Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add mcp earch

Browse Source
This commit is contained in:
larssand
2026-06-21 22:15:02 +02:00
parent 0daa34cb03
commit 5010e53e0a
6 changed files with 111 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
src/fgai/monitor.py
View File

@@ -8,6 +8,7 @@ from .anomaly import anomaly_summary, detect_source_anomalies
from .baseline import BaselineStore
from .config import ConfigStore
from .graylog_mcp import GraylogMcpClient
from .graylog_source import GraylogStreamSource
from .llm import ollama_dashboard_assessment
from .logs import local_in_failures, read_events, summarize_events, top_field_values
from .mitigation import parse_allowlist, suggest_block_candidates
@@ -26,26 +27,27 @@ def build_status(
baseline_path: str | None = None,
config_path: str | None = None,
) -> dict[str, object]:
events = read_events(log_path) if Path(log_path).exists() else []
baseline = BaselineStore(baseline_path) if baseline_path else None
profiles = baseline.profiles({event.src_ip for event in events if event.src_ip}) if baseline else {}
anomalies = detect_source_anomalies(events, limit=anomaly_limit, baselines=profiles)
baseline_events = baseline.ingest(events) if baseline else 0
config_store = ConfigStore(config_path) if config_path else None
config_exists = bool(config_store and config_store.path.exists())
runtime_values = config_store.read() if config_exists and config_store else {}
runtime_config = config_store.public() if config_store else {}
events = read_events(log_path) if Path(log_path).exists() else []
mcp_status: dict[str, object] = {"status": "not_configured"}
if runtime_values.get("log_source") == "graylog_mcp":
url = str(runtime_values.get("graylog_mcp_url", ""))
token = str(runtime_values.get("graylog_mcp_token", ""))
url, token = str(runtime_values.get("graylog_mcp_url", "")), str(runtime_values.get("graylog_mcp_token", ""))
if not url or not token:
mcp_status = {"status": "missing_configuration"}
events = []
else:
try:
mcp_status = GraylogMcpClient(url, token).probe()
events, mcp_status = GraylogStreamSource(GraylogMcpClient(url, token), str(runtime_values.get("graylog_stream", "")), str(runtime_values.get("graylog_query", "*")), str(runtime_values.get("graylog_field_mapping", ""))).fetch()
except RuntimeError as exc:
mcp_status = {"status": "error", "error": str(exc)}
events = []
baseline = BaselineStore(baseline_path) if baseline_path else None
profiles = baseline.profiles({event.src_ip for event in events if event.src_ip}) if baseline else {}
anomalies = detect_source_anomalies(events, limit=anomaly_limit, baselines=profiles)
baseline_events = baseline.ingest(events) if baseline else 0
intel_ips = sorted(
{
ip