From 74fddf11ed04cedaef4f736b4edcd3aff5bd3f54 Mon Sep 17 00:00:00 2001 From: rookit Date: Wed, 27 May 2026 18:22:40 +0800 Subject: [PATCH] update PLUGINS --- DATA/SYSTEM/KNOWLEDGE_EXTRACTION/System.md | 3 ++- DATA/SYSTEM/KNOWLEDGE_EXTRACTION/System_EN.md | 3 ++- PLAYBOOKS/Knowledge_Extraction.py | 3 ++- PLUGINS/SIRP/analysis.py | 7 +++++-- 4 files changed, 11 insertions(+), 5 deletions(-) diff --git a/DATA/SYSTEM/KNOWLEDGE_EXTRACTION/System.md b/DATA/SYSTEM/KNOWLEDGE_EXTRACTION/System.md index d133d70..e251498 100644 --- a/DATA/SYSTEM/KNOWLEDGE_EXTRACTION/System.md +++ b/DATA/SYSTEM/KNOWLEDGE_EXTRACTION/System.md @@ -3,13 +3,14 @@ 输入格式： -HumanMessage 是一个 JSON 对象，包含三个顶层字段：`case_id`、`case` 和 `discussions`。 +HumanMessage 是一个 JSON 对象，包含三个必选顶层字段：`case_id`、`case` 和 `discussions`，以及一个可选字段 `user_input`。 - `case_id` 是 Case 的人类可读 ID（例如 "case_000123"）。你必须在知识正文中引用此 ID，以便未来读者追溯知识来源。 - `case` 是已关闭的 Case 及其全部结构化数据 — 告警、实体、富化信息、判定结果、结案摘要、分析师注释、描述、标签等。 - `discussions` 是案件上的分析师评论和回复列表。每条包含 `message`（评论文本）、`created_at`、`created_by`（作者）、 `reply_to_author`、`mentions`（被提及的用户列表）和 `attachments`（附件列表）。讨论通常包含最有价值的人工推理：假设、误报理由、手动标注的 IOC 和操作备注。 +- `user_input`（可选）是分析师触发 Playbook 时提供的额外指引。如果存在，请结合用户输入来调整提取方向 — 它可能指定了关注点、格式偏好或补充背景信息。 ## 何时提取知识 diff --git a/DATA/SYSTEM/KNOWLEDGE_EXTRACTION/System_EN.md b/DATA/SYSTEM/KNOWLEDGE_EXTRACTION/System_EN.md index f52b72f..f88fe65 100644 --- a/DATA/SYSTEM/KNOWLEDGE_EXTRACTION/System_EN.md +++ b/DATA/SYSTEM/KNOWLEDGE_EXTRACTION/System_EN.md @@ -2,11 +2,12 @@ You are a SOC knowledge extraction agent. Your task is to read a closed Case (in Input format: -The human message is a JSON object with three top-level fields: `case_id`, `case`, and `discussions`. +The human message is a JSON object with three required top-level fields: `case_id`, `case`, and `discussions`. An optional fourth field `user_input` may also be present. - `case_id` is the human-readable Case ID (e.g. "case_000123"). You MUST reference this ID in the knowledge body so future readers can trace the knowledge back to its source. - `case` is the closed Case with all its structured data — alerts, artifacts, enrichments, verdict, summary, comment, description, tags, and more. - `discussions` is a list of analyst comments and replies on the case. Each item contains `message`, `created_at`, `created_by`, `reply_to_author`, `mentions`, and `attachments`. Discussions often contain the most valuable human reasoning: hypotheses, false positive rationale, manually noted IOCs, and operational notes. +- `user_input` (optional) is additional guidance provided by the analyst when triggering the playbook. If present, use it to inform your extraction — it may specify a focus area, format preference, or supplementary context that should shape the knowledge output. ## When to extract knowledge diff --git a/PLAYBOOKS/Knowledge_Extraction.py b/PLAYBOOKS/Knowledge_Extraction.py index d247260..0767279 100644 --- a/PLAYBOOKS/Knowledge_Extraction.py +++ b/PLAYBOOKS/Knowledge_Extraction.py @@ -37,7 +37,8 @@ class Playbook(BasePlaybook): discussions = Case.get_discussions_by_row_id(case_row_id) or [] # 5. Call LLM to extract knowledge - extraction = extract_knowledge_from_case(case.id or "", case_json, discussions) + user_input = self.param_user_input or "" + extraction = extract_knowledge_from_case(case.id or "", case_json, discussions, user_input) # 6. If no knowledge, log and return success if not extraction.has_knowledge: diff --git a/PLUGINS/SIRP/analysis.py b/PLUGINS/SIRP/analysis.py index 5223803..dd1693a 100644 --- a/PLUGINS/SIRP/analysis.py +++ b/PLUGINS/SIRP/analysis.py @@ -303,14 +303,17 @@ class KnowledgeExtractionResult(BaseModel): reason: str = Field(description="Brief explanation of the extraction decision. 提取或不提取的简要原因。") -def extract_knowledge_from_case(case_id: str, case_json: str, discussions: List[dict[str, Any]]) -> KnowledgeExtractionResult: +def extract_knowledge_from_case(case_id: str, case_json: str, discussions: List[dict[str, Any]], user_input: str = "") -> KnowledgeExtractionResult: system_prompt = KNOWLEDGE_EXTRACTION_PROMPT_PATH.read_text(encoding="utf-8") llm = LLMAPI().get_model(tag="structured_output").with_structured_output(KnowledgeExtractionResult) try: case_data = json.loads(case_json) except json.JSONDecodeError: case_data = case_json - input_json = json.dumps({"case_id": case_id, "case": case_data, "discussions": discussions}, ensure_ascii=False, separators=(",", ":")) + input_data = {"case_id": case_id, "case": case_data, "discussions": discussions} + if user_input: + input_data["user_input"] = user_input + input_json = json.dumps(input_data, ensure_ascii=False, separators=(",", ":")) result = llm.invoke([ SystemMessage(content=system_prompt), HumanMessage(content=input_json),