Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

investigation export.

Browse Source
This commit is contained in:
larssand
2026-06-29 19:48:29 +02:00
parent 16b5bbdd63
commit 6ea8bfd714
6 changed files with 265 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
src/fgai/cli.py
View File

@@ -16,6 +16,7 @@ from .syslog_server import listen_udp_syslog
from .monitor import monitor_loop
from .threat_intel import enrich_ips, is_public_ip
from .config import ConfigStore
from .exports import investigation_report, investigation_report_markdown
from .graylog_mcp import GraylogMcpClient
from .graylog_source import GraylogStreamSource
from .replay import replay_comparison, replay_events
@@ -220,6 +221,22 @@ def run_dashboard(args: argparse.Namespace) -> int:
return 0
def export_investigation(args: argparse.Namespace) -> int:
status_path = Path(args.status_file)
status = json.loads(status_path.read_text(encoding="utf-8")) if status_path.exists() else {}
report = investigation_report(status, incident_id=args.incident_id or None)
fmt = "markdown" if args.format == "md" else args.format
output = investigation_report_markdown(report) if fmt == "markdown" else json.dumps(report, indent=2, sort_keys=True)
if args.output:
path = Path(args.output)
path.parent.mkdir(parents=True, exist_ok=True)
path.write_text(output, encoding="utf-8")
print(f"Wrote {path}")
else:
print(output, end="" if output.endswith("\n") else "\n")
return 0
def _stream_name(config: dict[str, object], stream_id: str) -> str:
return next((str(item.get("title", "")) for item in config.get("graylog_streams", []) if isinstance(item, dict) and item.get("id") == stream_id), stream_id)
@@ -406,6 +423,13 @@ def build_parser() -> argparse.ArgumentParser:
dashboard.add_argument("--config-file", default="state/fgai-config.json", help="Local runtime configuration JSON")
dashboard.set_defaults(func=run_dashboard)
export = subparsers.add_parser("export-investigation", help="Export current investigation incidents as Markdown or JSON")
export.add_argument("--status-file", default="state/fgai-status.json", help="Status JSON produced by monitor")
export.add_argument("--incident-id", default="", help="Export only one incident ID")
export.add_argument("--format", choices=["markdown", "md", "json"], default="markdown", help="Report format")
export.add_argument("--output", default="", help="Write the report to this file instead of stdout")
export.set_defaults(func=export_investigation)
replay = subparsers.add_parser("replay", help="Replay a historical log export against temporary baselines")
replay.add_argument("--logs", required=True, help="Historic JSONL or key/value log export")
replay.add_argument("--config-file", default="state/fgai-config.json", help="Stream profile configuration")