Mick 6cd9da82da Auto-load detection library from S1 API, improve coverage map accuracy ...

- Fetch detection library rules from platform-rules API at startup (falls
  back to extracted.json); adds Sync Detection Library button for refresh
- Parser column simplified to ✓ Parsed / ✗ Not Parsed
- Detection counts now use library rules only (exclude custom STAR rules)
- Add close-match suggestions for dataSource.name mismatches (e.g. CloudTrail
  → AWS CloudTrail, Microsoft 365 Collaboration → Microsoft O365)
- Exclude SentinelOne Ranger AD from coverage map (native S1 source)
- Add success feedback banners to Load SDL Parsers and Sync Library buttons
- Remove rule_counts.json manual override; extracted.json is source of truth
- Remove Load Detections button; rules auto-import on backend startup
- Add get_account_id() and get_platform_rules() to s1_client

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-20 15:14:10 -04:00

..

routers

Auto-load detection library from S1 API, improve coverage map accuracy

2026-05-20 15:14:10 -04:00

services

Auto-load detection library from S1 API, improve coverage map accuracy

2026-05-20 15:14:10 -04:00

db.py

Use parsed event detection in data lake as coverage signal

2026-05-19 13:06:29 -04:00

Dockerfile

Initial commit: SIEM Toolkit for SentinelOne

2026-05-19 11:39:26 -04:00

main.py

Auto-load detection library from S1 API, improve coverage map accuracy

2026-05-20 15:14:10 -04:00

requirements.txt

Initial commit: SIEM Toolkit for SentinelOne

2026-05-19 11:39:26 -04:00