feat(tests): add Blue detect_procedure field mapped from template suggestion

Blue Team gets a detect_procedure field on Test (what they actually
did to detect the attack), Blue's counterpart to Red's procedure_text.
It's seeded from a new detect_suggested_procedure field on
TestTemplate at test-creation time, so a junior who later reuses the
same template starts with prior guidance instead of a blank field.

Also adds the procedure_suggestions review table and Test.source_template_id,
laying the groundwork for suggesting template improvements from filled-in
procedure fields (reviewed and approved by a lead, never auto-written).
detect_procedure is archived (not cleared) on Blue reopen, matching
blue_summary, and now appears in the Jira round-archived and blue_review
comments alongside the existing detection/containment fields.
This commit is contained in:
kitos
2026-07-14 14:58:29 +02:00
parent fd94e55799
commit 8bdbe48fbe
11 changed files with 127 additions and 1 deletions
+4
View File
@@ -115,6 +115,7 @@ class TestBlueUpdate(BaseModel):
containment_time: datetime | None = None
# Assign blue_summary = None
blue_summary: str | None = None
detect_procedure: str | None = None
_normalize_datetimes = field_validator("detection_time", "containment_time")(_to_naive_utc)
@@ -142,6 +143,7 @@ class TestRoundHistoryOut(BaseModel):
detection_time: datetime | None = None
containment_time: datetime | None = None
blue_summary: str | None = None
detect_procedure: str | None = None
review_notes: str | None = None
reviewed_by: uuid.UUID | None = None
archived_at: datetime | None = None
@@ -269,6 +271,7 @@ class TestOut(BaseModel):
execution_date: datetime | None = None
# Assign created_by = None
created_by: uuid.UUID | None = None
source_template_id: uuid.UUID | None = None
# Assign result = None
result: TestResult | None = None
# Assign state = TestState.draft
@@ -293,6 +296,7 @@ class TestOut(BaseModel):
# Blue Team fields
blue_summary: str | None = None
detect_procedure: str | None = None
# Assign detection_result = None
detection_result: TestResult | None = None
containment_result: ContainmentResult | None = None
+2
View File
@@ -31,6 +31,7 @@ class TestTemplateOut(BaseModel):
attack_procedure: str | None = None
# Assign expected_detection = None
expected_detection: str | None = None
detect_suggested_procedure: str | None = None
# Assign platform = None
platform: str | None = None
# Assign tool_suggested = None
@@ -70,6 +71,7 @@ class TestTemplateCreate(BaseModel):
attack_procedure: str | None = None
# Assign expected_detection = None
expected_detection: str | None = None
detect_suggested_procedure: str | None = None
# Assign platform = None
platform: str | None = None
# Assign tool_suggested = None