worked poc

tests/test_tuning.py

@@ -0,0 +1,39 @@
+import unittest
+
+from app.tuning import AlertTuner
+
+
+def event(severity=2, sid=123, category="Attempted Information Leak"):
+    return {
+        "event_type": "alert",
+        "alert": {
+            "severity": severity,
+            "signature_id": sid,
+            "category": category,
+        },
+    }
+
+
+class TuningTests(unittest.TestCase):
+    def test_keeps_high_and_medium_priority_by_default_profile(self):
+        tuner = AlertTuner(2)
+        self.assertTrue(tuner.evaluate(event(1)).keep)
+        self.assertTrue(tuner.evaluate(event(2)).keep)
+
+    def test_filters_low_priority(self):
+        tuner = AlertTuner(2)
+        decision = tuner.evaluate(event(3))
+        self.assertFalse(decision.keep)
+        self.assertEqual(decision.reason, "low_priority")
+
+    def test_filters_ignored_sid_and_category(self):
+        tuner = AlertTuner(3, "123,456", "Policy Violation,Misc activity")
+        self.assertEqual(tuner.evaluate(event(1, sid=123)).reason, "ignored_sid")
+        self.assertEqual(
+            tuner.evaluate(event(1, sid=999, category="misc activity")).reason,
+            "ignored_category",
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()