Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Continued the Detection Quality roadmap.

Browse Source
This commit is contained in:
larssand
2026-06-24 21:32:18 +02:00
parent cdef3e1355
commit ea4aaf57ed
14 changed files with 258 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
ROADMAP.md
View File

@@ -25,11 +25,12 @@ Goal: make findings more accurate before adding more integrations.
- [x] Add baseline confidence based on sample count and time-bucket coverage.
- [x] Add generic event-rate burst detection per stream/entity.
- [x] Add rare-value detection with a minimum historical observation threshold.
- [ ] Add detector-specific authentication failure, DNS volume, and denied-traffic burst thresholds.
- [x] Add detector-specific authentication failure, DNS volume, and denied-traffic burst thresholds.
- [ ] Add configurable per-field detector weights.
- [ ] Add sequence detection, for example DNS lookup -> outbound connection -> authentication event.
- [ ] Add per-stream detector enablement and thresholds in the UI.
- [ ] Add a dry-run replay command to evaluate detector changes against a selected historic Graylog time range.
- [x] Add per-stream detector enablement and thresholds in the UI.
- [x] Add a dry-run replay command for historic JSONL or Graylog exports using temporary baselines.
- [ ] Add direct Graylog MCP time-range replay and result comparison against saved detector configurations.
Acceptance: each finding shows its detector, confidence, baseline sample count, current value, expected value, and a bounded set of raw-event references.