3 Commits

Author	SHA1	Message	Date
Mick	ac97196435	Improve coverage map matching, bar chart gradients, and add 1h time filter ... - Coverage map: replace filename fuzzy-match with exact dataSource.name lookup read directly from parser file attributes; grok/dottedJson parsers now flagged as "parser_needed" with format type shown in the UI - Bar chart: SVG linearGradient (light purple → deep violet) replaces flat fill - Ingest dashboard: add 1h button (first option) backed by new backend hours= query param on /api/ingest/top-sources; daily-volume chart shows informational message when in 1h mode Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-19 12:43:10 -04:00
Mick	735e364b71	Fix Ingest Dashboard timeout causing failed to fetch ... - daily-volume: run per-day PowerQueries in parallel with asyncio.gather instead of sequentially with sleeps — 3 days now completes in ~16s vs 140s+ - Default view changed from 7d to 3d; day buttons updated to [3, 5, 7] - igLoad: fire daily-volume and top-sources simultaneously with Promise.allSettled so both panels load in parallel rather than one after the other - Each panel shows "Querying data lake…" spinner while loading - Each panel renders independently — one failure doesn't block the other Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-19 11:53:37 -04:00
Mick	c182d837ee	Initial commit: SIEM Toolkit for SentinelOne ... Dockerized SecOps toolkit with: - Coverage Map: STAR rule vs SDL parser field coverage analysis - Ingest Dashboard: PowerQuery-powered event volume and source breakdown - Onboarding Assistant: AI-guided log source onboarding with Claude - Parser management via SDL MCP integration Stack: FastAPI + PostgreSQL backend, nginx-served HTML frontend, Docker Compose. PowerQuery runs via Scalyr XDR API (SDL_XDR_URL + SDL_LOG_READ_KEY). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-05-19 11:39:26 -04:00