Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add better correlatin

Browse Source
This commit is contained in:
larssand
2026-06-22 19:41:48 +02:00
parent be8a597be0
commit 5b217a12ff
3 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
src/fgai/graylog_source.py
View File

@@ -8,8 +8,8 @@ from .models import LogEvent
DEFAULT_FIELD_MAP = {
"srcip": ("srcip", "src_ip", "source_ip", "client_ip"),
"dstip": ("dstip", "dst_ip", "destination_ip", "server_ip"),
"srcip": ("srcip", "src_ip", "source_ip", "client_ip", "ip", "client"),
"dstip": ("dstip", "dst_ip", "destination_ip", "server_ip", "upstream"),
"dstport": ("dstport", "dst_port", "destination_port"),
"srcport": ("srcport", "src_port", "source_port"),
"eventtime": ("eventtime", "timestamp", "time"),
@@ -17,7 +17,7 @@ DEFAULT_FIELD_MAP = {
"action": ("action", "event_action", "disposition"),
}
DEFAULT_FIELDS = ["timestamp", "source", "srcip", "dstip", "srcport", "dstport", "service", "action", "severity", "policyid", "subtype", "type", "sentbyte", "rcvdbyte", "hitcount"]
DEFAULT_FIELDS = ["timestamp", "source", "srcip", "src_ip", "source_ip", "client_ip", "ip", "dstip", "dst_ip", "destination_ip", "upstream", "query_domain", "qh", "qt", "query_type", "srcport", "dstport", "service", "action", "severity", "policyid", "subtype", "type", "sentbyte", "rcvdbyte", "hitcount", "elapsed", "message"]
def _records(value: object) -> Iterable[dict[str, object]]: