Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

policy 0 is deny

Browse Source
This commit is contained in:
larssand
2026-06-18 23:07:02 +02:00
parent 6530e51700
commit 6117013c6e
3 changed files with 36 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/fgai/anomaly.py
View File

@@ -76,7 +76,8 @@ def detect_source_anomalies(events: list[LogEvent], *, limit: int = 20) -> list[
deny_count = sum(1 for event in src_events if event.action in THREAT_ACTIONS)
utm_count = sum(1 for event in src_events if is_utm_event(event))
high_severity_count = sum(1 for event in src_events if event.severity in {"critical", "high", "alert", "emergency"})
policies = {event.fields.get("policyid") for event in src_events if event.fields.get("policyid")}
policies = {event.fields.get("policyid") for event in src_events if event.fields.get("policyid") and event.fields.get("policyid") != "0"}
implicit_deny_count = sum(1 for event in src_events if event.fields.get("policyid") == "0")
reasons: list[str] = []
score = 0
@@ -105,6 +106,10 @@ def detect_source_anomalies(events: list[LogEvent], *, limit: int = 20) -> list[
score += min(20, 8 + int(deny_rate * 12))
reasons.append(f"high deny/threat-action rate ({deny_count}/{event_count})")
if implicit_deny_count >= 10:
score += min(15, 5 + implicit_deny_count // 10)
reasons.append(f"implicit FortiGate deny/drop hits observed (policyid=0, {implicit_deny_count} events)")
if utm_count:
utm_score = sum(event_score(event) for event in src_events if is_utm_event(event))
points = min(35, 5 + utm_score)
@@ -143,6 +148,7 @@ def detect_source_anomalies(events: list[LogEvent], *, limit: int = 20) -> list[
"high_severity_events": high_severity_count,
"total_bytes": total_bytes,
"policy_count": len(policies),
"implicit_deny_events": implicit_deny_count,
},
)
)