Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

add more streams

Browse Source
This commit is contained in:
larssand
2026-06-22 19:09:25 +02:00
parent f99e699da6
commit a5489d3c87
6 changed files with 115 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

13
src/fgai/llm.py
View File

@@ -16,7 +16,7 @@ def ollama_summary(
timeout: int | None = None,
) -> str:
host = os.getenv("OLLAMA_HOST", "http://127.0.0.1:11434").rstrip("/")
selected_model = model or os.getenv("OLLAMA_MODEL", "llama3.3")
selected_model = model or os.getenv("OLLAMA_MODEL", "llama3.1")
selected_timeout = timeout or int(os.getenv("OLLAMA_TIMEOUT", "180"))
prompt = {
"analysis": analysis or {},
@@ -35,8 +35,8 @@ def ollama_summary(
"temperature": 0.2,
},
"prompt": (
"You are a local FortiGate security analyst. Summarize these policy findings "
"and log diagnostics. Be concise. Include risk, likely cause, and next action. "
"You are a local security operations analyst. Analyze normalized events from one or more log sources. "
"Be concise. Include risk, likely cause, affected entities, evidence, and next action. "
"Do not recommend blocking private/internal client IPs unless the data explicitly proves compromise. "
f"Data: {json.dumps(prompt)}"
),
@@ -56,6 +56,9 @@ def ollama_dashboard_assessment(analysis: dict[str, object], model: str | None =
"top_recommendations": analysis.get("recommendations", [])[:5],
"block_candidates": analysis.get("block_candidates", [])[:5],
"policy_findings": analysis.get("policy_findings", [])[:5],
"event_context": analysis.get("event_context", {}),
"diagnostics": analysis.get("diagnostics", {}),
"capabilities": analysis.get("capabilities", {}),
}
return ollama_summary(
[],
@@ -63,8 +66,8 @@ def ollama_dashboard_assessment(analysis: dict[str, object], model: str | None =
model,
analysis={
"task": (
"Write a concise dashboard analyst note for a FortiGate admin. "
"Explain likely cause, whether this looks malicious or noisy, and the next action. "
"Write a concise dashboard analyst note. Compare activity across every listed entity, "
"identify the most unusual entity or behavior, and state the next investigation step. "
"Mention policyid=0 as implicit deny/drop, not an editable policy."
),
"data": compact,