Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implemented the next multi-source detection layer in this repository.

Browse Source
This commit is contained in:
larssand
2026-06-24 19:16:16 +02:00
parent f6bee0438c
commit 868022008a
15 changed files with 281 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tests/test_baseline.py
View File

@@ -4,6 +4,7 @@ from pathlib import Path
from fgai.baseline import BaselineStore
from fgai.logs import parse_log_line
from fgai.stream_profiles import parse_profiles
class BaselineTests(unittest.TestCase):
@@ -15,3 +16,14 @@ class BaselineTests(unittest.TestCase):
profiles = store.profiles({"10.0.0.1"})
self.assertEqual(profiles["10.0.0.1"]["samples"], 12)
self.assertIn("1000", profiles["10.0.0.1"]["known_destination_ports"])
def test_profile_events_are_deduplicated_between_polls(self):
with tempfile.TemporaryDirectory() as directory:
store = BaselineStore(str(Path(directory) / "baseline.sqlite3"))
profiles = parse_profiles([{"stream_id": "windows", "entity_field": "username", "categorical_fields": ["action"]}])
events = [
parse_log_line(f"fgai_stream_id=windows username=alice action=login event={index}")
for index in range(12)
]
self.assertEqual(store.ingest_profile_fields(events, profiles, observed_at=1_700_000_000), 1)
self.assertEqual(store.ingest_profile_fields(events, profiles, observed_at=1_700_000_300), 0)

9
tests/test_correlation.py
View File

@@ -14,3 +14,12 @@ class CorrelationTests(unittest.TestCase):
self.assertEqual(result[0]["source_ip"], "10.0.0.5")
self.assertEqual(result[0]["streams"], ["DNS", "Fortigate"])
self.assertEqual(len(result[0]["samples"]), 2)
def test_correlates_user_across_streams(self):
events = [
parse_log_line("username=alice fgai_stream=Windows action=login timestamp=2026-06-24T10:00:00Z"),
parse_log_line("username=alice fgai_stream=VPN action=accept timestamp=2026-06-24T10:01:00Z"),
]
result = correlate_source_ips(events)
self.assertEqual(result[0]["entity"], "alice")
self.assertEqual(result[0]["entity_type"], "user")

6
tests/test_graylog_source.py
View File

@@ -30,6 +30,12 @@ class GraylogSourceTests(unittest.TestCase):
self.assertIn("client", client.arguments["fields"])
self.assertEqual(client.arguments["offset"], 0)
def test_requests_selected_profile_fields(self):
client = _Client()
GraylogStreamSource(client, "windows", profile_fields=("TargetUserName", "EventID")).fetch()
self.assertIn("targetusername", client.arguments["fields"])
self.assertIn("eventid", client.arguments["fields"])
if __name__ == "__main__":
unittest.main()

5
tests/test_incidents.py
View File

@@ -7,3 +7,8 @@ class IncidentTests(unittest.TestCase):
anomaly = AnomalyFinding("10.0.0.1", 60, "high", "high", ["burst"], {})
result = build_incidents([anomaly], {"10.0.0.1": [{"score": 15, "reason": "new domain"}]}, [{"source_ip": "10.0.0.1", "streams": ["DNS", "Firewall"]}])
self.assertEqual(result[0]["score"], 85)
def test_creates_incident_for_profile_entity_without_network_anomaly(self):
result = build_incidents([], {"alice": [{"score": 15, "reason": "new login country", "stream_id": "windows"}]}, [])
self.assertEqual(result[0]["entity"], "alice")
self.assertEqual(result[0]["field_deviations"], 1)