External/agentic-soc-platform
1
0
Fork 0
mirror of https://github.com/FunnyWolf/agentic-soc-platform.git synced 2026-08-22 13:12:56 +02:00
Code Issues Packages Projects Releases Wiki Activity

tmp

Browse Source
This commit is contained in:
rookit
2026-05-13 17:55:56 +08:00
parent eeae622acd
commit ef0412f4b9
3 changed files with 10 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Lib/montior.py
+2 -2
View File
@@ -82,8 +82,8 @@ class MainMonitor(object):
# Start background tasks
self.start_background_task(self.subscribe_pending_playbook, "subscribe_pending_playbook", delay_time)
self.start_background_task(self.subscribe_case_analysis_scheduler, "subscribe_case_analysis_scheduler", delay_time)
self.start_background_task(self.subscribe_case_analysis_queue, "subscribe_case_analysis_queue", delay_time)
# self.start_background_task(self.subscribe_case_analysis_scheduler, "subscribe_case_analysis_scheduler", delay_time)
# self.start_background_task(self.subscribe_case_analysis_queue, "subscribe_case_analysis_queue", delay_time)
# engine
# self.engine.start()
MODULES/Cloud-01-AWS-IAM-Privilege-Escalation-via-AttachUserPolicy.py
+3 -3
View File
@@ -112,7 +112,7 @@ class Module(BaseModule):
correlation_uid = Correlation.generate_correlation_uid(
rule_id=self.module_name,
time_window="24h",
keys=[target_user, account_id],
keys=[principal_user, account_id],
timestamp=event_time_formatted
)
@@ -194,7 +194,7 @@ class Module(BaseModule):
else:
# 根据 Alert 计算 Case字段
new_case = CaseModel(
title=f"Potential IAM Privilege Escalation in Account {account_id} by {target_user}",
title=f"Potential IAM Privilege Escalation in Account {account_id} by {principal_user}",
severity=severity,
impact=Impact.HIGH if outcome == "success" else Impact.MEDIUM,
priority=CasePriority.HIGH if outcome == "success" else CasePriority.MEDIUM,
@@ -225,7 +225,7 @@ if __name__ == "__main__":
# 批量测试最早的100条告警
module = Module()
message_ids = module.read_stream_head_ids(100)
message_ids = module.read_stream_head_ids(10)
for message_id in message_ids:
module.debug_message_id = message_id
module.run()
PLUGINS/SIRP/sirpextramodel.py
+5 -4
View File
@@ -38,9 +38,9 @@ class PlaybookModel(BaseSystemModel):
json_schema_extra={"ai": [AI_PROFILE_MCP]})
source_row_id: Optional[str] = Field(default="", description="Trigger source row ID (触发源行 ID)",
json_schema_extra={"ai": [AI_PROFILE_MCP]})
source_id: Optional[str] = Field(default="",
description="Trigger source record ID e.g. case_000001(触发源记录 ID e.g. case_0000001)",
json_schema_extra={"ai": [AI_PROFILE_MCP]})
case_id: Optional[str] = Field(default="",
description="Trigger source record ID e.g. case_000001(触发源记录 ID e.g. case_0000001)",
json_schema_extra={"ai": [AI_PROFILE_MCP]})
name: Optional[str] = Field(default="", description="Executed playbook name (执行剧本名称)",
json_schema_extra={"ai": [AI_PROFILE_MCP]})
user_input: Optional[str] = Field(default="", description="Initial or follow-up user input (初始或后续用户输入)",
@@ -62,7 +62,8 @@ class KnowledgeModel(BaseSystemModel):
json_schema_extra={"ai": [AI_PROFILE_MCP]})
body: Optional[str] = Field(default="", description="Knowledge content (知识内容)",
json_schema_extra={"ai": [AI_PROFILE_MCP]})
expires_at: Optional[AutoDatetime] = Field(default=None, description="Knowledge expiration time; empty means permanently valid (知识过期时间，空表示永久有效)",
expires_at: Optional[AutoDatetime] = Field(default=None,
description="Knowledge expiration time; empty means permanently valid (知识过期时间，空表示永久有效)",
json_schema_extra={"ai": [AI_PROFILE_MCP]})
source: Optional[KnowledgeSource] = Field(default=None, description="Knowledge source (知识来源)",
json_schema_extra={"ai": [AI_PROFILE_MCP]})