28 lines
1.2 KiB
Python
28 lines
1.2 KiB
Python
from datetime import UTC, datetime, timedelta
|
|
|
|
from app.correlate import correlate
|
|
from app.demo import load_demo
|
|
from app.models import NormalizedEvent
|
|
|
|
|
|
def test_demo_resolves_into_named_rules():
|
|
rule_ids={incident.rule_id for incident in correlate(load_demo())}
|
|
assert "windows.system.startup" in rule_ids
|
|
assert "windows.service.failure" in rule_ids
|
|
assert "windows.network.dns-timeout" in rule_ids
|
|
assert "windows.crash.application-report" in rule_ids
|
|
|
|
|
|
def test_repeated_dns_events_are_compressed_in_incident_summary():
|
|
start=datetime(2026,9,9,8,0,tzinfo=UTC)
|
|
events=[NormalizedEvent(id=str(index),timestamp=start+timedelta(seconds=index*10),provider="Microsoft-Windows-DNS-Client",event_id=1014,level="warning",channel="System",computer="LAB-PC",category="network",summary="DNS timeout") for index in range(3)]
|
|
incident=correlate(events)[0]
|
|
assert incident.rule_id == "windows.network.dns-timeout"
|
|
assert incident.original_count == 3
|
|
assert incident.compressed_count == 1
|
|
|
|
|
|
def test_incident_ids_are_deterministic():
|
|
events=load_demo()
|
|
assert [incident.id for incident in correlate(events)] == [incident.id for incident in correlate(events)]
|