55 lines
3.0 KiB
Python
55 lines
3.0 KiB
Python
from __future__ import annotations
|
|
|
|
from collections import defaultdict
|
|
|
|
from .entities import entity_type
|
|
from .models import AnomalyFinding
|
|
|
|
|
|
def build_incidents(anomalies: list[AnomalyFinding], field_deviations: dict[str, list[dict[str, object]]], correlations: list[dict[str, object]]) -> list[dict[str, object]]:
|
|
"""Build investigation units from any log source, not only network source IPs."""
|
|
groups: dict[str, dict[str, object]] = defaultdict(lambda: {"score": 0, "evidence": [], "fields": [], "correlations": [], "timeline": []})
|
|
for anomaly in anomalies:
|
|
group = groups[anomaly.subject]
|
|
group["score"] = max(int(group["score"]), anomaly.score)
|
|
group["evidence"].extend(anomaly.reasons)
|
|
for entity, deviations in field_deviations.items():
|
|
group = groups[entity]
|
|
group["fields"].extend(deviations)
|
|
active = [item for item in deviations if item.get("feedback") not in {"expected", "false_positive"}]
|
|
group["score"] = min(100, int(group["score"]) + min(30, sum(int(item.get("score", 0)) for item in active)))
|
|
group["evidence"].extend(str(item.get("reason", "")) for item in active)
|
|
for item in active:
|
|
group["timeline"].extend(item.get("sample_events", []))
|
|
for correlation in correlations:
|
|
entity = str(correlation.get("entity") or correlation.get("source_ip") or "")
|
|
if not entity:
|
|
continue
|
|
group = groups[entity]
|
|
group["correlations"].append(correlation)
|
|
group["score"] = min(100, int(group["score"]) + 10 + min(15, int(correlation.get("security_events", 0)) * 2))
|
|
group["evidence"].append(f"observed across {len(correlation.get('streams', []))} streams")
|
|
group["timeline"].extend(correlation.get("samples", []))
|
|
|
|
incidents = []
|
|
for entity, group in groups.items():
|
|
if not group["evidence"]:
|
|
continue
|
|
score = int(group["score"])
|
|
severity = "critical" if score >= 85 else "high" if score >= 60 else "medium" if score >= 35 else "low"
|
|
streams = sorted({stream for item in group["correlations"] for stream in item.get("streams", [])} | {str(item.get("stream_name") or item.get("stream_title") or item.get("stream_id", "")) for item in group["fields"] if item.get("stream_id") or item.get("stream_name") or item.get("stream_title")})
|
|
timeline = sorted(group["timeline"], key=lambda item: str(item.get("timestamp", "")))[:20]
|
|
incidents.append({
|
|
"entity": entity,
|
|
"entity_type": entity_type(entity),
|
|
"score": score,
|
|
"severity": severity,
|
|
"evidence": list(dict.fromkeys(str(item) for item in group["evidence"] if item))[:8],
|
|
"field_deviations": len(group["fields"]),
|
|
"correlated_streams": streams,
|
|
"timeline": timeline,
|
|
"first_seen": timeline[0].get("timestamp", "") if timeline else "",
|
|
"last_seen": timeline[-1].get("timestamp", "") if timeline else "",
|
|
})
|
|
return sorted(incidents, key=lambda item: int(item["score"]), reverse=True)
|