Ny central normalisering

2026-06-29 18:55:18 +02:00
parent 0b31e6c55e
commit 20b0e0a92e
13 changed files with 146 additions and 43 deletions
--- a/src/fgai/detectors.py
+++ b/src/fgai/detectors.py
@@ -18,7 +18,7 @@ def event_detector_categories(event: LogEvent) -> tuple[str, ...]:
    categories: list[str] = []
    if action in {"fail", "failed", "failure", "login_failed", "logon_failed", "authentication_failed"} or event_id == "4625":
        categories.append("auth_failure")
-    if fields.get("query_domain") or fields.get("qh") or fields.get("dns_query"):
+    if fields.get("dns_query"):
        categories.append("dns_query")
    if action in THREAT_ACTIONS:
        categories.append("deny_action")