Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Continued the Detection Quality roadmap milestone.

Browse Source
This commit is contained in:
larssand
2026-06-24 21:14:07 +02:00
parent 223b2a013e
commit cdef3e1355
4 changed files with 78 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
ROADMAP.md
View File

@@ -22,9 +22,11 @@ operational value and dependency, not by UI appeal.
Goal: make findings more accurate before adding more integrations.
- [ ] Add baseline confidence based on sample count, profile age, and time-bucket coverage.
- [ ] Add burst detection for event rate, authentication failures, DNS volume, and denied traffic.
- [ ] Add rare-value detection with frequency thresholds and configurable field weights.
- [x] Add baseline confidence based on sample count and time-bucket coverage.
- [x] Add generic event-rate burst detection per stream/entity.
- [x] Add rare-value detection with a minimum historical observation threshold.
- [ ] Add detector-specific authentication failure, DNS volume, and denied-traffic burst thresholds.
- [ ] Add configurable per-field detector weights.
- [ ] Add sequence detection, for example DNS lookup -> outbound connection -> authentication event.
- [ ] Add per-stream detector enablement and thresholds in the UI.
- [ ] Add a dry-run replay command to evaluate detector changes against a selected historic Graylog time range.