Continued the Detection Quality roadmap.

tests/test_baseline.py

@@ -45,3 +45,19 @@ class BaselineTests(unittest.TestCase):
             rate = next(item for item in deviations if item["detector"] == "event_rate_burst")
             self.assertEqual(rate["field"], "event_rate")
             self.assertEqual(rate["baseline_samples"], 12)
+
+    def test_profile_authentication_failure_burst(self):
+        with tempfile.TemporaryDirectory() as directory:
+            store = BaselineStore(str(Path(directory) / "baseline.sqlite3"))
+            profiles = parse_profiles([{"stream_id": "windows", "entity_field": "username", "categorical_fields": ["action"]}])
+            for index in range(12):
+                event = parse_log_line(f"fgai_stream_id=windows username=alice action=failed baseline={index}")
+                store.ingest_profile_fields([event], profiles, observed_at=1_700_000_000 + index * 300)
+
+            burst = [
+                parse_log_line(f"fgai_stream_id=windows username=alice action=failed burst={index}")
+                for index in range(5)
+            ]
+            deviations = store.profile_deviations(burst, profiles)["alice"]
+            auth = next(item for item in deviations if item["detector"] == "auth_failure_burst")
+            self.assertEqual(auth["current"], 5)

tests/test_detectors.py

@@ -0,0 +1,11 @@
+import unittest
+
+from fgai.detectors import event_detector_categories
+from fgai.logs import parse_log_line
+
+
+class DetectorCategoryTests(unittest.TestCase):
+    def test_classifies_windows_auth_failure_dns_and_deny(self):
+        self.assertEqual(event_detector_categories(parse_log_line("eventid=4625")), ("auth_failure",))
+        self.assertEqual(event_detector_categories(parse_log_line("qh=example.org")), ("dns_query",))
+        self.assertEqual(event_detector_categories(parse_log_line("action=deny")), ("deny_action",))

tests/test_replay.py

@@ -0,0 +1,21 @@
+import unittest
+
+from fgai.logs import parse_log_line
+from fgai.replay import replay_events
+from fgai.stream_profiles import parse_profiles
+
+
+class ReplayTests(unittest.TestCase):
+    def test_replay_uses_temporary_profile_baseline(self):
+        profiles = parse_profiles([{"stream_id": "windows", "entity_field": "username", "categorical_fields": ["action"]}])
+        events = [
+            parse_log_line(f"timestamp={1_700_000_000 + index * 300} username=alice action=failed event={index}")
+            for index in range(12)
+        ]
+        events.extend(
+            parse_log_line(f"timestamp={1_700_003_600} username=alice action=failed burst={index}")
+            for index in range(5)
+        )
+        result = replay_events(events, profiles, stream_id="windows")
+        self.assertEqual(result["events"], 17)
+        self.assertGreaterEqual(result["field_detector_counts"].get("auth_failure_burst", 0), 1)

tests/test_stream_profiles.py

@@ -9,3 +9,7 @@ class StreamProfileTests(unittest.TestCase):
         self.assertEqual(profiles["dns"].name, "DNS client behavior")
         self.assertEqual(profiles["dns"].entity_field, "IP")
         self.assertEqual(profiles["dns"].numeric_fields, ("Elapsed",))
+
+    def test_parses_detector_thresholds(self):
+        profiles = parse_profiles([{"stream_id": "windows", "entity_field": "username", "detectors": {"auth_failure": {"enabled": False, "minimum": 7, "z_threshold": 4.5}}}])
+        self.assertEqual(profiles["windows"].detectors["auth_failure"], {"enabled": False, "minimum": 7, "z_threshold": 4.5})