Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Entity labels now resolve like this for IP-based entities:

Browse Source
This commit is contained in:
larssand
2026-07-02 20:30:33 +02:00
parent 48b56852cf
commit 5e14104f0a
5 changed files with 78 additions and 49 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
tests/test_event_context.py
View File

@@ -24,6 +24,13 @@ class EventContextTests(unittest.TestCase):
self.assertEqual(context["source_profiles"][0]["entity_label"], "win01 (10.0.0.2)")
self.assertEqual(context["security_event_samples"][0]["entity_label"], "win01 (10.0.0.2)")
def test_ip_entity_falls_back_to_username_display_label(self):
events = [
parse_log_line("srcip=10.0.0.3 username=alice type=utm action=blocked severity=high"),
]
context = build_event_context(events)
self.assertEqual(context["source_profiles"][0]["entity_label"], "alice (10.0.0.3)")
if __name__ == "__main__":
unittest.main()