fix view in profile stream field and readme

README.md

@@ -27,6 +27,42 @@ Or use the helper script, which creates/uses `.venv` automatically and runs `pip
 - Continuous monitor writing `state/fgai-status.json`
 - Local dashboard at `http://127.0.0.1:8088`
 
+## Graylog MCP
+
+Graylog 7.1 MCP can be used as the active log source instead of the local JSONL
+listener. In the dashboard, open `Settings`, select `Graylog MCP`, provide the
+MCP URL and a read-only API token, then load and enable the streams to analyze.
+
+The token field accepts a raw Graylog API token, the Base64 value after `Basic `,
+or a complete `Basic <value>` header. Tokens are stored only in the local runtime
+configuration and are never returned by the dashboard API.
+
+Use `Load selected stream fields` after choosing a stream. The field table shows
+Graylog datatype/capability metadata and lets you select an entity field, a time
+field, and categorical/numeric fields for the stream profile. Profiles are stored
+under `graylog_stream_profiles` in `state/fgai-config.json`.
+
+Enabled streams are normalized through the same event model. The dashboard and
+Ollama correlate source IPs that occur across two or more streams, for example
+FortiGate, AdGuard/DNS, Windows Security, Nginx, Squid, VPN, or Proxmox.
+
+The current MCP endpoint is `http://<graylog-host>:9000/api/mcp`. Enable it in
+Graylog under `System -> Configurations -> MCP` and use stream IDs internally;
+the fgAI stream picker resolves titles in the UI.
+
+## Monitoring Export
+
+The dashboard also exposes Prometheus text metrics at:
+
+```text
+http://127.0.0.1:8088/metrics
+```
+
+This endpoint is passive and has no Prometheus or Grafana dependency. It reports
+low-cardinality event counts, anomaly severities, baseline readiness, and Graylog
+MCP health. Use it later as a Prometheus scrape target or as input for a Checkmk
+local check. Do not use source IPs, domains, or raw event IDs as metric labels.
+
 Enable cached Ollama analyst notes in the dashboard:
 
 ```bash
@@ -200,7 +236,7 @@ end
 - `FORTIGATE_VERIFY_TLS`: `true` or `false`, defaults to `true`.
 - `FGAI_ALLOWLIST`: comma-separated IPs/CIDRs never to block.
 - `OLLAMA_HOST`: defaults to `http://127.0.0.1:11434`.
-- `OLLAMA_MODEL`: defaults to `llama3.3`.
+- `OLLAMA_MODEL`: defaults to `llama3.1`.
 - `OLLAMA_TIMEOUT`: Ollama request timeout in seconds, defaults to `180`.
 - `FGAI_LLM`: set to `1` to enable dashboard Ollama analyst notes.
 - `FGAI_LLM_INTERVAL`: seconds between dashboard LLM notes, defaults to `300`.