multi-entity stream profiles.

src/fgai/monitor.py

@@ -13,7 +13,7 @@ from .feedback import FeedbackStore
 from .graylog_mcp import GraylogMcpClient
 from .graylog_source import GraylogStreamSource
 from .history import HistoryStore
-from .incidents import build_incidents
+from .incidents import IncidentStore, build_incidents
 from .data_quality import assess_data_quality
 from .llm import ollama_dashboard_assessment
 from .logs import local_in_failures, read_events, summarize_events, top_field_values
@@ -102,6 +102,7 @@ def build_status(
     baseline_path: str | None = None,
     config_path: str | None = None,
     history_path: str | None = None,
+    incident_path: str | None = None,
 ) -> dict[str, object]:
     config_store = ConfigStore(config_path) if config_path else None
     config_exists = bool(config_store and config_store.path.exists())
@@ -202,6 +203,7 @@ def build_status(
     threat_intel_status = ThreatIntelClient(enabled=threat_enabled).status()
     recommendations = build_recommendations(events, anomalies, reputation)
     correlations = correlate_source_ips(events)
+    incidents = IncidentStore(incident_path or "state/signalscope-incidents.json").apply(build_incidents(anomalies, field_deviations, correlations))
     block_candidates = suggest_block_candidates(
         events,
         min_events=min_block_events,
@@ -245,7 +247,7 @@ def build_status(
         "sequence_findings": sequence_findings,
         "feedback": feedback,
         "cross_source_correlations": correlations,
-        "incidents": build_incidents(anomalies, field_deviations, correlations),
+        "incidents": incidents,
         "data_quality": assess_data_quality(events, mcp_status),
         "anomalies": [
             {