Device watch data layer - #14
Open
ashleigh-byte wants to merge 3 commits into
Open
ashleigh-byte wants to merge 3 commits into
ashleigh-byte wants to merge 3 commits into
Conversation
Pure schema change with no consumers yet: nmap-derived MAC address, vendor, and hostname data will be tracked per device scan starting in a follow-up PR. Existing databases auto-migrate in place via _migrate_device_scans_columns() so upgrading doesn't require recreating the database.
…ty tracking Builds on the device_scans schema from #<PR1>. Extracts nmap-derived MAC address, vendor, and hostname per device (nmap only resolves MAC/vendor for hosts on the same local subnet it can ARP directly, which the existing sudo ARP scan already covers). Adds get_latest_devices_with_novelty(), which flags devices whose MAC hasn't been seen in any scan within the last 14 days -- devices with no resolvable MAC are never flagged as new, since there's no reliable identity to compare against. No reporting/AI changes yet -- this is data layer only. Surfacing this in the AI report is a separate follow-up PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Second PR in the split of the previous oversized branch (depends on #13 , the device_scans schema migration). Pure data layer — no reporting/AI changes yet.
runner.py: extracts MAC, vendor, and hostname from the existing nmap XML scan. nmap only resolves MAC/vendor for hosts on the same local subnet it can ARP directly, which the existing sudo ARP scan already covers — no new scan flags needed.models.py: adds optionalmac,vendor,hostnamefields toNetworkDevice.sqlite.py:add_devicesnow persists the new fields; addsget_latest_devices_with_novelty(), which returns the latest scan's devices annotated with whether each MAC was seen in any scan in the last 14 days. Devices with no resolvable MAC are never flagged as new (no reliable identity to compare against).Surfacing any of this in the AI report (vendor breakdown, new-devices list) is a separate follow-up PR.