Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Graylog query details

Browse Source
This commit is contained in:
larssand
2026-06-29 19:26:16 +02:00
parent 4a85e53869
commit 16b5bbdd63
8 changed files with 103 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ROADMAP.md
View File

@@ -44,7 +44,7 @@ Goal: make one incident answer what happened, to whom, and across which sources.
- [ ] Add entity aliasing: map DHCP, VPN, DNS, and endpoint identities to the same host where evidence supports it.
- [x] Add incident lifecycle: open, acknowledged, resolved, reopened.
- [x] Persist incident state and analyst notes separately from transient detection output.
- [ ] Add direct Graylog query links or query details for each timeline event.
- [x] Add direct Graylog query links or query details for each timeline event.
- [ ] Add investigation export as JSON and Markdown report.
Acceptance: an analyst can open an incident, see an ordered multi-stream timeline, review evidence, and record an outcome without losing it after the next monitor poll.