Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ny central normalisering

Browse Source
This commit is contained in:
larssand
2026-06-29 18:55:18 +02:00
parent 0b31e6c55e
commit 20b0e0a92e
13 changed files with 146 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
README.md
View File

@@ -79,6 +79,13 @@ The dashboard and Ollama then correlate behavior across sources, for example a
client IP appearing in FortiGate, AdGuard/DNS, Windows Security, Nginx, Squid,
VPN, or Proxmox.
SignalScope keeps a common alias map for fields such as source IP, destination
IP, ports, action, severity, service/protocol, DNS query, URL, message, and event
type. This lets Related Activity and correlations work with firewall/proxy/DNS
streams that use names like `src_addr`, `destination.ip`, `dest_port`,
`fw_action`, `priority`, `proto`, or `full_message` without adding a new parser
for every product.
Correlation is entity-aware rather than FortiGate-specific. SignalScope recognizes
common IP fields such as `srcip`, `source_ip`, `remote_addr`, and Windows event
IP fields; account fields such as `username`, `user`, and `TargetUserName`; and