Initial release: offline NetScaler triage with Sigma rules and MIT license

tests/test_indicators.py

@@ -0,0 +1,42 @@
+import unittest
+
+from netscaler_triage.indicators import defang, extract_indicators
+
+
+class IndicatorTests(unittest.TestCase):
+    def test_interleaved_url_and_path_spans(self) -> None:
+        rows = extract_indicators(
+            "/before http://example.test/a /between https://example.test/b?q=/internal /after"
+        )
+        self.assertEqual(
+            {r["value"] for r in rows if r["type"] == "path"}, {"/before", "/between", "/after"}
+        )
+
+    def test_addresses_and_domains(self) -> None:
+        rows = extract_indicators(
+            "src=192.0.2.1 invalid=999.1.1.1 peer=2001:db8::1 Host: example.test ordinary.txt"
+        )
+        values = {r["value"] for r in rows}
+        self.assertIn("192.0.2.1", values)
+        self.assertIn("2001:db8::1", values)
+        self.assertIn("example.test", values)
+        self.assertNotIn("999.1.1.1", values)
+        self.assertNotIn("ordinary.txt", values)
+
+    def test_original_and_reversible_defang(self) -> None:
+        url = "https://example.test:8443/a.php?q=1"
+        rows = extract_indicators(url + " /tmp/file " + "a" * 64)
+        self.assertIn(url, [r["value"] for r in rows])
+        self.assertIn("sha256", [r["type"] for r in rows])
+        encoded = defang(url, "url")
+        self.assertNotIn("https://", encoded)
+        restored = encoded.replace("[.]", ".").replace("[:]", ":").replace("hxxps:", "https:")
+        self.assertEqual(restored, url)
+
+    def test_boundaries(self) -> None:
+        self.assertEqual(extract_indicators("x192.0.2.1suffix"), [])
+        self.assertFalse(any(r["type"] == "domain" for r in extract_indicators("http://[broken")))
+
+
+if __name__ == "__main__":
+    unittest.main()