Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fortsatte roadmapen med multi-entity stream profiles

Browse Source
This commit is contained in:
larssand
2026-06-29 19:08:23 +02:00
parent 20b0e0a92e
commit 68370217da
10 changed files with 102 additions and 60 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
README.md
View File

@@ -59,9 +59,9 @@ or a complete `Basic <value>` header. Tokens are stored only in the local runtim
configuration and are never returned by the dashboard API.
Use `Edit profile` on a stream to load its fields. The field table shows Graylog
datatype/capability metadata and lets you select an entity field, a time field,
and categorical/numeric fields for the stream profile. Profiles are stored under
`graylog_stream_profiles` in `state/fgai-config.json`.
datatype/capability metadata and lets you select one or more entity fields, a
time field, and categorical/numeric fields for the stream profile. Profiles are
stored under `graylog_stream_profiles` in `state/fgai-config.json`.
The settings page treats stream enablement and profile editing separately. The
checkboxes decide which streams are monitored. Click `Edit profile` on one stream
@@ -79,6 +79,11 @@ The dashboard and Ollama then correlate behavior across sources, for example a
client IP appearing in FortiGate, AdGuard/DNS, Windows Security, Nginx, Squid,
VPN, or Proxmox.
A stream profile can track multiple entities from the same event, such as
`username`, `srcip`, and `hostname`. SignalScope stores profile baselines for
each selected entity value, which makes cross-source investigation work even when
one source is user-centric and another is IP- or host-centric.
SignalScope keeps a common alias map for fields such as source IP, destination
IP, ports, action, severity, service/protocol, DNS query, URL, message, and event
type. This lets Related Activity and correlations work with firewall/proxy/DNS