The Fine Print

import os
from crewai import Agent, Task, Crew, Process
from langchain_openai import ChatOpenAI
# Ensure OPENAI_API_KEY is set in the environment
llm = ChatOpenAI(model="gpt-4-turbo", temperature=0)
# Define the Swarm Agents
network_agent = Agent(
    role='Network Security Analyst',
    goal='Analyze network telemetry and firewall logs to identify lateral movement or exfiltration.',
    backstory='Expert in packet analysis and network flow anomalies. You spot what hides in the wire.',
    verbose=True,
    allow_delegation=False,
    llm=llm
)
endpoint_agent = Agent(
    role='Endpoint Detection Specialist',
    goal='Analyze EDR alerts and process trees for malicious execution.',
    backstory='Deep Windows/Linux internals expert. You reverse engineer malware execution paths.',
    verbose=True,
    allow_delegation=False,
    llm=llm
)
coordinator_agent = Agent(
    role='SOC Incident Commander',
    goal='Synthesize domain-specific findings into a unified, chronological attack narrative.',
    backstory='Veteran Incident Responder. You see the big picture and direct the defense.',
    verbose=True,
    allow_delegation=True,
    llm=llm
)
# Simulated Incident Data
incident_data = """
10:01 AM - Network: Large outbound transfer (4GB) to unknown IP 198.51.100.44 over port 443.
10:02 AM - Endpoint: PowerShell execution with encoded command on Server-DB-01.
10:05 AM - Endpoint: Process 'vssadmin.exe delete shadows' executed.
"""
# Define Tasks for the Swarm
network_task = Task(
    description=f'Extract network IOCs and assess exfiltration risk from: {incident_data}',
    expected_output='A bulleted list of network IOCs and risk assessment.',
    agent=network_agent
)
endpoint_task = Task(
    description=f'Analyze process execution and assess ransomware/malware risk from: {incident_data}',
    expected_output='A detailed process tree analysis and threat classification.',
    agent=endpoint_agent
)
synthesis_task = Task(
    description='Combine the network and endpoint reports into a final MITRE ATT&CK mapped executive summary.',
    expected_output='A final incident report with MITRE tactics, timeline, and critical severity score.',
    agent=coordinator_agent,
    context=[network_task, endpoint_task]
)
# Instantiate and run the Swarm
soc_swarm = Crew(
    agents=[network_agent, endpoint_agent, coordinator_agent],
    tasks=[network_task, endpoint_task, synthesis_task],
    process=Process.sequential # In production, Process.hierarchical can be used for dynamic delegation
)
if __name__ == "__main__":
    print("Initiating SOC Swarm Analysis...")
    result = soc_swarm.kickoff()
    print("\n--- Final Swarm Report ---\n")
    print(result)