Initial curated EventLens source from 0d80d3b38dfb817285481665b9e71e4b8a0656a0

backend/tests/test_normalize.py

@@ -0,0 +1,17 @@
+from app.normalize import classify, normalize_record
+
+
+def test_normalizes_rust_evtx_json_shape():
+    payload = {"Event": {"System": {"Provider": {"#attributes": {"Name": "Microsoft-Windows-Security-Auditing"}},"EventID": 4625,"Level": 0,"Channel": "Security","Computer": "LAB-PC","EventRecordID": 77,"TimeCreated": {"#attributes": {"SystemTime": "2026-09-09T08:32:11.000000Z"}}},"EventData": {"TargetUserName": "jens", "Status": "0xc000006d"}}}
+    event = normalize_record(payload)
+    assert event.id == "77"
+    assert event.event_id == 4625
+    assert event.category == "authentication"
+    assert event.summary == "Failed sign-in for jens"
+    assert event.fields["EventData.Status"] == "0xc000006d"
+
+
+def test_classification_handles_common_windows_sources():
+    assert classify("Service Control Manager", 7031, "System") == "service"
+    assert classify("Microsoft-Windows-DNS-Client", 1014, "System") == "network"
+    assert classify("Application Error", 1000, "Application") == "crash"