From 5b217a12ff699695b26ec6c2a2139ab5a9785a1fc8dc99cf8cf0eb60b8ddac40 Mon Sep 17 00:00:00 2001
From: larssand <larssand@LPW0JW6L1>
Date: Mon, 22 Jun 2026 19:41:48 +0200
Subject: [PATCH] add better correlatin

---
 src/fgai/correlation.py    | 1 +
 src/fgai/dashboard.py      | 2 +-
 src/fgai/graylog_source.py | 6 +++---
 3 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/fgai/correlation.py b/src/fgai/correlation.py
index 28f9dff..4b39fba 100644
--- a/src/fgai/correlation.py
+++ b/src/fgai/correlation.py
@@ -22,6 +22,7 @@ def correlate_source_ips(events: list[LogEvent], *, limit: int = 20) -> list[dic
                 "stream": event.fields.get("fgai_stream", "local_syslog"), "timestamp": event.fields.get("eventtime", event.fields.get("timestamp", "")),
                 "type": event.fields.get("type", ""), "subtype": event.subtype, "action": event.action,
                 "severity": event.severity, "destination": event.dst_ip or "", "service": event.fields.get("service", ""),
+                "context": event.fields.get("query_domain", event.fields.get("qh", event.fields.get("message", ""))),
             }
             for event in source_events[:20]
         ]
diff --git a/src/fgai/dashboard.py b/src/fgai/dashboard.py
index 2febba4..4e34549 100644
--- a/src/fgai/dashboard.py
+++ b/src/fgai/dashboard.py
@@ -143,7 +143,7 @@ async function refresh() {
   document.getElementById('relatedActivity').innerHTML = table(relatedRows, [
     {label:'Source IP', key:'source_ip'}, {label:'Stream', key:'stream'}, {label:'Time', key:'timestamp'},
     {label:'Type', key:'type'}, {label:'Action', key:'action'}, {label:'Severity', key:'severity'},
-    {label:'Destination', key:'destination'}, {label:'Service', key:'service'}
+    {label:'Destination', key:'destination'}, {label:'Service', key:'service'}, {label:'Context', key:'context'}
   ]);
   document.getElementById('reputation').innerHTML = table(reputationRows, [
     {label:'IP', key:'ip'},
diff --git a/src/fgai/graylog_source.py b/src/fgai/graylog_source.py
index 36ba153..ffc9e41 100644
--- a/src/fgai/graylog_source.py
+++ b/src/fgai/graylog_source.py
@@ -8,8 +8,8 @@ from .models import LogEvent
 
 
 DEFAULT_FIELD_MAP = {
-    "srcip": ("srcip", "src_ip", "source_ip", "client_ip"),
-    "dstip": ("dstip", "dst_ip", "destination_ip", "server_ip"),
+    "srcip": ("srcip", "src_ip", "source_ip", "client_ip", "ip", "client"),
+    "dstip": ("dstip", "dst_ip", "destination_ip", "server_ip", "upstream"),
     "dstport": ("dstport", "dst_port", "destination_port"),
     "srcport": ("srcport", "src_port", "source_port"),
     "eventtime": ("eventtime", "timestamp", "time"),
@@ -17,7 +17,7 @@ DEFAULT_FIELD_MAP = {
     "action": ("action", "event_action", "disposition"),
 }
 
-DEFAULT_FIELDS = ["timestamp", "source", "srcip", "dstip", "srcport", "dstport", "service", "action", "severity", "policyid", "subtype", "type", "sentbyte", "rcvdbyte", "hitcount"]
+DEFAULT_FIELDS = ["timestamp", "source", "srcip", "src_ip", "source_ip", "client_ip", "ip", "dstip", "dst_ip", "destination_ip", "upstream", "query_domain", "qh", "qt", "query_type", "srcport", "dstport", "service", "action", "severity", "policyid", "subtype", "type", "sentbyte", "rcvdbyte", "hitcount", "elapsed", "message"]
 
 
 def _records(value: object) -> Iterable[dict[str, object]]: