import unittest from fgai.stream_profiles import parse_profiles class StreamProfileTests(unittest.TestCase): def test_parses_field_level_profile(self): profiles = parse_profiles([{"stream_id": "dns", "name": "DNS client behavior", "entity_field": "IP", "categorical_fields": ["QH"], "numeric_fields": ["Elapsed"]}]) self.assertEqual(profiles["dns"].name, "DNS client behavior") self.assertEqual(profiles["dns"].entity_field, "IP") self.assertEqual(profiles["dns"].numeric_fields, ("Elapsed",)) def test_parses_detector_thresholds(self): profiles = parse_profiles([{"stream_id": "windows", "entity_field": "username", "detectors": {"auth_failure": {"enabled": False, "minimum": 7, "z_threshold": 4.5}}}]) self.assertEqual(profiles["windows"].detectors["auth_failure"], {"enabled": False, "minimum": 7, "z_threshold": 4.5})