Mick 1b07a59991 Use parsed event detection in data lake as coverage signal ...

- sync-sources now runs a parallel PowerQuery checking for event.type
  population per source; count stored in new active_sources.parser_detected
- Coverage map marks a source as covered if parser_detected > 0, even
  without a matching local parser file (handles built-in/cloud parsers)
- UI parser cell shows "Parsed (N typed events detected)" for data-lake-
  detected parsers vs named local parser files
- Runtime ALTER TABLE migration adds parser_detected column to existing DBs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-19 13:06:29 -04:00

backend

Use parsed event detection in data lake as coverage signal

2026-05-19 13:06:29 -04:00

db

Initial commit: SIEM Toolkit for SentinelOne

2026-05-19 11:39:26 -04:00

frontend

Use parsed event detection in data lake as coverage signal

2026-05-19 13:06:29 -04:00

parsers

Initial commit: SIEM Toolkit for SentinelOne

2026-05-19 11:39:26 -04:00

.env.example

Add Settings page with .env manager

2026-05-19 11:43:41 -04:00

.gitignore

Initial commit: SIEM Toolkit for SentinelOne

2026-05-19 11:39:26 -04:00

build.sh

Initial commit: SIEM Toolkit for SentinelOne

2026-05-19 11:39:26 -04:00

docker-compose.yml

Add Settings page with .env manager

2026-05-19 11:43:41 -04:00

S

Description

Mirror of https://github.com/marcredhat/SIEM-toolkit-patched

445 KiB

Languages

Python 59.7%

HTML 31.4%

TypeScript 6.4%

Shell 2.3%

JavaScript 0.1%