Add host correlation and assurance coverage

tests/test_first_seen.py

@@ -0,0 +1,42 @@
+# SPDX-License-Identifier: GPL-3.0-or-later
+import tempfile
+import unittest
+from pathlib import Path
+
+from enodia_sentinel.config import Config
+from enodia_sentinel.detectors import first_seen
+from enodia_sentinel.system import Socket, SystemState
+
+
+class TestFirstSeen(unittest.TestCase):
+    def setUp(self):
+        self.dir = tempfile.TemporaryDirectory()
+        self.cfg = Config()
+        self.cfg.log_dir = Path(self.dir.name)
+
+    def tearDown(self):
+        self.dir.cleanup()
+
+    def test_first_pass_baselines_without_alerting_then_new_dest_alerts(self):
+        first = SystemState(sockets=[
+            Socket("ESTAB", "10.0.0.2:5000", "8.8.8.8:443", 1, "curl", 400, "tcp"),
+        ])
+        self.assertEqual(list(first_seen.detect(first, self.cfg)), [])
+        second = SystemState(sockets=[
+            Socket("ESTAB", "10.0.0.2:5001", "1.1.1.1:8443", 2, "curl", 400, "tcp"),
+        ])
+        alerts = list(first_seen.detect(second, self.cfg))
+        self.assertEqual(alerts[0].sid, first_seen.SID_FIRST_PUBLIC_DESTINATION)
+
+    def test_new_listener_port_alerts_after_baseline(self):
+        list(first_seen.detect(SystemState(sockets=[
+            Socket("LISTEN", "0.0.0.0:8000", "*:*", 1, "python3", 401, "tcp"),
+        ]), self.cfg))
+        alerts = list(first_seen.detect(SystemState(sockets=[
+            Socket("LISTEN", "0.0.0.0:9000", "*:*", 2, "python3", 401, "tcp"),
+        ]), self.cfg))
+        self.assertEqual(alerts[0].sid, first_seen.SID_FIRST_LISTENER_PORT)
+
+
+if __name__ == "__main__":
+    unittest.main()