Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix entity dsiplay names instead of ip

Browse Source
This commit is contained in:
larssand
2026-07-02 20:18:55 +02:00
parent 20a9401e02
commit e260e51e67
7 changed files with 162 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
tests/test_correlation.py
View File

@@ -23,3 +23,14 @@ class CorrelationTests(unittest.TestCase):
result = correlate_source_ips(events)
self.assertEqual(result[0]["entity"], "alice")
self.assertEqual(result[0]["entity_type"], "user")
def test_ip_entity_prefers_hostname_display_label(self):
events = [
parse_log_line("srcip=10.0.0.5 hostname=win01 fgai_stream=Windows action=login"),
parse_log_line("srcip=10.0.0.5 hostname=win01 fgai_stream=Firewall action=blocked"),
]
result = correlate_source_ips(events)
self.assertEqual(result[0]["entity"], "10.0.0.5")
self.assertEqual(result[0]["entity_display"], "win01")
self.assertEqual(result[0]["entity_label"], "win01 (10.0.0.5)")
self.assertEqual(result[0]["entity_detail"], "10.0.0.5")