from __future__ import annotations

from .logs import THREAT_ACTIONS
from .models import LogEvent
from .normalization import canonical_value


DETECTOR_MINIMUMS = {
    "auth_failure": 5,
    "dns_query": 20,
    "deny_action": 10,
}


def event_detector_categories(event: LogEvent) -> tuple[str, ...]:
    fields = event.fields
    action = event.action
    event_id = canonical_value(fields, "eventid")
    categories: list[str] = []
    if action in {"fail", "failed", "failure", "login_failed", "logon_failed", "authentication_failed"} or event_id == "4625":
        categories.append("auth_failure")
    if fields.get("dns_query"):
        categories.append("dns_query")
    if action in THREAT_ACTIONS:
        categories.append("deny_action")
    return tuple(categories)