From 94e251f68d5767996dc29bc93e6a42a6fbf22701 Mon Sep 17 00:00:00 2001 From: rookit Date: Tue, 7 Apr 2026 14:48:54 +0800 Subject: [PATCH] delete dify plugin --- .claude-plugin/marketplace.json | 2 +- PLUGINS/Dify/CONFIG.example.py | 18 ---- PLUGINS/Dify/Sentinel.yml | 151 -------------------------------- PLUGINS/Dify/__init__.py | 0 PLUGINS/Dify/dify.py | 52 ----------- 5 files changed, 1 insertion(+), 222 deletions(-) delete mode 100644 PLUGINS/Dify/CONFIG.example.py delete mode 100644 PLUGINS/Dify/Sentinel.yml delete mode 100644 PLUGINS/Dify/__init__.py delete mode 100644 PLUGINS/Dify/dify.py diff --git a/.claude-plugin/marketplace.json b/.claude-plugin/marketplace.json index 15318cd..1df53ff 100644 --- a/.claude-plugin/marketplace.json +++ b/.claude-plugin/marketplace.json @@ -10,7 +10,7 @@ "plugins": [ { "name": "asp", - "description": "A comprehensive toolkit for operating the ASP platform, including features such as case management,SIEM Query.", + "description": "A comprehensive toolkit for operating the ASP platform.", "source": "./PLUGINS/ClaudeCode", "category": "cybersecurity", "homepage": "https://github.com/FunnyWolf/agentic-soc-platform/tree/master/PLUGINS/ClaudeCode" diff --git a/PLUGINS/Dify/CONFIG.example.py b/PLUGINS/Dify/CONFIG.example.py deleted file mode 100644 index 32adc5c..0000000 --- a/PLUGINS/Dify/CONFIG.example.py +++ /dev/null @@ -1,18 +0,0 @@ -# Dify 插件文档地址: https://asp.viperrtp.com/zh/asf/PLUGINS/Dify/ -# Dify Doc: https://asp.viperrtp.com/asf/PLUGINS/Dify/ - -# Dify API接口 -DIFY_BASE_URL = "http://192.168.241.128/v1" - -# Dify 代理设置,如可直接访问DIFY_BASE_URL则设置为None -# 支持代理格式 -# HTTP: http://192.168.1.100:3128 -# HTTP带认证: http://user:pass@192.168.1.100:3128 -# SOCKS5: socks5://192.168.1.100:1080 -# SOCKS5带认证: socks5://user:pass@192.168.1.100:1080 -DIFY_PROXY = None - -# Dify 应用API Key配置 -DIFY_API_KEY = { - "ES-Rule-22-Phishing_user_report_mail": "app-6SY7rpP4BqnKqRgJjOrITCEn" -} diff --git a/PLUGINS/Dify/Sentinel.yml b/PLUGINS/Dify/Sentinel.yml deleted file mode 100644 index 12608e6..0000000 --- a/PLUGINS/Dify/Sentinel.yml +++ /dev/null @@ -1,151 +0,0 @@ -app: - description: '' - icon: 🤖 - icon_background: '#FFEAD5' - mode: agent-chat - name: Sentinel - use_icon_as_answer_icon: false -dependencies: -- current_identifier: null - type: package - value: - plugin_unique_identifier: langgenius/tongyi:0.1.0@a2dd9bb656a2722292e8936f3287d53ba176cfbbe9b8bfafc596d4a2ddd99eb2 - version: null -kind: app -model_config: - agent_mode: - enabled: true - max_iteration: 10 - prompt: null - strategy: function_call - tools: - - enabled: false - isDeleted: false - notAuthor: false - provider_id: sirp_new - provider_name: SIRP - provider_type: mcp - tool_label: function_call_debug - tool_name: function_call_debug - tool_parameters: - magic_num: '' - - enabled: true - isDeleted: false - notAuthor: false - provider_id: sirp_new - provider_name: SIRP - provider_type: mcp - tool_label: get_case_by_rowid - tool_name: get_case_by_rowid - tool_parameters: - case_id: '' - annotation_reply: - enabled: false - chat_prompt_config: - prompt: - - role: system - text: '' - completion_prompt_config: - conversation_histories_role: - assistant_prefix: '' - user_prefix: '' - prompt: - text: '' - dataset_configs: - datasets: - datasets: [] - retrieval_model: multiple - top_k: 4 - dataset_query_variable: '' - external_data_tools: [] - file_upload: - allowed_file_extensions: - - .JPG - - .JPEG - - .PNG - - .GIF - - .WEBP - - .SVG - - .MP4 - - .MOV - - .MPEG - - .WEBM - allowed_file_types: [] - allowed_file_upload_methods: - - remote_url - - local_file - enabled: false - image: - detail: high - enabled: false - number_limits: 3 - transfer_methods: - - remote_url - - local_file - number_limits: 3 - model: - completion_params: - stop: [] - mode: chat - name: qwen3-max - provider: langgenius/tongyi/tongyi - more_like_this: - enabled: false - opening_statement: '' - pre_prompt: "# Role & Identity\n你是一个嵌入在安全编排自动化与响应 (SOAR) 平台中的**专家级安全运营 Copilot**.你的代号是\ - \ \"Sentinel\".\n你的核心职责是作为人类分析师的**认知增强器 (Cognitive Multiplier)**,利用 MCP (Model\ - \ Context Protocol) 动态调用外部安全工具,高效完成威胁检测 (Detection)、事件调查 (Investigation) 和响应处置\ - \ (Response) 的闭环.\n\n你的思维模型必须完全模拟一名**高级安全分析师**：主动、严谨、基于证据、风险敏感.\n\n---\n\n# 1.\ - \ Dynamic Tool Utilization Strategy (核心机制：动态工具发现)\n你并不依赖硬编码的工具名称.在处理每个请求时,你必须实时检查\ - \ MCP 上下文提供的工具列表,并遵循以下逻辑：\n\n1. **工具自省 (Tool Introspection):** 仔细阅读每个工具的 `name`\ - \ 和 `description`.\n2. **语义映射 (Semantic Mapping):** 根据用户的意图寻找具备相应**能力**的工具：\n\ - \ * *验证/情报:* 寻找关键词 `reputation`, `enrich`, `lookup`, `intelligence`, `virustotal`,\ - \ `threat`.\n * *调查/日志:* 寻找关键词 `search`, `query`, `log`, `splunk`, `elastic`,\ - \ `history`.\n * *响应/处置:* 寻找关键词 `block`, `isolate`, `quarantine`, `ticket`,\ - \ `firewall`, `email`.\n3. **参数推断:** 严格根据 Schema 提取参数.如果缺少必要参数(如 IP 或 时间范围),**主动向用户询问**,绝不猜测.\n\ - 4. **优雅降级 (Graceful Degradation):** 如果当前环境没有适合的工具,请明确告知用户：“当前未检测到具备[某功能]的工具,建议手动检查...”,严禁捏造工具调用.\n\ - \n---\n\n# 2. Operational Workflow (标准作业流程)\n在收到任何输入(警报文本、JSON 日志或自然语言指令)时,必须严格执行以下三个阶段：\n\ - \n## Phase 1: Triage & Context Extraction (分类与自动提取)\n- **自动提取 IOC:** 无论用户是否明确要求,立即从输入中识别并提取关键实体\ - \ (IOCs)：IP、域名、URL、Hash、用户名、主机名.\n- **信誉验证:** 优先调用情报类工具查询这些 IOC 的威胁信誉.\n- **目标:**\ - \ 快速判断这是误报 (False Positive) 还是真实威胁 (True Positive).\n\n## Phase 2: Deep Investigation\ - \ (深度调查)\n- **上下文关联:** 不要孤立看待警报.尝试调用查询工具搜索该实体在警报前后 (例如 +/- 15分钟) 的关联日志.\n- **框架映射:**\ - \ 始终尝试将观察到的攻击行为映射到 **MITRE ATT&CK** 框架的战术 (Tactics) 和技术 (Techniques).(例如: *映射到\ - \ T1110 - Brute Force*).\n- **时间轴构建:** 将分散的证据按时间顺序排列,还原攻击路径.\n\n## Phase 3: Response\ - \ & Remediation (响应与处置)\n- **风险评估:** 在建议处置之前,评估受影响资产的重要性(如核心数据库 vs 访客 Wi-Fi).\n\ - - **处置建议:** 基于证据提出具体的行动方案(如“封禁 IP”、“隔离主机”).如果 MCP 具备响应工具,准备好调用参数.\n\n---\n\n#\ - \ 3. Safety Guardrails (安全护栏)\n1. **No Hallucinations (零幻觉):** 严禁编造日志内容、IP 地址或工具返回结果.一切分析必须基于工具返回的真实数据.\n\ - 2. **Human-in-the-Loop (人机回环):** 对于具有破坏性或阻断性的操作 (Write Actions),如“修改防火墙策略”、“隔离服务器”,除非用户明确授权或置信度极高,否则**必须优先输出建议**,请求用户确认,而不是直接执行.\n\ - 3. **Privacy Aware:** 处理敏感数据 (PII) 时保持克制,仅提取分析必要的信息.\n\n---\n\n# 4. Output Standards\ - \ (输出规范)\n为了提升分析师效率,你的输出必须结构化、清晰且专业：\n\n1. **摘要 (Executive Summary):** 开头用一句话总结事件性质和风险等级\ - \ (Critical/High/Medium/Low).\n2. **数据可视化:** 涉及多个 IOC 或对比信息时,**必须使用 Markdown\ - \ 表格**.\n * *Example Table Columns:* `Entity | Type | Reputation Score | Geo-Location\ - \ | Associated User`\n3. **证据引用:** 任何结论后必须简要标注来源.*(e.g., \"IP 恶意置信度 90% [Source:\ - \ VirusTotal]\")*\n4. **下一步建议 (Actionable Next Steps):** 在回复的最后,提供 2-3 个明确的后续操作选项.这可以帮助\ - \ SOAR 前端渲染快捷按钮.\n\n---\n\n# 5. Tone & Style\n- **专业 (Professional):** 使用标准的网络安全术语\ - \ (C2, Lateral Movement, Exfiltration, Beaconing).\n- **客观 (Objective):** 区分“事实”与“推测”.\n\ - - **简洁 (Concise):** 避免啰嗦的寒暄,直接切入重点.\n\n---\n\n# Example Scenario (Few-Shot Thinking)\n\ - *User:* \"分析警报：主机 192.168.1.50 尝试连接恶意域名 bad-site.com\"\n*Your Thought Process:*\n\ - 1. *Extract:* IOCs -> IP: 192.168.1.50 (Internal), Domain: bad-site.com (External).\n\ - 2. *Tool:* Find threat intel tool -> Check 'bad-site.com'. (Result: Malware C2).\n\ - 3. *Tool:* Find SIEM query tool -> Search 192.168.1.50 traffic history. (Result:\ - \ 500MB upload).\n4. *Analyze:* Confirmed C2 communication with Data Exfiltration.\ - \ Map to T1048.\n5. *Response:* Draft response suggesting isolation of 192.168.1.50\ - \ immediately." - prompt_type: simple - retriever_resource: - enabled: true - sensitive_word_avoidance: - configs: [] - enabled: false - type: '' - speech_to_text: - enabled: false - suggested_questions: [] - suggested_questions_after_answer: - enabled: false - text_to_speech: - enabled: false - language: '' - voice: '' - user_input_form: [] -version: 0.5.0 diff --git a/PLUGINS/Dify/__init__.py b/PLUGINS/Dify/__init__.py deleted file mode 100644 index e69de29..0000000 diff --git a/PLUGINS/Dify/dify.py b/PLUGINS/Dify/dify.py deleted file mode 100644 index 80ce7b3..0000000 --- a/PLUGINS/Dify/dify.py +++ /dev/null @@ -1,52 +0,0 @@ -from typing import Dict, Any - -import requests - -from Lib.log import logger -from PLUGINS.Dify.CONFIG import DIFY_BASE_URL, DIFY_PROXY, DIFY_API_KEY - -requests.packages.urllib3.disable_warnings() - - -class Dify(object): - def __init__(self): - self.base_url = DIFY_BASE_URL - - def run_workflow(self, api_key: str, inputs: Dict[str, Any], user: str = "default_user") -> Dict[str, Any]: - url = f"{self.base_url}/workflows/run" - headers = { - "Authorization": f"Bearer {api_key}", - } - payload = { - "inputs": inputs, - "response_mode": "blocking", - "user": user - } - proxies = None - if DIFY_PROXY: - proxies = { - "http": DIFY_PROXY, - "https": DIFY_PROXY, - } - try: - response = requests.post(url, - headers=headers, - json=payload, - proxies=proxies, - ) - response.raise_for_status() - - response_data = response.json() - logger.debug(f"Dify API response: {response_data}") - - data = response_data.get("data", {}) - if data and data.get("status") == "succeeded": - outputs = data.get("outputs") - return outputs - else: - return {} - except Exception as e: - raise - - def get_dify_api_key(self, app_name=None): - return DIFY_API_KEY.get(app_name)