Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add better correlatin

Browse Source
This commit is contained in:
larssand
2026-06-22 19:41:48 +02:00
parent be8a597be0
commit 5b217a12ff
3 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
src/fgai/correlation.py
View File

@@ -22,6 +22,7 @@ def correlate_source_ips(events: list[LogEvent], *, limit: int = 20) -> list[dic
"stream": event.fields.get("fgai_stream", "local_syslog"), "timestamp": event.fields.get("eventtime", event.fields.get("timestamp", "")), "stream": event.fields.get("fgai_stream", "local_syslog"), "timestamp": event.fields.get("eventtime", event.fields.get("timestamp", "")),
"type": event.fields.get("type", ""), "subtype": event.subtype, "action": event.action, "type": event.fields.get("type", ""), "subtype": event.subtype, "action": event.action,
"severity": event.severity, "destination": event.dst_ip or "", "service": event.fields.get("service", ""), "severity": event.severity, "destination": event.dst_ip or "", "service": event.fields.get("service", ""),
"context": event.fields.get("query_domain", event.fields.get("qh", event.fields.get("message", ""))),
} }
for event in source_events[:20] for event in source_events[:20]
] ]

2
src/fgai/dashboard.py
View File

@@ -143,7 +143,7 @@ async function refresh() {
document.getElementById('relatedActivity').innerHTML = table(relatedRows, [ document.getElementById('relatedActivity').innerHTML = table(relatedRows, [
{label:'Source IP', key:'source_ip'}, {label:'Stream', key:'stream'}, {label:'Time', key:'timestamp'}, {label:'Source IP', key:'source_ip'}, {label:'Stream', key:'stream'}, {label:'Time', key:'timestamp'},
{label:'Type', key:'type'}, {label:'Action', key:'action'}, {label:'Severity', key:'severity'}, {label:'Type', key:'type'}, {label:'Action', key:'action'}, {label:'Severity', key:'severity'},
{label:'Destination', key:'destination'}, {label:'Service', key:'service'} {label:'Destination', key:'destination'}, {label:'Service', key:'service'}, {label:'Context', key:'context'}
]); ]);
document.getElementById('reputation').innerHTML = table(reputationRows, [ document.getElementById('reputation').innerHTML = table(reputationRows, [
{label:'IP', key:'ip'}, {label:'IP', key:'ip'},

6
src/fgai/graylog_source.py
View File

@@ -8,8 +8,8 @@ from .models import LogEvent
DEFAULT_FIELD_MAP = { DEFAULT_FIELD_MAP = {
"srcip": ("srcip", "src_ip", "source_ip", "client_ip"), "srcip": ("srcip", "src_ip", "source_ip", "client_ip", "ip", "client"),
"dstip": ("dstip", "dst_ip", "destination_ip", "server_ip"), "dstip": ("dstip", "dst_ip", "destination_ip", "server_ip", "upstream"),
"dstport": ("dstport", "dst_port", "destination_port"), "dstport": ("dstport", "dst_port", "destination_port"),
"srcport": ("srcport", "src_port", "source_port"), "srcport": ("srcport", "src_port", "source_port"),
"eventtime": ("eventtime", "timestamp", "time"), "eventtime": ("eventtime", "timestamp", "time"),
@@ -17,7 +17,7 @@ DEFAULT_FIELD_MAP = {
"action": ("action", "event_action", "disposition"), "action": ("action", "event_action", "disposition"),
} }
DEFAULT_FIELDS = ["timestamp", "source", "srcip", "dstip", "srcport", "dstport", "service", "action", "severity", "policyid", "subtype", "type", "sentbyte", "rcvdbyte", "hitcount"] DEFAULT_FIELDS = ["timestamp", "source", "srcip", "src_ip", "source_ip", "client_ip", "ip", "dstip", "dst_ip", "destination_ip", "upstream", "query_domain", "qh", "qt", "query_type", "srcport", "dstport", "service", "action", "severity", "policyid", "subtype", "type", "sentbyte", "rcvdbyte", "hitcount", "elapsed", "message"]
def _records(value: object) -> Iterable[dict[str, object]]: def _records(value: object) -> Iterable[dict[str, object]]: