Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Ny central normalisering

Browse Source
This commit is contained in:
larssand
2026-06-29 18:55:18 +02:00
parent 0b31e6c55e
commit 20b0e0a92e
13 changed files with 146 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/fgai/sequences.py
View File

@@ -7,6 +7,7 @@ from .detectors import event_detector_categories
from .entities import event_entities
from .logs import THREAT_ACTIONS
from .models import LogEvent
from .normalization import canonical_value
DEFAULT_SEQUENCE_PATTERNS = {
@@ -38,9 +39,9 @@ def _timestamp(event: LogEvent, fallback: int) -> int:
def _is_network_event(event: LogEvent) -> bool:
if event.fields.get("dstip") or event.fields.get("destination_ip") or event.fields.get("dst_ip"):
if event.dst_ip:
return True
if event.fields.get("dstport") or event.fields.get("destination_port") or event.fields.get("service"):
if canonical_value(event.fields, "dstport") or canonical_value(event.fields, "service"):
return True
return event.action in {"accept", "pass", "allowed", "allow", "close", "client-rst", "server-rst"} | THREAT_ACTIONS
@@ -50,12 +51,12 @@ def _sample(event: LogEvent, value: str) -> dict[str, str]:
"timestamp": event.fields.get("eventtime", event.fields.get("timestamp", "")),
"stream": event.fields.get("fgai_stream", event.fields.get("fgai_stream_id", "")),
"source": event.src_ip or event.fields.get("source", ""),
"destination": event.dst_ip or event.fields.get("query_domain", event.fields.get("qh", "")),
"destination": event.dst_ip or canonical_value(event.fields, "context"),
"action": event.action,
"severity": event.severity,
"service": event.fields.get("service", event.fields.get("query_type", "")),
"service": canonical_value(event.fields, "service"),
"value": value,
"message": event.fields.get("message", event.fields.get("msg", ""))[:240],
"message": canonical_value(event.fields, "context")[:240],
}