nsmcp::AccessAnalytics method correlateWarnings (public)

 <instance of nsmcp::AccessAnalytics> correlateWarnings samples \
    redactor

Defined in /usr/local/ns/tcl/nsmcp/access-analytics.tcl

Correlate bounded warning examples with retained access records. Use the existing start-time index only; do not scan raw logs or trigger ingestion or historical backfill. Peer addresses are never selected.

Parameters:

samples (required)

Up to three dictionaries with requestIdentifier and timestamp; optional system-log User-Agent fields take precedence over the cached agent.

redactor (required)

Redactor object applied before returning diagnostic evidence.

Returns:

Rooted JSON triples with sampled evidence and explicit missing and ambiguous counts.

Testcases:

No testcase defined.