Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Entity labels now resolve like this for IP-based entities:

Browse Source
This commit is contained in:
larssand
2026-07-02 20:30:33 +02:00
parent 48b56852cf
commit 5e14104f0a
5 changed files with 78 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
tests/test_correlation.py
View File

@@ -34,3 +34,21 @@ class CorrelationTests(unittest.TestCase):
self.assertEqual(result[0]["entity_display"], "win01")
self.assertEqual(result[0]["entity_label"], "win01 (10.0.0.5)")
self.assertEqual(result[0]["entity_detail"], "10.0.0.5")
def test_ip_entity_falls_back_to_username_display_label(self):
events = [
parse_log_line("srcip=10.0.0.6 username=alice fgai_stream=Windows action=login"),
parse_log_line("srcip=10.0.0.6 username=alice fgai_stream=VPN action=accept"),
]
result = correlate_source_ips(events)
self.assertEqual(result[0]["entity"], "10.0.0.6")
self.assertEqual(result[0]["entity_label"], "alice (10.0.0.6)")
def test_ip_entity_falls_back_to_service_display_label(self):
events = [
parse_log_line("srcip=10.0.0.7 process.name=spoolsv.exe fgai_stream=Windows action=started"),
parse_log_line("srcip=10.0.0.7 process.name=spoolsv.exe fgai_stream=Sysmon action=connect"),
]
result = correlate_source_ips(events)
self.assertEqual(result[0]["entity"], "10.0.0.7")
self.assertEqual(result[0]["entity_label"], "spoolsv.exe (10.0.0.7)")

7
tests/test_event_context.py
View File

@@ -24,6 +24,13 @@ class EventContextTests(unittest.TestCase):
self.assertEqual(context["source_profiles"][0]["entity_label"], "win01 (10.0.0.2)")
self.assertEqual(context["security_event_samples"][0]["entity_label"], "win01 (10.0.0.2)")
def test_ip_entity_falls_back_to_username_display_label(self):
events = [
parse_log_line("srcip=10.0.0.3 username=alice type=utm action=blocked severity=high"),
]
context = build_event_context(events)
self.assertEqual(context["source_profiles"][0]["entity_label"], "alice (10.0.0.3)")
if __name__ == "__main__":
unittest.main()