first add

tests/test_logs.py

@@ -0,0 +1,23 @@
+import unittest
+
+from fgai.logs import event_score, is_utm_event, parse_log_line, summarize_events
+
+
+class LogTests(unittest.TestCase):
+    def test_parse_key_value_log_line(self):
+        event = parse_log_line('date=2026-06-18 type="utm" subtype="ips" srcip=8.8.8.8 action="blocked" severity="critical"')
+
+        self.assertEqual(event.src_ip, "8.8.8.8")
+        self.assertEqual(event.subtype, "ips")
+        self.assertTrue(is_utm_event(event))
+        self.assertGreaterEqual(event_score(event), 9)
+
+    def test_parse_json_log_line(self):
+        event = parse_log_line('{"type":"utm","subtype":"virus","srcip":"1.1.1.1","action":"detected","severity":"high"}')
+
+        self.assertEqual(event.src_ip, "1.1.1.1")
+        self.assertEqual(summarize_events([event])["utm"], 1)
+
+
+if __name__ == "__main__":
+    unittest.main()