larssand
83ffef3570
Pool baseline state across streams sharing an entity concept
...
Completes the last deferred item from ROADMAP §0: entities recognized as
the same real-world concept across enabled streams (e.g. srcip in both a
firewall and an IIS stream) now share baseline knowledge of entity
presence/age and known relationship-target values, instead of each stream
learning it cold. Implemented additively (synthetic shared_entity:<group>
namespace in the existing baseline.py tables, no schema migration), scoped
to entity presence + relationship known-values only — per-stream
distribution baselines stay untouched. Also fixes a latent alias-map
collision bug found while building this (ALIAS_CANONICAL_BY_FIELD let
"context" silently steal "hostname"/"dns_query" from their own canonical
groups).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com >
2026-09-23 18:50:14 +02:00
larssand
8c155ec9cf
add new structure
2026-09-23 17:06:05 +02:00
larssand
7cbec64b0e
ny roadmap och arch
2026-09-23 15:09:13 +02:00
larssand
5f8b1cd098
fix ollama
2026-09-23 13:40:51 +02:00
larssand
bf1109be81
add rule generalization, sized LLM defaults, ops docs, and UI polish
...
Feedback rules can now be suggested for merging when a human has already
reviewed the same pattern multiple times (never guesses about new values).
LLM defaults sized for constrained VRAM instead of llama3.3/llama3.1.
Adds systemd units, a state backup script, and reverse-proxy auth guidance
for production deployment. Findings view is collapsible and sorts
suggested-review rows to the top for a quicker overview.
2026-09-23 13:04:53 +02:00
larssand
67609e415f
fix isssue classification and doc
2026-09-07 22:04:45 +02:00
larssand
649c29a8c2
fix clear investi
2026-07-06 16:49:30 +02:00
larssand
35282bca7f
fix ui readme
2026-07-06 12:58:16 +02:00
larssand
841f94dc9f
fix retention
2026-07-06 12:41:34 +02:00
larssand
7568767946
första UI/operatörs-pass
2026-07-02 19:47:09 +02:00
larssand
7d0e66c239
add relationship fields
2026-07-02 15:07:15 +02:00
larssand
d48d34f96c
keep discoverds fileds in separate sqlite
2026-07-02 12:51:36 +02:00
larssand
7c0b482a22
improve find fileds for default profiles
2026-07-02 09:51:25 +02:00
larssand
53437a3952
uopdate doc
2026-07-01 09:15:14 +02:00
larssand
4a441bf443
MCP sample fetch now asks for common Winlogbeat/ECS fields before
2026-06-30 15:10:47 +02:00
larssand
e144cd8258
add more stats and fix
2026-06-30 12:23:23 +02:00
larssand
4d669be66d
add agregated search
2026-06-30 11:34:11 +02:00
larssand
2aaa2e28f3
add chache for last known good in sqlite..
2026-06-30 10:30:59 +02:00
larssand
50463aa4d6
Fixed the MCP error handling for large pulls.
2026-06-30 10:15:06 +02:00
larssand
31ac3c25d2
Improved the overview graphs. and MCP fetching poll
2026-06-30 09:40:20 +02:00
larssand
9c6c08b5ec
Added local Ollama model listing in the U
2026-06-30 09:15:03 +02:00
larssand
d7b8c494e9
Added the optional Ollama profile advisor
2026-06-30 09:09:04 +02:00
larssand
d540b8a77d
Implemented cleanup/triage direction. ui, and baselinbe days
2026-06-29 20:20:00 +02:00
larssand
d764c5a038
Implemented the baseline/noise and SQLite growth improvements.
2026-06-29 19:58:49 +02:00
larssand
6ea8bfd714
investigation export.
2026-06-29 19:48:29 +02:00
larssand
16b5bbdd63
Graylog query details
2026-06-29 19:26:16 +02:00
larssand
aab9f15c6d
multi-entity stream profiles.
2026-06-29 19:18:11 +02:00
larssand
68370217da
Fortsatte roadmapen med multi-entity stream profiles
2026-06-29 19:08:23 +02:00
larssand
20b0e0a92e
Ny central normalisering
2026-06-29 18:55:18 +02:00
larssand
0b31e6c55e
stream_coverage i status-API.
2026-06-29 18:36:50 +02:00
larssand
c95634f976
fix profile editor
2026-06-29 17:10:03 +02:00
larssand
0e41e00ebc
sequence detection
2026-06-25 22:05:04 +02:00
larssand
9da1aedf52
configurable per-field detector weights är klart.
2026-06-25 19:36:08 +02:00
larssand
899dbdfc84
Fixat orsaken till att Findings/Correlation blinkade bort.
2026-06-25 18:51:04 +02:00
larssand
b6560d64f7
Implemented the next roadmap step: direct Graylog MCP replay with temporary baselines.
2026-06-25 18:34:51 +02:00
larssand
ea4aaf57ed
Continued the Detection Quality roadmap.
2026-06-24 21:32:18 +02:00
larssand
223b2a013e
Implemented the UI improvements. and roadmap
2026-06-24 20:43:40 +02:00
larssand
868022008a
Implemented the next multi-source detection layer in this repository.
2026-06-24 19:16:16 +02:00
larssand
f6bee0438c
Field baseline deviations now show distinct Mark expected, Mark false positive, and Mark confirmed
2026-06-24 18:54:37 +02:00
larssand
3fc4effd26
add pics
2026-06-24 12:13:43 +02:00
larssand
16881620e9
add filebeat sned test logs
2026-06-23 20:16:32 +02:00
larssand
4e5f928405
Improved field-profile scoring.
2026-06-22 21:37:32 +02:00
larssand
aa0167b9ff
update readme
2026-06-22 21:27:37 +02:00
larssand
0bc51bdd0d
add new name for it SignalScope
2026-06-22 21:14:54 +02:00
larssand
9c51b92303
fix view in profile stream field and readme
2026-06-22 21:10:17 +02:00
larssand
d41d318134
add baseline and sqlite
2026-06-21 15:04:23 +02:00
larssand
395a86e157
add rotation
2026-06-21 15:00:13 +02:00
larssand
5e257b7d47
add ollama bagcround run and cache
2026-06-18 23:13:16 +02:00
larssand
6530e51700
add ip rep
2026-06-18 23:03:21 +02:00
larssand
f7611ef2b3
ad VS
2026-06-18 22:51:54 +02:00
