Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MCP sample fetch now asks for common Winlogbeat/ECS fields before

Browse Source
This commit is contained in:
larssand
2026-06-30 15:10:47 +02:00
parent b8fe738aa1
commit 4a441bf443
8 changed files with 307 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/fgai/entities.py
View File

@@ -9,9 +9,9 @@ from .query_details import event_query_details
ENTITY_FIELDS: dict[str, tuple[str, ...]] = {
"ip": ("srcip", "src_ip", "source_ip", "client_ip", "remote_addr", "remote_ip", "ip", "ipaddress", "winlog_event_data_ipaddress", "event_data_ipaddress"),
"user": ("username", "user", "user_name", "account", "account_name", "targetusername", "subjectusername", "xauthuser", "winlog_event_data_targetusername", "winlog_event_data_subjectusername"),
"host": ("hostname", "host", "computer", "computer_name", "workstation", "device_name", "winlog_computer_name", "agent_name"),
"ip": ("srcip", "src_ip", "source_ip", "source.ip", "client_ip", "client.ip", "remote_addr", "remote_ip", "ip", "ipaddress", "winlog_event_data_ipaddress", "winlog.event_data.ipaddress", "winlog.event_data.ip_address", "event_data_ipaddress"),
"user": ("username", "user", "user.name", "user_name", "account", "account_name", "targetusername", "subjectusername", "xauthuser", "winlog_event_data_targetusername", "winlog.event_data.targetusername", "winlog_event_data_subjectusername", "winlog.event_data.subjectusername"),
"host": ("hostname", "host", "host.name", "computer", "computer_name", "workstation", "device_name", "winlog_computer_name", "winlog.computer_name", "agent.hostname", "agent_name"),
}

25
src/fgai/graylog_source.py
View File

@@ -8,7 +8,30 @@ from .models import LogEvent
from .normalization import DEFAULT_SEARCH_FIELDS, normalize_fields
DEFAULT_FIELDS = list(dict.fromkeys([*DEFAULT_SEARCH_FIELDS, "source", "eventid", "event_id", "winlog_event_id", "policyid", "policy_id", "policy", "rule", "rule_name", "sentbyte", "rcvdbyte", "bytes_in", "bytes_out", "hitcount", "elapsed"]))
WINDOWS_DISCOVERY_FIELDS = (
"winlog.channel",
"winlog.provider_name",
"winlog.record_id",
"winlog.process.pid",
"winlog.process.thread.id",
"winlog.task",
"winlog.opcode",
"winlog.keywords",
"winlog.event_data.logontype",
"winlog.event_data.logon_type",
"winlog.event_data.authenticationpackagename",
"winlog.event_data.logonprocessname",
"winlog.event_data.failurereason",
"winlog.event_data.status",
"winlog.event_data.substatus",
"process.name",
"process.executable",
"process.pid",
"process.command_line",
"service.name",
)
DEFAULT_FIELDS = list(dict.fromkeys([*DEFAULT_SEARCH_FIELDS, *WINDOWS_DISCOVERY_FIELDS, "source", "eventid", "event_id", "winlog_event_id", "policyid", "policy_id", "policy", "rule", "rule_name", "sentbyte", "rcvdbyte", "bytes_in", "bytes_out", "hitcount", "elapsed"]))
def _records(value: object) -> Iterable[dict[str, object]]:

24
src/fgai/normalization.py
View File

@@ -2,21 +2,21 @@ from __future__ import annotations
FIELD_ALIASES: dict[str, tuple[str, ...]] = {
"srcip": ("srcip", "src_ip", "source_ip", "source.ip", "src", "src_addr", "srcaddr", "sourceaddress", "client_ip", "client.ip", "clientip", "client", "remote_addr", "remote_ip", "ip", "ipaddress", "gl2_remote_ip", "winlog_event_data_ipaddress", "event_data_ipaddress"),
"dstip": ("dstip", "dst_ip", "destination_ip", "destination.ip", "dst", "dst_addr", "dstaddr", "destinationaddress", "dest_ip", "dest", "server_ip", "server.ip", "server", "upstream"),
"srcip": ("srcip", "src_ip", "source_ip", "source.ip", "source.address", "src", "src_addr", "srcaddr", "sourceaddress", "client_ip", "client.ip", "client.address", "clientip", "client", "remote_addr", "remote_ip", "ip", "ipaddress", "related.ip", "gl2_remote_ip", "winlog_event_data_ipaddress", "winlog.event_data.ipaddress", "winlog.event_data.ip_address", "event_data_ipaddress"),
"dstip": ("dstip", "dst_ip", "destination_ip", "destination.ip", "destination.address", "dst", "dst_addr", "dstaddr", "destinationaddress", "dest_ip", "dest", "server_ip", "server.ip", "server.address", "server", "upstream"),
"srcport": ("srcport", "src_port", "source_port", "source.port", "sport", "client_port", "client.port", "clientport"),
"dstport": ("dstport", "dst_port", "destination_port", "destination.port", "dest_port", "dport", "server_port", "server.port", "serverport"),
"eventtime": ("eventtime", "timestamp", "time", "event_time", "eventtime_ms", "created_at"),
"severity": ("severity", "level", "priority", "sev", "loglevel", "log_level", "event_severity"),
"action": ("action", "act", "fw_action", "rule_action", "policy_action", "event_action", "disposition", "outcome", "result", "status", "event_outcome"),
"type": ("type", "event_type", "log_type", "category", "event_category", "facility"),
"subtype": ("subtype", "sub_type", "event_subtype", "subcategory"),
"service": ("service", "service_name", "dst_service", "app", "appname", "application", "application_name", "proto", "protocol", "transport", "network.transport", "query_type", "qt"),
"username": ("username", "targetusername", "target_user_name", "winlog_event_data_targetusername", "subjectusername", "subject_user_name", "winlog_event_data_subjectusername", "user", "user_name", "account", "account_name", "xauthuser", "actor", "actor_id", "principal", "principal_name", "login", "login_name"),
"hostname": ("hostname", "host", "computer", "computer_name", "workstation", "workstation_name", "device_name", "agent_name", "winlog_computer_name", "host.name", "agent.name"),
"eventid": ("eventid", "event_id", "winlog_event_id", "event_code", "event.code", "windows_event_id"),
"eventtime": ("eventtime", "timestamp", "@timestamp", "time", "event_time", "eventtime_ms", "created_at", "event.created", "event.ingested", "winlog.time_created"),
"severity": ("severity", "level", "priority", "sev", "loglevel", "log_level", "log.level", "event_severity", "event.severity", "winlog.level", "winlog.level_name"),
"action": ("action", "act", "fw_action", "rule_action", "policy_action", "event_action", "event.action", "disposition", "outcome", "result", "status", "event_outcome", "event.outcome"),
"type": ("type", "event_type", "log_type", "category", "event_category", "event.category", "event.kind", "event.module", "event.dataset", "facility"),
"subtype": ("subtype", "sub_type", "event_subtype", "subcategory", "event.type"),
"service": ("service", "service_name", "service.name", "dst_service", "app", "appname", "application", "application_name", "proto", "protocol", "transport", "network.transport", "network.protocol", "query_type", "qt"),
"username": ("username", "targetusername", "target_user_name", "winlog_event_data_targetusername", "winlog.event_data.targetusername", "winlog.event_data.target_user_name", "subjectusername", "subject_user_name", "winlog_event_data_subjectusername", "winlog.event_data.subjectusername", "winlog.event_data.subject_user_name", "user", "user.name", "user.id", "user_name", "account", "account_name", "xauthuser", "actor", "actor_id", "principal", "principal_name", "login", "login_name"),
"hostname": ("hostname", "host", "host.name", "computer", "computer_name", "workstation", "workstation_name", "device_name", "agent_name", "agent.hostname", "agent.name", "observer.hostname", "winlog_computer_name", "winlog.computer_name"),
"eventid": ("eventid", "event_id", "winlog_event_id", "winlog.event_id", "event_code", "event.code", "windows_event_id"),
"dns_query": ("dns_query", "query_domain", "qh", "dns_question", "question", "queried_domain"),
"context": ("query_domain", "qh", "dns_query", "url", "uri", "request", "request_uri", "path", "domain", "hostname", "message", "msg", "full_message", "event_message", "event_original"),
"context": ("query_domain", "qh", "dns_query", "url", "url.full", "url.path", "uri", "request", "request_uri", "path", "domain", "hostname", "message", "msg", "full_message", "event_message", "event_original", "event.original", "process.command_line", "powershell.command.value"),
}
DEFAULT_SEARCH_FIELDS = tuple(dict.fromkeys(field for aliases in FIELD_ALIASES.values() for field in aliases))

175
src/fgai/profile_suggestions.py
View File

@@ -57,6 +57,99 @@ CATEGORICAL_PRIORITY = (
"context",
)
NUMERIC_PRIORITY = ("hitcount", "sentbyte", "rcvdbyte", "duration", "elapsed", "proto", "eventid", "event_id", "winlog_event_id", "event_code")
WINDOWS_ENTITY_PRIORITY = (
"username",
"user.name",
"user.id",
"hostname",
"host.name",
"srcip",
"source.ip",
"client.ip",
"source",
"targetusername",
"winlog_event_data_targetusername",
"winlog.event_data.targetusername",
"winlog.event_data.target_user_name",
"subjectusername",
"winlog_event_data_subjectusername",
"winlog.event_data.subjectusername",
"winlog.event_data.subject_user_name",
"user",
"account_name",
"computer",
"computer_name",
"winlog_computer_name",
"winlog.computer_name",
"agent.hostname",
"source_ip",
"client_ip",
"winlog_event_data_ipaddress",
"winlog.event_data.ipaddress",
"winlog.event_data.ip_address",
"ipaddress",
)
WINDOWS_CATEGORICAL_PRIORITY = (
"eventid",
"event_id",
"winlog_event_id",
"winlog.event_id",
"event_code",
"event.code",
"action",
"event.action",
"event.outcome",
"severity",
"channel",
"winlog.channel",
"provider_name",
"event_provider",
"event.provider",
"winlog_provider_name",
"winlog.provider_name",
"logon_type",
"winlog.event_data.logontype",
"winlog.event_data.logon_type",
"event.category",
"event.type",
"event.kind",
"event.module",
"event.dataset",
"task",
"winlog.task",
"opcode",
"winlog.opcode",
"keywords",
"winlog.keywords",
"process_name",
"process.name",
"process.executable",
"image",
"service_name",
"service.name",
"authentication_package_name",
"winlog.event_data.authenticationpackagename",
"logon_process_name",
"winlog.event_data.logonprocessname",
"failure_reason",
"winlog.event_data.failurereason",
"sub_status",
"winlog.event_data.substatus",
"status",
"winlog.event_data.status",
)
WINDOWS_NUMERIC_PRIORITY = (
"event_record_id",
"record_id",
"winlog_record_id",
"winlog.record_id",
"process_id",
"process.pid",
"winlog_process_pid",
"winlog.process.pid",
"thread_id",
"winlog.process.thread.id",
)
ALLOWED_DETECTORS = {"auth_failure", "dns_query", "deny_action"}
IGNORED_DISCOVERY_FIELDS = {
"message",
@@ -112,6 +205,43 @@ def _looks_like_time_field(field: str) -> bool:
return any(token in field for token in ("time", "timestamp", "created", "@timestamp"))
def _looks_like_windows_stream(stream_id: str, stream_name: str, coverage: Counter[str]) -> bool:
name = f"{stream_id} {stream_name}".lower()
if any(token in name for token in ("windows", "winlog", "event log", "security event", "sysmon", "powershell")):
return True
windows_fields = {
"winlog_event_id",
"winlog.event_id",
"winlog_computer_name",
"winlog.computer_name",
"winlog_event_data_targetusername",
"winlog.event_data.targetusername",
"winlog_event_data_subjectusername",
"winlog.event_data.subjectusername",
"eventid",
"event_code",
"event.code",
"logon_type",
"winlog.channel",
}
return sum(1 for field in windows_fields if coverage[field]) >= 2
def _compact_windows_fields(fields: list[str]) -> list[str]:
output = list(dict.fromkeys(fields))
alias_groups = (
("username", "user.name", "user.id", "targetusername", "winlog_event_data_targetusername", "winlog.event_data.targetusername", "winlog.event_data.target_user_name", "subjectusername", "winlog_event_data_subjectusername", "winlog.event_data.subjectusername", "winlog.event_data.subject_user_name", "user", "account_name"),
("hostname", "host.name", "computer", "computer_name", "winlog_computer_name", "winlog.computer_name", "agent.hostname"),
("srcip", "source.ip", "source_ip", "client.ip", "client_ip", "winlog_event_data_ipaddress", "winlog.event_data.ipaddress", "winlog.event_data.ip_address", "ipaddress"),
("eventid", "event_id", "winlog_event_id", "winlog.event_id", "event_code", "event.code"),
("action", "event.action", "event.outcome"),
)
for canonical, *aliases in alias_groups:
if canonical in output:
output = [field for field in output if field == canonical or field not in aliases]
return output
def _generic_entity_fields(coverage: Counter[str], unique_values: dict[str, set[str]], total: int, selected: list[str]) -> list[str]:
output = list(selected)
for field, count in coverage.most_common():
@@ -244,24 +374,59 @@ def suggest_stream_profiles(events: list[LogEvent], *, existing_profiles: dict[s
numeric_counts[field] += 1
detector_counts.update(event_detector_categories(event))
entity_fields = _generic_entity_fields(coverage, unique_values, total, _pick_present(ENTITY_PRIORITY, coverage, total, min_ratio=0.02, limit=3))
stream_name = names.get(stream_id, stream_id)
is_windows = _looks_like_windows_stream(stream_id, stream_name, coverage)
entity_priority = WINDOWS_ENTITY_PRIORITY if is_windows else ENTITY_PRIORITY
categorical_priority = WINDOWS_CATEGORICAL_PRIORITY if is_windows else CATEGORICAL_PRIORITY
numeric_priority = WINDOWS_NUMERIC_PRIORITY if is_windows else NUMERIC_PRIORITY
entity_fields = _generic_entity_fields(coverage, unique_values, total, _pick_present(entity_priority, coverage, total, min_ratio=0.02, limit=12 if is_windows else 3))
timestamp = next(iter(_pick_present(TIME_PRIORITY, coverage, total, min_ratio=0.02, limit=1)), "")
if not timestamp:
timestamp = next((field for field, count in coverage.most_common() if _looks_like_time_field(field) and count / max(1, total) >= 0.02), "timestamp")
categorical = _generic_categorical_fields(coverage, unique_values, total, _pick_present(CATEGORICAL_PRIORITY, coverage, total, min_ratio=0.02, limit=8))
numeric = _generic_numeric_fields(coverage, numeric_counts, total, [
field for field in NUMERIC_PRIORITY
categorical = _generic_categorical_fields(coverage, unique_values, total, _pick_present(categorical_priority, coverage, total, min_ratio=0.02, limit=10 if is_windows else 8))
numeric_seed = [
field for field in numeric_priority
if coverage[field] and numeric_counts[field] / max(1, coverage[field]) >= 0.8
][:5])
][:5]
numeric = numeric_seed if is_windows else _generic_numeric_fields(coverage, numeric_counts, total, numeric_seed)
if not entity_fields:
entity_fields = [field for field, _count in coverage.most_common() if field not in IGNORED_DISCOVERY_FIELDS][:1]
if not entity_fields:
entity_fields = ["source"]
if is_windows:
entity_fields = _compact_windows_fields(entity_fields)[:4]
categorical = _compact_windows_fields(categorical)
entity_set = set(entity_fields)
categorical = [
field for field in categorical
if field not in entity_set and field not in {
"srcip", "source.ip", "source_ip", "client.ip", "client_ip",
"hostname", "host.name", "computer", "username", "user.name",
"source", "context",
}
][:10]
for field in WINDOWS_CATEGORICAL_PRIORITY:
if len(categorical) >= 10:
break
compacted = _compact_windows_fields([*categorical, field])
if field not in compacted or field in categorical:
continue
if not coverage[field] or len(unique_values[field]) <= 1:
continue
if field in entity_set or field in {"srcip", "source.ip", "client.ip", "hostname", "host.name", "username", "user.name"}:
continue
categorical = compacted
numeric = [
field for field in _compact_windows_fields(numeric)
if field not in set(categorical) and field not in {"eventid", "event_id", "winlog_event_id", "winlog.event_id", "event_code", "event.code", "logon_type"}
][:5]
detectors = {
name: {"enabled": True, "minimum": 5 if name == "auth_failure" else 10, "z_threshold": 3.0}
for name, count in detector_counts.items()
if count > 0
}
if is_windows and coverage["eventid"]:
detectors.setdefault("auth_failure", {"enabled": True, "minimum": 5, "z_threshold": 3.0})
if not detectors:
detectors = {"deny_action": {"enabled": True, "minimum": 10, "z_threshold": 3.0}}
high_coverage = [