@panguard-ai/core 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (233) hide show
  1. package/dist/adapters/adapter-registry.d.ts +150 -0
  2. package/dist/adapters/adapter-registry.d.ts.map +1 -0
  3. package/dist/adapters/adapter-registry.js +271 -0
  4. package/dist/adapters/adapter-registry.js.map +1 -0
  5. package/dist/adapters/base-adapter.d.ts +101 -0
  6. package/dist/adapters/base-adapter.d.ts.map +1 -0
  7. package/dist/adapters/base-adapter.js +160 -0
  8. package/dist/adapters/base-adapter.js.map +1 -0
  9. package/dist/adapters/defender-adapter.d.ts +90 -0
  10. package/dist/adapters/defender-adapter.d.ts.map +1 -0
  11. package/dist/adapters/defender-adapter.js +227 -0
  12. package/dist/adapters/defender-adapter.js.map +1 -0
  13. package/dist/adapters/index.d.ts +22 -0
  14. package/dist/adapters/index.d.ts.map +1 -0
  15. package/dist/adapters/index.js +23 -0
  16. package/dist/adapters/index.js.map +1 -0
  17. package/dist/adapters/syslog-adapter.d.ts +207 -0
  18. package/dist/adapters/syslog-adapter.d.ts.map +1 -0
  19. package/dist/adapters/syslog-adapter.js +432 -0
  20. package/dist/adapters/syslog-adapter.js.map +1 -0
  21. package/dist/adapters/types.d.ts +135 -0
  22. package/dist/adapters/types.d.ts.map +1 -0
  23. package/dist/adapters/types.js +13 -0
  24. package/dist/adapters/types.js.map +1 -0
  25. package/dist/adapters/wazuh-adapter.d.ts +120 -0
  26. package/dist/adapters/wazuh-adapter.d.ts.map +1 -0
  27. package/dist/adapters/wazuh-adapter.js +266 -0
  28. package/dist/adapters/wazuh-adapter.js.map +1 -0
  29. package/dist/ai/claude-provider.d.ts +66 -0
  30. package/dist/ai/claude-provider.d.ts.map +1 -0
  31. package/dist/ai/claude-provider.js +166 -0
  32. package/dist/ai/claude-provider.js.map +1 -0
  33. package/dist/ai/funnel-router.d.ts +75 -0
  34. package/dist/ai/funnel-router.d.ts.map +1 -0
  35. package/dist/ai/funnel-router.js +173 -0
  36. package/dist/ai/funnel-router.js.map +1 -0
  37. package/dist/ai/index.d.ts +77 -0
  38. package/dist/ai/index.d.ts.map +1 -0
  39. package/dist/ai/index.js +95 -0
  40. package/dist/ai/index.js.map +1 -0
  41. package/dist/ai/ollama-provider.d.ts +73 -0
  42. package/dist/ai/ollama-provider.d.ts.map +1 -0
  43. package/dist/ai/ollama-provider.js +200 -0
  44. package/dist/ai/ollama-provider.js.map +1 -0
  45. package/dist/ai/openai-provider.d.ts +70 -0
  46. package/dist/ai/openai-provider.d.ts.map +1 -0
  47. package/dist/ai/openai-provider.js +175 -0
  48. package/dist/ai/openai-provider.js.map +1 -0
  49. package/dist/ai/prompts/event-classifier.d.ts +25 -0
  50. package/dist/ai/prompts/event-classifier.d.ts.map +1 -0
  51. package/dist/ai/prompts/event-classifier.js +94 -0
  52. package/dist/ai/prompts/event-classifier.js.map +1 -0
  53. package/dist/ai/prompts/index.d.ts +13 -0
  54. package/dist/ai/prompts/index.d.ts.map +1 -0
  55. package/dist/ai/prompts/index.js +13 -0
  56. package/dist/ai/prompts/index.js.map +1 -0
  57. package/dist/ai/prompts/report-generator.d.ts +25 -0
  58. package/dist/ai/prompts/report-generator.d.ts.map +1 -0
  59. package/dist/ai/prompts/report-generator.js +131 -0
  60. package/dist/ai/prompts/report-generator.js.map +1 -0
  61. package/dist/ai/prompts/threat-analyzer.d.ts +26 -0
  62. package/dist/ai/prompts/threat-analyzer.d.ts.map +1 -0
  63. package/dist/ai/prompts/threat-analyzer.js +75 -0
  64. package/dist/ai/prompts/threat-analyzer.js.map +1 -0
  65. package/dist/ai/provider-base.d.ts +100 -0
  66. package/dist/ai/provider-base.d.ts.map +1 -0
  67. package/dist/ai/provider-base.js +166 -0
  68. package/dist/ai/provider-base.js.map +1 -0
  69. package/dist/ai/response-parser.d.ts +36 -0
  70. package/dist/ai/response-parser.d.ts.map +1 -0
  71. package/dist/ai/response-parser.js +195 -0
  72. package/dist/ai/response-parser.js.map +1 -0
  73. package/dist/ai/token-tracker.d.ts +72 -0
  74. package/dist/ai/token-tracker.d.ts.map +1 -0
  75. package/dist/ai/token-tracker.js +145 -0
  76. package/dist/ai/token-tracker.js.map +1 -0
  77. package/dist/ai/types.d.ts +138 -0
  78. package/dist/ai/types.d.ts.map +1 -0
  79. package/dist/ai/types.js +12 -0
  80. package/dist/ai/types.js.map +1 -0
  81. package/dist/cli/index.d.ts +146 -0
  82. package/dist/cli/index.d.ts.map +1 -0
  83. package/dist/cli/index.js +515 -0
  84. package/dist/cli/index.js.map +1 -0
  85. package/dist/cli/prompts.d.ts +58 -0
  86. package/dist/cli/prompts.d.ts.map +1 -0
  87. package/dist/cli/prompts.js +327 -0
  88. package/dist/cli/prompts.js.map +1 -0
  89. package/dist/cli/wizard.d.ts +58 -0
  90. package/dist/cli/wizard.d.ts.map +1 -0
  91. package/dist/cli/wizard.js +200 -0
  92. package/dist/cli/wizard.js.map +1 -0
  93. package/dist/discovery/firewall-checker.d.ts +28 -0
  94. package/dist/discovery/firewall-checker.d.ts.map +1 -0
  95. package/dist/discovery/firewall-checker.js +379 -0
  96. package/dist/discovery/firewall-checker.js.map +1 -0
  97. package/dist/discovery/index.d.ts +23 -0
  98. package/dist/discovery/index.d.ts.map +1 -0
  99. package/dist/discovery/index.js +29 -0
  100. package/dist/discovery/index.js.map +1 -0
  101. package/dist/discovery/network-scanner.d.ts +60 -0
  102. package/dist/discovery/network-scanner.d.ts.map +1 -0
  103. package/dist/discovery/network-scanner.js +640 -0
  104. package/dist/discovery/network-scanner.js.map +1 -0
  105. package/dist/discovery/os-detector.d.ts +24 -0
  106. package/dist/discovery/os-detector.d.ts.map +1 -0
  107. package/dist/discovery/os-detector.js +253 -0
  108. package/dist/discovery/os-detector.js.map +1 -0
  109. package/dist/discovery/osquery-provider.d.ts +127 -0
  110. package/dist/discovery/osquery-provider.d.ts.map +1 -0
  111. package/dist/discovery/osquery-provider.js +214 -0
  112. package/dist/discovery/osquery-provider.js.map +1 -0
  113. package/dist/discovery/risk-scorer.d.ts +66 -0
  114. package/dist/discovery/risk-scorer.d.ts.map +1 -0
  115. package/dist/discovery/risk-scorer.js +294 -0
  116. package/dist/discovery/risk-scorer.js.map +1 -0
  117. package/dist/discovery/security-tools.d.ts +31 -0
  118. package/dist/discovery/security-tools.d.ts.map +1 -0
  119. package/dist/discovery/security-tools.js +346 -0
  120. package/dist/discovery/security-tools.js.map +1 -0
  121. package/dist/discovery/service-detector.d.ts +28 -0
  122. package/dist/discovery/service-detector.d.ts.map +1 -0
  123. package/dist/discovery/service-detector.js +300 -0
  124. package/dist/discovery/service-detector.js.map +1 -0
  125. package/dist/discovery/types.d.ts +502 -0
  126. package/dist/discovery/types.d.ts.map +1 -0
  127. package/dist/discovery/types.js +12 -0
  128. package/dist/discovery/types.js.map +1 -0
  129. package/dist/discovery/user-auditor.d.ts +28 -0
  130. package/dist/discovery/user-auditor.d.ts.map +1 -0
  131. package/dist/discovery/user-auditor.js +385 -0
  132. package/dist/discovery/user-auditor.js.map +1 -0
  133. package/dist/i18n/config.d.ts +45 -0
  134. package/dist/i18n/config.d.ts.map +1 -0
  135. package/dist/i18n/config.js +135 -0
  136. package/dist/i18n/config.js.map +1 -0
  137. package/dist/i18n/index.d.ts +8 -0
  138. package/dist/i18n/index.d.ts.map +1 -0
  139. package/dist/i18n/index.js +8 -0
  140. package/dist/i18n/index.js.map +1 -0
  141. package/dist/index.d.ts +31 -0
  142. package/dist/index.d.ts.map +1 -0
  143. package/dist/index.js +31 -0
  144. package/dist/index.js.map +1 -0
  145. package/dist/monitor/event-normalizer.d.ts +102 -0
  146. package/dist/monitor/event-normalizer.d.ts.map +1 -0
  147. package/dist/monitor/event-normalizer.js +195 -0
  148. package/dist/monitor/event-normalizer.js.map +1 -0
  149. package/dist/monitor/file-monitor.d.ts +90 -0
  150. package/dist/monitor/file-monitor.d.ts.map +1 -0
  151. package/dist/monitor/file-monitor.js +222 -0
  152. package/dist/monitor/file-monitor.js.map +1 -0
  153. package/dist/monitor/index.d.ts +147 -0
  154. package/dist/monitor/index.d.ts.map +1 -0
  155. package/dist/monitor/index.js +293 -0
  156. package/dist/monitor/index.js.map +1 -0
  157. package/dist/monitor/log-monitor.d.ts +102 -0
  158. package/dist/monitor/log-monitor.d.ts.map +1 -0
  159. package/dist/monitor/log-monitor.js +245 -0
  160. package/dist/monitor/log-monitor.js.map +1 -0
  161. package/dist/monitor/network-monitor.d.ts +103 -0
  162. package/dist/monitor/network-monitor.d.ts.map +1 -0
  163. package/dist/monitor/network-monitor.js +336 -0
  164. package/dist/monitor/network-monitor.js.map +1 -0
  165. package/dist/monitor/process-monitor.d.ts +108 -0
  166. package/dist/monitor/process-monitor.d.ts.map +1 -0
  167. package/dist/monitor/process-monitor.js +245 -0
  168. package/dist/monitor/process-monitor.js.map +1 -0
  169. package/dist/monitor/threat-intel-feeds.d.ts +141 -0
  170. package/dist/monitor/threat-intel-feeds.d.ts.map +1 -0
  171. package/dist/monitor/threat-intel-feeds.js +430 -0
  172. package/dist/monitor/threat-intel-feeds.js.map +1 -0
  173. package/dist/monitor/threat-intel.d.ts +83 -0
  174. package/dist/monitor/threat-intel.d.ts.map +1 -0
  175. package/dist/monitor/threat-intel.js +215 -0
  176. package/dist/monitor/threat-intel.js.map +1 -0
  177. package/dist/monitor/types.d.ts +65 -0
  178. package/dist/monitor/types.d.ts.map +1 -0
  179. package/dist/monitor/types.js +20 -0
  180. package/dist/monitor/types.js.map +1 -0
  181. package/dist/rules/index.d.ts +115 -0
  182. package/dist/rules/index.d.ts.map +1 -0
  183. package/dist/rules/index.js +244 -0
  184. package/dist/rules/index.js.map +1 -0
  185. package/dist/rules/rule-loader.d.ts +54 -0
  186. package/dist/rules/rule-loader.d.ts.map +1 -0
  187. package/dist/rules/rule-loader.js +167 -0
  188. package/dist/rules/rule-loader.js.map +1 -0
  189. package/dist/rules/sigma-matcher.d.ts +40 -0
  190. package/dist/rules/sigma-matcher.d.ts.map +1 -0
  191. package/dist/rules/sigma-matcher.js +447 -0
  192. package/dist/rules/sigma-matcher.js.map +1 -0
  193. package/dist/rules/sigma-parser.d.ts +36 -0
  194. package/dist/rules/sigma-parser.d.ts.map +1 -0
  195. package/dist/rules/sigma-parser.js +180 -0
  196. package/dist/rules/sigma-parser.js.map +1 -0
  197. package/dist/rules/types.d.ts +112 -0
  198. package/dist/rules/types.d.ts.map +1 -0
  199. package/dist/rules/types.js +11 -0
  200. package/dist/rules/types.js.map +1 -0
  201. package/dist/rules/yara-scanner.d.ts +103 -0
  202. package/dist/rules/yara-scanner.d.ts.map +1 -0
  203. package/dist/rules/yara-scanner.js +421 -0
  204. package/dist/rules/yara-scanner.js.map +1 -0
  205. package/dist/scoring/achievements.d.ts +76 -0
  206. package/dist/scoring/achievements.d.ts.map +1 -0
  207. package/dist/scoring/achievements.js +211 -0
  208. package/dist/scoring/achievements.js.map +1 -0
  209. package/dist/scoring/index.d.ts +3 -0
  210. package/dist/scoring/index.d.ts.map +1 -0
  211. package/dist/scoring/index.js +3 -0
  212. package/dist/scoring/index.js.map +1 -0
  213. package/dist/scoring/security-score.d.ts +60 -0
  214. package/dist/scoring/security-score.d.ts.map +1 -0
  215. package/dist/scoring/security-score.js +211 -0
  216. package/dist/scoring/security-score.js.map +1 -0
  217. package/dist/types.d.ts +71 -0
  218. package/dist/types.d.ts.map +1 -0
  219. package/dist/types.js +8 -0
  220. package/dist/types.js.map +1 -0
  221. package/dist/utils/index.d.ts +10 -0
  222. package/dist/utils/index.d.ts.map +1 -0
  223. package/dist/utils/index.js +9 -0
  224. package/dist/utils/index.js.map +1 -0
  225. package/dist/utils/logger.d.ts +38 -0
  226. package/dist/utils/logger.d.ts.map +1 -0
  227. package/dist/utils/logger.js +71 -0
  228. package/dist/utils/logger.js.map +1 -0
  229. package/dist/utils/validation.d.ts +35 -0
  230. package/dist/utils/validation.d.ts.map +1 -0
  231. package/dist/utils/validation.js +56 -0
  232. package/dist/utils/validation.js.map +1 -0
  233. package/package.json +60 -0
@@ -0,0 +1 @@
1
+ {"version":3,"file":"event-classifier.js","sourceRoot":"","sources":["../../../src/ai/prompts/event-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;;;GAIG;AACH,MAAM,aAAa,GAAG;IACpB,gBAAgB;IAChB,sBAAsB;IACtB,gBAAgB;IAChB,WAAW;IACX,aAAa;IACb,sBAAsB;IACtB,iBAAiB;IACjB,mBAAmB;IACnB,WAAW;IACX,kBAAkB;IAClB,YAAY;IACZ,qBAAqB;IACrB,cAAc;IACd,QAAQ;CACA,CAAC;AAEX;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,wBAAwB,CAAC,KAAoB,EAAE,IAAc;IAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAC9B;QACE,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,SAAS,EAAE,KAAK,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS;QAC5F,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;KACzB,EACD,IAAI,EACJ,CAAC,CACF,CAAC;IAEF,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO;;;EAGT,SAAS;;;EAGT,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;mBAWP,CAAC;IAClB,CAAC;IAED,OAAO;;;EAGP,SAAS;;;EAGT,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;sCAWY,CAAC;AACvC,CAAC"}
@@ -0,0 +1,13 @@
1
+ /**
2
+ * AI prompt templates barrel export
3
+ * AI 提示詞範本統一匯出
4
+ *
5
+ * Re-exports all prompt template functions for use by LLM providers.
6
+ * 重新匯出所有提示詞範本函式供 LLM 供應商使用。
7
+ *
8
+ * @module @panguard-ai/core/ai/prompts
9
+ */
10
+ export { getEventClassifierPrompt } from './event-classifier.js';
11
+ export { getThreatAnalysisPrompt } from './threat-analyzer.js';
12
+ export { getReportPrompt } from './report-generator.js';
13
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ai/prompts/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}
@@ -0,0 +1,13 @@
1
+ /**
2
+ * AI prompt templates barrel export
3
+ * AI 提示詞範本統一匯出
4
+ *
5
+ * Re-exports all prompt template functions for use by LLM providers.
6
+ * 重新匯出所有提示詞範本函式供 LLM 供應商使用。
7
+ *
8
+ * @module @panguard-ai/core/ai/prompts
9
+ */
10
+ export { getEventClassifierPrompt } from './event-classifier.js';
11
+ export { getThreatAnalysisPrompt } from './threat-analyzer.js';
12
+ export { getReportPrompt } from './report-generator.js';
13
+ //# sourceMappingURL=index.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/ai/prompts/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC"}
@@ -0,0 +1,25 @@
1
+ /**
2
+ * Report generation prompt templates
3
+ * 報告產生提示詞範本
4
+ *
5
+ * Generates prompts for summarizing multiple security events
6
+ * into structured security reports.
7
+ * 產生將多個安全事件摘要為結構化安全報告的提示詞。
8
+ *
9
+ * @module @panguard-ai/core/ai/prompts/report-generator
10
+ */
11
+ import type { Language, SecurityEvent } from '../../types.js';
12
+ /**
13
+ * Generate a report summarization prompt for multiple security events
14
+ * 為多個安全事件產生報告摘要提示詞
15
+ *
16
+ * If the number of events exceeds MAX_EVENTS_IN_PROMPT, only the most
17
+ * severe events are included with a statistical summary of the rest.
18
+ * 若事件數量超過 MAX_EVENTS_IN_PROMPT,僅包含最嚴重的事件,並附上其餘事件的統計摘要。
19
+ *
20
+ * @param events - Array of security events to summarize / 要摘要的安全事件陣列
21
+ * @param lang - Output language / 輸出語言
22
+ * @returns Formatted prompt string / 格式化的提示詞字串
23
+ */
24
+ export declare function getReportPrompt(events: SecurityEvent[], lang: Language): string;
25
+ //# sourceMappingURL=report-generator.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"report-generator.d.ts","sourceRoot":"","sources":["../../../src/ai/prompts/report-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAmD9D;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,EAAE,IAAI,EAAE,QAAQ,GAAG,MAAM,CAqE/E"}
@@ -0,0 +1,131 @@
1
+ /**
2
+ * Report generation prompt templates
3
+ * 報告產生提示詞範本
4
+ *
5
+ * Generates prompts for summarizing multiple security events
6
+ * into structured security reports.
7
+ * 產生將多個安全事件摘要為結構化安全報告的提示詞。
8
+ *
9
+ * @module @panguard-ai/core/ai/prompts/report-generator
10
+ */
11
+ /**
12
+ * Maximum number of events to include in the prompt to avoid token limits
13
+ * 提示詞中包含的最大事件數量,以避免超出 Token 限制
14
+ * @internal
15
+ */
16
+ const MAX_EVENTS_IN_PROMPT = 50;
17
+ /**
18
+ * Serialize a security event for inclusion in the prompt
19
+ * 序列化安全事件以包含在提示詞中
20
+ *
21
+ * @param event - Security event to serialize / 要序列化的安全事件
22
+ * @returns Compact string representation / 精簡的字串表示
23
+ * @internal
24
+ */
25
+ function serializeEvent(event) {
26
+ const ts = event.timestamp instanceof Date ? event.timestamp.toISOString() : String(event.timestamp);
27
+ return `[${ts}] [${event.severity.toUpperCase()}] [${event.source}] ${event.host}: ${event.description}`;
28
+ }
29
+ /**
30
+ * Generate a severity distribution summary
31
+ * 產生嚴重等級分布摘要
32
+ *
33
+ * @param events - Array of security events / 安全事件陣列
34
+ * @returns Distribution string / 分布字串
35
+ * @internal
36
+ */
37
+ function getSeverityDistribution(events) {
38
+ const counts = {
39
+ critical: 0,
40
+ high: 0,
41
+ medium: 0,
42
+ low: 0,
43
+ info: 0,
44
+ };
45
+ for (const event of events) {
46
+ const key = event.severity.toLowerCase();
47
+ if (key in counts) {
48
+ counts[key] = (counts[key] ?? 0) + 1;
49
+ }
50
+ }
51
+ return Object.entries(counts)
52
+ .filter(([, count]) => count > 0)
53
+ .map(([level, count]) => `${level}: ${count}`)
54
+ .join(', ');
55
+ }
56
+ /**
57
+ * Generate a report summarization prompt for multiple security events
58
+ * 為多個安全事件產生報告摘要提示詞
59
+ *
60
+ * If the number of events exceeds MAX_EVENTS_IN_PROMPT, only the most
61
+ * severe events are included with a statistical summary of the rest.
62
+ * 若事件數量超過 MAX_EVENTS_IN_PROMPT,僅包含最嚴重的事件,並附上其餘事件的統計摘要。
63
+ *
64
+ * @param events - Array of security events to summarize / 要摘要的安全事件陣列
65
+ * @param lang - Output language / 輸出語言
66
+ * @returns Formatted prompt string / 格式化的提示詞字串
67
+ */
68
+ export function getReportPrompt(events, lang) {
69
+ const total = events.length;
70
+ const distribution = getSeverityDistribution(events);
71
+ // Sort by severity (critical first) and take top N
72
+ // 按嚴重等級排序(critical 優先)並取前 N 個
73
+ const severityOrder = {
74
+ critical: 0,
75
+ high: 1,
76
+ medium: 2,
77
+ low: 3,
78
+ info: 4,
79
+ };
80
+ const sorted = [...events].sort((a, b) => {
81
+ const aOrder = severityOrder[a.severity] ?? 5;
82
+ const bOrder = severityOrder[b.severity] ?? 5;
83
+ return aOrder - bOrder;
84
+ });
85
+ const included = sorted.slice(0, MAX_EVENTS_IN_PROMPT);
86
+ const eventLines = included.map(serializeEvent).join('\n');
87
+ const truncationNote = total > MAX_EVENTS_IN_PROMPT
88
+ ? lang === 'zh-TW'
89
+ ? `\n(注意:共有 ${total} 個事件,以下僅顯示最嚴重的 ${MAX_EVENTS_IN_PROMPT} 個)\n`
90
+ : `\n(Note: ${total} total events, showing the ${MAX_EVENTS_IN_PROMPT} most severe below)\n`
91
+ : '';
92
+ if (lang === 'zh-TW') {
93
+ return `你是一位專業的資安報告撰寫者。請根據以下安全事件產生一份結構化的安全摘要報告。
94
+
95
+ 事件統計:
96
+ - 總事件數量:${total}
97
+ - 嚴重等級分布:${distribution}
98
+ ${truncationNote}
99
+ 安全事件清單:
100
+ ${eventLines}
101
+
102
+ 請產生一份結構化的安全摘要報告,包含以下章節:
103
+
104
+ 1. 總體概述:整體安全狀態的簡要描述
105
+ 2. 關鍵發現:列出最重要的安全發現(最多 5 項)
106
+ 3. 威脅趨勢:觀察到的威脅模式或趨勢
107
+ 4. 建議措施:具體的改善建議(最多 5 項)
108
+ 5. 風險評級:整體風險等級(低/中/高/極高)及理由
109
+
110
+ 請使用繁體中文撰寫,語氣專業簡潔。直接回傳報告文字內容。`;
111
+ }
112
+ return `You are a professional cybersecurity report writer. Generate a structured security summary report based on the following security events.
113
+
114
+ Event Statistics:
115
+ - Total events: ${total}
116
+ - Severity distribution: ${distribution}
117
+ ${truncationNote}
118
+ Security Events:
119
+ ${eventLines}
120
+
121
+ Generate a structured security summary report with the following sections:
122
+
123
+ 1. Executive Summary: Brief description of the overall security posture
124
+ 2. Key Findings: List the most important security findings (up to 5)
125
+ 3. Threat Trends: Observed threat patterns or trends
126
+ 4. Recommendations: Specific improvement recommendations (up to 5)
127
+ 5. Risk Rating: Overall risk level (Low/Medium/High/Critical) with justification
128
+
129
+ Write in a professional and concise tone. Return the report text directly.`;
130
+ }
131
+ //# sourceMappingURL=report-generator.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"report-generator.js","sourceRoot":"","sources":["../../../src/ai/prompts/report-generator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,EAAE,CAAC;AAEhC;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,KAAoB;IAC1C,MAAM,EAAE,GACN,KAAK,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC5F,OAAO,IAAI,EAAE,MAAM,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,WAAW,EAAE,CAAC;AAC3G,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,MAAuB;IACtD,MAAM,MAAM,GAA2B;QACrC,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IACF,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACzC,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC;YAClB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;SAC1B,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,GAAG,CAAC,CAAC;SAChC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,KAAK,KAAK,EAAE,CAAC;SAC7C,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,eAAe,CAAC,MAAuB,EAAE,IAAc;IACrE,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC;IAC5B,MAAM,YAAY,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAErD,mDAAmD;IACnD,8BAA8B;IAC9B,MAAM,aAAa,GAA2B;QAC5C,QAAQ,EAAE,CAAC;QACX,IAAI,EAAE,CAAC;QACP,MAAM,EAAE,CAAC;QACT,GAAG,EAAE,CAAC;QACN,IAAI,EAAE,CAAC;KACR,CAAC;IAEF,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO,MAAM,GAAG,MAAM,CAAC;IACzB,CAAC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACvD,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAE3D,MAAM,cAAc,GAClB,KAAK,GAAG,oBAAoB;QAC1B,CAAC,CAAC,IAAI,KAAK,OAAO;YAChB,CAAC,CAAC,YAAY,KAAK,kBAAkB,oBAAoB,OAAO;YAChE,CAAC,CAAC,YAAY,KAAK,8BAA8B,oBAAoB,uBAAuB;QAC9F,CAAC,CAAC,EAAE,CAAC;IAET,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO;;;UAGD,KAAK;WACJ,YAAY;EACrB,cAAc;;EAEd,UAAU;;;;;;;;;;6BAUiB,CAAC;IAC5B,CAAC;IAED,OAAO;;;kBAGS,KAAK;2BACI,YAAY;EACrC,cAAc;;EAEd,UAAU;;;;;;;;;;2EAU+D,CAAC;AAC5E,CAAC"}
@@ -0,0 +1,26 @@
1
+ /**
2
+ * Threat analysis prompt templates
3
+ * 威脅分析提示詞範本
4
+ *
5
+ * Generates prompts for AI-powered security threat analysis.
6
+ * Supports bilingual output (English and Traditional Chinese).
7
+ * 產生 AI 驅動的安全威脅分析提示詞。支援雙語輸出(英文和繁體中文)。
8
+ *
9
+ * @module @panguard-ai/core/ai/prompts/threat-analyzer
10
+ */
11
+ import type { Language } from '../../types.js';
12
+ /**
13
+ * Generate a threat analysis prompt
14
+ * 產生威脅分析提示詞
15
+ *
16
+ * Creates a prompt that instructs the LLM to analyze a security threat
17
+ * and return structured JSON with summary, severity, confidence, and recommendations.
18
+ * 建立一個提示詞,指示 LLM 分析安全威脅並回傳包含摘要、嚴重等級、信心分數和建議的結構化 JSON。
19
+ *
20
+ * @param prompt - The primary analysis prompt or question / 主要分析提示詞或問題
21
+ * @param context - Optional additional context (logs, environment info) / 可選的額外上下文(日誌、環境資訊)
22
+ * @param lang - Output language / 輸出語言
23
+ * @returns Formatted prompt string / 格式化的提示詞字串
24
+ */
25
+ export declare function getThreatAnalysisPrompt(prompt: string, context: string | undefined, lang: Language): string;
26
+ //# sourceMappingURL=threat-analyzer.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"threat-analyzer.d.ts","sourceRoot":"","sources":["../../../src/ai/prompts/threat-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE/C;;;;;;;;;;;;GAYG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GAAG,SAAS,EAC3B,IAAI,EAAE,QAAQ,GACb,MAAM,CAoDR"}
@@ -0,0 +1,75 @@
1
+ /**
2
+ * Threat analysis prompt templates
3
+ * 威脅分析提示詞範本
4
+ *
5
+ * Generates prompts for AI-powered security threat analysis.
6
+ * Supports bilingual output (English and Traditional Chinese).
7
+ * 產生 AI 驅動的安全威脅分析提示詞。支援雙語輸出(英文和繁體中文)。
8
+ *
9
+ * @module @panguard-ai/core/ai/prompts/threat-analyzer
10
+ */
11
+ /**
12
+ * Generate a threat analysis prompt
13
+ * 產生威脅分析提示詞
14
+ *
15
+ * Creates a prompt that instructs the LLM to analyze a security threat
16
+ * and return structured JSON with summary, severity, confidence, and recommendations.
17
+ * 建立一個提示詞,指示 LLM 分析安全威脅並回傳包含摘要、嚴重等級、信心分數和建議的結構化 JSON。
18
+ *
19
+ * @param prompt - The primary analysis prompt or question / 主要分析提示詞或問題
20
+ * @param context - Optional additional context (logs, environment info) / 可選的額外上下文(日誌、環境資訊)
21
+ * @param lang - Output language / 輸出語言
22
+ * @returns Formatted prompt string / 格式化的提示詞字串
23
+ */
24
+ export function getThreatAnalysisPrompt(prompt, context, lang) {
25
+ const contextSection = context
26
+ ? lang === 'zh-TW'
27
+ ? `\n額外上下文資訊:\n${context}\n`
28
+ : `\nAdditional Context:\n${context}\n`
29
+ : '';
30
+ if (lang === 'zh-TW') {
31
+ return `你是一位專業的資安威脅分析師。請分析以下安全相關資訊並提供專業評估。
32
+
33
+ 分析需求:
34
+ ${prompt}
35
+ ${contextSection}
36
+ 請以 JSON 格式回應,包含以下欄位:
37
+ {
38
+ "summary": "威脅分析摘要,清楚描述發現的問題和潛在影響",
39
+ "severity": "嚴重等級:info、low、medium、high 或 critical",
40
+ "confidence": "信心分數,0 到 1 之間的數字",
41
+ "recommendations": ["建議措施 1", "建議措施 2", "建議措施 3"]
42
+ }
43
+
44
+ 評估標準:
45
+ - info:一般資訊性事件,無安全疑慮
46
+ - low:輕微安全疑慮,可列入觀察
47
+ - medium:中等威脅,建議進一步調查
48
+ - high:嚴重威脅,需要立即處理
49
+ - critical:極度嚴重,系統可能已遭入侵
50
+
51
+ 只回傳 JSON,不要包含其他文字。`;
52
+ }
53
+ return `You are a professional cybersecurity threat analyst. Analyze the following security information and provide a professional assessment.
54
+
55
+ Analysis Request:
56
+ ${prompt}
57
+ ${contextSection}
58
+ Respond in JSON format with the following fields:
59
+ {
60
+ "summary": "threat analysis summary, clearly describing findings and potential impact",
61
+ "severity": "severity level: info, low, medium, high, or critical",
62
+ "confidence": "confidence score, a number between 0 and 1",
63
+ "recommendations": ["recommendation 1", "recommendation 2", "recommendation 3"]
64
+ }
65
+
66
+ Assessment Criteria:
67
+ - info: General informational event, no security concern
68
+ - low: Minor security concern, can be monitored
69
+ - medium: Moderate threat, further investigation recommended
70
+ - high: Serious threat, immediate action required
71
+ - critical: Extremely severe, system may already be compromised
72
+
73
+ Return only JSON, no additional text.`;
74
+ }
75
+ //# sourceMappingURL=threat-analyzer.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"threat-analyzer.js","sourceRoot":"","sources":["../../../src/ai/prompts/threat-analyzer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,uBAAuB,CACrC,MAAc,EACd,OAA2B,EAC3B,IAAc;IAEd,MAAM,cAAc,GAAG,OAAO;QAC5B,CAAC,CAAC,IAAI,KAAK,OAAO;YAChB,CAAC,CAAC,eAAe,OAAO,IAAI;YAC5B,CAAC,CAAC,0BAA0B,OAAO,IAAI;QACzC,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO;;;EAGT,MAAM;EACN,cAAc;;;;;;;;;;;;;;;;mBAgBG,CAAC;IAClB,CAAC;IAED,OAAO;;;EAGP,MAAM;EACN,cAAc;;;;;;;;;;;;;;;;sCAgBsB,CAAC;AACvC,CAAC"}
@@ -0,0 +1,100 @@
1
+ /**
2
+ * Abstract base class for LLM providers
3
+ * LLM 供應商抽象基礎類別
4
+ *
5
+ * Implements shared logic for all LLM providers including prompt
6
+ * construction, response parsing, and token tracking.
7
+ * 實作所有 LLM 供應商的共用邏輯,包括提示詞建構、回應解析和 Token 追蹤。
8
+ *
9
+ * @module @panguard-ai/core/ai/provider-base
10
+ */
11
+ import type { SecurityEvent } from '../types.js';
12
+ import type { LLMConfig, LLMProvider, LLMProviderType, AnalysisResult, ThreatClassification, TokenUsage } from './types.js';
13
+ import { TokenTracker } from './token-tracker.js';
14
+ /**
15
+ * Abstract base class that all LLM providers extend
16
+ * 所有 LLM 供應商繼承的抽象基礎類別
17
+ *
18
+ * Subclasses must implement `sendRequest()` and `isAvailable()`.
19
+ * The base class handles prompt construction, response parsing,
20
+ * error wrapping, and token tracking.
21
+ * 子類別必須實作 `sendRequest()` 和 `isAvailable()`。
22
+ * 基礎類別處理提示詞建構、回應解析、錯誤包裝和 Token 追蹤。
23
+ */
24
+ export declare abstract class LLMProviderBase implements LLMProvider {
25
+ /** The provider type identifier / 供應商類型識別碼 */
26
+ readonly providerType: LLMProviderType;
27
+ /** The model name being used / 使用的模型名稱 */
28
+ readonly model: string;
29
+ /** Provider configuration / 供應商配置 */
30
+ protected readonly config: Required<Pick<LLMConfig, 'provider' | 'model' | 'lang' | 'temperature' | 'maxTokens' | 'timeout'>> & Pick<LLMConfig, 'endpoint' | 'apiKey'>;
31
+ /** Token usage tracker / Token 使用追蹤器 */
32
+ protected readonly tokenTracker: TokenTracker;
33
+ /** Module logger / 模組日誌記錄器 */
34
+ protected readonly logger: import("../index.js").Logger;
35
+ /**
36
+ * Create a new LLM provider base instance
37
+ * 建立新的 LLM 供應商基礎實例
38
+ *
39
+ * @param config - LLM configuration / LLM 配置
40
+ */
41
+ constructor(config: LLMConfig);
42
+ /**
43
+ * Send a raw prompt to the LLM and return the response text
44
+ * 向 LLM 發送原始提示詞並回傳回應文字
45
+ *
46
+ * Must be implemented by each provider subclass.
47
+ * 必須由每個供應商子類別實作。
48
+ *
49
+ * @param prompt - The prompt to send / 要發送的提示詞
50
+ * @returns Raw response text from the LLM / LLM 的原始回應文字
51
+ */
52
+ protected abstract sendRequest(prompt: string): Promise<string>;
53
+ /**
54
+ * Check if the provider is available and properly configured
55
+ * 檢查供應商是否可用且配置正確
56
+ *
57
+ * Must be implemented by each provider subclass.
58
+ * 必須由每個供應商子類別實作。
59
+ *
60
+ * @returns True if provider is ready / 供應商就緒時回傳 true
61
+ */
62
+ abstract isAvailable(): Promise<boolean>;
63
+ /**
64
+ * Analyze a security prompt with optional context
65
+ * 分析安全提示詞,可附帶上下文
66
+ *
67
+ * Constructs a threat analysis prompt, sends it to the LLM,
68
+ * and parses the response into an AnalysisResult.
69
+ * 建構威脅分析提示詞,發送至 LLM,並將回應解析為 AnalysisResult。
70
+ *
71
+ * @param prompt - The analysis prompt / 分析提示詞
72
+ * @param context - Optional additional context / 可選的額外上下文
73
+ * @returns Analysis result / 分析結果
74
+ */
75
+ analyze(prompt: string, context?: string): Promise<AnalysisResult>;
76
+ /**
77
+ * Classify a security event using MITRE ATT&CK framework
78
+ * 使用 MITRE ATT&CK 框架分類安全事件
79
+ *
80
+ * @param event - The security event to classify / 要分類的安全事件
81
+ * @returns Threat classification / 威脅分類
82
+ */
83
+ classify(event: SecurityEvent): Promise<ThreatClassification>;
84
+ /**
85
+ * Summarize multiple security events into a report
86
+ * 將多個安全事件摘要為報告
87
+ *
88
+ * @param events - Array of security events / 安全事件陣列
89
+ * @returns Summary text / 摘要文字
90
+ */
91
+ summarize(events: SecurityEvent[]): Promise<string>;
92
+ /**
93
+ * Get cumulative token usage statistics
94
+ * 取得累計 Token 使用統計
95
+ *
96
+ * @returns Token usage data / Token 使用資料
97
+ */
98
+ getTokenUsage(): TokenUsage;
99
+ }
100
+ //# sourceMappingURL=provider-base.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"provider-base.d.ts","sourceRoot":"","sources":["../../src/ai/provider-base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EACV,SAAS,EACT,WAAW,EACX,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,UAAU,EACX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAOlD;;;;;;;;;GASG;AACH,8BAAsB,eAAgB,YAAW,WAAW;IAC1D,8CAA8C;IAC9C,SAAgB,YAAY,EAAE,eAAe,CAAC;IAC9C,0CAA0C;IAC1C,SAAgB,KAAK,EAAE,MAAM,CAAC;IAE9B,qCAAqC;IACrC,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CACjC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,WAAW,GAAG,SAAS,CAAC,CACzF,GACC,IAAI,CAAC,SAAS,EAAE,UAAU,GAAG,QAAQ,CAAC,CAAC;IAEzC,wCAAwC;IACxC,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IAE9C,8BAA8B;IAC9B,SAAS,CAAC,QAAQ,CAAC,MAAM,+BAAC;IAE1B;;;;;OAKG;gBACS,MAAM,EAAE,SAAS;IAiB7B;;;;;;;;;OASG;IACH,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAE/D;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC;IAExC;;;;;;;;;;;OAWG;IACG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAwBxE;;;;;;OAMG;IACG,QAAQ,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA8BnE;;;;;;OAMG;IACG,SAAS,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAgCzD;;;;;OAKG;IACH,aAAa,IAAI,UAAU;CAG5B"}
@@ -0,0 +1,166 @@
1
+ /**
2
+ * Abstract base class for LLM providers
3
+ * LLM 供應商抽象基礎類別
4
+ *
5
+ * Implements shared logic for all LLM providers including prompt
6
+ * construction, response parsing, and token tracking.
7
+ * 實作所有 LLM 供應商的共用邏輯,包括提示詞建構、回應解析和 Token 追蹤。
8
+ *
9
+ * @module @panguard-ai/core/ai/provider-base
10
+ */
11
+ import { TokenTracker } from './token-tracker.js';
12
+ import { parseAnalysisResponse, parseClassificationResponse } from './response-parser.js';
13
+ import { getEventClassifierPrompt } from './prompts/event-classifier.js';
14
+ import { getThreatAnalysisPrompt } from './prompts/threat-analyzer.js';
15
+ import { getReportPrompt } from './prompts/report-generator.js';
16
+ import { createLogger } from '../utils/logger.js';
17
+ /**
18
+ * Abstract base class that all LLM providers extend
19
+ * 所有 LLM 供應商繼承的抽象基礎類別
20
+ *
21
+ * Subclasses must implement `sendRequest()` and `isAvailable()`.
22
+ * The base class handles prompt construction, response parsing,
23
+ * error wrapping, and token tracking.
24
+ * 子類別必須實作 `sendRequest()` 和 `isAvailable()`。
25
+ * 基礎類別處理提示詞建構、回應解析、錯誤包裝和 Token 追蹤。
26
+ */
27
+ export class LLMProviderBase {
28
+ /** The provider type identifier / 供應商類型識別碼 */
29
+ providerType;
30
+ /** The model name being used / 使用的模型名稱 */
31
+ model;
32
+ /** Provider configuration / 供應商配置 */
33
+ config;
34
+ /** Token usage tracker / Token 使用追蹤器 */
35
+ tokenTracker;
36
+ /** Module logger / 模組日誌記錄器 */
37
+ logger;
38
+ /**
39
+ * Create a new LLM provider base instance
40
+ * 建立新的 LLM 供應商基礎實例
41
+ *
42
+ * @param config - LLM configuration / LLM 配置
43
+ */
44
+ constructor(config) {
45
+ this.providerType = config.provider;
46
+ this.model = config.model;
47
+ this.config = {
48
+ provider: config.provider,
49
+ model: config.model,
50
+ lang: config.lang,
51
+ temperature: config.temperature ?? 0.3,
52
+ maxTokens: config.maxTokens ?? 2048,
53
+ timeout: config.timeout ?? 30_000,
54
+ endpoint: config.endpoint,
55
+ apiKey: config.apiKey,
56
+ };
57
+ this.tokenTracker = new TokenTracker(config.provider, config.model);
58
+ this.logger = createLogger(`ai:${config.provider}`);
59
+ }
60
+ /**
61
+ * Analyze a security prompt with optional context
62
+ * 分析安全提示詞,可附帶上下文
63
+ *
64
+ * Constructs a threat analysis prompt, sends it to the LLM,
65
+ * and parses the response into an AnalysisResult.
66
+ * 建構威脅分析提示詞,發送至 LLM,並將回應解析為 AnalysisResult。
67
+ *
68
+ * @param prompt - The analysis prompt / 分析提示詞
69
+ * @param context - Optional additional context / 可選的額外上下文
70
+ * @returns Analysis result / 分析結果
71
+ */
72
+ async analyze(prompt, context) {
73
+ this.logger.info('Starting threat analysis', { promptLength: prompt.length });
74
+ try {
75
+ const fullPrompt = getThreatAnalysisPrompt(prompt, context, this.config.lang);
76
+ const raw = await this.sendRequest(fullPrompt);
77
+ const result = parseAnalysisResponse(raw);
78
+ this.logger.info('Threat analysis completed', {
79
+ severity: result.severity,
80
+ confidence: result.confidence,
81
+ });
82
+ return result;
83
+ }
84
+ catch (error) {
85
+ this.logger.error('Threat analysis failed', {
86
+ error: error instanceof Error ? error.message : String(error),
87
+ });
88
+ throw new Error(`Analysis failed (${this.providerType}/${this.model}): ${error instanceof Error ? error.message : String(error)}`);
89
+ }
90
+ }
91
+ /**
92
+ * Classify a security event using MITRE ATT&CK framework
93
+ * 使用 MITRE ATT&CK 框架分類安全事件
94
+ *
95
+ * @param event - The security event to classify / 要分類的安全事件
96
+ * @returns Threat classification / 威脅分類
97
+ */
98
+ async classify(event) {
99
+ this.logger.info('Classifying security event', {
100
+ eventId: event.id,
101
+ source: event.source,
102
+ });
103
+ try {
104
+ const prompt = getEventClassifierPrompt(event, this.config.lang);
105
+ const raw = await this.sendRequest(prompt);
106
+ const result = parseClassificationResponse(raw);
107
+ this.logger.info('Event classification completed', {
108
+ eventId: event.id,
109
+ category: result.category,
110
+ technique: result.technique,
111
+ severity: result.severity,
112
+ });
113
+ return result;
114
+ }
115
+ catch (error) {
116
+ this.logger.error('Event classification failed', {
117
+ eventId: event.id,
118
+ error: error instanceof Error ? error.message : String(error),
119
+ });
120
+ throw new Error(`Classification failed (${this.providerType}/${this.model}): ${error instanceof Error ? error.message : String(error)}`);
121
+ }
122
+ }
123
+ /**
124
+ * Summarize multiple security events into a report
125
+ * 將多個安全事件摘要為報告
126
+ *
127
+ * @param events - Array of security events / 安全事件陣列
128
+ * @returns Summary text / 摘要文字
129
+ */
130
+ async summarize(events) {
131
+ this.logger.info('Generating security summary', {
132
+ eventCount: events.length,
133
+ });
134
+ if (events.length === 0) {
135
+ return this.config.lang === 'zh-TW'
136
+ ? '沒有安全事件需要摘要。'
137
+ : 'No security events to summarize.';
138
+ }
139
+ try {
140
+ const prompt = getReportPrompt(events, this.config.lang);
141
+ const summary = await this.sendRequest(prompt);
142
+ this.logger.info('Security summary generated', {
143
+ eventCount: events.length,
144
+ summaryLength: summary.length,
145
+ });
146
+ return summary;
147
+ }
148
+ catch (error) {
149
+ this.logger.error('Summary generation failed', {
150
+ eventCount: events.length,
151
+ error: error instanceof Error ? error.message : String(error),
152
+ });
153
+ throw new Error(`Summarization failed (${this.providerType}/${this.model}): ${error instanceof Error ? error.message : String(error)}`);
154
+ }
155
+ }
156
+ /**
157
+ * Get cumulative token usage statistics
158
+ * 取得累計 Token 使用統計
159
+ *
160
+ * @returns Token usage data / Token 使用資料
161
+ */
162
+ getTokenUsage() {
163
+ return this.tokenTracker.getUsage();
164
+ }
165
+ }
166
+ //# sourceMappingURL=provider-base.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"provider-base.js","sourceRoot":"","sources":["../../src/ai/provider-base.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAWH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAC1F,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;;;;;;;GASG;AACH,MAAM,OAAgB,eAAe;IACnC,8CAA8C;IAC9B,YAAY,CAAkB;IAC9C,0CAA0C;IAC1B,KAAK,CAAS;IAE9B,qCAAqC;IAClB,MAAM,CAGgB;IAEzC,wCAAwC;IACrB,YAAY,CAAe;IAE9C,8BAA8B;IACX,MAAM,CAAC;IAE1B;;;;;OAKG;IACH,YAAY,MAAiB;QAC3B,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,QAAQ,CAAC;QACpC,IAAI,CAAC,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG;YACZ,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,GAAG;YACtC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;YACnC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,MAAM;YACjC,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,MAAM,CAAC,MAAM;SACtB,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM,GAAG,YAAY,CAAC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtD,CAAC;IAyBD;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,OAAgB;QAC5C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAE9E,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9E,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YAC/C,MAAM,MAAM,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAE1C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;aAC9B,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,wBAAwB,EAAE;gBAC1C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,oBAAoB,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClH,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAoB;QACjC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;YAC7C,OAAO,EAAE,KAAK,CAAC,EAAE;YACjB,MAAM,EAAE,KAAK,CAAC,MAAM;SACrB,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACjE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,2BAA2B,CAAC,GAAG,CAAC,CAAC;YAEhD,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,gCAAgC,EAAE;gBACjD,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,EAAE;gBAC/C,OAAO,EAAE,KAAK,CAAC,EAAE;gBACjB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,0BAA0B,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACxH,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,SAAS,CAAC,MAAuB;QACrC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,6BAA6B,EAAE;YAC9C,UAAU,EAAE,MAAM,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO;gBACjC,CAAC,CAAC,aAAa;gBACf,CAAC,CAAC,kCAAkC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAE/C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBAC7C,UAAU,EAAE,MAAM,CAAC,MAAM;gBACzB,aAAa,EAAE,OAAO,CAAC,MAAM;aAC9B,CAAC,CAAC;YAEH,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2BAA2B,EAAE;gBAC7C,UAAU,EAAE,MAAM,CAAC,MAAM;gBACzB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;YACH,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,KAAK,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CACvH,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACH,aAAa;QACX,OAAO,IAAI,CAAC,YAAY,CAAC,QAAQ,EAAE,CAAC;IACtC,CAAC;CACF"}
@@ -0,0 +1,36 @@
1
+ /**
2
+ * LLM response parsing utilities
3
+ * LLM 回應解析工具
4
+ *
5
+ * Parses raw LLM text responses into structured data objects.
6
+ * Supports JSON extraction from markdown code blocks and plain text fallback.
7
+ * 將原始 LLM 文字回應解析為結構化資料物件。
8
+ * 支援從 Markdown 程式碼區塊提取 JSON 以及純文字回退。
9
+ *
10
+ * @module @panguard-ai/core/ai/response-parser
11
+ */
12
+ import type { AnalysisResult, ThreatClassification } from './types.js';
13
+ /**
14
+ * Parse a raw LLM response into an AnalysisResult
15
+ * 將原始 LLM 回應解析為 AnalysisResult
16
+ *
17
+ * Attempts JSON parsing first, then falls back to treating the entire
18
+ * response as a text summary.
19
+ * 首先嘗試 JSON 解析,然後回退到將整個回應視為文字摘要。
20
+ *
21
+ * @param raw - Raw LLM response text / 原始 LLM 回應文字
22
+ * @returns Parsed analysis result / 解析的分析結果
23
+ */
24
+ export declare function parseAnalysisResponse(raw: string): AnalysisResult;
25
+ /**
26
+ * Parse a raw LLM response into a ThreatClassification
27
+ * 將原始 LLM 回應解析為 ThreatClassification
28
+ *
29
+ * Attempts JSON parsing first, then falls back to a generic classification.
30
+ * 首先嘗試 JSON 解析,然後回退到通用分類。
31
+ *
32
+ * @param raw - Raw LLM response text / 原始 LLM 回應文字
33
+ * @returns Parsed threat classification / 解析的威脅分類
34
+ */
35
+ export declare function parseClassificationResponse(raw: string): ThreatClassification;
36
+ //# sourceMappingURL=response-parser.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"response-parser.d.ts","sourceRoot":"","sources":["../../src/ai/response-parser.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAmHvE;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAkCjE;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CAAC,GAAG,EAAE,MAAM,GAAG,oBAAoB,CA6B7E"}