The Fine Print

from crewai import Agent, Task, Crew
from langchain_openai import ChatOpenAI
llm = ChatOpenAI(model="gpt-4-turbo", temperature=0)
ttp_agent = Agent(
    role='TTP Mapper',
    goal='Map unstructured incident reports to specific MITRE ATT&CK techniques.',
    backstory='Expert at dissecting malware behavior and mapping it to standard frameworks.',
    verbose=True,
    llm=llm
)
infra_agent = Agent(
    role='Infrastructure Analyst',
    goal='Analyze IPs, domains, and ASN data to find historical overlap with known threat actors.',
    backstory='You find the hidden connections in WHOIS data and BGP routing.',
    verbose=True,
    llm=llm
)
attribution_agent = Agent(
    role='Lead CTI Analyst',
    goal='Synthesize TTP and Infrastructure data to attribute the attack to a known APT group, providing a confidence score.',
    backstory='Senior intelligence officer who requires hard evidence before pointing fingers.',
    verbose=True,
    llm=llm
)
incident_report = """
The attackers gained access via a spear-phishing email containing an LNK file. 
Once executed, it dropped a custom loader that communicated with 45.33.32.156. 
They then used WMI for lateral movement and staged data in a RAR archive.
"""
ttp_task = Task(
    description=f'Extract MITRE ATT&CK techniques from this report: {incident_report}',
    expected_output='List of MITRE Technique IDs and names.',
    agent=ttp_agent
)
infra_task = Task(
    description=f'Analyze the infrastructure mentioned in the report: {incident_report}',
    expected_output='Assessment of the IP addresses and domains.',
    agent=infra_agent
)
attribution_task = Task(
    description='Using the TTP and Infrastructure data, determine the most likely APT group. You MUST provide a High, Medium, or Low confidence score with justification.',
    expected_output='Attribution report with confidence score.',
    agent=attribution_agent,
    context=[ttp_task, infra_task]
)
cti_swarm = Crew(
    agents=[ttp_agent, infra_agent, attribution_agent],
    tasks=[ttp_task, infra_task, attribution_task]
)
if __name__ == "__main__":
    print("Initiating Attribution Swarm...")
    intel_report = cti_swarm.kickoff()
    print("\n--- Threat Intelligence Report ---\n")
    print(intel_report)