secmon-lab/alertchain

Support GraphQL interface

Opened this issue · 0 comments

m-mizutani commented

Why

AlertChain can output workflow progress and results as structured logs. It can be used for testing and debugging for production environment. However it's suitable for only developer and difficult to understand them for non-developer of AlertChain.

AlertChain's concept is lightweight SOAR and it should not have heavy UI component. So it should have data access API and provide capability to build separated front-end implementation liek
most of other SOAR production.

ToDo

  • Add GraphQL schema and interface implementation
  • Add authentication mechanism for GraphQL query (and original /alert path also)
  • Implement small web UI as example