Dev

VERSION

@@ -1 +1 @@
-v2.3.4
+v2.3.5-dev

src/detector/plugins/domainator_attributor.py

@@ -113,7 +113,7 @@ def detect(self):
                 if not is_legitimate and winning_probability >= self.threshold:
                     logger.debug("Append malicious request domain to warning.")
                     warning = {
-                        "request": self.message_queues[message_domain],
+                        "request": self.message_queues[message_domain].copy(),
                         "probability": winning_probability,
                         "predicted_class": winning_label,
                         "attributes": y_pred_labelled,

src/detector/plugins/domainator_detector.py

@@ -90,7 +90,7 @@ def detect(self):
                 if np.argmax(y_pred, axis=1) == 1 and y_pred[0][1] > self.threshold:
                     logger.info("Append malicious request domain to warning.")
                     warning = {
-                        "request": self.message_queues[message_domain],
+                        "request": self.message_queues[message_domain].copy(),
                         "probability": float(y_pred[0][1]),
                         "name": self.name,
                         "sha256": self.checksum,

tests/detector/test_domainator_attributor.py

@@ -93,6 +93,41 @@ def test_detect(self):
             sut.detect()
             self.assertNotEqual([], sut.warnings)
 
+    def test_detect_snapshots_each_warning_request(self):
+        sut = self._create_detector()
+        sut.labels = ["benign", "tool-A"]
+        sut.messages = [
+            {
+                **DEFAULT_DATA,
+                "domain_name": f"subdomain-{index}.example.org",
+                "logline_id": str(index),
+            }
+            for index in range(5)
+        ]
+
+        with patch.object(
+            sut,
+            "predict",
+            return_value=np.array([[0.01, 0.99]]),
+        ):
+            sut.detect()
+
+        self.assertEqual(
+            [
+                ["0", "1", "2"],
+                ["0", "1", "2", "3"],
+                ["0", "1", "2", "3", "4"],
+            ],
+            [
+                [message["logline_id"] for message in warning["request"]]
+                for warning in sut.warnings
+            ],
+        )
+        self.assertEqual(
+            ["1", "2", "3", "4"],
+            [message["logline_id"] for message in sut.message_queues["example"]],
+        )
+
     def test_detect_emits_for_attribution_class_other_than_index_one(self):
         mock_kafka = MagicMock()
         mock_ch = MagicMock()

tests/detector/test_domainator_detector.py

@@ -92,6 +92,40 @@ def test_detect(self):
             sut.detect()
             self.assertNotEqual([], sut.warnings)
 
+    def test_detect_snapshots_each_warning_request(self):
+        sut = self._create_detector()
+        sut.messages = [
+            {
+                **DEFAULT_DATA,
+                "domain_name": f"subdomain-{index}.example.org",
+                "logline_id": str(index),
+            }
+            for index in range(5)
+        ]
+
+        with patch.object(
+            sut,
+            "predict",
+            return_value=np.array([[0.01, 0.99]]),
+        ):
+            sut.detect()
+
+        self.assertEqual(
+            [
+                ["0", "1", "2"],
+                ["0", "1", "2", "3"],
+                ["0", "1", "2", "3", "4"],
+            ],
+            [
+                [message["logline_id"] for message in warning["request"]]
+                for warning in sut.warnings
+            ],
+        )
+        self.assertEqual(
+            ["1", "2", "3", "4"],
+            [message["logline_id"] for message in sut.message_queues["example"]],
+        )
+
     def test_predict_calls_model(self):
         """Test that predict method correctly uses the model with features."""
         mock_kafka = MagicMock()