add correlation

src/fgai/correlation.py

@@ -0,0 +1,21 @@
+from __future__ import annotations
+
+from collections import defaultdict
+
+from .logs import THREAT_ACTIONS, is_utm_event
+from .models import LogEvent
+
+
+def correlate_source_ips(events: list[LogEvent], *, limit: int = 20) -> list[dict[str, object]]:
+    grouped: dict[str, list[LogEvent]] = defaultdict(list)
+    for event in events:
+        if event.src_ip:
+            grouped[event.src_ip].append(event)
+    correlations = []
+    for source_ip, source_events in grouped.items():
+        streams = sorted({event.fields.get("fgai_stream", "local_syslog") for event in source_events})
+        if len(streams) < 2:
+            continue
+        threat_events = sum(event.action in THREAT_ACTIONS or is_utm_event(event) for event in source_events)
+        correlations.append({"source_ip": source_ip, "streams": streams, "events": len(source_events), "security_events": threat_events})
+    return sorted(correlations, key=lambda item: (int(item["security_events"]), int(item["events"])), reverse=True)[:limit]