import unittest

from fgai.detectors import event_detector_categories
from fgai.logs import parse_log_line


class DetectorCategoryTests(unittest.TestCase):
    def test_classifies_windows_auth_failure_dns_and_deny(self):
        self.assertEqual(event_detector_categories(parse_log_line("eventid=4625")), ("auth_failure",))
        self.assertEqual(event_detector_categories(parse_log_line("qh=example.org")), ("dns_query",))
        self.assertEqual(event_detector_categories(parse_log_line("action=deny")), ("deny_action",))