How kh4nh709/ai_support_soc_1_2 works
AI Support SOC là ứng dụng hỗ trợ analyst xử lý alert Wazuh qua Tier 1 và Tier 2; LLM đề xuất, con người quyết định. Luồng chính đi từ tiếp nhận, chuẩn hóa, loại trùng, enrichment và chấm rủi ro tới hàng đợi, triage, bàn giao case, điều tra và kết luận. Sơ đồ cũng thể hiện các nhánh xác thực, bảo vệ prompt và audit. README mô tả một số năng lực chưa có excerpt nguồn tương ứng; các liên kết của chúng chỉ phản ánh luồng được tài liệu nêu, không suy diễn chi tiết triển khai.
Main entry points: pipeline.py Alert pipeline · db.py Application database · triage.py LLM triage · investigate.py Tier 2 investigation
Components 25
Tiếp nhận alert
- Webhook intake
backend/app/web/routers/webhook.py - Intake service
backend/app/infra/intake.py - Wazuh parser
backend/app/ingest/wazuh_parser.py
Xử lý tự động
- Alert pipeline
backend/app/soar/pipeline.py - Deduplication
backend/app/ingest/dedup.py - Context enrichment
backend/app/enrichment/lookups.py - Risk scoring
backend/app/soar/risk.py - Alert transitions
backend/app/domain/transitions.py
Workflow analyst
- Tier 1 queue
backend/app/tier1/queue.py - LLM triage
backend/app/tier1/triage.py - Tier 1 decision
backend/app/tier1/decide.py - Tier 2 investigation
backend/app/tier2/investigate.py - Tier 2 conclusion
backend/app/tier2/conclude.py
LLM và an toàn
- LLM adapter
backend/app/llm/adapter.py - Prompt builder
llm/prompt_builder.py - Prompt safeguards
backend/app/security/wrap.py - LLM run audit
backend/app/audit/llm_runs.py
Web và nền tảng
- Worker composition
backend/app/web/worker.py - Job worker
backend/app/infra/worker.py - Web application
backend/app/web/main.py - Auth routes
backend/app/web/routers/auth.py - Authentication
backend/app/infra/auth.py - Application database
backend/app/infra/db.py
Other components
- Wazuh
- SOC analyst
Connections 30
- Wazuh → Webhook intake: sends alerts
- Webhook intake → Intake service: passes payload
- Intake service → Application database: records intake
- Worker composition → Job worker: runs handlers
- Worker composition → Alert pipeline: registers handler
- Job worker → Alert pipeline: dispatches job
- Alert pipeline → Application database: reads intake
- Alert pipeline → Wazuh parser: parses alert
- Alert pipeline → Deduplication: checks cluster
- Alert pipeline → Context enrichment: builds context
- Alert pipeline → Risk scoring: scores alert
- Alert pipeline → Alert transitions: writes transitions
- Alert pipeline → Application database: writes outcomes
- Alert transitions → Application database: persists state
- Alert pipeline → Tier 1 queue: queues triage
- Tier 1 queue → LLM triage: provides queued alert
- LLM triage → Prompt builder: builds prompt
- Prompt builder → Prompt safeguards: wraps untrusted data
- LLM triage → LLM adapter: requests proposal
- LLM triage → LLM run audit: records model run
- Tier 1 decision → Tier 2 investigation: escalates case
- Tier 2 investigation → Prompt builder: builds prompt
- Tier 2 investigation → LLM adapter: requests assistance
- Tier 2 investigation → Tier 2 conclusion: submits findings
- SOC analyst → Tier 1 decision: decides triage
- SOC analyst → Tier 2 conclusion: reviews conclusion
- Web application → Auth routes: mounts routes
- Auth routes → Authentication: authenticates
- Auth routes → Application database: uses connection
- Authentication → Application database: checks user state