Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

sequence detection

Browse Source
This commit is contained in:
larssand
2026-06-25 22:05:04 +02:00
parent 9da1aedf52
commit 0e41e00ebc
5 changed files with 179 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ROADMAP.md
View File

@@ -27,7 +27,7 @@ Goal: make findings more accurate before adding more integrations.
- [x] Add rare-value detection with a minimum historical observation threshold.
- [x] Add detector-specific authentication failure, DNS volume, and denied-traffic burst thresholds.
- [x] Add configurable per-field detector weights.
- [ ] Add sequence detection, for example DNS lookup -> outbound connection -> authentication event.
- [x] Add sequence detection, for example DNS lookup -> outbound connection -> authentication event.
- [x] Add per-stream detector enablement and thresholds in the UI.
- [x] Add a dry-run replay command for historic JSONL or Graylog exports using temporary baselines.
- [x] Add direct Graylog MCP time-range replay and result comparison against saved detector configurations.