Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Graylog query details

Browse Source
This commit is contained in:
larssand
2026-06-29 19:26:16 +02:00
parent 4a85e53869
commit 16b5bbdd63
8 changed files with 103 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/fgai/baseline.py
View File

@@ -13,6 +13,7 @@ from .models import LogEvent
from .entities import profile_entities
from .detectors import DETECTOR_MINIMUMS, event_detector_categories
from .normalization import canonical_value
from .query_details import event_query_details
def _number(value: str | None) -> int:
@@ -63,7 +64,8 @@ def _weighted_score(base: int, profile: object | None, field: str, detector: str
return min(100, max(0, int(round(base * multiplier)))), round(multiplier, 2)
def _sample_event(event: LogEvent, value: str = "") -> dict[str, str]:
def _sample_event(event: LogEvent, value: str = "") -> dict[str, object]:
query_details = event_query_details(event)
return {
"timestamp": event.fields.get("eventtime", event.fields.get("timestamp", "")),
"source": event.src_ip or event.fields.get("source", ""),
@@ -73,6 +75,8 @@ def _sample_event(event: LogEvent, value: str = "") -> dict[str, str]:
"service": canonical_value(event.fields, "service"),
"value": value,
"message": canonical_value(event.fields, "context")[:240],
"query_details": query_details,
"graylog_query": query_details["query"],
}