fix labeler and add new test

logprep/processor/labeler/processor.py

@@ -78,7 +78,7 @@ def _apply_rules(self, event, rule):
         """Applies the rule to the current event"""
         targets = [f"label.{key}" for key in rule.label.keys()]
         contents = rule.label.values()
-        add_batch_to_silent_fail(event, targets, contents)
+        add_batch_to_silent_fail(event, targets, contents, extends_lists=True)
         # convert sets into sorted lists
-        contents = [sorted(list(get_dotted_field_value(event, target))) for target in targets]
+        contents = [sorted(set(get_dotted_field_value(event, target))) for target in targets]
         add_batch_to_silent_fail(event, targets, contents, overwrite_output_field=True)

logprep/util/helper.py

@@ -136,7 +136,7 @@ def add_field_to(
             return
         if not extends_lists or not isinstance(existing_value, list):
             raise FieldExistsWarning(event, [target_field])
-        if isinstance(content, list):
+        if isinstance(content, list | set):
             target_parent[target_key].extend(content)
         else:
             target_parent[target_key].append(content)

tests/unit/processor/labeler/test_labeler.py

@@ -257,3 +257,11 @@ def test_create_loads_the_specified_labeling_schema(self):
         labeler = Factory.create({"test instance": config})
 
         assert labeler._schema == expected_schema
+
+    def test_extend_list_of_existing_labels(self):
+        rule = {"filter": "applyrule", "labeler": {"label": {"reporter": ["windows", "foo"]}}}
+        document = {"applyrule": "yes", "label": {"reporter": ["windows"]}}
+        expected = {"applyrule": "yes", "label": {"reporter": ["foo", "windows"]}}
+        self._load_specific_rule(rule)
+        self.object.process(document)
+        assert document == expected

tests/unit/util/test_auto_rule_tester.py

@@ -281,8 +281,8 @@ def test_full_auto_rule_test_run(self, auto_rule_tester, capsys):
         ]
 
         expected_overall_results = [
-            "+ Successful Tests: 31",
-            "- Failed Tests: 7",
+            "+ Successful Tests: 32",
+            "- Failed Tests: 6",
             "~ Warning: 2",
             "Rule Test Coverage: 72.72727272727273",
             "Total Tests: 38",