18 lines
997 B
Python
18 lines
997 B
Python
from app.normalize import classify, normalize_record
|
|
|
|
|
|
def test_normalizes_rust_evtx_json_shape():
|
|
payload = {"Event": {"System": {"Provider": {"#attributes": {"Name": "Microsoft-Windows-Security-Auditing"}},"EventID": 4625,"Level": 0,"Channel": "Security","Computer": "LAB-PC","EventRecordID": 77,"TimeCreated": {"#attributes": {"SystemTime": "2026-09-09T08:32:11.000000Z"}}},"EventData": {"TargetUserName": "jens", "Status": "0xc000006d"}}}
|
|
event = normalize_record(payload)
|
|
assert event.id == "77"
|
|
assert event.event_id == 4625
|
|
assert event.category == "authentication"
|
|
assert event.summary == "Failed sign-in for jens"
|
|
assert event.fields["EventData.Status"] == "0xc000006d"
|
|
|
|
|
|
def test_classification_handles_common_windows_sources():
|
|
assert classify("Service Control Manager", 7031, "System") == "service"
|
|
assert classify("Microsoft-Windows-DNS-Client", 1014, "System") == "network"
|
|
assert classify("Application Error", 1000, "Application") == "crash"
|