Initial curated EventLens source from 0d80d3b38dfb817285481665b9e71e4b8a0656a0

backend/tests/test_evtx_fixture.py

@@ -0,0 +1,19 @@
+import os
+from pathlib import Path
+
+import pytest
+
+from app.parser import parse_evtx_bytes
+
+FIXTURE = os.environ.get("EVENTLENS_EVTX_FIXTURE")
+
+
+@pytest.mark.skipif(not FIXTURE, reason="EVENTLENS_EVTX_FIXTURE is only supplied by CI/release qualification")
+def test_pinned_real_evtx_fixture_end_to_end():
+    data = Path(FIXTURE).read_bytes()
+    assert data.startswith(b"ElfFile\x00")
+    result = parse_evtx_bytes(data, max_events=100, max_seconds=10.0)
+    assert len(result.events) == 7
+    assert [event.event_id for event in result.events] == [5152, 4611, 4776, 4625, 5152, 5157, 4673]
+    assert all(event.provider == "Microsoft-Windows-Security-Auditing" for event in result.events)
+    assert all(event.channel == "Security" for event in result.events)