v2026.7.29

.flocks/flockshub/index.json

@@ -14640,7 +14640,7 @@
       "name": "SOC Workspace WebUI",
       "description": "SOC workspace pages for posture, overview, and alert investigation.",
       "descriptionCn": "SOC 工作区页面，包含态势、SOC 总览和告警调查。",
-      "version": "1.0.0",
+      "version": "1.1.4",
       "category": "workflow-automation",
       "tags": [
         "siem",

.flocks/flockshub/plugins/webuis/soc_ui/access/soc_alerts_operations.py

@@ -84,6 +84,8 @@
         "_source_type",
         "net_type",
         "direction",
+        "threat_severity",
+        "threat_level",
         "threat_name",
         "threat_type",
         "threat_phase",
@@ -228,7 +230,7 @@ def _incident_from_row(row: InternalDataRow) -> dict[str, Any]:
     record = row.raw
     record_id = _record_id(record)
     observed_at = _observed_at(record)
-    threat_name = _first_text(record, "threat_name", "_threat_type", "report_title") or "SOC alert"
+    threat_name = _first_text(record, "threat_name", "report_title") or "SOC alert"
     threat_msg = _first_text(record, "threat_msg", "report_title", "threat_type")
     verdict = _verdict_bucket(record)
     table_cells = _table_cells(record)
@@ -425,7 +427,7 @@ def _verdict_bucket(record: dict[str, Any]) -> str:
         return "success"
     raw = " ".join(
         _text(record.get(key)).lower()
-        for key in ("attack_verdict", "threat_result", "risk_level", "threat_level")
+        for key in ("attack_verdict", "threat_result")
     )
     if any(marker in raw for marker in ("success", "attack_success", "succeeded")):
         return "success"

.flocks/flockshub/plugins/webuis/soc_ui/manifest.json

@@ -5,7 +5,7 @@
   "name": "SOC Workspace WebUI",
   "description": "SOC workspace pages for posture, overview, and alert investigation.",
   "descriptionCn": "SOC 工作区页面，包含态势、SOC 总览和告警调查。",
-  "version": "1.0.0",
+  "version": "1.1.4",
   "author": "Flocks Team",
   "license": "MIT",
   "homepage": "",

.flocks/flockshub/plugins/webuis/soc_ui/soc_alerts/src/filterValues.ts

@@ -0,0 +1,94 @@
+type Translate = (text: string) => string;
+
+const identityTr: Translate = (text) => text;
+
+const FILTER_VALUE_TEXT: Record<string, Record<string, string>> = {
+  direction: {
+    in: '入站',
+    inbound: '入站',
+    ingress: '入站',
+    out: '出站',
+    outbound: '出站',
+    egress: '出站',
+    lateral: '横向',
+  },
+  threat_severity: {
+    critical: '严重',
+    severe: '严重',
+    high: '高危',
+    medium: '中危',
+    low: '低危',
+    info: '信息',
+    informational: '信息',
+  },
+  threat_level: {
+    critical: '严重',
+    severe: '严重',
+    high: '高危',
+    medium: '中危',
+    low: '低危',
+    info: '信息',
+    informational: '信息',
+  },
+  threat_phase: {
+    recon: '侦察',
+    reconnaissance: '侦察',
+    access: '访问',
+    initial_access: '初始访问',
+    execution: '执行',
+    persistence: '持久化',
+    privilege_escalation: '权限提升',
+    defense_evasion: '防御规避',
+    credential_access: '凭据访问',
+    discovery: '发现',
+    lateral_movement: '横向移动',
+    collection: '收集',
+    command_and_control: '命令与控制',
+    exfiltration: '数据渗出',
+    impact: '影响',
+    exploit: '利用',
+    exploitation: '利用',
+  },
+  threat_result: {
+    attack_success: '攻击成功',
+    success: '成功',
+    succeeded: '成功',
+    attack_failed: '攻击失败',
+    failed: '失败',
+    blocked: '已阻断',
+    detected: '已检测',
+    attack: '攻击行为',
+    benign: '安全',
+    safe: '安全',
+    normal: '正常',
+    unknown: '未知',
+  },
+};
+
+function normalized(value: string) {
+  return value.trim().toLowerCase();
+}
+
+function localizedValueText(key: string, value: string) {
+  return FILTER_VALUE_TEXT[key]?.[normalized(value)] || '';
+}
+
+export function filterOptionText(key: string, value: string, tr: Translate = identityTr) {
+  if (key === 'rsp_status_code') return value || tr('未知响应');
+  if (key === '_source_type' || key === 'net_type') return value || 'unknown';
+  const localizedText = localizedValueText(key, value);
+  return localizedText ? tr(localizedText) : value || tr('空值');
+}
+
+export function matchesFilterOptionSearch(
+  key: string,
+  value: string,
+  search: string,
+  tr: Translate = identityTr,
+) {
+  const query = normalized(search);
+  if (!query) return true;
+  const localizedText = localizedValueText(key, value);
+  return [value, localizedText, localizedText ? tr(localizedText) : '']
+    .some((candidate) => normalized(candidate).includes(query));
+}

.flocks/flockshub/plugins/webuis/soc_ui/soc_alerts/src/index.tsx

@@ -1,8 +1,9 @@
 import { Fragment, useCallback, useEffect, useMemo, useRef, useState } from 'react';
 import { api } from '@flocks/webui-contract-sdk';
+import { filterOptionText, matchesFilterOptionSearch } from './filterValues';
 
 type Tone = 'red' | 'orange' | 'blue' | 'green' | 'purple' | 'slate';
-type FilterKey = '_source_type' | 'net_type' | 'direction' | 'threat_name' | 'threat_type' | 'threat_phase' | 'threat_result' | 'rsp_status_code' | 'sip' | 'dport' | 'dip' | 'req_host' | 'threat_rule_id';
+type FilterKey = '_source_type' | 'net_type' | 'direction' | 'threat_severity' | 'threat_level' | 'threat_name' | 'threat_type' | 'threat_phase' | 'threat_result' | 'rsp_status_code' | 'sip' | 'dport' | 'dip' | 'req_host' | 'threat_rule_id';
 type TimeRangeKey = '15m' | '1h' | '2h' | '24h' | 'today' | '7d' | '30d';
 type TimeFilterMode = 'relative' | 'custom';
 type TimePanelTab = 'auto' | 'custom';
@@ -201,6 +202,8 @@ const EN_TEXT: Record<string, string> = {
   '数据源': 'Data Source',
   '协议类型': 'Protocol',
   '流量方向': 'Traffic Direction',
+  '严重等级': 'Severity',
+  '威胁级别': 'Threat Level',
   '威胁名称': 'Threat Name',
   '威胁类型': 'Threat Type',
   '攻击阶段': 'Attack Stage',
@@ -261,6 +264,34 @@ const EN_TEXT: Record<string, string> = {
   '展开趋势图': 'Expand timeline',
   '攻击成功': 'Attack Success',
   '攻击失败': 'Attack Failed',
+  '入站': 'Inbound',
+  '出站': 'Outbound',
+  '横向': 'Lateral',
+  '严重': 'Critical',
+  '高危': 'High',
+  '中危': 'Medium',
+  '低危': 'Low',
+  '信息': 'Informational',
+  '侦察': 'Reconnaissance',
+  '初始访问': 'Initial Access',
+  '执行': 'Execution',
+  '持久化': 'Persistence',
+  '权限提升': 'Privilege Escalation',
+  '防御规避': 'Defense Evasion',
+  '凭据访问': 'Credential Access',
+  '发现': 'Discovery',
+  '横向移动': 'Lateral Movement',
+  '收集': 'Collection',
+  '命令与控制': 'Command and Control',
+  '数据渗出': 'Exfiltration',
+  '影响': 'Impact',
+  '利用': 'Exploitation',
+  '成功': 'Success',
+  '失败': 'Failed',
+  '已阻断': 'Blocked',
+  '已检测': 'Detected',
+  '安全': 'Benign',
+  '正常': 'Normal',
   '未知': 'Unknown',
   '暂无可展示的告警数据。': 'No alerts to display.',
   '显示 {start}-{end} / {total} 条，每页 {pageSize} 条': 'Showing {start}-{end} / {total}, {pageSize} per page',
@@ -356,6 +387,8 @@ const BASE_FILTER_CONFIGS: FilterConfig[] = [
   { key: '_source_type', label: '数据源' },
   { key: 'net_type', label: '协议类型' },
   { key: 'direction', label: '流量方向' },
+  { key: 'threat_severity', label: '严重等级' },
+  { key: 'threat_level', label: '威胁级别' },
   { key: 'threat_name', label: '威胁名称' },
 ];
 
@@ -377,6 +410,8 @@ const DEFAULT_FILTER_VALUES: Record<FilterKey, string[]> = {
   _source_type: ['tdp'],
   net_type: ['http'],
   direction: [],
+  threat_severity: [],
+  threat_level: [],
   threat_name: [],
   threat_type: [],
   threat_phase: [],
@@ -990,9 +1025,7 @@ function readFilterValue(incident: IncidentCluster, key: FilterKey) {
 }
 
 function optionText(key: FilterKey, value: string, tr: Translate = identityTr) {
-  if (key === 'rsp_status_code') return value || tr('未知响应');
-  if (key === '_source_type' || key === 'net_type') return value || 'unknown';
-  return value || tr('空值');
+  return filterOptionText(key, value, tr);
 }
 
 function optionLabel(key: FilterKey, value: string | string[], tr: Translate = identityTr) {
@@ -1118,7 +1151,7 @@ function FilterDropdown({
   }, [open, value]);
 
   const choices = options.filter((option) => option && option !== ALL_FILTER_VALUE);
-  const visibleChoices = choices.filter((choice) => optionText(config.key, choice, tr).toLowerCase().includes(search.trim().toLowerCase()));
+  const visibleChoices = choices.filter((choice) => matchesFilterOptionSearch(config.key, choice, search, tr));
   const selected = new Set(draft.map(normalized));
 
   const toggleChoice = (choice: string) => {