37 lines
1.5 KiB
Python
37 lines
1.5 KiB
Python
import unittest
|
|
|
|
from fgai.event_context import build_event_context
|
|
from fgai.logs import parse_log_line
|
|
|
|
|
|
class EventContextTests(unittest.TestCase):
|
|
def test_includes_each_source_and_security_sample(self):
|
|
events = [
|
|
parse_log_line("srcip=10.0.0.1 dstip=1.1.1.1 action=accept"),
|
|
parse_log_line("srcip=10.0.0.2 dstip=8.8.8.8 type=utm subtype=ips action=blocked severity=high"),
|
|
]
|
|
context = build_event_context(events)
|
|
self.assertEqual(context["entities_total"], 2)
|
|
self.assertEqual(context["source_profiles"][0]["entity"], "10.0.0.2")
|
|
self.assertEqual(len(context["security_event_samples"]), 1)
|
|
|
|
def test_ip_entity_prefers_hostname_display_label(self):
|
|
events = [
|
|
parse_log_line("srcip=10.0.0.2 hostname=win01 dstip=8.8.8.8 type=utm action=blocked severity=high"),
|
|
]
|
|
context = build_event_context(events)
|
|
self.assertEqual(context["source_profiles"][0]["entity"], "10.0.0.2")
|
|
self.assertEqual(context["source_profiles"][0]["entity_label"], "win01 (10.0.0.2)")
|
|
self.assertEqual(context["security_event_samples"][0]["entity_label"], "win01 (10.0.0.2)")
|
|
|
|
def test_ip_entity_falls_back_to_username_display_label(self):
|
|
events = [
|
|
parse_log_line("srcip=10.0.0.3 username=alice type=utm action=blocked severity=high"),
|
|
]
|
|
context = build_event_context(events)
|
|
self.assertEqual(context["source_profiles"][0]["entity_label"], "alice (10.0.0.3)")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|