line(self):
+        event = parse_log_line('date=2026-06-18 type="utm" subtype="ips" srcip=8.8.8.8 action="blocked" severity="critical"')
+
+        self.assertEqual(event.src_ip, "8.8.8.8")
+        self.assertEqual(event.subtype, "ips")
+        self.assertTrue(is_utm_event(event))
+        self.assertGreaterEqual(event_score(event), 9)
+
+    def test_parse_json_log_line(self):
+        event = parse_log_line('{"type":"utm","subtype":"virus","srcip":"1.1.1.1","action":"detected","severity":"high"}')
+
+        self.assertEqual(event.src_ip, "1.1.1.1")
+        self.assertEqual(summarize_events([event])["utm"], 1)
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_mitigation.py

@@ -0,0 +1,27 @@
+import unittest
+
+from fgai.logs import parse_log_line
+from fgai.mitigation import is_blockable_public_ip, suggest_block_candidates
+
+
+class MitigationTests(unittest.TestCase):
+    def test_private_ips_are_not_blockable(self):
+        self.assertFalse(is_blockable_public_ip("192.168.1.10"))
+        self.assertFalse(is_blockable_public_ip("10.0.0.5"))
+        self.assertTrue(is_blockable_public_ip("8.8.8.8"))
+
+    def test_suggests_repeated_public_utm_offender(self):
+        events = [
+            parse_log_line('type=utm subtype=ips srcip=8.8.8.8 action=blocked severity=high attack="scan"'),
+            parse_log_line('type=utm subtype=ips srcip=8.8.8.8 action=blocked severity=high attack="scan"'),
+            parse_log_line('type=utm subtype=ips srcip=8.8.8.8 action=blocked severity=high attack="scan"'),
+            parse_log_line('type=utm subtype=ips srcip=192.168.1.5 action=blocked severity=critical attack="scan"'),
+        ]
+
+        candidates = suggest_block_candidates(events)
+
+        self.assertEqual([candidate.src_ip for candidate in candidates], ["8.8.8.8"])
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_policies.py

@@ -0,0 +1,30 @@
+import unittest
+
+from fgai.policies import audit_policies, parse_policy_config
+
+
+class PolicyTests(unittest.TestCase):
+    def test_policy_audit_finds_broad_unprotected_allow(self):
+        policies = parse_policy_config(
+            """
+config firewall policy
+    edit 1
+        set srcaddr "all"
+        set dstaddr "all"
+        set service "ALL"
+        set action accept
+        set logtraffic disable
+    next
+end
+"""
+        )
+
+        findings = audit_policies(policies)
+
+        titles = {finding.title for finding in findings}
+        self.assertIn("Broad allow policy", titles)
+        self.assertIn("Accepted traffic lacks UTM inspection", titles)
+
+
+if __name__ == "__main__":
+    unittest.main()