67 lines
2.0 KiB
Python
67 lines
2.0 KiB
Python
from datetime import UTC, datetime
|
|
|
|
|
|
def test_matches_equals():
|
|
rule = {"conditions": [{"field": "operation", "op": "eq", "value": "Add user"}]}
|
|
event = {"operation": "Add user", "timestamp": datetime.now(UTC).isoformat()}
|
|
from rules import _matches
|
|
|
|
assert _matches(rule, event) is True
|
|
|
|
|
|
def test_matches_not_equals():
|
|
rule = {"conditions": [{"field": "operation", "op": "neq", "value": "Delete user"}]}
|
|
event = {"operation": "Add user", "timestamp": datetime.now(UTC).isoformat()}
|
|
from rules import _matches
|
|
|
|
assert _matches(rule, event) is True
|
|
|
|
|
|
def test_matches_contains():
|
|
rule = {"conditions": [{"field": "actor_display", "op": "contains", "value": "Admin"}]}
|
|
event = {"actor_display": "Admin (admin@example.com)", "timestamp": datetime.now(UTC).isoformat()}
|
|
from rules import _matches
|
|
|
|
assert _matches(rule, event) is True
|
|
|
|
|
|
def test_matches_after_hours():
|
|
rule = {"conditions": [{"field": "timestamp", "op": "after_hours", "value": None}]}
|
|
event = {"timestamp": "2024-01-01T22:00:00Z"}
|
|
from rules import _matches
|
|
|
|
assert _matches(rule, event) is True
|
|
|
|
event2 = {"timestamp": "2024-01-01T10:00:00Z"}
|
|
assert _matches(rule, event2) is False
|
|
|
|
|
|
def test_evaluate_event_creates_alert(monkeypatch):
|
|
from rules import alerts_collection, evaluate_event
|
|
|
|
monkeypatch.setattr(
|
|
"rules.load_rules",
|
|
lambda: [
|
|
{
|
|
"_id": "r1",
|
|
"name": "Test rule",
|
|
"enabled": True,
|
|
"severity": "high",
|
|
"conditions": [{"field": "operation", "op": "eq", "value": "Add user"}],
|
|
"message": "Alert!",
|
|
}
|
|
],
|
|
)
|
|
|
|
inserted = {}
|
|
|
|
def mock_insert(doc):
|
|
inserted["doc"] = doc
|
|
|
|
monkeypatch.setattr(alerts_collection, "insert_one", mock_insert)
|
|
|
|
event = {"id": "e1", "operation": "Add user", "timestamp": datetime.now(UTC).isoformat(), "dedupe_key": "dk1"}
|
|
triggered = evaluate_event(event)
|
|
assert len(triggered) == 1
|
|
assert inserted["doc"]["rule_name"] == "Test rule"
|