Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implemented the next roadmap step: direct Graylog MCP replay with temporary baselines.

Browse Source
This commit is contained in:
larssand
2026-06-25 18:34:51 +02:00
parent ea4aaf57ed
commit b6560d64f7
8 changed files with 195 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
src/fgai/replay.py
View File

@@ -10,6 +10,23 @@ from .baseline import BaselineStore
from .models import LogEvent
def replay_comparison(current: dict[str, object], candidate: dict[str, object]) -> dict[str, object]:
"""Summarize how two replay outputs differ."""
current_counts = current.get("field_detector_counts", {})
candidate_counts = candidate.get("field_detector_counts", {})
detectors = sorted(set(current_counts if isinstance(current_counts, dict) else {}) | set(candidate_counts if isinstance(candidate_counts, dict) else {}))
detector_deltas = {
detector: int((candidate_counts if isinstance(candidate_counts, dict) else {}).get(detector, 0)) - int((current_counts if isinstance(current_counts, dict) else {}).get(detector, 0))
for detector in detectors
}
return {
"events_delta": int(candidate.get("events", 0)) - int(current.get("events", 0)),
"field_findings_delta": len(candidate.get("field_findings", [])) - len(current.get("field_findings", [])),
"source_anomalies_delta": len(candidate.get("source_anomalies", [])) - len(current.get("source_anomalies", [])),
"detector_count_delta": detector_deltas,
}
def _timestamp(event: LogEvent, fallback: int) -> int:
value = event.fields.get("eventtime", event.fields.get("timestamp", ""))
try: