The Fine Print

import json
from typing import Literal
from pydantic import BaseModel, Field
from langchain_openai import ChatOpenAI
from langchain_core.prompts import ChatPromptTemplate
class TriageDecision(BaseModel):
    action: Literal["CLOSE_BENIGN", "ESCALATE_TIER2", "CONTAIN_IMMEDIATELY"] = Field(description="Triage action")
    risk_score: int = Field(description="Risk score between 0 and 100")
    reasoning: str = Field(description="Detailed triage reasoning based on enriched telemetry")
    recommended_playbook: str = Field(description="Name of standard playbook to execute if escalated")
def triage_alert(raw_alert: dict, asset_context: dict, threat_intel: dict) -> TriageDecision:
    llm = ChatOpenAI(model="gpt-4o", temperature=0)
    structured_llm = llm.with_structured_output(TriageDecision)
    prompt = ChatPromptTemplate.from_messages([
        ("system", "You are an expert Tier-1 SOC Lead Analyst. Analyze the incoming alert alongside asset context and threat intelligence. Make a deterministic triage decision."),
        ("human", "RAW ALERT:\n{alert}\n\nASSET CONTEXT:\n{asset}\n\nTHREAT INTEL:\n{intel}")
    ])
    chain = prompt | structured_llm
    return chain.invoke({
        "alert": json.dumps(raw_alert),
        "asset": json.dumps(asset_context),
        "intel": json.dumps(threat_intel)
    })
if __name__ == "__main__":
    sample_alert = {"alert_name": "Powershell Executed Base64 Encoded Command", "host": "WORKSTATION-99", "user": "jdoe", "process": "powershell.exe -e aW52b2tlLWV4cHJlc3Npb24="}
    sample_asset = {"host": "WORKSTATION-99", "owner": "John Doe", "role": "Financial Analyst", "criticality": "MEDIUM"}
    sample_intel = {"hash_reputation": "MALICIOUS", "threat_actor": "Unknown"}
    decision = triage_alert(sample_alert, sample_asset, sample_intel)
    print(f"Action: {decision.action}")
    print(f"Risk Score: {decision.risk_score}/100")
    print(f"Reasoning: {decision.reasoning}")
    print(f"Playbook: {decision.recommended_playbook}")