Initial commit: SIEM Toolkit for SentinelOne

mirror of https://github.com/marcredhat/SIEM-toolkit-patched synced 2026-06-08 12:33:51 +00:00

Dockerized SecOps toolkit with:
- Coverage Map: STAR rule vs SDL parser field coverage analysis
- Ingest Dashboard: PowerQuery-powered event volume and source breakdown
- Onboarding Assistant: AI-guided log source onboarding with Claude
- Parser management via SDL MCP integration

Stack: FastAPI + PostgreSQL backend, nginx-served HTML frontend, Docker Compose.
PowerQuery runs via Scalyr XDR API (SDL_XDR_URL + SDL_LOG_READ_KEY).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

This commit is contained in:

Mick

2026-05-19 11:39:26 -04:00

commit c182d837ee

42 changed files with 2273 additions and 0 deletions

									
										db/init.sql
									
		+3
		
												View File
												
				@@ -0,0 +1,3 @@

				-- Tables are created by SQLAlchemy on startup.

				-- This file exists for the postgres healthcheck mount.

				SELECT 1;