fix entity dsiplay names instead of ip

src/fgai/event_context.py

@@ -1,7 +1,9 @@
 from __future__ import annotations
 
+import ipaddress
 from collections import Counter, defaultdict
 
+from .entities import ENTITY_FIELDS
 from .logs import THREAT_ACTIONS, is_utm_event
 from .models import LogEvent
 from .normalization import canonical_value
@@ -11,6 +13,32 @@ def _entity(event: LogEvent) -> str:
     return event.src_ip or event.fields.get("user") or event.fields.get("username") or event.fields.get("hostname") or event.fields.get("source") or "unknown"
 
 
+def _related_value(events: list[LogEvent], fields: tuple[str, ...], *, exclude: str = "") -> str:
+    counts: Counter[str] = Counter()
+    excluded = exclude.lower()
+    for event in events:
+        for field in fields:
+            value = str(event.fields.get(field, "")).strip()
+            if not value or value in {"-", "unknown", "n/a"}:
+                continue
+            if excluded and value.lower() == excluded:
+                continue
+            counts[value] += 1
+    return counts.most_common(1)[0][0] if counts else ""
+
+
+def _display_label(entity: str, events: list[LogEvent]) -> dict[str, str]:
+    try:
+        ipaddress.ip_address(entity)
+    except ValueError:
+        return {"entity_display": entity, "entity_label": entity, "entity_detail": ""}
+    hostname = _related_value(events, ENTITY_FIELDS["host"], exclude=entity)
+    username = _related_value(events, ENTITY_FIELDS["user"], exclude=entity)
+    display = hostname or username or entity
+    label = f"{display} ({entity})" if display != entity else entity
+    return {"entity_display": display, "entity_label": label, "entity_detail": entity if display != entity else ""}
+
+
 def build_event_context(events: list[LogEvent], *, source_limit: int = 30, sample_limit: int = 15) -> dict[str, object]:
     grouped: dict[str, list[LogEvent]] = defaultdict(list)
     field_presence: Counter[str] = Counter()
@@ -24,6 +52,7 @@ def build_event_context(events: list[LogEvent], *, source_limit: int = 30, sampl
         destinations = {event.dst_ip for event in source_events if event.dst_ip}
         source_profiles.append({
             "entity": entity, "events": len(source_events), "utm_events": sum(is_utm_event(event) for event in source_events),
+            **_display_label(entity, source_events),
             "deny_or_threat_actions": sum(event.action in THREAT_ACTIONS for event in source_events),
             "distinct_destinations": len(destinations), "top_actions": [action for action, _ in actions.most_common(3)],
         })
@@ -31,7 +60,7 @@ def build_event_context(events: list[LogEvent], *, source_limit: int = 30, sampl
 
     suspicious = [event for event in events if is_utm_event(event) or event.action in THREAT_ACTIONS or event.severity in {"critical", "high", "alert", "emergency"}]
     samples = [{
-        "entity": _entity(event), "type": canonical_value(event.fields, "type"), "subtype": event.subtype,
+        "entity": _entity(event), **_display_label(_entity(event), [event]), "type": canonical_value(event.fields, "type"), "subtype": event.subtype,
         "action": event.action, "severity": event.severity, "dst": event.dst_ip or canonical_value(event.fields, "context"), "service": canonical_value(event.fields, "service"),
         "policyid": event.fields.get("policyid", ""), "timestamp": event.fields.get("eventtime", event.fields.get("timestamp", "")),
     } for event in suspicious[:sample_limit]]