Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Profile recommendations

Browse Source
This commit is contained in:
larssand
2026-06-30 08:55:15 +02:00
parent d99fe24b84
commit f2385a00a9
5 changed files with 158 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/fgai/normalization.py
View File

@@ -12,8 +12,11 @@ FIELD_ALIASES: dict[str, tuple[str, ...]] = {
"type": ("type", "event_type", "log_type", "category", "event_category", "facility"),
"subtype": ("subtype", "sub_type", "event_subtype", "subcategory"),
"service": ("service", "service_name", "dst_service", "app", "appname", "application", "application_name", "proto", "protocol", "transport", "network.transport", "query_type", "qt"),
"username": ("username", "targetusername", "target_user_name", "winlog_event_data_targetusername", "subjectusername", "subject_user_name", "winlog_event_data_subjectusername", "user", "user_name", "account", "account_name", "xauthuser", "actor", "actor_id", "principal", "principal_name", "login", "login_name"),
"hostname": ("hostname", "host", "computer", "computer_name", "workstation", "workstation_name", "device_name", "agent_name", "winlog_computer_name", "host.name", "agent.name"),
"eventid": ("eventid", "event_id", "winlog_event_id", "event_code", "event.code", "windows_event_id"),
"dns_query": ("dns_query", "query_domain", "qh", "dns_question", "question", "queried_domain"),
"context": ("query_domain", "qh", "dns_query", "url", "uri", "request", "request_uri", "path", "domain", "hostname", "message", "msg", "full_message", "event_message"),
"context": ("query_domain", "qh", "dns_query", "url", "uri", "request", "request_uri", "path", "domain", "hostname", "message", "msg", "full_message", "event_message", "event_original"),
}
DEFAULT_SEARCH_FIELDS = tuple(dict.fromkeys(field for aliases in FIELD_ALIASES.values() for field in aliases))