Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

MCP sample fetch now asks for common Winlogbeat/ECS fields before

Browse Source
This commit is contained in:
larssand
2026-06-30 15:10:47 +02:00
parent b8fe738aa1
commit 4a441bf443
8 changed files with 307 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
src/fgai/graylog_source.py
View File

@@ -8,7 +8,30 @@ from .models import LogEvent
from .normalization import DEFAULT_SEARCH_FIELDS, normalize_fields
DEFAULT_FIELDS = list(dict.fromkeys([*DEFAULT_SEARCH_FIELDS, "source", "eventid", "event_id", "winlog_event_id", "policyid", "policy_id", "policy", "rule", "rule_name", "sentbyte", "rcvdbyte", "bytes_in", "bytes_out", "hitcount", "elapsed"]))
WINDOWS_DISCOVERY_FIELDS = (
"winlog.channel",
"winlog.provider_name",
"winlog.record_id",
"winlog.process.pid",
"winlog.process.thread.id",
"winlog.task",
"winlog.opcode",
"winlog.keywords",
"winlog.event_data.logontype",
"winlog.event_data.logon_type",
"winlog.event_data.authenticationpackagename",
"winlog.event_data.logonprocessname",
"winlog.event_data.failurereason",
"winlog.event_data.status",
"winlog.event_data.substatus",
"process.name",
"process.executable",
"process.pid",
"process.command_line",
"service.name",
)
DEFAULT_FIELDS = list(dict.fromkeys([*DEFAULT_SEARCH_FIELDS, *WINDOWS_DISCOVERY_FIELDS, "source", "eventid", "event_id", "winlog_event_id", "policyid", "policy_id", "policy", "rule", "rule_name", "sentbyte", "rcvdbyte", "bytes_in", "bytes_out", "hitcount", "elapsed"]))
def _records(value: object) -> Iterable[dict[str, object]]: