Rework old detections tracking into stuctured alert levels

tests/android/test_artifact_dumpsys_accessibility.py

@@ -49,6 +49,6 @@ class TestDumpsysAccessibilityArtifact:
         ind.parse_stix2(indicator_file)
         ind.ioc_collections[0]["app_ids"].append("com.sec.android.app.camera")
         da.indicators = ind
-        assert len(da.detected) == 0
+        assert len(da.alertstore.alerts) == 0
         da.check_indicators()
-        assert len(da.detected) == 1
+        assert len(da.alertstore.alerts) == 1

tests/android/test_artifact_dumpsys_appops.py

@@ -42,22 +42,24 @@ class TestDumpsysAppopsArtifact:
         ind.parse_stix2(indicator_file)
         ind.ioc_collections[0]["app_ids"].append("com.facebook.katana")
         da.indicators = ind
-        assert len(da.detected) == 0
+        assert len(da.alertstore.alerts) == 0
 
         da.check_indicators()
         detected_by_ioc = [
-            detected for detected in da.detected if detected.get("matched_indicator")
+            alert
+            for alert in da.alertstore.alerts
+            if "matched_indicator" in alert.event
         ]
         detected_by_permission_heuristic = [
-            detected
-            for detected in da.detected
+            alert
+            for alert in da.alertstore.alerts
             if all(
                 [
                     perm["name"] == "REQUEST_INSTALL_PACKAGES"
-                    for perm in detected["permissions"]
+                    for perm in alert.event["permissions"]
                 ]
             )
         ]
-        assert len(da.detected) == 3
+        assert len(da.alertstore.alerts) == 3
         assert len(detected_by_ioc) == 1
         assert len(detected_by_permission_heuristic) == 2

tests/android/test_artifact_dumpsys_battery_daily.py

@@ -32,6 +32,6 @@ class TestDumpsysBatteryDailyArtifact:
         ind.parse_stix2(indicator_file)
         ind.ioc_collections[0]["app_ids"].append("com.facebook.system")
         dba.indicators = ind
-        assert len(dba.detected) == 0
+        assert len(dba.alertstore.alerts) == 0
         dba.check_indicators()
-        assert len(dba.detected) == 1
+        assert len(dba.alertstore.alerts) == 1

tests/android/test_artifact_dumpsys_battery_history.py

@@ -39,6 +39,6 @@ class TestDumpsysBatteryHistoryArtifact:
         ind.parse_stix2(indicator_file)
         ind.ioc_collections[0]["app_ids"].append("com.samsung.android.app.reminder")
         dba.indicators = ind
-        assert len(dba.detected) == 0
+        assert len(dba.alertstore.alerts) == 0
         dba.check_indicators()
-        assert len(dba.detected) == 2
+        assert len(dba.alertstore.alerts) == 2

tests/android/test_artifact_dumpsys_dbinfo.py

@@ -37,6 +37,6 @@ class TestDumpsysDBinfoArtifact:
         ind.parse_stix2(indicator_file)
         ind.ioc_collections[0]["app_ids"].append("com.wssyncmldm")
         dbi.indicators = ind
-        assert len(dbi.detected) == 0
+        assert len(dbi.alertstore.alerts) == 0
         dbi.check_indicators()
-        assert len(dbi.detected) == 5
+        assert len(dbi.alertstore.alerts) == 5

tests/android/test_artifact_dumpsys_package_activities.py

@@ -39,6 +39,6 @@ class TestDumpsysPackageActivitiesArtifact:
         ind.parse_stix2(indicator_file)
         ind.ioc_collections[0]["app_ids"].append("com.google.android.gms")
         dpa.indicators = ind
-        assert len(dpa.detected) == 0
+        assert len(dpa.alertstore.alerts) == 0
         dpa.check_indicators()
-        assert len(dpa.detected) == 1
+        assert len(dpa.alertstore.alerts) == 1

tests/android/test_artifact_dumpsys_packages.py

@@ -37,6 +37,6 @@ class TestDumpsysPackagesArtifact:
         ind.parse_stix2(indicator_file)
         ind.ioc_collections[0]["app_ids"].append("com.sec.android.app.DataCreate")
         dpa.indicators = ind
-        assert len(dpa.detected) == 0
+        assert len(dpa.alertstore.alerts) == 0
         dpa.check_indicators()
-        assert len(dpa.detected) == 1
+        assert len(dpa.alertstore.alerts) == 1

tests/android/test_artifact_dumpsys_platform_compat.py

@@ -35,6 +35,6 @@ class TestDumpsysPlatformCompatArtifact:
         ind.ioc_collections[0]["app_ids"].append("org.torproject.torbrowser")
         ind.ioc_collections[0]["app_ids"].append("org.article19.circulo.next")
         dbi.indicators = ind
-        assert len(dbi.detected) == 0
+        assert len(dbi.alertstore.alerts) == 0
         dbi.check_indicators()
-        assert len(dbi.detected) == 2
+        assert len(dbi.alertstore.alerts) == 2

tests/android/test_artifact_dumpsys_receivers.py

@@ -42,6 +42,6 @@ class TestDumpsysReceiversArtifact:
         ind.parse_stix2(indicator_file)
         ind.ioc_collections[0]["app_ids"].append("com.android.storagemanager")
         dr.indicators = ind
-        assert len(dr.detected) == 0
+        assert len(dr.alertstore.alerts) == 0
         dr.check_indicators()
-        assert len(dr.detected) == 1
+        assert len(dr.alertstore.alerts) == 1

tests/android/test_artifact_getprop.py

@@ -36,6 +36,6 @@ class TestGetPropArtifact:
             "dalvik.vm.appimageformat"
         )
         gp.indicators = ind
-        assert len(gp.detected) == 0
+        assert len(gp.alertstore.alerts) == 0
         gp.check_indicators()
-        assert len(gp.detected) == 1
+        assert len(gp.alertstore.alerts) == 1

tests/android/test_artifact_processes.py

@@ -33,6 +33,6 @@ class TestProcessesArtifact:
         ind.parse_stix2(indicator_file)
         ind.ioc_collections[0]["processes"].append("lru-add-drain")
         p.indicators = ind
-        assert len(p.detected) == 0
+        assert len(p.alertstore.alerts) == 0
         p.check_indicators()
-        assert len(p.detected) == 1
+        assert len(p.alertstore.alerts) == 1

tests/android/test_backup_parser.py

@@ -60,7 +60,6 @@ class TestBackupParsing:
             == "33e73df2ede9798dcb3a85c06200ee41c8f52dd2f2e50ffafcceb0407bc13e3a"
         )
         sms = parse_tar_for_sms(ddata)
-        print(sms)
         assert isinstance(sms, list)
         assert len(sms) == 1
         assert len(sms[0]["links"]) == 1