|
| 1 | +package configurations |
| 2 | + |
| 3 | +import ( |
| 4 | + "path/filepath" |
| 5 | + |
| 6 | + "github.com/utmstack/soc-ai/utils" |
| 7 | +) |
| 8 | + |
| 9 | +const ( |
| 10 | + SOC_AI_SERVER_PORT = "8080" |
| 11 | + SOC_AI_SERVER_ENDPOINT = "/process" |
| 12 | + API_ALERT_ENDPOINT = "/api/elasticsearch/search" |
| 13 | + API_ALERT_STATUS_ENDPOINT = "/api/utm-alerts/status" |
| 14 | + API_INCIDENT_ENDPOINT = "/api/utm-incidents" |
| 15 | + API_INCIDENT_ADD_NEW_ALERT_ENDPOINT = "/api/utm-incidents/add-alerts" |
| 16 | + API_ALERT_COMPLETED_STATUS_CODE = 5 |
| 17 | + API_ALERT_INFO_PARAMS = "?page=0&size=25&top=10000&indexPattern=" |
| 18 | + ELASTIC_DOC_ENDPOINT = "/_doc/" |
| 19 | + ELASTIC_UPDATE_BY_QUERY_ENDPOINT = "/_update_by_query" |
| 20 | + ALERT_INDEX_PATTERN = "alert-*" |
| 21 | + LOGS_INDEX_PATTERN = "log-*" |
| 22 | + SOC_AI_INDEX = "soc-ai" |
| 23 | + GPT_API_ENDPOINT = "https://api.openai.com/v1/chat/completions" |
| 24 | + TIME_FOR_GET_CONFIG = 10 |
| 25 | + CLEANER_DELAY = 10 |
| 26 | + MAX_ATTEMPS_TO_GPT = 3 |
| 27 | + GPT_RESPONSE_TOKENS = 10 |
| 28 | + HTTP_GPT_TIMEOUT = 90 |
| 29 | + HTTP_TIMEOUT = 30 |
| 30 | + LOGS_SEPARATOR = "[utm-logs-separator]" |
| 31 | +) |
| 32 | + |
| 33 | +var ( |
| 34 | + AllowedGPTModels = map[string]int{ |
| 35 | + "gpt-4.1": 1047576, |
| 36 | + "gpt-4.1-mini": 1047576, |
| 37 | + "gpt-4.1-nano": 1047576, |
| 38 | + "gpt-4o": 128000, |
| 39 | + "gpt-4o-mini": 128000, |
| 40 | + "gpt-4-turbo": 128000, |
| 41 | + "gpt-4-0614": 8192, |
| 42 | + "gpt-4-0125-preview": 128000, |
| 43 | + "gpt-3.5-turbo": 16385, |
| 44 | + "gpt-3.5-turbo-instruct": 4096, |
| 45 | + "gpt-3.5-turbo-1106": 16385, |
| 46 | + "o1": 200000, |
| 47 | + "o1-pro": 200000, |
| 48 | + "o3": 200000, |
| 49 | + "o3-mini": 200000, |
| 50 | + "o4-mini": 200000, |
| 51 | + // "gpt-4-0314": 8192, // Removed 2024-06-13 |
| 52 | + // "gpt-4-1106-preview": 128000, // Removed 2024-12-06 |
| 53 | + } |
| 54 | +) |
| 55 | + |
| 56 | +type SensitivePattern struct { |
| 57 | + Regexp string |
| 58 | + FakeValue string |
| 59 | +} |
| 60 | + |
| 61 | +var ( |
| 62 | + SensitivePatterns = map[string]SensitivePattern{ |
| 63 | + "email": { Regexp: `([a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,})`, FakeValue: "[email protected]"}, |
| 64 | + //"ipv4": `(?:(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.){3}(?:25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)`, |
| 65 | + } |
| 66 | + GPT_INSTRUCTION = "You are an expert security engineer. Perform a deep analysis of an alert created by a SIEM and the logs related to it. Determine if the alert could be an actual potential threat or not and explain why. Provide a description that shows a deep understanding of the alert based on a deep analysis of its logs and estimate the risk to the systems affected. Classify the alert in the following manner: if the alert information is sufficient to determine that the security, availability, confidentiality, or integrity of the systems has being compromised, then classify it as \"possible incident\". If the alert does not pose a security risk to the organization or has no security relevance, classify it as \"possible false positive\". If the alert does not pose an imminent risk to the systems, requires no urgent action from an administrator, or requires not urgent review by an administrator, it should be classified as a \"standard alert\". You will also provide context-specific instructions for remediation, mitigation, or further investigation, related to the alert and logs analyzed. Your answer should be provided using the following JSON format and the total number of characters in your answer must not exceed 1500 words. Your entire answer must be inside this json format. {\"activity_id\":\"<activity_id>\",\"classification\":\"<classification>\",\"reasoning\":[\"<deep_reasoning>\"],\"nextSteps\":[{\"step\":1,\"action\":\"<action_1>\",\"details\":\"<action_1_details>\"},{\"step\":2,\"action\":\"<action_2>\",\"details\":\"<action_2_details>\"},{\"step\":3,\"action\":\"<action_3>\"]}Ensure that your entire answer adheres to the provided JSON format. The response should be valid JSON syntax and schema." |
| 67 | + GPT_FALSE_POSITIVE = "This alert is categorized as a potential false positive due to two key factors. Firstly, it originates from an automated system, which may occasionally produce alerts without direct human validation. Additionally, the absence of any correlated logs further raises suspicion, as a genuine incident typically leaves a trail of relevant log entries. Hence, the combination of its system-generated nature and the lack of associated logs suggests a likelihood of being a false positive rather than a genuine security incident." |
| 68 | +) |
| 69 | + |
| 70 | +func GetInternalKey() string { |
| 71 | + return utils.Getenv("INTERNAL_KEY", true) |
| 72 | +} |
| 73 | + |
| 74 | +func GetPanelServiceName() string { |
| 75 | + return utils.Getenv("PANEL_SERV_NAME", true) |
| 76 | +} |
| 77 | + |
| 78 | +func GetOpenSearchHost() string { |
| 79 | + return "http://" + utils.Getenv("OPENSEARCH_HOST", true) |
| 80 | +} |
| 81 | + |
| 82 | +func GetOpenSearchPort() string { |
| 83 | + return utils.Getenv("OPENSEARCH_PORT", true) |
| 84 | +} |
| 85 | + |
| 86 | +func GetAlertsDBPath() string { |
| 87 | + path, _ := utils.GetMyPath() |
| 88 | + return filepath.Join(path, "database", "alerts.sqlite3") |
| 89 | +} |
0 commit comments