Skip to content

Add destination assertions to rule tests - #829

Merged
dekatzenel merged 4 commits into
panther-labs:mainfrom
tomasz-sq:tomasz/expected-destinations
Sep 3, 2026
Merged

Add destination assertions to rule tests#829
dekatzenel merged 4 commits into
panther-labs:mainfrom
tomasz-sq:tomasz/expected-destinations

Conversation

@tomasz-sq

@tomasz-sq tomasz-sq commented Aug 28, 2026

Copy link
Copy Markdown
Contributor

Why

Rule YAML tests can currently observe destination routing but cannot assert whether a matching event should route an alert to a specific destination or remain signal-only (destination list is empty)

What

  • Add optional ExpectedDestinations lists to rule tests
  • Treat an empty expected list as signal-only routing
  • Compare named expectations against resolved test destinations
  • Add passing and mismatch regression coverage

Risk Assessment

Low. Existing tests omit the optional field and retain their current behavior.

@tomasz-sq
tomasz-sq marked this pull request as ready for review August 28, 2026 18:44
@tomasz-sq
tomasz-sq requested a review from a team as a code owner August 28, 2026 18:44
@cursor

cursor Bot commented Aug 28, 2026

Copy link
Copy Markdown

PR Summary

Low Risk
The feature is entirely optional and backward compatible; tests without ExpectedDestinations retain their current behavior unchanged.

Overview
This PR adds the ability for rule tests to assert expected alert destination routing by introducing an optional ExpectedDestinations field to test specifications.

Tests can now specify which destinations an alert should route to, with an empty list representing signal-only (no destination routing). The implementation creates test-specific destination instances for any expected destinations not available globally, then compares the actual routing output against the expected list to mark tests as failed if they don't match.

Includes schema validation updates, test utilities, and regression test fixtures demonstrating the feature including a passing test case and a mismatch failure case.

Reviewed by Cursor Bugbot for commit 8e1140f. Bugbot is set up for automated code reviews on this repo. Configure here.

Comment thread panther_analysis_tool/main.py
Comment thread panther_analysis_tool/main.py
Comment thread panther_analysis_tool/main.py
@dekatzenel

dekatzenel commented Sep 1, 2026

Copy link
Copy Markdown
Contributor

Other than the issue cursor flagged, LGTM. I'll wait on that fix to approve. Tag me when it's ready!

@tomasz-sq
tomasz-sq force-pushed the tomasz/expected-destinations branch from 36a8e64 to 269e893 Compare September 3, 2026 15:37

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Fix All in Cursor

Reviewed by Cursor Bugbot for commit 269e893. Configure here.

Comment thread panther_analysis_tool/main.py
@dekatzenel
dekatzenel merged commit ca4569f into panther-labs:main Sep 3, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants