12 lines
528 B
Python
12 lines
528 B
Python
import unittest
|
|
|
|
from fgai.detectors import event_detector_categories
|
|
from fgai.logs import parse_log_line
|
|
|
|
|
|
class DetectorCategoryTests(unittest.TestCase):
|
|
def test_classifies_windows_auth_failure_dns_and_deny(self):
|
|
self.assertEqual(event_detector_categories(parse_log_line("eventid=4625")), ("auth_failure",))
|
|
self.assertEqual(event_detector_categories(parse_log_line("qh=example.org")), ("dns_query",))
|
|
self.assertEqual(event_detector_categories(parse_log_line("action=deny")), ("deny_action",))
|