diff --git a/docs/detectors/deeplog.md b/docs/detectors/deeplog.md index f9e7e3f9..ff86e760 100644 --- a/docs/detectors/deeplog.md +++ b/docs/detectors/deeplog.md @@ -38,26 +38,6 @@ detectors: ## Example usage ```python -from detectmatelibrary.detectors.deeplog_detector import DeeplogDetector - -import detectmatelibrary.schemas as schemas - -detector = DeeplogDetector(name="DeeplogDetector", config=cfg) - -test_data = schemas.ParserSchema({ - "parserType": "test", - "EventID": 12, - "template": "test template", - "variables": ["adsasd", "asdasd"], - "logID": "2", - "parsedLogID": "2", - "parserID": "test_parser", - "log": "test log message", - "logFormatVariables": {"level": "CRITICAL"} -}) -output = schemas.DetectorSchema() - -result = detector.detect(test_data, output) - +--8<-- "docs/examples/detectors/deeplog_detector.py:example" ``` Go back [Index](../index.md) diff --git a/docs/detectors/ecvc_detector.md b/docs/detectors/ecvc_detector.md index a3570ea2..bae84357 100644 --- a/docs/detectors/ecvc_detector.md +++ b/docs/detectors/ecvc_detector.md @@ -25,35 +25,7 @@ detectors: ## Example usage ```python -from detectmatelibrary.detectors.ecvc_detector import ECVCDetector -import detectmatelibrary.schemas as schemas - -cfg = { - "detectors": { - "ECVCDetector": { - "method_type": "ecvc_detector_detector", - "window_size": 10, - "validation_per": 0.2, - "threshold_method": "mean" # mean, default (default = threshold 0) - } - } -} -detector = ECVCDetector(name="ECVCDetector", config=cfg) - -parser_data = schemas.ParserSchema({ - "parserType": "test", - "EventID": 1, - "template": "test template", - "variables": ["var1"], - "logID": "1", - "parsedLogID": "1", - "parserID": "test_parser", - "log": "test log message", - "logFormatVariables": {"timestamp": "123456"} -}) - - -alert = detector.process(parser_data) +--8<-- "docs/examples/detectors/ecvc_detector.py:example" ``` Go back [Index](../index.md) diff --git a/docs/detectors/logbert.md b/docs/detectors/logbert.md index 6c379014..dbfde1e7 100644 --- a/docs/detectors/logbert.md +++ b/docs/detectors/logbert.md @@ -43,26 +43,6 @@ detectors: ## Example usage ```python -from detectmatelibrary.detectors.logbert_detector import LogBertDetector - -import detectmatelibrary.schemas as schemas - -detector = LogBertDetector(name="LogBertDetector", config=cfg) - -test_data = schemas.ParserSchema({ - "parserType": "test", - "EventID": 12, - "template": "test template", - "variables": ["adsasd", "asdasd"], - "logID": "2", - "parsedLogID": "2", - "parserID": "test_parser", - "log": "test log message", - "logFormatVariables": {"level": "CRITICAL"} -}) -output = schemas.DetectorSchema() - -result = detector.detect(test_data, output) - +--8<-- "docs/examples/detectors/logbert_detector.py:example" ``` Go back [Index](../index.md) diff --git a/docs/detectors/scvs_detector.md b/docs/detectors/scvs_detector.md index 85be4764..8935516e 100644 --- a/docs/detectors/scvs_detector.md +++ b/docs/detectors/scvs_detector.md @@ -25,33 +25,7 @@ detectors: ## Example usage ```python -from detectmatelibrary.detectors.scvs_detector import SCVSDetector -import detectmatelibrary.schemas as schemas - -cfg = { - "detectors": { - "SCVSDetector": { - "method_type": "scvs_detector", - "auto_config": False, - } - } -} -detector = SCVSDetector(name="NewValueTest", config=cfg) - -parser_data = schemas.ParserSchema({ - "parserType": "test", - "EventID": 1, - "template": "test template", - "variables": ["var1"], - "logID": "1", - "parsedLogID": "1", - "parserID": "test_parser", - "log": "test log message", - "logFormatVariables": {"timestamp": "123456"} -}) - - -alert = detector.process(parser_data) +--8<-- "docs/examples/detectors/scvs_detector.py:example" ``` Go back [Index](../index.md) diff --git a/docs/examples/detectors/deeplog_detector.py b/docs/examples/detectors/deeplog_detector.py new file mode 100644 index 00000000..93c83625 --- /dev/null +++ b/docs/examples/detectors/deeplog_detector.py @@ -0,0 +1,31 @@ +# --8<-- [start:example] +from detectmatelibrary.detectors.deeplog_detector import DeeplogDetector + +import detectmatelibrary.schemas as schemas + +cfg = { + "detectors": { + "DeeplogDetector": { + "method_type": "deeplog_detector", + "auto_config": True, + } + } +} + +detector = DeeplogDetector(name="DeeplogDetector", config=cfg) + +test_data = schemas.ParserSchema({ + "parserType": "test", + "EventID": 12, + "template": "test template", + "variables": ["adsasd", "asdasd"], + "logID": "2", + "parsedLogID": "2", + "parserID": "test_parser", + "log": "test log message", + "logFormatVariables": {"level": "CRITICAL"} +}) +output = schemas.DetectorSchema() + +result = detector.detect([test_data], output) +# --8<-- [end:example] \ No newline at end of file diff --git a/docs/examples/detectors/ecvc_detector.py b/docs/examples/detectors/ecvc_detector.py new file mode 100644 index 00000000..4789674f --- /dev/null +++ b/docs/examples/detectors/ecvc_detector.py @@ -0,0 +1,31 @@ +# --8<-- [start:example] +from detectmatelibrary.detectors.ecvc_detector import ECVCDetector +import detectmatelibrary.schemas as schemas + +cfg = { + "detectors": { + "ECVCDetector": { + "method_type": "ecvc_detector_detector", + "window_size": 10, + "validation_per": 0.2, + "threshold_method": "mean" # mean, default (default = threshold 0) + } + } +} +detector = ECVCDetector(name="ECVCDetector", config=cfg) + +parser_data = schemas.ParserSchema({ + "parserType": "test", + "EventID": 1, + "template": "test template", + "variables": ["var1"], + "logID": "1", + "parsedLogID": "1", + "parserID": "test_parser", + "log": "test log message", + "logFormatVariables": {"timestamp": "123456"} +}) + + +alert = detector.process(parser_data) +# --8<-- [end:example] diff --git a/docs/examples/detectors/logbert_detector.py b/docs/examples/detectors/logbert_detector.py new file mode 100644 index 00000000..5ac47bc9 --- /dev/null +++ b/docs/examples/detectors/logbert_detector.py @@ -0,0 +1,31 @@ +# --8<-- [start:example] +from detectmatelibrary.detectors.logbert_detector import LogBertDetector + +import detectmatelibrary.schemas as schemas + +cfg = { + "detectors": { + "LogBertDetector": { + "method_type": "logbert_detector", + "auto_config": True, + } + } +} + +detector = LogBertDetector(name="LogBertDetector", config=cfg) + +test_data = schemas.ParserSchema({ + "parserType": "test", + "EventID": 12, + "template": "test template", + "variables": ["adsasd", "asdasd"], + "logID": "2", + "parsedLogID": "2", + "parserID": "test_parser", + "log": "test log message", + "logFormatVariables": {"level": "CRITICAL"} +}) +output = schemas.DetectorSchema() + +result = detector.detect([test_data], output) +# --8<-- [end:example] \ No newline at end of file diff --git a/docs/examples/detectors/scvs_detector.py b/docs/examples/detectors/scvs_detector.py new file mode 100644 index 00000000..bb0c1675 --- /dev/null +++ b/docs/examples/detectors/scvs_detector.py @@ -0,0 +1,29 @@ +# --8<-- [start:example] +from detectmatelibrary.detectors.scvs_detector import SCVSDetector +import detectmatelibrary.schemas as schemas + +cfg = { + "detectors": { + "SCVSDetector": { + "method_type": "scvs_detector", + "auto_config": False, + } + } +} +detector = SCVSDetector(name="SCVSDetector", config=cfg) + +parser_data = schemas.ParserSchema({ + "parserType": "test", + "EventID": 1, + "template": "test template", + "variables": ["var1"], + "logID": "1", + "parsedLogID": "1", + "parserID": "test_parser", + "log": "test log message", + "logFormatVariables": {"timestamp": "123456"} +}) + + +alert = detector.process(parser_data) +# --8<-- [end:example] diff --git a/tests/test_detectors/test_ecvc_detector.py b/tests/test_detectors/test_ecvc_detector.py index 138fa2a9..ca9ee8d4 100644 --- a/tests/test_detectors/test_ecvc_detector.py +++ b/tests/test_detectors/test_ecvc_detector.py @@ -7,6 +7,7 @@ from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL import numpy as np +import pytest class TestECVCOP: @@ -136,6 +137,7 @@ def test_ecvc(self): class TestECVCDetectorEndToEnd: """Regression test: full configure/train/detect pipeline on audit.log.""" + @pytest.mark.ignored def test_audit_log_anomalies(self): parser = MatcherParser(config=PIPELINE_CONFIG) detector = ECVCDetector(config=PIPELINE_CONFIG) diff --git a/tests/test_detectors/test_scvs_detector.py b/tests/test_detectors/test_scvs_detector.py index e69cc968..4307c128 100644 --- a/tests/test_detectors/test_scvs_detector.py +++ b/tests/test_detectors/test_scvs_detector.py @@ -6,6 +6,8 @@ from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL +import pytest + class TestSCVSDetector: def test_build_count_vec(self): @@ -81,6 +83,7 @@ def test_scvs(self): class TestSCVSDetectorEndToEnd: """Regression test: full configure/train/detect pipeline on audit.log.""" + @pytest.mark.ignored def test_audit_log_anomalies(self): parser = MatcherParser(config=PIPELINE_CONFIG) detector = SCVSDetector(config=PIPELINE_CONFIG)