Initial commit: SIEM Toolkit for SentinelOne

Dockerized SecOps toolkit with:
- Coverage Map: STAR rule vs SDL parser field coverage analysis
- Ingest Dashboard: PowerQuery-powered event volume and source breakdown
- Onboarding Assistant: AI-guided log source onboarding with Claude
- Parser management via SDL MCP integration

Stack: FastAPI + PostgreSQL backend, nginx-served HTML frontend, Docker Compose.
PowerQuery runs via Scalyr XDR API (SDL_XDR_URL + SDL_LOG_READ_KEY).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

docker-compose.yml

@@ -0,0 +1,42 @@
+services:
+  frontend:
+    build: ./frontend
+    ports:
+      - "3001:3000"
+    depends_on:
+      - backend
+
+  backend:
+    build: ./backend
+    ports:
+      - "8001:8000"
+    environment:
+      - S1_API_TOKEN=${S1_API_TOKEN}
+      - S1_BASE_URL=${S1_BASE_URL}
+      - SDL_XDR_URL=${SDL_XDR_URL}
+      - SDL_LOG_READ_KEY=${SDL_LOG_READ_KEY}
+      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}
+      - DATABASE_URL=postgresql://siem:siem@db:5432/siem
+    depends_on:
+      db:
+        condition: service_healthy
+    volumes:
+      - ./parsers:/app/parsers
+
+  db:
+    image: postgres:16-alpine
+    environment:
+      - POSTGRES_DB=siem
+      - POSTGRES_USER=siem
+      - POSTGRES_PASSWORD=siem
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+      - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U siem"]
+      interval: 5s
+      timeout: 5s
+      retries: 5
+
+volumes:
+  pgdata: