mirror of
https://github.com/mvt-project/mvt.git
synced 2026-09-03 08:30:51 +02:00
Add parsed timestamps to alerts
This commit is contained in:
@@ -63,4 +63,10 @@ class TestDumpsysAppopsArtifact:
|
||||
assert len(da.alertstore.alerts) == 3
|
||||
assert len(detected_by_ioc) == 1
|
||||
assert detected_by_ioc[0].matched_indicator is not None
|
||||
assert detected_by_ioc[0].event_time == max(
|
||||
entry["timestamp"]
|
||||
for permission in detected_by_ioc[0].event["permissions"]
|
||||
for entry in permission.get("entries", [])
|
||||
if entry.get("timestamp")
|
||||
)
|
||||
assert len(detected_by_permission_heuristic) == 2
|
||||
|
||||
Reference in New Issue
Block a user