From 1306a529ee985b0724f5706a3b7640ccd53a6ca9dc8e9eec276ac9e8f9da2303 Mon Sep 17 00:00:00 2001
From: larssand <larssand@LPW0JW6L1>
Date: Tue, 30 Jun 2026 13:40:06 +0200
Subject: [PATCH] fix profile save button

---
 src/fgai/dashboard.py | 96 ++++++++++++++++++++++++++-----------------
 1 file changed, 59 insertions(+), 37 deletions(-)
diff --git a/src/fgai/dashboard.py b/src/fgai/dashboard.py
index c2614a1..37f4bca 100644
--- a/src/fgai/dashboard.py
+++ b/src/fgai/dashboard.py
@@ -116,7 +116,7 @@ HTML = """<!doctype html>
     <div data-view="overview" class="active"><section class="split"><div class="panel"><h2>Events and Anomalies</h2><canvas id="trendChart" class="chart"></canvas></div><div class="panel"><h2>Baseline and Stream Health</h2><div id="health"></div></div></section><section class="split"><div class="panel"><h2>Correlation Map</h2><canvas id="correlationGraph" class="graph"></canvas><div id="correlationGraphInfo" class="muted"></div></div><div class="panel"><h2>AI Assessment</h2><div id="llmAssessment" class="muted">LLM assessment disabled.</div></div></section><section class="panel"><h2>Investigation Incidents</h2><div id="incidents"></div></section><section class="split"><div class="panel"><h2>Anomalies</h2><div id="anomalies"></div></div><div class="panel"><h2>Recommendations</h2><div id="recommendations"></div></div></section></div>
     <div data-view="findings"><section class="panel"><h2>Triage Queue</h2><div id="triageQueue"></div></section><section class="panel"><h2>Field Baseline Deviations</h2><div class="toolbar"><label><input id="showReviewedFindings" type="checkbox"> show reviewed</label><label><input id="showLowFindings" type="checkbox"> show low score</label><span id="findingSummary"></span></div><div id="feedbackNotice" class="muted" role="status"></div><div id="fieldDeviations"></div></section><section class="panel"><h2>Related Activity Across Sources</h2><div id="relatedActivity"></div></section><section class="split"><div class="panel"><h2>Block Candidates</h2><div id="blocks"></div></div><div class="panel"><h2>Threat Intelligence</h2><div id="reputation"></div></div></section><section class="panel"><h2>Policy Findings</h2><div id="policies"></div></section></div>
     <div data-view="diagnostics"><section class="panel"><h2>Diagnostics</h2><div id="diagnostics"></div></section></div>
-    <div data-view="settings"><section class="panel"><h2>Recommended Stream Profiles</h2><div id="profileSuggestions" class="muted">Waiting for observed stream data.</div></section><section class="panel"><h2>Installed Ollama Models</h2><div id="ollamaModels" class="muted">Loading local Ollama models.</div></section><section class="panel"><h2>Runtime Configuration</h2><form id="settingsForm"><div class="grid"><label>Log source<br><select name="log_source"><option value="local_syslog">Local syslog</option><option value="graylog_mcp">Graylog MCP</option></select></label><label>Graylog MCP URL<br><input name="graylog_mcp_url" type="url" placeholder="https://graylog.example/api/mcp"></label><label>Enabled streams<br><button type="button" id="loadStreams">Load streams</button><div id="streamPicker" class="muted">Load streams after URL and token are saved.</div></label><label>Profile editor<br><button type="button" id="loadFields">Edit first checked stream profile</button><div id="profileEditorStatus" class="muted">No profile selected for editing.</div><div id="fieldPicker" class="muted">Click Edit profile on one stream.</div></label><label>Profile name<br><input name="profile_name" placeholder="Example: Windows login behavior"></label><label>Detector thresholds (JSON)<br><textarea name="profile_detectors" placeholder='{"auth_failure":{"enabled":true,"minimum":5,"z_threshold":3}}'></textarea></label><label>Field weights (JSON)<br><textarea name="profile_field_weights" placeholder='{"url":1.5,"auth_failure_burst":2,"query_domain":{"rare_value":1.8}}'></textarea></label><label>Graylog query<br><input name="graylog_query" placeholder="*"></label><label>Graylog fetch mode<br><select name="graylog_fetch_mode"><option value="auto">Auto aggregate</option><option value="aggregate">Aggregate + sample</option><option value="raw">Raw only</option></select></label><label>Graylog MCP poll window seconds<br><input name="graylog_range_seconds" type="number" min="60" step="60" placeholder="300"></label><label>Graylog max events per stream<br><input name="graylog_max_events_per_stream" type="number" min="1" step="1000" placeholder="5000"></label><label>Raw sample events per stream<br><input name="graylog_raw_sample_events" type="number" min="1" step="1000" placeholder="5000"></label><label>Baseline training days<br><input name="baseline_training_days" type="number" min="1" step="1" placeholder="7"></label><label>Baseline bucket retention days<br><input name="baseline_retention_days" type="number" min="1" step="1" placeholder="14"></label><label>Baseline value retention days<br><input name="baseline_value_retention_days" type="number" min="1" step="1" placeholder="7"></label><label>Max values per entity field<br><input name="baseline_max_values_per_field" type="number" min="1" step="100" placeholder="2000"></label><label>Threat intel provider<br><select name="threat_intel_provider"><option value="auto">Auto</option><option value="abuseipdb">AbuseIPDB</option><option value="virustotal">VirusTotal</option></select></label><label>AbuseIPDB API key<br><input name="abuseipdb_api_key" type="password" placeholder="Leave blank to keep current key"></label><label>VirusTotal API key<br><input name="virustotal_api_key" type="password" placeholder="Leave blank to keep current key"></label><label>Threat intel daily limit<br><input name="threat_intel_daily_limit" type="number" min="1" step="1" placeholder="100"></label><label>Threat intel cache TTL seconds<br><input name="threat_intel_ttl_seconds" type="number" min="60" step="60" placeholder="604800"></label><label>Threat intel error TTL seconds<br><input name="threat_intel_error_ttl_seconds" type="number" min="60" step="60" placeholder="3600"></label><label>AbuseIPDB max age days<br><input name="abuseipdb_max_age_days" type="number" min="1" step="1" placeholder="90"></label><label>Graylog field mapping (JSON)<br><textarea name="graylog_field_mapping" placeholder='{"srcip":"client_ip","dstip":"server_ip","action":"event_action"}'></textarea></label><label>Graylog MCP token<br><input name="graylog_mcp_token" type="password" placeholder="Leave blank to keep current token"></label><label><input name="graylog_tls_verify" type="checkbox"> Verify Graylog TLS certificate</label><label>Ollama model<br><input name="llm_model" placeholder="llama3.1"></label><label>Profile advisor model<br><input name="profile_advisor_model" placeholder="qwen3:8b"></label><label>Profile advisor timeout seconds<br><input name="profile_advisor_timeout" type="number" min="1" step="1" placeholder="120"></label><label><input name="llm_enabled" type="checkbox"> Enable Ollama analysis</label><label><input name="profile_advisor_enabled" type="checkbox"> Enable Ollama profile advisor</label><label><input name="threat_intel_enabled" type="checkbox"> Enable threat intelligence</label></div><p><button type="submit">Save configuration</button> <span id="settingsResult" class="muted"></span></p></form></section></div>
+    <div data-view="settings"><section class="panel"><h2>Recommended Stream Profiles</h2><div id="profileApplyResult" class="muted" role="status"></div><div id="profileSuggestions" class="muted">Waiting for observed stream data.</div></section><section class="panel"><h2>Installed Ollama Models</h2><div id="ollamaModels" class="muted">Loading local Ollama models.</div></section><section class="panel"><h2>Runtime Configuration</h2><form id="settingsForm"><div class="grid"><label>Log source<br><select name="log_source"><option value="local_syslog">Local syslog</option><option value="graylog_mcp">Graylog MCP</option></select></label><label>Graylog MCP URL<br><input name="graylog_mcp_url" type="url" placeholder="https://graylog.example/api/mcp"></label><label>Enabled streams<br><button type="button" id="loadStreams">Load streams</button><div id="streamPicker" class="muted">Load streams after URL and token are saved.</div></label><label>Profile editor<br><button type="button" id="loadFields">Edit first checked stream profile</button><div id="profileEditorStatus" class="muted">No profile selected for editing.</div><div id="fieldPicker" class="muted">Click Edit profile on one stream.</div></label><label>Profile name<br><input name="profile_name" placeholder="Example: Windows login behavior"></label><label>Detector thresholds (JSON)<br><textarea name="profile_detectors" placeholder='{"auth_failure":{"enabled":true,"minimum":5,"z_threshold":3}}'></textarea></label><label>Field weights (JSON)<br><textarea name="profile_field_weights" placeholder='{"url":1.5,"auth_failure_burst":2,"query_domain":{"rare_value":1.8}}'></textarea></label><label>Graylog query<br><input name="graylog_query" placeholder="*"></label><label>Graylog fetch mode<br><select name="graylog_fetch_mode"><option value="auto">Auto aggregate</option><option value="aggregate">Aggregate + sample</option><option value="raw">Raw only</option></select></label><label>Graylog MCP poll window seconds<br><input name="graylog_range_seconds" type="number" min="60" step="60" placeholder="300"></label><label>Graylog max events per stream<br><input name="graylog_max_events_per_stream" type="number" min="1" step="1000" placeholder="5000"></label><label>Raw sample events per stream<br><input name="graylog_raw_sample_events" type="number" min="1" step="1000" placeholder="5000"></label><label>Baseline training days<br><input name="baseline_training_days" type="number" min="1" step="1" placeholder="7"></label><label>Baseline bucket retention days<br><input name="baseline_retention_days" type="number" min="1" step="1" placeholder="14"></label><label>Baseline value retention days<br><input name="baseline_value_retention_days" type="number" min="1" step="1" placeholder="7"></label><label>Max values per entity field<br><input name="baseline_max_values_per_field" type="number" min="1" step="100" placeholder="2000"></label><label>Threat intel provider<br><select name="threat_intel_provider"><option value="auto">Auto</option><option value="abuseipdb">AbuseIPDB</option><option value="virustotal">VirusTotal</option></select></label><label>AbuseIPDB API key<br><input name="abuseipdb_api_key" type="password" placeholder="Leave blank to keep current key"></label><label>VirusTotal API key<br><input name="virustotal_api_key" type="password" placeholder="Leave blank to keep current key"></label><label>Threat intel daily limit<br><input name="threat_intel_daily_limit" type="number" min="1" step="1" placeholder="100"></label><label>Threat intel cache TTL seconds<br><input name="threat_intel_ttl_seconds" type="number" min="60" step="60" placeholder="604800"></label><label>Threat intel error TTL seconds<br><input name="threat_intel_error_ttl_seconds" type="number" min="60" step="60" placeholder="3600"></label><label>AbuseIPDB max age days<br><input name="abuseipdb_max_age_days" type="number" min="1" step="1" placeholder="90"></label><label>Graylog field mapping (JSON)<br><textarea name="graylog_field_mapping" placeholder='{"srcip":"client_ip","dstip":"server_ip","action":"event_action"}'></textarea></label><label>Graylog MCP token<br><input name="graylog_mcp_token" type="password" placeholder="Leave blank to keep current token"></label><label><input name="graylog_tls_verify" type="checkbox"> Verify Graylog TLS certificate</label><label>Ollama model<br><input name="llm_model" placeholder="llama3.1"></label><label>Profile advisor model<br><input name="profile_advisor_model" placeholder="qwen3:8b"></label><label>Profile advisor timeout seconds<br><input name="profile_advisor_timeout" type="number" min="1" step="1" placeholder="120"></label><label><input name="llm_enabled" type="checkbox"> Enable Ollama analysis</label><label><input name="profile_advisor_enabled" type="checkbox"> Enable Ollama profile advisor</label><label><input name="threat_intel_enabled" type="checkbox"> Enable threat intelligence</label></div><p><button type="submit">Save configuration</button> <span id="settingsResult" class="muted"></span></p></form></section></div>
   </main>
 <script>
 function esc(value) {
@@ -468,41 +468,63 @@ async function loadStreams() {
 }
 document.getElementById('loadStreams').addEventListener('click', loadStreams);
 async function applySuggestedProfile(streamId) {
-  const suggestion = (window.profileSuggestions || []).find(item => item.stream_id === streamId);
-  if (!suggestion || !suggestion.profile) return;
-  const config = await (await fetch('/api/config', {cache: 'no-store'})).json();
-  const profile = suggestion.profile;
-  const payload = {
-    graylog_stream_profiles: [...(config.graylog_stream_profiles || []).filter(item => item.stream_id !== profile.stream_id), profile],
-    graylog_streams: config.graylog_streams || [],
-    log_source: config.log_source || 'graylog_mcp',
-    graylog_mcp_url: config.graylog_mcp_url || '',
-    graylog_query: config.graylog_query || '*',
-    graylog_fetch_mode: config.graylog_fetch_mode || 'auto',
-    graylog_tls_verify: config.graylog_tls_verify !== false,
-    graylog_range_seconds: config.graylog_range_seconds || 300,
-    graylog_max_events_per_stream: config.graylog_max_events_per_stream || 5000,
-    graylog_raw_sample_events: config.graylog_raw_sample_events || 5000,
-    graylog_field_mapping: config.graylog_field_mapping || '',
-    baseline_training_days: config.baseline_training_days || 7,
-    baseline_retention_days: config.baseline_retention_days || 14,
-    baseline_value_retention_days: config.baseline_value_retention_days || 7,
-    baseline_max_values_per_field: config.baseline_max_values_per_field || 2000,
-    llm_enabled: Boolean(config.llm_enabled),
-    llm_model: config.llm_model || '',
-    profile_advisor_enabled: Boolean(config.profile_advisor_enabled),
-    profile_advisor_model: config.profile_advisor_model || 'qwen3:8b',
-    profile_advisor_timeout: config.profile_advisor_timeout || 120,
-    threat_intel_enabled: Boolean(config.threat_intel_enabled),
-    threat_intel_provider: config.threat_intel_provider || 'auto',
-    threat_intel_daily_limit: config.threat_intel_daily_limit || 100,
-    threat_intel_ttl_seconds: config.threat_intel_ttl_seconds || 604800,
-    threat_intel_error_ttl_seconds: config.threat_intel_error_ttl_seconds || 3600,
-    abuseipdb_max_age_days: config.abuseipdb_max_age_days || 90
-  };
-  const response = await fetch('/api/config', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify(payload)});
-  document.getElementById('settingsResult').textContent = response.ok ? `Applied recommended profile for ${suggestion.stream_name || streamId}.` : 'Could not apply recommended profile.';
-  if (response.ok) loadSettings();
+  const notice = document.getElementById('profileApplyResult');
+  const button = document.querySelector(`.apply-suggested-profile[data-stream-id="${CSS.escape(streamId)}"]`);
+  const suggestion = (window.profileSuggestions || []).find(item => String(item.stream_id) === String(streamId));
+  if (!suggestion || !suggestion.profile) {
+    notice.textContent = `No recommended profile found for ${streamId}.`;
+    return;
+  }
+  try {
+    if (button) button.disabled = true;
+    notice.textContent = `Applying profile for ${suggestion.stream_name || streamId}...`;
+    const configResponse = await fetch('/api/config', {cache: 'no-store'});
+    const config = await configResponse.json();
+    const profile = suggestion.profile;
+    const payload = {
+      graylog_stream_profiles: [...(config.graylog_stream_profiles || []).filter(item => item.stream_id !== profile.stream_id), profile],
+      graylog_streams: config.graylog_streams || [],
+      log_source: config.log_source || 'graylog_mcp',
+      graylog_mcp_url: config.graylog_mcp_url || '',
+      graylog_query: config.graylog_query || '*',
+      graylog_fetch_mode: config.graylog_fetch_mode || 'auto',
+      graylog_tls_verify: config.graylog_tls_verify !== false,
+      graylog_range_seconds: config.graylog_range_seconds || 300,
+      graylog_max_events_per_stream: config.graylog_max_events_per_stream || 5000,
+      graylog_raw_sample_events: config.graylog_raw_sample_events || 5000,
+      graylog_field_mapping: config.graylog_field_mapping || '',
+      baseline_training_days: config.baseline_training_days || 7,
+      baseline_retention_days: config.baseline_retention_days || 14,
+      baseline_value_retention_days: config.baseline_value_retention_days || 7,
+      baseline_max_values_per_field: config.baseline_max_values_per_field || 2000,
+      llm_enabled: Boolean(config.llm_enabled),
+      llm_model: config.llm_model || '',
+      profile_advisor_enabled: Boolean(config.profile_advisor_enabled),
+      profile_advisor_model: config.profile_advisor_model || 'qwen3:8b',
+      profile_advisor_timeout: config.profile_advisor_timeout || 120,
+      threat_intel_enabled: Boolean(config.threat_intel_enabled),
+      threat_intel_provider: config.threat_intel_provider || 'auto',
+      threat_intel_daily_limit: config.threat_intel_daily_limit || 100,
+      threat_intel_ttl_seconds: config.threat_intel_ttl_seconds || 604800,
+      threat_intel_error_ttl_seconds: config.threat_intel_error_ttl_seconds || 3600,
+      abuseipdb_max_age_days: config.abuseipdb_max_age_days || 90
+    };
+    const response = await fetch('/api/config', {method:'POST', headers:{'Content-Type':'application/json'}, body:JSON.stringify(payload)});
+    let result = {};
+    try { result = await response.json(); } catch {}
+    if (!response.ok) {
+      notice.textContent = `Could not apply profile: ${result.error || response.statusText || response.status}`;
+      return;
+    }
+    notice.textContent = `Applied recommended profile for ${suggestion.stream_name || streamId}. Monitor will use it on the next cycle.`;
+    document.getElementById('settingsResult').textContent = notice.textContent;
+    window.streamProfiles = result.graylog_stream_profiles || payload.graylog_stream_profiles;
+    loadSettings();
+  } catch (error) {
+    notice.textContent = `Could not apply profile: ${error}`;
+  } finally {
+    if (button) button.disabled = false;
+  }
 }
 async function editStreamProfile(streamId, title) {
   document.getElementById('profileEditorStatus').innerHTML = `Editing profile for <code>${esc(title || streamId)}</code>`;
@@ -684,7 +706,7 @@ def serve_dashboard(host: str, port: int, status_file: str, *, image_dir: str |
                 return
             try:
                 length = int(self.headers.get("Content-Length", "0"))
-                payload = json.loads(self.rfile.read(min(length, 32_768)).decode("utf-8"))
+                payload = json.loads(self.rfile.read(min(length, 2_097_152)).decode("utf-8"))
                 if not isinstance(payload, dict):
                     raise ValueError("configuration must be an object")
                 body = json.dumps(config_store.update(payload)).encode("utf-8")
