<commit_before># This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
# Copyright (c) 2017 Mozilla Corporation

from positive_alert_test_case import PositiveAlertTestCase
from negative_alert_test_case import NegativeAlertTestCase

from alert_test_suite import AlertTestSuite


class TestAlertGeomodel(AlertTestSuite):
    default_event = {
        "_type": "event",
        "_source": {
            "category": "geomodelnotice",
            "summary": "<EMAIL> NEWCOUNTRY Diamond Bar, United States access from 1.2.3.4 (duo) [deviation:12.07010770457331] last activity was from Ottawa, Canada (3763 km away) approx 23.43 hours before",
            "details": {
                "severity": 2,
                "category": "NEWCOUNTRY",
                "prev_locality_details": {
                    "city": "Toronto",
                    "country": "Canada"
                },
                "locality_details": {
                    "city": "Diamond Bar",
                    "country": "United States"
                },
                "principal": "<EMAIL>",
                "source_ipv4": "1.2.3.4"
            }
        }
    }

    default_alert = {
        "category": "geomodel",
        "tags": ['geomodel'],
        "severity": "NOTICE",
        "notify_mozdefbot": False,
        "summary": "<EMAIL> NEWCOUNTRY Diamond Bar, United States access from 1.2.3.4 (duo) [deviation:12.07010770457331] last activity was from Ottawa, Canada (3763 km away) approx 23.43 hours before",
        "details": {
            "category": "NEWCOUNTRY",
            "previous_locality_details": {
                "city": "Toronto",
                "country": "Canada"
            },
            "locality_details": {
                "city": "Diamond Bar",
                "country": "United States"
            },
            "principal": "<EMAIL>",
            "source_ip": "1.2.3.4"
        },
        "url": "https://www.mozilla.org",
    }

    test_cases = []

    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test case with good event",
            events=[AlertTestSuite.create_event(default_event)],
            expected_alert=default_alert
        )
    )

    event = AlertTestSuite.create_event(default_event)
    event['_source']['details']['severity'] = 3
    alert = AlertTestSuite.create_alert(default_alert)
    alert['notify_mozdefbot'] = True
    alert['severity'] = 'WARNING'
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test case with good event with high severity",
            events=[event],
            expected_alert=alert
        )
    )

    event = AlertTestSuite.create_event(default_event)
    event['_source']['utctimestamp'] = AlertTestSuite.subtract_from_timestamp_lambda({'minutes': 1})
    event['_source']['receivedtimestamp'] = AlertTestSuite.subtract_from_timestamp_lambda({'minutes': 1})
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test case with an event with somewhat old timestamp",
            events=[event],
            expected_alert=default_alert
        )
    )

    movement_event = {
        "_source": {
            u'category': u'geomodelnotice',
            u'details': {
                'category': 'MOVEMENT',
            },
            'severity': 'NOTICE',
            'source': 'UNKNOWN',
            'summary': '<EMAIL> MOVEMENT window violation (London, United Kingdom) -> (San Jose, United States) -> (Frankfurt am Main, Germany) within 4h window',
        }
    }
    movement_alert = {
        "category": "geomodel",
        "tags": ['geomodel'],
        "severity": "NOTICE",
        "notify_mozdefbot": False,
        "summary": "<EMAIL> MOVEMENT window violation (London, United Kingdom) -> (San Jose, United States) -> (Frankfurt am Main, Germany) within 4h window",
    }
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test case with multiple localities",
            events=[AlertTestSuite.create_event(movement_event)],
            expected_alert=movement_alert
        )
    )
<commit_msg>Add tests for unicode details in geomodel alert<commit_after># This Source Code Form is subject to the terms of the Mozilla Public
# License, v. 2.0. If a copy of the MPL was not distributed with this
# file, You can obtain one at http://mozilla.org/MPL/2.0/.
# Copyright (c) 2017 Mozilla Corporation

from positive_alert_test_case import PositiveAlertTestCase
from negative_alert_test_case import NegativeAlertTestCase

from alert_test_suite import AlertTestSuite


class TestAlertGeomodel(AlertTestSuite):
    default_event = {
        "_type": "event",
        "_source": {
            "category": "geomodelnotice",
            "summary": "<EMAIL> NEWCOUNTRY Diamond Bar, United States access from 1.2.3.4 (duo) [deviation:12.07010770457331] last activity was from Ottawa, Canada (3763 km away) approx 23.43 hours before",
            "details": {
                "severity": 2,
                "category": "NEWCOUNTRY",
                "prev_locality_details": {
                    "city": "Toronto",
                    "country": "Canada"
                },
                "locality_details": {
                    "city": "Diamond Bar",
                    "country": "United States"
                },
                "principal": "<EMAIL>",
                "source_ipv4": "1.2.3.4"
            }
        }
    }

    default_alert = {
        "category": "geomodel",
        "tags": ['geomodel'],
        "severity": "NOTICE",
        "notify_mozdefbot": False,
        "summary": "<EMAIL> NEWCOUNTRY Diamond Bar, United States access from 1.2.3.4 (duo) [deviation:12.07010770457331] last activity was from Ottawa, Canada (3763 km away) approx 23.43 hours before",
        "details": {
            "category": "NEWCOUNTRY",
            "previous_locality_details": {
                "city": "Toronto",
                "country": "Canada"
            },
            "locality_details": {
                "city": "Diamond Bar",
                "country": "United States"
            },
            "principal": "<EMAIL>",
            "source_ip": "1.2.3.4"
        },
        "url": "https://www.mozilla.org",
    }

    test_cases = []

    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test case with good event",
            events=[AlertTestSuite.create_event(default_event)],
            expected_alert=default_alert
        )
    )

    event = AlertTestSuite.create_event(default_event)
    event['_source']['details']['severity'] = 3
    alert = AlertTestSuite.create_alert(default_alert)
    alert['notify_mozdefbot'] = True
    alert['severity'] = 'WARNING'
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test case with good event with high severity",
            events=[event],
            expected_alert=alert
        )
    )

    event = AlertTestSuite.create_event(default_event)
    event['_source']['utctimestamp'] = AlertTestSuite.subtract_from_timestamp_lambda({'minutes': 1})
    event['_source']['receivedtimestamp'] = AlertTestSuite.subtract_from_timestamp_lambda({'minutes': 1})
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test case with an event with somewhat old timestamp",
            events=[event],
            expected_alert=default_alert
        )
    )

    movement_event = {
        "_source": {
            u'category': u'geomodelnotice',
            u'details': {
                'category': 'MOVEMENT',
            },
            'severity': 'NOTICE',
            'source': 'UNKNOWN',
            'summary': '<EMAIL> MOVEMENT window violation (London, United Kingdom) -> (San Jose, United States) -> (Frankfurt am Main, Germany) within 4h window',
        }
    }
    movement_alert = {
        "category": "geomodel",
        "tags": ['geomodel'],
        "severity": "NOTICE",
        "notify_mozdefbot": False,
        "summary": "<EMAIL> MOVEMENT window violation (London, United Kingdom) -> (San Jose, United States) -> (Frankfurt am Main, Germany) within 4h window",
    }
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test case with multiple localities",
            events=[AlertTestSuite.create_event(movement_event)],
            expected_alert=movement_alert
        )
    )

    unicode_event = AlertTestSuite.create_event(default_event)
    unicode_event['_source']['summary'] = u"\<EMAIL> NEWCOUNTRY \u0107Bar, \u0107United States access from 1.2.3.4 (duo) [deviation:12.07010770457331] last activity was from Ottawa, Canada (3763 km away) approx 23.43 hours before"
    unicode_event['_source']['details']['prev_locality_details'] = {
        "city": u"\u0107Toronto",
        "country": u"\u0107Canada"
    }
    unicode_event['_source']['details']['locality_details'] = {
        "city": u"\u0107Bar",
        "country": u"\u0107United States"
    }
    unicode_event['_source']['details']['principal'] = u"\<EMAIL>"

    unicode_alert = {
        "category": "geomodel",
        "tags": ['geomodel'],
        "severity": "NOTICE",
        "notify_mozdefbot": False,
        "summary": u"\<EMAIL> NEWCOUNTRY \u0107Bar, \u0107United States access from 1.2.3.4 (duo) [deviation:12.07010770457331] last activity was from Ottawa, Canada (3763 km away) approx 23.43 hours before",
        "details": {
            "category": "NEWCOUNTRY",
            "previous_locality_details": {
                "city": u"\u0107Toronto",
                "country": u"\u0107Canada"
            },
            "locality_details": {
                "city": u"\u0107Bar",
                "country": u"\u0107United States"
            },
            "principal": u"\<EMAIL>",
            "source_ip": "1.2.3.4"
        },
        "url": "https://www.mozilla.org",
    }
    test_cases.append(
        PositiveAlertTestCase(
            description="Positive test case with unicode locations and name",
            events=[AlertTestSuite.create_event(unicode_event)],
            expected_alert=AlertTestSuite.create_alert(unicode_alert)
        )
    )

{'fraction_non_alphanumeric': 0.12149985466524561, 'fraction_numerical': 0.02577269644414301, 'mean_word_length': 2.234722657474146, 'pattern_counts': {'":': 94, '<': 19, '<?xml version=': 0, '>': 27, 'https://': 3, 'lorem ipsum': 0, 'www.': 3, 'xml': 0}, 'pii_count': 11, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6934307', 'n_tokens_mistral': 3171, 'n_tokens_neox': 2869, 'n_words': 681}