mirror of
https://github.com/FunnyWolf/agentic-soc-platform.git
synced 2026-08-22 13:12:56 +02:00
delete dify plugin
This commit is contained in:
rookit
@@ -10,7 +10,7 @@
|
||||
"plugins": [
|
||||
{
|
||||
"name": "asp",
|
||||
"description": "A comprehensive toolkit for operating the ASP platform, including features such as case management,SIEM Query.",
|
||||
"description": "A comprehensive toolkit for operating the ASP platform.",
|
||||
"source": "./PLUGINS/ClaudeCode",
|
||||
"category": "cybersecurity",
|
||||
"homepage": "https://github.com/FunnyWolf/agentic-soc-platform/tree/master/PLUGINS/ClaudeCode"
|
||||
|
||||
@@ -1,18 +0,0 @@
|
||||
# Dify 插件文档地址: https://asp.viperrtp.com/zh/asf/PLUGINS/Dify/
|
||||
# Dify Doc: https://asp.viperrtp.com/asf/PLUGINS/Dify/
|
||||
|
||||
# Dify API接口
|
||||
DIFY_BASE_URL = "http://192.168.241.128/v1"
|
||||
|
||||
# Dify 代理设置,如可直接访问DIFY_BASE_URL则设置为None
|
||||
# 支持代理格式
|
||||
# HTTP: http://192.168.1.100:3128
|
||||
# HTTP带认证: http://user:pass@192.168.1.100:3128
|
||||
# SOCKS5: socks5://192.168.1.100:1080
|
||||
# SOCKS5带认证: socks5://user:pass@192.168.1.100:1080
|
||||
DIFY_PROXY = None
|
||||
|
||||
# Dify 应用API Key配置
|
||||
DIFY_API_KEY = {
|
||||
"ES-Rule-22-Phishing_user_report_mail": "app-6SY7rpP4BqnKqRgJjOrITCEn"
|
||||
}
|
||||
@@ -1,151 +0,0 @@
|
||||
app:
|
||||
description: ''
|
||||
icon: 🤖
|
||||
icon_background: '#FFEAD5'
|
||||
mode: agent-chat
|
||||
name: Sentinel
|
||||
use_icon_as_answer_icon: false
|
||||
dependencies:
|
||||
- current_identifier: null
|
||||
type: package
|
||||
value:
|
||||
plugin_unique_identifier: langgenius/tongyi:0.1.0@a2dd9bb656a2722292e8936f3287d53ba176cfbbe9b8bfafc596d4a2ddd99eb2
|
||||
version: null
|
||||
kind: app
|
||||
model_config:
|
||||
agent_mode:
|
||||
enabled: true
|
||||
max_iteration: 10
|
||||
prompt: null
|
||||
strategy: function_call
|
||||
tools:
|
||||
- enabled: false
|
||||
isDeleted: false
|
||||
notAuthor: false
|
||||
provider_id: sirp_new
|
||||
provider_name: SIRP
|
||||
provider_type: mcp
|
||||
tool_label: function_call_debug
|
||||
tool_name: function_call_debug
|
||||
tool_parameters:
|
||||
magic_num: ''
|
||||
- enabled: true
|
||||
isDeleted: false
|
||||
notAuthor: false
|
||||
provider_id: sirp_new
|
||||
provider_name: SIRP
|
||||
provider_type: mcp
|
||||
tool_label: get_case_by_rowid
|
||||
tool_name: get_case_by_rowid
|
||||
tool_parameters:
|
||||
case_id: ''
|
||||
annotation_reply:
|
||||
enabled: false
|
||||
chat_prompt_config:
|
||||
prompt:
|
||||
- role: system
|
||||
text: ''
|
||||
completion_prompt_config:
|
||||
conversation_histories_role:
|
||||
assistant_prefix: ''
|
||||
user_prefix: ''
|
||||
prompt:
|
||||
text: ''
|
||||
dataset_configs:
|
||||
datasets:
|
||||
datasets: []
|
||||
retrieval_model: multiple
|
||||
top_k: 4
|
||||
dataset_query_variable: ''
|
||||
external_data_tools: []
|
||||
file_upload:
|
||||
allowed_file_extensions:
|
||||
- .JPG
|
||||
- .JPEG
|
||||
- .PNG
|
||||
- .GIF
|
||||
- .WEBP
|
||||
- .SVG
|
||||
- .MP4
|
||||
- .MOV
|
||||
- .MPEG
|
||||
- .WEBM
|
||||
allowed_file_types: []
|
||||
allowed_file_upload_methods:
|
||||
- remote_url
|
||||
- local_file
|
||||
enabled: false
|
||||
image:
|
||||
detail: high
|
||||
enabled: false
|
||||
number_limits: 3
|
||||
transfer_methods:
|
||||
- remote_url
|
||||
- local_file
|
||||
number_limits: 3
|
||||
model:
|
||||
completion_params:
|
||||
stop: []
|
||||
mode: chat
|
||||
name: qwen3-max
|
||||
provider: langgenius/tongyi/tongyi
|
||||
more_like_this:
|
||||
enabled: false
|
||||
opening_statement: ''
|
||||
pre_prompt: "# Role & Identity\n你是一个嵌入在安全编排自动化与响应 (SOAR) 平台中的**专家级安全运营 Copilot**.你的代号是\
|
||||
\ \"Sentinel\".\n你的核心职责是作为人类分析师的**认知增强器 (Cognitive Multiplier)**,利用 MCP (Model\
|
||||
\ Context Protocol) 动态调用外部安全工具,高效完成威胁检测 (Detection)、事件调查 (Investigation) 和响应处置\
|
||||
\ (Response) 的闭环.\n\n你的思维模型必须完全模拟一名**高级安全分析师**：主动、严谨、基于证据、风险敏感.\n\n---\n\n# 1.\
|
||||
\ Dynamic Tool Utilization Strategy (核心机制：动态工具发现)\n你并不依赖硬编码的工具名称.在处理每个请求时,你必须实时检查\
|
||||
\ MCP 上下文提供的工具列表,并遵循以下逻辑：\n\n1. **工具自省 (Tool Introspection):** 仔细阅读每个工具的 `name`\
|
||||
\ 和 `description`.\n2. **语义映射 (Semantic Mapping):** 根据用户的意图寻找具备相应**能力**的工具：\n\
|
||||
\ * *验证/情报:* 寻找关键词 `reputation`, `enrich`, `lookup`, `intelligence`, `virustotal`,\
|
||||
\ `threat`.\n * *调查/日志:* 寻找关键词 `search`, `query`, `log`, `splunk`, `elastic`,\
|
||||
\ `history`.\n * *响应/处置:* 寻找关键词 `block`, `isolate`, `quarantine`, `ticket`,\
|
||||
\ `firewall`, `email`.\n3. **参数推断:** 严格根据 Schema 提取参数.如果缺少必要参数(如 IP 或 时间范围),**主动向用户询问**,绝不猜测.\n\
|
||||
4. **优雅降级 (Graceful Degradation):** 如果当前环境没有适合的工具,请明确告知用户：“当前未检测到具备[某功能]的工具,建议手动检查...”,严禁捏造工具调用.\n\
|
||||
\n---\n\n# 2. Operational Workflow (标准作业流程)\n在收到任何输入(警报文本、JSON 日志或自然语言指令)时,必须严格执行以下三个阶段：\n\
|
||||
\n## Phase 1: Triage & Context Extraction (分类与自动提取)\n- **自动提取 IOC:** 无论用户是否明确要求,立即从输入中识别并提取关键实体\
|
||||
\ (IOCs)：IP、域名、URL、Hash、用户名、主机名.\n- **信誉验证:** 优先调用情报类工具查询这些 IOC 的威胁信誉.\n- **目标:**\
|
||||
\ 快速判断这是误报 (False Positive) 还是真实威胁 (True Positive).\n\n## Phase 2: Deep Investigation\
|
||||
\ (深度调查)\n- **上下文关联:** 不要孤立看待警报.尝试调用查询工具搜索该实体在警报前后 (例如 +/- 15分钟) 的关联日志.\n- **框架映射:**\
|
||||
\ 始终尝试将观察到的攻击行为映射到 **MITRE ATT&CK** 框架的战术 (Tactics) 和技术 (Techniques).(例如: *映射到\
|
||||
\ T1110 - Brute Force*).\n- **时间轴构建:** 将分散的证据按时间顺序排列,还原攻击路径.\n\n## Phase 3: Response\
|
||||
\ & Remediation (响应与处置)\n- **风险评估:** 在建议处置之前,评估受影响资产的重要性(如核心数据库 vs 访客 Wi-Fi).\n\
|
||||
- **处置建议:** 基于证据提出具体的行动方案(如“封禁 IP”、“隔离主机”).如果 MCP 具备响应工具,准备好调用参数.\n\n---\n\n#\
|
||||
\ 3. Safety Guardrails (安全护栏)\n1. **No Hallucinations (零幻觉):** 严禁编造日志内容、IP 地址或工具返回结果.一切分析必须基于工具返回的真实数据.\n\
|
||||
2. **Human-in-the-Loop (人机回环):** 对于具有破坏性或阻断性的操作 (Write Actions),如“修改防火墙策略”、“隔离服务器”,除非用户明确授权或置信度极高,否则**必须优先输出建议**,请求用户确认,而不是直接执行.\n\
|
||||
3. **Privacy Aware:** 处理敏感数据 (PII) 时保持克制,仅提取分析必要的信息.\n\n---\n\n# 4. Output Standards\
|
||||
\ (输出规范)\n为了提升分析师效率,你的输出必须结构化、清晰且专业：\n\n1. **摘要 (Executive Summary):** 开头用一句话总结事件性质和风险等级\
|
||||
\ (Critical/High/Medium/Low).\n2. **数据可视化:** 涉及多个 IOC 或对比信息时,**必须使用 Markdown\
|
||||
\ 表格**.\n * *Example Table Columns:* `Entity | Type | Reputation Score | Geo-Location\
|
||||
\ | Associated User`\n3. **证据引用:** 任何结论后必须简要标注来源.*(e.g., \"IP 恶意置信度 90% [Source:\
|
||||
\ VirusTotal]\")*\n4. **下一步建议 (Actionable Next Steps):** 在回复的最后,提供 2-3 个明确的后续操作选项.这可以帮助\
|
||||
\ SOAR 前端渲染快捷按钮.\n\n---\n\n# 5. Tone & Style\n- **专业 (Professional):** 使用标准的网络安全术语\
|
||||
\ (C2, Lateral Movement, Exfiltration, Beaconing).\n- **客观 (Objective):** 区分“事实”与“推测”.\n\
|
||||
- **简洁 (Concise):** 避免啰嗦的寒暄,直接切入重点.\n\n---\n\n# Example Scenario (Few-Shot Thinking)\n\
|
||||
*User:* \"分析警报：主机 192.168.1.50 尝试连接恶意域名 bad-site.com\"\n*Your Thought Process:*\n\
|
||||
1. *Extract:* IOCs -> IP: 192.168.1.50 (Internal), Domain: bad-site.com (External).\n\
|
||||
2. *Tool:* Find threat intel tool -> Check 'bad-site.com'. (Result: Malware C2).\n\
|
||||
3. *Tool:* Find SIEM query tool -> Search 192.168.1.50 traffic history. (Result:\
|
||||
\ 500MB upload).\n4. *Analyze:* Confirmed C2 communication with Data Exfiltration.\
|
||||
\ Map to T1048.\n5. *Response:* Draft response suggesting isolation of 192.168.1.50\
|
||||
\ immediately."
|
||||
prompt_type: simple
|
||||
retriever_resource:
|
||||
enabled: true
|
||||
sensitive_word_avoidance:
|
||||
configs: []
|
||||
enabled: false
|
||||
type: ''
|
||||
speech_to_text:
|
||||
enabled: false
|
||||
suggested_questions: []
|
||||
suggested_questions_after_answer:
|
||||
enabled: false
|
||||
text_to_speech:
|
||||
enabled: false
|
||||
language: ''
|
||||
voice: ''
|
||||
user_input_form: []
|
||||
version: 0.5.0
|
||||
@@ -1,52 +0,0 @@
|
||||
from typing import Dict, Any
|
||||
|
||||
import requests
|
||||
|
||||
from Lib.log import logger
|
||||
from PLUGINS.Dify.CONFIG import DIFY_BASE_URL, DIFY_PROXY, DIFY_API_KEY
|
||||
|
||||
requests.packages.urllib3.disable_warnings()
|
||||
|
||||
|
||||
class Dify(object):
|
||||
def __init__(self):
|
||||
self.base_url = DIFY_BASE_URL
|
||||
|
||||
def run_workflow(self, api_key: str, inputs: Dict[str, Any], user: str = "default_user") -> Dict[str, Any]:
|
||||
url = f"{self.base_url}/workflows/run"
|
||||
headers = {
|
||||
"Authorization": f"Bearer {api_key}",
|
||||
}
|
||||
payload = {
|
||||
"inputs": inputs,
|
||||
"response_mode": "blocking",
|
||||
"user": user
|
||||
}
|
||||
proxies = None
|
||||
if DIFY_PROXY:
|
||||
proxies = {
|
||||
"http": DIFY_PROXY,
|
||||
"https": DIFY_PROXY,
|
||||
}
|
||||
try:
|
||||
response = requests.post(url,
|
||||
headers=headers,
|
||||
json=payload,
|
||||
proxies=proxies,
|
||||
)
|
||||
response.raise_for_status()
|
||||
|
||||
response_data = response.json()
|
||||
logger.debug(f"Dify API response: {response_data}")
|
||||
|
||||
data = response_data.get("data", {})
|
||||
if data and data.get("status") == "succeeded":
|
||||
outputs = data.get("outputs")
|
||||
return outputs
|
||||
else:
|
||||
return {}
|
||||
except Exception as e:
|
||||
raise
|
||||
|
||||
def get_dify_api_key(self, app_name=None):
|
||||
return DIFY_API_KEY.get(app_name)
|
||||
Reference in New Issue
Block a user