toggle('timeline')}>
diff --git a/tests/correlation/test_event_kinds.py b/tests/correlation/test_event_kinds.py
new file mode 100644
index 00000000..82084fc8
--- /dev/null
+++ b/tests/correlation/test_event_kinds.py
@@ -0,0 +1,91 @@
+"""Classifier unit tests for decnet.correlation.event_kinds."""
+from __future__ import annotations
+
+from decnet.correlation.event_kinds import (
+ INTERACTION_EVENT_TYPES,
+ NOISE_EVENT_TYPES,
+ bucket_services,
+ classify_event,
+)
+
+
+def test_shell_family_classifies_as_interaction():
+ for evt in ("command", "shell_input", "sql_query", "redis_command", "exec"):
+ assert classify_event(evt) == "interaction", evt
+
+
+def test_smtp_engagement_classifies_as_interaction():
+ for evt in ("mail_from", "rcpt_to", "message_accepted"):
+ assert classify_event(evt) == "interaction", evt
+
+
+def test_file_and_pubsub_classify_as_interaction():
+ for evt in ("file_captured", "upload", "retr", "publish", "subscribe"):
+ assert classify_event(evt) == "interaction", evt
+
+
+def test_noise_events_classify_as_noise():
+ for evt in ("startup", "shutdown", "parse_error", "unknown_command"):
+ assert classify_event(evt) == "noise", evt
+
+
+def test_scan_touch_events_classify_as_scan():
+ # These are common template verbs that don't cross into interaction
+ # and aren't on the noise list.
+ for evt in ("connection", "disconnect", "tls_client_hello", "auth_attempt",
+ "banner", "get_request", "head_request"):
+ assert classify_event(evt) == "scan", evt
+
+
+def test_unknown_event_defaults_to_scan():
+ # Conservative default: an unknown verb from a new template should
+ # show up as "scanned" rather than over-credited as interaction.
+ assert classify_event("some_future_verb") == "scan"
+ assert classify_event("") == "scan"
+
+
+def test_interaction_and_noise_sets_are_disjoint():
+ assert INTERACTION_EVENT_TYPES.isdisjoint(NOISE_EVENT_TYPES)
+
+
+def test_bucket_services_single_interaction_wins():
+ # If a service has both scan-level and interaction-level events,
+ # it counts as interacted (not scanned).
+ pairs = [
+ ("ssh", "connection"), # scan
+ ("ssh", "shell_input"), # interaction → wins
+ ]
+ assert bucket_services(pairs) == {"interacted": ["ssh"], "scanned": []}
+
+
+def test_bucket_services_noise_only_service_dropped():
+ pairs = [("bus", "startup"), ("bus", "shutdown")]
+ assert bucket_services(pairs) == {"interacted": [], "scanned": []}
+
+
+def test_bucket_services_mixed_realistic():
+ # Attacker A: scan-only on http + ssh.
+ # Attacker B (same test but for one attacker's pairs): mixed.
+ pairs = [
+ ("http", "connection"),
+ ("http", "get_request"),
+ ("ssh", "connection"),
+ ("ssh", "auth_attempt"),
+ ("ssh", "shell_input"), # promotes ssh to interacted
+ ("ftp", "retr"), # interaction
+ ("mongo", "connection"), # scan only
+ ]
+ result = bucket_services(pairs)
+ assert result["interacted"] == ["ftp", "ssh"]
+ assert result["scanned"] == ["http", "mongo"]
+
+
+def test_bucket_services_empty_input():
+ assert bucket_services([]) == {"interacted": [], "scanned": []}
+
+
+def test_bucket_services_returns_sorted_lists():
+ pairs = [("zzz", "command"), ("aaa", "command"), ("mmm", "connection")]
+ result = bucket_services(pairs)
+ assert result["interacted"] == ["aaa", "zzz"] # alphabetical
+ assert result["scanned"] == ["mmm"]
diff --git a/tests/web/test_api_attackers.py b/tests/web/test_api_attackers.py
index 5c385d0a..6fa7513d 100644
--- a/tests/web/test_api_attackers.py
+++ b/tests/web/test_api_attackers.py
@@ -183,6 +183,7 @@ class TestGetAttackerDetail:
with patch("decnet.web.router.attackers.api_get_attacker_detail.repo") as mock_repo:
mock_repo.get_attacker_by_uuid = AsyncMock(return_value=sample)
mock_repo.get_attacker_behavior = AsyncMock(return_value=None)
+ mock_repo.get_attacker_service_activity = AsyncMock(return_value=[])
result = await get_attacker_detail(uuid="att-uuid-1", user={"uuid": "test-user", "role": "viewer"})
@@ -211,6 +212,7 @@ class TestGetAttackerDetail:
with patch("decnet.web.router.attackers.api_get_attacker_detail.repo") as mock_repo:
mock_repo.get_attacker_by_uuid = AsyncMock(return_value=sample)
mock_repo.get_attacker_behavior = AsyncMock(return_value=None)
+ mock_repo.get_attacker_service_activity = AsyncMock(return_value=[])
result = await get_attacker_detail(uuid="att-uuid-1", user={"uuid": "test-user", "role": "viewer"})
@@ -219,6 +221,34 @@ class TestGetAttackerDetail:
assert isinstance(result["fingerprints"], list)
assert isinstance(result["commands"], list)
+ @pytest.mark.asyncio
+ async def test_service_activity_splits_scanned_vs_interacted(self):
+ """Attacker detail response buckets services by event-type signal."""
+ from decnet.web.router.attackers.api_get_attacker_detail import get_attacker_detail
+
+ sample = _sample_attacker()
+ pairs = [
+ ("ssh", "connection"),
+ ("ssh", "shell_input"), # promotes ssh to interacted
+ ("http", "get_request"), # scan only
+ ("ftp", "retr"), # interacted
+ ("bus", "startup"), # noise — dropped
+ ]
+ with patch("decnet.web.router.attackers.api_get_attacker_detail.repo") as mock_repo:
+ mock_repo.get_attacker_by_uuid = AsyncMock(return_value=sample)
+ mock_repo.get_attacker_behavior = AsyncMock(return_value=None)
+ mock_repo.get_attacker_service_activity = AsyncMock(return_value=pairs)
+
+ result = await get_attacker_detail(
+ uuid="att-uuid-1",
+ user={"uuid": "test-user", "role": "viewer"},
+ )
+
+ assert result["service_activity"] == {
+ "interacted": ["ftp", "ssh"],
+ "scanned": ["http"],
+ }
+
# ─── GET /attackers/{uuid}/commands ──────────────────────────────────────────