Mick 6e137438b1 Add Detection Fields Missing column + STAR_LIBRARY_ONLY setting ...

Coverage Map:
- New "Detection Fields Missing" column shows dotted-path SDL fields that
  associated STAR rules reference but the parser does not provide
- Only dotted field paths (src.ip, winEventLog.channel) are considered;
  single-word correlation variables and metadata tokens are excluded
- Schema fields always present in events (dataSource.name, event.type etc)
  are excluded from the missing list

Settings:
- New STAR_LIBRARY_ONLY field (select: true/false) controls whether
  Load Library STAR Rules filters to @sentinelone.com creators or loads all
- Rendered as a dropdown in the Settings form with a hint description
- saveSettings now always persists select field values (not just non-empty)
- load-star-rules reads STAR_LIBRARY_ONLY env var as its default

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-19 15:46:05 -04:00

..

__init__.py

Initial commit: SIEM Toolkit for SentinelOne

2026-05-19 11:39:26 -04:00

coverage.py

Add Detection Fields Missing column + STAR_LIBRARY_ONLY setting

2026-05-19 15:46:05 -04:00

ingest.py

Improve coverage map matching, bar chart gradients, and add 1h time filter

2026-05-19 12:43:10 -04:00

quality.py

Add Parser Quality page: Live Event Sampler, Field Population Rate, Parser Test Runner

2026-05-19 12:53:48 -04:00

settings.py

Add Detection Fields Missing column + STAR_LIBRARY_ONLY setting

2026-05-19 15:46:05 -04:00