check-msdefender 1.1.0__tar.gz → 1.1.1__tar.gz

{check_msdefender-1.1.0 → check_msdefender-1.1.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: check-msdefender
-Version: 1.1.0
+Version: 1.1.1
 Summary: A Nagios plugin for monitoring Microsoft Defender API endpoints
 Author-email: ldvchosal <ldvchosal@github.com>
 License: MIT
@@ -46,7 +46,7 @@ A comprehensive **Nagios plugin** for monitoring Microsoft Defender for Endpoint
 ## ✨ Features
 
 - 🔐 **Dual Authentication** - Support for Client Secret and Certificate-based authentication
-- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, and machine details
+- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, alerts, and machine details
 - 📊 **Nagios Compatible** - Standard exit codes and performance data output
 - 🏗️ **Clean Architecture** - Modular design with testable components
 - 🔧 **Flexible Configuration** - File-based configuration with sensible defaults
@@ -78,6 +78,9 @@ check_msdefender lastseen -d machine.domain.tld -W 7 -C 30
 # Check vulnerabilities
 check_msdefender vulnerabilities -d machine.domain.tld -W 10 -C 100
 
+# Check alerts
+check_msdefender alerts -d machine.domain.tld -W 1 -C 5
+
 # List all machines
 check_msdefender machines
 
@@ -92,6 +95,7 @@ check_msdefender detail -d machine.domain.tld
 | `onboarding` | Check machine onboarding status | W:1, C:2 |
 | `lastseen` | Days since machine last seen | W:7, C:30 |
 | `vulnerabilities` | Vulnerability score calculation | W:10, C:100 |
+| `alerts` | Count of unresolved alerts | W:1, C:0 |
 | `machines` | List all machines | W:10, C:25 |
 | `detail` | Get detailed machine information | - |
 
@@ -103,6 +107,14 @@ The vulnerability score is calculated as:
 - **Medium vulnerabilities** × 5
 - **Low vulnerabilities** × 1
 
+### Alert Monitoring
+
+The alerts command monitors unresolved security alerts for a machine:
+- **Counts only unresolved alerts** (status ≠ "Resolved")
+- **Excludes informational alerts** when critical/warning alerts exist
+- **Shows alert details** including creation time, title, and severity
+- **Default thresholds**: Warning at 1 alert, Critical at 0 (meaning any alert triggers warning)
+
 ### Onboarding Status Values
 
 - `0` - Onboarded ✅
@@ -145,6 +157,7 @@ timeout = 5
    - `Machine.Read.All`
    - `Vulnerability.Read`
    - `Vulnerability.Read.All`
+   - `Alert.Read.All`
 3. **Create Authentication** (Secret or Certificate)
 4. **Note Credentials** (Client ID, Tenant ID, Secret/Certificate)
 
@@ -182,6 +195,11 @@ define command {
     command_name    check_defender_vulnerabilities
     command_line    $USER1$/check_msdefender/bin/check_msdefender vulnerabilities -d $HOSTALIAS$ -W 10 -C 100
 }
+
+define command {
+    command_name    check_defender_alerts
+    command_line    $USER1$/check_msdefender/bin/check_msdefender alerts -d $HOSTALIAS$ -W 1 -C 5
+}
 ```
 
 ### Service Definitions
@@ -208,6 +226,13 @@ define service {
     check_command           check_defender_vulnerabilities
     hostgroup_name          msdefender
 }
+
+define service {
+    use                     generic-service
+    service_description     DEFENDER_ALERTS
+    check_command           check_defender_alerts
+    hostgroup_name          msdefender
+}
 ```
 
 ## 🏗️ Architecture
@@ -221,6 +246,7 @@ check_msdefender/
 │   │   ├── onboarding.py      # Onboarding status command
 │   │   ├── lastseen.py        # Last seen command
 │   │   ├── vulnerabilities.py # Vulnerabilities command
+│   │   ├── alerts.py          # Alerts monitoring command
 │   │   ├── machines.py        # List machines command
 │   │   └── detail.py          # Machine detail command
 │   ├── decorators.py          # Common CLI decorators
@@ -236,6 +262,7 @@ check_msdefender/
 │   ├── onboarding_service.py  # Onboarding business logic
 │   ├── lastseen_service.py    # Last seen business logic
 │   ├── vulnerabilities_service.py # Vulnerability business logic
+│   ├── alerts_service.py      # Alerts monitoring business logic
 │   ├── machines_service.py    # Machines business logic
 │   ├── detail_service.py      # Detail business logic
 │   └── models.py              # Data models
@@ -317,6 +344,14 @@ DEFENDER WARNING - Last seen: 10 days ago | lastseen=10;7;30;0;
 DEFENDER CRITICAL - Vulnerability score: 150 (1 Critical, 5 High) | vulnerabilities=150;10;100;0;
 ```
 
+### Alerts Warning
+```
+DEFENDER WARNING - Unresolved alerts for machine.domain.com | alerts=2;1;5;0;
+Unresolved alerts for machine.domain.com
+2025-09-14T10:22:14.12Z - Suspicious activity detected (New high)
+2025-09-14T12:00:00.00Z - Malware detection (InProgress medium)
+```
+
 ## 🔧 Troubleshooting
 
 ### Common Issues

{check_msdefender-1.1.0 → check_msdefender-1.1.1}/README.md

@@ -9,7 +9,7 @@ A comprehensive **Nagios plugin** for monitoring Microsoft Defender for Endpoint
 ## ✨ Features
 
 - 🔐 **Dual Authentication** - Support for Client Secret and Certificate-based authentication
-- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, and machine details
+- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, alerts, and machine details
 - 📊 **Nagios Compatible** - Standard exit codes and performance data output
 - 🏗️ **Clean Architecture** - Modular design with testable components
 - 🔧 **Flexible Configuration** - File-based configuration with sensible defaults
@@ -41,6 +41,9 @@ check_msdefender lastseen -d machine.domain.tld -W 7 -C 30
 # Check vulnerabilities
 check_msdefender vulnerabilities -d machine.domain.tld -W 10 -C 100
 
+# Check alerts
+check_msdefender alerts -d machine.domain.tld -W 1 -C 5
+
 # List all machines
 check_msdefender machines
 
@@ -55,6 +58,7 @@ check_msdefender detail -d machine.domain.tld
 | `onboarding` | Check machine onboarding status | W:1, C:2 |
 | `lastseen` | Days since machine last seen | W:7, C:30 |
 | `vulnerabilities` | Vulnerability score calculation | W:10, C:100 |
+| `alerts` | Count of unresolved alerts | W:1, C:0 |
 | `machines` | List all machines | W:10, C:25 |
 | `detail` | Get detailed machine information | - |
 
@@ -66,6 +70,14 @@ The vulnerability score is calculated as:
 - **Medium vulnerabilities** × 5
 - **Low vulnerabilities** × 1
 
+### Alert Monitoring
+
+The alerts command monitors unresolved security alerts for a machine:
+- **Counts only unresolved alerts** (status ≠ "Resolved")
+- **Excludes informational alerts** when critical/warning alerts exist
+- **Shows alert details** including creation time, title, and severity
+- **Default thresholds**: Warning at 1 alert, Critical at 0 (meaning any alert triggers warning)
+
 ### Onboarding Status Values
 
 - `0` - Onboarded ✅
@@ -108,6 +120,7 @@ timeout = 5
    - `Machine.Read.All`
    - `Vulnerability.Read`
    - `Vulnerability.Read.All`
+   - `Alert.Read.All`
 3. **Create Authentication** (Secret or Certificate)
 4. **Note Credentials** (Client ID, Tenant ID, Secret/Certificate)
 
@@ -145,6 +158,11 @@ define command {
     command_name    check_defender_vulnerabilities
     command_line    $USER1$/check_msdefender/bin/check_msdefender vulnerabilities -d $HOSTALIAS$ -W 10 -C 100
 }
+
+define command {
+    command_name    check_defender_alerts
+    command_line    $USER1$/check_msdefender/bin/check_msdefender alerts -d $HOSTALIAS$ -W 1 -C 5
+}
 ```
 
 ### Service Definitions
@@ -171,6 +189,13 @@ define service {
     check_command           check_defender_vulnerabilities
     hostgroup_name          msdefender
 }
+
+define service {
+    use                     generic-service
+    service_description     DEFENDER_ALERTS
+    check_command           check_defender_alerts
+    hostgroup_name          msdefender
+}
 ```
 
 ## 🏗️ Architecture
@@ -184,6 +209,7 @@ check_msdefender/
 │   │   ├── onboarding.py      # Onboarding status command
 │   │   ├── lastseen.py        # Last seen command
 │   │   ├── vulnerabilities.py # Vulnerabilities command
+│   │   ├── alerts.py          # Alerts monitoring command
 │   │   ├── machines.py        # List machines command
 │   │   └── detail.py          # Machine detail command
 │   ├── decorators.py          # Common CLI decorators
@@ -199,6 +225,7 @@ check_msdefender/
 │   ├── onboarding_service.py  # Onboarding business logic
 │   ├── lastseen_service.py    # Last seen business logic
 │   ├── vulnerabilities_service.py # Vulnerability business logic
+│   ├── alerts_service.py      # Alerts monitoring business logic
 │   ├── machines_service.py    # Machines business logic
 │   ├── detail_service.py      # Detail business logic
 │   └── models.py              # Data models
@@ -280,6 +307,14 @@ DEFENDER WARNING - Last seen: 10 days ago | lastseen=10;7;30;0;
 DEFENDER CRITICAL - Vulnerability score: 150 (1 Critical, 5 High) | vulnerabilities=150;10;100;0;
 ```
 
+### Alerts Warning
+```
+DEFENDER WARNING - Unresolved alerts for machine.domain.com | alerts=2;1;5;0;
+Unresolved alerts for machine.domain.com
+2025-09-14T10:22:14.12Z - Suspicious activity detected (New high)
+2025-09-14T12:00:00.00Z - Malware detection (InProgress medium)
+```
+
 ## 🔧 Troubleshooting
 
 ### Common Issues

{check_msdefender-1.1.0 → check_msdefender-1.1.1}/check_msdefender.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: check-msdefender
-Version: 1.1.0
+Version: 1.1.1
 Summary: A Nagios plugin for monitoring Microsoft Defender API endpoints
 Author-email: ldvchosal <ldvchosal@github.com>
 License: MIT
@@ -46,7 +46,7 @@ A comprehensive **Nagios plugin** for monitoring Microsoft Defender for Endpoint
 ## ✨ Features
 
 - 🔐 **Dual Authentication** - Support for Client Secret and Certificate-based authentication
-- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, and machine details
+- 🎯 **Multiple Endpoints** - Monitor onboarding status, last seen, vulnerabilities, alerts, and machine details
 - 📊 **Nagios Compatible** - Standard exit codes and performance data output
 - 🏗️ **Clean Architecture** - Modular design with testable components
 - 🔧 **Flexible Configuration** - File-based configuration with sensible defaults
@@ -78,6 +78,9 @@ check_msdefender lastseen -d machine.domain.tld -W 7 -C 30
 # Check vulnerabilities
 check_msdefender vulnerabilities -d machine.domain.tld -W 10 -C 100
 
+# Check alerts
+check_msdefender alerts -d machine.domain.tld -W 1 -C 5
+
 # List all machines
 check_msdefender machines
 
@@ -92,6 +95,7 @@ check_msdefender detail -d machine.domain.tld
 | `onboarding` | Check machine onboarding status | W:1, C:2 |
 | `lastseen` | Days since machine last seen | W:7, C:30 |
 | `vulnerabilities` | Vulnerability score calculation | W:10, C:100 |
+| `alerts` | Count of unresolved alerts | W:1, C:0 |
 | `machines` | List all machines | W:10, C:25 |
 | `detail` | Get detailed machine information | - |
 
@@ -103,6 +107,14 @@ The vulnerability score is calculated as:
 - **Medium vulnerabilities** × 5
 - **Low vulnerabilities** × 1
 
+### Alert Monitoring
+
+The alerts command monitors unresolved security alerts for a machine:
+- **Counts only unresolved alerts** (status ≠ "Resolved")
+- **Excludes informational alerts** when critical/warning alerts exist
+- **Shows alert details** including creation time, title, and severity
+- **Default thresholds**: Warning at 1 alert, Critical at 0 (meaning any alert triggers warning)
+
 ### Onboarding Status Values
 
 - `0` - Onboarded ✅
@@ -145,6 +157,7 @@ timeout = 5
    - `Machine.Read.All`
    - `Vulnerability.Read`
    - `Vulnerability.Read.All`
+   - `Alert.Read.All`
 3. **Create Authentication** (Secret or Certificate)
 4. **Note Credentials** (Client ID, Tenant ID, Secret/Certificate)
 
@@ -182,6 +195,11 @@ define command {
     command_name    check_defender_vulnerabilities
     command_line    $USER1$/check_msdefender/bin/check_msdefender vulnerabilities -d $HOSTALIAS$ -W 10 -C 100
 }
+
+define command {
+    command_name    check_defender_alerts
+    command_line    $USER1$/check_msdefender/bin/check_msdefender alerts -d $HOSTALIAS$ -W 1 -C 5
+}
 ```
 
 ### Service Definitions
@@ -208,6 +226,13 @@ define service {
     check_command           check_defender_vulnerabilities
     hostgroup_name          msdefender
 }
+
+define service {
+    use                     generic-service
+    service_description     DEFENDER_ALERTS
+    check_command           check_defender_alerts
+    hostgroup_name          msdefender
+}
 ```
 
 ## 🏗️ Architecture
@@ -221,6 +246,7 @@ check_msdefender/
 │   │   ├── onboarding.py      # Onboarding status command
 │   │   ├── lastseen.py        # Last seen command
 │   │   ├── vulnerabilities.py # Vulnerabilities command
+│   │   ├── alerts.py          # Alerts monitoring command
 │   │   ├── machines.py        # List machines command
 │   │   └── detail.py          # Machine detail command
 │   ├── decorators.py          # Common CLI decorators
@@ -236,6 +262,7 @@ check_msdefender/
 │   ├── onboarding_service.py  # Onboarding business logic
 │   ├── lastseen_service.py    # Last seen business logic
 │   ├── vulnerabilities_service.py # Vulnerability business logic
+│   ├── alerts_service.py      # Alerts monitoring business logic
 │   ├── machines_service.py    # Machines business logic
 │   ├── detail_service.py      # Detail business logic
 │   └── models.py              # Data models
@@ -317,6 +344,14 @@ DEFENDER WARNING - Last seen: 10 days ago | lastseen=10;7;30;0;
 DEFENDER CRITICAL - Vulnerability score: 150 (1 Critical, 5 High) | vulnerabilities=150;10;100;0;
 ```
 
+### Alerts Warning
+```
+DEFENDER WARNING - Unresolved alerts for machine.domain.com | alerts=2;1;5;0;
+Unresolved alerts for machine.domain.com
+2025-09-14T10:22:14.12Z - Suspicious activity detected (New high)
+2025-09-14T12:00:00.00Z - Malware detection (InProgress medium)
+```
+
 ## 🔧 Troubleshooting
 
 ### Common Issues

{check_msdefender-1.1.0 → check_msdefender-1.1.1}/check_msdefender.egg-info/SOURCES.txt

@@ -71,8 +71,10 @@ doc/Feat-Pypi-Package.md
 doc/Feat-Verbose.md
 tests/__init__.py
 tests/fixtures/__init__.py
+tests/fixtures/alerts_data.json
 tests/fixtures/machine_data.json
 tests/fixtures/mock_defender_client.py
+tests/fixtures/test_alerts_service.py
 tests/fixtures/test_detail_service.py
 tests/fixtures/test_lastseen_service.py
 tests/fixtures/test_onboarding_service.py
@@ -82,4 +84,5 @@ tests/integration/__init__.py
 tests/integration/test_cli_integration.py
 tests/integration/test_lastseen_integration.py
 tests/unit/__init__.py
+tests/unit/test_alerts_service.py
 tests/unit/test_detail_service.py

{check_msdefender-1.1.0 → check_msdefender-1.1.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "check-msdefender"
-version = "1.1.0"
+version = "1.1.1"
 authors = [
     {name = "ldvchosal", email = "ldvchosal@github.com"},
 ]

check_msdefender-1.1.1/tests/fixtures/alerts_data.json

@@ -0,0 +1,72 @@
+{
+  "alerts": {
+    "value": [
+      {
+        "severity": "High",
+        "status": "New",
+        "title": "Suspicious activity detected",
+        "alertCreationTime": "2025-09-14T10:22:14.12Z",
+        "firstEventTime": "2025-09-14T10:22:13.7175652Z",
+        "lastEventTime": "2025-09-14T10:22:13.7175652Z",
+        "lastUpdateTime": "2025-09-14T10:24:04.42Z",
+        "machineId": "test-machine-1",
+        "computerDnsName": "test-machine-1.domain.com"
+      },
+      {
+        "severity": "Informational",
+        "status": "New",
+        "title": "Automated investigation started manually",
+        "alertCreationTime": "2025-09-12T21:22:14.12Z",
+        "firstEventTime": "2025-09-12T21:22:13.7175652Z",
+        "lastEventTime": "2025-09-12T21:22:13.7175652Z",
+        "lastUpdateTime": "2025-09-13T01:24:04.42Z",
+        "machineId": "test-machine-1",
+        "computerDnsName": "test-machine-1.domain.com"
+      },
+      {
+        "severity": "Medium",
+        "status": "Resolved",
+        "title": "Malware detected and remediated",
+        "alertCreationTime": "2025-09-10T15:30:45.67Z",
+        "firstEventTime": "2025-09-10T15:30:44.1234567Z",
+        "lastEventTime": "2025-09-10T15:30:44.1234567Z",
+        "lastUpdateTime": "2025-09-11T09:15:22.89Z",
+        "machineId": "test-machine-1",
+        "computerDnsName": "test-machine-1.domain.com"
+      },
+      {
+        "severity": "Informational",
+        "status": "Resolved",
+        "title": "Automated investigation completed",
+        "alertCreationTime": "2025-09-11T15:25:38.54Z",
+        "firstEventTime": "2025-09-11T15:25:38.1183588Z",
+        "lastEventTime": "2025-09-11T15:25:38.1183588Z",
+        "lastUpdateTime": "2025-09-12T11:05:46.9966667Z",
+        "machineId": "test-machine-2",
+        "computerDnsName": "test-machine-2.domain.com"
+      },
+      {
+        "severity": "Low",
+        "status": "New",
+        "title": "Suspicious file execution",
+        "alertCreationTime": "2025-09-13T08:15:22.33Z",
+        "firstEventTime": "2025-09-13T08:15:21.9876543Z",
+        "lastEventTime": "2025-09-13T08:15:21.9876543Z",
+        "lastUpdateTime": "2025-09-13T08:20:11.11Z",
+        "machineId": "test-machine-3",
+        "computerDnsName": "test-machine-3.domain.com"
+      },
+      {
+        "severity": "Informational",
+        "status": "InProgress",
+        "title": "Manual investigation in progress",
+        "alertCreationTime": "2025-09-14T12:45:30.77Z",
+        "firstEventTime": "2025-09-14T12:45:29.1111111Z",
+        "lastEventTime": "2025-09-14T12:45:29.1111111Z",
+        "lastUpdateTime": "2025-09-14T13:00:15.55Z",
+        "machineId": "test-machine-2",
+        "computerDnsName": "test-machine-2.domain.com"
+      }
+    ]
+  }
+}

check_msdefender-1.1.1/tests/fixtures/test_alerts_service.py

@@ -0,0 +1,150 @@
+"""Fixture tests for AlertsService."""
+
+import pytest
+
+from check_msdefender.services.alerts_service import AlertsService
+from check_msdefender.core.exceptions import ValidationError
+from tests.fixtures.mock_defender_client import MockDefenderClient
+
+
+class TestAlertsServiceFixtures:
+    """Fixture tests for AlertsService."""
+
+    def setup_method(self):
+        """Set up test fixtures."""
+        self.mock_client = MockDefenderClient()
+        self.service = AlertsService(self.mock_client)
+
+    def test_get_result_by_machine_id_multiple_alerts(self):
+        """Test getting alerts for machine with multiple alerts."""
+        # test-machine-1 has 2 unresolved alerts: 1 High (New) + 1 Informational (New)
+        result = self.service.get_result(machine_id="test-machine-1")
+
+        # Should return 2 unresolved alerts
+        assert result["value"] == 2
+        assert len(result["details"]) == 3  # Summary line + 2 alert details
+
+        # Check that details include both alerts
+        details_text = "\n".join(result["details"])
+        assert "Suspicious activity detected" in details_text
+        assert "Automated investigation started manually" in details_text
+        assert "test-machine-1.domain.com" in details_text
+
+    def test_get_result_by_machine_id_resolved_alerts_only(self):
+        """Test machine with only resolved alerts."""
+        # test-machine-2 has 1 resolved alert
+        result = self.service.get_result(machine_id="test-machine-2")
+
+        # Should return 1 unresolved alert (InProgress status)
+        assert result["value"] == 1
+        assert len(result["details"]) == 2  # Summary line + 1 alert detail
+
+        details_text = "\n".join(result["details"])
+        assert "Manual investigation in progress" in details_text
+        assert "test-machine-2.domain.com" in details_text
+
+    def test_get_result_by_machine_id_low_severity_alert(self):
+        """Test machine with low severity unresolved alert."""
+        # test-machine-3 has 1 Low severity alert (New status)
+        result = self.service.get_result(machine_id="test-machine-3")
+
+        # Should return 1 unresolved alert
+        assert result["value"] == 1
+        assert len(result["details"]) == 2  # Summary line + 1 alert detail
+
+        details_text = "\n".join(result["details"])
+        assert "Suspicious file execution" in details_text
+        assert "test-machine-3.domain.com" in details_text
+
+    def test_get_result_by_dns_name(self):
+        """Test getting alerts by DNS name."""
+        # test-machine-2.domain.com should match alerts
+        result = self.service.get_result(dns_name="test-machine-2.domain.com")
+
+        # Should return 1 unresolved alert (InProgress)
+        assert result["value"] == 1
+        assert len(result["details"]) == 2  # Summary line + 1 alert detail
+
+    def test_get_result_no_parameters(self):
+        """Test error when no parameters provided."""
+        with pytest.raises(ValidationError, match="Either machine_id or dns_name must be provided"):
+            self.service.get_result()
+
+    def test_get_result_nonexistent_dns_name(self):
+        """Test error when DNS name doesn't exist."""
+        with pytest.raises(ValidationError, match="Machine not found with DNS name"):
+            self.service.get_result(dns_name="nonexistent.domain.com")
+
+    def test_get_result_nonexistent_machine_id(self):
+        """Test error when machine ID doesn't exist."""
+        with pytest.raises(ValidationError, match="Machine not found"):
+            self.service.get_result(machine_id="nonexistent-machine")
+
+    def test_get_result_machine_without_alerts(self):
+        """Test machine that exists but has no alerts."""
+        # Create a machine that has no matching alerts in fixture data
+        result = self.service.get_result(machine_id="test-machine-4")
+
+        # Should return 0 alerts since test-machine-4 has no alerts in fixture
+        assert result["value"] == 0
+        assert result["details"] == []
+
+    def test_alert_severity_categorization(self):
+        """Test that alerts are properly categorized by severity."""
+        # test-machine-1 has High + Informational alerts
+        result = self.service.get_result(machine_id="test-machine-1")
+
+        # Should count both as unresolved (High=1, Informational=1)
+        assert result["value"] == 2
+
+        # Check that summary mentions unresolved alerts (not specifically informational)
+        details_text = "\n".join(result["details"])
+        assert "Unresolved alerts for test-machine-1.domain.com" in details_text
+
+    def test_alert_status_filtering(self):
+        """Test that only unresolved alerts are counted."""
+        # Based on fixture data, test-machine-1 has:
+        # - 1 High/New (unresolved)
+        # - 1 Informational/New (unresolved)
+        # - 1 Medium/Resolved (resolved - should be filtered out)
+        result = self.service.get_result(machine_id="test-machine-1")
+
+        # Should only count the 2 unresolved alerts
+        assert result["value"] == 2
+
+        # Resolved alert should not appear in details
+        details_text = "\n".join(result["details"])
+        assert "Malware detected and remediated" not in details_text
+
+    def test_alert_creation_time_format(self):
+        """Test that alert creation times are properly formatted in output."""
+        result = self.service.get_result(machine_id="test-machine-1")
+
+        details_text = "\n".join(result["details"])
+
+        # Should include timestamps in ISO format
+        assert "2025-09-14T10:22:14.12Z" in details_text
+        assert "2025-09-12T21:22:14.12Z" in details_text
+
+    def test_alert_title_and_severity_in_output(self):
+        """Test that alert titles and severities appear correctly in output."""
+        result = self.service.get_result(machine_id="test-machine-1")
+
+        details_text = "\n".join(result["details"])
+
+        # Should include alert titles and severity/status
+        assert "suspicious activity detected (new high)" in details_text.lower()
+        assert (
+            "automated investigation started manually (new informational)" in details_text.lower()
+        )
+
+    def test_dns_name_matching(self):
+        """Test that alerts are matched by DNS name when provided."""
+        # Use DNS name that should match alerts
+        result = self.service.get_result(dns_name="test-machine-3.domain.com")
+
+        # Should find the Low severity alert for test-machine-3
+        assert result["value"] == 1
+
+        details_text = "\n".join(result["details"])
+        assert "Suspicious file execution" in details_text

check_msdefender-1.1.1/tests/unit/test_alerts_service.py

@@ -0,0 +1,267 @@
+"""Unit tests for AlertsService."""
+
+import pytest
+from unittest.mock import Mock
+
+from check_msdefender.services.alerts_service import AlertsService
+from check_msdefender.core.exceptions import ValidationError
+
+
+class TestAlertsService:
+    """Unit tests for AlertsService."""
+
+    def setup_method(self):
+        """Set up test fixtures."""
+        self.mock_client = Mock()
+        self.service = AlertsService(self.mock_client)
+
+    def test_init(self):
+        """Test service initialization."""
+        assert self.service.defender == self.mock_client
+        assert hasattr(self.service, "logger")
+
+    def test_get_result_by_machine_id_success(self):
+        """Test successful retrieval by machine ID."""
+        # Mock the alerts API response
+        mock_alerts_data = {
+            "value": [
+                {
+                    "severity": "High",
+                    "status": "New",
+                    "title": "Suspicious activity detected",
+                    "alertCreationTime": "2025-09-14T10:22:14.12Z",
+                    "firstEventTime": "2025-09-14T10:22:13.7175652Z",
+                    "lastEventTime": "2025-09-14T10:22:13.7175652Z",
+                    "lastUpdateTime": "2025-09-14T10:24:04.42Z",
+                    "machineId": "test-machine-123",
+                    "computerDnsName": "test.domain.com",
+                },
+                {
+                    "severity": "Informational",
+                    "status": "Resolved",
+                    "title": "Investigation completed",
+                    "alertCreationTime": "2025-09-13T15:30:45.67Z",
+                    "firstEventTime": "2025-09-13T15:30:44.1234567Z",
+                    "lastEventTime": "2025-09-13T15:30:44.1234567Z",
+                    "lastUpdateTime": "2025-09-13T16:15:22.89Z",
+                    "machineId": "test-machine-123",
+                    "computerDnsName": "test.domain.com",
+                },
+            ]
+        }
+
+        # Mock machine details API response
+        mock_machine_data = {
+            "id": "test-machine-123",
+            "computerDnsName": "test.domain.com",
+        }
+
+        self.mock_client.get_alerts.return_value = mock_alerts_data
+        self.mock_client.get_machine_by_id.return_value = mock_machine_data
+
+        result = self.service.get_result(machine_id="test-machine-123")
+
+        # Should return 1 unresolved alert (High severity, New status)
+        assert result["value"] == 1
+        assert len(result["details"]) == 2  # Summary line + 1 alert detail
+
+        # Should call the client methods
+        self.mock_client.get_alerts.assert_called_once()
+        self.mock_client.get_machine_by_id.assert_called_once_with("test-machine-123")
+
+    def test_get_result_by_dns_name_success(self):
+        """Test successful retrieval by DNS name."""
+        # Mock DNS lookup response
+        mock_dns_response = {"value": [{"id": "test-machine-456"}]}
+
+        # Mock alerts API response
+        mock_alerts_data = {
+            "value": [
+                {
+                    "severity": "Medium",
+                    "status": "InProgress",
+                    "title": "Security scan in progress",
+                    "alertCreationTime": "2025-09-14T12:00:00.00Z",
+                    "firstEventTime": "2025-09-14T12:00:00.00Z",
+                    "lastEventTime": "2025-09-14T12:00:00.00Z",
+                    "lastUpdateTime": "2025-09-14T12:30:00.00Z",
+                    "machineId": "test-machine-456",
+                    "computerDnsName": "test.example.com",
+                }
+            ]
+        }
+
+        self.mock_client.get_machine_by_dns_name.return_value = mock_dns_response
+        self.mock_client.get_alerts.return_value = mock_alerts_data
+
+        result = self.service.get_result(dns_name="test.example.com")
+
+        # Should return 1 unresolved alert
+        assert result["value"] == 1
+        assert len(result["details"]) == 2  # Summary line + 1 alert detail
+
+        # Should call DNS lookup
+        self.mock_client.get_machine_by_dns_name.assert_called_once_with("test.example.com")
+        self.mock_client.get_alerts.assert_called_once()
+
+    def test_get_result_by_dns_name_not_found(self):
+        """Test error when DNS name doesn't exist."""
+        # Mock empty DNS response
+        mock_dns_response = {"value": []}
+        self.mock_client.get_machine_by_dns_name.return_value = mock_dns_response
+
+        with pytest.raises(ValidationError, match="Machine not found with DNS name"):
+            self.service.get_result(dns_name="nonexistent.domain.com")
+
+        self.mock_client.get_machine_by_dns_name.assert_called_once_with("nonexistent.domain.com")
+        self.mock_client.get_alerts.assert_not_called()
+
+    def test_get_result_no_parameters(self):
+        """Test error when no parameters provided."""
+        with pytest.raises(ValidationError, match="Either machine_id or dns_name must be provided"):
+            self.service.get_result()
+
+        self.mock_client.get_machine_by_dns_name.assert_not_called()
+        self.mock_client.get_machine_by_id.assert_not_called()
+        self.mock_client.get_alerts.assert_not_called()
+
+    def test_get_result_no_alerts_for_machine(self):
+        """Test when no alerts exist for the machine."""
+        # Mock alerts API response with no matching alerts
+        mock_alerts_data = {
+            "value": [
+                {
+                    "severity": "High",
+                    "status": "New",
+                    "title": "Alert for different machine",
+                    "alertCreationTime": "2025-09-14T10:22:14.12Z",
+                    "machineId": "different-machine",
+                    "computerDnsName": "other.domain.com",
+                }
+            ]
+        }
+
+        mock_machine_data = {
+            "id": "test-machine-123",
+            "computerDnsName": "test.domain.com",
+        }
+
+        self.mock_client.get_alerts.return_value = mock_alerts_data
+        self.mock_client.get_machine_by_id.return_value = mock_machine_data
+
+        result = self.service.get_result(machine_id="test-machine-123")
+
+        # Should return 0 alerts
+        assert result["value"] == 0
+        assert result["details"] == []
+
+    def test_get_result_only_resolved_alerts(self):
+        """Test when machine has only resolved alerts."""
+        mock_alerts_data = {
+            "value": [
+                {
+                    "severity": "High",
+                    "status": "Resolved",
+                    "title": "Resolved security issue",
+                    "alertCreationTime": "2025-09-14T10:22:14.12Z",
+                    "machineId": "test-machine-123",
+                    "computerDnsName": "test.domain.com",
+                }
+            ]
+        }
+
+        mock_machine_data = {
+            "id": "test-machine-123",
+            "computerDnsName": "test.domain.com",
+        }
+
+        self.mock_client.get_alerts.return_value = mock_alerts_data
+        self.mock_client.get_machine_by_id.return_value = mock_machine_data
+
+        result = self.service.get_result(machine_id="test-machine-123")
+
+        # Should return 0 unresolved alerts
+        assert result["value"] == 0
+        assert result["details"] == []
+
+    def test_get_result_multiple_severity_alerts(self):
+        """Test handling multiple alerts with different severities."""
+        mock_alerts_data = {
+            "value": [
+                {
+                    "severity": "High",
+                    "status": "New",
+                    "title": "Critical security threat",
+                    "alertCreationTime": "2025-09-14T10:22:14.12Z",
+                    "machineId": "test-machine-123",
+                    "computerDnsName": "test.domain.com",
+                },
+                {
+                    "severity": "Informational",
+                    "status": "InProgress",
+                    "title": "System scan running",
+                    "alertCreationTime": "2025-09-14T11:00:00.00Z",
+                    "machineId": "test-machine-123",
+                    "computerDnsName": "test.domain.com",
+                },
+                {
+                    "severity": "Medium",
+                    "status": "New",
+                    "title": "Suspicious file detected",
+                    "alertCreationTime": "2025-09-14T12:00:00.00Z",
+                    "machineId": "test-machine-123",
+                    "computerDnsName": "test.domain.com",
+                },
+            ]
+        }
+
+        mock_machine_data = {
+            "id": "test-machine-123",
+            "computerDnsName": "test.domain.com",
+        }
+
+        self.mock_client.get_alerts.return_value = mock_alerts_data
+        self.mock_client.get_machine_by_id.return_value = mock_machine_data
+
+        result = self.service.get_result(machine_id="test-machine-123")
+
+        # Should return 3 unresolved alerts
+        assert result["value"] == 3
+        assert len(result["details"]) == 4  # Summary line + 3 alert details
+
+    def test_get_result_api_exception_propagation(self):
+        """Test that API exceptions are properly propagated."""
+        self.mock_client.get_alerts.side_effect = Exception("API Error")
+
+        mock_machine_data = {
+            "id": "test-machine-123",
+            "computerDnsName": "test.domain.com",
+        }
+
+        self.mock_client.get_machine_by_id.return_value = mock_machine_data
+
+        with pytest.raises(Exception, match="API Error"):
+            self.service.get_result(machine_id="test-machine-123")
+
+    def test_logging_calls(self):
+        """Test that logging methods are called appropriately."""
+        # Mock logger
+        mock_logger = Mock()
+        self.service.logger = mock_logger
+
+        # Mock successful response
+        mock_alerts_data = {"value": []}
+        mock_machine_data = {
+            "id": "test-machine-123",
+            "computerDnsName": "test.domain.com",
+        }
+
+        self.mock_client.get_alerts.return_value = mock_alerts_data
+        self.mock_client.get_machine_by_id.return_value = mock_machine_data
+
+        self.service.get_result(machine_id="test-machine-123")
+
+        # Verify logging calls
+        mock_logger.method_entry.assert_called_once()
+        mock_logger.method_exit.assert_called_once()
+        assert mock_logger.info.call_count >= 2  # At least 2 info calls expected