Public/fgAI
SHA256
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

ad VS

Browse Source
This commit is contained in:
larssand
2026-06-18 22:51:54 +02:00
parent 5650973e50
commit f7611ef2b3
8 changed files with 374 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

50
src/fgai/cli.py
View File

@@ -11,8 +11,10 @@ from .llm import ollama_summary
from .logs import local_in_failures, read_events, summarize_events, top_field_values
from .mitigation import FortiGateClient, parse_allowlist, suggest_block_candidates
from .policies import audit_policies, read_policies
from .recommendations import build_recommendations
from .syslog_server import listen_udp_syslog
from .monitor import monitor_loop
from .threat_intel import enrich_ips, is_public_ip
def _print_json(data: object) -> None:
@@ -119,6 +121,43 @@ def detect_anomalies(args: argparse.Namespace) -> int:
return 0
def recommend(args: argparse.Namespace) -> int:
events = read_events(args.logs)
anomalies = detect_source_anomalies(events, limit=args.limit)
intel_ips = sorted(
{
ip
for event in events
for ip in (event.src_ip, event.dst_ip)
if is_public_ip(ip)
}
)
reputation = enrich_ips(intel_ips, limit=args.intel_limit) if args.threat_intel else {}
recommendations = build_recommendations(events, anomalies, reputation)
output = {
"recommendations": [
{
"subject": item.subject,
"score": item.score,
"severity": item.severity,
"title": item.title,
"recommendation": item.recommendation,
"reasons": item.reasons,
"related_policy_ids": item.related_policy_ids,
"related_services": item.related_services,
}
for item in recommendations
if item.score >= args.min_score
],
"reputation": reputation,
}
_print_json(output)
if args.llm:
print("\nLLM summary:")
print(ollama_summary([], [], args.model, analysis=output, timeout=args.llm_timeout))
return 0
def test_connection(args: argparse.Namespace) -> int:
client = FortiGateClient.from_env()
status = client.system_status()
@@ -186,6 +225,17 @@ def build_parser() -> argparse.ArgumentParser:
anomalies.add_argument("--llm-timeout", type=int, default=None, help="Ollama request timeout in seconds")
anomalies.set_defaults(func=detect_anomalies)
recommendations = subparsers.add_parser("recommend", help="Generate policy and response recommendations from anomalies")
recommendations.add_argument("--logs", required=True, help="Path to syslog JSONL or key/value log file")
recommendations.add_argument("--limit", type=int, default=20, help="Maximum anomaly findings to evaluate")
recommendations.add_argument("--min-score", type=int, default=35, help="Minimum recommendation score to output")
recommendations.add_argument("--threat-intel", action="store_true", help="Use enabled external threat intelligence lookups")
recommendations.add_argument("--intel-limit", type=int, default=25, help="Maximum public IPs to enrich")
recommendations.add_argument("--llm", action="store_true", help="Ask local Ollama to summarize results")
recommendations.add_argument("--model", default=None, help="Ollama model name")
recommendations.add_argument("--llm-timeout", type=int, default=None, help="Ollama request timeout in seconds")
recommendations.set_defaults(func=recommend)
policies = subparsers.add_parser("audit-policies", help="Audit FortiOS firewall policy config")
policies.add_argument("--config", required=True, help="Path to FortiOS config backup")
policies.add_argument("--llm", action="store_true", help="Ask local Ollama to summarize results")