feat(go): add bounded hot-path enrichment

go-agent/internal/enrich/enrich_test.go

@@ -0,0 +1,56 @@
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package enrich
+
+import (
+	"testing"
+
+	"codeberg.org/anassaeneroi/enodia-sentinal/go-agent/internal/model"
+)
+
+func TestBuildAddsBoundedProcessRemotePathAndLineageContext(t *testing.T) {
+	result := Build([]model.Alert{{
+		SID: 100010, Signature: "reverse_shell", Key: "persist:/etc/cron.d/dropper",
+		Detail: "pid=42 peer=[8.8.8.8:4444] wrote /tmp/dropper (deleted)",
+	}}, []Process{{PID: 42, Comm: "bash", Exe: "/tmp/dropper (deleted)", PPID: 10, PPIDComm: "nginx"}}, []int{42, 10})
+	processes := result["processes"].([]map[string]any)
+	if len(processes) != 1 || processes[0]["exe"] != "/tmp/dropper" ||
+		processes[0]["package_owner"] != nil || processes[0]["exe_sha256"] != nil {
+		t.Fatalf("processes=%#v", processes)
+	}
+	chain := processes[0]["parent_chain"].([]map[string]any)
+	if len(chain) != 1 || chain[0]["pid"] != 10 || chain[0]["comm"] != "nginx" {
+		t.Fatalf("chain=%#v", chain)
+	}
+	remotes := result["remotes"].([]map[string]any)
+	if len(remotes) != 1 || remotes[0]["ip"] != "8.8.8.8" || remotes[0]["classification"] != "public" {
+		t.Fatalf("remotes=%#v", remotes)
+	}
+	files := result["files"].([]map[string]any)
+	if len(files) != 2 || files[0]["path"] != "/etc/cron.d/dropper" || files[1]["path"] != "/tmp/dropper" {
+		t.Fatalf("files=%#v", files)
+	}
+	lineage := result["lineage"].([]map[string]any)
+	if len(lineage) != 2 || lineage[0]["pid"] != 10 || lineage[0]["comm"] != "nginx" {
+		t.Fatalf("lineage=%#v", lineage)
+	}
+}
+
+func TestBuildClassifiesPrivateAndInvalidAddresses(t *testing.T) {
+	result := Build([]model.Alert{{Detail: "peers 10.1.2.3 and 999.1.2.3"}}, nil, nil)
+	remotes := result["remotes"].([]map[string]any)
+	if len(remotes) != 2 || remotes[0]["classification"] != "private" || remotes[1]["classification"] != "invalid" {
+		t.Fatalf("remotes=%#v", remotes)
+	}
+}
+
+func TestBuildCapsAttackerControlledIndicators(t *testing.T) {
+	alerts := make([]model.Alert, 300)
+	for index := range alerts {
+		alerts[index].Detail = "/tmp/path " + "1.2.3.4"
+	}
+	result := Build(alerts, nil, nil)
+	if len(result["remotes"].([]map[string]any)) > maxIndicators || len(result["files"].([]map[string]any)) > maxIndicators {
+		t.Fatal("indicator caps were not applied")
+	}
+}