diff --git a/AGENTS/agent_threat_intelligence.py b/AGENTS/agent_threat_intelligence.py index 5b4dcc6..e46ea20 100644 --- a/AGENTS/agent_threat_intelligence.py +++ b/AGENTS/agent_threat_intelligence.py @@ -127,17 +127,3 @@ class GraphAgent(LanggraphPlaybook): result = final_state['messages'][-1].content logger.info(f"Query result extracted, result length: {len(result)} characters") return result - - -# Test code -if __name__ == "__main__": - import os - import django - - os.environ.setdefault("DJANGO_SETTINGS_MODULE", "ASP.settings") - django.setup() - - print("\n--- Using create_agent for Query ---") - test_query = "最近5分钟192.168.1.150使用ssh访问了哪些内网主机?" - result_simple = AgentThreatIntelligence.threat_intelligence_lookup("ip", "66.240.205.34") - print(result_simple) diff --git a/DATA/Indexes/siem-aws-cloudtrail.yaml b/DATA/Plugin_SIEM_Indexes/siem-aws-cloudtrail.yaml similarity index 100% rename from DATA/Indexes/siem-aws-cloudtrail.yaml rename to DATA/Plugin_SIEM_Indexes/siem-aws-cloudtrail.yaml diff --git a/DATA/Indexes/siem-host-events.yaml b/DATA/Plugin_SIEM_Indexes/siem-host-events.yaml similarity index 100% rename from DATA/Indexes/siem-host-events.yaml rename to DATA/Plugin_SIEM_Indexes/siem-host-events.yaml diff --git a/DATA/Indexes/siem-network-traffic.yaml b/DATA/Plugin_SIEM_Indexes/siem-network-traffic.yaml similarity index 100% rename from DATA/Indexes/siem-network-traffic.yaml rename to DATA/Plugin_SIEM_Indexes/siem-network-traffic.yaml diff --git a/PLUGINS/SIEM/readme.md b/PLUGINS/SIEM/readme.md new file mode 100644 index 0000000..e69de29 diff --git a/PLUGINS/SIEM/registry.py b/PLUGINS/SIEM/registry.py index e06db26..2bbf054 100644 --- a/PLUGINS/SIEM/registry.py +++ b/PLUGINS/SIEM/registry.py @@ -28,7 +28,7 @@ def _load_yaml_configs() -> Dict[str, IndexInfo]: script_path = Path(__file__).resolve() project_root = script_path.parents[2] - indexs_dir = project_root / "DATA" / "Indexes" + indexs_dir = project_root / "DATA" / "Plugin_SIEM_Indexes" if not indexs_dir.exists(): return registry diff --git a/PLUGINS/SIRP/sirpmodel.py b/PLUGINS/SIRP/sirpmodel.py index ffcef7a..1b8341e 100644 --- a/PLUGINS/SIRP/sirpmodel.py +++ b/PLUGINS/SIRP/sirpmodel.py @@ -274,13 +274,13 @@ class CasePriority(StrEnum): class CaseStatus(StrEnum): - UNKNOWN = "Unknown" + # UNKNOWN = "Unknown" NEW = "New" IN_PROGRESS = "In Progress" ON_HOLD = "On Hold" RESOLVED = "Resolved" CLOSED = "Closed" - OTHER = "Other" + # OTHER = "Other" class CaseVerdict(StrEnum):