Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add settings in UI

Browse Source
This commit is contained in:
larssand
2026-06-21 21:30:59 +02:00
parent 5bb381a063
commit 5bd720f4d5
7 changed files with 159 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
src/fgai/monitor.py
View File

@@ -6,6 +6,7 @@ from pathlib import Path
from .anomaly import anomaly_summary, detect_source_anomalies
from .baseline import BaselineStore
from .config import ConfigStore
from .llm import ollama_dashboard_assessment
from .logs import local_in_failures, read_events, summarize_events, top_field_values
from .mitigation import parse_allowlist, suggest_block_candidates
@@ -22,12 +23,17 @@ def build_status(
min_block_score: int = 7,
anomaly_limit: int = 20,
baseline_path: str | None = None,
config_path: str | None = None,
) -> dict[str, object]:
events = read_events(log_path) if Path(log_path).exists() else []
baseline = BaselineStore(baseline_path) if baseline_path else None
profiles = baseline.profiles({event.src_ip for event in events if event.src_ip}) if baseline else {}
anomalies = detect_source_anomalies(events, limit=anomaly_limit, baselines=profiles)
baseline_events = baseline.ingest(events) if baseline else 0
config_store = ConfigStore(config_path) if config_path else None
config_exists = bool(config_store and config_store.path.exists())
runtime_values = config_store.read() if config_exists and config_store else {}
runtime_config = config_store.public() if config_store else {}
intel_ips = sorted(
{
ip
@@ -36,8 +42,9 @@ def build_status(
if is_public_ip(ip)
}
)
reputation = enrich_ips(intel_ips, limit=25)
threat_intel_status = ThreatIntelClient().status()
threat_enabled = bool(runtime_values.get("threat_intel_enabled")) if runtime_values else None
reputation = enrich_ips(intel_ips, limit=25, enabled=threat_enabled)
threat_intel_status = ThreatIntelClient(enabled=threat_enabled).status()
recommendations = build_recommendations(events, anomalies, reputation)
block_candidates = suggest_block_candidates(
events,
@@ -62,6 +69,7 @@ def build_status(
"anomaly_summary": anomaly_summary(anomalies),
"baseline": {"enabled": bool(baseline), "sources_ready": len(profiles), "new_events_recorded": baseline_events},
"capabilities": {"threat_intel": threat_intel_status},
"configuration": runtime_config,
"diagnostics": {
"top_source_ips": top_field_values(events, "srcip", limit=10),
"top_destination_ips": top_field_values(events, "dstip", limit=10),
@@ -145,17 +153,24 @@ def monitor_loop(
llm_model: str | None = None,
llm_timeout: int | None = None,
baseline_path: str | None = None,
config_path: str | None = None,
) -> None:
print(f"Monitoring {log_path}")
print(f"Writing status to {output}")
last_llm_at = 0
last_llm_text: str | None = None
while True:
status = build_status(log_path, policy_path=policy_path, anomaly_limit=anomaly_limit, baseline_path=baseline_path)
if llm:
runtime = ConfigStore(config_path).read() if config_path and Path(config_path).exists() else {}
effective_llm = bool(runtime.get("llm_enabled")) if runtime else llm
effective_model = str(runtime.get("llm_model") or llm_model or "")
status = build_status(
log_path, policy_path=policy_path, anomaly_limit=anomaly_limit,
baseline_path=baseline_path, config_path=config_path,
)
if effective_llm:
now = int(time.time())
if now - last_llm_at >= llm_interval:
add_llm_assessment(status, previous=last_llm_text, model=llm_model, timeout=llm_timeout)
add_llm_assessment(status, previous=last_llm_text, model=effective_model or None, timeout=llm_timeout)
assessment = status.get("llm_assessment", {})
if isinstance(assessment, dict):
last_llm_text = str(assessment.get("text", "") or last_llm_text or "")