Epic: Unified Request Timeline — full request lifecycle correlation

[jmrGrav]

Goal

Correlate every data source that touches a single HTTP request into one chronological timeline, so an operator can trace an IP from first probe to final outcome without switching tools.

Why this matters

Today each data source (nginx, Cloudflare WAF, CrowdSec, AbuseIPDB) shows a fragment of the story. During an active incident, operators must mentally join these fragments. The Unified Timeline makes the join automatic.

Scope

• Nginx access log ingestion (structured, per-request)
• OpenResty/Lua event emission (future)
• Cloudflare WAF event correlation by IP + time window
• CrowdSec decision events (ban, suppress, report)
• AbuseIPDB enrichment at query time
• VirusTotal enrichment (optional, rate-limited)
• Final request outcome (allowed / suppressed / banned / rate-limited)
• Timeline grouping by incident (correlated burst)
• Export as NDJSON for SIEM ingestion

Non-goals

• Real-time streaming (polling-based is acceptable at v1.x)
• Multi-host correlation (single host scope)
• Log storage beyond the SQLite WAL window

Related milestones

• v1.7.9: WAF Events structured panel, nginx correlation widget
• v1.8.0: Causal correlation engine alpha
• v1.9.0: Full root-cause reasoning

Causal reasoning note

v1.9 must not just ingest more logs — it must answer why a ban happened: entry vector → score accumulation → threshold crossing → ban decision → CF propagation. Correlation without causation is noise.