@oneuptime/common 12.0.14 → 12.0.16

package/Tests/Types/Monitor/MonitorStepSecurityEventsMonitor.test.ts

@@ -0,0 +1,201 @@
+import MonitorStepSecurityEventsMonitor, {
+  MonitorStepSecurityEventsMonitorUtil,
+} from "../../../Types/Monitor/MonitorStepSecurityEventsMonitor";
+import SecurityEvent from "../../../Models/AnalyticsModels/SecurityEvent";
+import InBetween from "../../../Types/BaseDatabase/InBetween";
+import Includes from "../../../Types/BaseDatabase/Includes";
+import Query from "../../../Types/BaseDatabase/Query";
+import Search from "../../../Types/BaseDatabase/Search";
+import OcsfSeverity from "../../../Types/SecurityEvent/OcsfSeverity";
+import ObjectID from "../../../Types/ObjectID";
+import { JSONObject } from "../../../Types/JSON";
+import { describe, expect, test } from "@jest/globals";
+
+/*
+ * MonitorStepSecurityEventsMonitor is the security-events monitor step
+ * config: what the UI stores, what round-trips through MonitorStep JSON,
+ * and what toQuery turns into the SecurityEvent table filter the worker
+ * runs. These tests pin the default shape, the config -> query mapping
+ * (each populated field becomes exactly one filter, empty ones none), and
+ * the toJSON/fromJSON round-trip that must preserve ObjectIDs.
+ */
+
+const SERVICE_ID_A: ObjectID = new ObjectID(
+  "11111111-1111-4111-8111-111111111111",
+);
+const SERVICE_ID_B: ObjectID = new ObjectID(
+  "22222222-2222-4222-8222-222222222222",
+);
+
+function buildConfig(
+  overrides: Partial<MonitorStepSecurityEventsMonitor> = {},
+): MonitorStepSecurityEventsMonitor {
+  return {
+    ...MonitorStepSecurityEventsMonitorUtil.getDefault(),
+    ...overrides,
+  };
+}
+
+describe("MonitorStepSecurityEventsMonitorUtil.getDefault", () => {
+  test("returns the empty config with a 60-second window", () => {
+    expect(MonitorStepSecurityEventsMonitorUtil.getDefault()).toEqual({
+      attributes: {},
+      messageContains: "",
+      severityNames: [],
+      classNames: [],
+      telemetryServiceIds: [],
+      lastXSecondsOfEvents: 60,
+    });
+  });
+});
+
+describe("MonitorStepSecurityEventsMonitorUtil.toQuery", () => {
+  test("an empty config produces only the time window filter", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(buildConfig());
+
+    expect(Object.keys(query)).toEqual(["time"]);
+
+    const time: InBetween<Date> = query.time as InBetween<Date>;
+    expect(time).toBeInstanceOf(InBetween);
+    expect(time.endValue.getTime() - time.startValue.getTime()).toBe(60 * 1000);
+  });
+
+  test("lastXSecondsOfEvents drives the InBetween window size", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(
+        buildConfig({ lastXSecondsOfEvents: 300 }),
+      );
+
+    const time: InBetween<Date> = query.time as InBetween<Date>;
+    expect(time.endValue.getTime() - time.startValue.getTime()).toBe(
+      300 * 1000,
+    );
+  });
+
+  test("a zero-second window produces no filters at all", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(
+        buildConfig({ lastXSecondsOfEvents: 0 }),
+      );
+
+    expect(query).toEqual({});
+  });
+
+  test("severityNames become an Includes filter on severityName", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(
+        buildConfig({
+          severityNames: [OcsfSeverity.High, OcsfSeverity.Critical],
+        }),
+      );
+
+    const filter: Includes = query.severityName as Includes;
+    expect(filter).toBeInstanceOf(Includes);
+    expect(filter.values).toEqual([OcsfSeverity.High, OcsfSeverity.Critical]);
+  });
+
+  test("classNames become an Includes filter on className", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(
+        buildConfig({ classNames: ["Authentication", "Process Activity"] }),
+      );
+
+    const filter: Includes = query.className as Includes;
+    expect(filter).toBeInstanceOf(Includes);
+    expect(filter.values).toEqual(["Authentication", "Process Activity"]);
+  });
+
+  test("messageContains becomes a Search filter on message", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(
+        buildConfig({ messageContains: "failed login" }),
+      );
+
+    const filter: Search<string> = query.message as Search<string>;
+    expect(filter).toBeInstanceOf(Search);
+    expect(filter.toString()).toBe("failed login");
+  });
+
+  test("telemetryServiceIds become an Includes filter on primaryEntityId", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(
+        buildConfig({ telemetryServiceIds: [SERVICE_ID_A, SERVICE_ID_B] }),
+      );
+
+    const filter: Includes = query.primaryEntityId as Includes;
+    expect(filter).toBeInstanceOf(Includes);
+    expect(filter.values).toEqual([SERVICE_ID_A, SERVICE_ID_B]);
+  });
+
+  test("attributes pass through as-is", () => {
+    const attributes: MonitorStepSecurityEventsMonitor["attributes"] = {
+      env: "prod",
+      attempts: 3,
+      blocked: true,
+    };
+
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(buildConfig({ attributes }));
+
+    expect(query.attributes).toEqual(attributes);
+  });
+
+  test("empty attributes add no filter", () => {
+    const query: Query<SecurityEvent> =
+      MonitorStepSecurityEventsMonitorUtil.toQuery(
+        buildConfig({ lastXSecondsOfEvents: 0, attributes: {} }),
+      );
+
+    expect(query.attributes).toBeUndefined();
+  });
+});
+
+describe("MonitorStepSecurityEventsMonitorUtil toJSON/fromJSON", () => {
+  test("round-trips every field and revives ObjectIDs", () => {
+    const config: MonitorStepSecurityEventsMonitor = {
+      attributes: { env: "prod", attempts: 3, blocked: true },
+      messageContains: "failed login",
+      severityNames: [OcsfSeverity.High, OcsfSeverity.Critical],
+      classNames: ["Authentication"],
+      telemetryServiceIds: [SERVICE_ID_A, SERVICE_ID_B],
+      lastXSecondsOfEvents: 300,
+    };
+
+    const json: JSONObject =
+      MonitorStepSecurityEventsMonitorUtil.toJSON(config);
+    const roundTripped: MonitorStepSecurityEventsMonitor =
+      MonitorStepSecurityEventsMonitorUtil.fromJSON(json);
+
+    expect(roundTripped.attributes).toEqual(config.attributes);
+    expect(roundTripped.messageContains).toBe("failed login");
+    expect(roundTripped.severityNames).toEqual([
+      OcsfSeverity.High,
+      OcsfSeverity.Critical,
+    ]);
+    expect(roundTripped.classNames).toEqual(["Authentication"]);
+    expect(roundTripped.lastXSecondsOfEvents).toBe(300);
+
+    expect(roundTripped.telemetryServiceIds).toHaveLength(2);
+    for (const serviceId of roundTripped.telemetryServiceIds) {
+      expect(serviceId).toBeInstanceOf(ObjectID);
+    }
+    expect(
+      roundTripped.telemetryServiceIds.map((serviceId: ObjectID): string => {
+        return serviceId.toString();
+      }),
+    ).toEqual([SERVICE_ID_A.toString(), SERVICE_ID_B.toString()]);
+  });
+
+  test("the default config round-trips to itself", () => {
+    const config: MonitorStepSecurityEventsMonitor =
+      MonitorStepSecurityEventsMonitorUtil.getDefault();
+
+    const roundTripped: MonitorStepSecurityEventsMonitor =
+      MonitorStepSecurityEventsMonitorUtil.fromJSON(
+        MonitorStepSecurityEventsMonitorUtil.toJSON(config),
+      );
+
+    expect(roundTripped).toEqual(config);
+  });
+});

package/Tests/Types/NetworkDevice/NetworkDeviceLinkRuleScope.test.ts

@@ -0,0 +1,215 @@
+import NetworkDeviceLinkRuleScope, {
+  NetworkDeviceLinkRuleScopeUtil,
+} from "../../../Types/NetworkDevice/NetworkDeviceLinkRuleScope";
+
+/*
+ * `scope` was added to a table that already had rules in it, so every rule
+ * written before the column existed holds NULL — and each of those rules is
+ * currently drawing a topology somebody has already looked at and trusted.
+ * NULL therefore has to read as Project, because Project is exactly what
+ * those rules have always meant: one parent across whatever device set the
+ * query handed the resolver. Read NULL as Site instead and every legacy rule
+ * quietly starts asking a different question, re-pointing cables on maps
+ * nobody re-opened. That is why the default lives in `parse` rather than in a
+ * `=== "Site"` comparison scattered over the call sites: one place to be
+ * right, and it is pinned here.
+ *
+ * The mirror of the same worry is the unrecognised value. The column is free
+ * text (the NetworkDeviceMonitoringMethod precedent), so a typo, an older
+ * client, or a future scope name that this build has never heard of can all
+ * land in it. Every one of them has to fall back to the behaviour that was
+ * already on screen rather than to the new one.
+ */
+describe("NetworkDeviceLinkRuleScope enum", () => {
+  /*
+   * These strings are persisted values, not display labels. Renaming one is
+   * a silent data migration: every row already holding the old spelling stops
+   * being recognised and — by the fallback above — quietly reverts to
+   * Project, with no error anywhere to say so. Change these only alongside a
+   * migration that rewrites the column.
+   */
+  test("Project is persisted as the string Project", () => {
+    expect(NetworkDeviceLinkRuleScope.Project).toBe("Project");
+  });
+
+  test("Site is persisted as the string Site", () => {
+    expect(NetworkDeviceLinkRuleScope.Site).toBe("Site");
+  });
+
+  test("has exactly the two known scopes", () => {
+    expect(Object.values(NetworkDeviceLinkRuleScope).sort()).toEqual([
+      "Project",
+      "Site",
+    ]);
+  });
+});
+
+/*
+ * One table, two consumers. `parse` and `isSiteScoped` are asserted against
+ * the same rows further down so the pair cannot drift apart: a caller that
+ * branches on `isSiteScoped` and a caller that switches on `parse` must never
+ * disagree about the same stored string.
+ */
+const PROJECT_INPUTS: Array<string | null | undefined> = [
+  // The pre-column rows, and the shapes an empty form field arrives as.
+  undefined,
+  null,
+  "",
+  "  ",
+  // The value written by anything that does set the column explicitly.
+  "Project",
+  "project",
+  "PROJECT",
+  " Project ",
+  /*
+   * Near-misses that must NOT be read as site scope. "Sites" and
+   * "site-scoped" are the plausible typo and the plausible rename; matching
+   * them loosely would turn a mistyped rule into one that silently redraws.
+   */
+  "Sites",
+  "site-scoped",
+  "anything",
+  // Falsy-looking text is still just unrecognised text, not a flag.
+  "0",
+  "false",
+];
+
+const SITE_INPUTS: Array<string> = [
+  "Site",
+  "site",
+  "SITE",
+  " site ",
+  "  SiTe  ",
+];
+
+interface ScopeCase {
+  value: string | null | undefined;
+  expected: NetworkDeviceLinkRuleScope;
+}
+
+const ALL_CASES: Array<ScopeCase> = [
+  ...PROJECT_INPUTS.map((value: string | null | undefined): ScopeCase => {
+    return { value: value, expected: NetworkDeviceLinkRuleScope.Project };
+  }),
+  ...SITE_INPUTS.map((value: string): ScopeCase => {
+    return { value: value, expected: NetworkDeviceLinkRuleScope.Site };
+  }),
+];
+
+describe("NetworkDeviceLinkRuleScopeUtil.parse", () => {
+  test.each(PROJECT_INPUTS)(
+    "reads %p as Project",
+    (value: string | null | undefined) => {
+      expect(NetworkDeviceLinkRuleScopeUtil.parse(value)).toBe(
+        NetworkDeviceLinkRuleScope.Project,
+      );
+    },
+  );
+
+  test.each(SITE_INPUTS)(
+    "reads %p as Site, case- and whitespace-insensitively",
+    (value: string) => {
+      expect(NetworkDeviceLinkRuleScopeUtil.parse(value)).toBe(
+        NetworkDeviceLinkRuleScope.Site,
+      );
+    },
+  );
+
+  /*
+   * Only an exact (trimmed, lowercased) "site" opts in. Substring matching
+   * would make "not site" or "site (deprecated)" flip the rule's meaning,
+   * which is the one direction of mistake this type refuses to make.
+   */
+  test("does not treat a string merely containing 'site' as site-scoped", () => {
+    expect(NetworkDeviceLinkRuleScopeUtil.parse("per site")).toBe(
+      NetworkDeviceLinkRuleScope.Project,
+    );
+    expect(NetworkDeviceLinkRuleScopeUtil.parse("not site")).toBe(
+      NetworkDeviceLinkRuleScope.Project,
+    );
+  });
+
+  /*
+   * The return value is always one of the two enum members — never the raw
+   * column text passed straight back. Callers switch on it, and a passthrough
+   * would send an unrecognised spelling into a branch that does not exist.
+   */
+  test("returns an enum member for every case in the table, never the raw input", () => {
+    for (const testCase of ALL_CASES) {
+      const parsed: NetworkDeviceLinkRuleScope =
+        NetworkDeviceLinkRuleScopeUtil.parse(testCase.value);
+
+      expect(Object.values(NetworkDeviceLinkRuleScope)).toContain(parsed);
+    }
+  });
+
+  /*
+   * The parser sits in the middle of rendering a topology map: throwing here
+   * would take out the whole map over one bad cell, when the safe answer
+   * (Project, what the rule drew yesterday) is right there. So nothing in the
+   * declared signature may throw — and neither may the falsy non-string
+   * shapes a loosely typed caller or a hand-rolled JSON body can smuggle past
+   * TypeScript, which the `|| ""` guard absorbs.
+   */
+  test("never throws for any value in or near its declared signature", () => {
+    const inputs: Array<string | null | undefined> = [
+      ...ALL_CASES.map((testCase: ScopeCase): string | null | undefined => {
+        return testCase.value;
+      }),
+      "\tSITE\n",
+      "\n  project  \t",
+      "Site\u0000",
+      "🙂",
+    ];
+
+    for (const input of inputs) {
+      expect((): NetworkDeviceLinkRuleScope => {
+        return NetworkDeviceLinkRuleScopeUtil.parse(input);
+      }).not.toThrow();
+    }
+
+    /*
+     * Not strings at all. 0/false/NaN are what a JSON body or a permissive
+     * ORM can hand over in place of "no scope set", and they have to land on
+     * the same safe default rather than blow up.
+     */
+    const nonStrings: Array<unknown> = [0, false, NaN];
+
+    for (const input of nonStrings) {
+      expect(
+        NetworkDeviceLinkRuleScopeUtil.parse(input as unknown as string),
+      ).toBe(NetworkDeviceLinkRuleScope.Project);
+    }
+  });
+});
+
+describe("NetworkDeviceLinkRuleScopeUtil.isSiteScoped", () => {
+  test.each(SITE_INPUTS)("is true for %p", (value: string) => {
+    expect(NetworkDeviceLinkRuleScopeUtil.isSiteScoped(value)).toBe(true);
+  });
+
+  test.each(PROJECT_INPUTS)(
+    "is false for %p",
+    (value: string | null | undefined) => {
+      expect(NetworkDeviceLinkRuleScopeUtil.isSiteScoped(value)).toBe(false);
+    },
+  );
+
+  /*
+   * The two entry points are asserted against the same table in the same
+   * loop, so neither can be extended (a new alias, a new scope) without the
+   * other. `NetworkDeviceLinkRuleUtil` branches on `isSiteScoped` while the
+   * dashboard's rule list renders off it too — if they ever disagreed, a rule
+   * would be labelled one way and resolved the other.
+   */
+  test("agrees with parse on every case in the table", () => {
+    for (const testCase of ALL_CASES) {
+      expect(NetworkDeviceLinkRuleScopeUtil.parse(testCase.value)).toBe(
+        testCase.expected,
+      );
+      expect(NetworkDeviceLinkRuleScopeUtil.isSiteScoped(testCase.value)).toBe(
+        testCase.expected === NetworkDeviceLinkRuleScope.Site,
+      );
+    }
+  });
+});

package/Tests/Types/SecurityEvent/OcsfEventClass.test.ts

@@ -0,0 +1,105 @@
+import { describe, expect, test } from "@jest/globals";
+import {
+  OcsfCategory,
+  OcsfCategoryId,
+  OcsfEventClassProps,
+  OcsfEventClasses,
+  ocsfCategoryForClassUid,
+  ocsfEventClassByUid,
+} from "../../../Types/SecurityEvent/OcsfEventClass";
+
+/*
+ * Every normalizer stamps classUid/className/categoryUid/categoryName from
+ * this table, and the SIEM UI groups events by those columns. Two things
+ * must never regress: a class uid always lands in the category OCSF says it
+ * belongs to (floor(uid/1000), except extension classes like 201001 which
+ * are curated by hand), and an unknown uid degrades to a sensible category
+ * instead of being dropped — the schema grows faster than our curated
+ * subset, so "unknown class" is an expected steady state, not an error.
+ */
+describe("OcsfEventClass", () => {
+  describe("ocsfEventClassByUid", () => {
+    test.each<[number, string, OcsfCategory]>([
+      [0, "Base Event", OcsfCategory.Uncategorized],
+      [1007, "Process Activity", OcsfCategory.SystemActivity],
+      [2004, "Detection Finding", OcsfCategory.Findings],
+      [3002, "Authentication", OcsfCategory.IdentityAndAccessManagement],
+      [4003, "DNS Activity", OcsfCategory.NetworkActivity],
+      [5002, "Device Config State", OcsfCategory.Discovery],
+      [6003, "API Activity", OcsfCategory.ApplicationActivity],
+      [201001, "Registry Key Activity", OcsfCategory.SystemActivity],
+    ])(
+      "uid %i -> %s in %s",
+      (uid: number, name: string, category: OcsfCategory) => {
+        const cls: OcsfEventClassProps | undefined = ocsfEventClassByUid(uid);
+
+        expect(cls).toBeDefined();
+        expect(cls?.name).toBe(name);
+        expect(cls?.category).toBe(category);
+      },
+    );
+
+    test.each<[number]>([[1234], [3999], [99999], [-1]])(
+      "unknown uid %i -> undefined",
+      (uid: number) => {
+        expect(ocsfEventClassByUid(uid)).toBeUndefined();
+      },
+    );
+  });
+
+  describe("ocsfCategoryForClassUid", () => {
+    test("known class uses its curated category", () => {
+      expect(ocsfCategoryForClassUid(3002)).toEqual({
+        categoryUid: 3,
+        categoryName: "Identity & Access Management",
+      });
+    });
+
+    test("unknown uid in a known category range derives the category", () => {
+      expect(ocsfCategoryForClassUid(4999)).toEqual({
+        categoryUid: 4,
+        categoryName: "Network Activity",
+      });
+
+      expect(ocsfCategoryForClassUid(2999)).toEqual({
+        categoryUid: 2,
+        categoryName: "Findings",
+      });
+    });
+
+    test("unknown uid outside every category range -> Uncategorized", () => {
+      expect(ocsfCategoryForClassUid(9999)).toEqual({
+        categoryUid: 0,
+        categoryName: "Uncategorized",
+      });
+    });
+
+    test("uid 0 (Base Event) -> Uncategorized, not a derived guess", () => {
+      expect(ocsfCategoryForClassUid(0)).toEqual({
+        categoryUid: 0,
+        categoryName: "Uncategorized",
+      });
+    });
+
+    /*
+     * The Windows extension class does NOT follow floor(uid/1000): 201001
+     * would derive to nothing sensible, so the curated entry must win and
+     * put registry events under System Activity.
+     */
+    test("windows extension class 201001 -> System Activity", () => {
+      expect(ocsfCategoryForClassUid(201001)).toEqual({
+        categoryUid: 1,
+        categoryName: "System Activity",
+      });
+    });
+
+    test("every curated class resolves to its own category", () => {
+      for (const cls of OcsfEventClasses) {
+        expect(ocsfCategoryForClassUid(cls.uid)).toEqual({
+          categoryUid: OcsfCategoryId[cls.category],
+          categoryName: cls.category,
+        });
+      }
+    });
+  });
+});

package/Tests/Types/SecurityEvent/OcsfSeverity.test.ts

@@ -0,0 +1,111 @@
+import { describe, expect, test } from "@jest/globals";
+import OcsfSeverity, {
+  OcsfSeverityId,
+  normalizeOcsfSeverity,
+  ocsfSeverityFromId,
+} from "../../../Types/SecurityEvent/OcsfSeverity";
+
+/*
+ * A SecurityEvent row stores severity twice: as text (severityName) and as a
+ * number (severityId), and every writer promises the pair agrees. Filters
+ * compare against the numeric id while the UI shows the text, so a drifting
+ * map would make a row claim "Critical" while filtering as something else and
+ * nobody would see an error. These tests pin the id map, the id -> name
+ * reverse lookup, and the alias table that grades foreign dialect severities
+ * (UDM security_result, syslog levels) — the exact strings the normalizers
+ * depend on to grade events consistently.
+ */
+describe("OcsfSeverity", () => {
+  describe("OcsfSeverityId matches the OCSF severity_id values", () => {
+    test.each<[OcsfSeverity, number]>([
+      [OcsfSeverity.Unknown, 0],
+      [OcsfSeverity.Informational, 1],
+      [OcsfSeverity.Low, 2],
+      [OcsfSeverity.Medium, 3],
+      [OcsfSeverity.High, 4],
+      [OcsfSeverity.Critical, 5],
+      [OcsfSeverity.Fatal, 6],
+      [OcsfSeverity.Other, 99],
+    ])("%s -> %i", (severity: OcsfSeverity, expected: number) => {
+      expect(OcsfSeverityId[severity]).toBe(expected);
+    });
+
+    test("every enum member has an id", () => {
+      for (const severity of Object.values(OcsfSeverity)) {
+        expect(OcsfSeverityId[severity]).toBeDefined();
+      }
+    });
+  });
+
+  describe("ocsfSeverityFromId reverses the id map", () => {
+    test("round-trips every enum member", () => {
+      for (const severity of Object.values(OcsfSeverity)) {
+        expect(ocsfSeverityFromId(OcsfSeverityId[severity])).toBe(severity);
+      }
+    });
+
+    test.each<[number]>([[7], [42], [-1], [100], [98]])(
+      "unknown id %i -> Unknown",
+      (id: number) => {
+        expect(ocsfSeverityFromId(id)).toBe(OcsfSeverity.Unknown);
+      },
+    );
+  });
+
+  describe("normalizeOcsfSeverity grades the dialects we ingest", () => {
+    // UDM security_result severities.
+    test.each<[string, OcsfSeverity]>([
+      ["EMERGENCY", OcsfSeverity.Fatal],
+      ["ALERT", OcsfSeverity.Critical],
+      ["CRITICAL", OcsfSeverity.Critical],
+      ["ERROR", OcsfSeverity.Medium],
+      ["HIGH", OcsfSeverity.High],
+      ["MEDIUM", OcsfSeverity.Medium],
+      ["LOW", OcsfSeverity.Low],
+      ["INFORMATIONAL", OcsfSeverity.Informational],
+      ["NONE", OcsfSeverity.Informational],
+      ["UNKNOWN_SEVERITY", OcsfSeverity.Unknown],
+      ["UNKNOWN", OcsfSeverity.Unknown],
+    ])("UDM %s -> %s", (input: string, expected: OcsfSeverity) => {
+      expect(normalizeOcsfSeverity(input)).toBe(expected);
+    });
+
+    /*
+     * Syslog levels. ERR is the interesting one: it is severity 3 in syslog
+     * but grades as OCSF Medium here, matching how ERROR is graded — the two
+     * spellings of the same level must not diverge.
+     */
+    test.each<[string, OcsfSeverity]>([
+      ["DEBUG", OcsfSeverity.Informational],
+      ["INFO", OcsfSeverity.Informational],
+      ["NOTICE", OcsfSeverity.Informational],
+      ["WARNING", OcsfSeverity.Low],
+      ["WARN", OcsfSeverity.Low],
+      ["ERR", OcsfSeverity.Medium],
+      ["CRIT", OcsfSeverity.Critical],
+    ])("syslog %s -> %s", (input: string, expected: OcsfSeverity) => {
+      expect(normalizeOcsfSeverity(input)).toBe(expected);
+    });
+
+    test.each<[string, OcsfSeverity]>([
+      ["high", OcsfSeverity.High],
+      ["Critical", OcsfSeverity.Critical],
+      ["  low  ", OcsfSeverity.Low],
+      ["moderate", OcsfSeverity.Medium],
+      ["severe", OcsfSeverity.High],
+      ["fatal", OcsfSeverity.Fatal],
+    ])(
+      "case-insensitive and trimmed: %s -> %s",
+      (input: string, expected: OcsfSeverity) => {
+        expect(normalizeOcsfSeverity(input)).toBe(expected);
+      },
+    );
+
+    test.each<[string]>([[""], ["   "], ["nonsense"], ["P1"], ["3"], ["Sev1"]])(
+      "unrecognised %s -> null rather than a guess",
+      (input: string) => {
+        expect(normalizeOcsfSeverity(input)).toBeNull();
+      },
+    );
+  });
+});