first add

src/fgai/models.py

@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+
+@dataclass(frozen=True)
+class LogEvent:
+    raw: str
+    fields: dict[str, str]
+
+    @property
+    def src_ip(self) -> str | None:
+        return self.fields.get("srcip") or self.fields.get("src_ip") or self.fields.get("source_ip")
+
+    @property
+    def subtype(self) -> str:
+        return self.fields.get("subtype", "").lower()
+
+    @property
+    def action(self) -> str:
+        return self.fields.get("action", "").lower()
+
+    @property
+    def severity(self) -> str:
+        return self.fields.get("severity", self.fields.get("level", "")).lower()
+
+
+@dataclass(frozen=True)
+class PolicyRule:
+    policy_id: str
+    settings: dict[str, list[str]] = field(default_factory=dict)
+
+    def values(self, key: str) -> list[str]:
+        return self.settings.get(key, [])
+
+    def first(self, key: str, default: str = "") -> str:
+        values = self.values(key)
+        return values[0] if values else default
+
+
+@dataclass(frozen=True)
+class Finding:
+    severity: str
+    title: str
+    detail: str
+    reference: str | None = None
+
+
+@dataclass(frozen=True)
+class BlockCandidate:
+    src_ip: str
+    score: int
+    reasons: list[str]
+    sample_events: list[LogEvent]