feat: add timestamp tracking to flows with first_seen_at/last_seen_at/observed_at fields across all collectors

Add FIREWALL_LOG_TS_RE regex to parse timestamps from firewall log lines, implement firewall_log_seen_at to extract and convert log timestamps to UTC ISO format, add first_seen_at/last_seen_at/observed_at fields to flows in collect_packet_flows (AF_PACKET collector) with timestamp updates on flow aggregation, add timestamp fields to collect_flows (conntrack collector) and parse_firewall_log_line (

backend/app/agent_assets/nexafabric-ebpf.go

@@ -55,13 +55,16 @@ type flowValue struct {
 	Direction       string `json:"direction,omitempty"`
 	State           string `json:"state"`
 	Collector       string `json:"collector"`
+	FirstSeenAt     string `json:"first_seen_at"`
+	LastSeenAt      string `json:"last_seen_at"`
+	ObservedAt      string `json:"observed_at"`
 }
 
 type diagnostics struct {
-	AttachMode         string   `json:"attach_mode"`
+	AttachMode          string   `json:"attach_mode"`
 	InterfacesRequested []string `json:"interfaces_requested"`
 	InterfacesAttached  []string `json:"interfaces_attached"`
-	Errors             []string `json:"errors"`
+	Errors              []string `json:"errors"`
 }
 
 type payload struct {
@@ -189,9 +192,11 @@ func openSocket(interfaceName string) (int, error) {
 
 func collect(interfaceNames []string, duration time.Duration, limit int) payload {
 	result := payload{
+		Flows: []flowValue{},
 		Diagnostics: diagnostics{
 			AttachMode:          "af_packet_raw_socket",
 			InterfacesRequested: interfaceNames,
+			InterfacesAttached:  []string{},
 			Errors:              []string{},
 		},
 	}
@@ -258,6 +263,7 @@ func collect(interfaceNames []string, duration time.Duration, limit int) payload
 			if !ok {
 				continue
 			}
+			now := time.Now().UTC().Format(time.RFC3339Nano)
 			key.Interface = socket.name
 			key.VMID, key.NIC = interfaceMeta(socket.name)
 			key.Direction = "ingress"
@@ -278,11 +284,16 @@ func collect(interfaceNames []string, duration time.Duration, limit int) payload
 					Direction:       key.Direction,
 					State:           "observed",
 					Collector:       "ebpf-helper",
+					FirstSeenAt:     now,
+					LastSeenAt:      now,
+					ObservedAt:      now,
 				}
 				flows[key] = current
 			}
 			current.Packets++
 			current.Bytes += uint64(bytes)
+			current.LastSeenAt = now
+			current.ObservedAt = now
 			if len(flows) >= limit {
 				break
 			}