4 Commits

Author	SHA1	Message	Date
marc	8dbd38f3bb	Fix Parser Test Runner JSON mode, Filter Simulator PQ syntax, dropdown source ... - backend/routers/quality.py * Add GET /api/quality/parsers (lists actual files in /app/parsers) * Support SDL JSON auto-extract parsers ($=json{parse=json}$) * Apply parser rewrite blocks with correct $0/$N backref translation * Accept single JSON / JSON array / NDJSON in test-parser body * Flatten JSON inside 'message' for Field Population coverage - backend/routers/ingest.py * Rewrite simulate-filter PowerQuery to valid SDL syntax * Correct field name: src.name -> dataSource.name - frontend/index.html * Parser dropdown loads from /api/quality/parsers * Add 'Last 7d' lookback option * Render JSON-mode test results with badges + payload counter	2026-05-20 19:40:24 +02:00
Mick	ac97196435	Improve coverage map matching, bar chart gradients, and add 1h time filter ... - Coverage map: replace filename fuzzy-match with exact dataSource.name lookup read directly from parser file attributes; grok/dottedJson parsers now flagged as "parser_needed" with format type shown in the UI - Bar chart: SVG linearGradient (light purple → deep violet) replaces flat fill - Ingest dashboard: add 1h button (first option) backed by new backend hours= query param on /api/ingest/top-sources; daily-volume chart shows informational message when in 1h mode Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-19 12:43:10 -04:00
Mick	735e364b71	Fix Ingest Dashboard timeout causing failed to fetch ... - daily-volume: run per-day PowerQueries in parallel with asyncio.gather instead of sequentially with sleeps — 3 days now completes in ~16s vs 140s+ - Default view changed from 7d to 3d; day buttons updated to [3, 5, 7] - igLoad: fire daily-volume and top-sources simultaneously with Promise.allSettled so both panels load in parallel rather than one after the other - Each panel shows "Querying data lake…" spinner while loading - Each panel renders independently — one failure doesn't block the other Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-19 11:53:37 -04:00
Mick	c182d837ee	Initial commit: SIEM Toolkit for SentinelOne ... Dockerized SecOps toolkit with: - Coverage Map: STAR rule vs SDL parser field coverage analysis - Ingest Dashboard: PowerQuery-powered event volume and source breakdown - Onboarding Assistant: AI-guided log source onboarding with Claude - Parser management via SDL MCP integration Stack: FastAPI + PostgreSQL backend, nginx-served HTML frontend, Docker Compose. PowerQuery runs via Scalyr XDR API (SDL_XDR_URL + SDL_LOG_READ_KEY). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-19 11:39:26 -04:00