e504b3dbcf
38 tests covering the pure worker-line logic: Classifyline rules, Routeline TLP/country/incident-type gates, Sealine seal/unseal round-trip, Proofline confidence scoring, Mapline CVEResolver escalation, Trainline dataset well-posedness (the v1/v3 input-signal bugs are now regression-guarded), and the Scoutline feed parsers. pytest added as a dev extra. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
50 lines
1.6 KiB
Python
50 lines
1.6 KiB
Python
"""Scoutline parser tests — feed rows to normalized Case objects."""
|
|
|
|
from __future__ import annotations
|
|
|
|
from psyc.lines.scout import _feodo_record_to_case, _kev_vuln_to_case, _parse_urlhaus_csv
|
|
|
|
URLHAUS_CSV = """\
|
|
# comment line
|
|
"3846688","2026-05-14 11:01:14","http://1.2.3.4/x","online","2026-05-14","malware_download","elf,mirai","https://urlhaus.abuse.ch/url/3846688/","reporter1"
|
|
"""
|
|
|
|
|
|
def test__parse_urlhaus_csv_skips_comments_and_parses_rows():
|
|
rows = list(_parse_urlhaus_csv(URLHAUS_CSV))
|
|
assert len(rows) == 1
|
|
assert rows[0]["url"] == "http://1.2.3.4/x"
|
|
assert rows[0]["url_status"] == "online"
|
|
|
|
|
|
def test_kev_vuln_to_case():
|
|
vuln = {
|
|
"cveID": "CVE-2026-0300",
|
|
"vendorProject": "Microsoft",
|
|
"product": "Exchange",
|
|
"vulnerabilityName": "Exchange XSS",
|
|
"dateAdded": "2026-05-15",
|
|
"knownRansomwareCampaignUse": "Known",
|
|
}
|
|
case = _kev_vuln_to_case(vuln)
|
|
assert case.case_id == "PSYC-KEV-CVE-2026-0300"
|
|
assert case.observables.cves == ["CVE-2026-0300"]
|
|
assert case.source_metadata["feed"] == "cisa-kev"
|
|
assert case.source_metadata["ransomware"] == "Known"
|
|
|
|
|
|
def test_feodo_record_to_case():
|
|
record = {
|
|
"ip_address": "162.243.103.246",
|
|
"port": 8080,
|
|
"status": "online",
|
|
"malware": "Emotet",
|
|
"country": "US",
|
|
"first_seen": "2022-06-04 21:24:53",
|
|
}
|
|
case = _feodo_record_to_case(record)
|
|
assert case.observables.ips == ["162.243.103.246"]
|
|
assert case.source_metadata["feed"] == "feodo"
|
|
assert case.source_metadata["malware"] == "Emotet"
|
|
assert case.source_metadata["status"] == "online"
|