Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sequence detection

Browse Source
This commit is contained in:
larssand
2026-06-25 22:05:04 +02:00
parent 9da1aedf52
commit 0e41e00ebc
5 changed files with 179 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
README.md
View File

@@ -88,6 +88,12 @@ baselines for authentication failures, DNS queries, and deny/block actions when
those events are present. These are evaluated per configured entity, so a Windows
account, DNS client, or firewall source is compared to its own history.
SignalScope also detects ordered behavior sequences across any streams that share
an entity. The built-in sequence is category-based, not source-specific:
`dns_query -> network_connection -> auth_failure`. Those categories can come from
AdGuard, Windows DNS, a proxy, firewall, VPN, endpoint, or any other Graylog
stream as long as the fields normalize into the same generic event model.
Stream profiles can also carry `field_weights` to tune scoring without changing
the baseline itself. Weights are multipliers from `0` to `5` and can target a
field, a detector, or a field+detector pair: