Ny central normalisering

src/fgai/event_context.py

@@ -4,6 +4,7 @@ from collections import Counter, defaultdict
 
 from .logs import THREAT_ACTIONS, is_utm_event
 from .models import LogEvent
+from .normalization import canonical_value
 
 
 def _entity(event: LogEvent) -> str:
@@ -30,8 +31,8 @@ def build_event_context(events: list[LogEvent], *, source_limit: int = 30, sampl
 
     suspicious = [event for event in events if is_utm_event(event) or event.action in THREAT_ACTIONS or event.severity in {"critical", "high", "alert", "emergency"}]
     samples = [{
-        "entity": _entity(event), "type": event.fields.get("type", ""), "subtype": event.subtype,
-        "action": event.action, "severity": event.severity, "dst": event.dst_ip or "", "service": event.fields.get("service", ""),
+        "entity": _entity(event), "type": canonical_value(event.fields, "type"), "subtype": event.subtype,
+        "action": event.action, "severity": event.severity, "dst": event.dst_ip or canonical_value(event.fields, "context"), "service": canonical_value(event.fields, "service"),
         "policyid": event.fields.get("policyid", ""), "timestamp": event.fields.get("eventtime", event.fields.get("timestamp", "")),
     } for event in suspicious[:sample_limit]]
     return {