39 lines
1.2 KiB
Python
39 lines
1.2 KiB
Python
import os
|
|
import unittest
|
|
from unittest.mock import patch
|
|
|
|
from fgai.anomaly import detect_source_anomalies
|
|
from fgai.logs import parse_log_line
|
|
from fgai.recommendations import build_recommendations
|
|
from fgai.threat_intel import ThreatIntelClient
|
|
|
|
|
|
class RecommendationTests(unittest.TestCase):
|
|
def test_recommends_review_for_utm_anomaly(self):
|
|
events = [
|
|
parse_log_line(
|
|
'type=utm subtype=ips srcip=8.8.8.8 dstip=10.0.0.10 policyid=4 '
|
|
'service=https action=blocked severity=critical'
|
|
)
|
|
for _ in range(5)
|
|
]
|
|
anomalies = detect_source_anomalies(events)
|
|
|
|
recommendations = build_recommendations(events, anomalies)
|
|
|
|
self.assertGreaterEqual(recommendations[0].score, 60)
|
|
self.assertIn("4", recommendations[0].related_policy_ids)
|
|
self.assertIn("https", recommendations[0].related_services)
|
|
|
|
def test_threat_intel_disabled_by_default(self):
|
|
with patch.dict(os.environ, {}, clear=True):
|
|
client = ThreatIntelClient(cache_file="/tmp/fgai-test-threat-cache.json")
|
|
|
|
result = client.lookup_ip("8.8.8.8")
|
|
|
|
self.assertEqual(result["status"], "disabled")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|