Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implemented the baseline/noise and SQLite growth improvements.

Browse Source
This commit is contained in:
larssand
2026-06-29 19:58:49 +02:00
parent 6ea8bfd714
commit d764c5a038
8 changed files with 205 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
ROADMAP.md
View File

@@ -33,6 +33,8 @@ Goal: make findings more accurate before adding more integrations.
- [x] Add a dry-run replay command for historic JSONL or Graylog exports using temporary baselines.
- [x] Add direct Graylog MCP time-range replay and result comparison against saved detector configurations.
- [ ] Add dashboard controls for launching safe replay jobs and viewing detector deltas.
- [ ] Add baseline confidence tooling: per detector learning state, expected false-positive rate, and why a deviation crossed threshold.
- [ ] Add baseline maintenance tooling in the dashboard for retention, high-cardinality fields, and database compaction status.
Acceptance: each finding shows its detector, confidence, baseline sample count, current value, expected value, and a bounded set of raw-event references.
@@ -46,6 +48,7 @@ Goal: make one incident answer what happened, to whom, and across which sources.
- [x] Persist incident state and analyst notes separately from transient detection output.
- [x] Add direct Graylog query links or query details for each timeline event.
- [x] Add investigation export as JSON and Markdown report.
- [ ] Add guided investigation tools that compare a selected incident against its baseline, related entities, and similar prior outcomes.
Acceptance: an analyst can open an incident, see an ordered multi-stream timeline, review evidence, and record an outcome without losing it after the next monitor poll.
@@ -79,7 +82,8 @@ Goal: run reliably in a monitored environment.
- [ ] Add systemd unit files for monitor, dashboard, and optional local syslog listener.
- [ ] Add health and readiness endpoints with last successful Graylog fetch time.
- [ ] Add structured application logs and configurable retention for status/history/baseline data.
- [x] Add configurable retention for baseline buckets and high-cardinality field values.
- [ ] Add structured application logs and configurable retention for status/history data.
- [ ] Add backup and migration procedure for SQLite state.
- [ ] Add Checkmk local-check output in addition to Prometheus metrics.
- [ ] Add authentication/reverse-proxy guidance before exposing the dashboard beyond loopback.