mirror of
https://github.com/marcredhat/SIEM-toolkit-patched
synced 2026-06-08 20:37:12 +00:00
Mick
f0bd56aee8
Previously showed field-level coverage (rule fields vs parser fields).
Now shows per-dataSource.name coverage: is a parser loaded for each
active ingest source?
- New ActiveSource DB model stores live sources from SDL
- New POST /api/coverage/sync-sources endpoint runs PowerQuery to fetch
current dataSource.names and their event counts, stores in DB
- GET /api/coverage/map now returns per-source status:
covered = a loaded parser matches this source name
parser_needed = source is ingesting but no parser is loaded
- Parser matching uses fuzzy substring (handles "palo"→"Palo Alto Networks Firewall")
- Coverage table shows: source name, 7d event count, status, matched parser + field count, STAR rules
- Frontend: new "Sync Live Sources" button, updated stats cards, updated filter tabs
- Removed field-level view (was confusing — parser_needed on a field ≠ missing parser for a source)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
55 lines
1.6 KiB
Python
55 lines
1.6 KiB
Python
import os
|
|
from sqlalchemy import create_engine, Column, Integer, String, Float, DateTime, Text
|
|
from sqlalchemy.dialects.postgresql import JSONB
|
|
from sqlalchemy.orm import declarative_base, sessionmaker
|
|
from datetime import datetime
|
|
|
|
DATABASE_URL = os.environ.get("DATABASE_URL", "postgresql://siem:siem@db:5432/siem")
|
|
|
|
engine = create_engine(DATABASE_URL)
|
|
SessionLocal = sessionmaker(autocommit=False, autoflush=False, bind=engine)
|
|
Base = declarative_base()
|
|
|
|
|
|
class ParsedRule(Base):
|
|
__tablename__ = "parsed_rules"
|
|
id = Column(Integer, primary_key=True)
|
|
rule_id = Column(String, unique=True, index=True)
|
|
name = Column(String)
|
|
rule_type = Column(String) # 'star' or 'sigma'
|
|
fields_used = Column(JSONB)
|
|
raw = Column(Text)
|
|
cached_at = Column(DateTime, default=datetime.utcnow)
|
|
|
|
|
|
class ParserField(Base):
|
|
__tablename__ = "parser_fields"
|
|
id = Column(Integer, primary_key=True)
|
|
parser_name = Column(String, index=True)
|
|
field_name = Column(String)
|
|
field_type = Column(String)
|
|
|
|
|
|
class ActiveSource(Base):
|
|
__tablename__ = "active_sources"
|
|
id = Column(Integer, primary_key=True)
|
|
source_name = Column(String, unique=True, index=True)
|
|
event_count = Column(Integer, default=0)
|
|
synced_at = Column(DateTime, default=datetime.utcnow)
|
|
|
|
|
|
class IngestSnapshot(Base):
|
|
__tablename__ = "ingest_snapshots"
|
|
id = Column(Integer, primary_key=True)
|
|
period_days = Column(Integer)
|
|
data = Column(JSONB)
|
|
recorded_at = Column(DateTime, default=datetime.utcnow)
|
|
|
|
|
|
def get_db():
|
|
db = SessionLocal()
|
|
try:
|
|
yield db
|
|
finally:
|
|
db.close()
|