Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

multi-entity stream profiles.

Browse Source
This commit is contained in:
larssand
2026-06-29 19:18:11 +02:00
parent 68370217da
commit aab9f15c6d
6 changed files with 101 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
ROADMAP.md
View File

@@ -42,8 +42,8 @@ Goal: make one incident answer what happened, to whom, and across which sources.
- [x] Allow multiple entity fields per stream, such as user plus source IP plus hostname.
- [ ] Add entity aliasing: map DHCP, VPN, DNS, and endpoint identities to the same host where evidence supports it.
- [ ] Add configurable incident grouping windows and incident lifecycle: open, acknowledged, resolved, reopened.
- [ ] Persist incident state and analyst notes separately from transient detection output.
- [x] Add incident lifecycle: open, acknowledged, resolved, reopened.
- [x] Persist incident state and analyst notes separately from transient detection output.
- [ ] Add direct Graylog query links or query details for each timeline event.
- [ ] Add investigation export as JSON and Markdown report.