Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MCP sample fetch now asks for common Winlogbeat/ECS fields before

Browse Source
This commit is contained in:
larssand
2026-06-30 15:10:47 +02:00
parent b8fe738aa1
commit 4a441bf443
8 changed files with 307 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
README.md
View File

@@ -72,6 +72,19 @@ validated against fields actually seen in the stream before it can be applied.
Unknown fields, raw message fields, internal `fgai_*` fields, and unknown
detectors are rejected.
Windows-like streams are recognized from stream names such as `Windows`,
`Winlog`, `Security Event Log`, `Sysmon`, and `Powershell`, or from Windows event
fields. The MCP search asks for common Winlogbeat/ECS names such as
`winlog.event_id`, `event.code`, `user.name`, `host.name`, `source.ip`,
`winlog.channel`, and `process.name` before a profile exists. Their default
recommendation favors normalized `username`, `hostname`, and `srcip` as
entities, then uses the observed Windows fields such as event ID,
action/outcome, channel/provider, `logon_type`, process/service fields, and
event category/type as categorical baseline fields. The authentication-failure
detector is enabled by default. You can still edit the applied profile per
stream when your Windows parser uses different field names or when a stream
contains a narrower log type.
Settings also lists locally installed Ollama models from `http://127.0.0.1:11434/api/tags`.
Click a model name to fill both the dashboard analyst model and profile advisor
model fields.
@@ -445,9 +458,9 @@ filebeat -e -c examples/filebeat-windows-synthetic.yml
Update the absolute JSONL path and Graylog host in the Filebeat template first.
Route `stream_hint: Windows` to a dedicated Graylog stream, then enable that
stream in SignalScope and configure a profile such as entity `user` or
`source_ip`, categorical `event_id`, `status`, `logon_type`, and numeric fields
when present. Filebeat uses its Logstash output to communicate with Graylog's
stream in SignalScope. The Settings page should recommend a Windows profile once
sample events have been fetched; apply it and adjust the entity/categorical
fields if your parser uses different names. Filebeat uses its Logstash output to communicate with Graylog's
Beats input on TCP `5044`. [Graylog Beats input documentation](https://go2docs.graylog.org/current/getting_in_log_data/beats_input.html)
For logs, configure FortiGate syslog to write into a local file such as `logs/fg_syslog.jsonl`. The parser supports common key/value syslog lines and JSONL.