ad VS

README.md

@@ -58,6 +58,20 @@ fgai detect-anomalies --logs logs/fg_syslog.jsonl --min-score 35
 fgai detect-anomalies --logs logs/fg_syslog.jsonl --min-score 35 --llm --llm-timeout 300
 ```
 
+Generate response and policy recommendations:
+
+```bash
+fgai recommend --logs logs/fg_syslog.jsonl --min-score 35
+```
+
+Optional external reputation enrichment is disabled by default. To use VirusTotal for public source/destination IP reputation:
+
+```bash
+export FGAI_THREAT_INTEL=1
+export VIRUSTOTAL_API_KEY='...'
+fgai recommend --logs logs/fg_syslog.jsonl --min-score 35 --threat-intel
+```
+
 Listen for FortiGate syslog locally:
 
 ```bash
@@ -159,6 +173,8 @@ end
 - `OLLAMA_HOST`: defaults to `http://127.0.0.1:11434`.
 - `OLLAMA_MODEL`: defaults to `llama3.3`.
 - `OLLAMA_TIMEOUT`: Ollama request timeout in seconds, defaults to `180`.
+- `FGAI_THREAT_INTEL`: set to `1` to enable external threat intelligence lookups.
+- `VIRUSTOTAL_API_KEY`: VirusTotal API key for public IP reputation enrichment.
 
 ## Safety Model