Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add related findings

Browse Source
This commit is contained in:
larssand
2026-06-22 19:32:18 +02:00
parent 9c9b6e96a0
commit be8a597be0
3 changed files with 17 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
src/fgai/correlation.py
View File

@@ -17,5 +17,13 @@ def correlate_source_ips(events: list[LogEvent], *, limit: int = 20) -> list[dic
if len(streams) < 2:
continue
threat_events = sum(event.action in THREAT_ACTIONS or is_utm_event(event) for event in source_events)
correlations.append({"source_ip": source_ip, "streams": streams, "events": len(source_events), "security_events": threat_events})
samples = [
{
"stream": event.fields.get("fgai_stream", "local_syslog"), "timestamp": event.fields.get("eventtime", event.fields.get("timestamp", "")),
"type": event.fields.get("type", ""), "subtype": event.subtype, "action": event.action,
"severity": event.severity, "destination": event.dst_ip or "", "service": event.fields.get("service", ""),
}
for event in source_events[:20]
]
correlations.append({"source_ip": source_ip, "streams": streams, "events": len(source_events), "security_events": threat_events, "samples": samples})
return sorted(correlations, key=lambda item: (int(item["security_events"]), int(item["events"])), reverse=True)[:limit]