Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implemented the next roadmap step: direct Graylog MCP replay with temporary baselines.

Browse Source
This commit is contained in:
larssand
2026-06-25 18:34:51 +02:00
parent ea4aaf57ed
commit b6560d64f7
8 changed files with 195 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tests/test_replay.py
View File

@@ -1,7 +1,7 @@
import unittest
from fgai.logs import parse_log_line
from fgai.replay import replay_events
from fgai.replay import replay_comparison, replay_events
from fgai.stream_profiles import parse_profiles
@@ -19,3 +19,13 @@ class ReplayTests(unittest.TestCase):
result = replay_events(events, profiles, stream_id="windows")
self.assertEqual(result["events"], 17)
self.assertGreaterEqual(result["field_detector_counts"].get("auth_failure_burst", 0), 1)
def test_replay_comparison_reports_detector_deltas(self):
result = replay_comparison(
{"events": 10, "field_findings": [{"a": 1}], "source_anomalies": [], "field_detector_counts": {"auth_failure_burst": 2}},
{"events": 10, "field_findings": [{"a": 1}, {"a": 2}], "source_anomalies": [{"a": 1}], "field_detector_counts": {"auth_failure_burst": 1, "rare_value": 3}},
)
self.assertEqual(result["field_findings_delta"], 1)
self.assertEqual(result["source_anomalies_delta"], 1)
self.assertEqual(result["detector_count_delta"]["auth_failure_burst"], -1)
self.assertEqual(result["detector_count_delta"]["rare_value"], 3)