iflow-mcp-m507_ai-soc-agent 1.0.0__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- iflow_mcp_m507_ai_soc_agent-1.0.0.dist-info/METADATA +410 -0
- iflow_mcp_m507_ai_soc_agent-1.0.0.dist-info/RECORD +85 -0
- iflow_mcp_m507_ai_soc_agent-1.0.0.dist-info/WHEEL +5 -0
- iflow_mcp_m507_ai_soc_agent-1.0.0.dist-info/entry_points.txt +2 -0
- iflow_mcp_m507_ai_soc_agent-1.0.0.dist-info/licenses/LICENSE +21 -0
- iflow_mcp_m507_ai_soc_agent-1.0.0.dist-info/top_level.txt +1 -0
- src/__init__.py +8 -0
- src/ai_controller/README.md +139 -0
- src/ai_controller/__init__.py +12 -0
- src/ai_controller/agent_executor.py +596 -0
- src/ai_controller/cli/__init__.py +2 -0
- src/ai_controller/cli/main.py +243 -0
- src/ai_controller/session_manager.py +409 -0
- src/ai_controller/web/__init__.py +2 -0
- src/ai_controller/web/server.py +1181 -0
- src/ai_controller/web/static/css/README.md +102 -0
- src/api/__init__.py +13 -0
- src/api/case_management.py +271 -0
- src/api/edr.py +187 -0
- src/api/kb.py +136 -0
- src/api/siem.py +308 -0
- src/core/__init__.py +10 -0
- src/core/config.py +242 -0
- src/core/config_storage.py +684 -0
- src/core/dto.py +50 -0
- src/core/errors.py +36 -0
- src/core/logging.py +128 -0
- src/integrations/__init__.py +8 -0
- src/integrations/case_management/__init__.py +5 -0
- src/integrations/case_management/iris/__init__.py +11 -0
- src/integrations/case_management/iris/iris_client.py +885 -0
- src/integrations/case_management/iris/iris_http.py +274 -0
- src/integrations/case_management/iris/iris_mapper.py +263 -0
- src/integrations/case_management/iris/iris_models.py +128 -0
- src/integrations/case_management/thehive/__init__.py +8 -0
- src/integrations/case_management/thehive/thehive_client.py +193 -0
- src/integrations/case_management/thehive/thehive_http.py +147 -0
- src/integrations/case_management/thehive/thehive_mapper.py +190 -0
- src/integrations/case_management/thehive/thehive_models.py +125 -0
- src/integrations/cti/__init__.py +6 -0
- src/integrations/cti/local_tip/__init__.py +10 -0
- src/integrations/cti/local_tip/local_tip_client.py +90 -0
- src/integrations/cti/local_tip/local_tip_http.py +110 -0
- src/integrations/cti/opencti/__init__.py +10 -0
- src/integrations/cti/opencti/opencti_client.py +101 -0
- src/integrations/cti/opencti/opencti_http.py +418 -0
- src/integrations/edr/__init__.py +6 -0
- src/integrations/edr/elastic_defend/__init__.py +6 -0
- src/integrations/edr/elastic_defend/elastic_defend_client.py +351 -0
- src/integrations/edr/elastic_defend/elastic_defend_http.py +162 -0
- src/integrations/eng/__init__.py +10 -0
- src/integrations/eng/clickup/__init__.py +8 -0
- src/integrations/eng/clickup/clickup_client.py +513 -0
- src/integrations/eng/clickup/clickup_http.py +156 -0
- src/integrations/eng/github/__init__.py +8 -0
- src/integrations/eng/github/github_client.py +169 -0
- src/integrations/eng/github/github_http.py +158 -0
- src/integrations/eng/trello/__init__.py +8 -0
- src/integrations/eng/trello/trello_client.py +207 -0
- src/integrations/eng/trello/trello_http.py +162 -0
- src/integrations/kb/__init__.py +12 -0
- src/integrations/kb/fs_kb_client.py +313 -0
- src/integrations/siem/__init__.py +6 -0
- src/integrations/siem/elastic/__init__.py +6 -0
- src/integrations/siem/elastic/elastic_client.py +3319 -0
- src/integrations/siem/elastic/elastic_http.py +165 -0
- src/mcp/README.md +183 -0
- src/mcp/TOOLS.md +2827 -0
- src/mcp/__init__.py +13 -0
- src/mcp/__main__.py +18 -0
- src/mcp/agent_profiles.py +408 -0
- src/mcp/flow_agent_profiles.py +424 -0
- src/mcp/mcp_server.py +4086 -0
- src/mcp/rules_engine.py +487 -0
- src/mcp/runbook_manager.py +264 -0
- src/orchestrator/__init__.py +11 -0
- src/orchestrator/incident_workflow.py +244 -0
- src/orchestrator/tools_case.py +1085 -0
- src/orchestrator/tools_cti.py +359 -0
- src/orchestrator/tools_edr.py +315 -0
- src/orchestrator/tools_eng.py +378 -0
- src/orchestrator/tools_kb.py +156 -0
- src/orchestrator/tools_siem.py +1709 -0
- src/web/__init__.py +8 -0
- src/web/config_server.py +511 -0
src/core/dto.py
ADDED
|
@@ -0,0 +1,50 @@
|
|
|
1
|
+
"""
|
|
2
|
+
Common DTO utilities for SamiGPT.
|
|
3
|
+
|
|
4
|
+
We use Python dataclasses for DTOs across the generic API layer. This module
|
|
5
|
+
provides a small mixin with helper methods so all DTOs have a consistent
|
|
6
|
+
API (e.g., ``to_dict``).
|
|
7
|
+
|
|
8
|
+
Design choices:
|
|
9
|
+
- Style: synchronous (no async in DTOs or interfaces).
|
|
10
|
+
- Response pattern: API clients return DTOs (or lists of DTOs) directly,
|
|
11
|
+
without wrapping everything in a ``result`` + ``metadata`` envelope.
|
|
12
|
+
"""
|
|
13
|
+
|
|
14
|
+
from __future__ import annotations
|
|
15
|
+
|
|
16
|
+
from dataclasses import asdict, dataclass
|
|
17
|
+
from typing import Any, Dict, Type, TypeVar
|
|
18
|
+
|
|
19
|
+
|
|
20
|
+
T_BaseDTO = TypeVar("T_BaseDTO", bound="BaseDTO")
|
|
21
|
+
|
|
22
|
+
|
|
23
|
+
@dataclass
|
|
24
|
+
class BaseDTO:
|
|
25
|
+
"""
|
|
26
|
+
Base mixin for DTO dataclasses.
|
|
27
|
+
|
|
28
|
+
Inherit from this in DTOs to get a consistent ``to_dict`` method and
|
|
29
|
+
a simple ``from_dict`` constructor.
|
|
30
|
+
"""
|
|
31
|
+
|
|
32
|
+
def to_dict(self) -> Dict[str, Any]:
|
|
33
|
+
"""
|
|
34
|
+
Convert this DTO into a plain dict (recursively).
|
|
35
|
+
"""
|
|
36
|
+
|
|
37
|
+
return asdict(self)
|
|
38
|
+
|
|
39
|
+
@classmethod
|
|
40
|
+
def from_dict(cls: Type[T_BaseDTO], data: Dict[str, Any]) -> T_BaseDTO:
|
|
41
|
+
"""
|
|
42
|
+
Construct this DTO from a dict of attributes.
|
|
43
|
+
|
|
44
|
+
This is a thin wrapper around normal dataclass construction; any
|
|
45
|
+
extra validation should be implemented by callers as needed.
|
|
46
|
+
"""
|
|
47
|
+
|
|
48
|
+
return cls(**data)
|
|
49
|
+
|
|
50
|
+
|
src/core/errors.py
ADDED
|
@@ -0,0 +1,36 @@
|
|
|
1
|
+
"""
|
|
2
|
+
Core error types for SamiGPT.
|
|
3
|
+
|
|
4
|
+
These exceptions provide a common base for all raised errors across the
|
|
5
|
+
project so that callers (including the orchestrator and web API) can handle
|
|
6
|
+
them in a consistent way.
|
|
7
|
+
"""
|
|
8
|
+
|
|
9
|
+
from __future__ import annotations
|
|
10
|
+
|
|
11
|
+
|
|
12
|
+
class SamiError(Exception):
|
|
13
|
+
"""
|
|
14
|
+
Base exception for all SamiGPT-specific errors.
|
|
15
|
+
"""
|
|
16
|
+
|
|
17
|
+
|
|
18
|
+
class ConfigError(SamiError):
|
|
19
|
+
"""
|
|
20
|
+
Raised when configuration is missing, invalid, or inconsistent.
|
|
21
|
+
"""
|
|
22
|
+
|
|
23
|
+
|
|
24
|
+
class IntegrationError(SamiError):
|
|
25
|
+
"""
|
|
26
|
+
Raised when an external integration (TheHive, SIEM, EDR, etc.) fails
|
|
27
|
+
or returns an unexpected response.
|
|
28
|
+
"""
|
|
29
|
+
|
|
30
|
+
|
|
31
|
+
class ValidationError(SamiError):
|
|
32
|
+
"""
|
|
33
|
+
Raised when input data, DTOs, or configuration values fail validation.
|
|
34
|
+
"""
|
|
35
|
+
|
|
36
|
+
|
src/core/logging.py
ADDED
|
@@ -0,0 +1,128 @@
|
|
|
1
|
+
"""
|
|
2
|
+
Shared logging configuration for SamiGPT.
|
|
3
|
+
|
|
4
|
+
This module centralizes logging setup so that all components
|
|
5
|
+
(core, API layer, integrations, orchestrator, web API) can
|
|
6
|
+
log in a consistent way.
|
|
7
|
+
"""
|
|
8
|
+
|
|
9
|
+
from __future__ import annotations
|
|
10
|
+
|
|
11
|
+
import logging
|
|
12
|
+
import logging.handlers
|
|
13
|
+
import os
|
|
14
|
+
from typing import Optional
|
|
15
|
+
|
|
16
|
+
from .config import LoggingConfig
|
|
17
|
+
|
|
18
|
+
|
|
19
|
+
def configure_logging(config: Optional[LoggingConfig] = None) -> None:
|
|
20
|
+
"""
|
|
21
|
+
Configure application-wide logging.
|
|
22
|
+
|
|
23
|
+
This function is idempotent: calling it multiple times will not
|
|
24
|
+
re-add handlers if they already exist.
|
|
25
|
+
"""
|
|
26
|
+
|
|
27
|
+
if config is None:
|
|
28
|
+
# Fall back to sensible defaults if no config is provided.
|
|
29
|
+
config = LoggingConfig()
|
|
30
|
+
|
|
31
|
+
log_dir = config.log_dir
|
|
32
|
+
os.makedirs(log_dir, exist_ok=True)
|
|
33
|
+
|
|
34
|
+
root_logger = logging.getLogger()
|
|
35
|
+
|
|
36
|
+
# Avoid configuring logging twice.
|
|
37
|
+
if getattr(root_logger, "_sami_logging_configured", False):
|
|
38
|
+
return
|
|
39
|
+
|
|
40
|
+
root_logger.setLevel(config.log_level.upper())
|
|
41
|
+
|
|
42
|
+
formatter = logging.Formatter(
|
|
43
|
+
fmt="%(asctime)s [%(levelname)s] %(name)s [%(message)s]",
|
|
44
|
+
datefmt="%Y-%m-%d %H:%M:%S",
|
|
45
|
+
)
|
|
46
|
+
|
|
47
|
+
# Error log
|
|
48
|
+
error_handler = logging.FileHandler(os.path.join(log_dir, "error.log"))
|
|
49
|
+
error_handler.setLevel(logging.ERROR)
|
|
50
|
+
error_handler.setFormatter(formatter)
|
|
51
|
+
|
|
52
|
+
# Warning log
|
|
53
|
+
warning_handler = logging.FileHandler(os.path.join(log_dir, "warning.log"))
|
|
54
|
+
warning_handler.setLevel(logging.WARNING)
|
|
55
|
+
warning_handler.setFormatter(formatter)
|
|
56
|
+
|
|
57
|
+
# Debug log
|
|
58
|
+
debug_handler = logging.FileHandler(os.path.join(log_dir, "debug.log"))
|
|
59
|
+
debug_handler.setLevel(logging.DEBUG)
|
|
60
|
+
debug_handler.setFormatter(formatter)
|
|
61
|
+
|
|
62
|
+
# Optional console handler for development.
|
|
63
|
+
console_handler = logging.StreamHandler()
|
|
64
|
+
console_handler.setLevel(config.log_level.upper())
|
|
65
|
+
console_handler.setFormatter(formatter)
|
|
66
|
+
|
|
67
|
+
root_logger.addHandler(error_handler)
|
|
68
|
+
root_logger.addHandler(warning_handler)
|
|
69
|
+
root_logger.addHandler(debug_handler)
|
|
70
|
+
root_logger.addHandler(console_handler)
|
|
71
|
+
|
|
72
|
+
# Mark as configured
|
|
73
|
+
root_logger._sami_logging_configured = True # type: ignore[attr-defined]
|
|
74
|
+
|
|
75
|
+
# ------------------------------------------------------------------
|
|
76
|
+
# Dedicated logging for ai_controller components
|
|
77
|
+
# ------------------------------------------------------------------
|
|
78
|
+
try:
|
|
79
|
+
from pathlib import Path
|
|
80
|
+
|
|
81
|
+
core_dir = Path(__file__).resolve().parent
|
|
82
|
+
ai_controller_logs_dir = core_dir.parent / "ai_controller" / "logs"
|
|
83
|
+
os.makedirs(ai_controller_logs_dir, exist_ok=True)
|
|
84
|
+
|
|
85
|
+
ai_logger = logging.getLogger("sami.ai_controller")
|
|
86
|
+
|
|
87
|
+
if not getattr(ai_logger, "_sami_ai_controller_logging_configured", False):
|
|
88
|
+
ai_formatter = logging.Formatter(
|
|
89
|
+
fmt="%(asctime)s [%(levelname)s] %(name)s [%(message)s]",
|
|
90
|
+
datefmt="%Y-%m-%d %H:%M:%S",
|
|
91
|
+
)
|
|
92
|
+
|
|
93
|
+
# Error log for ai_controller
|
|
94
|
+
ai_error_handler = logging.FileHandler(os.path.join(ai_controller_logs_dir, "error.log"))
|
|
95
|
+
ai_error_handler.setLevel(logging.ERROR)
|
|
96
|
+
ai_error_handler.setFormatter(ai_formatter)
|
|
97
|
+
|
|
98
|
+
# Warning log for ai_controller
|
|
99
|
+
ai_warning_handler = logging.FileHandler(os.path.join(ai_controller_logs_dir, "warning.log"))
|
|
100
|
+
ai_warning_handler.setLevel(logging.WARNING)
|
|
101
|
+
ai_warning_handler.setFormatter(ai_formatter)
|
|
102
|
+
|
|
103
|
+
# Debug log for ai_controller (includes info/debug)
|
|
104
|
+
ai_debug_handler = logging.FileHandler(os.path.join(ai_controller_logs_dir, "debug.log"))
|
|
105
|
+
ai_debug_handler.setLevel(logging.DEBUG)
|
|
106
|
+
ai_debug_handler.setFormatter(ai_formatter)
|
|
107
|
+
|
|
108
|
+
ai_logger.addHandler(ai_error_handler)
|
|
109
|
+
ai_logger.addHandler(ai_warning_handler)
|
|
110
|
+
ai_logger.addHandler(ai_debug_handler)
|
|
111
|
+
|
|
112
|
+
# Ensure we still propagate to root so central logs receive entries too
|
|
113
|
+
ai_logger.propagate = True
|
|
114
|
+
|
|
115
|
+
ai_logger._sami_ai_controller_logging_configured = True # type: ignore[attr-defined]
|
|
116
|
+
except Exception:
|
|
117
|
+
# Never let logging configuration crash the app
|
|
118
|
+
root_logger.exception("Failed to configure dedicated ai_controller logging handlers")
|
|
119
|
+
|
|
120
|
+
|
|
121
|
+
def get_logger(name: str) -> logging.Logger:
|
|
122
|
+
"""
|
|
123
|
+
Convenience helper to get a logger for a given module or subsystem.
|
|
124
|
+
"""
|
|
125
|
+
|
|
126
|
+
return logging.getLogger(name)
|
|
127
|
+
|
|
128
|
+
|
|
@@ -0,0 +1,11 @@
|
|
|
1
|
+
"""
|
|
2
|
+
IRIS case management integration.
|
|
3
|
+
|
|
4
|
+
IRIS (https://github.com/dfir-iris/iris) is an open-source incident response platform.
|
|
5
|
+
This module provides integration with IRIS for case management.
|
|
6
|
+
"""
|
|
7
|
+
|
|
8
|
+
from .iris_client import IRISCaseManagementClient
|
|
9
|
+
|
|
10
|
+
__all__ = ["IRISCaseManagementClient"]
|
|
11
|
+
|