Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MCP sample fetch now asks for common Winlogbeat/ECS fields before

Browse Source
This commit is contained in:
larssand
2026-06-30 15:10:47 +02:00
parent b8fe738aa1
commit 4a441bf443
8 changed files with 307 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
tests/test_graylog_source.py
View File

@@ -88,6 +88,17 @@ class GraylogSourceTests(unittest.TestCase):
self.assertIn("fw_action", client.arguments["fields"])
self.assertIn("full_message", client.arguments["fields"])
def test_requests_winlogbeat_discovery_fields_before_profile_exists(self):
client = _Client()
GraylogStreamSource(client, "windows").fetch()
self.assertIn("winlog.event_id", client.arguments["fields"])
self.assertIn("event.code", client.arguments["fields"])
self.assertIn("user.name", client.arguments["fields"])
self.assertIn("host.name", client.arguments["fields"])
self.assertIn("source.ip", client.arguments["fields"])
self.assertIn("winlog.channel", client.arguments["fields"])
self.assertIn("process.name", client.arguments["fields"])
if __name__ == "__main__":
unittest.main()