Profile recommendations

tests/test_normalization.py

@@ -34,6 +34,16 @@ class NormalizationTests(unittest.TestCase):
         self.assertEqual(row["service"], "tcp")
         self.assertEqual(row["context"], "allowed outbound session")
 
+    def test_identity_and_event_aliases_populate_common_fields(self):
+        event = parse_log_line(
+            "winlog_event_data_targetusername=alice winlog_computer_name=host01 "
+            "winlog_event_id=4625 actor_id=bob"
+        )
+
+        self.assertEqual(event.fields["username"], "alice")
+        self.assertEqual(event.fields["hostname"], "host01")
+        self.assertEqual(event.fields["eventid"], "4625")
+
 
 if __name__ == "__main__":
     unittest.main()

tests/test_profile_suggestions.py

@@ -22,6 +22,42 @@ class ProfileSuggestionTests(unittest.TestCase):
         self.assertIn("hitcount", profile["numeric_fields"])
         self.assertIn("deny_action", profile["detectors"])
 
+    def test_suggests_windows_event_fields(self):
+        events = [
+            parse_log_line(
+                f"fgai_stream_id=windows fgai_stream=Windows winlog_event_id=4625 "
+                f"winlog_event_data_targetusername=alice winlog_computer_name=host{index % 3} "
+                f"event_provider=Microsoft-Windows-Security-Auditing logon_type=3 "
+                f"eventtime=2026-06-29T10:00:{index:02d}Z action=failure"
+            )
+            for index in range(1, 30)
+        ]
+
+        profile = suggest_stream_profiles(events)[0]["profile"]
+
+        self.assertIn("username", profile["entity_fields"])
+        self.assertIn("hostname", profile["entity_fields"])
+        self.assertIn("eventid", profile["categorical_fields"])
+        self.assertIn("logon_type", profile["categorical_fields"])
+        self.assertIn("auth_failure", profile["detectors"])
+
+    def test_discovers_non_priority_application_fields(self):
+        events = [
+            parse_log_line(
+                f"fgai_stream_id=app fgai_stream=BillingApp tenant_id=t{index % 4} actor_id=user{index % 7} "
+                f"workflow_state={'approved' if index % 2 else 'rejected'} payment_provider=stripe risk_points={index % 9} "
+                f"created_at=2026-06-29T10:00:{index:02d}Z"
+            )
+            for index in range(1, 40)
+        ]
+
+        profile = suggest_stream_profiles(events)[0]["profile"]
+
+        self.assertIn("username", profile["entity_fields"])
+        self.assertIn("tenant_id", profile["categorical_fields"])
+        self.assertIn("workflow_state", profile["categorical_fields"])
+        self.assertIn("risk_points", profile["numeric_fields"])
+
 
 if __name__ == "__main__":
     unittest.main()