From 74e6665fe8fec0dd6e18d093bdba24f91fce7c25 Mon Sep 17 00:00:00 2001 From: "angre.garcia-gomez@ait.ac.at" Date: Tue, 11 Aug 2026 15:05:26 +0200 Subject: [PATCH 1/5] update code doc for SCVS detector --- docs/detectors/scvs_detector.md | 28 +---------------------- docs/examples/detectors/scvs_detector.py | 29 ++++++++++++++++++++++++ 2 files changed, 30 insertions(+), 27 deletions(-) create mode 100644 docs/examples/detectors/scvs_detector.py diff --git a/docs/detectors/scvs_detector.md b/docs/detectors/scvs_detector.md index 85be4764..8935516e 100644 --- a/docs/detectors/scvs_detector.md +++ b/docs/detectors/scvs_detector.md @@ -25,33 +25,7 @@ detectors: ## Example usage ```python -from detectmatelibrary.detectors.scvs_detector import SCVSDetector -import detectmatelibrary.schemas as schemas - -cfg = { - "detectors": { - "SCVSDetector": { - "method_type": "scvs_detector", - "auto_config": False, - } - } -} -detector = SCVSDetector(name="NewValueTest", config=cfg) - -parser_data = schemas.ParserSchema({ - "parserType": "test", - "EventID": 1, - "template": "test template", - "variables": ["var1"], - "logID": "1", - "parsedLogID": "1", - "parserID": "test_parser", - "log": "test log message", - "logFormatVariables": {"timestamp": "123456"} -}) - - -alert = detector.process(parser_data) +--8<-- "docs/examples/detectors/scvs_detector.py:example" ``` Go back [Index](../index.md) diff --git a/docs/examples/detectors/scvs_detector.py b/docs/examples/detectors/scvs_detector.py new file mode 100644 index 00000000..bb0c1675 --- /dev/null +++ b/docs/examples/detectors/scvs_detector.py @@ -0,0 +1,29 @@ +# --8<-- [start:example] +from detectmatelibrary.detectors.scvs_detector import SCVSDetector +import detectmatelibrary.schemas as schemas + +cfg = { + "detectors": { + "SCVSDetector": { + "method_type": "scvs_detector", + "auto_config": False, + } + } +} +detector = SCVSDetector(name="SCVSDetector", config=cfg) + +parser_data = schemas.ParserSchema({ + "parserType": "test", + "EventID": 1, + "template": "test template", + "variables": ["var1"], + "logID": "1", + "parsedLogID": "1", + "parserID": "test_parser", + "log": "test log message", + "logFormatVariables": {"timestamp": "123456"} +}) + + +alert = detector.process(parser_data) +# --8<-- [end:example] From f7c096c3a745d3bb59912f2f5d41b9d7be66d1be Mon Sep 17 00:00:00 2001 From: "angre.garcia-gomez@ait.ac.at" Date: Tue, 11 Aug 2026 15:11:10 +0200 Subject: [PATCH 2/5] update code doc for ECVC detector --- docs/detectors/ecvc_detector.md | 30 +---------------------- docs/examples/detectors/ecvc_detector.py | 31 ++++++++++++++++++++++++ 2 files changed, 32 insertions(+), 29 deletions(-) create mode 100644 docs/examples/detectors/ecvc_detector.py diff --git a/docs/detectors/ecvc_detector.md b/docs/detectors/ecvc_detector.md index a3570ea2..bae84357 100644 --- a/docs/detectors/ecvc_detector.md +++ b/docs/detectors/ecvc_detector.md @@ -25,35 +25,7 @@ detectors: ## Example usage ```python -from detectmatelibrary.detectors.ecvc_detector import ECVCDetector -import detectmatelibrary.schemas as schemas - -cfg = { - "detectors": { - "ECVCDetector": { - "method_type": "ecvc_detector_detector", - "window_size": 10, - "validation_per": 0.2, - "threshold_method": "mean" # mean, default (default = threshold 0) - } - } -} -detector = ECVCDetector(name="ECVCDetector", config=cfg) - -parser_data = schemas.ParserSchema({ - "parserType": "test", - "EventID": 1, - "template": "test template", - "variables": ["var1"], - "logID": "1", - "parsedLogID": "1", - "parserID": "test_parser", - "log": "test log message", - "logFormatVariables": {"timestamp": "123456"} -}) - - -alert = detector.process(parser_data) +--8<-- "docs/examples/detectors/ecvc_detector.py:example" ``` Go back [Index](../index.md) diff --git a/docs/examples/detectors/ecvc_detector.py b/docs/examples/detectors/ecvc_detector.py new file mode 100644 index 00000000..4789674f --- /dev/null +++ b/docs/examples/detectors/ecvc_detector.py @@ -0,0 +1,31 @@ +# --8<-- [start:example] +from detectmatelibrary.detectors.ecvc_detector import ECVCDetector +import detectmatelibrary.schemas as schemas + +cfg = { + "detectors": { + "ECVCDetector": { + "method_type": "ecvc_detector_detector", + "window_size": 10, + "validation_per": 0.2, + "threshold_method": "mean" # mean, default (default = threshold 0) + } + } +} +detector = ECVCDetector(name="ECVCDetector", config=cfg) + +parser_data = schemas.ParserSchema({ + "parserType": "test", + "EventID": 1, + "template": "test template", + "variables": ["var1"], + "logID": "1", + "parsedLogID": "1", + "parserID": "test_parser", + "log": "test log message", + "logFormatVariables": {"timestamp": "123456"} +}) + + +alert = detector.process(parser_data) +# --8<-- [end:example] From c03f0bc205d9b4c8ac5c39f2476440d4224a7d4d Mon Sep 17 00:00:00 2001 From: "angre.garcia-gomez@ait.ac.at" Date: Tue, 11 Aug 2026 15:17:00 +0200 Subject: [PATCH 3/5] update code doc for Deeplog detector --- docs/detectors/deeplog.md | 22 +-------------- docs/examples/detectors/deeplog_detector.py | 31 +++++++++++++++++++++ 2 files changed, 32 insertions(+), 21 deletions(-) create mode 100644 docs/examples/detectors/deeplog_detector.py diff --git a/docs/detectors/deeplog.md b/docs/detectors/deeplog.md index f9e7e3f9..ff86e760 100644 --- a/docs/detectors/deeplog.md +++ b/docs/detectors/deeplog.md @@ -38,26 +38,6 @@ detectors: ## Example usage ```python -from detectmatelibrary.detectors.deeplog_detector import DeeplogDetector - -import detectmatelibrary.schemas as schemas - -detector = DeeplogDetector(name="DeeplogDetector", config=cfg) - -test_data = schemas.ParserSchema({ - "parserType": "test", - "EventID": 12, - "template": "test template", - "variables": ["adsasd", "asdasd"], - "logID": "2", - "parsedLogID": "2", - "parserID": "test_parser", - "log": "test log message", - "logFormatVariables": {"level": "CRITICAL"} -}) -output = schemas.DetectorSchema() - -result = detector.detect(test_data, output) - +--8<-- "docs/examples/detectors/deeplog_detector.py:example" ``` Go back [Index](../index.md) diff --git a/docs/examples/detectors/deeplog_detector.py b/docs/examples/detectors/deeplog_detector.py new file mode 100644 index 00000000..998ce7a4 --- /dev/null +++ b/docs/examples/detectors/deeplog_detector.py @@ -0,0 +1,31 @@ +# --8<-- [start:example] +from detectmatelibrary.detectors.deeplog_detector import DeeplogDetector + +import detectmatelibrary.schemas as schemas + +cfg = { + "detectors": { + "DeeplogDetector": { + "method_type": "deeplog_detector", + "auto_config": True, + } + } +} + +detector = DeeplogDetector(name="DeeplogDetector", config=cfg) + +test_data = schemas.ParserSchema({ + "parserType": "test", + "EventID": 12, + "template": "test template", + "variables": ["adsasd", "asdasd"], + "logID": "2", + "parsedLogID": "2", + "parserID": "test_parser", + "log": "test log message", + "logFormatVariables": {"level": "CRITICAL"} +}) +output = schemas.DetectorSchema() + +result = detector.detect(test_data, output) +# --8<-- [end:example] \ No newline at end of file From ebca96c1cd6d22c1b27eab7a5e7c3ab972bde7fc Mon Sep 17 00:00:00 2001 From: "angre.garcia-gomez@ait.ac.at" Date: Tue, 11 Aug 2026 15:24:52 +0200 Subject: [PATCH 4/5] update code doc for LogBert detector --- docs/detectors/logbert.md | 22 +-------------- docs/examples/detectors/deeplog_detector.py | 2 +- docs/examples/detectors/logbert_detector.py | 31 +++++++++++++++++++++ 3 files changed, 33 insertions(+), 22 deletions(-) create mode 100644 docs/examples/detectors/logbert_detector.py diff --git a/docs/detectors/logbert.md b/docs/detectors/logbert.md index 6c379014..dbfde1e7 100644 --- a/docs/detectors/logbert.md +++ b/docs/detectors/logbert.md @@ -43,26 +43,6 @@ detectors: ## Example usage ```python -from detectmatelibrary.detectors.logbert_detector import LogBertDetector - -import detectmatelibrary.schemas as schemas - -detector = LogBertDetector(name="LogBertDetector", config=cfg) - -test_data = schemas.ParserSchema({ - "parserType": "test", - "EventID": 12, - "template": "test template", - "variables": ["adsasd", "asdasd"], - "logID": "2", - "parsedLogID": "2", - "parserID": "test_parser", - "log": "test log message", - "logFormatVariables": {"level": "CRITICAL"} -}) -output = schemas.DetectorSchema() - -result = detector.detect(test_data, output) - +--8<-- "docs/examples/detectors/logbert_detector.py:example" ``` Go back [Index](../index.md) diff --git a/docs/examples/detectors/deeplog_detector.py b/docs/examples/detectors/deeplog_detector.py index 998ce7a4..93c83625 100644 --- a/docs/examples/detectors/deeplog_detector.py +++ b/docs/examples/detectors/deeplog_detector.py @@ -27,5 +27,5 @@ }) output = schemas.DetectorSchema() -result = detector.detect(test_data, output) +result = detector.detect([test_data], output) # --8<-- [end:example] \ No newline at end of file diff --git a/docs/examples/detectors/logbert_detector.py b/docs/examples/detectors/logbert_detector.py new file mode 100644 index 00000000..5ac47bc9 --- /dev/null +++ b/docs/examples/detectors/logbert_detector.py @@ -0,0 +1,31 @@ +# --8<-- [start:example] +from detectmatelibrary.detectors.logbert_detector import LogBertDetector + +import detectmatelibrary.schemas as schemas + +cfg = { + "detectors": { + "LogBertDetector": { + "method_type": "logbert_detector", + "auto_config": True, + } + } +} + +detector = LogBertDetector(name="LogBertDetector", config=cfg) + +test_data = schemas.ParserSchema({ + "parserType": "test", + "EventID": 12, + "template": "test template", + "variables": ["adsasd", "asdasd"], + "logID": "2", + "parsedLogID": "2", + "parserID": "test_parser", + "log": "test log message", + "logFormatVariables": {"level": "CRITICAL"} +}) +output = schemas.DetectorSchema() + +result = detector.detect([test_data], output) +# --8<-- [end:example] \ No newline at end of file From f00d2e790467c5c49951409b5a6e970441fa3c56 Mon Sep 17 00:00:00 2001 From: "angre.garcia-gomez@ait.ac.at" Date: Tue, 11 Aug 2026 15:28:08 +0200 Subject: [PATCH 5/5] add ignred mark --- tests/test_detectors/test_ecvc_detector.py | 2 ++ tests/test_detectors/test_scvs_detector.py | 3 +++ 2 files changed, 5 insertions(+) diff --git a/tests/test_detectors/test_ecvc_detector.py b/tests/test_detectors/test_ecvc_detector.py index 138fa2a9..ca9ee8d4 100644 --- a/tests/test_detectors/test_ecvc_detector.py +++ b/tests/test_detectors/test_ecvc_detector.py @@ -7,6 +7,7 @@ from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL import numpy as np +import pytest class TestECVCOP: @@ -136,6 +137,7 @@ def test_ecvc(self): class TestECVCDetectorEndToEnd: """Regression test: full configure/train/detect pipeline on audit.log.""" + @pytest.mark.ignored def test_audit_log_anomalies(self): parser = MatcherParser(config=PIPELINE_CONFIG) detector = ECVCDetector(config=PIPELINE_CONFIG) diff --git a/tests/test_detectors/test_scvs_detector.py b/tests/test_detectors/test_scvs_detector.py index e69cc968..4307c128 100644 --- a/tests/test_detectors/test_scvs_detector.py +++ b/tests/test_detectors/test_scvs_detector.py @@ -6,6 +6,8 @@ from tests.test_data import AUDIT_LOG, AUDIT_TEMPLATES, TRAIN_UNTIL +import pytest + class TestSCVSDetector: def test_build_count_vec(self): @@ -81,6 +83,7 @@ def test_scvs(self): class TestSCVSDetectorEndToEnd: """Regression test: full configure/train/detect pipeline on audit.log.""" + @pytest.mark.ignored def test_audit_log_anomalies(self): parser = MatcherParser(config=PIPELINE_CONFIG) detector = SCVSDetector(config=PIPELINE_CONFIG)