sequence detection

src/fgai/monitor.py

@@ -20,6 +20,7 @@ from .logs import local_in_failures, read_events, summarize_events, top_field_va
 from .mitigation import parse_allowlist, suggest_block_candidates
 from .policies import audit_policies, read_policies
 from .recommendations import build_recommendations
+from .sequences import detect_sequences
 from .threat_intel import ThreatIntelClient, enrich_ips, is_public_ip
 from .stream_profiles import parse_profiles
 
@@ -104,6 +105,9 @@ def build_status(
     baseline = BaselineStore(baseline_path) if baseline_path else None
     profiles = baseline.profiles({event.src_ip for event in events if event.src_ip}) if baseline else {}
     field_deviations = baseline.profile_deviations(events, stream_profiles) if baseline else {}
+    sequence_findings = detect_sequences(events)
+    for entity, findings in sequence_findings.items():
+        field_deviations.setdefault(entity, []).extend(findings)
     for deviations in field_deviations.values():
         for deviation in deviations:
             stream_id = str(deviation.get("stream_id", ""))
@@ -194,6 +198,7 @@ def build_status(
         },
         "event_context": build_event_context(events),
         "field_deviations": field_deviations,
+        "sequence_findings": sequence_findings,
         "feedback": feedback,
         "cross_source_correlations": correlations,
         "incidents": build_incidents(anomalies, field_deviations, correlations),