Graylog query details

tests/test_query_details.py

@@ -0,0 +1,28 @@
+import unittest
+
+from fgai.entities import sample_timeline
+from fgai.logs import parse_log_line
+from fgai.query_details import event_query_details
+
+
+class QueryDetailsTests(unittest.TestCase):
+    def test_builds_generic_graylog_query_from_aliases(self):
+        event = parse_log_line("src_addr=10.0.0.5 dst_addr=198.51.100.10 fw_action=allow")
+
+        details = event_query_details(event)
+
+        self.assertIn('srcip:"10.0.0.5"', details["query"])
+        self.assertIn('dstip:"198.51.100.10"', details["query"])
+        self.assertIn('action:"allow"', details["query"])
+
+    def test_timeline_contains_query_details(self):
+        event = parse_log_line('timestamp=2026-06-29T16:45:52Z fgai_stream=Firewall srcip=10.0.0.5 dstip=198.51.100.10 action=deny')
+
+        row = sample_timeline([event])[0]
+
+        self.assertEqual(row["query_details"]["stream"], "Firewall")
+        self.assertIn('srcip:"10.0.0.5"', row["graylog_query"])
+
+
+if __name__ == "__main__":
+    unittest.main()