investigation export.

2026-06-29 19:48:29 +02:00
parent 16b5bbdd63
commit 6ea8bfd714
6 changed files with 265 additions and 1 deletions
--- a/tests/test_exports.py
+++ b/tests/test_exports.py
@@ -0,0 +1,75 @@
+import unittest
+
+from fgai.exports import investigation_report, investigation_report_markdown
+
+
+class InvestigationExportTests(unittest.TestCase):
+    def test_report_filters_incident_and_related_recommendations(self):
+        status = {
+            "summary": {"total": 42},
+            "anomaly_summary": {"critical": 1},
+            "incidents": [
+                {"id": "one", "entity": "alice", "severity": "high", "score": 70, "timeline": []},
+                {"id": "two", "entity": "10.0.0.5", "severity": "medium", "score": 35, "timeline": []},
+            ],
+            "recommendations": [
+                {"subject": "alice", "title": "Review login", "severity": "high", "score": 70},
+                {"subject": "other", "title": "Ignore", "severity": "low", "score": 10},
+            ],
+        }
+
+        report = investigation_report(status, incident_id="one")
+
+        self.assertEqual([item["id"] for item in report["incidents"]], ["one"])
+        self.assertEqual([item["subject"] for item in report["recommendations"]], ["alice"])
+        self.assertEqual(report["summary"]["total"], 42)
+
+    def test_markdown_includes_evidence_timeline_and_query_details(self):
+        report = investigation_report(
+            {
+                "summary": {"total": 10},
+                "anomaly_summary": {"high": 1},
+                "baseline": {"sources_ready": 2},
+                "stream_coverage": [
+                    {"stream_name": "Windows", "enabled": True, "profile_name": "Windows profile", "events_fetched": 9, "health": "ready"}
+                ],
+                "incidents": [
+                    {
+                        "id": "abc123",
+                        "entity": "alice",
+                        "entity_type": "user",
+                        "score": 88,
+                        "severity": "critical",
+                        "lifecycle_status": "acknowledged",
+                        "note": "Known test account.",
+                        "correlated_streams": ["Windows", "Firewall"],
+                        "first_seen": "2026-06-29T10:00:00Z",
+                        "last_seen": "2026-06-29T10:05:00Z",
+                        "evidence": ["failed logins above baseline"],
+                        "timeline": [
+                            {
+                                "timestamp": "2026-06-29T10:00:00Z",
+                                "stream_name": "Windows",
+                                "action": "failure",
+                                "destination": "host01",
+                                "service": "logon",
+                                "context": "4625",
+                                "query_details": {"query": 'username:"alice" AND event_id:4625'},
+                            }
+                        ],
+                    }
+                ],
+            }
+        )
+
+        markdown = investigation_report_markdown(report)
+
+        self.assertIn("SignalScope Investigation Report", markdown)
+        self.assertIn("alice (critical)", markdown)
+        self.assertIn("Known test account.", markdown)
+        self.assertIn('username:"alice" AND event_id:4625', markdown)
+        self.assertIn("Windows profile", markdown)
+
+
+if __name__ == "__main__":
+    unittest.main()