add more matching

tests/test_correlation.py

@@ -0,0 +1,15 @@
+import unittest
+
+from fgai.correlation import correlate_source_ips
+from fgai.logs import parse_log_line
+
+
+class CorrelationTests(unittest.TestCase):
+    def test_correlates_same_source_across_streams(self):
+        events = [
+            parse_log_line("srcip=10.0.0.5 fgai_stream=Fortigate action=blocked"),
+            parse_log_line("srcip=10.0.0.5 fgai_stream=DNS action=deny"),
+        ]
+        result = correlate_source_ips(events)
+        self.assertEqual(result[0]["source_ip"], "10.0.0.5")
+        self.assertEqual(result[0]["streams"], ["DNS", "Fortigate"])

tests/test_metrics.py

@@ -0,0 +1,10 @@
+import unittest
+
+from fgai.metrics import prometheus_metrics
+
+
+class MetricsTests(unittest.TestCase):
+    def test_renders_low_cardinality_metrics(self):
+        output = prometheus_metrics({"summary": {"total": 10}, "anomaly_summary": {"high": 2}, "baseline": {"sources_ready": 3}, "capabilities": {"graylog_mcp": {"status": "connected", "events_fetched": 9}}})
+        self.assertIn('fgai_events_total{kind="total"} 10', output)
+        self.assertIn("fgai_graylog_mcp_connected 1", output)