Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add correlation

Browse Source
This commit is contained in:
larssand
2026-06-22 19:20:33 +02:00
parent f2257c74de
commit 9c9b6e96a0
2 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/fgai/correlation.py Normal file
View File

@@ -0,0 +1,21 @@
from __future__ import annotations
from collections import defaultdict
from .logs import THREAT_ACTIONS, is_utm_event
from .models import LogEvent
def correlate_source_ips(events: list[LogEvent], *, limit: int = 20) -> list[dict[str, object]]:
grouped: dict[str, list[LogEvent]] = defaultdict(list)
for event in events:
if event.src_ip:
grouped[event.src_ip].append(event)
correlations = []
for source_ip, source_events in grouped.items():
streams = sorted({event.fields.get("fgai_stream", "local_syslog") for event in source_events})
if len(streams) < 2:
continue
threat_events = sum(event.action in THREAT_ACTIONS or is_utm_event(event) for event in source_events)
correlations.append({"source_ip": source_ip, "streams": streams, "events": len(source_events), "security_events": threat_events})
return sorted(correlations, key=lambda item: (int(item["security_events"]), int(item["events"])), reverse=True)[:limit]

2
src/fgai/dashboard.py
View File

@@ -155,7 +155,9 @@ async function refresh() {
]);
const d = data.diagnostics || {};
const context = data.event_context || {};
const correlations = data.cross_source_correlations || [];
document.getElementById('diagnostics').innerHTML =
'<h3>Cross-Source Correlations</h3>' + table(correlations, [{label:'Source IP', key:'source_ip'}, {label:'Streams', render:r => esc((r.streams || []).join(', '))}, {label:'Events', key:'events'}, {label:'Security Events', key:'security_events'}]) +
'<h3>Entities</h3>' + table(context.source_profiles || [], [{label:'Entity', key:'entity'}, {label:'Events', key:'events'}, {label:'UTM', key:'utm_events'}, {label:'Deny', key:'deny_or_threat_actions'}, {label:'Destinations', key:'distinct_destinations'}, {label:'Actions', render:r => esc((r.top_actions || []).join(', '))}]) +
'<h3>Security Event Samples</h3>' + table(context.security_event_samples || [], [{label:'Entity', key:'entity'}, {label:'Type', key:'type'}, {label:'Action', key:'action'}, {label:'Severity', key:'severity'}, {label:'Destination', key:'dst'}, {label:'Service', key:'service'}]) +
'<h3>Top Sources</h3>' + table(d.top_source_ips || [], [{label:'Value', key:'value'}, {label:'Count', key:'count'}]) +