violin/tests/pentest_docs/test_pentest_docs_task8_detection_engineering.py

from pathlib import Path

ROOT = Path(__file__).resolve().parents[2]
PENTEST = ROOT / "skills/pentest"
REPORTING = PENTEST / "playbooks/reporting.md"
TEMPLATE = PENTEST / "templates/report-template.md"
DETECTION_TEMPLATE = PENTEST / "templates/detection-engineering.md"


def _text(path: Path) -> str:
    return path.read_text(encoding="utf-8")


def test_detection_engineering_template_exists_with_required_fields():
    text = _text(DETECTION_TEMPLATE)
    required = [
        "# Detection Engineering Deliverable",
        "Finding ID",
        "Detection Objective",
        "Data Sources",
        "Log Source / Product",
        "Detection Logic",
        "Sigma",
        "Splunk SPL",
        "Elastic KQL",
        "Triage Steps",
        "False Positive Notes",
        "Validation Command or Replay",
        "Evidence Path",
        "Owner",
    ]
    for marker in required:
        assert marker in text


def test_reporting_requires_detection_deliverable_for_actionable_findings():
    text = _text(REPORTING)
    required = [
        "Detection Engineering Deliverable",
        "templates/detection-engineering.md",
        "data sources",
        "detection logic",
        "triage steps",
        "false positive notes",
        "validation command or replay",
        "Do not invent telemetry",
    ]
    for marker in required:
        assert marker in text


def test_report_template_has_detection_section_linking_to_findings():
    text = _text(TEMPLATE)
    required = [
        "## Detection Engineering",
        "Finding ID",
        "Detection Deliverable",
        "Data Sources",
        "Detection Status",
        "Validation Evidence",
        "False Positive Notes",
    ]
    for marker in required:
        assert marker in text