Add unlabelled event detection, stub parser quality, Sync All, and modern UI redesign

mirror of https://github.com/marcredhat/SIEM-toolkit-patched synced 2026-06-09 04:47:16 +00:00

Key changes:
- Unlabelled event banner: shows count only after Sample Events is clicked; uses broad SDL filter expression; time window synced to sync-days dropdown
- Parser Quality: new "Attributes Missing" subsection listing all parsers without dataSource.name regardless of event volume
- Coverage map: filter buttons (All / Complete Parser / Attributes Missing); stat card renamed to "Incomplete Parser"; stub count excluded from sync when no active sources
- Sync All button: runs SDL parser sync → library sync → live sources sync in sequence
- Reset now clears ActiveSource table and resets unlabelled count cache
- run_powerquery: configurable max_count param (default 1000, 50M for count queries)
- _DS_NAME_RE: supports both quoted and unquoted dataSource.name keys in parser files
- Full modern UI redesign: slate palette, gradient cards, ring borders, pill nav, colored stat accents
- Updated 7 tracked parser files synced from SDL

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

This commit is contained in:

Mick

2026-05-22 10:00:21 -04:00

parent 0013adbe7e

commit c5a4f796a0

15 changed files with 3498 additions and 469 deletions

									
										docker-compose.yml
									
		+1
		
												View File
												
				@@ -15,6 +15,7 @@ services:

				      - S1_BASE_URL=${S1_BASE_URL}

				      - SDL_XDR_URL=${SDL_XDR_URL}

				      - SDL_LOG_READ_KEY=${SDL_LOG_READ_KEY}

				      - SDL_CONFIG_READ_KEY=${SDL_CONFIG_READ_KEY}

				      - ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY}

				      - DATABASE_URL=postgresql://siem:siem@db:5432/siem

				      - DETECTIONS_FILE=/app/data/detections.json