Entire Rule Engine and Detection Pipeline

lol big update, lemme go in chronological order what i did

Bug fixes

so i fixed a bug in SSH Pipeline where it was trying to send an event for EVERY journal ingestion which is not what i want because not every sshd journal log is important, so i added a check where if the log isnt about password failed or accepted then it wont ignore it.
__
i also added Rule Name column in detection table which i forgot to add.

Rule Engine setup

so in this “setup” i made the database table and seeded it with 2 rules manually so i can make the detection functions first.
ofc the two rules were the Sus Process match type rule and SSH Bruteforce threshold type rule.
__
the detection engine is just the previous hardcoded one but now works with database variables, it still has the same the group by checking for threshold based rules, and for match rules i made the input be command seperated for example the values to be matched with can be nc, netcat, ncat, nmap

Rule CRUD Endpoints

created 5 endpoints on backend

1. GET /rules/ - lists all rules
2. POST /rules/ - creates rule
3. PATCH - /rules/id - update a rule
4. DELETE - /rules/id - delete a rule
5. PATCH - /rules/id/toggle - toggle on a rule, small thing so made a seperate endpoint

Dashboard

created pages:

1. /rules - shows rules table
2. /rules/new - creates new rules

---

Pending things: /rules/id page on dashboard, will do that later with rule updating feature

Next: probably more types of events or config improvement, not decided.