Add enrichment and SID coverage gates

tests/test_sids.py

@@ -0,0 +1,63 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+"""The SID registry is unique, complete, and matches the engine sources."""
+import unittest
+
+from enodia_sentinel import fim, pkgdb, posture, rootcheck, sids
+from enodia_sentinel.detectors import (
+    credential_access,
+    input_snooper,
+    memory_obfuscation,
+    stealth_network,
+)
+from enodia_sentinel.events.rules import DEFAULT_EXEC_RULES
+from enodia_sentinel.events.syscall_rules import DEFAULT_SYSCALL_RULES
+
+
+class TestRegistry(unittest.TestCase):
+    def test_sids_are_unique(self):
+        nums = [s.sid for s in sids.BUILTIN_SIDS]
+        self.assertEqual(len(nums), len(set(nums)))
+
+    def test_count_and_helpers(self):
+        self.assertEqual(len(sids.BUILTIN_SIDS), 52)
+        self.assertEqual(
+            sids.all_sids(), frozenset(s.sid for s in sids.BUILTIN_SIDS)
+        )
+        self.assertEqual(
+            sids.engine_sids("exec_rule"),
+            frozenset({100001, 100002, 100003, 100004}),
+        )
+
+    def test_event_rule_sids_match_engines(self):
+        self.assertEqual(
+            sids.engine_sids("exec_rule"),
+            frozenset(r.sid for r in DEFAULT_EXEC_RULES),
+        )
+        self.assertEqual(
+            sids.engine_sids("syscall_rule"),
+            frozenset(r.sid for r in DEFAULT_SYSCALL_RULES),
+        )
+
+    def test_registry_uses_the_source_constants(self):
+        by_sid = {s.sid: s for s in sids.BUILTIN_SIDS}
+        for const, engine in (
+            (fim.SID_MODIFIED, "fim"),
+            (pkgdb.SID_PKGDB, "pkgdb"),
+            (rootcheck.SID_HIDDEN_PROC, "rootcheck"),
+            (posture.SID_SSH_ROOT_LOGIN, "posture"),
+            (input_snooper.SID_INPUT_SNOOPER, "detector"),
+            (credential_access.SID_CREDENTIAL_ACCESS, "detector"),
+            (stealth_network.SID_STEALTH_NETWORK, "detector"),
+            (memory_obfuscation.SID_PROCESS_HIDING_LIBRARY, "detector"),
+        ):
+            self.assertIn(const, by_sid)
+            self.assertEqual(by_sid[const].engine, engine)
+
+    def test_every_entry_has_name_and_module(self):
+        for entry in sids.BUILTIN_SIDS:
+            self.assertTrue(entry.name)
+            self.assertTrue(entry.module.startswith("enodia_sentinel"))
+
+
+if __name__ == "__main__":
+    unittest.main()