Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ny central normalisering

Browse Source
This commit is contained in:
larssand
2026-06-29 18:55:18 +02:00
parent 0b31e6c55e
commit 20b0e0a92e
13 changed files with 146 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
src/fgai/entities.py
View File

@@ -4,6 +4,7 @@ import ipaddress
from collections.abc import Iterable
from .models import LogEvent
from .normalization import canonical_value
ENTITY_FIELDS: dict[str, tuple[str, ...]] = {
@@ -46,13 +47,13 @@ def sample_timeline(events: Iterable[LogEvent], *, limit: int = 20) -> list[dict
{
"stream": event.fields.get("fgai_stream", "local_syslog"),
"timestamp": event.fields.get("eventtime", event.fields.get("timestamp", "")),
"type": event.fields.get("type", ""),
"type": canonical_value(event.fields, "type"),
"subtype": event.subtype,
"action": event.action,
"severity": event.severity,
"destination": event.dst_ip or event.fields.get("query_domain", event.fields.get("url", "")),
"service": event.fields.get("service", event.fields.get("query_type", "")),
"context": event.fields.get("query_domain", event.fields.get("qh", event.fields.get("url", event.fields.get("message", event.fields.get("msg", "")))))[:240],
"destination": event.dst_ip or canonical_value(event.fields, "context"),
"service": canonical_value(event.fields, "service"),
"context": canonical_value(event.fields, "context")[:240],
}
for event in events
]