67 lines
2.4 KiB
Python
67 lines
2.4 KiB
Python
import unittest
|
|
|
|
from fgai.anomaly import anomaly_summary, detect_source_anomalies
|
|
from fgai.logs import parse_log_line
|
|
|
|
|
|
class AnomalyTests(unittest.TestCase):
|
|
def test_scores_repeated_utm_public_source_as_anomaly(self):
|
|
events = [
|
|
parse_log_line(f'type=traffic srcip=10.0.0.{i} dstip=1.1.1.1 service=https action=accept sentbyte=100 rcvdbyte=100')
|
|
for i in range(1, 8)
|
|
]
|
|
events.extend(
|
|
parse_log_line(
|
|
'type=utm subtype=ips srcip=8.8.8.8 dstip=10.0.0.10 service=https '
|
|
'action=blocked severity=critical sentbyte=0 rcvdbyte=0'
|
|
)
|
|
for _ in range(5)
|
|
)
|
|
|
|
findings = detect_source_anomalies(events)
|
|
|
|
self.assertEqual(findings[0].subject, "8.8.8.8")
|
|
self.assertGreaterEqual(findings[0].score, 60)
|
|
self.assertIn(findings[0].severity, {"high", "critical"})
|
|
|
|
def test_summary_counts_severities(self):
|
|
events = [
|
|
parse_log_line(
|
|
'type=utm subtype=ips srcip=8.8.8.8 dstip=10.0.0.10 service=https '
|
|
'action=blocked severity=critical'
|
|
)
|
|
for _ in range(5)
|
|
]
|
|
|
|
summary = anomaly_summary(detect_source_anomalies(events))
|
|
|
|
self.assertEqual(summary["total"], 1)
|
|
|
|
def test_includes_rate_ports_and_hitcount_in_evidence(self):
|
|
events = [
|
|
parse_log_line(
|
|
f"eventtime={1_700_000_000_000_000_000 + index * 100_000_000} type=traffic "
|
|
f"srcip=203.0.113.10 dstip=10.0.0.{index} srcport={40000 + index} dstport={1000 + index} "
|
|
"service=tcp/unknown action=deny hitcount=200"
|
|
)
|
|
for index in range(12)
|
|
]
|
|
events.extend(
|
|
parse_log_line(
|
|
f"eventtime={1_700_000_000_000_000_000 + index * 60_000_000_000} type=traffic "
|
|
f"srcip=10.0.0.{index} dstip=1.1.1.1 service=https action=accept hitcount=1"
|
|
)
|
|
for index in range(1, 8)
|
|
)
|
|
|
|
finding = next(item for item in detect_source_anomalies(events) if item.subject == "203.0.113.10")
|
|
|
|
self.assertGreater(finding.evidence["events_per_minute"], 20)
|
|
self.assertEqual(finding.evidence["distinct_dst_ports"], 12)
|
|
self.assertEqual(finding.evidence["distinct_src_ports"], 12)
|
|
self.assertEqual(finding.evidence["hitcount_total"], 2400)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|