Skip to content

LOTC-677: Add TrafficPeak Bot Insights SIEM assets#136

Open
kevinborkman-hub wants to merge 18 commits intomainfrom
LOTC-677/trafficpeak-bot-insights-siem
Open

LOTC-677: Add TrafficPeak Bot Insights SIEM assets#136
kevinborkman-hub wants to merge 18 commits intomainfrom
LOTC-677/trafficpeak-bot-insights-siem

Conversation

@kevinborkman-hub
Copy link
Copy Markdown
Collaborator

@kevinborkman-hub kevinborkman-hub commented Mar 25, 2026

Summary

  • Adds TrafficPeak Bot Insights SIEM solution bundle assets including dashboard, summary SQL files, transform, and bundle config
  • Assets sourced from cac-tools reference implementation

Jira

LOTC-677

Test plan

  • Validate bundle config is well-formed
  • Verify dashboard JSON loads correctly
  • Confirm summary SQL and transform are correct per the runbook

🤖 Generated with Claude Code

kevinborkman-hub and others added 3 commits March 25, 2026 16:30
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@kevinborkman-hub kevinborkman-hub force-pushed the LOTC-677/trafficpeak-bot-insights-siem branch from 8b57a1f to e6e8b2e Compare March 25, 2026 20:33
@kevinborkman-hub kevinborkman-hub temporarily deployed to bundle-validator-env April 8, 2026 19:38 — with GitHub Actions Inactive
@kcorbett-hdx kcorbett-hdx temporarily deployed to bundle-validator-env April 8, 2026 23:07 — with GitHub Actions Inactive
kcorbett-hdx
kcorbett-hdx previously approved these changes Apr 8, 2026
@kcorbett-hdx kcorbett-hdx temporarily deployed to bundle-validator-env April 8, 2026 23:49 — with GitHub Actions Inactive
kcorbett-hdx
kcorbett-hdx previously approved these changes Apr 8, 2026
kevinborkman-hub and others added 2 commits April 15, 2026 11:13
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
github-actions Bot and others added 7 commits April 15, 2026 16:34
These computed columns are required by the summary SQL but were missing
from the raw transform's sql_transform and output_columns.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Hourly summary had extra columns (ai_category, is_bot_traffic, status,
host, country, city, asn, bytes) not present in the transform. Updated
from upstream cac-tools repo which simplified all three summaries to
the same column set.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
ClickHouse rejected "botScoreRange: multiIf(...)" — the colon named
expression syntax isn't valid in this context. Changed both
resource_category and botScoreRange to use "multiIf(...) AS column"
to match the existing transform style.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants