Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implemented cleanup/triage direction. ui, and baselinbe days

Browse Source
This commit is contained in:
larssand
2026-06-29 20:20:00 +02:00
parent d764c5a038
commit d540b8a77d
9 changed files with 298 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
src/fgai/config.py
View File

@@ -16,10 +16,18 @@ DEFAULT_CONFIG: dict[str, object] = {
"baseline_retention_days": 14,
"baseline_value_retention_days": 7,
"baseline_max_values_per_field": 2000,
"baseline_training_days": 7,
"graylog_field_mapping": "",
"llm_enabled": False,
"llm_model": "",
"threat_intel_enabled": False,
"threat_intel_provider": "auto",
"abuseipdb_api_key": "",
"virustotal_api_key": "",
"threat_intel_daily_limit": 100,
"threat_intel_ttl_seconds": 604800,
"threat_intel_error_ttl_seconds": 3600,
"abuseipdb_max_age_days": 90,
}
EDITABLE_FIELDS = set(DEFAULT_CONFIG) | {"graylog_mcp_token"}
@@ -39,6 +47,8 @@ class ConfigStore:
def public(self) -> dict[str, object]:
config = self.read()
config["graylog_mcp_token_configured"] = bool(config.pop("graylog_mcp_token", ""))
config["abuseipdb_api_key_configured"] = bool(config.pop("abuseipdb_api_key", ""))
config["virustotal_api_key_configured"] = bool(config.pop("virustotal_api_key", ""))
return config
def update(self, values: dict[str, object]) -> dict[str, object]:
@@ -46,18 +56,20 @@ class ConfigStore:
for key, value in values.items():
if key not in EDITABLE_FIELDS:
continue
if key == "graylog_mcp_token" and value == "":
if key in {"graylog_mcp_token", "abuseipdb_api_key", "virustotal_api_key"} and value == "":
continue
if key in {"llm_enabled", "threat_intel_enabled"}:
current[key] = bool(value)
elif key == "log_source" and value in {"local_syslog", "graylog_mcp"}:
current[key] = value
elif key in {"graylog_range_seconds", "baseline_retention_days", "baseline_value_retention_days", "baseline_max_values_per_field"}:
elif key in {"graylog_range_seconds", "baseline_retention_days", "baseline_value_retention_days", "baseline_max_values_per_field", "baseline_training_days", "threat_intel_daily_limit", "threat_intel_ttl_seconds", "threat_intel_error_ttl_seconds", "abuseipdb_max_age_days"}:
try:
minimum = 60 if key == "graylog_range_seconds" else 1
current[key] = max(minimum, int(value))
except (TypeError, ValueError):
continue
elif key == "threat_intel_provider" and value in {"auto", "abuseipdb", "virustotal"}:
current[key] = value
elif key == "graylog_streams" and isinstance(value, list):
current[key] = [
{"id": str(item.get("id", "")), "title": str(item.get("title", "")), "enabled": bool(item.get("enabled"))}