mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 20:37:12 +00:00
Mick
d0299e0f23
Tenant Health Score: - CoverageSnapshot table stores daily health metrics (parser %, MITRE %, firing %) - _compute_health() weighted formula: 40% parser coverage + 35% MITRE + 25% firing (reweighted 55/45 when firing cache empty) - GET /api/coverage/health returns score + delta vs previous snapshot - GET /api/coverage/snapshots returns chronological history for sparklines - POST /api/coverage/snapshot for manual recording - Auto-snapshot recorded at end of every sync-sources call - Overview dashboard: prominent health score card with color coding, component breakdown, delta indicator, and inline SVG sparkline (last 30 points) Rule Dependency Map: - GET /api/coverage/dependency-map flips the coverage map — rule → required sources - Each source flagged healthy/inactive/no_parser; at_risk = any source missing - New section on Threat Coverage tab with at-risk filter toggle PowerQuery Playground: - New query.py router: GET /presets (7 curated queries) + POST /run - New Query nav tab with time-range pills, preset buttons, localStorage history, monospace textarea, auto-column results table, client-side CSV export Onboarding Tracker: - GET /api/coverage/onboarding-status returns per-source pipeline progress across 6 stages: Data Received → Parser File → Parser Active → Source Labeled → Detection Rules → Rules Firing - New section on Onboarding tab with emoji stage dots, progress bars, collapsed completed sources with show/hide toggle Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
83 lines
2.9 KiB
Python
83 lines
2.9 KiB
Python
import os
|
|
from sqlalchemy import create_engine, Column, Integer, String, Float, DateTime, Text, Boolean
|
|
from sqlalchemy.dialects.postgresql import JSONB
|
|
from sqlalchemy.orm import declarative_base, sessionmaker
|
|
from datetime import datetime
|
|
|
|
DATABASE_URL = os.environ.get("DATABASE_URL", "postgresql://siem:siem@db:5432/siem")
|
|
|
|
engine = create_engine(DATABASE_URL)
|
|
SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
|
|
Base = declarative_base()
|
|
|
|
|
|
class ParsedRule(Base):
|
|
__tablename__ = "parsed_rules"
|
|
id = Column(Integer, primary_key=True)
|
|
rule_id = Column(String, unique=True, index=True)
|
|
name = Column(String)
|
|
rule_type = Column(String) # 'star' or 'sigma'
|
|
fields_used = Column(JSONB)
|
|
raw = Column(Text)
|
|
cached_at = Column(DateTime, default=datetime.utcnow)
|
|
|
|
|
|
class ParserField(Base):
|
|
__tablename__ = "parser_fields"
|
|
id = Column(Integer, primary_key=True)
|
|
parser_name = Column(String, index=True)
|
|
field_name = Column(String)
|
|
field_type = Column(String)
|
|
|
|
|
|
class ActiveSource(Base):
|
|
__tablename__ = "active_sources"
|
|
id = Column(Integer, primary_key=True)
|
|
source_name = Column(String, unique=True, index=True)
|
|
event_count = Column(Integer, default=0)
|
|
synced_at = Column(DateTime, default=datetime.utcnow)
|
|
parser_detected = Column(Integer, default=0) # >0 means parsed events seen in data lake
|
|
unlabelled = Column(Boolean, default=False) # True = events had no dataSource.name
|
|
|
|
|
|
class IngestSnapshot(Base):
|
|
__tablename__ = "ingest_snapshots"
|
|
id = Column(Integer, primary_key=True)
|
|
period_days = Column(Integer)
|
|
data = Column(JSONB)
|
|
recorded_at = Column(DateTime, default=datetime.utcnow)
|
|
|
|
|
|
class RuleFiringCache(Base):
|
|
__tablename__ = "rule_firing_cache"
|
|
id = Column(Integer, primary_key=True)
|
|
rule_name = Column(String, unique=True, index=True)
|
|
alert_count = Column(Integer, default=0)
|
|
period_days = Column(Integer, default=30)
|
|
checked_at = Column(DateTime, default=datetime.utcnow)
|
|
|
|
|
|
class CoverageSnapshot(Base):
|
|
__tablename__ = "coverage_snapshots"
|
|
id = Column(Integer, primary_key=True)
|
|
recorded_at = Column(DateTime, default=datetime.utcnow, index=True)
|
|
health_score = Column(Float, default=0.0)
|
|
parser_pct = Column(Float, default=0.0) # % sources with working parser
|
|
mitre_pct = Column(Float, default=0.0) # % ATT&CK tactics covered
|
|
firing_pct = Column(Float, default=0.0) # % rules that have fired
|
|
active_sources = Column(Integer, default=0)
|
|
covered_sources = Column(Integer, default=0)
|
|
rules_loaded = Column(Integer, default=0)
|
|
tactics_covered = Column(Integer, default=0)
|
|
techniques_covered = Column(Integer, default=0)
|
|
rules_with_mitre = Column(Integer, default=0)
|
|
rules_fired = Column(Integer, default=0)
|
|
|
|
|
|
def get_db():
|
|
db = SessionLocal()
|
|
try:
|
|
yield db
|
|
finally:
|
|
db.close()
|