Tomas Kracmar
b35cac42e0
Some checks failed
CI / lint-and-test (push) Has been cancelled
- Migrate frontend to Alpine.js for reactive state management
- Add source health dashboard in UI and /api/source-health endpoint
- Add event tagging (PATCH /api/events/{id}/tags) and commenting (POST /api/events/{id}/comments)
- Add CSV/JSON export from the UI
- Add rule-based alerting engine (rules.py) with CRUD endpoints (/api/rules)
- Add SIEM export via webhook (siem.py)
- Add AOC audit trail middleware logging all mutations to aoc_audit collection
- Update config with SIEM_ENABLED, SIEM_WEBHOOK_URL, ALERTS_ENABLED
- Add tests for rules engine, tags, comments, and source health
67 lines
1.4 KiB
Python
67 lines
1.4 KiB
Python
from pydantic import BaseModel, ConfigDict
|
|
|
|
|
|
class EventItem(BaseModel):
|
|
id: str | None = None
|
|
timestamp: str | None = None
|
|
service: str | None = None
|
|
operation: str | None = None
|
|
result: str | None = None
|
|
actor_display: str | None = None
|
|
target_displays: list[str] | None = None
|
|
display_summary: str | None = None
|
|
display_category: str | None = None
|
|
dedupe_key: str | None = None
|
|
actor: dict | None = None
|
|
targets: list[dict] | None = None
|
|
raw: dict | None = None
|
|
raw_text: str | None = None
|
|
tags: list[str] | None = None
|
|
comments: list[dict] | None = None
|
|
|
|
model_config = ConfigDict(extra="allow")
|
|
|
|
|
|
class PaginatedEventResponse(BaseModel):
|
|
items: list[dict]
|
|
total: int
|
|
page_size: int
|
|
next_cursor: str | None = None
|
|
|
|
|
|
class FilterOptionsResponse(BaseModel):
|
|
services: list[str]
|
|
operations: list[str]
|
|
results: list[str]
|
|
actors: list[str]
|
|
actor_upns: list[str]
|
|
devices: list[str]
|
|
|
|
|
|
class FetchAuditLogsResponse(BaseModel):
|
|
stored_events: int
|
|
errors: list[str]
|
|
|
|
|
|
class SourceHealthResponse(BaseModel):
|
|
source: str
|
|
last_fetch_time: str | None = None
|
|
status: str
|
|
|
|
|
|
class TagsUpdateRequest(BaseModel):
|
|
tags: list[str]
|
|
|
|
|
|
class CommentAddRequest(BaseModel):
|
|
text: str
|
|
|
|
|
|
class AlertRuleResponse(BaseModel):
|
|
id: str | None = None
|
|
name: str
|
|
enabled: bool
|
|
severity: str
|
|
conditions: list[dict]
|
|
message: str
|