76 lines
3.2 KiB
Python
76 lines
3.2 KiB
Python
import unittest
|
|
|
|
from fgai.exports import investigation_report, investigation_report_markdown
|
|
|
|
|
|
class InvestigationExportTests(unittest.TestCase):
|
|
def test_report_filters_incident_and_related_recommendations(self):
|
|
status = {
|
|
"summary": {"total": 42},
|
|
"anomaly_summary": {"critical": 1},
|
|
"incidents": [
|
|
{"id": "one", "entity": "alice", "severity": "high", "score": 70, "timeline": []},
|
|
{"id": "two", "entity": "10.0.0.5", "severity": "medium", "score": 35, "timeline": []},
|
|
],
|
|
"recommendations": [
|
|
{"subject": "alice", "title": "Review login", "severity": "high", "score": 70},
|
|
{"subject": "other", "title": "Ignore", "severity": "low", "score": 10},
|
|
],
|
|
}
|
|
|
|
report = investigation_report(status, incident_id="one")
|
|
|
|
self.assertEqual([item["id"] for item in report["incidents"]], ["one"])
|
|
self.assertEqual([item["subject"] for item in report["recommendations"]], ["alice"])
|
|
self.assertEqual(report["summary"]["total"], 42)
|
|
|
|
def test_markdown_includes_evidence_timeline_and_query_details(self):
|
|
report = investigation_report(
|
|
{
|
|
"summary": {"total": 10},
|
|
"anomaly_summary": {"high": 1},
|
|
"baseline": {"sources_ready": 2},
|
|
"stream_coverage": [
|
|
{"stream_name": "Windows", "enabled": True, "profile_name": "Windows profile", "events_fetched": 9, "health": "ready"}
|
|
],
|
|
"incidents": [
|
|
{
|
|
"id": "abc123",
|
|
"entity": "alice",
|
|
"entity_type": "user",
|
|
"score": 88,
|
|
"severity": "critical",
|
|
"lifecycle_status": "acknowledged",
|
|
"note": "Known test account.",
|
|
"correlated_streams": ["Windows", "Firewall"],
|
|
"first_seen": "2026-06-29T10:00:00Z",
|
|
"last_seen": "2026-06-29T10:05:00Z",
|
|
"evidence": ["failed logins above baseline"],
|
|
"timeline": [
|
|
{
|
|
"timestamp": "2026-06-29T10:00:00Z",
|
|
"stream_name": "Windows",
|
|
"action": "failure",
|
|
"destination": "host01",
|
|
"service": "logon",
|
|
"context": "4625",
|
|
"query_details": {"query": 'username:"alice" AND event_id:4625'},
|
|
}
|
|
],
|
|
}
|
|
],
|
|
}
|
|
)
|
|
|
|
markdown = investigation_report_markdown(report)
|
|
|
|
self.assertIn("SignalScope Investigation Report", markdown)
|
|
self.assertIn("alice (critical)", markdown)
|
|
self.assertIn("Known test account.", markdown)
|
|
self.assertIn('username:"alice" AND event_id:4625', markdown)
|
|
self.assertIn("Windows profile", markdown)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|