Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add relationship fields

Browse Source
This commit is contained in:
larssand
2026-07-02 15:07:15 +02:00
parent d48d34f96c
commit 7d0e66c239
13 changed files with 437 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
tests/test_profile_suggestions.py
View File

@@ -202,6 +202,25 @@ class ProfileSuggestionTests(unittest.TestCase):
self.assertIn("source.ip", shared["srcip"]["aliases"])
self.assertIn("client_ip", shared["srcip"]["aliases"])
def test_custom_namespace_and_suffix_fields_are_shared_across_streams(self):
events = []
for stream_id, field in (("app1", "lcs_customer_id"), ("app2", "lcs_order_id")):
events.extend(
parse_log_line(
f"fgai_stream_id={stream_id} fgai_stream={stream_id} {field}=id{index % 4} result_state=ok actor_name=user{index % 3}"
)
for index in range(1, 20)
)
suggestions = {item["stream_id"]: item for item in suggest_stream_profiles(events)}
for suggestion in suggestions.values():
shared = {item["field"]: item for item in suggestion["shared_fields"]}
self.assertIn("lcs_*", shared)
self.assertIn("*_id", shared)
self.assertIn("*_status", shared)
self.assertIn("*_name", shared)
def test_applies_valid_llm_advice_and_rejects_unknown_fields(self):
suggestion = suggest_stream_profiles([
parse_log_line("fgai_stream_id=windows fgai_stream=Windows username=alice hostname=host01 eventid=4625 action=failure")
@@ -214,6 +233,9 @@ class ProfileSuggestionTests(unittest.TestCase):
"categorical_fields": ["eventid", "full_message"],
"numeric_fields": ["missing_number"],
"detectors": {"auth_failure": {"enabled": True, "minimum": 3, "z_threshold": 2.5}, "made_up": {"enabled": True}},
"relationship_fields": [{"left": "username", "right": "eventid", "name": "user event"}, {"left": "username", "right": "not_a_field"}],
"field_roles": {"username": "identity", "not_a_field": "entity"},
"correlation_roles": {"identity": ["username", "not_a_field"], "asset": ["missing_host"]},
"reason": "Windows auth fields",
}])[0]
@@ -222,6 +244,9 @@ class ProfileSuggestionTests(unittest.TestCase):
self.assertIn("eventid", advised["profile"]["categorical_fields"])
self.assertNotIn("full_message", advised["profile"]["categorical_fields"])
self.assertEqual(set(advised["profile"]["detectors"]), {"auth_failure"})
self.assertEqual(advised["profile"]["relationship_fields"], [{"left": "username", "right": "eventid", "name": "user event"}])
self.assertEqual(advised["profile_advisor"]["field_roles"], {"username": "identity"})
self.assertEqual(advised["profile_advisor"]["correlation_roles"], {"identity": ["username"]})
def test_missing_llm_advice_keeps_heuristic_profile(self):
suggestion = suggest_stream_profiles([