add baseline and sqlite

src/fgai/monitor.py

@@ -5,6 +5,7 @@ import time
 from pathlib import Path
 
 from .anomaly import anomaly_summary, detect_source_anomalies
+from .baseline import BaselineStore
 from .llm import ollama_dashboard_assessment
 from .logs import local_in_failures, read_events, summarize_events, top_field_values
 from .mitigation import parse_allowlist, suggest_block_candidates
@@ -20,9 +21,13 @@ def build_status(
     min_block_events: int = 3,
     min_block_score: int = 7,
     anomaly_limit: int = 20,
+    baseline_path: str | None = None,
 ) -> dict[str, object]:
     events = read_events(log_path) if Path(log_path).exists() else []
-    anomalies = detect_source_anomalies(events, limit=anomaly_limit)
+    baseline = BaselineStore(baseline_path) if baseline_path else None
+    profiles = baseline.profiles({event.src_ip for event in events if event.src_ip}) if baseline else {}
+    anomalies = detect_source_anomalies(events, limit=anomaly_limit, baselines=profiles)
+    baseline_events = baseline.ingest(events) if baseline else 0
     intel_ips = sorted(
         {
             ip
@@ -54,6 +59,7 @@ def build_status(
         "policy_path": policy_path,
         "summary": summarize_events(events),
         "anomaly_summary": anomaly_summary(anomalies),
+        "baseline": {"enabled": bool(baseline), "sources_ready": len(profiles), "new_events_recorded": baseline_events},
         "diagnostics": {
             "top_source_ips": top_field_values(events, "srcip", limit=10),
             "top_destination_ports": top_field_values(events, "dstport", limit=10),
@@ -134,13 +140,14 @@ def monitor_loop(
     llm_interval: int = 300,
     llm_model: str | None = None,
     llm_timeout: int | None = None,
+    baseline_path: str | None = None,
 ) -> None:
     print(f"Monitoring {log_path}")
     print(f"Writing status to {output}")
     last_llm_at = 0
     last_llm_text: str | None = None
     while True:
-        status = build_status(log_path, policy_path=policy_path, anomaly_limit=anomaly_limit)
+        status = build_status(log_path, policy_path=policy_path, anomaly_limit=anomaly_limit, baseline_path=baseline_path)
         if llm:
             now = int(time.time())
             if now - last_llm_at >= llm_interval: