Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Started the roadmap with incident grouping.

Browse Source
This commit is contained in:
larssand
2026-06-23 20:30:14 +02:00
parent e71f868be4
commit e3938c2581
3 changed files with 30 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/fgai/monitor.py
View File

@@ -13,6 +13,7 @@ from .feedback import FeedbackStore
from .graylog_mcp import GraylogMcpClient
from .graylog_source import GraylogStreamSource
from .history import HistoryStore
from .incidents import build_incidents
from .llm import ollama_dashboard_assessment
from .logs import local_in_failures, read_events, summarize_events, top_field_values
from .mitigation import parse_allowlist, suggest_block_candidates
@@ -90,6 +91,7 @@ def build_status(
reputation = enrich_ips(intel_ips, limit=25, enabled=threat_enabled)
threat_intel_status = ThreatIntelClient(enabled=threat_enabled).status()
recommendations = build_recommendations(events, anomalies, reputation)
correlations = correlate_source_ips(events)
block_candidates = suggest_block_candidates(
events,
min_events=min_block_events,
@@ -130,7 +132,8 @@ def build_status(
"event_context": build_event_context(events),
"field_deviations": field_deviations,
"feedback": feedback,
"cross_source_correlations": correlate_source_ips(events),
"cross_source_correlations": correlations,
"incidents": build_incidents(anomalies, field_deviations, correlations),
"anomalies": [
{
"subject": finding.subject,