Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Graylog query details

Browse Source
This commit is contained in:
larssand
2026-06-29 19:26:16 +02:00
parent 4a85e53869
commit 16b5bbdd63
8 changed files with 103 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

35
src/fgai/entities.py
View File

@@ -5,6 +5,7 @@ from collections.abc import Iterable
from .models import LogEvent
from .normalization import canonical_value
from .query_details import event_query_details
ENTITY_FIELDS: dict[str, tuple[str, ...]] = {
@@ -52,19 +53,23 @@ def profile_entities(event: LogEvent, profile: object) -> tuple[str, ...]:
return tuple(values)
def sample_timeline(events: Iterable[LogEvent], *, limit: int = 20) -> list[dict[str, str]]:
samples = [
{
"stream": event.fields.get("fgai_stream", "local_syslog"),
"timestamp": event.fields.get("eventtime", event.fields.get("timestamp", "")),
"type": canonical_value(event.fields, "type"),
"subtype": event.subtype,
"action": event.action,
"severity": event.severity,
"destination": event.dst_ip or canonical_value(event.fields, "context"),
"service": canonical_value(event.fields, "service"),
"context": canonical_value(event.fields, "context")[:240],
}
for event in events
]
def _timeline_sample(event: LogEvent) -> dict[str, object]:
query_details = event_query_details(event)
return {
"stream": event.fields.get("fgai_stream", "local_syslog"),
"timestamp": event.fields.get("eventtime", event.fields.get("timestamp", "")),
"type": canonical_value(event.fields, "type"),
"subtype": event.subtype,
"action": event.action,
"severity": event.severity,
"destination": event.dst_ip or canonical_value(event.fields, "context"),
"service": canonical_value(event.fields, "service"),
"context": canonical_value(event.fields, "context")[:240],
"query_details": query_details,
"graylog_query": query_details["query"],
}
def sample_timeline(events: Iterable[LogEvent], *, limit: int = 20) -> list[dict[str, object]]:
samples = [_timeline_sample(event) for event in events]
return sorted(samples, key=lambda item: item["timestamp"])[-limit:]