Pool baseline state across streams sharing an entity concept
Completes the last deferred item from ROADMAP §0: entities recognized as the same real-world concept across enabled streams (e.g. srcip in both a firewall and an IIS stream) now share baseline knowledge of entity presence/age and known relationship-target values, instead of each stream learning it cold. Implemented additively (synthetic shared_entity:<group> namespace in the existing baseline.py tables, no schema migration), scoped to entity presence + relationship known-values only — per-stream distribution baselines stay untouched. Also fixes a latent alias-map collision bug found while building this (ALIAS_CANONICAL_BY_FIELD let "context" silently steal "hostname"/"dns_query" from their own canonical groups). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
@@ -99,6 +99,11 @@ class DashboardTests(unittest.TestCase):
|
||||
self.assertIn("-entity pattern", HTML)
|
||||
self.assertIn("cluster_dampened", HTML)
|
||||
|
||||
def test_dashboard_shows_shared_entity_baselines(self):
|
||||
self.assertIn("shared-entity-baselines", HTML)
|
||||
self.assertIn("Shared Entity Baselines", HTML)
|
||||
self.assertIn("shared_entity_baselines", HTML)
|
||||
|
||||
def test_dashboard_shows_shape_mismatch_warnings(self):
|
||||
self.assertIn('id="profileShapeWarnings"', HTML)
|
||||
self.assertIn("profile_shape_warnings", HTML)
|
||||
|
||||
Reference in New Issue
Block a user