Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Added the Profile Discovery report.

Browse Source
This commit is contained in:
larssand
2026-06-30 16:15:54 +02:00
parent 70191d93fb
commit 78f11af302
3 changed files with 117 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
tests/test_profile_suggestions.py
View File

@@ -111,6 +111,29 @@ class ProfileSuggestionTests(unittest.TestCase):
self.assertIn("workflow_state", profile["categorical_fields"])
self.assertIn("risk_points", profile["numeric_fields"])
def test_profile_discovery_explains_selected_and_rejected_fields(self):
events = [
parse_log_line(
f"fgai_stream_id=app fgai_stream=BillingApp tenant_id=t{index % 4} actor_id=user{index % 7} "
f"workflow_state={'approved' if index % 2 else 'rejected'} request_id=req-{index} "
f"constant_field=same raw='{{json}}' risk_points={index % 9} created_at=2026-06-29T10:00:{index:02d}Z"
)
for index in range(1, 40)
]
suggestion = suggest_stream_profiles(events)[0]
discovery = suggestion["discovery"]
self.assertEqual(suggestion["detected_log_type"], "application")
self.assertEqual(discovery["log_type"], "application")
self.assertIn("actor_id", discovery["selected_fields"]["entity"])
self.assertIn("workflow_state", discovery["selected_fields"]["categorical"])
self.assertIn("risk_points", discovery["selected_fields"]["numeric"])
rejected = {item["field"]: item["reason"] for item in discovery["rejected_fields"]}
self.assertEqual(rejected["raw"], "raw/internal field")
self.assertEqual(rejected["constant_field"], "constant value")
self.assertEqual(rejected["request_id"], "too high cardinality")
def test_applies_valid_llm_advice_and_rejects_unknown_fields(self):
suggestion = suggest_stream_profiles([
parse_log_line("fgai_stream_id=windows fgai_stream=Windows username=alice hostname=host01 eventid=4625 action=failure")