Tomas Kracmar
0ef50c91f7
Features: - Add /api/ask endpoint for plain-language audit log queries - Regex-based time/entity extraction (no LLM required for parsing) - LLM-powered narrative summarisation with OpenAI-compatible APIs - Graceful fallback to structured bullet lists when LLM is unavailable - Frontend ask panel with markdown rendering and cited events Production: - Harden Dockerfile: non-root user, gunicorn+uvicorn workers - Add docker-compose.prod.yml with internal networks and health checks - Add nginx reverse proxy with security headers - MongoDB no longer exposed externally in production Tests: - 29 new tests for ask parsing, query building, and endpoint behaviour - Fix conftest monkeypatch for routes.ask events collection Bump version to 1.1.0
95 lines
2.0 KiB
Python
95 lines
2.0 KiB
Python
from pydantic import BaseModel, ConfigDict
|
|
|
|
|
|
class EventItem(BaseModel):
|
|
id: str | None = None
|
|
timestamp: str | None = None
|
|
service: str | None = None
|
|
operation: str | None = None
|
|
result: str | None = None
|
|
actor_display: str | None = None
|
|
target_displays: list[str] | None = None
|
|
display_summary: str | None = None
|
|
display_category: str | None = None
|
|
dedupe_key: str | None = None
|
|
actor: dict | None = None
|
|
targets: list[dict] | None = None
|
|
raw: dict | None = None
|
|
raw_text: str | None = None
|
|
tags: list[str] | None = None
|
|
comments: list[dict] | None = None
|
|
|
|
model_config = ConfigDict(extra="allow")
|
|
|
|
|
|
class PaginatedEventResponse(BaseModel):
|
|
items: list[dict]
|
|
total: int
|
|
page_size: int
|
|
next_cursor: str | None = None
|
|
|
|
|
|
class FilterOptionsResponse(BaseModel):
|
|
services: list[str]
|
|
operations: list[str]
|
|
results: list[str]
|
|
actors: list[str]
|
|
actor_upns: list[str]
|
|
devices: list[str]
|
|
|
|
|
|
class FetchAuditLogsResponse(BaseModel):
|
|
stored_events: int
|
|
errors: list[str]
|
|
|
|
|
|
class SourceHealthResponse(BaseModel):
|
|
source: str
|
|
last_fetch_time: str | None = None
|
|
last_attempt_time: str | None = None
|
|
status: str
|
|
|
|
|
|
class TagsUpdateRequest(BaseModel):
|
|
tags: list[str]
|
|
|
|
|
|
class BulkTagsRequest(BaseModel):
|
|
tags: list[str]
|
|
mode: str = "append" # "append" or "replace"
|
|
|
|
|
|
class CommentAddRequest(BaseModel):
|
|
text: str
|
|
|
|
|
|
class AlertRuleResponse(BaseModel):
|
|
id: str | None = None
|
|
name: str
|
|
enabled: bool
|
|
severity: str
|
|
conditions: list[dict]
|
|
message: str
|
|
|
|
|
|
class AskRequest(BaseModel):
|
|
question: str
|
|
|
|
|
|
class AskEventRef(BaseModel):
|
|
id: str | None = None
|
|
timestamp: str | None = None
|
|
operation: str | None = None
|
|
actor_display: str | None = None
|
|
target_displays: list[str] | None = None
|
|
display_summary: str | None = None
|
|
service: str | None = None
|
|
result: str | None = None
|
|
|
|
|
|
class AskResponse(BaseModel):
|
|
answer: str
|
|
events: list[AskEventRef]
|
|
query_info: dict
|
|
llm_used: bool
|