Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ny central normalisering

Browse Source
This commit is contained in:
larssand
2026-06-29 18:55:18 +02:00
parent 0b31e6c55e
commit 20b0e0a92e
13 changed files with 146 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
ROADMAP.md
View File

@@ -11,6 +11,7 @@ operational value and dependency, not by UI appeal.
- [x] Local five-minute field baselines with duplicate-event protection.
- [x] Time-aware baseline comparison using matching UTC weekday/hour when available.
- [x] Generic entity correlation for IP addresses, users, and hostnames.
- [x] Centralized common field alias normalization for firewall, DNS, proxy, endpoint, and web logs.
- [x] Cross-stream correlation timelines and investigation incident grouping.
- [x] Field-deviation review: expected, false positive, confirmed, note, and expiry.
- [x] Local Ollama analyst assessment with incident and feedback context.
@@ -106,6 +107,7 @@ Goal: add log sources and outputs without adding source-specific logic everywher
- [ ] Define versioned stream-profile templates for FortiGate, Windows, DNS/AdGuard, Nginx, Squid, VPN, and Proxmox.
- [x] Add inventory-style stream coverage to guide which streams need profiles before templates are added.
- [x] Add common alias normalizer so new firewall/proxy/DNS streams can populate source, destination, action, severity, service, and context without source-specific code.
- [ ] Add import/export for profile templates and detector settings.
- [ ] Separate source adapters, normalizers, detectors, enrichers, and output adapters into explicit extension interfaces.
- [ ] Add optional webhook/SIEM ticket output for confirmed high-severity incidents.