Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

advisor runs to update new and existing profiles if new field occur

Browse Source
This commit is contained in:
larssand
2026-07-06 11:21:41 +02:00
parent 897f593be9
commit 5c3f43a596
2 changed files with 91 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

42
tests/test_monitor.py
View File

@@ -201,6 +201,48 @@ class MonitorTests(unittest.TestCase):
self.assertEqual(status["profile_suggestions"][0]["profile_advisor"]["status"], "heuristic")
self.assertIn("timeout", status["profile_suggestions"][0]["profile_advisor"]["error"])
def test_profile_advisor_skips_when_all_streams_have_profiles(self):
with tempfile.TemporaryDirectory() as tmp:
log_path = Path(tmp) / "events.log"
log_path.write_text("fgai_stream_id=windows fgai_stream=Windows username=alice\n", encoding="utf-8")
config_path = Path(tmp) / "config.json"
config_path.write_text(
json.dumps(
{
"profile_advisor_enabled": True,
"graylog_stream_profiles": [{"stream_id": "windows", "name": "Windows profile", "entity_field": "username", "entity_fields": ["username"], "timestamp_field": "timestamp"}],
}
),
encoding="utf-8",
)
with patch("fgai.monitor.ollama_profile_advice") as advisor:
status = build_status(str(log_path), config_path=str(config_path), incident_path=str(Path(tmp) / "incidents.json"))
advisor.assert_not_called()
self.assertEqual(status["capabilities"]["profile_advisor"]["status"], "skipped_no_profile_changes")
def test_profile_advisor_runs_when_existing_profile_has_new_fields(self):
with tempfile.TemporaryDirectory() as tmp:
log_path = Path(tmp) / "events.log"
log_path.write_text("fgai_stream_id=windows fgai_stream=Windows username=alice eventid=4625 action=failure\n", encoding="utf-8")
config_path = Path(tmp) / "config.json"
config_path.write_text(
json.dumps(
{
"profile_advisor_enabled": True,
"graylog_stream_profiles": [{"stream_id": "windows", "name": "Windows profile", "entity_field": "username", "entity_fields": ["username"], "timestamp_field": "timestamp"}],
}
),
encoding="utf-8",
)
with patch("fgai.monitor.ollama_profile_advice", return_value=[]) as advisor:
status = build_status(str(log_path), config_path=str(config_path), incident_path=str(Path(tmp) / "incidents.json"))
advisor.assert_called_once()
self.assertEqual(status["capabilities"]["profile_advisor"]["status"], "empty")
def test_profile_suggestions_use_cached_discovered_fields(self):
with tempfile.TemporaryDirectory() as tmp:
history_path = str(Path(tmp) / "history.sqlite3")