Ny central normalisering

tests/test_graylog_source.py

@@ -41,6 +41,14 @@ class GraylogSourceTests(unittest.TestCase):
         self.assertIn("targetusername", client.arguments["fields"])
         self.assertIn("eventid", client.arguments["fields"])
 
+    def test_requests_common_firewall_alias_fields(self):
+        client = _Client()
+        GraylogStreamSource(client, "firewall").fetch()
+        self.assertIn("src_addr", client.arguments["fields"])
+        self.assertIn("dest_port", client.arguments["fields"])
+        self.assertIn("fw_action", client.arguments["fields"])
+        self.assertIn("full_message", client.arguments["fields"])
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_normalization.py

@@ -0,0 +1,39 @@
+import unittest
+
+from fgai.entities import sample_timeline
+from fgai.logs import parse_log_line
+
+
+class NormalizationTests(unittest.TestCase):
+    def test_firewall_aliases_populate_common_event_fields(self):
+        event = parse_log_line(
+            'timestamp=2026-06-29T16:45:52.000Z fgai_stream="Illuminate:Fortigate Messages" '
+            "src_addr=10.251.62.26 dst_addr=198.51.100.10 dest_port=443 fw_action=allow priority=high proto=tcp "
+            'full_message="allowed outbound session"'
+        )
+
+        self.assertEqual(event.src_ip, "10.251.62.26")
+        self.assertEqual(event.dst_ip, "198.51.100.10")
+        self.assertEqual(event.action, "allow")
+        self.assertEqual(event.severity, "high")
+        self.assertEqual(event.fields["dstport"], "443")
+        self.assertEqual(event.fields["service"], "tcp")
+
+    def test_related_activity_timeline_uses_aliases(self):
+        event = parse_log_line(
+            'timestamp=2026-06-29T16:45:52.000Z fgai_stream="Illuminate:Fortigate Messages" '
+            "src_addr=10.251.62.26 dst_addr=198.51.100.10 dest_port=443 fw_action=allow priority=high proto=tcp "
+            'full_message="allowed outbound session"'
+        )
+
+        row = sample_timeline([event])[0]
+
+        self.assertEqual(row["action"], "allow")
+        self.assertEqual(row["severity"], "high")
+        self.assertEqual(row["destination"], "198.51.100.10")
+        self.assertEqual(row["service"], "tcp")
+        self.assertEqual(row["context"], "allowed outbound session")
+
+
+if __name__ == "__main__":
+    unittest.main()