Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Continued the Detection Quality roadmap milestone.

Browse Source
This commit is contained in:
larssand
2026-06-24 21:14:07 +02:00
parent 223b2a013e
commit cdef3e1355
4 changed files with 78 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
tests/test_baseline.py
View File

@@ -27,3 +27,21 @@ class BaselineTests(unittest.TestCase):
]
self.assertEqual(store.ingest_profile_fields(events, profiles, observed_at=1_700_000_000), 1)
self.assertEqual(store.ingest_profile_fields(events, profiles, observed_at=1_700_000_300), 0)
def test_profile_rate_burst_is_one_confident_detector(self):
with tempfile.TemporaryDirectory() as directory:
store = BaselineStore(str(Path(directory) / "baseline.sqlite3"))
profiles = parse_profiles([{"stream_id": "windows", "entity_field": "username", "categorical_fields": ["action"]}])
for index in range(12):
event = parse_log_line(f"fgai_stream_id=windows username=alice action=login baseline={index}")
store.ingest_profile_fields([event], profiles, observed_at=1_700_000_000 + index * 300)
burst = [
parse_log_line(f"fgai_stream_id=windows username=alice action=login burst={index}")
for index in range(20)
]
deviations = store.profile_deviations(burst, profiles)["alice"]
rate = next(item for item in deviations if item["detector"] == "event_rate_burst")
self.assertEqual(rate["field"], "event_rate")
self.assertEqual(rate["baseline_samples"], 12)