agentic-threat-hunting-framework 0.4.0__py3-none-any.whl → 0.5.1__py3-none-any.whl

{agentic_threat_hunting_framework-0.4.0.dist-info → agentic_threat_hunting_framework-0.5.1.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: agentic-threat-hunting-framework
-Version: 0.4.0
+Version: 0.5.1
 Summary: Agentic Threat Hunting Framework - Memory and AI for threat hunters
 Author-email: Sydney Marrone <athf@nebulock.io>
 Maintainer-email: Sydney Marrone <athf@nebulock.io>

{agentic_threat_hunting_framework-0.4.0.dist-info → agentic_threat_hunting_framework-0.5.1.dist-info}/RECORD

@@ -1,13 +1,14 @@
-agentic_threat_hunting_framework-0.4.0.dist-info/licenses/LICENSE,sha256=_KObErRfiKoolznt-DF0nJnr3U9Rdh7Z4Ba7G5qqckk,1071
+agentic_threat_hunting_framework-0.5.1.dist-info/licenses/LICENSE,sha256=_KObErRfiKoolznt-DF0nJnr3U9Rdh7Z4Ba7G5qqckk,1071
 athf/__init__.py,sha256=OrjZe8P97_BTEkscapnwSsqKSjwXNP9d8-HtGr19Ni0,241
 athf/__version__.py,sha256=wCIQoU9b7qKcSNQiIOgHaD2buzBC-dlQYtvg8X5WS4A,59
-athf/cli.py,sha256=l8PkZCs4ToUOAxX_Ciy5bLD1mV1Qta3_WalBJOA1t9c,4787
+athf/cli.py,sha256=108PnDRlaytJj9KzjzcTLljB3DeerMIXZOeAQJrmtPU,5052
+athf/plugin_system.py,sha256=c_9-oUiR6tuYpWpEmeVRayU8-TXlkjvZC3EUxuYWW4M,1515
 athf/agents/__init__.py,sha256=iaSJpvnXm9rz4QS7gBrsaLEjm49uvsMs4BLPOJeyp78,346
-athf/agents/base.py,sha256=HQJpQAKmY7folbzPnvF2OZ9vhEf205lBFUHrtfOXr64,4352
+athf/agents/base.py,sha256=ZLqSW6I0pKqs1Z3OIoV8urkysMRzNDs52yNIxDgQjTU,3981
 athf/agents/llm/__init__.py,sha256=qSGA-NaInjsDkMpGQwnTz3S1OgCVlzetpMcDS_to1co,671
 athf/agents/llm/hunt_researcher.py,sha256=dIyD2Izh3zdf62kCHug1DwXFgmWhOMQUTim7qM3UAIs,27071
 athf/agents/llm/hypothesis_generator.py,sha256=XkbJz8IS4zwQjEy-ZD0zy2XW5uRnAy87Lii-5XTY0WU,8564
-athf/commands/__init__.py,sha256=YYPIbajQf7DN_h8PFNfktgny4oHKKWKGbAU6tItE5vE,500
+athf/commands/__init__.py,sha256=-ZOfg6uV1eSh7RDW7dKzdufuYvQTT0KGMF4JB6waHsY,635
 athf/commands/agent.py,sha256=c7ZeZa3OArXyXTgVjmUB2JXa3m9IpLFJ_FEVDhaDLE8,19000
 athf/commands/context.py,sha256=V-at81-OgKcLY-In48-AccTnHfTgdofmnjE8S5kypoI,12678
 athf/commands/env.py,sha256=JPKRsv48cgsIAjSFaGJ1-Nu0nQKGSVg4AbiFxb9jVX4,11887
@@ -15,7 +16,7 @@ athf/commands/hunt.py,sha256=aQdgNddqy_VrxZOkxhuPxIr4KLZtX5a2ZLb9079vLlw,25169
 athf/commands/init.py,sha256=Qn0iETNyuQvM-ySqCeoDz-pPemeuzROX_karQF5yN_o,12685
 athf/commands/investigate.py,sha256=mK_id5vjfN_ukqB_-fyia0FNa0pBmtn0Xv6CKHQI1Qo,24663
 athf/commands/research.py,sha256=FrLph4agaGQ_rIxMh0OQwh1MIGDFtj40zJ3E1ZFwaAw,18112
-athf/commands/similar.py,sha256=qy1Gng73_VpqfoLLNUdxF1GBx-X29g-k8Q_wrEx26hA,11868
+athf/commands/similar.py,sha256=FTTVr4zzP9bdJrirscp6pOxdQbE8zot6pa20-_TYiuo,11804
 athf/commands/splunk.py,sha256=7n7Jl1ExqZCNxUhG0kAKgAvZMqbIoGSgx2Moq7vAu-Y,11622
 athf/core/__init__.py,sha256=yG7C8ljx3UW4QZoYvDjUxsWHlbS8M-GLGB7Je7rRfqo,31
 athf/core/attack_matrix.py,sha256=QZKKmxckQ6-U7lqVdGUJoj2jEAhP3Juvr3sqaNx2oTw,3238
@@ -25,7 +26,7 @@ athf/core/investigation_parser.py,sha256=wbfjnq4gFgIc0a4bHIAnidVNPhbHDpIXWY1SGLk
 athf/core/research_manager.py,sha256=i4fUjuZJcAik8I4pwbLkQlu6cuxkWDlqaIRQrzAfB0s,14512
 athf/core/splunk_client.py,sha256=Xib2zVwV2l8eChzqUahI3PZ7Z2XS2wz01sPbF1E0Q18,11611
 athf/core/template_engine.py,sha256=Awp0n9E5Q1dYA35XDKKAd5VJLdpaDl2N967hackUVa8,6010
-athf/core/web_search.py,sha256=lBdApqIemV2kH_NJ3vDd3adH9DwrPjaq_fs5qMjR8mI,10354
+athf/core/web_search.py,sha256=B9IhmwH7gy2RVA6WSN3L7yGp3Q4L8OsiiwcEvnnZejU,10320
 athf/data/__init__.py,sha256=QtgONloCaS3E9Ow995FMxyy6BbszpfmYeWpySQ2b9Mc,502
 athf/data/docs/CHANGELOG.md,sha256=JKkzzs1n5jSERHFi6fDt6sYEe52MSaY127dfzthkUA8,8655
 athf/data/docs/CLI_REFERENCE.md,sha256=pb76UqkY_WHJMBEXwEmK0TJR8kcGzoBPlJ0WdGMKDQM,54875
@@ -51,8 +52,8 @@ athf/data/prompts/ai-workflow.md,sha256=rZtOcGuAEi35qx7182TwHJEORdz1-RxkZMBVkg61
 athf/data/prompts/basic-prompts.md,sha256=2bunpO35RoBdJWYthXVi40RNl2UWrfwOaFthBLHF5sU,8463
 athf/data/templates/HUNT_LOCK.md,sha256=zXxHaKMWbRDLewLTegYJMbXRM72s9gFFvjdwFfGNeJE,7386
 athf/utils/__init__.py,sha256=aEAPI1xnAsowOtc036cCb9ZOek5nrrfevu8PElhbNgk,30
-agentic_threat_hunting_framework-0.4.0.dist-info/METADATA,sha256=KpwdeeDnNEGhS6zlI3NHdcKGwaN2iGYYJDIQkRr6D9E,15949
-agentic_threat_hunting_framework-0.4.0.dist-info/WHEEL,sha256=_zCd3N1l69ArxyTb8rzEoP9TpbYXkqRFSNOD5OuxnTs,91
-agentic_threat_hunting_framework-0.4.0.dist-info/entry_points.txt,sha256=GopR2iTiBs-yNMWiUZ2DaFIFglXxWJx1XPjTa3ePtfE,39
-agentic_threat_hunting_framework-0.4.0.dist-info/top_level.txt,sha256=Cxxg6SMLfawDJWBITsciRzq27XV8fiaAor23o9Byoes,5
-agentic_threat_hunting_framework-0.4.0.dist-info/RECORD,,
+agentic_threat_hunting_framework-0.5.1.dist-info/METADATA,sha256=A9gPoTr0bXjdPo_l76Fn1tIxJFAL3RFQRRUPSDT6N8I,15949
+agentic_threat_hunting_framework-0.5.1.dist-info/WHEEL,sha256=qELbo2s1Yzl39ZmrAibXA2jjPLUYfnVhUNTlyF1rq0Y,92
+agentic_threat_hunting_framework-0.5.1.dist-info/entry_points.txt,sha256=GopR2iTiBs-yNMWiUZ2DaFIFglXxWJx1XPjTa3ePtfE,39
+agentic_threat_hunting_framework-0.5.1.dist-info/top_level.txt,sha256=Cxxg6SMLfawDJWBITsciRzq27XV8fiaAor23o9Byoes,5
+agentic_threat_hunting_framework-0.5.1.dist-info/RECORD,,

{agentic_threat_hunting_framework-0.4.0.dist-info → agentic_threat_hunting_framework-0.5.1.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (80.9.0)
+Generator: setuptools (80.10.1)
 Root-Is-Purelib: true
 Tag: py3-none-any
 

athf/agents/base.py

@@ -1,4 +1,4 @@
-"""Base classes for hunt-vault agents."""
+"""Base classes for ATHF agents."""
 
 import os
 from abc import ABC, abstractmethod
@@ -89,6 +89,8 @@ class LLMAgent(Agent[InputT, OutputT]):
     ) -> None:
         """Log LLM call metrics to centralized tracker.
 
+        Override this method in subclasses or plugins to implement custom metrics tracking.
+
         Args:
             agent_name: Name of the agent (e.g., "hypothesis-generator")
             model_id: Bedrock model ID
@@ -97,19 +99,8 @@ class LLMAgent(Agent[InputT, OutputT]):
             cost_usd: Estimated cost in USD
             duration_ms: Call duration in milliseconds
         """
-        try:
-            from athf.core.metrics_tracker import MetricsTracker  # type: ignore[import-not-found]
-
-            MetricsTracker.get_instance().log_bedrock_call(
-                agent=agent_name,
-                model_id=model_id,
-                input_tokens=input_tokens,
-                output_tokens=output_tokens,
-                cost_usd=cost_usd,
-                duration_ms=duration_ms,
-            )
-        except Exception:
-            pass  # Never fail agent execution due to metrics logging
+        # No-op by default. Override in plugins for custom metrics tracking.
+        pass
 
     def _get_llm_client(self) -> Any:
         """Get AWS Bedrock runtime client for Claude models.
@@ -125,7 +116,7 @@ class LLMAgent(Agent[InputT, OutputT]):
             return None
 
         try:
-            import boto3  # type: ignore[import-untyped]
+            import boto3
 
             # Get AWS region from environment or use default
             region = os.getenv("AWS_REGION", os.getenv("AWS_DEFAULT_REGION", "us-east-1"))

athf/cli.py

@@ -95,8 +95,16 @@ cli.add_command(similar)
 # Agent commands
 cli.add_command(agent)
 
-# Integration commands
-cli.add_command(splunk)
+# Integration commands (optional, requires additional dependencies)
+if splunk is not None:
+    cli.add_command(splunk)
+
+# Load and register plugins
+from athf.plugin_system import PluginRegistry
+
+PluginRegistry.load_plugins()
+for name, cmd in PluginRegistry._commands.items():
+    cli.add_command(cmd, name=name)
 
 
 @cli.command(hidden=True)

athf/commands/__init__.py

@@ -7,7 +7,12 @@ from athf.commands.init import init
 from athf.commands.investigate import investigate
 from athf.commands.research import research
 from athf.commands.similar import similar
-from athf.commands.splunk import splunk
+
+# Optional: Splunk integration (requires requests package)
+try:
+    from athf.commands.splunk import splunk
+except ImportError:
+    splunk = None  # type: ignore[assignment]
 
 __all__ = [
     "init",

athf/commands/similar.py

@@ -132,8 +132,8 @@ def _find_similar_hunts(
 ) -> List[Dict[str, Any]]:
     """Find similar hunts using TF-IDF similarity."""
     try:
-        from sklearn.feature_extraction.text import TfidfVectorizer  # type: ignore[import-untyped]
-        from sklearn.metrics.pairwise import cosine_similarity  # type: ignore[import-untyped]
+        from sklearn.feature_extraction.text import TfidfVectorizer
+        from sklearn.metrics.pairwise import cosine_similarity
     except ImportError:
         console.print("[red]Error: scikit-learn not installed[/red]")
         console.print("[dim]Install with: pip install scikit-learn[/dim]")

athf/core/web_search.py

@@ -84,7 +84,7 @@ class TavilySearchClient:
         """Get or create Tavily client instance."""
         if self._client is None:
             try:
-                from tavily import TavilyClient  # type: ignore[import-not-found]
+                from tavily import TavilyClient
 
                 self._client = TavilyClient(api_key=self.api_key)
             except ImportError:

athf/plugin_system.py

@@ -0,0 +1,48 @@
+"""Plugin system for ATHF extensions."""
+from typing import Dict, Type, Callable
+import importlib.metadata
+from click import Command
+
+
+class PluginRegistry:
+    """Central registry for ATHF plugins."""
+
+    _agents: Dict[str, Type] = {}
+    _commands: Dict[str, Command] = {}
+
+    @classmethod
+    def register_agent(cls, name: str, agent_class: Type) -> None:
+        """Register an agent plugin."""
+        cls._agents[name] = agent_class
+
+    @classmethod
+    def register_command(cls, name: str, command: Command) -> None:
+        """Register a CLI command plugin."""
+        cls._commands[name] = command
+
+    @classmethod
+    def get_agent(cls, name: str) -> Type:
+        """Get registered agent by name."""
+        return cls._agents.get(name)
+
+    @classmethod
+    def get_command(cls, name: str) -> Command:
+        """Get registered command by name."""
+        return cls._commands.get(name)
+
+    @classmethod
+    def load_plugins(cls) -> None:
+        """Auto-discover and load all installed plugins."""
+        try:
+            for ep in importlib.metadata.entry_points(group='athf.commands'):
+                command = ep.load()
+                cls.register_command(ep.name, command)
+        except Exception:
+            pass  # No plugins installed yet
+
+        try:
+            for ep in importlib.metadata.entry_points(group='athf.agents'):
+                agent = ep.load()
+                cls.register_agent(ep.name, agent)
+        except Exception:
+            pass  # No plugins installed yet