[konkos1]

Summary

Improve the Insights engine so findings use event time, retain bounded evidence after raw-event retention, and distinguish observed facts from temporal relationships. Add bounded scan/ban correlation across multiple IPs and assets, plus fixed comparisons of observed weekly access-error and GeoBlock counts.

• Validate and import declarative rules atomically, preserve remote overrides, and add schema-2 scan/ban rules with resumable workers and bounded anchor scans.
• Add evidence detail pages, clearer certainty labels, event-time ordering, and sample-based investigation links.
• Provide paginated JSON downloads and separately opt-in MQTT publishing with minimal payloads, no historical replay, and retry-safe cursors.
• Add database migrations, classify CrowdSec ASN policy bans before correlation, and update the relevant ADRs and website guides.

Validation

• cd backend && .venv/bin/python -m pytest tests/test_insight*.py tests/test_mqtt_insight_export.py tests/test_plugin_insight_rules.py tests/test_dashboard_insights.py -q: 641 passed, 15 warnings about SQLite expression-index reflection.
• git diff --check origin/main...HEAD: passed.
• The full backend suite, website build, and container checks were not run during PR preparation.

Review notes

• Includes four database migrations for evidence, schema-2 rules, and query indexes; legacy findings retain their existing text without reconstructed evidence.
• Trend findings report observed counts and do not establish continuous log coverage or causality.
• MQTT Insight publishing is off by default and requires explicit opt-in.
• Public schema-2 ruleset publication remains gated on a compatible app release.