fix anon

src/fgai/anomaly.py

@@ -5,7 +5,7 @@ from datetime import datetime
 from statistics import mean, pstdev
 
 from .entities import is_public_ip as _is_public_ip
-from .feedback import SUPPRESSING_STATUSES
+from .feedback import SUPPRESSING_STATUSES, feedback_matches
 from .logs import THREAT_ACTIONS, event_score, is_utm_event
 from .models import AnomalyFinding, LogEvent
 
@@ -69,7 +69,7 @@ def _rate_per_minute(events: list[LogEvent]) -> tuple[float | None, float]:
 
 
 def detect_source_anomalies(
-    events: list[LogEvent], *, limit: int = 20, baselines: dict[str, dict[str, object]] | None = None, field_deviations: dict[str, list[dict[str, object]]] | None = None
+    events: list[LogEvent], *, limit: int = 20, baselines: dict[str, dict[str, object]] | None = None, field_deviations: dict[str, list[dict[str, object]]] | None = None, feedback: list[dict[str, object]] | None = None
 ) -> list[AnomalyFinding]:
     baselines = baselines or {}
     field_deviations = field_deviations or {}
@@ -105,6 +105,13 @@ def detect_source_anomalies(
 
     findings: list[AnomalyFinding] = []
     for src_ip, src_events in by_src.items():
+        if feedback:
+            suppression = next(
+                (item for item in feedback if feedback_matches(item, entity=src_ip, stream_id="", field="", value="")),
+                None,
+            )
+            if suppression and suppression.get("status") in SUPPRESSING_STATUSES:
+                continue
         event_count = len(src_events)
         distinct_dst = len({event.fields.get("dstip") for event in src_events if event.fields.get("dstip")})
         distinct_services = len({event.fields.get("service") for event in src_events if event.fields.get("service")})

src/fgai/monitor.py

@@ -526,7 +526,7 @@ def build_status(
                     deviation["score"] = 0
     generalization_min_values = int(runtime_values.get("feedback_generalization_min_values", 3) or 3)
     feedback_generalization_suggestions = suggest_generalizations(feedback, min_values=generalization_min_values)
-    anomalies = detect_source_anomalies(events, limit=anomaly_limit, baselines=profiles, field_deviations=field_deviations)
+    anomalies = detect_source_anomalies(events, limit=anomaly_limit, baselines=profiles, field_deviations=field_deviations, feedback=feedback)
     baseline_events = baseline.ingest(events) if baseline else 0
     profile_baseline_fields = (
         baseline.ingest_profile_fields(