The Fine Print

from pydantic import BaseModel, Field
from langchain_openai import ChatOpenAI
class EDRTuningRecommendation(BaseModel):
    should_whitelist: bool
    whitelist_scope: str = Field(description="GLOBAL_HASH, PATH_AND_HASH, or DO_NOT_WHITELIST")
    justification: str
def evaluate_edr_false_positive(process_path: str, binary_hash: str, is_digitally_signed: bool, signer_name: str, change_ticket_id: str) -> EDRTuningRecommendation:
    llm = ChatOpenAI(model="gpt-4o", temperature=0)
    structured_llm = llm.with_structured_output(EDRTuningRecommendation)
    prompt = f"""
Evaluate EDR Block Event for False Positive Exclusion:
Process Path: {process_path}
Hash: {binary_hash}
Signed: {is_digitally_signed} (Signer: {signer_name})
Associated ITSM Ticket: {change_ticket_id}
Determine if this process is a legitimate IT operation that should be whitelisted.
"""
    return structured_llm.invoke(prompt)
if __name__ == "__main__":
    res = evaluate_edr_false_positive(
        process_path="C:\\Program Files\\InternalIT\\DeployAgent.exe",
        binary_hash="e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
        is_digitally_signed=True,
        signer_name="Acme Corporation Inc",
        change_ticket_id="CHG-90912"
    )
    print(f"Whitelist Decision: {res.should_whitelist}")
    print(f"Scope: {res.whitelist_scope}")
    print(f"Justification: {res.justification}")