add more streams

tests/test_event_context.py

@@ -0,0 +1,20 @@
+import unittest
+
+from fgai.event_context import build_event_context
+from fgai.logs import parse_log_line
+
+
+class EventContextTests(unittest.TestCase):
+    def test_includes_each_source_and_security_sample(self):
+        events = [
+            parse_log_line("srcip=10.0.0.1 dstip=1.1.1.1 action=accept"),
+            parse_log_line("srcip=10.0.0.2 dstip=8.8.8.8 type=utm subtype=ips action=blocked severity=high"),
+        ]
+        context = build_event_context(events)
+        self.assertEqual(context["entities_total"], 2)
+        self.assertEqual(context["source_profiles"][0]["entity"], "10.0.0.2")
+        self.assertEqual(len(context["security_event_samples"]), 1)
+
+
+if __name__ == "__main__":
+    unittest.main()