Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ny central normalisering

Browse Source
This commit is contained in:
larssand
2026-06-29 18:55:18 +02:00
parent 0b31e6c55e
commit 20b0e0a92e
13 changed files with 146 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
src/fgai/graylog_source.py
View File

@@ -5,19 +5,10 @@ from collections.abc import Iterable
from .graylog_mcp import GraylogMcpClient
from .models import LogEvent
from .normalization import DEFAULT_SEARCH_FIELDS, normalize_fields
DEFAULT_FIELD_MAP = {
"srcip": ("srcip", "src_ip", "source_ip", "client_ip", "ip", "client"),
"dstip": ("dstip", "dst_ip", "destination_ip", "server_ip", "upstream"),
"dstport": ("dstport", "dst_port", "destination_port"),
"srcport": ("srcport", "src_port", "source_port"),
"eventtime": ("eventtime", "timestamp", "time"),
"severity": ("severity", "level"),
"action": ("action", "event_action", "disposition"),
}
DEFAULT_FIELDS = ["timestamp", "source", "srcip", "src_ip", "source_ip", "client_ip", "ip", "dstip", "dst_ip", "destination_ip", "upstream", "query_domain", "qh", "qt", "query_type", "dns_query", "srcport", "dstport", "service", "action", "status", "eventid", "event_id", "winlog_event_id", "severity", "policyid", "subtype", "type", "sentbyte", "rcvdbyte", "hitcount", "elapsed", "message"]
DEFAULT_FIELDS = list(dict.fromkeys([*DEFAULT_SEARCH_FIELDS, "source", "eventid", "event_id", "winlog_event_id", "policyid", "policy_id", "policy", "rule", "rule_name", "sentbyte", "rcvdbyte", "bytes_in", "bytes_out", "hitcount", "elapsed"]))
def _records(value: object) -> Iterable[dict[str, object]]:
@@ -92,11 +83,4 @@ class GraylogStreamSource:
fields = {str(key).lower(): str(value) for key, value in record.items() if value is not None}
fields["fgai_stream"] = self.stream_label
fields["fgai_stream_id"] = self.stream
for canonical, candidates in DEFAULT_FIELD_MAP.items():
mapped = self.mapping.get(canonical)
candidates = (str(mapped),) if mapped else candidates
for candidate in candidates:
if candidate.lower() in fields:
fields[canonical] = fields[candidate.lower()]
break
return LogEvent(raw=json.dumps(record, sort_keys=True), fields=fields)
return LogEvent(raw=json.dumps(record, sort_keys=True), fields=normalize_fields(fields, self.mapping))