Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

update readme

Browse Source
This commit is contained in:
larssand
2026-06-22 21:27:37 +02:00
parent c4f2751ee4
commit aa0167b9ff
1 changed files with 16 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
README.md
View File

@@ -1,6 +1,8 @@
# SignalScope # SignalScope
SignalScope is a local multi-stream security log correlation and anomaly detection agent. It ingests FortiGate, Graylog MCP streams, DNS, Windows, proxy, Nginx, VPN, and infrastructure events through a common model, then builds baselines and correlation evidence. SignalScope is a local multi-source security analytics agent. Its primary mode connects to Graylog through MCP, discovers the streams and fields already available in your environment, and uses stream profiles to normalize events, build baselines, correlate entities, and explain anomalies with a local LLM.
FortiGate is one supported example. The same workflow applies to DNS/AdGuard, Windows Event Logs, Sysmon, Nginx, Squid, VPN, Proxmox, Filebeat-collected logs, and future Graylog streams.
The Python module and legacy `fgai` command remain available for compatibility. New installations can use `signalscope`. The Python module and legacy `fgai` command remain available for compatibility. New installations can use `signalscope`.
@@ -25,15 +27,17 @@ Or use the helper script, which creates/uses `.venv` automatically and runs `pip
`./start.sh` starts three local background processes: `./start.sh` starts three local background processes:
- UDP syslog listener writing `logs/fg_syslog.jsonl` - Optional UDP syslog listener writing `logs/fg_syslog.jsonl`
- Continuous monitor writing `state/fgai-status.json` - Continuous monitor writing `state/fgai-status.json`
- Local dashboard at `http://127.0.0.1:8088` - Local dashboard at `http://127.0.0.1:8088`
## Graylog MCP ## Primary Workflow: Graylog MCP
Graylog 7.1 MCP can be used as the active log source instead of the local JSONL Graylog 7.1 MCP is the primary log-source integration. In the dashboard, open
listener. In the dashboard, open `Settings`, select `Graylog MCP`, provide the `Settings`, select `Graylog MCP`, provide the MCP URL and a read-only API token,
MCP URL and a read-only API token, then load and enable the streams to analyze. then load and enable the streams to analyze. SignalScope uses MCP `list_streams`,
`list_fields`, `search_messages`, and `aggregate_messages` to work with existing
log sources rather than requiring every source to be forwarded locally.
The token field accepts a raw Graylog API token, the Base64 value after `Basic `, The token field accepts a raw Graylog API token, the Base64 value after `Basic `,
or a complete `Basic <value>` header. Tokens are stored only in the local runtime or a complete `Basic <value>` header. Tokens are stored only in the local runtime
@@ -44,9 +48,11 @@ Graylog datatype/capability metadata and lets you select an entity field, a time
field, and categorical/numeric fields for the stream profile. Profiles are stored field, and categorical/numeric fields for the stream profile. Profiles are stored
under `graylog_stream_profiles` in `state/fgai-config.json`. under `graylog_stream_profiles` in `state/fgai-config.json`.
Enabled streams are normalized through the same event model. The dashboard and Enabled streams are normalized through the same event model. Stream profiles
Ollama correlate source IPs that occur across two or more streams, for example define the entity, timestamp, categorical, and numeric fields used for baselines.
FortiGate, AdGuard/DNS, Windows Security, Nginx, Squid, VPN, or Proxmox. The dashboard and Ollama then correlate behavior across sources, for example a
client IP appearing in FortiGate, AdGuard/DNS, Windows Security, Nginx, Squid,
VPN, or Proxmox.
The current MCP endpoint is `http://<graylog-host>:9000/api/mcp`. Enable it in The current MCP endpoint is `http://<graylog-host>:9000/api/mcp`. Enable it in
Graylog under `System -> Configurations -> MCP` and use stream IDs internally; Graylog under `System -> Configurations -> MCP` and use stream IDs internally;
@@ -213,7 +219,7 @@ For slower machines or large models:
OLLAMA_MODEL=llama3.1 OLLAMA_TIMEOUT=300 fgai analyze-logs --logs logs/fg_syslog.jsonl --llm OLLAMA_MODEL=llama3.1 OLLAMA_TIMEOUT=300 fgai analyze-logs --logs logs/fg_syslog.jsonl --llm
``` ```
## FortiGate Inputs ## Optional FortiGate Input
For logs, configure FortiGate syslog to write into a local file such as `logs/fg_syslog.jsonl`. The parser supports common key/value syslog lines and JSONL. For logs, configure FortiGate syslog to write into a local file such as `logs/fg_syslog.jsonl`. The parser supports common key/value syslog lines and JSONL.