Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ny central normalisering

Browse Source
This commit is contained in:
larssand
2026-06-29 18:55:18 +02:00
parent 0b31e6c55e
commit 20b0e0a92e
13 changed files with 146 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/fgai/models.py
View File

@@ -2,6 +2,8 @@ from __future__ import annotations
from dataclasses import dataclass, field
from .normalization import canonical_value
@dataclass(frozen=True)
class LogEvent:
@@ -10,23 +12,23 @@ class LogEvent:
@property
def src_ip(self) -> str | None:
return self.fields.get("srcip") or self.fields.get("src_ip") or self.fields.get("source_ip")
return canonical_value(self.fields, "srcip") or None
@property
def dst_ip(self) -> str | None:
return self.fields.get("dstip") or self.fields.get("dst_ip") or self.fields.get("destination_ip")
return canonical_value(self.fields, "dstip") or None
@property
def subtype(self) -> str:
return self.fields.get("subtype", "").lower()
return canonical_value(self.fields, "subtype").lower()
@property
def action(self) -> str:
return self.fields.get("action", "").lower()
return canonical_value(self.fields, "action").lower()
@property
def severity(self) -> str:
return self.fields.get("severity", self.fields.get("level", "")).lower()
return canonical_value(self.fields, "severity").lower()
@dataclass(frozen=True)