mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-10 21:31:19 +00:00
Revert "Preserve parser_detected across syncs to prevent coverage regression"
This reverts commit 21c8644443.
This commit is contained in:
@@ -565,13 +565,6 @@ async def sync_sources(days: int = 7, db: Session = Depends(get_db)):
|
|||||||
if name:
|
if name:
|
||||||
parsed_by_source[name] = row.get("parsed", 0)
|
parsed_by_source[name] = row.get("parsed", 0)
|
||||||
|
|
||||||
# Preserve existing parser_detected values so a source once confirmed as
|
|
||||||
# parsed never loses its "Covered" status due to a sampling gap or timeout.
|
|
||||||
existing_detected: dict[str, int] = {
|
|
||||||
s.source_name: (s.parser_detected or 0)
|
|
||||||
for s in db.query(ActiveSource).all()
|
|
||||||
}
|
|
||||||
|
|
||||||
rows = volume_result.get("events", [])
|
rows = volume_result.get("events", [])
|
||||||
db.query(ActiveSource).delete()
|
db.query(ActiveSource).delete()
|
||||||
synced_at = datetime.utcnow()
|
synced_at = datetime.utcnow()
|
||||||
@@ -579,14 +572,11 @@ async def sync_sources(days: int = 7, db: Session = Depends(get_db)):
|
|||||||
for row in rows:
|
for row in rows:
|
||||||
name = row.get("dataSource.name")
|
name = row.get("dataSource.name")
|
||||||
if name and name not in _S1_NATIVE_SOURCES:
|
if name and name not in _S1_NATIVE_SOURCES:
|
||||||
# Keep the highest parser_detected ever seen for this source
|
|
||||||
new_detected = parsed_by_source.get(name, 0)
|
|
||||||
prev_detected = existing_detected.get(name, 0)
|
|
||||||
db.add(ActiveSource(
|
db.add(ActiveSource(
|
||||||
source_name=name,
|
source_name=name,
|
||||||
event_count=row.get("events", 0),
|
event_count=row.get("events", 0),
|
||||||
synced_at=synced_at,
|
synced_at=synced_at,
|
||||||
parser_detected=max(new_detected, prev_detected),
|
parser_detected=parsed_by_source.get(name, 0),
|
||||||
))
|
))
|
||||||
seen += 1
|
seen += 1
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user