ad VS

src/fgai/models.py

@@ -12,6 +12,10 @@ class LogEvent:
     def src_ip(self) -> str | None:
         return self.fields.get("srcip") or self.fields.get("src_ip") or self.fields.get("source_ip")
 
+    @property
+    def dst_ip(self) -> str | None:
+        return self.fields.get("dstip") or self.fields.get("dst_ip") or self.fields.get("destination_ip")
+
     @property
     def subtype(self) -> str:
         return self.fields.get("subtype", "").lower()
@@ -62,3 +66,15 @@ class AnomalyFinding:
     confidence: str
     reasons: list[str]
     evidence: dict[str, int | str | float]
+
+
+@dataclass(frozen=True)
+class Recommendation:
+    subject: str
+    score: int
+    severity: str
+    title: str
+    recommendation: str
+    reasons: list[str]
+    related_policy_ids: list[str] = field(default_factory=list)
+    related_services: list[str] = field(default_factory=list)