40 lines
1.1 KiB
Python
40 lines
1.1 KiB
Python
import unittest
|
|
|
|
from app.tuning import AlertTuner
|
|
|
|
|
|
def event(severity=2, sid=123, category="Attempted Information Leak"):
|
|
return {
|
|
"event_type": "alert",
|
|
"alert": {
|
|
"severity": severity,
|
|
"signature_id": sid,
|
|
"category": category,
|
|
},
|
|
}
|
|
|
|
|
|
class TuningTests(unittest.TestCase):
|
|
def test_keeps_high_and_medium_priority_by_default_profile(self):
|
|
tuner = AlertTuner(2)
|
|
self.assertTrue(tuner.evaluate(event(1)).keep)
|
|
self.assertTrue(tuner.evaluate(event(2)).keep)
|
|
|
|
def test_filters_low_priority(self):
|
|
tuner = AlertTuner(2)
|
|
decision = tuner.evaluate(event(3))
|
|
self.assertFalse(decision.keep)
|
|
self.assertEqual(decision.reason, "low_priority")
|
|
|
|
def test_filters_ignored_sid_and_category(self):
|
|
tuner = AlertTuner(3, "123,456", "Policy Violation,Misc activity")
|
|
self.assertEqual(tuner.evaluate(event(1, sid=123)).reason, "ignored_sid")
|
|
self.assertEqual(
|
|
tuner.evaluate(event(1, sid=999, category="misc activity")).reason,
|
|
"ignored_category",
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|