ad VS

src/fgai/monitor.py

@@ -8,6 +8,8 @@ from .anomaly import anomaly_summary, detect_source_anomalies
 from .logs import local_in_failures, read_events, summarize_events, top_field_values
 from .mitigation import parse_allowlist, suggest_block_candidates
 from .policies import audit_policies, read_policies
+from .recommendations import build_recommendations
+from .threat_intel import enrich_ips, is_public_ip
 
 
 def build_status(
@@ -20,6 +22,16 @@ def build_status(
 ) -> dict[str, object]:
     events = read_events(log_path) if Path(log_path).exists() else []
     anomalies = detect_source_anomalies(events, limit=anomaly_limit)
+    intel_ips = sorted(
+        {
+            ip
+            for event in events
+            for ip in (event.src_ip, event.dst_ip)
+            if is_public_ip(ip)
+        }
+    )
+    reputation = enrich_ips(intel_ips, limit=25)
+    recommendations = build_recommendations(events, anomalies, reputation)
     block_candidates = suggest_block_candidates(
         events,
         min_events=min_block_events,
@@ -59,6 +71,20 @@ def build_status(
             }
             for finding in anomalies
         ],
+        "recommendations": [
+            {
+                "subject": item.subject,
+                "score": item.score,
+                "severity": item.severity,
+                "title": item.title,
+                "recommendation": item.recommendation,
+                "reasons": item.reasons,
+                "related_policy_ids": item.related_policy_ids,
+                "related_services": item.related_services,
+            }
+            for item in recommendations
+        ],
+        "reputation": reputation,
         "block_candidates": [
             {"src_ip": candidate.src_ip, "score": candidate.score, "reasons": candidate.reasons}
             for candidate in block_candidates