Added test for fix

SigmaHQ · Jan 9, 2025 · ea6cff5 · ea6cff5
1 parent d20c524
commit ea6cff5
Showing 1 changed file with 20 additions and 0 deletions.
diff --git a/tests/test_processing_transformations.py b/tests/test_processing_transformations.py
@@ -493,6 +493,26 @@ def test_field_prefix_mapping(dummy_pipeline, field_prefix_mapping_transformatio
     }
 
 
+def test_field_prefix_mapping_keyword_detection(
+    dummy_pipeline, keyword_sigma_rule, field_prefix_mapping_transformation
+):
+    field_prefix_mapping_transformation.set_pipeline(dummy_pipeline)
+    field_prefix_mapping_transformation.apply(keyword_sigma_rule)
+    assert keyword_sigma_rule.detection.detections["test"] == SigmaDetection(
+        [
+            SigmaDetectionItem(
+                None,
+                [],
+                [
+                    SigmaString("value1"),
+                    SigmaString("value2"),
+                    SigmaString("value3"),
+                ],
+            ),
+        ]
+    )
+
+
 def test_field_prefix_mapping_correlation_rule(
     dummy_pipeline, sigma_correlation_rule, field_prefix_mapping_transformation
 ):