2 Commits

Author	SHA1	Message	Date
Tomas Kracmar	e348881083	feat: Admin Operations SIEM — alerts, notifications, pre-built rules ... - Add pluggable notification system (webhook, Slack, Teams) with retry - Add alert deduplication: same rule + actor within 15 min = one alert - Add 10 pre-built admin-ops rule templates seeded on startup: - Failed Conditional Access, After-Hours Admin Activity - New Application Registration, Admin Role Assignment - License Change, Bulk User Deletion - Device Compliance Failure, Exchange Transport Rule Change - Service Principal Credential Added, External Sharing Enabled - Add /api/alerts, /api/alerts/{id}/status, /api/alerts/summary endpoints - Add alert dashboard to frontend with status filters and ack/resolve buttons - Add alert summary badge in hero header (high/medium/low counts) - New env vars: ALERT_WEBHOOK_URL, ALERT_WEBHOOK_FORMAT, ALERT_DEDUPE_MINUTES	2026-04-22 14:12:36 +02:00
Tomas Kracmar	b35cac42e0	feat: implement Phase 4 enhancements ... - Migrate frontend to Alpine.js for reactive state management - Add source health dashboard in UI and /api/source-health endpoint - Add event tagging (PATCH /api/events/{id}/tags) and commenting (POST /api/events/{id}/comments) - Add CSV/JSON export from the UI - Add rule-based alerting engine (rules.py) with CRUD endpoints (/api/rules) - Add SIEM export via webhook (siem.py) - Add AOC audit trail middleware logging all mutations to aoc_audit collection - Update config with SIEM_ENABLED, SIEM_WEBHOOK_URL, ALERTS_ENABLED - Add tests for rules engine, tags, comments, and source health	2026-04-14 15:38:39 +02:00