mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 12:33:51 +00:00
Use parsed event detection in data lake as coverage signal
- sync-sources now runs a parallel PowerQuery checking for event.type population per source; count stored in new active_sources.parser_detected - Coverage map marks a source as covered if parser_detected > 0, even without a matching local parser file (handles built-in/cloud parsers) - UI parser cell shows "Parsed (N typed events detected)" for data-lake- detected parsers vs named local parser files - Runtime ALTER TABLE migration adds parser_detected column to existing DBs Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
+5
-1
@@ -272,7 +272,11 @@ function cvSetFilter(f) {
|
||||
|
||||
function parserCell(s) {
|
||||
if (s.status === 'covered') {
|
||||
return `<span class="text-gray-400">${esc(s.parser)} <span class="text-gray-600">(${s.parser_fields} fields)</span></span>`
|
||||
if (s.parser === 'detected in data') {
|
||||
return `<span class="text-emerald-400">✓ Parsed <span class="text-emerald-700">(${(s.parser_detected||0).toLocaleString()} typed events detected)</span></span>`
|
||||
}
|
||||
const detail = s.parser_fields ? ` (${s.parser_fields} fields)` : ''
|
||||
return `<span class="text-gray-400">${esc(s.parser)}${detail}</span>`
|
||||
}
|
||||
if (s.parser && s.format_type && s.format_type !== 'custom') {
|
||||
return `<span class="text-amber-400 italic">⚠ ${esc(s.parser)} <span class="text-amber-600">(${esc(s.format_type)} — needs custom parser)</span></span>`
|
||||
|
||||
Reference in New Issue
Block a user