Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix entity dsiplay names instead of ip

Browse Source
This commit is contained in:
larssand
2026-07-02 20:18:55 +02:00
parent 20a9401e02
commit e260e51e67
7 changed files with 162 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
tests/test_correlation.py
View File

@@ -23,3 +23,14 @@ class CorrelationTests(unittest.TestCase):
result = correlate_source_ips(events)
self.assertEqual(result[0]["entity"], "alice")
self.assertEqual(result[0]["entity_type"], "user")
def test_ip_entity_prefers_hostname_display_label(self):
events = [
parse_log_line("srcip=10.0.0.5 hostname=win01 fgai_stream=Windows action=login"),
parse_log_line("srcip=10.0.0.5 hostname=win01 fgai_stream=Firewall action=blocked"),
]
result = correlate_source_ips(events)
self.assertEqual(result[0]["entity"], "10.0.0.5")
self.assertEqual(result[0]["entity_display"], "win01")
self.assertEqual(result[0]["entity_label"], "win01 (10.0.0.5)")
self.assertEqual(result[0]["entity_detail"], "10.0.0.5")

9
tests/test_event_context.py
View File

@@ -15,6 +15,15 @@ class EventContextTests(unittest.TestCase):
self.assertEqual(context["source_profiles"][0]["entity"], "10.0.0.2")
self.assertEqual(len(context["security_event_samples"]), 1)
def test_ip_entity_prefers_hostname_display_label(self):
events = [
parse_log_line("srcip=10.0.0.2 hostname=win01 dstip=8.8.8.8 type=utm action=blocked severity=high"),
]
context = build_event_context(events)
self.assertEqual(context["source_profiles"][0]["entity"], "10.0.0.2")
self.assertEqual(context["source_profiles"][0]["entity_label"], "win01 (10.0.0.2)")
self.assertEqual(context["security_event_samples"][0]["entity_label"], "win01 (10.0.0.2)")
if __name__ == "__main__":
unittest.main()