Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

policy 0 is deny

Browse Source
This commit is contained in:
larssand
2026-06-18 23:07:02 +02:00
parent 6530e51700
commit 6117013c6e
3 changed files with 36 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
tests/test_recommendations.py
View File

@@ -25,6 +25,22 @@ class RecommendationTests(unittest.TestCase):
self.assertIn("4", recommendations[0].related_policy_ids)
self.assertIn("https", recommendations[0].related_services)
def test_policy_zero_is_implicit_deny_not_related_policy(self):
events = [
parse_log_line(
'type=traffic srcip=203.0.113.8 dstip=10.0.0.10 policyid=0 '
'service=ssh action=deny severity=warning'
)
for _ in range(12)
]
anomalies = detect_source_anomalies(events)
recommendations = build_recommendations(events, anomalies)
self.assertEqual(recommendations[0].related_policy_ids, [])
self.assertEqual(recommendations[0].title, "Implicit deny/drop traffic observed")
self.assertIn("policyid=0", recommendations[0].recommendation)
def test_threat_intel_disabled_by_default(self):
with patch.dict(os.environ, {}, clear=True):
client = ThreatIntelClient(cache_file="/tmp/fgai-test-threat-cache.json")