The Fine Print

from crewai import Agent, Task, Crew, Process
from langchain_openai import ChatOpenAI
llm = ChatOpenAI(model="gpt-4-turbo", temperature=0)
regex_agent = Agent(
    role='RegEx Engineer',
    goal='Analyze unstructured log lines and create a robust Python regex pattern with named capture groups.',
    backstory='A wizard at pattern matching who anticipates edge cases in string structures.',
    verbose=True,
    llm=llm
)
schema_agent = Agent(
    role='ECS Schema Architect',
    goal='Map the named capture groups from the regex to the Elastic Common Schema (ECS) standard.',
    backstory='Strict data governance expert who knows the ECS documentation by heart.',
    verbose=True,
    llm=llm
)
qa_agent = Agent(
    role='Data Quality Engineer',
    goal='Test the regex and schema mapping against sample logs to ensure it works without errors.',
    backstory='Meticulous tester who breaks brittle parsers before they reach production.',
    verbose=True,
    llm=llm
)
raw_logs = """
[2026-11-05 10:15:32] INFO - User admin@corp.local successfully authenticated from IP 192.168.1.50 using App: MyApp_v2.1
[2026-11-05 10:17:10] WARN - User guest@corp.local failed authentication from IP 10.0.0.5 using App: MyApp_v2.1
"""
regex_task = Task(
    description=f'Create a single Python RegEx string with named capture groups to extract the Timestamp, Log Level, User, IP Address, and App Name from these logs: {raw_logs}',
    expected_output='A Python RegEx string.',
    agent=regex_agent
)
schema_task = Task(
    description='Take the RegEx output and map each named group to its exact ECS equivalent (e.g., source.ip, user.email).',
    expected_output='A JSON dictionary mapping regex group names to ECS field names.',
    agent=schema_agent,
    context=[regex_task]
)
qa_task = Task(
    description='Review the regex and ECS mapping. Verify conceptually that the regex will capture both the INFO and WARN logs perfectly. Output a final, validated SIEM parser configuration.',
    expected_output='A final deployment-ready parser configuration document.',
    agent=qa_agent,
    context=[regex_task, schema_task]
)
siem_swarm = Crew(
    agents=[regex_agent, schema_agent, qa_agent],
    tasks=[regex_task, schema_task, qa_task],
    process=Process.sequential
)
if __name__ == "__main__":
    print("Initiating SIEM Parsing Swarm...")
    parser_config = siem_swarm.kickoff()
    print("\n--- Final SIEM Parser Configuration ---\n")
    print(parser_config)