Add parsed timestamps to alerts

This commit is contained in:
Janik Besendorf
2026-08-14 11:37:38 +02:00
parent 7b64463727
commit 0123bf6e59
36 changed files with 191 additions and 56 deletions
@@ -63,4 +63,10 @@ class TestDumpsysAppopsArtifact:
assert len(da.alertstore.alerts) == 3
assert len(detected_by_ioc) == 1
assert detected_by_ioc[0].matched_indicator is not None
assert detected_by_ioc[0].event_time == max(
entry["timestamp"]
for permission in detected_by_ioc[0].event["permissions"]
for entry in permission.get("entries", [])
if entry.get("timestamp")
)
assert len(detected_by_permission_heuristic) == 2
+1
View File
@@ -44,3 +44,4 @@ class TestCalendarModule:
assert len(m.results) == 1
assert len(m.timeline) == 4
assert len(m.alertstore.alerts) == 1
assert m.alertstore.alerts[0].event_time == m.results[0]["start_date"]