The Fine Print

from typing import List
from pydantic import BaseModel, Field
from langchain_openai import ChatOpenAI
class PlaybookStep(BaseModel):
    step_number: int
    action_name: str = Field(description="Target API action, e.g., ISOLATE_HOST, REVOKE_TOKEN")
    target_entity: str = Field(description="Target IP, User, Hostname, or FileHash")
    justification: str = Field(description="Why this step is required based on attack phase")
class DynamicPlaybook(BaseModel):
    incident_id: str
    playbook_name: str
    mitre_technique: str
    execution_sequence: List[PlaybookStep]
def synthesize_playbook(incident_id: str, incident_summary: str, available_actions: List[str]) -> DynamicPlaybook:
    llm = ChatOpenAI(model="gpt-4o", temperature=0)
    structured_llm = llm.with_structured_output(DynamicPlaybook)
    prompt = f"""
Construct an executable SOAR playbook for Incident {incident_id}.
Incident Summary: {incident_summary}
Available SOAR API Integrations: {available_actions}
Map out precise, sequential containment steps.
"""
    return structured_llm.invoke(prompt)
if __name__ == "__main__":
    actions = ["AWS_DISABLE_IAM_KEY", "CROWDSTRIKE_CONTAIN_HO ST", "PAN_BLOCK_IP", "OKTA_EXPIRE_SESSION"]
    summary = "Attacker compromised IAM user 'dev_service_acct' via leaked API key from IP 198.51.100.45 and attempted to launch EC2 instances."
    playbook = synthesize_playbook("INC-8821", summary, actions)
    print(f"Generated Playbook: {playbook.playbook_name} (ATT&CK: {playbook.mitre_technique})\n")
    for step in playbook.execution_sequence:
        print(f"Step {step.step_number}: [{step.action_name}] on '{step.target_entity}' -> {step.justification}")