Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implemented the baseline/noise and SQLite growth improvements.

Browse Source
This commit is contained in:
larssand
2026-06-29 19:58:49 +02:00
parent 6ea8bfd714
commit d764c5a038
8 changed files with 205 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
src/fgai/cli.py
View File

@@ -16,6 +16,7 @@ from .syslog_server import listen_udp_syslog
from .monitor import monitor_loop
from .threat_intel import enrich_ips, is_public_ip
from .config import ConfigStore
from .baseline import BaselineStore, DEFAULT_MAX_VALUES_PER_FIELD, DEFAULT_RETENTION_DAYS, DEFAULT_VALUE_RETENTION_DAYS
from .exports import investigation_report, investigation_report_markdown
from .graylog_mcp import GraylogMcpClient
from .graylog_source import GraylogStreamSource
@@ -237,6 +238,17 @@ def export_investigation(args: argparse.Namespace) -> int:
return 0
def baseline_maintenance(args: argparse.Namespace) -> int:
result = BaselineStore(args.baseline_db).maintenance(
retention_days=args.retention_days,
value_retention_days=args.value_retention_days,
max_values_per_field=args.max_values_per_field,
vacuum=args.vacuum,
)
_print_json(result)
return 0
def _stream_name(config: dict[str, object], stream_id: str) -> str:
return next((str(item.get("title", "")) for item in config.get("graylog_streams", []) if isinstance(item, dict) and item.get("id") == stream_id), stream_id)
@@ -430,6 +442,14 @@ def build_parser() -> argparse.ArgumentParser:
export.add_argument("--output", default="", help="Write the report to this file instead of stdout")
export.set_defaults(func=export_investigation)
maintenance = subparsers.add_parser("baseline-maintenance", help="Prune and optionally compact the local SQLite baseline")
maintenance.add_argument("--baseline-db", default="state/fgai-baseline.sqlite3", help="SQLite baseline database")
maintenance.add_argument("--retention-days", type=int, default=DEFAULT_RETENTION_DAYS, help="Keep bucket and dedupe history for this many days")
maintenance.add_argument("--value-retention-days", type=int, default=DEFAULT_VALUE_RETENTION_DAYS, help="Prune stale one-off categorical values after this many days")
maintenance.add_argument("--max-values-per-field", type=int, default=DEFAULT_MAX_VALUES_PER_FIELD, help="Keep at most this many categorical values per stream/entity/field")
maintenance.add_argument("--vacuum", action="store_true", help="Run SQLite VACUUM after pruning to return disk space")
maintenance.set_defaults(func=baseline_maintenance)
replay = subparsers.add_parser("replay", help="Replay a historical log export against temporary baselines")
replay.add_argument("--logs", required=True, help="Historic JSONL or key/value log export")
replay.add_argument("--config-file", default="state/fgai-config.json", help="Stream profile configuration")