Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Field baseline deviations now show distinct Mark expected, Mark false positive, and Mark confirmed

Browse Source
This commit is contained in:
larssand
2026-06-24 18:54:37 +02:00
parent 63449c9e80
commit f6bee0438c
6 changed files with 110 additions and 290 deletions
Download Patch File Download Diff File Expand all files Collapse all files

34
tests/test_recommendations.py
View File

@@ -1,4 +1,5 @@
import os
import tempfile
import unittest
from unittest.mock import patch
@@ -65,6 +66,39 @@ class RecommendationTests(unittest.TestCase):
self.assertEqual(client._select_provider(), "virustotal")
def test_successful_lookup_is_reused_from_cache(self):
with tempfile.TemporaryDirectory() as directory, patch.dict(
os.environ,
{"FGAI_THREAT_INTEL": "1", "VIRUSTOTAL_API_KEY": "test", "FGAI_THREAT_INTEL_PROVIDER": "virustotal"},
clear=True,
):
client = ThreatIntelClient(cache_file=f"{directory}/intel.json")
with patch.object(client, "_lookup_virustotal_ip", return_value={"ip": "8.8.8.8", "provider": "virustotal", "status": "ok", "score": 0}) as lookup:
client.lookup_ip("8.8.8.8")
client.lookup_ip("8.8.8.8")
self.assertEqual(lookup.call_count, 1)
self.assertEqual(client.status()["requests_today"], 1)
def test_daily_limit_prevents_new_external_lookups(self):
with tempfile.TemporaryDirectory() as directory, patch.dict(
os.environ,
{
"FGAI_THREAT_INTEL": "1",
"VIRUSTOTAL_API_KEY": "test",
"FGAI_THREAT_INTEL_PROVIDER": "virustotal",
"FGAI_THREAT_INTEL_DAILY_LIMIT": "1",
},
clear=True,
):
client = ThreatIntelClient(cache_file=f"{directory}/intel.json")
with patch.object(client, "_lookup_virustotal_ip", return_value={"ip": "8.8.8.8", "provider": "virustotal", "status": "ok", "score": 0}) as lookup:
client.lookup_ip("8.8.8.8")
limited = client.lookup_ip("1.1.1.1")
self.assertEqual(lookup.call_count, 1)
self.assertEqual(limited["status"], "daily_limit_reached")
if __name__ == "__main__":
unittest.main()