Implemented the next roadmap step: direct Graylog MCP replay with temporary baselines.

tests/test_cli.py

@@ -0,0 +1,39 @@
+import unittest
+
+from fgai.cli import _configured_streams
+
+
+class CliTests(unittest.TestCase):
+    def test_configured_streams_uses_enabled_streams_by_default(self):
+        config = {
+            "graylog_streams": [
+                {"id": "fortigate", "title": "Fortigate", "enabled": True},
+                {"id": "adguard", "title": "Adguard", "enabled": False},
+            ]
+        }
+        self.assertEqual(_configured_streams(config), [{"id": "fortigate", "title": "Fortigate"}])
+
+    def test_configured_streams_can_select_disabled_stream(self):
+        config = {
+            "graylog_streams": [
+                {"id": "fortigate", "title": "Fortigate", "enabled": True},
+                {"id": "adguard", "title": "Adguard", "enabled": False},
+            ]
+        }
+        self.assertEqual(_configured_streams(config, ["adguard"]), [{"id": "adguard", "title": "Adguard"}])
+
+    def test_configured_streams_preserves_selected_order(self):
+        config = {
+            "graylog_streams": [
+                {"id": "fortigate", "title": "Fortigate", "enabled": True},
+                {"id": "adguard", "title": "Adguard", "enabled": False},
+            ]
+        }
+        self.assertEqual(
+            _configured_streams(config, ["adguard", "fortigate"]),
+            [{"id": "adguard", "title": "Adguard"}, {"id": "fortigate", "title": "Fortigate"}],
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()

tests/test_graylog_source.py

@@ -30,6 +30,11 @@ class GraylogSourceTests(unittest.TestCase):
         self.assertIn("client", client.arguments["fields"])
         self.assertEqual(client.arguments["offset"], 0)
 
+    def test_uses_requested_range_seconds(self):
+        client = _Client()
+        GraylogStreamSource(client, "vpn").fetch(range_seconds=86_400)
+        self.assertEqual(client.arguments["range_seconds"], 86_400)
+
     def test_requests_selected_profile_fields(self):
         client = _Client()
         GraylogStreamSource(client, "windows", profile_fields=("TargetUserName", "EventID")).fetch()

tests/test_replay.py

@@ -1,7 +1,7 @@
 import unittest
 
 from fgai.logs import parse_log_line
-from fgai.replay import replay_events
+from fgai.replay import replay_comparison, replay_events
 from fgai.stream_profiles import parse_profiles
 
 
@@ -19,3 +19,13 @@ class ReplayTests(unittest.TestCase):
         result = replay_events(events, profiles, stream_id="windows")
         self.assertEqual(result["events"], 17)
         self.assertGreaterEqual(result["field_detector_counts"].get("auth_failure_burst", 0), 1)
+
+    def test_replay_comparison_reports_detector_deltas(self):
+        result = replay_comparison(
+            {"events": 10, "field_findings": [{"a": 1}], "source_anomalies": [], "field_detector_counts": {"auth_failure_burst": 2}},
+            {"events": 10, "field_findings": [{"a": 1}, {"a": 2}], "source_anomalies": [{"a": 1}], "field_detector_counts": {"auth_failure_burst": 1, "rare_value": 3}},
+        )
+        self.assertEqual(result["field_findings_delta"], 1)
+        self.assertEqual(result["source_anomalies_delta"], 1)
+        self.assertEqual(result["detector_count_delta"]["auth_failure_burst"], -1)
+        self.assertEqual(result["detector_count_delta"]["rare_value"], 3)