ti2dac 0.1.0__tar.gz

ti2dac-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sazidul0
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

ti2dac-0.1.0/PKG-INFO

@@ -0,0 +1,180 @@
+Metadata-Version: 2.4
+Name: ti2dac
+Version: 0.1.0
+Summary: Threat Intelligence to Detection-as-Code: TI report -> Sigma -> multi-SIEM queries + safe simulation guides
+Author: Sazidul0
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/Sazidul0/TI2DaC
+Project-URL: Repository, https://github.com/Sazidul0/TI2DaC
+Project-URL: Issues, https://github.com/Sazidul0/TI2DaC/issues
+Keywords: threat-intelligence,sigma,detection-as-code,mitre-attack,siem,splunk,elastic,microsoft-sentinel,wazuh,blue-team,detection-engineering,llm,security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Information Technology
+Classifier: Intended Audience :: Developers
+Classifier: Environment :: Console
+Classifier: Environment :: Web Environment
+Classifier: Topic :: Security
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: anthropic>=2.3
+Requires-Dist: pydantic>=2.7
+Requires-Dist: pysigma<0.12,>=0.11
+Requires-Dist: pyparsing<3.2,>=3.1
+Requires-Dist: sigma-cli==1.0.6
+Requires-Dist: pySigma-backend-splunk==1.1.3
+Requires-Dist: pySigma-backend-elasticsearch==1.1.6
+Requires-Dist: pySigma-backend-kusto==0.4.5
+Requires-Dist: pySigma-backend-crowdstrike==2.0.1
+Requires-Dist: pySigma-backend-qradar-aql==0.3.2
+Requires-Dist: pySigma-backend-opensearch==1.0.4
+Requires-Dist: pySigma-backend-loki==0.12.4
+Requires-Dist: pySigma-pipeline-sysmon==1.0.4
+Requires-Dist: pySigma-pipeline-windows==1.2.0
+Requires-Dist: pySigma-backend-sqlite==0.2.0
+Requires-Dist: regex==2023.12.25
+Requires-Dist: dateparser==1.2.1
+Requires-Dist: trafilatura>=1.8
+Requires-Dist: beautifulsoup4
+Requires-Dist: lxml
+Requires-Dist: pypdf>=4
+Requires-Dist: python-docx>=1.1
+Requires-Dist: pyyaml>=6
+Requires-Dist: httpx>=0.27
+Requires-Dist: typer>=0.12
+Requires-Dist: fastapi>=0.110
+Requires-Dist: uvicorn>=0.29
+Requires-Dist: jinja2>=3.1
+Requires-Dist: markdown-it-py>=3
+Requires-Dist: python-multipart
+Provides-Extra: dev
+Requires-Dist: pytest>=8; extra == "dev"
+Provides-Extra: gemini
+Requires-Dist: google-genai>=1.30; extra == "gemini"
+Provides-Extra: evtx
+Requires-Dist: python-evtx>=0.7; extra == "evtx"
+Requires-Dist: defusedxml>=0.7; extra == "evtx"
+Dynamic: license-file
+
+<p align="center">
+  <img src="https://raw.githubusercontent.com/Sazidul0/TI2DaC/main/docs/ti2dac-banner.svg" alt="ti2dac: Threat Intelligence to Detection-as-Code" width="100%">
+</p>
+
+<p align="center">
+  <a href="https://pypi.org/project/ti2dac/"><img src="https://img.shields.io/pypi/v/ti2dac?label=PyPI&color=1f4e79" alt="PyPI version"></a>
+  <a href="https://pypi.org/project/ti2dac/"><img src="https://img.shields.io/pypi/pyversions/ti2dac" alt="Python versions"></a>
+  <a href="https://github.com/Sazidul0/TI2DaC/actions/workflows/ci.yml"><img src="https://github.com/Sazidul0/TI2DaC/actions/workflows/ci.yml/badge.svg" alt="Build status"></a>
+  <a href="https://github.com/Sazidul0/TI2DaC/blob/main/LICENSE"><img src="https://img.shields.io/github/license/Sazidul0/TI2DaC" alt="License"></a>
+  <a href="https://github.com/Sazidul0/TI2DaC/stargazers"><img src="https://img.shields.io/github/stars/Sazidul0/TI2DaC?style=flat" alt="GitHub stars"></a>
+  <a href="https://github.com/Sazidul0/TI2DaC/issues"><img src="https://img.shields.io/github/issues/Sazidul0/TI2DaC" alt="GitHub issues"></a>
+</p>
+
+**Open-source Threat Intelligence to Detection-as-Code engine.** ti2dac turns threat reports and incident write-ups into evidence-checked Sigma rules, native queries for Splunk, Elastic, Sentinel, Defender, CrowdStrike, QRadar, OpenSearch, Loki and Wazuh, and safe simulation and test guides, so blue teams can go from a report to a reviewed detection package in minutes.
+
+`sigma` · `detection-as-code` · `threat-intelligence` · `mitre-attack` · `siem` · `splunk` · `elastic` · `microsoft-sentinel` · `wazuh` · `blue-team` · `detection-engineering` · `llm`
+
+# ti2dac: Threat Intelligence → Detection-as-Code
+
+ti2dac turns a **threat-intelligence report or an internal incident report** into a reviewed, tested detection package:
+
+- the attacker behaviours (TTPs) in the report, with evidence quotes checked against the source and verified MITRE ATT&CK mappings
+- one vendor-neutral **Sigma** rule per behaviour (single-event or threshold/correlation), validated with pySigma
+- the same rule as native queries for **Splunk, Elastic, Microsoft Sentinel, Defender XDR, CrowdStrike NG-SIEM, QRadar, OpenSearch and Grafana Loki**, with a per-SIEM field-mapping table
+- a **simulation and test guide** per rule: a safe lab script and its cleanup, the matching Atomic Red Team test, expected events, and positive and false-positive test procedures
+- **unit tests** for each rule, plus local replay of real lab or incident logs, so you know a rule fires *before* it reaches a SIEM
+- **ADS** triage documentation, telemetry requirements, a validation matrix and an ATT&CK Navigator layer
+- a **feedback and review workflow**: error taxonomy, versioned corrections, lessons fed back into the AI, four-eyes approval and an audit log
+
+The AI does the reading and the detection writing. Everything that can be deterministic is deterministic: conversion,
+validation, documentation, safety checks and redaction. This keeps token use low and the output reproducible.
+
+![ti2dac main flow: report, reader, gatekeeper, summariser, AI analysis, verification, AI rule drafting, inspection and repair, SIEM translation, packaging, then human testing, review and export to Git](https://raw.githubusercontent.com/Sazidul0/TI2DaC/main/docs/ti2dac-overview.svg)
+
+*Steps 1 to 9 run automatically. Steps 10 to 12 are done by people: ti2dac never runs the simulation scripts and never connects to your SIEM.*
+
+## Install
+
+Requires Python 3.10 or newer.
+
+```bash
+pip install ti2dac            # or: pipx install ti2dac
+pip install "ti2dac[gemini]"  # optional: Google Gemini as the AI provider
+pip install "ti2dac[evtx]"    # optional: replay Windows .evtx evidence
+```
+
+## Quick start
+
+From a source checkout (`git clone https://github.com/Sazidul0/TI2DaC && cd TI2DaC`):
+
+```bash
+uv venv .venv && uv pip install --python .venv/bin/python -e ".[dev]"
+cp .env.example .env                         # then add ANTHROPIC_API_KEY (see docs/getting-started.md)
+cp ti2dac.example.yaml ti2dac.yaml           # then set your domains, customer names, telemetry
+
+ti2dac run path/to/report.html               # public threat-intel report (file or URL)
+ti2dac run IR-2026-0147.docx --incident --events host-sysmon.evtx   # internal incident report + its evidence logs
+ti2dac serve                                 # web UI on http://127.0.0.1:8000
+```
+
+The two-step flow lets an analyst choose behaviours before any rule-generation tokens are spent:
+
+```bash
+ti2dac analyze report.html                   # 1 AI call: behaviours ranked as B1..Bn
+ti2dac generate <run-id> --select B2,B5      # 1 AI call per chosen behaviour
+```
+
+Without AI (`--no-ai` or `TI2DAC_NO_AI=1`), the deterministic parts still work: ingestion, IOC extraction,
+cited ATT&CK IDs, and validation, conversion, unit tests and replay of hand-written rules.
+
+## Web UI
+
+`ti2dac serve` starts a local web UI (bound to `127.0.0.1`) for analysts and reviewers, with logins and roles.
+
+![ti2dac Runs page: totals for reports, rules, approvals and AI usage, the New analysis form with document type choice, recent jobs and SIEM coverage](https://raw.githubusercontent.com/Sazidul0/TI2DaC/main/docs/screenshot-runs.png)
+
+*The Runs page: upload a report or paste a URL, choose the document type, and follow recent jobs and totals.*
+
+![ti2dac run page: extracted behaviours ranked by detectability, each with ATT&CK technique, verified evidence count and the rule generated from it](https://raw.githubusercontent.com/Sazidul0/TI2DaC/main/docs/screenshot-behaviours.png)
+
+*A run: behaviours extracted from the report, ranked, with checked evidence quotes and ATT&CK mappings. Tick any behaviour without a rule to generate more.*
+
+## Safety at a glance
+
+- **Your data stays home.** The AI sees only trimmed, redacted text. Names, hosts, internal IPs, emails and secrets are replaced with placeholders first. TLP:RED documents never go to an AI.
+- **Nothing is executed.** Simulation scripts are linted for destructive or credential-stealing actions, and the tool never runs them. Nothing the model writes is run.
+- **Nothing is trusted unchecked.** Evidence quotes, ATT&CK IDs, Sigma syntax and rule self-tests are verified by code before you see a rule.
+- **People stay in charge.** The tool drafts. A second person (the approver) must approve what the author created, and only approved rules are exported.
+
+Generated rules are drafts until you have tested them on real events. See [known limitations](docs/known-limitations.md).
+
+## Documentation
+
+| Guide | What is in it |
+|---|---|
+| [Getting started](docs/getting-started.md) | AI provider setup, a step-by-step walk-through, supported inputs |
+| [How it works](docs/how-it-works.md) | Architecture in plain terms, the working process, how tokens are kept low |
+| [Quality, safety and testing](docs/quality-and-testing.md) | Safety controls and the three levels of proving a rule works |
+| [SIEM coverage](docs/siem-coverage.md) | The 14 targets, Wazuh, correlations and client profiles |
+| [Review and configuration](docs/governance-and-config.md) | Feedback, four-eyes approval, Git hand-off, `ti2dac.yaml` |
+| [Operations](docs/operations.md) | Monitoring, web UI security, output package layout |
+| [CLI reference](docs/cli-reference.md) | Every command |
+| [Known limitations](docs/known-limitations.md) | What the tool does not do yet |
+
+## Development
+
+```bash
+.venv/bin/python -m pytest -q      # 254 tests, no network or API key needed
+```
+
+Dependency pins that matter: pySigma must stay `0.11.x`, because the QRadar backend breaks on 2.x and newer
+SQLite-backend releases silently pull in pySigma 2. `pyparsing` must stay below 3.2, which pySigma 0.11's condition
+parser needs. `pySigma-backend-sqlite` must be `0.2.0`. `regex` and `dateparser` are pinned together (see `pyproject.toml`).
+
+## License
+
+MIT. See [LICENSE](LICENSE).

ti2dac-0.1.0/README.md

@@ -0,0 +1,117 @@
+<p align="center">
+  <img src="https://raw.githubusercontent.com/Sazidul0/TI2DaC/main/docs/ti2dac-banner.svg" alt="ti2dac: Threat Intelligence to Detection-as-Code" width="100%">
+</p>
+
+<p align="center">
+  <a href="https://pypi.org/project/ti2dac/"><img src="https://img.shields.io/pypi/v/ti2dac?label=PyPI&color=1f4e79" alt="PyPI version"></a>
+  <a href="https://pypi.org/project/ti2dac/"><img src="https://img.shields.io/pypi/pyversions/ti2dac" alt="Python versions"></a>
+  <a href="https://github.com/Sazidul0/TI2DaC/actions/workflows/ci.yml"><img src="https://github.com/Sazidul0/TI2DaC/actions/workflows/ci.yml/badge.svg" alt="Build status"></a>
+  <a href="https://github.com/Sazidul0/TI2DaC/blob/main/LICENSE"><img src="https://img.shields.io/github/license/Sazidul0/TI2DaC" alt="License"></a>
+  <a href="https://github.com/Sazidul0/TI2DaC/stargazers"><img src="https://img.shields.io/github/stars/Sazidul0/TI2DaC?style=flat" alt="GitHub stars"></a>
+  <a href="https://github.com/Sazidul0/TI2DaC/issues"><img src="https://img.shields.io/github/issues/Sazidul0/TI2DaC" alt="GitHub issues"></a>
+</p>
+
+**Open-source Threat Intelligence to Detection-as-Code engine.** ti2dac turns threat reports and incident write-ups into evidence-checked Sigma rules, native queries for Splunk, Elastic, Sentinel, Defender, CrowdStrike, QRadar, OpenSearch, Loki and Wazuh, and safe simulation and test guides, so blue teams can go from a report to a reviewed detection package in minutes.
+
+`sigma` · `detection-as-code` · `threat-intelligence` · `mitre-attack` · `siem` · `splunk` · `elastic` · `microsoft-sentinel` · `wazuh` · `blue-team` · `detection-engineering` · `llm`
+
+# ti2dac: Threat Intelligence → Detection-as-Code
+
+ti2dac turns a **threat-intelligence report or an internal incident report** into a reviewed, tested detection package:
+
+- the attacker behaviours (TTPs) in the report, with evidence quotes checked against the source and verified MITRE ATT&CK mappings
+- one vendor-neutral **Sigma** rule per behaviour (single-event or threshold/correlation), validated with pySigma
+- the same rule as native queries for **Splunk, Elastic, Microsoft Sentinel, Defender XDR, CrowdStrike NG-SIEM, QRadar, OpenSearch and Grafana Loki**, with a per-SIEM field-mapping table
+- a **simulation and test guide** per rule: a safe lab script and its cleanup, the matching Atomic Red Team test, expected events, and positive and false-positive test procedures
+- **unit tests** for each rule, plus local replay of real lab or incident logs, so you know a rule fires *before* it reaches a SIEM
+- **ADS** triage documentation, telemetry requirements, a validation matrix and an ATT&CK Navigator layer
+- a **feedback and review workflow**: error taxonomy, versioned corrections, lessons fed back into the AI, four-eyes approval and an audit log
+
+The AI does the reading and the detection writing. Everything that can be deterministic is deterministic: conversion,
+validation, documentation, safety checks and redaction. This keeps token use low and the output reproducible.
+
+![ti2dac main flow: report, reader, gatekeeper, summariser, AI analysis, verification, AI rule drafting, inspection and repair, SIEM translation, packaging, then human testing, review and export to Git](https://raw.githubusercontent.com/Sazidul0/TI2DaC/main/docs/ti2dac-overview.svg)
+
+*Steps 1 to 9 run automatically. Steps 10 to 12 are done by people: ti2dac never runs the simulation scripts and never connects to your SIEM.*
+
+## Install
+
+Requires Python 3.10 or newer.
+
+```bash
+pip install ti2dac            # or: pipx install ti2dac
+pip install "ti2dac[gemini]"  # optional: Google Gemini as the AI provider
+pip install "ti2dac[evtx]"    # optional: replay Windows .evtx evidence
+```
+
+## Quick start
+
+From a source checkout (`git clone https://github.com/Sazidul0/TI2DaC && cd TI2DaC`):
+
+```bash
+uv venv .venv && uv pip install --python .venv/bin/python -e ".[dev]"
+cp .env.example .env                         # then add ANTHROPIC_API_KEY (see docs/getting-started.md)
+cp ti2dac.example.yaml ti2dac.yaml           # then set your domains, customer names, telemetry
+
+ti2dac run path/to/report.html               # public threat-intel report (file or URL)
+ti2dac run IR-2026-0147.docx --incident --events host-sysmon.evtx   # internal incident report + its evidence logs
+ti2dac serve                                 # web UI on http://127.0.0.1:8000
+```
+
+The two-step flow lets an analyst choose behaviours before any rule-generation tokens are spent:
+
+```bash
+ti2dac analyze report.html                   # 1 AI call: behaviours ranked as B1..Bn
+ti2dac generate <run-id> --select B2,B5      # 1 AI call per chosen behaviour
+```
+
+Without AI (`--no-ai` or `TI2DAC_NO_AI=1`), the deterministic parts still work: ingestion, IOC extraction,
+cited ATT&CK IDs, and validation, conversion, unit tests and replay of hand-written rules.
+
+## Web UI
+
+`ti2dac serve` starts a local web UI (bound to `127.0.0.1`) for analysts and reviewers, with logins and roles.
+
+![ti2dac Runs page: totals for reports, rules, approvals and AI usage, the New analysis form with document type choice, recent jobs and SIEM coverage](https://raw.githubusercontent.com/Sazidul0/TI2DaC/main/docs/screenshot-runs.png)
+
+*The Runs page: upload a report or paste a URL, choose the document type, and follow recent jobs and totals.*
+
+![ti2dac run page: extracted behaviours ranked by detectability, each with ATT&CK technique, verified evidence count and the rule generated from it](https://raw.githubusercontent.com/Sazidul0/TI2DaC/main/docs/screenshot-behaviours.png)
+
+*A run: behaviours extracted from the report, ranked, with checked evidence quotes and ATT&CK mappings. Tick any behaviour without a rule to generate more.*
+
+## Safety at a glance
+
+- **Your data stays home.** The AI sees only trimmed, redacted text. Names, hosts, internal IPs, emails and secrets are replaced with placeholders first. TLP:RED documents never go to an AI.
+- **Nothing is executed.** Simulation scripts are linted for destructive or credential-stealing actions, and the tool never runs them. Nothing the model writes is run.
+- **Nothing is trusted unchecked.** Evidence quotes, ATT&CK IDs, Sigma syntax and rule self-tests are verified by code before you see a rule.
+- **People stay in charge.** The tool drafts. A second person (the approver) must approve what the author created, and only approved rules are exported.
+
+Generated rules are drafts until you have tested them on real events. See [known limitations](docs/known-limitations.md).
+
+## Documentation
+
+| Guide | What is in it |
+|---|---|
+| [Getting started](docs/getting-started.md) | AI provider setup, a step-by-step walk-through, supported inputs |
+| [How it works](docs/how-it-works.md) | Architecture in plain terms, the working process, how tokens are kept low |
+| [Quality, safety and testing](docs/quality-and-testing.md) | Safety controls and the three levels of proving a rule works |
+| [SIEM coverage](docs/siem-coverage.md) | The 14 targets, Wazuh, correlations and client profiles |
+| [Review and configuration](docs/governance-and-config.md) | Feedback, four-eyes approval, Git hand-off, `ti2dac.yaml` |
+| [Operations](docs/operations.md) | Monitoring, web UI security, output package layout |
+| [CLI reference](docs/cli-reference.md) | Every command |
+| [Known limitations](docs/known-limitations.md) | What the tool does not do yet |
+
+## Development
+
+```bash
+.venv/bin/python -m pytest -q      # 254 tests, no network or API key needed
+```
+
+Dependency pins that matter: pySigma must stay `0.11.x`, because the QRadar backend breaks on 2.x and newer
+SQLite-backend releases silently pull in pySigma 2. `pyparsing` must stay below 3.2, which pySigma 0.11's condition
+parser needs. `pySigma-backend-sqlite` must be `0.2.0`. `regex` and `dateparser` are pinned together (see `pyproject.toml`).
+
+## License
+
+MIT. See [LICENSE](LICENSE).

ti2dac-0.1.0/pyproject.toml

@@ -0,0 +1,86 @@
+[build-system]
+requires = ["setuptools>=77"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "ti2dac"
+version = "0.1.0"
+description = "Threat Intelligence to Detection-as-Code: TI report -> Sigma -> multi-SIEM queries + safe simulation guides"
+readme = "README.md"
+requires-python = ">=3.10"
+license = "MIT"
+license-files = ["LICENSE"]
+authors = [{ name = "Sazidul0" }]
+keywords = ["threat-intelligence", "sigma", "detection-as-code", "mitre-attack", "siem", "splunk", "elastic", "microsoft-sentinel", "wazuh", "blue-team", "detection-engineering", "llm", "security"]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Information Technology",
+    "Intended Audience :: Developers",
+    "Environment :: Console",
+    "Environment :: Web Environment",
+    "Topic :: Security",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3 :: Only",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.12",
+    "Operating System :: OS Independent",
+]
+dependencies = [
+    "anthropic>=2.3",
+    "pydantic>=2.7",
+    "pysigma>=0.11,<0.12",
+    "pyparsing>=3.1,<3.2",          # pySigma 0.11 condition parser breaks on pyparsing 3.2+
+    # Exact pins: the sigma backends are tested together at these versions.
+    # Unpinned, pip backtracks through dozens of releases during install.
+    "sigma-cli==1.0.6",
+    "pySigma-backend-splunk==1.1.3",
+    "pySigma-backend-elasticsearch==1.1.6",
+    "pySigma-backend-kusto==0.4.5",
+    "pySigma-backend-crowdstrike==2.0.1",
+    "pySigma-backend-qradar-aql==0.3.2",
+    "pySigma-backend-opensearch==1.0.4",
+    "pySigma-backend-loki==0.12.4",
+    "pySigma-pipeline-sysmon==1.0.4",
+    "pySigma-pipeline-windows==1.2.0",
+    "pySigma-backend-sqlite==0.2.0",  # local rule evaluation (self-tests, replay); later versions need pySigma 2
+    # pySigma-backend-qradar-aql needs regex<2024; dateparser>=1.4 (pulled in via trafilatura) needs regex>=2024.
+    # These two pins are the combination the project is tested with.
+    "regex==2023.12.25",
+    "dateparser==1.2.1",
+    "trafilatura>=1.8",
+    "beautifulsoup4",
+    "lxml",
+    "pypdf>=4",
+    "python-docx>=1.1",               # incident reports in Word format
+    "pyyaml>=6",
+    "httpx>=0.27",
+    "typer>=0.12",
+    "fastapi>=0.110",
+    "uvicorn>=0.29",
+    "jinja2>=3.1",
+    "markdown-it-py>=3",
+    "python-multipart",
+]
+
+[project.optional-dependencies]
+dev = ["pytest>=8"]
+gemini = ["google-genai>=1.30"]
+evtx = ["python-evtx>=0.7", "defusedxml>=0.7"]
+
+[project.urls]
+Homepage = "https://github.com/Sazidul0/TI2DaC"
+Repository = "https://github.com/Sazidul0/TI2DaC"
+Issues = "https://github.com/Sazidul0/TI2DaC/issues"
+
+[project.scripts]
+ti2dac = "ti2dac.cli:app"
+
+[tool.setuptools.packages.find]
+where = ["src"]
+
+[tool.setuptools.package-data]
+ti2dac = ["data/*.json", "data/*.yaml", "data/*.yml", "web/templates/*.html", "web/static/*"]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+filterwarnings = ["ignore::SyntaxWarning", "ignore::DeprecationWarning"]

ti2dac-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

ti2dac-0.1.0/src/ti2dac/__init__.py

@@ -0,0 +1,3 @@
+"""ti2dac - Threat Intelligence to Detection-as-Code."""
+
+__version__ = "0.1.0"

ti2dac-0.1.0/src/ti2dac/aistatus.py

@@ -0,0 +1,169 @@
+"""AI provider health: limit detection, circuit breaker and request counting.
+
+Shared by the CLI and the web UI through <state_dir>/ai_status.json, so that once a provider says
+"quota exhausted" (or our own daily cap is reached) NO process sends further requests until the reset
+time. Hammering a provider after it refused is wasteful and can look like abuse to the provider.
+
+States per provider:
+  ok               last call succeeded
+  rate_limited     short-term limit (per-minute); calls resume after retry_at
+  quota_exhausted  daily/monthly quota, credit or spend limit; calls blocked until retry_at (or manual reset)
+  daily_cap        our own `ai.daily_request_limit` reached; resets at local midnight
+  auth_error       key missing/invalid; blocked until reset
+  refused          the model declined a request (informational; does not block)
+  unavailable      provider down/overloaded after retries (informational; does not block)
+"""
+from __future__ import annotations
+
+import json
+import os
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+
+from .locks import file_lock
+
+BLOCKING = {"rate_limited", "quota_exhausted", "daily_cap", "auth_error"}
+DAILY_COUNTERS = ("requests_today", "input_tokens_today", "output_tokens_today", "cache_read_tokens_today", "cost_today_usd")
+TOTAL_COUNTERS = ("input_tokens_total", "output_tokens_total", "cost_total_usd")
+
+
+def _now() -> datetime:
+    return datetime.now(timezone.utc)
+
+
+def _path(state_dir: str | Path) -> Path:
+    return Path(state_dir) / "ai_status.json"
+
+
+def _locked(state_dir: str | Path):
+    """Read-modify-write of ai_status.json: the server, its job workers and the CLI all count requests."""
+    return file_lock(Path(state_dir) / "ai_status.lock")
+
+
+def load(state_dir: str | Path) -> dict:
+    try:
+        return json.loads(_path(state_dir).read_text())
+    except (OSError, ValueError):
+        return {}
+
+
+def _save(state_dir: str | Path, data: dict) -> None:
+    p = _path(state_dir)
+    p.parent.mkdir(parents=True, exist_ok=True)
+    tmp = p.with_suffix(f".{os.getpid()}.tmp")
+    tmp.write_text(json.dumps(data, indent=1))
+    tmp.replace(p)
+
+
+def provider_status(state_dir: str | Path, provider: str) -> dict:
+    s = load(state_dir).get(provider, {})
+    today = datetime.now().date().isoformat()
+    if s.get("day") != today:
+        s = {**s, "day": today, **{k: 0 for k in DAILY_COUNTERS}}
+        if s.get("state") == "daily_cap":
+            s["state"] = "ok"
+    return s
+
+
+def update(state_dir: str | Path, provider: str, **fields) -> dict:
+    with _locked(state_dir):
+        data = load(state_dir)
+        cur = provider_status(state_dir, provider) if provider in data else {
+            "day": datetime.now().date().isoformat(), "requests_today": 0}
+        cur.update(fields)
+        cur["updated_at"] = _now().isoformat(timespec="seconds")
+        data[provider] = cur
+        _save(state_dir, data)
+        return cur
+
+
+def count_request(state_dir: str | Path, provider: str) -> int:
+    with _locked(state_dir):
+        data = load(state_dir)
+        cur = provider_status(state_dir, provider)
+        cur["requests_today"] = int(cur.get("requests_today", 0)) + 1
+        data[provider] = cur
+        _save(state_dir, data)
+        return cur["requests_today"]
+
+
+def add_usage(state_dir: str | Path, provider: str, input_tokens: int, output_tokens: int,
+              cache_read_tokens: int, cost_usd: float) -> None:
+    """Token accounting per provider: today (resets at local midnight) and since the state dir was created."""
+    with _locked(state_dir):
+        data = load(state_dir)
+        cur = provider_status(state_dir, provider)
+        for key, val in (("input_tokens", input_tokens), ("output_tokens", output_tokens)):
+            cur[f"{key}_today"] = int(cur.get(f"{key}_today", 0)) + val
+            cur[f"{key}_total"] = int(cur.get(f"{key}_total", 0)) + val
+        cur["cache_read_tokens_today"] = int(cur.get("cache_read_tokens_today", 0)) + cache_read_tokens
+        cur["cost_today_usd"] = round(float(cur.get("cost_today_usd", 0)) + cost_usd, 4)
+        cur["cost_total_usd"] = round(float(cur.get("cost_total_usd", 0)) + cost_usd, 4)
+        data[provider] = cur
+        _save(state_dir, data)
+
+
+def record_ok(state_dir: str | Path, provider: str) -> None:
+    update(state_dir, provider, state="ok", message="", retry_at="", last_success=_now().isoformat(timespec="seconds"))
+
+
+def record_block(state_dir: str | Path, provider: str, state: str, message: str, retry_after_s: float | None) -> None:
+    retry_at = (_now() + timedelta(seconds=retry_after_s)).isoformat(timespec="seconds") if retry_after_s else ""
+    update(state_dir, provider, state=state, message=message[:500], retry_at=retry_at)
+
+
+def reset(state_dir: str | Path, provider: str | None = None) -> None:
+    with _locked(state_dir):
+        data = load(state_dir)
+        for name in ([provider] if provider else list(data)):
+            if name in data:
+                data[name].update(state="ok", message="", retry_at="")
+        _save(state_dir, data)
+
+
+def block_reason(state_dir: str | Path, provider: str, daily_limit: int = 0) -> str:
+    """Why calls to `provider` are blocked right now ('' = allowed). Never contacts the provider."""
+    s = provider_status(state_dir, provider)
+    state = s.get("state", "ok")
+    if daily_limit and int(s.get("requests_today", 0)) >= daily_limit:
+        return (f"{provider}: daily request cap reached ({s.get('requests_today')}/{daily_limit}, "
+                "ai.daily_request_limit). Resets at local midnight, or raise the cap.")
+    if state not in BLOCKING:
+        return ""
+    retry_at = s.get("retry_at", "")
+    if retry_at:
+        try:
+            if datetime.fromisoformat(retry_at) <= _now():
+                return ""                       # the provider's own reset time has passed
+        except ValueError:
+            pass
+    elif state == "rate_limited":
+        return ""
+    when = f" Retry after {retry_at} (UTC)." if retry_at else " Fix the cause, then reset with `ti2dac ai-status --reset` or the AI page."
+    return f"{provider}: {state.replace('_', ' ')}. {s.get('message', '')}".strip() + when
+
+
+def human_wait(retry_at: str) -> str:
+    try:
+        secs = (datetime.fromisoformat(retry_at) - _now()).total_seconds()
+    except (ValueError, TypeError):
+        return ""
+    if secs <= 0:
+        return "now"
+    h, m = int(secs // 3600), int(secs % 3600 // 60)
+    return f"{h}h {m}m" if h else f"{m}m"
+
+
+def key_status(provider: str) -> str:
+    """Where credentials would come from (never the key itself)."""
+    if provider == "gemini":
+        for var in ("GEMINI_API_KEY", "GOOGLE_API_KEY"):
+            if os.environ.get(var):
+                return f"{var} is set"
+        return "not configured"
+    for var in ("ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN"):
+        if os.environ.get(var):
+            return f"{var} is set"
+    if os.environ.get("ANTHROPIC_PROFILE") or (Path.home() / ".config" / "anthropic").is_dir():
+        return "`ant auth login` profile found"
+    return "not configured"