larssand caa37de98e Fix cardinality judged against sample size instead of real event volume ...

classify_field_shape() received a deduplicated set of observed values with
no real event-volume context, so cardinality was always measured against
itself — trivially 100%, making any field with more than ~16 distinct
values look "high cardinality" no matter how large the real traffic volume
was. This misclassified genuinely low-cardinality fields (e.g. username: 82
distinct values across 1,601 events) as free text, which the new shape-veto
work then surfaced as false-positive "remove this field" warnings in
production. Fixed by passing real event coverage as an explicit
total_events parameter; omitting it keeps prior behavior for other callers.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-09-23 22:02:44 +02:00

..

test_anomaly.py

fix anon

2026-09-23 13:32:09 +02:00

test_baseline.py

Pool baseline state across streams sharing an entity concept

2026-09-23 18:50:14 +02:00

test_cli.py

Implemented the next roadmap step: direct Graylog MCP replay with temporary baselines.

2026-06-25 18:34:51 +02:00

test_config.py

add rule generalization, sized LLM defaults, ops docs, and UI polish

2026-09-23 13:04:53 +02:00

test_correlation.py

Entity labels now resolve like this for IP-based entities:

2026-07-02 20:30:33 +02:00

test_dashboard.py

Pool baseline state across streams sharing an entity concept

2026-09-23 18:50:14 +02:00

test_data_quality.py

Added data-quality health checks.

2026-06-23 22:56:54 +02:00

test_detectors.py

Continued the Detection Quality roadmap.

2026-06-24 21:32:18 +02:00

test_diagnostics.py

add dynamic

2026-06-18 21:48:32 +02:00

test_entities.py

add value-shape field classification and auto-apply

2026-09-07 21:58:25 +02:00

test_event_context.py

Entity labels now resolve like this for IP-based entities:

2026-07-02 20:30:33 +02:00

test_exports.py

investigation export.

2026-06-29 19:48:29 +02:00

test_feedback.py

add rule generalization, sized LLM defaults, ops docs, and UI polish

2026-09-23 13:04:53 +02:00

test_field_shapes.py

Fix cardinality judged against sample size instead of real event volume

2026-09-23 22:02:44 +02:00

test_graylog_aggregate.py

add timeout mcp poll

2026-07-02 21:17:50 +02:00

test_graylog_mcp.py

add nested poll check mcp

2026-07-06 11:03:05 +02:00

test_graylog_source.py

add timeout mcp poll

2026-07-02 21:17:50 +02:00

test_history.py

add value-shape field classification and auto-apply

2026-09-07 21:58:25 +02:00

test_incidents.py

fix clear investi

2026-07-06 16:49:30 +02:00

test_llm.py

add value-shape field classification and auto-apply

2026-09-07 21:58:25 +02:00

test_logs.py

first add

2026-06-18 21:03:07 +02:00

test_metrics.py

add feedback scopes, revoke and precision metrics

2026-09-07 19:51:54 +02:00

test_mitigation.py

first add

2026-06-18 21:03:07 +02:00

test_monitor.py

Pool baseline state across streams sharing an entity concept

2026-09-23 18:50:14 +02:00

test_normalization.py

MCP sample fetch now asks for common Winlogbeat/ECS fields before

2026-06-30 15:10:47 +02:00

test_policies.py

add timoute och export av fg config

2026-06-18 22:17:03 +02:00

test_profile_suggestions.py

Fix cardinality judged against sample size instead of real event volume

2026-09-23 22:02:44 +02:00

test_query_details.py

Graylog query details

2026-06-29 19:26:16 +02:00

test_recommendations.py

Field baseline deviations now show distinct Mark expected, Mark false positive, and Mark confirmed

2026-06-24 18:54:37 +02:00

test_replay.py

Implemented the next roadmap step: direct Graylog MCP replay with temporary baselines.

2026-06-25 18:34:51 +02:00

test_sequences.py

sequence detection

2026-06-25 22:05:04 +02:00

test_stream_profiles.py

add value-shape field classification and auto-apply

2026-09-07 21:58:25 +02:00

test_syslog_server.py

add rotation

2026-06-21 15:00:13 +02:00

test_triage.py

Implemented cleanup/triage direction. ui, and baselinbe days

2026-06-29 20:20:00 +02:00