The Fine Print

from typing import List
from pydantic import BaseModel, Field
from langchain_openai import ChatOpenAI
class TimelineEvent(BaseModel):
    timestamp_utc: str = Field(description="ISO8601 Timestamp")
    source: str = Field(description="EDR, Slack, CloudTrail, PagerDuty, etc.")
    summary: str = Field(description="Brief event summary")
class PostMortemReport(BaseModel):
    incident_title: str
    root_cause: str
    chronological_timeline: List[TimelineEvent]
    lessons_learned: List[str]
def generate_post_mortem(raw_logs: List[str]) -> PostMortemReport:
    llm = ChatOpenAI(model="gpt-4o", temperature=0)
    structured_llm = llm.with_structured_output(PostMortemReport)
    prompt = f"""
Synthesize an Incident Post-Mortem Report from these raw incident log entries:
{chr(10).join(raw_logs)}
Order events strictly chronologically.
"""
    return structured_llm.invoke(prompt)
if __name__ == "__main__":
    logs = [
        "[2026-03-31 10:14:02 UTC] EDR Alert: Suspicious credential dump process detected on host DB-PROD-01",
        "[2026-03-31 10:15:30 UTC] PagerDuty: High Severity Alert triggered - DB-PROD-01 compromise indicator",
        "[2026-03-31 10:18:00 UTC] Slack #sec-ops (Analyst Alice): Isolated DB-PROD-01 from network via CrowdStrike API",
        "[2026-03-31 10:25:00 UTC] Slack #sec-ops (Analyst Bob): Confirmed containment. Attacker utilized compromised service key."
    ]
    report = generate_post_mortem(logs)
    print(f"Incident Title: {report.incident_title}")
    print(f"Root Cause: {report.root_cause}\n")
    print("Chronological Timeline:")
    for event in report.chronological_timeline:
        print(f"  [{event.timestamp_utc}] ({event.source}): {event.summary}")
    print("\nLessons Learned:")
    for lesson in report.lessons_learned:
        print(f"  - {lesson}")