Add host correlation and assurance coverage

This commit is contained in:
Luna 2026-07-10 03:07:00 -07:00
parent 8194d13734
commit b40ac4252c
No known key found for this signature in database
36 changed files with 944 additions and 23 deletions

View file

@ -113,6 +113,12 @@ class TestTuiCore(unittest.TestCase):
"severity": "CRITICAL",
"alert_count": 1,
"signatures": ["reverse_shell"],
"correlations": [{
"sid": 100080,
"severity": "CRITICAL",
"signature": "correlation.multi_stage_intrusion",
"summary": "web RCE plus suspicious egress",
}],
},
"timeline": [{
"time": "2026-07-09T01:02:03-07:00",
@ -138,6 +144,12 @@ class TestTuiCore(unittest.TestCase):
"pacman": {"keyring_present": True, "siglevel_status": "ok"},
},
"sentinel_footprint": {"present": 2, "configured": 3, "missing": 1},
"hash_chain": {
"path": "/tmp/hash-chain.jsonl",
"exists": True,
"count": 2,
"last_hash": "abc123",
},
"reconciliation": {
"total": 1,
"stale": 1,
@ -172,8 +184,10 @@ class TestTuiCore(unittest.TestCase):
timeline = render_lines(TuiState(view="timeline", model=model), width=100)
self.assertTrue(any("inc-1" in line for line in timeline))
self.assertTrue(any("pids=4242" in line for line in timeline))
self.assertTrue(any("correlation sid=100080" in line for line in timeline))
integrity = render_lines(TuiState(view="integrity", model=model), width=100)
self.assertTrue(any("Overall:" in line for line in integrity))
self.assertTrue(any("Hash chain:" in line for line in integrity))
self.assertTrue(any("ttl expired" in line for line in integrity))
events = render_lines(TuiState(view="events", model=model), width=100)
self.assertTrue(any("technical logs" in line for line in events))