Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add more matching

Browse Source
This commit is contained in:
larssand
2026-06-22 19:19:31 +02:00
parent a5489d3c87
commit f2257c74de
8 changed files with 85 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
src/fgai/monitor.py
View File

@@ -7,6 +7,7 @@ from pathlib import Path
from .anomaly import anomaly_summary, detect_source_anomalies
from .baseline import BaselineStore
from .config import ConfigStore
from .correlation import correlate_source_ips
from .event_context import build_event_context
from .graylog_mcp import GraylogMcpClient
from .graylog_source import GraylogStreamSource
@@ -42,13 +43,15 @@ def build_status(
else:
try:
configured_streams = runtime_values.get("graylog_streams", [])
stream_ids = [str(item.get("id")) for item in configured_streams if isinstance(item, dict) and item.get("enabled") and item.get("id")]
stream_configs = [item for item in configured_streams if isinstance(item, dict) and item.get("enabled") and item.get("id")]
stream_ids = [str(item.get("id")) for item in stream_configs]
if not stream_ids:
stream_ids = [str(runtime_values.get("graylog_stream", ""))]
stream_configs = [{"id": str(runtime_values.get("graylog_stream", "")), "title": "Graylog"}]
stream_statuses = []
events = []
for stream_id in stream_ids:
stream_events, stream_status = GraylogStreamSource(GraylogMcpClient(url, token), stream_id, str(runtime_values.get("graylog_query", "*")), str(runtime_values.get("graylog_field_mapping", ""))).fetch()
for stream_config in stream_configs:
stream_id = str(stream_config["id"])
stream_events, stream_status = GraylogStreamSource(GraylogMcpClient(url, token), stream_id, str(runtime_values.get("graylog_query", "*")), str(runtime_values.get("graylog_field_mapping", "")), str(stream_config.get("title", stream_id))).fetch()
events.extend(stream_events)
stream_statuses.append({"stream_id": stream_id, **stream_status})
mcp_status = {"status": "connected", "streams": stream_statuses, "events_fetched": len(events)}
@@ -107,6 +110,7 @@ def build_status(
"local_in_failures": local_in_failures(events, limit=10),
},
"event_context": build_event_context(events),
"cross_source_correlations": correlate_source_ips(events),
"anomalies": [
{
"subject": finding.subject,