Initial curated EventLens source from 0d80d3b38dfb817285481665b9e71e4b8a0656a0

backend/tests/test_correlation.py

@@ -0,0 +1,27 @@
+from datetime import UTC, datetime, timedelta
+
+from app.correlate import correlate
+from app.demo import load_demo
+from app.models import NormalizedEvent
+
+
+def test_demo_resolves_into_named_rules():
+    rule_ids={incident.rule_id for incident in correlate(load_demo())}
+    assert "windows.system.startup" in rule_ids
+    assert "windows.service.failure" in rule_ids
+    assert "windows.network.dns-timeout" in rule_ids
+    assert "windows.crash.application-report" in rule_ids
+
+
+def test_repeated_dns_events_are_compressed_in_incident_summary():
+    start=datetime(2026,9,9,8,0,tzinfo=UTC)
+    events=[NormalizedEvent(id=str(index),timestamp=start+timedelta(seconds=index*10),provider="Microsoft-Windows-DNS-Client",event_id=1014,level="warning",channel="System",computer="LAB-PC",category="network",summary="DNS timeout") for index in range(3)]
+    incident=correlate(events)[0]
+    assert incident.rule_id == "windows.network.dns-timeout"
+    assert incident.original_count == 3
+    assert incident.compressed_count == 1
+
+
+def test_incident_ids_are_deterministic():
+    events=load_demo()
+    assert [incident.id for incident in correlate(events)] == [incident.id for incident in correlate(events)]