Snapshot 95 demo-tenant parsers (incl. stormshield) + un-ignore parsers/

The original upstream gitignores parsers/* on the assumption that each tenant has its own set. This fork commits a working snapshot so the Parser Test Runner and Parser Coverage features are usable out of the box. Stormshield parser exercises the new SDL key=value scanner, pattern references, and JS-style unquoted format keys added to backend/routers/quality.py.
2026-06-11 05:41:19 +00:00 · 2026-05-22 14:11:39 +02:00
parent 1e61fa9814
commit a9dcf48e65
96 changed files with 14742 additions and 5 deletions
@@ -0,0 +1,73 @@
+{
+  "duration": "24h",
+  "description": "Active threats and detection triggers across OCSF sources",
+  "graphs": [
+    {
+      "title": "About This Dashboard",
+      "graphStyle": "markdown",
+      "markdown": "## OCSF Threat Detection\nMonitors suspicious activity patterns across all OCSF-normalized log sources.\n\n**Key Indicators:**\n- Brute force attempts (3+ failed logins)\n- Port scanning (5+ unique ports)\n- Suspicious process execution\n- Lateral movement indicators",
+      "layout": {
+        "w": 60,
+        "h": 6,
+        "x": 0,
+        "y": 0
+      }
+    },
+    {
+      "title": "Brute Force Attempts",
+      "graphStyle": "table",
+      "query": "message contains 'Failed password' or message contains 'authentication failure' | group failed_attempts=count() by src_ip, user_name | filter failed_attempts >= 3 | sort -failed_attempts | limit 20",
+      "layout": {
+        "w": 30,
+        "h": 14,
+        "x": 0,
+        "y": 6
+      }
+    },
+    {
+      "title": "Port Scan Sources",
+      "graphStyle": "table",
+      "query": "action = 'deny' dstport = * srcip = * | group hits=count() by srcip, dstport | group unique_ports=count() by srcip | filter unique_ports >= 5 | sort -unique_ports | limit 15",
+      "layout": {
+        "w": 30,
+        "h": 14,
+        "x": 30,
+        "y": 6
+      }
+    },
+    {
+      "title": "Suspicious Process Execution",
+      "graphStyle": "table",
+      "query": "message contains 'mimikatz' or message contains 'psexec' or message contains 'netcat' or message contains 'reverse shell' or message contains 'powershell -enc' | columns timestamp, serverHost, message | limit 50",
+      "layout": {
+        "w": 60,
+        "h": 14,
+        "x": 0,
+        "y": 20
+      }
+    },
+    {
+      "title": "Lateral Movement Indicators",
+      "graphStyle": "table",
+      "query": "(dstport = 22 or dstport = 3389 or dstport = 445 or dstport = 5985) srcip = * | group conns=count() by srcip, dstport | filter conns >= 3 | sort -conns | limit 15",
+      "layout": {
+        "w": 30,
+        "h": 14,
+        "x": 0,
+        "y": 34
+      }
+    },
+    {
+      "title": "C2 Beacon Activity",
+      "graphStyle": "stacked_bar",
+      "xAxis": "grouped_data",
+      "query": "(dstport = 4444 or dstport = 8080 or dstport = 1337) srcip = * | group count() by srcip | sort -count | limit 10",
+      "layout": {
+        "w": 30,
+        "h": 14,
+        "x": 30,
+        "y": 34
+      }
+    }
+  ]
+}