PapaTramp/security-alert-center
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: problem rules v1 brute-force, privilege spike, host silence (d1-3)

Browse Source 
- Threshold rules on ingest; heartbeat auto-resolves host silence

- Config thresholds in sac-api.env; unit tests

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
PTah
2026-05-28 09:51:05 +10:00
parent 83f48dce97
commit 64b5ef297a
7 changed files with 450 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/work-plan.md
+2 -2
View File
@@ -83,7 +83,7 @@
- [x] `d1-1` Ingest: `event_id` UUID обязателен, UNIQUE индекс, коды duplicate, логи, docs/schema
- [x] `d1-2` MVP Problems: модель, корреляция `host+type+окно`, API `GET/ack/resolve`
- [ ] `d1-3` Правила v1: `brute-force burst`, `privilege spike`, `host silence`
- [x] `d1-3` Правила v1: `brute-force burst`, `privilege spike`, `host silence`
### День 2
@@ -112,7 +112,7 @@
- [x] `13:00–14:30` модель Problems + миграция
- [x] `14:30–16:00` корреляция при ingest (`fingerprint`, `count`, `last_seen`)
- [x] `16:00–17:30` API `GET /problems`, `ack`, `resolve` + smoke
- [ ] `18:00–19:00` правила `brute/privilege/silence` + unit tests
- [x] `18:00–19:00` правила `brute/privilege/silence` + unit tests
#### День 2