diff --git a/README.md b/README.md index 0ce0879..f556890 100644 --- a/README.md +++ b/README.md @@ -117,6 +117,10 @@ The current MCP endpoint is `http://:9000/api/mcp`. Enable it in Graylog under `System -> Configurations -> MCP` and use stream IDs internally; the fgAI stream picker resolves titles in the UI. +For live monitoring, `graylog_range_seconds` controls how far back each MCP poll +searches. The default is one hour, which keeps findings and correlations more +stable than a very short window while still limiting MCP query cost. + ## Monitoring Export The dashboard also exposes Prometheus text metrics at: diff --git a/src/fgai/config.py b/src/fgai/config.py index eb6580e..29c147d 100644 --- a/src/fgai/config.py +++ b/src/fgai/config.py @@ -12,6 +12,7 @@ DEFAULT_CONFIG: dict[str, object] = { "graylog_streams": [], "graylog_stream_profiles": [], "graylog_query": "*", + "graylog_range_seconds": 3600, "graylog_field_mapping": "", "llm_enabled": False, "llm_model": "", @@ -48,6 +49,11 @@ class ConfigStore: current[key] = bool(value) elif key == "log_source" and value in {"local_syslog", "graylog_mcp"}: current[key] = value + elif key == "graylog_range_seconds": + try: + current[key] = max(60, int(value)) + except (TypeError, ValueError): + continue elif key == "graylog_streams" and isinstance(value, list): current[key] = [ {"id": str(item.get("id", "")), "title": str(item.get("title", "")), "enabled": bool(item.get("enabled"))} diff --git a/src/fgai/dashboard.py b/src/fgai/dashboard.py index 45a2ea2..52ec548 100644 --- a/src/fgai/dashboard.py +++ b/src/fgai/dashboard.py @@ -80,7 +80,7 @@ HTML = """

Events and Anomalies

Baseline and Stream Health

Correlation Map

AI Assessment

LLM assessment disabled.

Investigation Incidents

Anomalies

Recommendations

Field Baseline Deviations

Related Activity Across Sources

Block Candidates

Threat Intelligence

Policy Findings

Diagnostics

-

Runtime Configuration

+

Runtime Configuration