Continued the Detection Quality roadmap.

src/fgai/detectors.py

@@ -0,0 +1,25 @@
+from __future__ import annotations
+
+from .logs import THREAT_ACTIONS
+from .models import LogEvent
+
+
+DETECTOR_MINIMUMS = {
+    "auth_failure": 5,
+    "dns_query": 20,
+    "deny_action": 10,
+}
+
+
+def event_detector_categories(event: LogEvent) -> tuple[str, ...]:
+    fields = event.fields
+    action = event.action
+    event_id = fields.get("eventid", fields.get("event_id", fields.get("winlog_event_id", "")))
+    categories: list[str] = []
+    if action in {"fail", "failed", "failure", "login_failed", "logon_failed", "authentication_failed"} or event_id == "4625":
+        categories.append("auth_failure")
+    if fields.get("query_domain") or fields.get("qh") or fields.get("dns_query"):
+        categories.append("dns_query")
+    if action in THREAT_ACTIONS:
+        categories.append("deny_action")
+    return tuple(categories)