ThreatTriageConfig { public List<RiskLevelRule> getRiskLevelRules() { return riskLevelRules; }  List<RiskLevelRule> getRiskLevelRules(); void setRiskLevelRules(List<RiskLevelRule> riskLevelRules); Aggregators getAggregator(); void setAggregator(String aggregator); Map<String, Object> getAggregationConfig(); void setAggregationConfig(Map<String, Object> aggregationConfig); @Override String toString(); @Override boolean equals(Object o); @Override int hashCode();  }
@Test public void shouldAllowNumericRuleScore() throws Exception { SensorEnrichmentConfig enrichment = (SensorEnrichmentConfig) ENRICHMENT.deserialize(triageRuleWithNumericScore); ThreatTriageConfig threatTriage = enrichment.getThreatIntel().getTriageConfig(); assertNotNull(threatTriage); List<RiskLevelRule> rules = threatTriage.getRiskLevelRules(); assertEquals(1, rules.size()); RiskLevelRule rule = rules.get(0); assertEquals("Rule Name", rule.getName()); assertEquals("Rule Comment", rule.getComment()); assertEquals("ip_src_addr == '10.0.2.3'", rule.getRule()); assertEquals("'Rule Reason'", rule.getReason()); assertEquals("10", rule.getScoreExpression()); }
@Test public void shouldAllowScoreAsStellarExpression() throws Exception { SensorEnrichmentConfig enrichment = (SensorEnrichmentConfig) ENRICHMENT.deserialize(triageRuleWithScoreExpression); ThreatTriageConfig threatTriage = enrichment.getThreatIntel().getTriageConfig(); assertNotNull(threatTriage); List<RiskLevelRule> rules = threatTriage.getRiskLevelRules(); assertEquals(1, rules.size()); RiskLevelRule rule = rules.get(0); assertEquals("Rule Name", rule.getName()); assertEquals("Rule Comment", rule.getComment()); assertEquals("'Rule Reason'", rule.getReason()); assertEquals("ip_src_addr == '10.0.2.3'", rule.getRule()); assertEquals("10 + 10", rule.getScoreExpression()); }